xmrig | 9e83d6862fc84d28b67d661496f8f80d0d3f1ffb6323cf0bdd34854ad05a6144

Analysis

max time kernel
124s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
Size

2.1MB
MD5

2ec1c5ff491233da88ca6dc7a56a5080
SHA1

46adbccea7ef7cfe9bcbae243ee700f8d84aa4b0
SHA256

9e83d6862fc84d28b67d661496f8f80d0d3f1ffb6323cf0bdd34854ad05a6144
SHA512

1c26a46278884fc4bdda01d3fc78460b6b0bda5cf84c0892944f7105e8b132476ee2c438e974c04e68de43ea270b7c52490b5cd7ec791ddb9e326ad527be8bf5
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIRMmSdtMk+Fy:GemTLkNdfE0pZaa

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000700000002328e-4.dat	xmrig
behavioral2/files/0x00070000000233fa-7.dat	xmrig
behavioral2/files/0x00090000000233f3-10.dat	xmrig
behavioral2/files/0x00070000000233fb-18.dat	xmrig
behavioral2/files/0x00070000000233fd-29.dat	xmrig
behavioral2/files/0x00070000000233fe-32.dat	xmrig
behavioral2/files/0x00070000000233ff-46.dat	xmrig
behavioral2/files/0x0007000000023401-52.dat	xmrig
behavioral2/files/0x0007000000023407-75.dat	xmrig
behavioral2/files/0x0007000000023409-87.dat	xmrig
behavioral2/files/0x000700000002340c-97.dat	xmrig
behavioral2/files/0x000700000002340b-96.dat	xmrig
behavioral2/files/0x000700000002340a-95.dat	xmrig
behavioral2/files/0x0007000000023408-93.dat	xmrig
behavioral2/files/0x0007000000023406-84.dat	xmrig
behavioral2/files/0x0007000000023405-80.dat	xmrig
behavioral2/files/0x0007000000023404-78.dat	xmrig
behavioral2/files/0x0007000000023403-60.dat	xmrig
behavioral2/files/0x0007000000023402-58.dat	xmrig
behavioral2/files/0x0007000000023400-50.dat	xmrig
behavioral2/files/0x00070000000233fc-25.dat	xmrig
behavioral2/files/0x000700000002340e-109.dat	xmrig
behavioral2/files/0x00080000000233f7-115.dat	xmrig
behavioral2/files/0x000700000002340f-120.dat	xmrig
behavioral2/files/0x0007000000023411-124.dat	xmrig
behavioral2/files/0x0007000000023412-128.dat	xmrig
behavioral2/files/0x0007000000023413-137.dat	xmrig
behavioral2/files/0x0007000000023414-139.dat	xmrig
behavioral2/files/0x0007000000023416-153.dat	xmrig
behavioral2/files/0x0007000000023418-158.dat	xmrig
behavioral2/files/0x0007000000023417-160.dat	xmrig
behavioral2/files/0x0007000000023419-159.dat	xmrig
behavioral2/files/0x0007000000023415-145.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2808	wKpReYP.exe
2540	fdxRfYM.exe
3984	uKmtSKJ.exe
1968	CWtUlIk.exe
4368	eKkPGMd.exe
1788	vBWJOOo.exe
3260	rWNsAkQ.exe
3220	IFZtMRK.exe
4980	OlgROqW.exe
4084	tFNuamU.exe
2576	ciQiimm.exe
964	KDESFZj.exe
2568	hOgtUHI.exe
2516	oYMIbSY.exe
3328	JBvuxtO.exe
2856	kUnlcTy.exe
1704	FSFAepW.exe
2480	dVeQKoD.exe
8	DbrcoHX.exe
1896	UKedMoz.exe
4564	wRdzKzN.exe
624	FeOHTMs.exe
4896	SEoRTvP.exe
5116	MqSsXqB.exe
1756	CnuwwZc.exe
884	KHFUTAw.exe
3628	RasVWsC.exe
1724	ZwglFfk.exe
3656	VSMErdX.exe
4212	aTufcih.exe
5104	Ufxyjcf.exe
3576	tjmAuNs.exe
3264	UtRqoDd.exe
4360	ZJDIgUU.exe
1532	EAbjciq.exe
5076	wVhzkkU.exe
2628	MGdfari.exe
1608	PRaixdz.exe
4164	eWrDDwE.exe
4796	fbUTnuc.exe
4344	HvFpuyn.exe
1948	rTmArcg.exe
1204	igLSTTt.exe
4640	bnvTUAJ.exe
2104	eSdFWHJ.exe
3776	pEMVaAl.exe
1876	YNPpdRT.exe
1612	FipupGT.exe
4676	NaVEbXI.exe
1632	iwciuNZ.exe
3580	qlpmBdC.exe
1392	rfyYPsB.exe
4012	QOlsMAr.exe
3020	EqJXWCf.exe
4724	NKRpWEc.exe
4512	nTJdVgh.exe
3352	OScfqVr.exe
4784	VMduAMo.exe
1936	SPBpBxJ.exe
3216	QAEeGey.exe
1908	JFZvwOW.exe
1460	HKlmXJL.exe
3792	zjwcSys.exe
1276	JyQuxOe.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rTmArcg.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\DqzggCT.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\SvuIBhA.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\uIfmFLY.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\Jtaomts.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\CBwWVis.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\XIMWldI.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\OScfqVr.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\zGKEdFD.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\dqVWHmP.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\xpXJGZu.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\yTTIJPa.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\dBKiDWY.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\AoeZHhu.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\mjGeEqH.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\AaxljMe.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\oDmGdlT.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\hjdtHQv.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\HErNmZC.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\cQvsoav.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\BJoFsHc.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\DJyayGO.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\JUCAPnP.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\XQbSRbH.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\QNDzJIX.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\ZmXYaAE.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\nkMkRyx.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\stzVKKU.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\gASuZJV.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\FwBdgfk.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\CIrEWVi.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\aLHjJlg.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\ChWpbrj.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\otkDqji.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\ymwJhRC.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\UBpqxOC.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\bafeUcM.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\iHzutqj.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\GynSFBW.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\thLWnpM.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\KpXobCn.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\pOffbBr.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\YpXagXC.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\FWsdqrV.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\cPMFFMA.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\RPitTXW.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\NXJpQDI.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\EojrNkN.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\VAcLnZu.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\WBzzcDY.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\rCiQyqW.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\dVmXZIK.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\emdqQgc.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\GYloaaC.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\VNnRrGy.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\CdrpHtV.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\gbnmxYI.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\awEDNYs.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\sQqfSOB.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\ByBqJNu.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\hRvNmEr.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\SkSeqPJ.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\KKhqUKz.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
File created	C:\Windows\System\rfyYPsB.exe	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
16668	WerFaultSecure.exe
16668	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16512	dwm.exe
Token: SeChangeNotifyPrivilege	16512	dwm.exe
Token: 33	16512	dwm.exe
Token: SeIncBasePriorityPrivilege	16512	dwm.exe
Token: SeShutdownPrivilege	16512	dwm.exe
Token: SeCreatePagefilePrivilege	16512	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 2808	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	84
PID 5000 wrote to memory of 2808	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	84
PID 5000 wrote to memory of 2540	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	85
PID 5000 wrote to memory of 2540	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	85
PID 5000 wrote to memory of 3984	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	86
PID 5000 wrote to memory of 3984	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	86
PID 5000 wrote to memory of 1968	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	87
PID 5000 wrote to memory of 1968	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	87
PID 5000 wrote to memory of 4368	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	88
PID 5000 wrote to memory of 4368	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	88
PID 5000 wrote to memory of 1788	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	89
PID 5000 wrote to memory of 1788	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	89
PID 5000 wrote to memory of 3260	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	90
PID 5000 wrote to memory of 3260	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	90
PID 5000 wrote to memory of 3220	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	91
PID 5000 wrote to memory of 3220	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	91
PID 5000 wrote to memory of 4980	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	92
PID 5000 wrote to memory of 4980	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	92
PID 5000 wrote to memory of 4084	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	93
PID 5000 wrote to memory of 4084	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	93
PID 5000 wrote to memory of 2576	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	94
PID 5000 wrote to memory of 2576	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	94
PID 5000 wrote to memory of 964	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	95
PID 5000 wrote to memory of 964	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	95
PID 5000 wrote to memory of 2568	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	96
PID 5000 wrote to memory of 2568	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	96
PID 5000 wrote to memory of 2516	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	97
PID 5000 wrote to memory of 2516	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	97
PID 5000 wrote to memory of 3328	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	98
PID 5000 wrote to memory of 3328	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	98
PID 5000 wrote to memory of 2856	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	99
PID 5000 wrote to memory of 2856	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	99
PID 5000 wrote to memory of 1704	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	100
PID 5000 wrote to memory of 1704	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	100
PID 5000 wrote to memory of 2480	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	101
PID 5000 wrote to memory of 2480	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	101
PID 5000 wrote to memory of 8	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	102
PID 5000 wrote to memory of 8	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	102
PID 5000 wrote to memory of 1896	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	103
PID 5000 wrote to memory of 1896	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	103
PID 5000 wrote to memory of 4564	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	104
PID 5000 wrote to memory of 4564	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	104
PID 5000 wrote to memory of 624	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	105
PID 5000 wrote to memory of 624	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	105
PID 5000 wrote to memory of 4896	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	106
PID 5000 wrote to memory of 4896	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	106
PID 5000 wrote to memory of 5116	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	107
PID 5000 wrote to memory of 5116	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	107
PID 5000 wrote to memory of 1756	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	109
PID 5000 wrote to memory of 1756	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	109
PID 5000 wrote to memory of 884	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	110
PID 5000 wrote to memory of 884	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	110
PID 5000 wrote to memory of 3628	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	111
PID 5000 wrote to memory of 3628	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	111
PID 5000 wrote to memory of 1724	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	112
PID 5000 wrote to memory of 1724	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	112
PID 5000 wrote to memory of 3656	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	113
PID 5000 wrote to memory of 3656	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	113
PID 5000 wrote to memory of 4212	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	114
PID 5000 wrote to memory of 4212	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	114
PID 5000 wrote to memory of 5104	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	115
PID 5000 wrote to memory of 5104	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	115
PID 5000 wrote to memory of 3576	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	116
PID 5000 wrote to memory of 3576	5000	2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2ec1c5ff491233da88ca6dc7a56a5080_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\System\wKpReYP.exe
  C:\Windows\System\wKpReYP.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\fdxRfYM.exe
