xmrig | 350b48e0f873602a5adfe286b414a12d0040554f01c82010052393458655be51

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
Size 1.6MB
Sample240518-eqjacabc6w
SHA256 350b48e0f873602a5adfe286b414a12d0040554f01c82010052393458655be51
MD5 898dc90d46a03171f79809828d03c4f0
SHA1 df7ec03f705f1e97b17e1d85f25747f6240f236e
SHA512 b56d802424da9b376787a488dd3ead2aaa2b78c40c6385cebd409aac6416a5343ba96004c269976ddf75a0d4a9d6d83ad4d05c5c1fe6e54f0121e253a6430ba4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2f:GemTLkNdfE0pZa2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0007000000023428-8.dat	xmrig
behavioral2/files/0x0007000000023429-9.dat	xmrig
behavioral2/files/0x000700000002342a-19.dat	xmrig
behavioral2/files/0x000700000002342d-34.dat	xmrig
behavioral2/files/0x000700000002342f-42.dat	xmrig
behavioral2/files/0x0007000000023430-50.dat	xmrig
behavioral2/files/0x000700000002342e-39.dat	xmrig
behavioral2/files/0x000700000002342c-30.dat	xmrig
behavioral2/files/0x000700000002342b-24.dat	xmrig
behavioral2/files/0x000a0000000233ff-5.dat	xmrig
behavioral2/files/0x0007000000023431-54.dat	xmrig
behavioral2/files/0x0007000000023433-65.dat	xmrig
behavioral2/files/0x0007000000023432-63.dat	xmrig
behavioral2/files/0x0007000000023435-86.dat	xmrig
behavioral2/files/0x0007000000023439-100.dat	xmrig
behavioral2/files/0x000700000002343c-115.dat	xmrig
behavioral2/files/0x000700000002343d-120.dat	xmrig
behavioral2/files/0x000700000002343f-129.dat	xmrig
behavioral2/files/0x000700000002343e-127.dat	xmrig
behavioral2/files/0x000700000002343b-113.dat	xmrig
behavioral2/files/0x0007000000023438-111.dat	xmrig
behavioral2/files/0x000700000002343a-109.dat	xmrig
behavioral2/files/0x0007000000023437-99.dat	xmrig
behavioral2/files/0x0007000000023436-91.dat	xmrig
behavioral2/files/0x0007000000023434-75.dat	xmrig
behavioral2/files/0x000900000002341b-70.dat	xmrig
behavioral2/files/0x0007000000023440-139.dat	xmrig
behavioral2/files/0x0007000000023444-159.dat	xmrig
behavioral2/files/0x0007000000023445-161.dat	xmrig
behavioral2/files/0x0007000000023446-163.dat	xmrig
behavioral2/files/0x0007000000023442-157.dat	xmrig
behavioral2/files/0x0007000000023447-156.dat	xmrig
behavioral2/files/0x0007000000023443-152.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4416	JYqKxKD.exe
2540	PuuVKdX.exe
2936	JEEMvdh.exe
4408	OYIIfGZ.exe
624	HKuCero.exe
620	UyEqxkx.exe
3756	uFGGXcG.exe
1852	RQRcyOS.exe
3660	YjvvaBc.exe
1092	qjyCDsx.exe
1756	XWolXDd.exe
1676	IPomzwg.exe
3192	pBBaQrI.exe
3916	cQhPSgg.exe
3464	ORCjcUc.exe
1932	yvQWHFK.exe
3608	fjYoOKk.exe
3856	RYFDURe.exe
4720	JdDjtba.exe
2332	hDjGnZO.exe
1624	WtuKZyw.exe
2700	yBcqQwA.exe
532	sCTBLWS.exe
2952	ZOghWxL.exe
3232	DNhZJeo.exe
3400	FOYDMDA.exe
4116	zzmVwuD.exe
1992	IjBMbPn.exe
1116	tqExzid.exe
4928	ozwKLgt.exe
2300	VuiOyQe.exe
2456	uiCvzFF.exe
3544	GbqjAMa.exe
3952	qowtzSd.exe
2812	sSWVepR.exe
3712	vNdxaAK.exe
4700	uKUiJUF.exe
4308	uJzilMe.exe
4488	FECMmOt.exe
1488	FygdCaC.exe
212	vQvIxFz.exe
2544	qZkCtxg.exe
1600	gxcIwBA.exe
1700	OtYkwib.exe
3796	WuTRIqq.exe
4296	essTHAw.exe
4272	UdxFGCA.exe
4896	zGeyFiR.exe
1276	pOIatCs.exe
648	ITzZPFC.exe
4900	QNjXgfh.exe
2960	gnwNiJl.exe
3752	Rrsinwa.exe
2692	FjWIbkK.exe
4168	IGrPqIa.exe
3924	yQcJxHk.exe
4828	PTMiHNy.exe
2980	ERQUToC.exe
3596	qsxqisS.exe
3376	SEfERfJ.exe
1988	RFjOaAl.exe
3808	bVXrogr.exe
5088	qHUCoPt.exe
2616	behvQjz.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NwhiNkU.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\aBbsXkd.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\HheILKF.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\USqoAka.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\QLCaTOj.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\DDmhPtQ.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\gnwNiJl.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\VnNiNig.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\IoMjMDz.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\KjQqJSo.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\WtuKZyw.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\JpepNbA.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\xBkKtcs.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\ViJsdfA.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\yFluNhf.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\dRWPnJh.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\pzEZTGe.