  C:\Windows\System\fdxRfYM.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\uKmtSKJ.exe
  C:\Windows\System\uKmtSKJ.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\CWtUlIk.exe
  C:\Windows\System\CWtUlIk.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\eKkPGMd.exe
  C:\Windows\System\eKkPGMd.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\vBWJOOo.exe
  C:\Windows\System\vBWJOOo.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\rWNsAkQ.exe
  C:\Windows\System\rWNsAkQ.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\IFZtMRK.exe
  C:\Windows\System\IFZtMRK.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\OlgROqW.exe
  C:\Windows\System\OlgROqW.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\tFNuamU.exe
  C:\Windows\System\tFNuamU.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\ciQiimm.exe
  C:\Windows\System\ciQiimm.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\KDESFZj.exe
  C:\Windows\System\KDESFZj.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\hOgtUHI.exe
  C:\Windows\System\hOgtUHI.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\oYMIbSY.exe
  C:\Windows\System\oYMIbSY.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\JBvuxtO.exe
  C:\Windows\System\JBvuxtO.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\kUnlcTy.exe
  C:\Windows\System\kUnlcTy.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\FSFAepW.exe
  C:\Windows\System\FSFAepW.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\dVeQKoD.exe
  C:\Windows\System\dVeQKoD.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\DbrcoHX.exe
  C:\Windows\System\DbrcoHX.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\UKedMoz.exe
  C:\Windows\System\UKedMoz.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\wRdzKzN.exe
  C:\Windows\System\wRdzKzN.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\FeOHTMs.exe
  C:\Windows\System\FeOHTMs.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\SEoRTvP.exe
  C:\Windows\System\SEoRTvP.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\MqSsXqB.exe
  C:\Windows\System\MqSsXqB.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\CnuwwZc.exe
  C:\Windows\System\CnuwwZc.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\KHFUTAw.exe
  C:\Windows\System\KHFUTAw.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\RasVWsC.exe
  C:\Windows\System\RasVWsC.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\ZwglFfk.exe
  C:\Windows\System\ZwglFfk.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\VSMErdX.exe
  C:\Windows\System\VSMErdX.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\aTufcih.exe
  C:\Windows\System\aTufcih.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\Ufxyjcf.exe
  C:\Windows\System\Ufxyjcf.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\tjmAuNs.exe
  C:\Windows\System\tjmAuNs.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\UtRqoDd.exe
  C:\Windows\System\UtRqoDd.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\ZJDIgUU.exe
  C:\Windows\System\ZJDIgUU.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\EAbjciq.exe
  C:\Windows\System\EAbjciq.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\wVhzkkU.exe
  C:\Windows\System\wVhzkkU.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\MGdfari.exe
  C:\Windows\System\MGdfari.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\PRaixdz.exe
  C:\Windows\System\PRaixdz.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\eWrDDwE.exe
  C:\Windows\System\eWrDDwE.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\fbUTnuc.exe
  C:\Windows\System\fbUTnuc.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\HvFpuyn.exe
  C:\Windows\System\HvFpuyn.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\rTmArcg.exe
  C:\Windows\System\rTmArcg.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\igLSTTt.exe
  C:\Windows\System\igLSTTt.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\bnvTUAJ.exe
  C:\Windows\System\bnvTUAJ.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\eSdFWHJ.exe
  C:\Windows\System\eSdFWHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\pEMVaAl.exe
  C:\Windows\System\pEMVaAl.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\YNPpdRT.exe
  C:\Windows\System\YNPpdRT.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\FipupGT.exe
  C:\Windows\System\FipupGT.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\NaVEbXI.exe
  C:\Windows\System\NaVEbXI.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\iwciuNZ.exe
  C:\Windows\System\iwciuNZ.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\qlpmBdC.exe
  C:\Windows\System\qlpmBdC.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\rfyYPsB.exe
  C:\Windows\System\rfyYPsB.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\QOlsMAr.exe
  C:\Windows\System\QOlsMAr.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\EqJXWCf.exe
  C:\Windows\System\EqJXWCf.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\NKRpWEc.exe
  C:\Windows\System\NKRpWEc.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\nTJdVgh.exe
  C:\Windows\System\nTJdVgh.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\OScfqVr.exe
  C:\Windows\System\OScfqVr.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\VMduAMo.exe
  C:\Windows\System\VMduAMo.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\SPBpBxJ.exe
  C:\Windows\System\SPBpBxJ.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\QAEeGey.exe
  C:\Windows\System\QAEeGey.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\JFZvwOW.exe
  C:\Windows\System\JFZvwOW.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\HKlmXJL.exe
  C:\Windows\System\HKlmXJL.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\zjwcSys.exe
  C:\Windows\System\zjwcSys.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\JyQuxOe.exe
  C:\Windows\System\JyQuxOe.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\ZSIZckU.exe
  C:\Windows\System\ZSIZckU.exe
  2⤵
  PID:4824
- C:\Windows\System\ewiGLKZ.exe
  C:\Windows\System\ewiGLKZ.exe
  2⤵
  PID:1920
- C:\Windows\System\KRxgUhK.exe
  C:\Windows\System\KRxgUhK.exe
  2⤵
  PID:3692
- C:\Windows\System\iGUxGLL.exe
  C:\Windows\System\iGUxGLL.exe
  2⤵
  PID:380
- C:\Windows\System\QoOdzEy.exe
  C:\Windows\System\QoOdzEy.exe
  2⤵
  PID:4500
- C:\Windows\System\XmlFJWL.exe
  C:\Windows\System\XmlFJWL.exe
  2⤵
  PID:1044
- C:\Windows\System\JKfbptV.exe
  C:\Windows\System\JKfbptV.exe
  2⤵
  PID:1784
- C:\Windows\System\MxHFvkU.exe
  C:\Windows\System\MxHFvkU.exe
  2⤵
  PID:2796
- C:\Windows\System\fLtsIGe.exe
  C:\Windows\System\fLtsIGe.exe
  2⤵
  PID:1472
- C:\Windows\System\lJWOFKN.exe
  C:\Windows\System\lJWOFKN.exe
  2⤵
  PID:400
- C:\Windows\System\rbeAyxK.exe
  C:\Windows\System\rbeAyxK.exe
  2⤵
  PID:3492
- C:\Windows\System\bLwLaxB.exe
  C:\Windows\System\bLwLaxB.exe
  2⤵
  PID:2344
- C:\Windows\System\StXbyOT.exe
  C:\Windows\System\StXbyOT.exe
  2⤵
  PID:2964
- C:\Windows\System\oyoqVRA.exe
  C:\Windows\System\oyoqVRA.exe
  2⤵
  PID:4392
- C:\Windows\System\SEsJTtc.exe
  C:\Windows\System\SEsJTtc.exe
  2⤵
  PID:5056
- C:\Windows\System\KEBrIEu.exe
  C:\Windows\System\KEBrIEu.exe
  2⤵
  PID:1796
- C:\Windows\System\cJdBVhp.exe
  C:\Windows\System\cJdBVhp.exe
  2⤵
  PID:4216
- C:\Windows\System\VrqaRCR.exe
  C:\Windows\System\VrqaRCR.exe
  2⤵
  PID:1004
- C:\Windows\System\lcqxqvX.exe
  C:\Windows\System\lcqxqvX.exe
  2⤵
  PID:4324
- C:\Windows\System\RvPrbkm.exe
  C:\Windows\System\RvPrbkm.exe
  2⤵
  PID:4984
- C:\Windows\System\ymwJhRC.exe
  C:\Windows\System\ymwJhRC.exe
  2⤵
  PID:4400
- C:\Windows\System\aySTjYN.exe
  C:\Windows\System\aySTjYN.exe
  2⤵
  PID:620
- C:\Windows\System\zHWRRdM.exe
  C:\Windows\System\zHWRRdM.exe
  2⤵
  PID:1352
- C:\Windows\System\tGKdRhE.exe
  C:\Windows\System\tGKdRhE.exe
  2⤵
  PID:4804
- C:\Windows\System\CdgsXBb.exe
  C:\Windows\System\CdgsXBb.exe
  2⤵
  PID:2488
- C:\Windows\System\avVuGNc.exe
  C:\Windows\System\avVuGNc.exe
  2⤵
  PID:760
- C:\Windows\System\GvxpqTV.exe
  C:\Windows\System\GvxpqTV.exe
  2⤵
  PID:4484
- C:\Windows\System\QUlLvci.exe
  C:\Windows\System\QUlLvci.exe
  2⤵
  PID:1396
- C:\Windows\System\GEeLEYT.exe
  C:\Windows\System\GEeLEYT.exe
  2⤵
  PID:5164
- C:\Windows\System\JdDegpe.exe
  C:\Windows\System\JdDegpe.exe
  2⤵
  PID:5184
- C:\Windows\System\DVeFlrH.exe
  C:\Windows\System\DVeFlrH.exe
  2⤵
  PID:5208
- C:\Windows\System\iNKGMNH.exe
  C:\Windows\System\iNKGMNH.exe
  2⤵
  PID:5248
- C:\Windows\System\jdyAQbs.exe
  C:\Windows\System\jdyAQbs.exe
  2⤵
  PID:5268
- C:\Windows\System\aVTorLC.exe
  C:\Windows\System\aVTorLC.exe
  2⤵
  PID:5296
- C:\Windows\System\bQEgFqv.exe
  C:\Windows\System\bQEgFqv.exe
  2⤵
  PID:5328
- C:\Windows\System\ChWpbrj.exe
  C:\Windows\System\ChWpbrj.exe
  2⤵
  PID:5364
- C:\Windows\System\vfPSxex.exe
  C:\Windows\System\vfPSxex.exe
  2⤵
  PID:5388
- C:\Windows\System\AGLYvmR.exe
  C:\Windows\System\AGLYvmR.exe
  2⤵
  PID:5416
- C:\Windows\System\EHMpgHe.exe
  C:\Windows\System\EHMpgHe.exe
  2⤵
  PID:5444
- C:\Windows\System\GYVSWXu.exe
  C:\Windows\System\GYVSWXu.exe
  2⤵
  PID:5460
- C:\Windows\System\MGSQNVs.exe
  C:\Windows\System\MGSQNVs.exe
  2⤵
  PID:5504
- C:\Windows\System\HVQBrcg.exe
  C:\Windows\System\HVQBrcg.exe
  2⤵
  PID:5528
- C:\Windows\System\WbxlNlX.exe
  C:\Windows\System\WbxlNlX.exe
  2⤵
  PID:5544
- C:\Windows\System\fwHQtDY.exe
  C:\Windows\System\fwHQtDY.exe
  2⤵
  PID:5576
- C:\Windows\System\auzVwAp.exe
  C:\Windows\System\auzVwAp.exe
  2⤵
  PID:5612
- C:\Windows\System\kjoTNyy.exe
  C:\Windows\System\kjoTNyy.exe
  2⤵
  PID:5640
- C:\Windows\System\nIGOuFs.exe
  C:\Windows\System\nIGOuFs.exe
  2⤵
  PID:5672
- C:\Windows\System\fJcdKKt.exe
  C:\Windows\System\fJcdKKt.exe
  2⤵
  PID:5704
- C:\Windows\System\pwCacyW.exe
  C:\Windows\System\pwCacyW.exe
  2⤵
  PID:5736
- C:\Windows\System\gDrvIYr.exe
  C:\Windows\System\gDrvIYr.exe
  2⤵
  PID:5764
- C:\Windows\System\maPWPSa.exe
  C:\Windows\System\maPWPSa.exe
  2⤵
  PID:5792
- C:\Windows\System\FTJwNNk.exe
  C:\Windows\System\FTJwNNk.exe
  2⤵
  PID:5820
- C:\Windows\System\ThVCxCV.exe
  C:\Windows\System\ThVCxCV.exe
  2⤵
  PID:5836
- C:\Windows\System\DqzggCT.exe
  C:\Windows\System\DqzggCT.exe
  2⤵
  PID:5852
- C:\Windows\System\uzPggsu.exe
  C:\Windows\System\uzPggsu.exe
  2⤵
  PID:5868
- C:\Windows\System\SnQAHcH.exe
  C:\Windows\System\SnQAHcH.exe
  2⤵
  PID:5892
- C:\Windows\System\uhGbyrY.exe
  C:\Windows\System\uhGbyrY.exe
  2⤵
  PID:5924
- C:\Windows\System\KLecFBa.exe
  C:\Windows\System\KLecFBa.exe
  2⤵
  PID:5952
- C:\Windows\System\zOHqawC.exe
  C:\Windows\System\zOHqawC.exe
  2⤵
  PID:5968
- C:\Windows\System\PBxUoRw.exe
  C:\Windows\System\PBxUoRw.exe
  2⤵
  PID:6008
- C:\Windows\System\dvSopai.exe
  C:\Windows\System\dvSopai.exe
  2⤵
  PID:6048
- C:\Windows\System\Jpukvbp.exe
  C:\Windows\System\Jpukvbp.exe
  2⤵
  PID:6080
- C:\Windows\System\MNvFsFQ.exe
  C:\Windows\System\MNvFsFQ.exe
  2⤵
  PID:6116
- C:\Windows\System\auVNMJU.exe
  C:\Windows\System\auVNMJU.exe
  2⤵
  PID:6136
- C:\Windows\System\hpEqMsX.exe
  C:\Windows\System\hpEqMsX.exe
  2⤵
  PID:5088
- C:\Windows\System\yQaFyXi.exe
  C:\Windows\System\yQaFyXi.exe
  2⤵
  PID:5232
- C:\Windows\System\PBFQgar.exe
  C:\Windows\System\PBFQgar.exe
  2⤵
  PID:5280
- C:\Windows\System\WNXhEKg.exe
  C:\Windows\System\WNXhEKg.exe
  2⤵
  PID:5312
- C:\Windows\System\wPVabyu.exe
  C:\Windows\System\wPVabyu.exe
  2⤵
  PID:5400
- C:\Windows\System\ajIFxHw.exe
  C:\Windows\System\ajIFxHw.exe
  2⤵
  PID:5456
- C:\Windows\System\eQghuXc.exe
  C:\Windows\System\eQghuXc.exe
  2⤵
  PID:5540
- C:\Windows\System\eGrPyem.exe
  C:\Windows\System\eGrPyem.exe
  2⤵
  PID:5628
- C:\Windows\System\DUODfrA.exe
  C:\Windows\System\DUODfrA.exe
  2⤵
  PID:5696
- C:\Windows\System\FRgYXSj.exe
  C:\Windows\System\FRgYXSj.exe
  2⤵
  PID:5776
- C:\Windows\System\fRtNJOr.exe
  C:\Windows\System\fRtNJOr.exe
  2⤵
  PID:5844
- C:\Windows\System\LRYXryp.exe
  C:\Windows\System\LRYXryp.exe
  2⤵
  PID:5888
- C:\Windows\System\dJMDAEn.exe
  C:\Windows\System\dJMDAEn.exe
  2⤵
  PID:60
- C:\Windows\System\HXAMgGj.exe
  C:\Windows\System\HXAMgGj.exe
  2⤵
  PID:6040
- C:\Windows\System\SnVgLxE.exe
  C:\Windows\System\SnVgLxE.exe
  2⤵
  PID:6092
- C:\Windows\System\VFSIXYF.exe
  C:\Windows\System\VFSIXYF.exe
  2⤵
  PID:6128
- C:\Windows\System\mzEFEsT.exe
  C:\Windows\System\mzEFEsT.exe
  2⤵
  PID:5288
- C:\Windows\System\JbIFOmz.exe
  C:\Windows\System\JbIFOmz.exe
  2⤵
  PID:5380
- C:\Windows\System\otnYcSj.exe
  C:\Windows\System\otnYcSj.exe
  2⤵
  PID:5432
- C:\Windows\System\sHwOQJw.exe
  C:\Windows\System\sHwOQJw.exe
  2⤵
  PID:5524
- C:\Windows\System\BflYnXG.exe
  C:\Windows\System\BflYnXG.exe
  2⤵
  PID:5720
- C:\Windows\System\XxdTPMZ.exe
  C:\Windows\System\XxdTPMZ.exe
  2⤵
  PID:5936
- C:\Windows\System\fxVogLO.exe
  C:\Windows\System\fxVogLO.exe
  2⤵
  PID:6060
- C:\Windows\System\fiJXjqr.exe
  C:\Windows\System\fiJXjqr.exe
  2⤵
  PID:5340
- C:\Windows\System\BuaAoqx.exe
  C:\Windows\System\BuaAoqx.exe
  2⤵
  PID:5828
- C:\Windows\System\MvXFkxP.exe
  C:\Windows\System\MvXFkxP.exe
  2⤵
  PID:5152
- C:\Windows\System\bdPjpNk.exe
  C:\Windows\System\bdPjpNk.exe
  2⤵
  PID:5784
- C:\Windows\System\XyikmFV.exe
  C:\Windows\System\XyikmFV.exe
  2⤵
  PID:6168
- C:\Windows\System\JrpHNZg.exe
  C:\Windows\System\JrpHNZg.exe
  2⤵
  PID:6196
- C:\Windows\System\GaApgyY.exe
  C:\Windows\System\GaApgyY.exe
  2⤵
  PID:6220
- C:\Windows\System\FSjoRiC.exe
  C:\Windows\System\FSjoRiC.exe
  2⤵
  PID:6244
- C:\Windows\System\sVAapfz.exe
  C:\Windows\System\sVAapfz.exe
  2⤵
  PID:6276
- C:\Windows\System\cvsCWYa.exe
  C:\Windows\System\cvsCWYa.exe
  2⤵
  PID:6300
- C:\Windows\System\uhuuKhP.exe
  C:\Windows\System\uhuuKhP.exe
  2⤵
  PID:6324
- C:\Windows\System\awEDNYs.exe
  C:\Windows\System\awEDNYs.exe
  2⤵
  PID:6356
- C:\Windows\System\TDDgIXH.exe
  C:\Windows\System\TDDgIXH.exe
  2⤵
  PID:6372
- C:\Windows\System\LwEnyAn.exe
  C:\Windows\System\LwEnyAn.exe
  2⤵
  PID:6400
- C:\Windows\System\NlAZiDA.exe
  C:\Windows\System\NlAZiDA.exe
  2⤵
  PID:6440
- C:\Windows\System\daqLGry.exe
  C:\Windows\System\daqLGry.exe
  2⤵
  PID:6468
- C:\Windows\System\CBwWVis.exe
  C:\Windows\System\CBwWVis.exe
  2⤵
  PID:6488
- C:\Windows\System\QNDzJIX.exe
  C:\Windows\System\QNDzJIX.exe
  2⤵
  PID:6524
- C:\Windows\System\YkPXjfb.exe
  C:\Windows\System\YkPXjfb.exe
  2⤵
  PID:6560
- C:\Windows\System\vUpjOFi.exe
  C:\Windows\System\vUpjOFi.exe
  2⤵
  PID:6580
- C:\Windows\System\uUDlHrd.exe
  C:\Windows\System\uUDlHrd.exe
  2⤵
  PID:6600
- C:\Windows\System\LyTUCPc.exe
  C:\Windows\System\LyTUCPc.exe
  2⤵
  PID:6624
- C:\Windows\System\PWEcQMG.exe
  C:\Windows\System\PWEcQMG.exe
  2⤵
  PID:6656
- C:\Windows\System\NWBzgtn.exe
  C:\Windows\System\NWBzgtn.exe
  2⤵
  PID:6692
- C:\Windows\System\bkCGzaP.exe
  C:\Windows\System\bkCGzaP.exe
  2⤵
  PID:6712
- C:\Windows\System\dlvwiKT.exe
  C:\Windows\System\dlvwiKT.exe
  2⤵
  PID:6736
- C:\Windows\System\kGElRqu.exe
  C:\Windows\System\kGElRqu.exe
  2⤵
  PID:6772
- C:\Windows\System\ksfXIya.exe
  C:\Windows\System\ksfXIya.exe
  2⤵
  PID:6804
- C:\Windows\System\KeoAkdd.exe
  C:\Windows\System\KeoAkdd.exe
  2⤵
  PID:6836
- C:\Windows\System\DUXLAXk.exe
  C:\Windows\System\DUXLAXk.exe
  2⤵
  PID:6868
- C:\Windows\System\ioEOjmW.exe
  C:\Windows\System\ioEOjmW.exe
  2⤵
  PID:6888
- C:\Windows\System\uuiXwcR.exe
  C:\Windows\System\uuiXwcR.exe
  2⤵
  PID:6920
- C:\Windows\System\arOBYzH.exe
  C:\Windows\System\arOBYzH.exe
  2⤵
  PID:6948
- C:\Windows\System\tjEfvPe.exe
  C:\Windows\System\tjEfvPe.exe
  2⤵
  PID:6988
- C:\Windows\System\QNtccUQ.exe
  C:\Windows\System\QNtccUQ.exe
  2⤵
  PID:7016
- C:\Windows\System\hbfJWpO.exe
  C:\Windows\System\hbfJWpO.exe
  2⤵
  PID:7040
- C:\Windows\System\RpntYsp.exe
  C:\Windows\System\RpntYsp.exe
  2⤵
  PID:7064
- C:\Windows\System\SXgnxZL.exe
  C:\Windows\System\SXgnxZL.exe
  2⤵
  PID:7100
- C:\Windows\System\HLcLQOM.exe
  C:\Windows\System\HLcLQOM.exe
  2⤵
  PID:7116
- C:\Windows\System\PhLyadC.exe
  C:\Windows\System\PhLyadC.exe
  2⤵
  PID:7132
- C:\Windows\System\pkYVLHe.exe
  C:\Windows\System\pkYVLHe.exe
  2⤵
  PID:7152
- C:\Windows\System\kXDKQao.exe
  C:\Windows\System\kXDKQao.exe
  2⤵
  PID:5688
- C:\Windows\System\AtHeous.exe
  C:\Windows\System\AtHeous.exe
  2⤵
  PID:6180
- C:\Windows\System\NhIVgaE.exe
  C:\Windows\System\NhIVgaE.exe
  2⤵
  PID:6240
- C:\Windows\System\MGqtLic.exe
  C:\Windows\System\MGqtLic.exe
  2⤵
  PID:6316
- C:\Windows\System\BnrXKbT.exe
  C:\Windows\System\BnrXKbT.exe
  2⤵
  PID:6412
- C:\Windows\System\lRzZOhz.exe
  C:\Windows\System\lRzZOhz.exe
  2⤵
  PID:6476
- C:\Windows\System\vFubFxl.exe
  C:\Windows\System\vFubFxl.exe
  2⤵
  PID:6568
- C:\Windows\System\QsdyXeU.exe
  C:\Windows\System\QsdyXeU.exe
  2⤵
  PID:6616
- C:\Windows\System\jUziHAE.exe
  C:\Windows\System\jUziHAE.exe
  2⤵
  PID:6720
- C:\Windows\System\iCdrVXV.exe
  C:\Windows\System\iCdrVXV.exe
  2⤵
  PID:6796
- C:\Windows\System\xXmzLag.exe
  C:\Windows\System\xXmzLag.exe
  2⤵
  PID:6844
- C:\Windows\System\lWYMyAn.exe
  C:\Windows\System\lWYMyAn.exe
  2⤵
  PID:6912
- C:\Windows\System\wVPgxgy.exe
  C:\Windows\System\wVPgxgy.exe
  2⤵
  PID:6964
- C:\Windows\System\kjoxhuc.exe
  C:\Windows\System\kjoxhuc.exe
  2⤵
  PID:6208
- C:\Windows\System\hoOzrtu.exe
  C:\Windows\System\hoOzrtu.exe
  2⤵
  PID:6268
- C:\Windows\System\lTMJpTN.exe
  C:\Windows\System\lTMJpTN.exe
  2⤵
  PID:6364
- C:\Windows\System\yLwFtJi.exe
  C:\Windows\System\yLwFtJi.exe
  2⤵
  PID:6428
- C:\Windows\System\rmEmvdO.exe
  C:\Windows\System\rmEmvdO.exe
  2⤵
  PID:6576
- C:\Windows\System\FWfggTD.exe
  C:\Windows\System\FWfggTD.exe
  2⤵
  PID:6864
- C:\Windows\System\yFJEJCs.exe
  C:\Windows\System\yFJEJCs.exe
  2⤵
  PID:6932
- C:\Windows\System\RYwuQPb.exe
  C:\Windows\System\RYwuQPb.exe
  2⤵
  PID:7012
- C:\Windows\System\nasmdwy.exe
  C:\Windows\System\nasmdwy.exe
  2⤵
  PID:6212
- C:\Windows\System\CmrLUtP.exe
  C:\Windows\System\CmrLUtP.exe
  2⤵
  PID:6500
- C:\Windows\System\lLNKDfy.exe
  C:\Windows\System\lLNKDfy.exe
  2⤵
  PID:7000
- C:\Windows\System\cVFMZkU.exe
  C:\Windows\System\cVFMZkU.exe
  2⤵
  PID:6816
- C:\Windows\System\PVjKRQP.exe
  C:\Windows\System\PVjKRQP.exe
  2⤵
  PID:7188
- C:\Windows\System\qvknHdy.exe
  C:\Windows\System\qvknHdy.exe
  2⤵
  PID:7224
- C:\Windows\System\UKQairb.exe
  C:\Windows\System\UKQairb.exe
  2⤵
  PID:7264
- C:\Windows\System\MLDgQZE.exe
  C:\Windows\System\MLDgQZE.exe
  2⤵
  PID:7300
- C:\Windows\System\fKtLNPo.exe
  C:\Windows\System\fKtLNPo.exe
  2⤵
  PID:7320
- C:\Windows\System\KyhSCGL.exe
  C:\Windows\System\KyhSCGL.exe
  2⤵
  PID:7356
- C:\Windows\System\osYHNkj.exe
  C:\Windows\System\osYHNkj.exe
  2⤵
  PID:7380
- C:\Windows\System\UgxYZBb.exe
  C:\Windows\System\UgxYZBb.exe
  2⤵
  PID:7416
- C:\Windows\System\eCORIOR.exe
  C:\Windows\System\eCORIOR.exe
  2⤵
  PID:7436
- C:\Windows\System\fNuTwlt.exe
  C:\Windows\System\fNuTwlt.exe
  2⤵
  PID:7460
- C:\Windows\System\LboWuLi.exe
  C:\Windows\System\LboWuLi.exe
  2⤵
  PID:7488
- C:\Windows\System\NuOKfFu.exe
  C:\Windows\System\NuOKfFu.exe
  2⤵
  PID:7504
- C:\Windows\System\BPunuJi.exe
  C:\Windows\System\BPunuJi.exe
  2⤵
  PID:7544
- C:\Windows\System\JFvlmsB.exe
  C:\Windows\System\JFvlmsB.exe
  2⤵
  PID:7560
- C:\Windows\System\DrlEKwC.exe
  C:\Windows\System\DrlEKwC.exe
  2⤵
  PID:7596
- C:\Windows\System\cywBWwk.exe
  C:\Windows\System\cywBWwk.exe
  2⤵
  PID:7628
- C:\Windows\System\GHpHNkz.exe
  C:\Windows\System\GHpHNkz.exe
  2⤵
  PID:7656
- C:\Windows\System\VQkeFIx.exe
  C:\Windows\System\VQkeFIx.exe
  2⤵
  PID:7684
- C:\Windows\System\FWsdqrV.exe
  C:\Windows\System\FWsdqrV.exe
  2⤵
  PID:7716
- C:\Windows\System\xTFsKJA.exe
  C:\Windows\System\xTFsKJA.exe
  2⤵
  PID:7740
- C:\Windows\System\cPMFFMA.exe
  C:\Windows\System\cPMFFMA.exe
  2⤵
  PID:7768
- C:\Windows\System\ZOocHGR.exe
  C:\Windows\System\ZOocHGR.exe
  2⤵
  PID:7796
- C:\Windows\System\ropNTct.exe
  C:\Windows\System\ropNTct.exe
  2⤵
  PID:7824
- C:\Windows\System\fBliZjt.exe
  C:\Windows\System\fBliZjt.exe
  2⤵
  PID:7852
- C:\Windows\System\senxNmw.exe
  C:\Windows\System\senxNmw.exe
  2⤵
  PID:7884
- C:\Windows\System\PKqCANK.exe
  C:\Windows\System\PKqCANK.exe
  2⤵
  PID:7908
- C:\Windows\System\KjfMwjg.exe
  C:\Windows\System\KjfMwjg.exe
  2⤵
  PID:7944
- C:\Windows\System\vYAZOmf.exe
  C:\Windows\System\vYAZOmf.exe
  2⤵
  PID:7964
- C:\Windows\System\EYiHMDW.exe
  C:\Windows\System\EYiHMDW.exe
  2⤵
  PID:7996
- C:\Windows\System\FUMWMhr.exe
  C:\Windows\System\FUMWMhr.exe
  2⤵
  PID:8024
- C:\Windows\System\kFOjohe.exe
  C:\Windows\System\kFOjohe.exe
  2⤵
  PID:8052
- C:\Windows\System\XQbSRbH.exe
  C:\Windows\System\XQbSRbH.exe
  2⤵
  PID:8076
- C:\Windows\System\kdGKjGe.exe
  C:\Windows\System\kdGKjGe.exe
  2⤵
  PID:8104
- C:\Windows\System\kLNBKhz.exe
  C:\Windows\System\kLNBKhz.exe
  2⤵
  PID:8136
- C:\Windows\System\qHcCchT.exe
  C:\Windows\System\qHcCchT.exe
  2⤵
  PID:8164
- C:\Windows\System\gHVzkOQ.exe
  C:\Windows\System\gHVzkOQ.exe
  2⤵
  PID:6228
- C:\Windows\System\TIJYOtN.exe
  C:\Windows\System\TIJYOtN.exe
  2⤵
  PID:7196
- C:\Windows\System\xkGaZhp.exe
  C:\Windows\System\xkGaZhp.exe
  2⤵
  PID:7288
- C:\Windows\System\xeRbEEk.exe
  C:\Windows\System\xeRbEEk.exe
  2⤵
  PID:7344
- C:\Windows\System\ObvpuvD.exe
  C:\Windows\System\ObvpuvD.exe
  2⤵
  PID:7392
- C:\Windows\System\fOLwhEV.exe
  C:\Windows\System\fOLwhEV.exe
  2⤵
  PID:7444
- C:\Windows\System\MuyBqoW.exe
  C:\Windows\System\MuyBqoW.exe
  2⤵
  PID:7496
- C:\Windows\System\aiSFTze.exe
  C:\Windows\System\aiSFTze.exe
  2⤵
  PID:7584
- C:\Windows\System\zzCrcnk.exe
  C:\Windows\System\zzCrcnk.exe
  2⤵
  PID:7580
- C:\Windows\System\OLzwJfU.exe
  C:\Windows\System\OLzwJfU.exe
  2⤵
  PID:7724
- C:\Windows\System\fRnRxUR.exe
  C:\Windows\System\fRnRxUR.exe
  2⤵
  PID:7756
- C:\Windows\System\cfZPcti.exe
  C:\Windows\System\cfZPcti.exe
  2⤵
  PID:7820
- C:\Windows\System\OaFVZnm.exe
  C:\Windows\System\OaFVZnm.exe
  2⤵
  PID:7892
- C:\Windows\System\VQwkJAD.exe
  C:\Windows\System\VQwkJAD.exe
  2⤵
  PID:7920
- C:\Windows\System\ryaTcFJ.exe
  C:\Windows\System\ryaTcFJ.exe
  2⤵
  PID:7984
- C:\Windows\System\fiZEdHP.exe
  C:\Windows\System\fiZEdHP.exe
  2⤵
  PID:8096
- C:\Windows\System\oCMflzm.exe
  C:\Windows\System\oCMflzm.exe
  2⤵
  PID:8172
- C:\Windows\System\ZStlucv.exe
  C:\Windows\System\ZStlucv.exe
  2⤵
  PID:8132
- C:\Windows\System\kkbJhTf.exe
  C:\Windows\System\kkbJhTf.exe
  2⤵
  PID:6756
- C:\Windows\System\CtppjAR.exe
  C:\Windows\System\CtppjAR.exe
  2⤵
  PID:7316
- C:\Windows\System\eWbELNI.exe
  C:\Windows\System\eWbELNI.exe
  2⤵
  PID:7404
- C:\Windows\System\GHaFDDl.exe
  C:\Windows\System\GHaFDDl.exe
  2⤵
  PID:7588
- C:\Windows\System\eJMlzoX.exe
  C:\Windows\System\eJMlzoX.exe
  2⤵
  PID:7880
- C:\Windows\System\sybVoQn.exe
  C:\Windows\System\sybVoQn.exe
  2⤵
  PID:7904
- C:\Windows\System\KvVUsxU.exe
  C:\Windows\System\KvVUsxU.exe
  2⤵
  PID:8120
- C:\Windows\System\muAxMey.exe
  C:\Windows\System\muAxMey.exe
  2⤵
  PID:7472
- C:\Windows\System\JhOlhYa.exe
  C:\Windows\System\JhOlhYa.exe
  2⤵
  PID:7680
- C:\Windows\System\hpgsbtB.exe
  C:\Windows\System\hpgsbtB.exe
  2⤵
  PID:7368
- C:\Windows\System\xzbfMGq.exe
  C:\Windows\System\xzbfMGq.exe
  2⤵
  PID:8224
- C:\Windows\System\zGKEdFD.exe
  C:\Windows\System\zGKEdFD.exe
  2⤵
  PID:8252
- C:\Windows\System\OGEwYUJ.exe
  C:\Windows\System\OGEwYUJ.exe
  2⤵
  PID:8280
- C:\Windows\System\dqVWHmP.exe
  C:\Windows\System\dqVWHmP.exe
  2⤵
  PID:8308
- C:\Windows\System\FnyYvYR.exe
  C:\Windows\System\FnyYvYR.exe
  2⤵
  PID:8332
- C:\Windows\System\XcuAMxz.exe
  C:\Windows\System\XcuAMxz.exe
  2⤵
  PID:8364
- C:\Windows\System\ucKVACq.exe
  C:\Windows\System\ucKVACq.exe
  2⤵
  PID:8392
- C:\Windows\System\opGhEsj.exe
  C:\Windows\System\opGhEsj.exe
  2⤵
  PID:8420
- C:\Windows\System\QAjSVkR.exe
  C:\Windows\System\QAjSVkR.exe
  2⤵
  PID:8460
- C:\Windows\System\HQJmkdC.exe
  C:\Windows\System\HQJmkdC.exe
  2⤵
  PID:8476
- C:\Windows\System\sqSRWJa.exe
  C:\Windows\System\sqSRWJa.exe
  2⤵
  PID:8504
- C:\Windows\System\mfCnksj.exe
  C:\Windows\System\mfCnksj.exe
  2⤵
  PID:8540
- C:\Windows\System\khfifcd.exe
  C:\Windows\System\khfifcd.exe
  2⤵
  PID:8572
- C:\Windows\System\ggLLnPG.exe
  C:\Windows\System\ggLLnPG.exe
  2⤵
  PID:8588
- C:\Windows\System\cKZiCpl.exe
  C:\Windows\System\cKZiCpl.exe
  2⤵
  PID:8616
- C:\Windows\System\qSAkWkJ.exe
  C:\Windows\System\qSAkWkJ.exe
  2⤵
  PID:8648
- C:\Windows\System\mKGggIT.exe
  C:\Windows\System\mKGggIT.exe
  2⤵
  PID:8668
- C:\Windows\System\hjdtHQv.exe
  C:\Windows\System\hjdtHQv.exe
  2⤵
  PID:8688
- C:\Windows\System\whdmIKw.exe
  C:\Windows\System\whdmIKw.exe
  2⤵
  PID:8704
- C:\Windows\System\SDUobDG.exe
  C:\Windows\System\SDUobDG.exe
  2⤵
  PID:8728
- C:\Windows\System\kMVyFJk.exe
  C:\Windows\System\kMVyFJk.exe
  2⤵
  PID:8760
- C:\Windows\System\pbBKXTc.exe
  C:\Windows\System\pbBKXTc.exe
  2⤵
  PID:8776
- C:\Windows\System\hlEAIoA.exe
  C:\Windows\System\hlEAIoA.exe
  2⤵
  PID:8812
- C:\Windows\System\hRvNmEr.exe
  C:\Windows\System\hRvNmEr.exe
  2⤵
  PID:8848
- C:\Windows\System\YPDUqkG.exe
  C:\Windows\System\YPDUqkG.exe
  2⤵
  PID:8872
- C:\Windows\System\afxittv.exe
  C:\Windows\System\afxittv.exe
  2⤵
  PID:8904
- C:\Windows\System\DoPeXLS.exe
  C:\Windows\System\DoPeXLS.exe
  2⤵
  PID:8928
- C:\Windows\System\BvnslBR.exe
  C:\Windows\System\BvnslBR.exe
  2⤵
  PID:8956
- C:\Windows\System\llmJssK.exe
  C:\Windows\System\llmJssK.exe
  2⤵
  PID:8988
- C:\Windows\System\kQfctdh.exe
  C:\Windows\System\kQfctdh.exe
  2⤵
  PID:9036
- C:\Windows\System\TRfAWTD.exe
  C:\Windows\System\TRfAWTD.exe
  2⤵
  PID:9064
- C:\Windows\System\KDEDDRl.exe
  C:\Windows\System\KDEDDRl.exe
  2⤵
  PID:9096
- C:\Windows\System\AjxlhTy.exe
  C:\Windows\System\AjxlhTy.exe
  2⤵
  PID:9120
- C:\Windows\System\IpiBIGA.exe
  C:\Windows\System\IpiBIGA.exe
  2⤵
  PID:9148
- C:\Windows\System\ApdXBMU.exe
  C:\Windows\System\ApdXBMU.exe
  2⤵
  PID:9176
- C:\Windows\System\Ovynlug.exe
  C:\Windows\System\Ovynlug.exe
  2⤵
  PID:9208
- C:\Windows\System\jTEhOSA.exe
  C:\Windows\System\jTEhOSA.exe
  2⤵
  PID:8160
- C:\Windows\System\CguGtxh.exe
  C:\Windows\System\CguGtxh.exe
  2⤵
  PID:8268
- C:\Windows\System\HSRGyCX.exe
  C:\Windows\System\HSRGyCX.exe
  2⤵
  PID:8320
- C:\Windows\System\aZsKdPi.exe
  C:\Windows\System\aZsKdPi.exe
  2⤵
  PID:8408
- C:\Windows\System\TWyRAmI.exe
  C:\Windows\System\TWyRAmI.exe
  2⤵
  PID:8488
- C:\Windows\System\fcBPNVL.exe
  C:\Windows\System\fcBPNVL.exe
  2⤵
  PID:8536
- C:\Windows\System\YsRxcBn.exe
  C:\Windows\System\YsRxcBn.exe
  2⤵
  PID:8584
- C:\Windows\System\rphQdQt.exe
  C:\Windows\System\rphQdQt.exe
  2⤵
  PID:8684
- C:\Windows\System\WYQYmCt.exe
  C:\Windows\System\WYQYmCt.exe
  2⤵
  PID:8720
- C:\Windows\System\mjGeEqH.exe
  C:\Windows\System\mjGeEqH.exe
  2⤵
  PID:8744
- C:\Windows\System\drtSysG.exe
  C:\Windows\System\drtSysG.exe
  2⤵
  PID:8832
- C:\Windows\System\VqXWsjV.exe
  C:\Windows\System\VqXWsjV.exe
  2⤵
  PID:8912
- C:\Windows\System\kLmGPdK.exe
  C:\Windows\System\kLmGPdK.exe
  2⤵
  PID:8920
- C:\Windows\System\lqRPUHB.exe
  C:\Windows\System\lqRPUHB.exe
  2⤵
  PID:8976
- C:\Windows\System\HOQsBSe.exe
  C:\Windows\System\HOQsBSe.exe
  2⤵
  PID:9052
- C:\Windows\System\sQqfSOB.exe
  C:\Windows\System\sQqfSOB.exe
  2⤵
  PID:9160
- C:\Windows\System\iMwMIBd.exe
  C:\Windows\System\iMwMIBd.exe
  2⤵
  PID:7532
- C:\Windows\System\GnlioqY.exe
  C:\Windows\System\GnlioqY.exe
  2⤵
  PID:8292
- C:\Windows\System\BGhHIth.exe