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\hDRgIxJ.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\uCTndXW.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\zzmVwuD.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\FrFFtir.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\fyoNcNs.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\uKFKinc.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\YfypZII.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\EOlPEEB.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\rGftgvB.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\EhigVdn.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\XolzCoe.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\ORCjcUc.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\xsOBMMO.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\SqNjvLp.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\bPxDbrh.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\RQRcyOS.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\AYYxDLO.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\fsPRcHs.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\QtCjWPq.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\IgUAFkG.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\rPEIuNQ.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\ZxTSyuT.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\VNbbiSW.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\ymUHlRX.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\IciXbVu.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\pBBaQrI.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\OzDWbSj.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\odmbklj.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\IvjcfSj.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\mUNxNxV.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\cNYCfSJ.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\rcojDkv.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\hZLxYIu.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\FECMmOt.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\uJzilMe.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\rtGYscf.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\ezQMbKK.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\waAUKAT.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\OYIIfGZ.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\KpXkzau.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\zsiDwtc.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\sLQzmuX.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\JgooYgF.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\lcIWhzp.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\uKUiJUF.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\aeWhOHQ.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
File created	C:\Windows\System\rxdnmiF.exe	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	788	dwm.exe
Token: SeChangeNotifyPrivilege	788	dwm.exe
Token: 33	788	dwm.exe
Token: SeIncBasePriorityPrivilege	788	dwm.exe
Token: SeShutdownPrivilege	788	dwm.exe
Token: SeCreatePagefilePrivilege	788	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4416	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	84
PID 4508 wrote to memory of 4416	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	84
PID 4508 wrote to memory of 2540	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	85
PID 4508 wrote to memory of 2540	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	85
PID 4508 wrote to memory of 2936	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	86
PID 4508 wrote to memory of 2936	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	86
PID 4508 wrote to memory of 4408	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	87
PID 4508 wrote to memory of 4408	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	87
PID 4508 wrote to memory of 624	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	88
PID 4508 wrote to memory of 624	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	88
PID 4508 wrote to memory of 620	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	89
PID 4508 wrote to memory of 620	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	89
PID 4508 wrote to memory of 3756	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	90