  C:\Windows\System\BGhHIth.exe
  2⤵
  PID:8404
- C:\Windows\System\oQcWAsh.exe
  C:\Windows\System\oQcWAsh.exe
  2⤵
  PID:8640
- C:\Windows\System\lIzkuPU.exe
  C:\Windows\System\lIzkuPU.exe
  2⤵
  PID:8768
- C:\Windows\System\usbRKfH.exe
  C:\Windows\System\usbRKfH.exe
  2⤵
  PID:8968
- C:\Windows\System\dAktOWT.exe
  C:\Windows\System\dAktOWT.exe
  2⤵
  PID:9116
- C:\Windows\System\RlYPjmv.exe
  C:\Windows\System\RlYPjmv.exe
  2⤵
  PID:8244
- C:\Windows\System\daJZrKl.exe
  C:\Windows\System\daJZrKl.exe
  2⤵
  PID:7572
- C:\Windows\System\JFrQDMr.exe
  C:\Windows\System\JFrQDMr.exe
  2⤵
  PID:8944
- C:\Windows\System\OvxTXkT.exe
  C:\Windows\System\OvxTXkT.exe
  2⤵
  PID:8496
- C:\Windows\System\afxrSzt.exe
  C:\Windows\System\afxrSzt.exe
  2⤵
  PID:8808
- C:\Windows\System\SwBeYdi.exe
  C:\Windows\System\SwBeYdi.exe
  2⤵
  PID:9228
- C:\Windows\System\QJahUpP.exe
  C:\Windows\System\QJahUpP.exe
  2⤵
  PID:9268
- C:\Windows\System\LaNHISB.exe
  C:\Windows\System\LaNHISB.exe
  2⤵
  PID:9296
- C:\Windows\System\ZETfpFo.exe
  C:\Windows\System\ZETfpFo.exe
  2⤵
  PID:9324
- C:\Windows\System\PIURlJG.exe
  C:\Windows\System\PIURlJG.exe
  2⤵
  PID:9352
- C:\Windows\System\qMsJkvQ.exe
  C:\Windows\System\qMsJkvQ.exe
  2⤵
  PID:9380
- C:\Windows\System\pRAyjUb.exe
  C:\Windows\System\pRAyjUb.exe
  2⤵
  PID:9408
- C:\Windows\System\BWrqjLr.exe
  C:\Windows\System\BWrqjLr.exe
  2⤵
  PID:9436
- C:\Windows\System\jGdznSp.exe
  C:\Windows\System\jGdznSp.exe
  2⤵
  PID:9464
- C:\Windows\System\KGSoozU.exe
  C:\Windows\System\KGSoozU.exe
  2⤵
  PID:9484
- C:\Windows\System\PspJogw.exe
  C:\Windows\System\PspJogw.exe
  2⤵
  PID:9512
- C:\Windows\System\htnEgiW.exe
  C:\Windows\System\htnEgiW.exe
  2⤵
  PID:9540
- C:\Windows\System\fsyASek.exe
  C:\Windows\System\fsyASek.exe
  2⤵
  PID:9580
- C:\Windows\System\qTpgBux.exe
  C:\Windows\System\qTpgBux.exe
  2⤵
  PID:9608
- C:\Windows\System\WBzzcDY.exe
  C:\Windows\System\WBzzcDY.exe
  2⤵
  PID:9640
- C:\Windows\System\hdOpKPL.exe
  C:\Windows\System\hdOpKPL.exe
  2⤵
  PID:9672
- C:\Windows\System\fcXtDhQ.exe
  C:\Windows\System\fcXtDhQ.exe
  2⤵
  PID:9692
- C:\Windows\System\FUPBsuH.exe
  C:\Windows\System\FUPBsuH.exe
  2⤵
  PID:9716
- C:\Windows\System\kbLMuTz.exe
  C:\Windows\System\kbLMuTz.exe
  2⤵
  PID:9744
- C:\Windows\System\TKdAstR.exe
  C:\Windows\System\TKdAstR.exe
  2⤵
  PID:9764
- C:\Windows\System\EGUJMwX.exe
  C:\Windows\System\EGUJMwX.exe
  2⤵
  PID:9792
- C:\Windows\System\gxdaqwC.exe
  C:\Windows\System\gxdaqwC.exe
  2⤵
  PID:9832
- C:\Windows\System\kjrrhyG.exe
  C:\Windows\System\kjrrhyG.exe
  2⤵
  PID:9848
- C:\Windows\System\wqnXkfN.exe
  C:\Windows\System\wqnXkfN.exe
  2⤵
  PID:9876
- C:\Windows\System\xIpZDOd.exe
  C:\Windows\System\xIpZDOd.exe
  2⤵
  PID:9908
- C:\Windows\System\wpAdESu.exe
  C:\Windows\System\wpAdESu.exe
  2⤵
  PID:9944
- C:\Windows\System\ETtApTv.exe
  C:\Windows\System\ETtApTv.exe
  2⤵
  PID:9960
- C:\Windows\System\vauXbkU.exe
  C:\Windows\System\vauXbkU.exe
  2⤵
  PID:9984
- C:\Windows\System\siamkEN.exe
  C:\Windows\System\siamkEN.exe
  2⤵
  PID:10016
- C:\Windows\System\MClgzbp.exe
  C:\Windows\System\MClgzbp.exe
  2⤵
  PID:10052
- C:\Windows\System\gASuZJV.exe
  C:\Windows\System\gASuZJV.exe
  2⤵
  PID:10072
- C:\Windows\System\upfBWrF.exe
  C:\Windows\System\upfBWrF.exe
  2⤵
  PID:10100
- C:\Windows\System\wFQkhUT.exe
  C:\Windows\System\wFQkhUT.exe
  2⤵
  PID:10132
- C:\Windows\System\GynSFBW.exe
  C:\Windows\System\GynSFBW.exe
  2⤵
  PID:10152
- C:\Windows\System\WHPzSha.exe
  C:\Windows\System\WHPzSha.exe
  2⤵
  PID:10192
- C:\Windows\System\xOgPkHD.exe
  C:\Windows\System\xOgPkHD.exe
  2⤵
  PID:10216
- C:\Windows\System\YElRrFV.exe
  C:\Windows\System\YElRrFV.exe
  2⤵
  PID:9048
- C:\Windows\System\RyITZqb.exe
  C:\Windows\System\RyITZqb.exe
  2⤵
  PID:9256
- C:\Windows\System\UOhmTfU.exe
  C:\Windows\System\UOhmTfU.exe
  2⤵
  PID:9340
- C:\Windows\System\UcusdQs.exe
  C:\Windows\System\UcusdQs.exe
  2⤵
  PID:9432
- C:\Windows\System\zImcgBQ.exe
  C:\Windows\System\zImcgBQ.exe
  2⤵
  PID:9472
- C:\Windows\System\cKhZVwV.exe
  C:\Windows\System\cKhZVwV.exe
  2⤵
  PID:9568
- C:\Windows\System\SvuIBhA.exe
  C:\Windows\System\SvuIBhA.exe
  2⤵
  PID:9624
- C:\Windows\System\XCcvvyT.exe
  C:\Windows\System\XCcvvyT.exe
  2⤵
  PID:9728
- C:\Windows\System\XpArqHO.exe
  C:\Windows\System\XpArqHO.exe
  2⤵
  PID:9812
- C:\Windows\System\OtyBhFs.exe
  C:\Windows\System\OtyBhFs.exe
  2⤵
  PID:9780
- C:\Windows\System\nMLXIQW.exe
  C:\Windows\System\nMLXIQW.exe
  2⤵
  PID:9844
- C:\Windows\System\bVIOTnf.exe
  C:\Windows\System\bVIOTnf.exe
  2⤵
  PID:9976
- C:\Windows\System\ZnUsjJh.exe
  C:\Windows\System\ZnUsjJh.exe
  2⤵
  PID:10004
- C:\Windows\System\SVMfvJz.exe
  C:\Windows\System\SVMfvJz.exe
  2⤵
  PID:10048
- C:\Windows\System\XeEPIdL.exe
  C:\Windows\System\XeEPIdL.exe
  2⤵
  PID:10112
- C:\Windows\System\JZiOkFC.exe
  C:\Windows\System\JZiOkFC.exe
  2⤵
  PID:10148
- C:\Windows\System\lCpKSVJ.exe
  C:\Windows\System\lCpKSVJ.exe
  2⤵
  PID:9252
- C:\Windows\System\JmticVz.exe
  C:\Windows\System\JmticVz.exe
  2⤵
  PID:9344
- C:\Windows\System\CPXRsDm.exe
  C:\Windows\System\CPXRsDm.exe
  2⤵
  PID:9364
- C:\Windows\System\DndknKK.exe
  C:\Windows\System\DndknKK.exe
  2⤵
  PID:9680
- C:\Windows\System\LMPeKBa.exe
  C:\Windows\System\LMPeKBa.exe
  2⤵
  PID:9860
- C:\Windows\System\UBpqxOC.exe
  C:\Windows\System\UBpqxOC.exe
  2⤵
  PID:9996
- C:\Windows\System\AbiBQkQ.exe
  C:\Windows\System\AbiBQkQ.exe
  2⤵
  PID:10036
- C:\Windows\System\UrJoEVV.exe
  C:\Windows\System\UrJoEVV.exe
  2⤵
  PID:9392
- C:\Windows\System\cemLZSC.exe
  C:\Windows\System\cemLZSC.exe
  2⤵
  PID:9776
- C:\Windows\System\qKXyYmn.exe
  C:\Windows\System\qKXyYmn.exe
  2⤵
  PID:10224
- C:\Windows\System\HErNmZC.exe
  C:\Windows\System\HErNmZC.exe
  2⤵
  PID:9456
- C:\Windows\System\VmEvDHc.exe
  C:\Windows\System\VmEvDHc.exe
  2⤵
  PID:10264
- C:\Windows\System\yrgAhxs.exe
  C:\Windows\System\yrgAhxs.exe
  2⤵
  PID:10296
- C:\Windows\System\CIJmrPP.exe
  C:\Windows\System\CIJmrPP.exe
  2⤵
  PID:10328
- C:\Windows\System\dvozgTY.exe
  C:\Windows\System\dvozgTY.exe
  2⤵
  PID:10348
- C:\Windows\System\wIxfMVs.exe
  C:\Windows\System\wIxfMVs.exe
  2⤵
  PID:10376
- C:\Windows\System\OlgvSFb.exe
  C:\Windows\System\OlgvSFb.exe
  2⤵
  PID:10404
- C:\Windows\System\AwdWFCq.exe
  C:\Windows\System\AwdWFCq.exe
  2⤵
  PID:10436
- C:\Windows\System\LhNArhe.exe
  C:\Windows\System\LhNArhe.exe
  2⤵
  PID:10460
- C:\Windows\System\YjFAQIQ.exe
  C:\Windows\System\YjFAQIQ.exe
  2⤵
  PID:10488
- C:\Windows\System\NnbvxqM.exe
  C:\Windows\System\NnbvxqM.exe
  2⤵
  PID:10504
- C:\Windows\System\BRBFPTe.exe
  C:\Windows\System\BRBFPTe.exe
  2⤵
  PID:10532
- C:\Windows\System\nXZSAhN.exe
  C:\Windows\System\nXZSAhN.exe
  2⤵
  PID:10572
- C:\Windows\System\eyxdSEL.exe
  C:\Windows\System\eyxdSEL.exe
  2⤵
  PID:10608
- C:\Windows\System\cQvsoav.exe
  C:\Windows\System\cQvsoav.exe
  2⤵
  PID:10628
- C:\Windows\System\rZnogud.exe
  C:\Windows\System\rZnogud.exe
  2⤵
  PID:10656
- C:\Windows\System\UnxYeGQ.exe
  C:\Windows\System\UnxYeGQ.exe
  2⤵
  PID:10716
- C:\Windows\System\uNdUwxS.exe
  C:\Windows\System\uNdUwxS.exe
  2⤵
  PID:10732
- C:\Windows\System\kVpnDPQ.exe
  C:\Windows\System\kVpnDPQ.exe
  2⤵
  PID:10748
- C:\Windows\System\HlrKsHE.exe
  C:\Windows\System\HlrKsHE.exe
  2⤵
  PID:10772
- C:\Windows\System\hysMPGS.exe
  C:\Windows\System\hysMPGS.exe
  2⤵
  PID:10796
- C:\Windows\System\iFyDXzD.exe
  C:\Windows\System\iFyDXzD.exe
  2⤵
  PID:10832
- C:\Windows\System\pNMWhtT.exe
  C:\Windows\System\pNMWhtT.exe
  2⤵
  PID:10852
- C:\Windows\System\HiGCitL.exe
  C:\Windows\System\HiGCitL.exe
  2⤵
  PID:10876
- C:\Windows\System\mHbboRl.exe
  C:\Windows\System\mHbboRl.exe
  2⤵
  PID:10896
- C:\Windows\System\XYNmppL.exe
  C:\Windows\System\XYNmppL.exe
  2⤵
  PID:10924
- C:\Windows\System\MrKNuYS.exe
  C:\Windows\System\MrKNuYS.exe
  2⤵
  PID:10956
- C:\Windows\System\YqqVdSN.exe
  C:\Windows\System\YqqVdSN.exe
  2⤵
  PID:10984
- C:\Windows\System\qPekWFb.exe
  C:\Windows\System\qPekWFb.exe
  2⤵
  PID:11016
- C:\Windows\System\RPitTXW.exe
  C:\Windows\System\RPitTXW.exe
  2⤵
  PID:11052
- C:\Windows\System\FwBdgfk.exe
  C:\Windows\System\FwBdgfk.exe
  2⤵
  PID:11080
- C:\Windows\System\HmrkzaE.exe
  C:\Windows\System\HmrkzaE.exe
  2⤵
  PID:11116
- C:\Windows\System\YiRENsi.exe
  C:\Windows\System\YiRENsi.exe
  2⤵
  PID:11140
- C:\Windows\System\LwZdzJE.exe
  C:\Windows\System\LwZdzJE.exe
  2⤵
  PID:11168
- C:\Windows\System\rajqHuC.exe
  C:\Windows\System\rajqHuC.exe
  2⤵
  PID:11216
- C:\Windows\System\YnjNFXY.exe
  C:\Windows\System\YnjNFXY.exe
  2⤵
  PID:11244
- C:\Windows\System\sSMkvAH.exe
  C:\Windows\System\sSMkvAH.exe
  2⤵
  PID:10140
- C:\Windows\System\oIiPsFA.exe
  C:\Windows\System\oIiPsFA.exe
  2⤵
  PID:10276
- C:\Windows\System\xuMHQmO.exe
  C:\Windows\System\xuMHQmO.exe
  2⤵
  PID:10368
- C:\Windows\System\qKZArDe.exe
  C:\Windows\System\qKZArDe.exe
  2⤵
  PID:10420
- C:\Windows\System\kxZVida.exe
  C:\Windows\System\kxZVida.exe
  2⤵
  PID:10520
- C:\Windows\System\rAZioVu.exe
  C:\Windows\System\rAZioVu.exe
  2⤵
  PID:10584
- C:\Windows\System\zkGKxAR.exe
  C:\Windows\System\zkGKxAR.exe
  2⤵
  PID:10644
- C:\Windows\System\KpXobCn.exe
  C:\Windows\System\KpXobCn.exe
  2⤵
  PID:10668
- C:\Windows\System\kGNQRPu.exe
  C:\Windows\System\kGNQRPu.exe
  2⤵
  PID:10768
- C:\Windows\System\iWEqrkn.exe
  C:\Windows\System\iWEqrkn.exe
  2⤵
  PID:10844
- C:\Windows\System\QLKbivE.exe
  C:\Windows\System\QLKbivE.exe
  2⤵
  PID:10908
- C:\Windows\System\tuGuLxP.exe
  C:\Windows\System\tuGuLxP.exe
  2⤵
  PID:10948
- C:\Windows\System\cLJXrdo.exe
  C:\Windows\System\cLJXrdo.exe
  2⤵
  PID:10996
- C:\Windows\System\uiGolyO.exe
  C:\Windows\System\uiGolyO.exe
  2⤵
  PID:11108
- C:\Windows\System\RhCJAJV.exe
  C:\Windows\System\RhCJAJV.exe
  2⤵
  PID:11224
- C:\Windows\System\YodNFxp.exe
  C:\Windows\System\YodNFxp.exe
  2⤵
  PID:9632
- C:\Windows\System\dbKsXgh.exe
  C:\Windows\System\dbKsXgh.exe
  2⤵
  PID:10244
- C:\Windows\System\EVbRzao.exe
  C:\Windows\System\EVbRzao.exe
  2⤵
  PID:10500
- C:\Windows\System\JVlajEh.exe
  C:\Windows\System\JVlajEh.exe
  2⤵
  PID:10256
- C:\Windows\System\DRmRBgV.exe
  C:\Windows\System\DRmRBgV.exe
  2⤵
  PID:10740
- C:\Windows\System\drsCBzx.exe
  C:\Windows\System\drsCBzx.exe
  2⤵
  PID:10980
- C:\Windows\System\QUgkCPy.exe
  C:\Windows\System\QUgkCPy.exe
  2⤵
  PID:11160
- C:\Windows\System\EHTBfMm.exe
  C:\Windows\System\EHTBfMm.exe
  2⤵
  PID:10384
- C:\Windows\System\SkSeqPJ.exe
  C:\Windows\System\SkSeqPJ.exe
  2⤵
  PID:10396
- C:\Windows\System\tLeYJIt.exe
  C:\Windows\System\tLeYJIt.exe
  2⤵
  PID:10944
- C:\Windows\System\XcnoGdy.exe
  C:\Windows\System\XcnoGdy.exe
  2⤵
  PID:10360
- C:\Windows\System\paqjGgL.exe
  C:\Windows\System\paqjGgL.exe
  2⤵
  PID:11272
- C:\Windows\System\TunLWtV.exe
  C:\Windows\System\TunLWtV.exe
  2⤵
  PID:11288
- C:\Windows\System\jDzyLCw.exe
  C:\Windows\System\jDzyLCw.exe
  2⤵
  PID:11304
- C:\Windows\System\IBVZIVY.exe
  C:\Windows\System\IBVZIVY.exe
  2⤵
  PID:11332
- C:\Windows\System\thLWnpM.exe
  C:\Windows\System\thLWnpM.exe
  2⤵
  PID:11364
- C:\Windows\System\hrSqwwk.exe
  C:\Windows\System\hrSqwwk.exe
  2⤵
  PID:11380
- C:\Windows\System\UYOlOmj.exe
  C:\Windows\System\UYOlOmj.exe
  2⤵
  PID:11412
- C:\Windows\System\GPbHgtm.exe
  C:\Windows\System\GPbHgtm.exe
  2⤵
  PID:11448
- C:\Windows\System\enaTSwQ.exe
  C:\Windows\System\enaTSwQ.exe
  2⤵
  PID:11480
- C:\Windows\System\pOffbBr.exe
  C:\Windows\System\pOffbBr.exe
  2⤵
  PID:11508
- C:\Windows\System\VLLlVYP.exe
  C:\Windows\System\VLLlVYP.exe
  2⤵
  PID:11528
- C:\Windows\System\MuSfxPw.exe
  C:\Windows\System\MuSfxPw.exe
  2⤵
  PID:11552
- C:\Windows\System\yOFMFCI.exe
  C:\Windows\System\yOFMFCI.exe
  2⤵
  PID:11584
- C:\Windows\System\uIfmFLY.exe
  C:\Windows\System\uIfmFLY.exe
  2⤵
  PID:11608
- C:\Windows\System\AicxgcP.exe
  C:\Windows\System\AicxgcP.exe
  2⤵
  PID:11644
- C:\Windows\System\fpaekLW.exe
  C:\Windows\System\fpaekLW.exe
  2⤵
  PID:11672
- C:\Windows\System\GYKxFBr.exe
  C:\Windows\System\GYKxFBr.exe
  2⤵
  PID:11716
- C:\Windows\System\DJQEpHP.exe
  C:\Windows\System\DJQEpHP.exe
  2⤵
  PID:11740
- C:\Windows\System\wIXIuRX.exe
  C:\Windows\System\wIXIuRX.exe
  2⤵
  PID:11776
- C:\Windows\System\fCDheVw.exe
  C:\Windows\System\fCDheVw.exe
  2⤵
  PID:11808
- C:\Windows\System\TQbQppC.exe
  C:\Windows\System\TQbQppC.exe
  2⤵
  PID:11844
- C:\Windows\System\NXJpQDI.exe
  C:\Windows\System\NXJpQDI.exe
  2⤵
  PID:11872
- C:\Windows\System\YpXagXC.exe
  C:\Windows\System\YpXagXC.exe
  2⤵
  PID:11892
- C:\Windows\System\xpXJGZu.exe
  C:\Windows\System\xpXJGZu.exe
  2⤵
  PID:11916
- C:\Windows\System\XwvNadr.exe
  C:\Windows\System\XwvNadr.exe
  2⤵
  PID:11944
- C:\Windows\System\lKWZDzN.exe
  C:\Windows\System\lKWZDzN.exe
  2⤵
  PID:11972
- C:\Windows\System\jmHqfsv.exe
  C:\Windows\System\jmHqfsv.exe
  2⤵
  PID:12004
- C:\Windows\System\oiZTSlS.exe
  C:\Windows\System\oiZTSlS.exe
  2⤵
  PID:12040
- C:\Windows\System\zCtlOUp.exe
  C:\Windows\System\zCtlOUp.exe
  2⤵
  PID:12056
- C:\Windows\System\Jtaomts.exe
  C:\Windows\System\Jtaomts.exe
  2⤵
  PID:12084
- C:\Windows\System\NIJxPzw.exe
  C:\Windows\System\NIJxPzw.exe
  2⤵
  PID:12100
- C:\Windows\System\tXucbzi.exe
  C:\Windows\System\tXucbzi.exe
  2⤵
  PID:12132
- C:\Windows\System\SrptzBs.exe
  C:\Windows\System\SrptzBs.exe
  2⤵
  PID:12156
- C:\Windows\System\BlZozZl.exe
  C:\Windows\System\BlZozZl.exe
  2⤵
  PID:12184
- C:\Windows\System\XewVqjg.exe
  C:\Windows\System\XewVqjg.exe
  2⤵
  PID:12224
- C:\Windows\System\dIKxURw.exe
  C:\Windows\System\dIKxURw.exe
  2⤵
  PID:12244
- C:\Windows\System\GxhQhRz.exe
  C:\Windows\System\GxhQhRz.exe