PID 4508 wrote to memory of 3756	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	90
PID 4508 wrote to memory of 1852	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	91
PID 4508 wrote to memory of 1852	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	91
PID 4508 wrote to memory of 3660	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	92
PID 4508 wrote to memory of 3660	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	92
PID 4508 wrote to memory of 1092	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	93
PID 4508 wrote to memory of 1092	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	93
PID 4508 wrote to memory of 1756	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	94
PID 4508 wrote to memory of 1756	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	94
PID 4508 wrote to memory of 1676	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	95
PID 4508 wrote to memory of 1676	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	95
PID 4508 wrote to memory of 3192	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	96
PID 4508 wrote to memory of 3192	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	96
PID 4508 wrote to memory of 3916	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	97
PID 4508 wrote to memory of 3916	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	97
PID 4508 wrote to memory of 3464	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	98
PID 4508 wrote to memory of 3464	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	98
PID 4508 wrote to memory of 1932	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	99
PID 4508 wrote to memory of 1932	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	99
PID 4508 wrote to memory of 3608	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	100
PID 4508 wrote to memory of 3608	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	100
PID 4508 wrote to memory of 3856	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	101
PID 4508 wrote to memory of 3856	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	101
PID 4508 wrote to memory of 4720	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	102
PID 4508 wrote to memory of 4720	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	102
PID 4508 wrote to memory of 2332	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	103
PID 4508 wrote to memory of 2332	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	103
PID 4508 wrote to memory of 1624	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	104
PID 4508 wrote to memory of 1624	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	104
PID 4508 wrote to memory of 2700	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	105
PID 4508 wrote to memory of 2700	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	105
PID 4508 wrote to memory of 532	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	106
PID 4508 wrote to memory of 532	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	106
PID 4508 wrote to memory of 2952	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	107
PID 4508 wrote to memory of 2952	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	107
PID 4508 wrote to memory of 3232	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	108
PID 4508 wrote to memory of 3232	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	108
PID 4508 wrote to memory of 3400	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	109
PID 4508 wrote to memory of 3400	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	109
PID 4508 wrote to memory of 4116	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	110
PID 4508 wrote to memory of 4116	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	110
PID 4508 wrote to memory of 1992	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	111
PID 4508 wrote to memory of 1992	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	111
PID 4508 wrote to memory of 1116	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	112
PID 4508 wrote to memory of 1116	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	112
PID 4508 wrote to memory of 4928	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	113
PID 4508 wrote to memory of 4928	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	113
PID 4508 wrote to memory of 2300	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	114