  2⤵
  PID:12272
- C:\Windows\System\Mlhtsjm.exe
  C:\Windows\System\Mlhtsjm.exe
  2⤵
  PID:10624
- C:\Windows\System\oRCznPw.exe
  C:\Windows\System\oRCznPw.exe
  2⤵
  PID:11284
- C:\Windows\System\yZsGNEz.exe
  C:\Windows\System\yZsGNEz.exe
  2⤵
  PID:11372
- C:\Windows\System\oJdObmT.exe
  C:\Windows\System\oJdObmT.exe
  2⤵
  PID:11424
- C:\Windows\System\fWPYBVo.exe
  C:\Windows\System\fWPYBVo.exe
  2⤵
  PID:11464
- C:\Windows\System\vndESoi.exe
  C:\Windows\System\vndESoi.exe
  2⤵
  PID:11540
- C:\Windows\System\Ppbjisl.exe
  C:\Windows\System\Ppbjisl.exe
  2⤵
  PID:11704
- C:\Windows\System\RzWsXdB.exe
  C:\Windows\System\RzWsXdB.exe
  2⤵
  PID:11656
- C:\Windows\System\tBIgJqJ.exe
  C:\Windows\System\tBIgJqJ.exe
  2⤵
  PID:11788
- C:\Windows\System\kVjuYMM.exe
  C:\Windows\System\kVjuYMM.exe
  2⤵
  PID:11796
- C:\Windows\System\VxoAInS.exe
  C:\Windows\System\VxoAInS.exe
  2⤵
  PID:11884
- C:\Windows\System\rGqhIJh.exe
  C:\Windows\System\rGqhIJh.exe
  2⤵
  PID:11956
- C:\Windows\System\XemgKmt.exe
  C:\Windows\System\XemgKmt.exe
  2⤵
  PID:12048
- C:\Windows\System\wxjLvWn.exe
  C:\Windows\System\wxjLvWn.exe
  2⤵
  PID:12164
- C:\Windows\System\qTLfXsh.exe
  C:\Windows\System\qTLfXsh.exe
  2⤵
  PID:12232
- C:\Windows\System\gWIWatc.exe
  C:\Windows\System\gWIWatc.exe
  2⤵
  PID:12180
- C:\Windows\System\PgsVuQE.exe
  C:\Windows\System\PgsVuQE.exe
  2⤵
  PID:11300
- C:\Windows\System\sAuuthG.exe
  C:\Windows\System\sAuuthG.exe
  2⤵
  PID:11468
- C:\Windows\System\GnAkfvJ.exe
  C:\Windows\System\GnAkfvJ.exe
  2⤵
  PID:11652
- C:\Windows\System\mBTnDJC.exe
  C:\Windows\System\mBTnDJC.exe
  2⤵
  PID:11732
- C:\Windows\System\ZmXYaAE.exe
  C:\Windows\System\ZmXYaAE.exe
  2⤵
  PID:11860
- C:\Windows\System\whqvvGm.exe
  C:\Windows\System\whqvvGm.exe
  2⤵
  PID:12024
- C:\Windows\System\hApiUnb.exe
  C:\Windows\System\hApiUnb.exe
  2⤵
  PID:12204
- C:\Windows\System\JgLfWPE.exe
  C:\Windows\System\JgLfWPE.exe
  2⤵
  PID:11544
- C:\Windows\System\qrZjmgR.exe
  C:\Windows\System\qrZjmgR.exe
  2⤵
  PID:11760
- C:\Windows\System\nkMkRyx.exe
  C:\Windows\System\nkMkRyx.exe
  2⤵
  PID:11988
- C:\Windows\System\RDRsFtZ.exe
  C:\Windows\System\RDRsFtZ.exe
  2⤵
  PID:12148
- C:\Windows\System\PDokjpp.exe
  C:\Windows\System\PDokjpp.exe
  2⤵
  PID:12296
- C:\Windows\System\SofpqJB.exe
  C:\Windows\System\SofpqJB.exe
  2⤵
  PID:12332
- C:\Windows\System\WdOXUrn.exe
  C:\Windows\System\WdOXUrn.exe
  2⤵
  PID:12352
- C:\Windows\System\BJoFsHc.exe
  C:\Windows\System\BJoFsHc.exe
  2⤵
  PID:12388
- C:\Windows\System\rCiQyqW.exe
  C:\Windows\System\rCiQyqW.exe
  2⤵
  PID:12416
- C:\Windows\System\GbgPZAU.exe
  C:\Windows\System\GbgPZAU.exe
  2⤵
  PID:12452
- C:\Windows\System\klJBsDf.exe
  C:\Windows\System\klJBsDf.exe
  2⤵
  PID:12472
- C:\Windows\System\HVFmGmz.exe
  C:\Windows\System\HVFmGmz.exe
  2⤵
  PID:12488
- C:\Windows\System\DSvZtlx.exe
  C:\Windows\System\DSvZtlx.exe
  2⤵
  PID:12512
- C:\Windows\System\detLKlC.exe
  C:\Windows\System\detLKlC.exe
  2⤵
  PID:12548
- C:\Windows\System\dERuLLb.exe
  C:\Windows\System\dERuLLb.exe
  2⤵
  PID:12572
- C:\Windows\System\xNxFciV.exe
  C:\Windows\System\xNxFciV.exe
  2⤵
  PID:12612
- C:\Windows\System\etDcpmn.exe
  C:\Windows\System\etDcpmn.exe
  2⤵
  PID:12628
- C:\Windows\System\AAKCfIS.exe
  C:\Windows\System\AAKCfIS.exe
  2⤵
  PID:12664
- C:\Windows\System\aWQyfiM.exe
  C:\Windows\System\aWQyfiM.exe
  2⤵
  PID:12700
- C:\Windows\System\vvAuDOn.exe
  C:\Windows\System\vvAuDOn.exe
  2⤵
  PID:12724
- C:\Windows\System\tBDbZTK.exe
  C:\Windows\System\tBDbZTK.exe
  2⤵
  PID:12740
- C:\Windows\System\TxnvSsU.exe
  C:\Windows\System\TxnvSsU.exe
  2⤵
  PID:12780
- C:\Windows\System\ETxkPlU.exe
  C:\Windows\System\ETxkPlU.exe
  2⤵
  PID:12808
- C:\Windows\System\GvbPzsr.exe
  C:\Windows\System\GvbPzsr.exe
  2⤵
  PID:12828
- C:\Windows\System\KXZETsx.exe
  C:\Windows\System\KXZETsx.exe
  2⤵
  PID:12844
- C:\Windows\System\ttOxWhs.exe
  C:\Windows\System\ttOxWhs.exe
  2⤵
  PID:12868
- C:\Windows\System\rtxlfEZ.exe
  C:\Windows\System\rtxlfEZ.exe
  2⤵
  PID:12888
- C:\Windows\System\PZQsbFE.exe
  C:\Windows\System\PZQsbFE.exe
  2⤵
  PID:12928
- C:\Windows\System\XksBuow.exe
  C:\Windows\System\XksBuow.exe
  2⤵
  PID:12956
- C:\Windows\System\CIrEWVi.exe
  C:\Windows\System\CIrEWVi.exe
  2⤵
  PID:12980
- C:\Windows\System\wzDkEJb.exe
  C:\Windows\System\wzDkEJb.exe
  2⤵
  PID:13000
- C:\Windows\System\blDCVkc.exe
  C:\Windows\System\blDCVkc.exe
  2⤵
  PID:13032
- C:\Windows\System\xWnFjTW.exe
  C:\Windows\System\xWnFjTW.exe
  2⤵
  PID:13060
- C:\Windows\System\rgUvSvH.exe
  C:\Windows\System\rgUvSvH.exe
  2⤵
  PID:13084
- C:\Windows\System\aVXIaKV.exe
  C:\Windows\System\aVXIaKV.exe
  2⤵
  PID:13116
- C:\Windows\System\BeluBXL.exe
  C:\Windows\System\BeluBXL.exe
  2⤵
  PID:13148
- C:\Windows\System\wmEjVNX.exe
  C:\Windows\System\wmEjVNX.exe
  2⤵
  PID:13172
- C:\Windows\System\aLHjJlg.exe
  C:\Windows\System\aLHjJlg.exe
  2⤵
  PID:13204
- C:\Windows\System\quLWEPB.exe
  C:\Windows\System\quLWEPB.exe
  2⤵
  PID:13224
- C:\Windows\System\MkAAHvc.exe
  C:\Windows\System\MkAAHvc.exe
  2⤵
  PID:13260
- C:\Windows\System\LPQKpgm.exe
  C:\Windows\System\LPQKpgm.exe
  2⤵
  PID:13292
- C:\Windows\System\xDJzmuZ.exe
  C:\Windows\System\xDJzmuZ.exe
  2⤵
  PID:12312
- C:\Windows\System\tlfXbgi.exe
  C:\Windows\System\tlfXbgi.exe
  2⤵
  PID:12340
- C:\Windows\System\GouuHkB.exe
  C:\Windows\System\GouuHkB.exe
  2⤵
  PID:12408
- C:\Windows\System\YIgmOoJ.exe
  C:\Windows\System\YIgmOoJ.exe
  2⤵
  PID:12460
- C:\Windows\System\DXlMVXV.exe
  C:\Windows\System\DXlMVXV.exe
  2⤵
  PID:12540
- C:\Windows\System\pzpSzPV.exe
  C:\Windows\System\pzpSzPV.exe
  2⤵
  PID:12600
- C:\Windows\System\BSvlfZD.exe
  C:\Windows\System\BSvlfZD.exe
  2⤵
  PID:12652
- C:\Windows\System\fEfWvqD.exe
  C:\Windows\System\fEfWvqD.exe
  2⤵
  PID:12736
- C:\Windows\System\FpuvOtw.exe
  C:\Windows\System\FpuvOtw.exe
  2⤵
  PID:12792
- C:\Windows\System\wVTlPsZ.exe
  C:\Windows\System\wVTlPsZ.exe
  2⤵
  PID:12860
- C:\Windows\System\ySguObq.exe
  C:\Windows\System\ySguObq.exe
  2⤵
  PID:12896
- C:\Windows\System\qqhcCea.exe
  C:\Windows\System\qqhcCea.exe
  2⤵
  PID:12976
- C:\Windows\System\otalenw.exe
  C:\Windows\System\otalenw.exe
  2⤵
  PID:13044
- C:\Windows\System\MyVPZVB.exe
  C:\Windows\System\MyVPZVB.exe
  2⤵
  PID:13140
- C:\Windows\System\HMagrYc.exe
  C:\Windows\System\HMagrYc.exe
  2⤵
  PID:13104
- C:\Windows\System\WWGPxip.exe
  C:\Windows\System\WWGPxip.exe
  2⤵
  PID:13220
- C:\Windows\System\DJyayGO.exe
  C:\Windows\System\DJyayGO.exe
  2⤵
  PID:13192
- C:\Windows\System\diIuiYA.exe
  C:\Windows\System\diIuiYA.exe
  2⤵
  PID:11392
- C:\Windows\System\ckNyZwE.exe
  C:\Windows\System\ckNyZwE.exe
  2⤵
  PID:11864
- C:\Windows\System\YdemnVm.exe
  C:\Windows\System\YdemnVm.exe
  2⤵
  PID:12532
- C:\Windows\System\NFITZtW.exe
  C:\Windows\System\NFITZtW.exe
  2⤵
  PID:12644
- C:\Windows\System\umsDmLx.exe
  C:\Windows\System\umsDmLx.exe
  2⤵
  PID:12912
- C:\Windows\System\Aekedtb.exe
  C:\Windows\System\Aekedtb.exe
  2⤵
  PID:13016
- C:\Windows\System\soXRhvQ.exe
  C:\Windows\System\soXRhvQ.exe
  2⤵
  PID:11752
- C:\Windows\System\GyqFKGA.exe
  C:\Windows\System\GyqFKGA.exe
  2⤵
  PID:13244
- C:\Windows\System\iGkiofy.exe
  C:\Windows\System\iGkiofy.exe
  2⤵
  PID:12800
- C:\Windows\System\PFjsuii.exe
  C:\Windows\System\PFjsuii.exe
  2⤵
  PID:12732
- C:\Windows\System\aUzHGJG.exe
  C:\Windows\System\aUzHGJG.exe
  2⤵
  PID:10664
- C:\Windows\System\FeLiCWv.exe
  C:\Windows\System\FeLiCWv.exe
  2⤵
  PID:12708
- C:\Windows\System\UtJQvWd.exe
  C:\Windows\System\UtJQvWd.exe
  2⤵
  PID:2376
- C:\Windows\System\KyFnQyI.exe
  C:\Windows\System\KyFnQyI.exe
  2⤵
  PID:13328
- C:\Windows\System\gdVhPHX.exe
  C:\Windows\System\gdVhPHX.exe
  2⤵
  PID:13348
- C:\Windows\System\jsptIqp.exe
  C:\Windows\System\jsptIqp.exe
  2⤵
  PID:13380
- C:\Windows\System\mbfGkky.exe
  C:\Windows\System\mbfGkky.exe
  2⤵
  PID:13412
- C:\Windows\System\XSvtsAZ.exe
  C:\Windows\System\XSvtsAZ.exe
  2⤵
  PID:13440
- C:\Windows\System\ydZBzwK.exe
  C:\Windows\System\ydZBzwK.exe
  2⤵
  PID:13468
- C:\Windows\System\lFTjqCL.exe
  C:\Windows\System\lFTjqCL.exe
  2⤵
  PID:13496
- C:\Windows\System\dzPyHKY.exe
  C:\Windows\System\dzPyHKY.exe
  2⤵
  PID:13524
- C:\Windows\System\fAOYDvV.exe
  C:\Windows\System\fAOYDvV.exe
  2⤵
  PID:13556
- C:\Windows\System\dRhbrLM.exe
  C:\Windows\System\dRhbrLM.exe
  2⤵
  PID:13580
- C:\Windows\System\TNADTNd.exe
  C:\Windows\System\TNADTNd.exe
  2⤵
  PID:13616
- C:\Windows\System\yTTIJPa.exe
  C:\Windows\System\yTTIJPa.exe
  2⤵
  PID:13636
- C:\Windows\System\CzSxAGG.exe
  C:\Windows\System\CzSxAGG.exe
  2⤵
  PID:13656
- C:\Windows\System\qvzYQHK.exe
  C:\Windows\System\qvzYQHK.exe
  2⤵
  PID:13680
- C:\Windows\System\ByBqJNu.exe
  C:\Windows\System\ByBqJNu.exe
  2⤵
  PID:13712
- C:\Windows\System\PCQcFRD.exe
  C:\Windows\System\PCQcFRD.exe
  2⤵
  PID:13748
- C:\Windows\System\CpMXThW.exe
  C:\Windows\System\CpMXThW.exe
  2⤵
  PID:13768
- C:\Windows\System\EvnhjoP.exe
  C:\Windows\System\EvnhjoP.exe
  2⤵
  PID:13788
- C:\Windows\System\WYkfIWN.exe
  C:\Windows\System\WYkfIWN.exe
  2⤵
  PID:13816
- C:\Windows\System\UlUpWrJ.exe
  C:\Windows\System\UlUpWrJ.exe
  2⤵
  PID:13848
- C:\Windows\System\UPpKZZM.exe
  C:\Windows\System\UPpKZZM.exe
  2⤵
  PID:13868
- C:\Windows\System\Mxzvhxk.exe
  C:\Windows\System\Mxzvhxk.exe
  2⤵
  PID:13908
- C:\Windows\System\eNkbdoU.exe
  C:\Windows\System\eNkbdoU.exe
  2⤵
  PID:13944
- C:\Windows\System\XbfSmhV.exe
  C:\Windows\System\XbfSmhV.exe
  2⤵
  PID:13960
- C:\Windows\System\CRoWQeH.exe
  C:\Windows\System\CRoWQeH.exe
  2⤵
  PID:13984
- C:\Windows\System\eaNJpQe.exe
  C:\Windows\System\eaNJpQe.exe
  2⤵
  PID:14012
- C:\Windows\System\nwcVNPX.exe
  C:\Windows\System\nwcVNPX.exe
  2⤵
  PID:14044
- C:\Windows\System\HLeRpBW.exe
  C:\Windows\System\HLeRpBW.exe
  2⤵
  PID:14068
- C:\Windows\System\TPlLstT.exe
  C:\Windows\System\TPlLstT.exe
  2⤵
  PID:14100
- C:\Windows\System\ouNHOAj.exe
  C:\Windows\System\ouNHOAj.exe
  2⤵
  PID:14128
- C:\Windows\System\PEpGIup.exe
  C:\Windows\System\PEpGIup.exe
  2⤵
  PID:14156
- C:\Windows\System\zbLqfcX.exe
  C:\Windows\System\zbLqfcX.exe
  2⤵
  PID:14184
- C:\Windows\System\YBcwKUs.exe
  C:\Windows\System\YBcwKUs.exe
  2⤵
  PID:14204
- C:\Windows\System\ETzXyPI.exe
  C:\Windows\System\ETzXyPI.exe
  2⤵
  PID:14228
- C:\Windows\System\bafeUcM.exe
  C:\Windows\System\bafeUcM.exe
  2⤵
  PID:14244
- C:\Windows\System\TFCZRPs.exe
  C:\Windows\System\TFCZRPs.exe
  2⤵
  PID:14260
- C:\Windows\System\CmMkWsQ.exe
  C:\Windows\System\CmMkWsQ.exe
  2⤵
  PID:14288
- C:\Windows\System\xPtcEFG.exe
  C:\Windows\System\xPtcEFG.exe
  2⤵
  PID:14320
- C:\Windows\System\mwvvueH.exe
  C:\Windows\System\mwvvueH.exe
  2⤵
  PID:13080
- C:\Windows\System\OCxIljh.exe
  C:\Windows\System\OCxIljh.exe
  2⤵
  PID:13404
- C:\Windows\System\PEBlwOO.exe
  C:\Windows\System\PEBlwOO.exe
  2⤵
  PID:13424
- C:\Windows\System\QEPrfvD.exe
  C:\Windows\System\QEPrfvD.exe
  2⤵
  PID:13484
- C:\Windows\System\jaHCWzi.exe
  C:\Windows\System\jaHCWzi.exe
  2⤵
  PID:13536
- C:\Windows\System\KKhqUKz.exe
  C:\Windows\System\KKhqUKz.exe
  2⤵
  PID:13624
- C:\Windows\System\jWsbdzY.exe
  C:\Windows\System\jWsbdzY.exe
  2⤵
  PID:13736
- C:\Windows\System\TqdGDWw.exe
  C:\Windows\System\TqdGDWw.exe
  2⤵
  PID:13756
- C:\Windows\System\kWSWbNy.exe
  C:\Windows\System\kWSWbNy.exe
  2⤵
  PID:13828
- C:\Windows\System\uWUKDry.exe
  C:\Windows\System\uWUKDry.exe
  2⤵
  PID:13896
- C:\Windows\System\uCLHHjT.exe
  C:\Windows\System\uCLHHjT.exe
  2⤵
  PID:14020
- C:\Windows\System\IUMzNgA.exe
  C:\Windows\System\IUMzNgA.exe
  2⤵
  PID:14084
- C:\Windows\System\hiBFJCp.exe
  C:\Windows\System\hiBFJCp.exe
  2⤵
  PID:2452
- C:\Windows\System\ONYfuzB.exe
  C:\Windows\System\ONYfuzB.exe
  2⤵
  PID:14200
- C:\Windows\System\lTvjbaV.exe
  C:\Windows\System\lTvjbaV.exe
  2⤵
  PID:14252
- C:\Windows\System\LqErBsa.exe
  C:\Windows\System\LqErBsa.exe
  2⤵
  PID:14304
- C:\Windows\System\tLpatOB.exe
  C:\Windows\System\tLpatOB.exe
  2⤵
  PID:13428
- C:\Windows\System\LJjjDQq.exe
  C:\Windows\System\LJjjDQq.exe
  2⤵
  PID:13564
- C:\Windows\System\EsGXxKk.exe
  C:\Windows\System\EsGXxKk.exe
  2⤵
  PID:4596
- C:\Windows\System\rHYWGMX.exe
  C:\Windows\System\rHYWGMX.exe
  2⤵
  PID:13892
- C:\Windows\System\EyVSBYv.exe
  C:\Windows\System\EyVSBYv.exe
  2⤵
  PID:13992
- C:\Windows\System\qgTluvv.exe
  C:\Windows\System\qgTluvv.exe
  2⤵
  PID:14080
- C:\Windows\System\jhhDXLF.exe
  C:\Windows\System\jhhDXLF.exe
  2⤵
  PID:13184
- C:\Windows\System\yTlYVPg.exe
  C:\Windows\System\yTlYVPg.exe
  2⤵
  PID:1972
- C:\Windows\System\LVkTTjL.exe
  C:\Windows\System\LVkTTjL.exe
  2⤵
  PID:13884
- C:\Windows\System\VkksDpA.exe
  C:\Windows\System\VkksDpA.exe
  2⤵
  PID:14240
- C:\Windows\System\ZrxmWto.exe
  C:\Windows\System\ZrxmWto.exe
  2⤵
  PID:13492
- C:\Windows\System\sTQiUNN.exe
  C:\Windows\System\sTQiUNN.exe
  2⤵
  PID:14140
- C:\Windows\System\qqMVbTl.exe
  C:\Windows\System\qqMVbTl.exe
  2⤵
  PID:14352
- C:\Windows\System\UODtQnS.exe
  C:\Windows\System\UODtQnS.exe
  2⤵
  PID:14388
- C:\Windows\System\zFxkkiS.exe
  C:\Windows\System\zFxkkiS.exe
  2⤵
  PID:14420
- C:\Windows\System\VVhSAnU.exe
  C:\Windows\System\VVhSAnU.exe
  2⤵
  PID:14444
- C:\Windows\System\THpKTIz.exe
  C:\Windows\System\THpKTIz.exe
  2⤵
  PID:14468
- C:\Windows\System\cRJmPTY.exe
  C:\Windows\System\cRJmPTY.exe
  2⤵
  PID:14496
- C:\Windows\System\SQFYJiS.exe
  C:\Windows\System\SQFYJiS.exe
  2⤵
  PID:14524
- C:\Windows\System\cZAWSFX.exe
  C:\Windows\System\cZAWSFX.exe
  2⤵
  PID:14544
- C:\Windows\System\bynpeAH.exe
  C:\Windows\System\bynpeAH.exe
  2⤵
  PID:14564
- C:\Windows\System\eMskqPE.exe
  C:\Windows\System\eMskqPE.exe
  2⤵
  PID:14592
- C:\Windows\System\ESoBtfU.exe
  C:\Windows\System\ESoBtfU.exe
  2⤵
  PID:14624
- C:\Windows\System\XdkWfKF.exe
  C:\Windows\System\XdkWfKF.exe
  2⤵
  PID:14644
- C:\Windows\System\jXjlIXj.exe
  C:\Windows\System\jXjlIXj.exe
  2⤵
  PID:14668
- C:\Windows\System\ZieHEDx.exe
  C:\Windows\System\ZieHEDx.exe
  2⤵
  PID:14692
- C:\Windows\System\LgMYytx.exe
  C:\Windows\System\LgMYytx.exe
  2⤵
  PID:14716
- C:\Windows\System\VbtlcIT.exe
  C:\Windows\System\VbtlcIT.exe
  2⤵
  PID:14744
- C:\Windows\System\wUJngyW.exe
  C:\Windows\System\wUJngyW.exe
  2⤵
  PID:14764
- C:\Windows\System\OuRAPUJ.exe
  C:\Windows\System\OuRAPUJ.exe
  2⤵
  PID:14800
- C:\Windows\System\BsSfsxW.exe
  C:\Windows\System\BsSfsxW.exe
  2⤵
  PID:14828
- C:\Windows\System\lywKbxo.exe
  C:\Windows\System\lywKbxo.exe
  2⤵
  PID:14864
- C:\Windows\System\ioFBafd.exe
  C:\Windows\System\ioFBafd.exe
  2⤵
  PID:14880
- C:\Windows\System\WWvwdfK.exe
  C:\Windows\System\WWvwdfK.exe
  2⤵
  PID:14916
- C:\Windows\System\ilCIieu.exe
  C:\Windows\System\ilCIieu.exe
  2⤵
  PID:14936
- C:\Windows\System\akMwwpf.exe
  C:\Windows\System\akMwwpf.exe
  2⤵
  PID:14952
- C:\Windows\System\HJSMQdy.exe
  C:\Windows\System\HJSMQdy.exe
  2⤵
  PID:14984
- C:\Windows\System\ClXbLKv.exe
  C:\Windows\System\ClXbLKv.exe
  2⤵
  PID:15012
- C:\Windows\System\xzBgbyx.exe
  C:\Windows\System\xzBgbyx.exe
  2⤵
  PID:15040
- C:\Windows\System\BGUtDaq.exe
  C:\Windows\System\BGUtDaq.exe
  2⤵
  PID:15064
- C:\Windows\System\CDPwIEF.exe
  C:\Windows\System\CDPwIEF.exe
  2⤵
  PID:15080
- C:\Windows\System\AQOqvBM.exe
  C:\Windows\System\AQOqvBM.exe
  2⤵
  PID:15108
- C:\Windows\System\FPjOggw.exe
  C:\Windows\System\FPjOggw.exe
  2⤵
  PID:15132
- C:\Windows\System\AbXAYoP.exe
  C:\Windows\System\AbXAYoP.exe
  2⤵
  PID:15152
- C:\Windows\System\XyLPoQy.exe
  C:\Windows\System\XyLPoQy.exe
  2⤵
  PID:15176
- C:\Windows\System\mrzNGRl.exe
  C:\Windows\System\mrzNGRl.exe
  2⤵
  PID:15324
- C:\Windows\System\ZaWXKwu.exe
  C:\Windows\System\ZaWXKwu.exe
  2⤵
  PID:15352
- C:\Windows\System\HYpAlJj.exe
  C:\Windows\System\HYpAlJj.exe
  2⤵
  PID:14348
- C:\Windows\System\ETFbsyL.exe
  C:\Windows\System\ETFbsyL.exe
  2⤵
  PID:14436
- C:\Windows\System\evdqJck.exe
  C:\Windows\System\evdqJck.exe
  2⤵
  PID:14516
- C:\Windows\System\vKhejxx.exe
  C:\Windows\System\vKhejxx.exe
  2⤵
  PID:14604
- C:\Windows\System\srYgIFV.exe
  C:\Windows\System\srYgIFV.exe
  2⤵
  PID:14536
- C:\Windows\System\KEpQZDd.exe
  C:\Windows\System\KEpQZDd.exe
  2⤵
  PID:14676
- C:\Windows\System\JMZdVLF.exe
  C:\Windows\System\JMZdVLF.exe
  2⤵
  PID:14704
- C:\Windows\System\qsQFNYV.exe
  C:\Windows\System\qsQFNYV.exe
  2⤵
  PID:14820
- C:\Windows\System\laEYXUG.exe
  C:\Windows\System\laEYXUG.exe
  2⤵
  PID:14756
- C:\Windows\System\ntXihEy.exe
  C:\Windows\System\ntXihEy.exe
  2⤵
  PID:14960
- C:\Windows\System\AECRTLw.exe
  C:\Windows\System\AECRTLw.exe
  2⤵
  PID:536
- C:\Windows\System\dVmXZIK.exe
  C:\Windows\System\dVmXZIK.exe
  2⤵
  PID:15056
- C:\Windows\System\cpmiKnx.exe
  C:\Windows\System\cpmiKnx.exe
  2⤵
  PID:15104
- C:\Windows\System\zQbZzZA.exe
  C:\Windows\System\zQbZzZA.exe
  2⤵
  PID:14996
- C:\Windows\System\kFXKdUX.exe
  C:\Windows\System\kFXKdUX.exe
  2⤵
  PID:15144
- C:\Windows\System\UdohrRs.exe
  C:\Windows\System\UdohrRs.exe
  2⤵
  PID:15296
- C:\Windows\System\PwEVHpH.exe
  C:\Windows\System\PwEVHpH.exe
  2⤵
  PID:15312
- C:\Windows\System\wEGALUf.exe
  C:\Windows\System\wEGALUf.exe
  2⤵
  PID:13596
- C:\Windows\System\njdfAOp.exe
  C:\Windows\System\njdfAOp.exe
  2⤵
  PID:14364
- C:\Windows\System\pSRuBSN.exe
  C:\Windows\System\pSRuBSN.exe
  2⤵
  PID:14616
- C:\Windows\System\ZUkrrdv.exe
  C:\Windows\System\ZUkrrdv.exe
  2⤵
  PID:14136
- C:\Windows\System\rLyMGUb.exe
  C:\Windows\System\rLyMGUb.exe
  2⤵
  PID:14792
- C:\Windows\System\rSDSPCg.exe
  C:\Windows\System\rSDSPCg.exe
  2⤵
  PID:14712
- C:\Windows\System\nIriJSC.exe
  C:\Windows\System\nIriJSC.exe
  2⤵
  PID:15172
- C:\Windows\System\rltWvEK.exe
  C:\Windows\System\rltWvEK.exe
  2⤵
  PID:15128
- C:\Windows\System\QsAnmUu.exe
  C:\Windows\System\QsAnmUu.exe
  2⤵
  PID:15200
- C:\Windows\System\VCwcwAu.exe
  C:\Windows\System\VCwcwAu.exe
  2⤵
  PID:14688
- C:\Windows\System\dBKiDWY.exe
  C:\Windows\System\dBKiDWY.exe
  2⤵
  PID:14848
- C:\Windows\System\zLbXPwm.exe
  C:\Windows\System\zLbXPwm.exe
  2⤵
  PID:15368
- C:\Windows\System\SkaHBjC.exe
  C:\Windows\System\SkaHBjC.exe
  2⤵
  PID:15408
- C:\Windows\System\AaxljMe.exe
  C:\Windows\System\AaxljMe.exe
  2⤵
  PID:15432
- C:\Windows\System\KyHWpRY.exe
  C:\Windows\System\KyHWpRY.exe
  2⤵
  PID:15456
- C:\Windows\System\uWEIdEp.exe
  C:\Windows\System\uWEIdEp.exe
  2⤵
  PID:15480
- C:\Windows\System\lYDJSiI.exe
  C:\Windows\System\lYDJSiI.exe
  2⤵
  PID:15508
- C:\Windows\System\yughRAi.exe
  C:\Windows\System\yughRAi.exe
  2⤵
  PID:15540
- C:\Windows\System\CBiaaUf.exe
  C:\Windows\System\CBiaaUf.exe
  2⤵
  PID:15568
- C:\Windows\System\pLalqgQ.exe
  C:\Windows\System\pLalqgQ.exe
  2⤵
  PID:15596
- C:\Windows\System\sEVKpFS.exe
  C:\Windows\System\sEVKpFS.exe
  2⤵
  PID:15624
- C:\Windows\System\siTtqhr.exe
  C:\Windows\System\siTtqhr.exe
  2⤵
  PID:15668
- C:\Windows\System\dYmHgYP.exe
  C:\Windows\System\dYmHgYP.exe
  2⤵
  PID:15700
- C:\Windows\System\ZIsBFwF.exe
  C:\Windows\System\ZIsBFwF.exe
  2⤵
  PID:15720
- C:\Windows\System\UWprham.exe
  C:\Windows\System\UWprham.exe
  2⤵
  PID:15748
- C:\Windows\System\emdqQgc.exe
  C:\Windows\System\emdqQgc.exe
  2⤵
  PID:15780
- C:\Windows\System\VDjLkko.exe
  C:\Windows\System\VDjLkko.exe
  2⤵
  PID:15800
- C:\Windows\System\FZnQapV.exe
  C:\Windows\System\FZnQapV.exe
  2⤵
  PID:15824
- C:\Windows\System\foMYMoT.exe
  C:\Windows\System\foMYMoT.exe
  2⤵
  PID:15840
- C:\Windows\System\JopvQRt.exe
  C:\Windows\System\JopvQRt.exe
  2⤵
  PID:15856
- C:\Windows\System\MvwkYGy.exe
  C:\Windows\System\MvwkYGy.exe
  2⤵
  PID:15880
- C:\Windows\System\EojrNkN.exe
  C:\Windows\System\EojrNkN.exe
  2⤵
  PID:15904
- C:\Windows\System\QqLrkUo.exe
  C:\Windows\System\QqLrkUo.exe
  2⤵
  PID:15928
- C:\Windows\System\XIMWldI.exe
  C:\Windows\System\XIMWldI.exe
  2⤵
  PID:15956
- C:\Windows\System\gabsWJp.exe
  C:\Windows\System\gabsWJp.exe
  2⤵
  PID:15988
- C:\Windows\System\CUefYyL.exe
  C:\Windows\System\CUefYyL.exe
  2⤵
  PID:16016
- C:\Windows\System\wCKZpXy.exe
  C:\Windows\System\wCKZpXy.exe
  2⤵
  PID:16048
- C:\Windows\System\mwDnwqE.exe
  C:\Windows\System\mwDnwqE.exe
  2⤵
  PID:16072
- C:\Windows\System\uRmJEtC.exe
  C:\Windows\System\uRmJEtC.exe
  2⤵
  PID:16100
- C:\Windows\System\GYloaaC.exe
  C:\Windows\System\GYloaaC.exe
  2⤵
  PID:16136
- C:\Windows\System\hIGSdyG.exe
  C:\Windows\System\hIGSdyG.exe
  2⤵
  PID:16168
- C:\Windows\System\wnaqZHv.exe
  C:\Windows\System\wnaqZHv.exe
  2⤵
  PID:16188
- C:\Windows\System\MlcutbE.exe
  C:\Windows\System\MlcutbE.exe
  2⤵
  PID:16220
- C:\Windows\System\fQaQLRl.exe
  C:\Windows\System\fQaQLRl.exe
  2⤵
  PID:16248
- C:\Windows\System\vbxaHTt.exe
  C:\Windows\System\vbxaHTt.exe
  2⤵
  PID:16272
- C:\Windows\System\igSqjCX.exe
  C:\Windows\System\igSqjCX.exe
  2⤵
  PID:16288
- C:\Windows\System\otpJEhZ.exe
  C:\Windows\System\otpJEhZ.exe
  2⤵
  PID:16316
- C:\Windows\System\itjSFHJ.exe
  C:\Windows\System\itjSFHJ.exe
  2⤵
  PID:16344
- C:\Windows\System\VNnRrGy.exe
  C:\Windows\System\VNnRrGy.exe
  2⤵
  PID:16372
- C:\Windows\System\WLunxNF.exe
  C:\Windows\System\WLunxNF.exe
  2⤵
  PID:14876
- C:\Windows\System\stzVKKU.exe
  C:\Windows\System\stzVKKU.exe
  2⤵
  PID:14852
- C:\Windows\System\XggJnYd.exe
  C:\Windows\System\XggJnYd.exe
  2⤵
  PID:15416
- C:\Windows\System\BeGPTWD.exe
  C:\Windows\System\BeGPTWD.exe
  2⤵
  PID:15528
- C:\Windows\System\xqbxAiM.exe
  C:\Windows\System\xqbxAiM.exe
  2⤵
  PID:15488
- C:\Windows\System\VJoNeeg.exe
  C:\Windows\System\VJoNeeg.exe
  2⤵
  PID:15548
- C:\Windows\System\gUgFjNI.exe
  C:\Windows\System\gUgFjNI.exe
  2⤵
  PID:15728
- C:\Windows\System\GgfiJXA.exe
  C:\Windows\System\GgfiJXA.exe
  2⤵
  PID:4204
- C:\Windows\System\wMBwAnw.exe
  C:\Windows\System\wMBwAnw.exe
  2⤵
  PID:15812
- C:\Windows\System\CdrpHtV.exe
  C:\Windows\System\CdrpHtV.exe
  2⤵
  PID:15876
- C:\Windows\System\kYwSdCI.exe
  C:\Windows\System\kYwSdCI.exe
  2⤵
  PID:15792
- C:\Windows\System\vDTvsrn.exe
  C:\Windows\System\vDTvsrn.exe
  2⤵
  PID:1020
- C:\Windows\System\EhzXDbF.exe
  C:\Windows\System\EhzXDbF.exe
  2⤵
  PID:16028
- C:\Windows\System\jqKmzxt.exe
  C:\Windows\System\jqKmzxt.exe
  2⤵
  PID:15964
- C:\Windows\System\NWHhMFT.exe
  C:\Windows\System\NWHhMFT.exe
  2⤵
  PID:16084
- C:\Windows\System\iHzutqj.exe
  C:\Windows\System\iHzutqj.exe
  2⤵
  PID:16152
- C:\Windows\System\ukriDku.exe
  C:\Windows\System\ukriDku.exe
  2⤵
  PID:16068
- C:\Windows\System\jSrqzge.exe
  C:\Windows\System\jSrqzge.exe
  2⤵
  PID:16120
- C:\Windows\System\BAlTarW.exe
  C:\Windows\System\BAlTarW.exe
  2⤵
  PID:16368
- C:\Windows\System\DMBLzSP.exe
  C:\Windows\System\DMBLzSP.exe
  2⤵
  PID:16256
- C:\Windows\System\eKOxIjm.exe
  C:\Windows\System\eKOxIjm.exe
  2⤵
  PID:14784
- C:\Windows\System\VehRxcp.exe
  C:\Windows\System\VehRxcp.exe
  2⤵
  PID:15468
- C:\Windows\System\SxcOcAM.exe
  C:\Windows\System\SxcOcAM.exe
  2⤵
  PID:15708
- C:\Windows\System\otkDqji.exe
  C:\Windows\System\otkDqji.exe
  2⤵
  PID:16004
- C:\Windows\System\IGgTuwS.exe
  C:\Windows\System\IGgTuwS.exe
  2⤵
  PID:16012
- C:\Windows\System\OwyhAKk.exe
  C:\Windows\System\OwyhAKk.exe
  2⤵
  PID:15612
- C:\Windows\System\SmXzSbs.exe
  C:\Windows\System\SmXzSbs.exe
  2⤵
  PID:16284
- C:\Windows\System\zTdLilb.exe
  C:\Windows\System\zTdLilb.exe
  2⤵
  PID:16360
- C:\Windows\System\FWtLRIq.exe
  C:\Windows\System\FWtLRIq.exe
  2⤵
  PID:15916
- C:\Windows\System\TnKsTph.exe
  C:\Windows\System\TnKsTph.exe
  2⤵
  PID:16204
- C:\Windows\System\TbBZhjX.exe
  C:\Windows\System\TbBZhjX.exe
  2⤵
  PID:15364
- C:\Windows\System\iDRkaEk.exe
  C:\Windows\System\iDRkaEk.exe
  2⤵
  PID:16396
- C:\Windows\System\fBWsYlG.exe
  C:\Windows\System\fBWsYlG.exe
  2⤵
  PID:16420
- C:\Windows\System\jvdyfRU.exe
  C:\Windows\System\jvdyfRU.exe
  2⤵
  PID:16464
- C:\Windows\System\avJUTzb.exe
  C:\Windows\System\avJUTzb.exe
  2⤵
  PID:16480
- C:\Windows\System\SThovGl.exe
  C:\Windows\System\SThovGl.exe
  2⤵
  PID:16504
- C:\Windows\System\eoccVSp.exe
  C:\Windows\System\eoccVSp.exe
  2⤵
  PID:16520
- C:\Windows\System\GMRqYKF.exe
  C:\Windows\System\GMRqYKF.exe
  2⤵
  PID:16548
- C:\Windows\System\RYunZoJ.exe
  C:\Windows\System\RYunZoJ.exe
  2⤵
  PID:16580
- C:\Windows\System\UfsFPKj.exe
  C:\Windows\System\UfsFPKj.exe
  2⤵
  PID:16604
- C:\Windows\System\WfDsKnN.exe
  C:\Windows\System\WfDsKnN.exe
  2⤵
  PID:16636
- C:\Windows\System\QaTsqqs.exe
  C:\Windows\System\QaTsqqs.exe
  2⤵
  PID:16652
- C:\Windows\System\oSazVKG.exe
  C:\Windows\System\oSazVKG.exe
  2⤵
  PID:16680
- C:\Windows\System\LhsHDNo.exe
  C:\Windows\System\LhsHDNo.exe
  2⤵
  PID:16712
- C:\Windows\System\BemhYHF.exe
  C:\Windows\System\BemhYHF.exe
  2⤵
  PID:16732
- C:\Windows\System\zJZpBEg.exe
  C:\Windows\System\zJZpBEg.exe
  2⤵
  PID:16764
- C:\Windows\System\EWAmNZe.exe
  C:\Windows\System\EWAmNZe.exe
  2⤵
  PID:16788
- C:\Windows\System\ijckLQJ.exe
  C:\Windows\System\ijckLQJ.exe
  2⤵
  PID:16820
- C:\Windows\System\goYTiMA.exe
  C:\Windows\System\goYTiMA.exe
  2⤵
  PID:16856
- C:\Windows\System\mUSdOSY.exe
  C:\Windows\System\mUSdOSY.exe
  2⤵
  PID:16880
- C:\Windows\System\IktFWNp.exe
  C:\Windows\System\IktFWNp.exe
  2⤵
  PID:16908
- C:\Windows\System\XnMHSPO.exe
  C:\Windows\System\XnMHSPO.exe
  2⤵
  PID:16936
- C:\Windows\System\rkkZwgx.exe
  C:\Windows\System\rkkZwgx.exe
  2⤵
  PID:16972
- C:\Windows\System\TaiunwI.exe
  C:\Windows\System\TaiunwI.exe
  2⤵
  PID:17000
- C:\Windows\System\xplEptK.exe
  C:\Windows\System\xplEptK.exe
  2⤵
  PID:17028
- C:\Windows\System\rlcEEsS.exe
  C:\Windows\System\rlcEEsS.exe
  2⤵
  PID:17056
- C:\Windows\System\jgKBgRU.exe
  C:\Windows\System\jgKBgRU.exe
  2⤵
  PID:17084
- C:\Windows\System\TwGDBkM.exe
  C:\Windows\System\TwGDBkM.exe
  2⤵
  PID:17112
- C:\Windows\System\JJGMkOZ.exe
  C:\Windows\System\JJGMkOZ.exe
  2⤵
  PID:17136
- C:\Windows\System\QEliOVk.exe
  C:\Windows\System\QEliOVk.exe
  2⤵
  PID:17164
- C:\Windows\System\sLbJHyh.exe
  C:\Windows\System\sLbJHyh.exe
  2⤵
  PID:17192
- C:\Windows\System\RfbTizj.exe
  C:\Windows\System\RfbTizj.exe
  2⤵
  PID:17224
- C:\Windows\System\WGGhkEX.exe
  C:\Windows\System\WGGhkEX.exe
  2⤵
  PID:17248
- C:\Windows\System\qFBUjnK.exe
  C:\Windows\System\qFBUjnK.exe
  2⤵
  PID:17276
- C:\Windows\System\wOiIfPo.exe
  C:\Windows\System\wOiIfPo.exe
  2⤵
  PID:17304
- C:\Windows\System\mxbCEWf.exe
  C:\Windows\System\mxbCEWf.exe
  2⤵
  PID:17324
- C:\Windows\System\ZwFFbbX.exe
  C:\Windows\System\ZwFFbbX.exe
  2⤵
  PID:17352
- C:\Windows\System\WhpwkUG.exe
  C:\Windows\System\WhpwkUG.exe
  2⤵
  PID:17376
- C:\Windows\System\HNrDHYu.exe
  C:\Windows\System\HNrDHYu.exe
  2⤵
  PID:2148
- C:\Windows\System\XdxyZMQ.exe
  C:\Windows\System\XdxyZMQ.exe
  2⤵
  PID:16388
- C:\Windows\System\YFrDxQG.exe
  C:\Windows\System\YFrDxQG.exe
  2⤵
  PID:15760
- C:\Windows\System\TpoCZnk.exe
  C:\Windows\System\TpoCZnk.exe
  2⤵
  PID:4496
- C:\Windows\System\UcSwSzE.exe
  C:\Windows\System\UcSwSzE.exe
  2⤵
  PID:16784
- C:\Windows\System\xVDVVZY.exe
  C:\Windows\System\xVDVVZY.exe
  2⤵
  PID:17040
- C:\Windows\System\zsoUZrZ.exe
  C:\Windows\System\zsoUZrZ.exe
  2⤵
  PID:16848
- C:\Windows\System\GbuvnpK.exe
  C:\Windows\System\GbuvnpK.exe
  2⤵
  PID:17024
- C:\Windows\System\vncfBcH.exe
  C:\Windows\System\vncfBcH.exe
  2⤵
  PID:17152
- C:\Windows\System\DVTCIxA.exe
  C:\Windows\System\DVTCIxA.exe
  2⤵
  PID:17240