PID 4508 wrote to memory of 2300	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	114
PID 4508 wrote to memory of 2456	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	115
PID 4508 wrote to memory of 2456	4508	898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\898dc90d46a03171f79809828d03c4f0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\System\JYqKxKD.exe
  C:\Windows\System\JYqKxKD.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\PuuVKdX.exe
  C:\Windows\System\PuuVKdX.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\JEEMvdh.exe
  C:\Windows\System\JEEMvdh.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\OYIIfGZ.exe
  C:\Windows\System\OYIIfGZ.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\HKuCero.exe
  C:\Windows\System\HKuCero.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\UyEqxkx.exe
  C:\Windows\System\UyEqxkx.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\uFGGXcG.exe
  C:\Windows\System\uFGGXcG.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\RQRcyOS.exe
  C:\Windows\System\RQRcyOS.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\YjvvaBc.exe
  C:\Windows\System\YjvvaBc.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\qjyCDsx.exe
  C:\Windows\System\qjyCDsx.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\XWolXDd.exe
  C:\Windows\System\XWolXDd.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\IPomzwg.exe
  C:\Windows\System\IPomzwg.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\pBBaQrI.exe
  C:\Windows\System\pBBaQrI.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\cQhPSgg.exe
  C:\Windows\System\cQhPSgg.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\ORCjcUc.exe
  C:\Windows\System\ORCjcUc.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\yvQWHFK.exe
  C:\Windows\System\yvQWHFK.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\fjYoOKk.exe
  C:\Windows\System\fjYoOKk.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\RYFDURe.exe
  C:\Windows\System\RYFDURe.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\JdDjtba.exe
  C:\Windows\System\JdDjtba.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\hDjGnZO.exe
  C:\Windows\System\hDjGnZO.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\WtuKZyw.exe
  C:\Windows\System\WtuKZyw.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\yBcqQwA.exe
  C:\Windows\System\yBcqQwA.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\sCTBLWS.exe
  C:\Windows\System\sCTBLWS.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\ZOghWxL.exe
  C:\Windows\System\ZOghWxL.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\DNhZJeo.exe
  C:\Windows\System\DNhZJeo.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\FOYDMDA.exe
  C:\Windows\System\FOYDMDA.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\zzmVwuD.exe
  C:\Windows\System\zzmVwuD.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\IjBMbPn.exe
  C:\Windows\System\IjBMbPn.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\tqExzid.exe
  C:\Windows\System\tqExzid.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\ozwKLgt.exe
  C:\Windows\System\ozwKLgt.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\VuiOyQe.exe
  C:\Windows\System\VuiOyQe.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\uiCvzFF.exe
  C:\Windows\System\uiCvzFF.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\GbqjAMa.exe
  C:\Windows\System\GbqjAMa.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\qowtzSd.exe
  C:\Windows\System\qowtzSd.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\sSWVepR.exe
  C:\Windows\System\sSWVepR.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\vNdxaAK.exe
  C:\Windows\System\vNdxaAK.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\uKUiJUF.exe
  C:\Windows\System\uKUiJUF.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\uJzilMe.exe
  C:\Windows\System\uJzilMe.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\FECMmOt.exe
  C:\Windows\System\FECMmOt.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\qZkCtxg.exe
  C:\Windows\System\qZkCtxg.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\FygdCaC.exe
  C:\Windows\System\FygdCaC.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\vQvIxFz.exe
  C:\Windows\System\vQvIxFz.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\gxcIwBA.exe
  C:\Windows\System\gxcIwBA.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\OtYkwib.exe