C:\Windows\system32\WerFaultSecure.exe
C:\Windows\system32\WerFaultSecure.exe -u -p 4076 -s 2096
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:16668

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CWtUlIk.exe

Filesize
2.1MB

MD5
f39a80a12db88a7d98fccdda25fb03fc

SHA1
913a789114a532735a5a59588715f3aed7f93b27

SHA256
7f71dbe0824cfe30436afd83b5571a1e8da95cffee6800ba94cd88dcc0923349

SHA512
395a442cbf67c058ec9effb3bc01a749b64d6422475dc81d53fd9cb23d6c4d3e3c45ad7b2e1217a61cc91dc61da9d23a5f1c7fdc5c3ad1a7f6d5cb6da927208d

Download Submit
C:\Windows\System\CnuwwZc.exe

Filesize
2.1MB

MD5
75c4f22563cc60d35e5f3d6206c40097

SHA1
b44fa94052f0553c34c2cd5e1e1842038e7018e2

SHA256
ae7aeaa577ddcb019098a2153bb40415760125a846bf59ed45eff011bd739b29

SHA512
60c8a57122e00ece089be556bcab94aa88f05599bf2db741d19c86e040c515ec051ce135a257410c4afb0988bd9da74910dfb9523fb5b23adea9070c4b7bb8c8

Download Submit
C:\Windows\System\DbrcoHX.exe

Filesize
2.1MB

MD5
8a702a942f0fe867a2f51dc11c3e9b3e

SHA1
f3ef60ff628aae8bc53230174004bdd049500308

SHA256
b46cd11e51961a716adab6ffed36f8fb196e82444e3dfa5be91f6653710e4a99

SHA512
d82ee86121aeb26834042a1f3072172ab9064f53ba870b5404dd3cacbf8f7001edc167e6c19031505c48ed6dac26e74b480a8aa49c6fbd5fab0eaaed929bb9a4

Download Submit
C:\Windows\System\FSFAepW.exe

Filesize
2.1MB

MD5
377a6deb4ea2405efd15abb86f011e39

SHA1
aca43123a7d023019549fca68176091fd860968b

SHA256
9fd2f7eb507b8d3a90ee56384aea3f678d1e452c3686b6a1e63491fb57dc38f9

SHA512
73105e870a9ef7992610321fd9ffb108589e77a2327d99e079c415c2cb637dcb828d604151420debf0ae6c50231704bd9873ec49884b9b9abc3ca2a297af3923

Download Submit
C:\Windows\System\FeOHTMs.exe

Filesize
2.1MB

MD5
499876df45eca28d99480b0f8cb11a8a

SHA1
05d0d935636c5caf9c42ffe6b1ac15ec99fcc649

SHA256
3a89d24f374b042f0e42de85aec8fd3aabedaf01f8e41a60aaf9921a05c3efa3

SHA512
14efafa4feb3ac42d75d6ff10161e15e25aabf16e0c1593df2104b6281f32daafe1f7f2cdcecde6828240a014ae78cae8c2c712611e2f1100984b8eb1ca1db98

Download Submit
C:\Windows\System\IFZtMRK.exe

Filesize
2.1MB

MD5
a9e4d9d0ac037a9b5743344de193d9eb

SHA1
c824e49df3df6596ea2ef742207afabb34cd331c

SHA256
dce74a7b213a9fd43a88df40f60d443731957c525747d7b56dd45c70181c4fb3

SHA512
f2b505e5ba3e826b372b7ece8ce3499d39b51a7fc8d8ea51659c2f6d3984f101462a981b75cd33cab232585f1d98a95dd2fd844c9c86b7da8b4978d175c14451

Download Submit
C:\Windows\System\JBvuxtO.exe

Filesize
2.1MB

MD5
9bfea2a37f0a6854b2d9ad6548a8e4d7

SHA1
2b270ddd6b1e977680e444f356952c78e3b2f349

SHA256
0de62d9975960f5b3ca680f2ca1f94944c9531ef6c2bf6df279ce0fd3b331ce7

SHA512
d180365bcbb48d46e1af735e5ef84c5a6b17c8c4fcc86a8459a0370873388ee3a22f00b394e8546b962f6276e64370d87ba25157fbff3e6910364a98665afe00

Download Submit
C:\Windows\System\KDESFZj.exe

Filesize
2.1MB

MD5
2f2e89c851344e5d2930f10b5fae0aad

SHA1
cfceec623277d04f9b74f09b87bf7f6711e47b88

SHA256
d38bf1dbab620f0fbc010afdb63f0388f66e42de5c56c7aeeb487f7bf4145c96

SHA512
17606d7fec1ef3d902a5b1560b78a84582a1807fc1483cd0118f6eb262a7162c0ced5a9a1b448c872748766718006888d4e855a7ecf40a37203b58a76abca0bc

Download Submit
C:\Windows\System\KHFUTAw.exe

Filesize
2.1MB

MD5
903bde7344d5b19b0de252943ed44e94

SHA1
285148b1c8dab45eef9e06bb4e81dc1f040fef9e

SHA256
eaef5aeae33b0dc383b7fda3af91af83ac7b0ca11952faf616033eb6ef1db58b

SHA512
c4dc96ce061f933a5b917a715c23af3d09a96e209496c15cb7480b730ba113b3b85c0038079ec82b139fafbd9511dbad568e2e5dc0047dc759bca6c555ec72ad

Download Submit
C:\Windows\System\MqSsXqB.exe

Filesize
2.1MB

MD5
ad507af81723eefae26ba8c6205e7423

SHA1
9efba6e4fafe1a4407fb981223145305936037d5

SHA256
ca3b02646d5b21a977843df4f72ab7c4273536121aaa8e3d7bbdf9a33f9ec57c

SHA512
8613745ae888be6dd3a499a35f86e3f8df375a929eb7a181418d9a94f9160a9837e9951ecf06be8240d21088de58af83d9f988a296f7a065d5e8af4bd33be563

Download Submit
C:\Windows\System\OlgROqW.exe

Filesize
2.1MB

MD5
e3fd2001e3c7081655dc11b696480874

SHA1
8b4938aca49f255e1dcbdfccde6fe83c32f80d56

SHA256
b60245b8a1dc80c2185284f0a6adbf615fbb557c913afbf0e1abdfa90f30bd80

SHA512
29a1cef3b25c1a8c5b0dd542f81e7fc808b0f3ef7efa57bdb6d65ddbeaa3cf320b2b94ae93176f37d8260d741b766b4b609e2fee72df7910017c1f975cff1e31

Download Submit
C:\Windows\System\RasVWsC.exe

Filesize
2.1MB

MD5
c56f0dda58f8fdb41ad41ab01639ecab

SHA1
b9ef7543b659b6d1f930e300c4e167c0da00349a

SHA256
1e53c378c3534aa8db23532062cfa34677a23237f302a569b98518313e734f0f

SHA512
f7703fcb7e7f8e630650e3c23684856d06bc4564f9330deb4433d9f3672b9d8e57cdf552cd045bf3a3c5bb63ecb0df621384d200b2d5775b21018a4d8d228956

Download Submit
C:\Windows\System\SEoRTvP.exe

Filesize
2.1MB

MD5
3ce32e2f36f2cea8080c763a5ebe95d8

SHA1
e271487a3676dd01bfad19ef26caf0282f8f9cfa

SHA256
1a911dfe08a34f14996e842e1b5c1bbc13bfb3a5cbf254b7b44a4dbbf17fe54f

SHA512
2675d8fa1d5e1d4b6bdb9a7c9cff2e440fddaee7cd8ec44342807d7f21ac4bd60bfaaa651623436dfb8c028bfa0795a0a93dd0313472408406417f8f6d8b0aa5

Download Submit
C:\Windows\System\UKedMoz.exe

Filesize
2.1MB

MD5
599761eeb3bda12d1144b4da6331d53c

SHA1
63ff00d26f03b4237a6bd38bfa0322dfdcefb2aa

SHA256
3ecee9b5854b8d24f66b5ed2b1da0f7699c5c4fbc5c323b11bbaa182be30ecdb

SHA512
0b84035f4fd1beec3d3da2886134667aa3734ffd88bcc23df03c31117fd01252e33f09214d345d70dc0709cea3554761c8ef8bbb0ee3e41c5c1bc50cf4ac992a

Download Submit
C:\Windows\System\Ufxyjcf.exe

Filesize
2.1MB

MD5
37183e4da897e504d1aa7288b7863a7c

SHA1
014bbd7d9fed17a4d16f01a9ce60e46c8e333f55

SHA256
95429503542b6366658bc20b182b93551bfac8fcbeac60902ca19b5784dced28

SHA512
f70a362c8bbfbac5c33343842eea42349f0a1b7bfddbce33cb1bffa8f2103874993010aac46d3bdc9b504e7eb7fd786387b10207530ea680cafa64c0e79ba746

Download Submit
C:\Windows\System\UtRqoDd.exe

Filesize
2.1MB

MD5
eb597269cc03374857b90ae16b07bc0c

SHA1
a6e025d8828a3452ebe7ea137064786717b47885

SHA256
a64005c4b05db070cc15c4988f5782c70a3e9b86999b52e3d54bdc2098ee99e5

SHA512
7c36c4d52f10619de8ca5fa414456006c4e72447cfae1e3ba8ccb5cf972e53f4b849cfdf8978862ce950e21380e0b2815dcbb696d0b3f2213b1db18631c295a2

Download Submit
C:\Windows\System\VSMErdX.exe

Filesize
2.1MB

MD5
0767a0d2665bc715cc667df2635e7590

SHA1
77eae8268bfadd1bda97443c752169ca0feb85ab

SHA256
7f9dfa93b31b1a01cf105f1c4149a8322e8b2414a2318b378c04203dfa22fa2f

SHA512
21a46a5396937c9dee2810a10612824aa7b74dd915b1d349612b8a9ee7529fe98ffa78650677ca6769ffc9aa1ba5be475ae8aa3cb9b472da619a1e8ada35b375

Download Submit
C:\Windows\System\ZwglFfk.exe

Filesize
2.1MB

MD5
2edbacfdb549157f593b4eaf6524382d

SHA1
05d349c62448739e9b07a1a4840298c905240382

SHA256
68382529d1eb3a6215e114adc3ea28a768c42c22cace16944e30919cdea3b5dd

SHA512
e161586a488afb1cc8043fcbf59e4d1941b79b828c84ff9729c4b16eacf2101e196defd6ce24c5bd4e0d7fc73b9c26702a23618344ba4643d5f7bcdf3fb255fd

Download Submit
C:\Windows\System\aTufcih.exe

Filesize
2.1MB

MD5
62bfd07d203c80366d1064e5f0ea33b2

SHA1
8b325116c3d0fcf065856017fc3605abf06a118a

SHA256
1b7e26eaf390231d94610dccd97bb9e77e5b83458d98b3b4bb6464c5255c7c88

SHA512
24e23cdcbffb16d01c7571cd081d8e350d055cd44bdbffbaf9fa0341b21c6b09bdf05b20be7888fb7195f349a6da51461e179638553383984dc15ef12a1fd4a1

Download Submit
C:\Windows\System\ciQiimm.exe

Filesize
2.1MB

MD5
a17c99b7589458dee8a2d05273b03a2e

SHA1
aff9104f8e90138f80d1662b8aab399df4f5b14c

SHA256
47b6b415c636c93ee8cbcca5dfba9e7d7b25fae01e99c357f102f6731f955a05

SHA512
20b9282febb8592f0396413862f3089b24915116e61c7ddc854d4c5fc32dceb2e8349760599b8b4812484d60017e056452ef6a08ef4b1f44ab7fc7f53f95e518

Download Submit
C:\Windows\System\dVeQKoD.exe

Filesize
2.1MB

MD5
298aec96f35beb7ef6c418aca28d2323

SHA1
1357f9cf2b6d916850e87093d00e5aa224fe7146

SHA256
ce1561da04e8eaf85c1fbb357dc3002f5ba1ad6a6018cc5694e20e091bd5cfa3

SHA512
b5c72c27136524342f4b1369d490f3185ac451db7f09c81f1b921a48303dcf5a63582e393769f3b7d594b68c25c6fcedb20093abec10de38abf5d46c62fecfe2

Download Submit
C:\Windows\System\eKkPGMd.exe

Filesize
2.1MB

MD5
52e12f64d1c110e394135ae0d4f59c99

SHA1
609f00650df3cd938e1303f26760c33adaafaee0

SHA256
b087c2eafb45ac7dd320bf5f1beeb1618a6b8654aa53e96bf3982de28bb9255a

SHA512
fb874cb3194df7210713b722378f7611c296d6ef22012c5642365c1eab28e851f405724fec85389dff1909927b3ffb02d551f619347bd8d5f64558fb59893590

Download Submit
C:\Windows\System\fdxRfYM.exe

Filesize
2.1MB

MD5
a35be94278e10566deeb99277f93a39c

SHA1
4e27e589debf104424e8645192f4243006adcba3

SHA256
c410b09dc1373fcc4844b85d67564e0eaa35af9c1884cbfcd78c15617940a7d0

SHA512
1dfe1232349ec51f4494774cf6da0804663e72ab6ddf0e34c0611511788772e3c16ab11206842b83f781df31f1375ded1a0ce885c52b0ad1d6b625987b2f807f

Download Submit
C:\Windows\System\hOgtUHI.exe

Filesize
2.1MB

MD5
0366ded93b05ecb8b7fe01d486514349

SHA1
cb0bc12c6218ba2eddd5eda9a99bc1dfba352a98

SHA256
1ad1df10577c194502ff4273edce71d0da6faae36920848f26381b5d65a0087b

SHA512
93ee369be66f1e5a819d5c77752cd40afadaefcf44f46b8627e818f68c5cee60f13169b8b560bf6f5e11d718944a3445226650dd152622b814e8172cf6d7b638

Download Submit
C:\Windows\System\kUnlcTy.exe

Filesize
2.1MB

MD5
f107c64c17ee4009edd748b1dccbe130

SHA1
3c82a2c4919a05b37cf7e553d818c57edd121254

SHA256
dba3e94dfa491a277671cadf0cc5de9a99a643d601d43d98cf8465844631adf5

SHA512
461ed2f892b5995b3bd613fea33c817135d5bd7b2cd909ebd865cb04669f31aace37c8613c3a5815ec0489afbd96911ca71f2bab8a4967bc91078b4cf95972fa

Download Submit
C:\Windows\System\oYMIbSY.exe

Filesize
2.1MB

MD5
f635cff77d01f006071982398b938e35

SHA1
271b5c877ca7df95fb0cba5491a09bda814fa196

SHA256
67ca7e228e411665cc6d395dab991622dffb873095ad4c6dff2e5689ad12992b

SHA512
684e9652d28b892fae428aee5a4f37088121bb70f0fd6ed43294e08801b5932ba6c0020d94d741178abf8bb524d70f2ace433af269c914f3f616f407c716d6f6

Download Submit
C:\Windows\System\rWNsAkQ.exe

Filesize
2.1MB

MD5
665cae778bff0b937950faae5f5ed554

SHA1
ac5e4eabce69649cbaa85e1d32f3258de9856cc3

SHA256
7e66f3e16823ae1d3d9b648d8ce57613bedcb5287e218989b7524909be6ff0c4

SHA512
9158ea410ce324903ec4f41e42deb87b8cf1d57c74f76a4ab098700458b462ba34b4f3766812a7586f0fa7f674600efcf31d83cf25358934b7f5431fba188eb3

Download Submit
C:\Windows\System\tFNuamU.exe

Filesize
2.1MB

MD5
5733a797e26ba119b0b4e4f43ed0e148

SHA1
7e99db8a28addea77d001ad4e13b8794c1fbb01b

SHA256
03976e33bddd9a4a29ff1b8643b355af3968b07d9e6f2292df28883eb5402a35

SHA512
784c9199fb1840b7b79bb17c22d79f90cfddc545cc40390da3855cbd682a3cf00f63b7e812f27a56ff3c5e133cd07a2cb4690e90e810247681d22551295aa2fc

Download Submit
C:\Windows\System\tjmAuNs.exe

Filesize
2.1MB

MD5
93b027c31303cb1644a912ebd77ead32

SHA1
3ca132b7dc93e183826822b46bf93ce5f32cd331

SHA256
eea8750d894ad4394a89f52a4a64727f3a252a45eaa4c3fdce803fa6d4db2ac0

SHA512
e7f24565b372a8873c1a43cbb7fa2bc720a366dc831477a1576a435f8ddcee6d2b36008df98164943a792467ff6d4c8ea85bfdab6311b997cbf47adc371b87dd

Download Submit
C:\Windows\System\uKmtSKJ.exe

Filesize
2.1MB

MD5
d3ee06d36fc1a4c8f44f71a733dcd3fa

SHA1
b46e16f0cc07c45fc23be3693918f65b6f924627

SHA256
7794cc63b73bb06a4a52df222b917a04059be76e3ebbd63d880f29c5f53c17ed

SHA512
65dda926d9627d89fcecd29b27f79f296d5f6f8ac6744d44e2312231bbdf787b496afac08ed6fa776f6fd0a3d27c0f406e6eaf1047981e333ff26f6b691e005a

Download Submit
C:\Windows\System\vBWJOOo.exe

Filesize
2.1MB

MD5
97638154cdb17c83305c91de70dc20a1

SHA1
1e26fc16f5c2728f9bec5859fd8d028238f0c275

SHA256
15f296adb50c8be9841826891e222fc084d3ab9bfb6875de0393e20b910785dc

SHA512
1cbb5c59ebe91ebdad893ac8e072b0f9bc0a2f164379a685fab96374c1fd8b3888cbe7f43b60ef6f2d2ff16bb58d05fe4c40a1453eec328ac257b03bf790d695

Download Submit
C:\Windows\System\wKpReYP.exe

Filesize
2.1MB

MD5
f5ec7ccad098c6cb79225793441099d3

SHA1
838439c01a7479dbce873f6f92b1c26f46e80eb1

SHA256
8d458fa44abf52edf977d9bc19f0729777e0eac6c08433a8441867429db2b3b5

SHA512
3ad57a536bee853c9f5a12a93fc5c604783a860cabe095d0a24a3644dde18ef55bbf59a3a994f56bc1f2a37952abc0fbcc6f5f7459dd37803d21600e77f4e98e

Download Submit
C:\Windows\System\wRdzKzN.exe

Filesize
2.1MB

MD5
99b2c01070bc2ab9e39b9c1d0c9d390e

SHA1
2c5e425979620bfd3d88240c6352649b330dc95f

SHA256
87fff97dd6a7a847d20a86e84a832fd3fbde447431b7fbd219ec617bec085fda

SHA512
b719e81c55cfac6f0131ca8e5586b63024989279cc5f2a02c3938f82cc6fc6d9d2da3ca201ee7513959a9a092ea966c75942506cd3129f0a4a9657669d9efeda

Download Submit
memory/5000-0-0x0000024FCC360000-0x0000024FCC370000-memory.dmp

Filesize
64KB

Download