  C:\Windows\System\OtYkwib.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\WuTRIqq.exe
  C:\Windows\System\WuTRIqq.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\essTHAw.exe
  C:\Windows\System\essTHAw.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\UdxFGCA.exe
  C:\Windows\System\UdxFGCA.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\zGeyFiR.exe
  C:\Windows\System\zGeyFiR.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\pOIatCs.exe
  C:\Windows\System\pOIatCs.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\ITzZPFC.exe
  C:\Windows\System\ITzZPFC.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\QNjXgfh.exe
  C:\Windows\System\QNjXgfh.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\gnwNiJl.exe
  C:\Windows\System\gnwNiJl.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\Rrsinwa.exe
  C:\Windows\System\Rrsinwa.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\FjWIbkK.exe
  C:\Windows\System\FjWIbkK.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\IGrPqIa.exe
  C:\Windows\System\IGrPqIa.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\yQcJxHk.exe
  C:\Windows\System\yQcJxHk.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\PTMiHNy.exe
  C:\Windows\System\PTMiHNy.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\ERQUToC.exe
  C:\Windows\System\ERQUToC.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\qsxqisS.exe
  C:\Windows\System\qsxqisS.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\SEfERfJ.exe
  C:\Windows\System\SEfERfJ.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\RFjOaAl.exe
  C:\Windows\System\RFjOaAl.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\bVXrogr.exe
  C:\Windows\System\bVXrogr.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\behvQjz.exe
  C:\Windows\System\behvQjz.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\qHUCoPt.exe
  C:\Windows\System\qHUCoPt.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\VpKbjGv.exe
  C:\Windows\System\VpKbjGv.exe
  2⤵
  PID:516
- C:\Windows\System\xNAmeCg.exe
  C:\Windows\System\xNAmeCg.exe
  2⤵
  PID:724
- C:\Windows\System\ibSjIIa.exe
  C:\Windows\System\ibSjIIa.exe
  2⤵
  PID:1160
- C:\Windows\System\DExdENZ.exe
  C:\Windows\System\DExdENZ.exe
  2⤵
  PID:1548
- C:\Windows\System\pxfmfbG.exe
  C:\Windows\System\pxfmfbG.exe
  2⤵
  PID:3584
- C:\Windows\System\TmhLtSK.exe
  C:\Windows\System\TmhLtSK.exe
  2⤵
  PID:992
- C:\Windows\System\SstWQSl.exe
  C:\Windows\System\SstWQSl.exe
  2⤵
  PID:388
- C:\Windows\System\aDURCle.exe
  C:\Windows\System\aDURCle.exe
  2⤵
  PID:448
- C:\Windows\System\mNSJocU.exe
  C:\Windows\System\mNSJocU.exe
  2⤵
  PID:2148
- C:\Windows\System\NpfsDiv.exe
  C:\Windows\System\NpfsDiv.exe
  2⤵
  PID:4576
- C:\Windows\System\sKqDfle.exe
  C:\Windows\System\sKqDfle.exe
  2⤵
  PID:392
- C:\Windows\System\ZMsRUvn.exe
  C:\Windows\System\ZMsRUvn.exe
  2⤵
  PID:5084
- C:\Windows\System\TPgMLwN.exe
  C:\Windows\System\TPgMLwN.exe
  2⤵
  PID:2156
- C:\Windows\System\Pwgkpsz.exe
  C:\Windows\System\Pwgkpsz.exe
  2⤵
  PID:4444
- C:\Windows\System\tueqjyx.exe
  C:\Windows\System\tueqjyx.exe
  2⤵
  PID:4728
- C:\Windows\System\JgooYgF.exe
  C:\Windows\System\JgooYgF.exe
  2⤵
  PID:2388
- C:\Windows\System\zgSqyWo.exe
  C:\Windows\System\zgSqyWo.exe
  2⤵
  PID:4200
- C:\Windows\System\sQKKsnl.exe
  C:\Windows\System\sQKKsnl.exe
  2⤵
  PID:2120
- C:\Windows\System\OCHVIpj.exe
  C:\Windows\System\OCHVIpj.exe
  2⤵
  PID:380
- C:\Windows\System\fYYKPuD.exe
  C:\Windows\System\fYYKPuD.exe
  2⤵
  PID:4788
- C:\Windows\System\tOZbItP.exe
  C:\Windows\System\tOZbItP.exe
  2⤵
  PID:3736
- C:\Windows\System\fieAJWE.exe
  C:\Windows\System\fieAJWE.exe
  2⤵
  PID:4360
- C:\Windows\System\bSBPSty.exe
  C:\Windows\System\bSBPSty.exe
  2⤵
  PID:4400
- C:\Windows\System\vJCEeYh.exe
  C:\Windows\System\vJCEeYh.exe
  2⤵
  PID:2296
- C:\Windows\System\YYmxleN.exe
  C:\Windows\System\YYmxleN.exe
  2⤵
  PID:4620
- C:\Windows\System\yVxIUnl.exe
  C:\Windows\System\yVxIUnl.exe
  2⤵
  PID:2672
- C:\Windows\System\msgdFGj.exe
  C:\Windows\System\msgdFGj.exe
  2⤵
  PID:5132
- C:\Windows\System\ZlqZGTr.exe
  C:\Windows\System\ZlqZGTr.exe
  2⤵
  PID:5160
- C:\Windows\System\wEyYSMc.exe
  C:\Windows\System\wEyYSMc.exe
  2⤵
  PID:5188
- C:\Windows\System\KgtOAqh.exe
  C:\Windows\System\KgtOAqh.exe
  2⤵
  PID:5216
- C:\Windows\System\LrnbyyH.exe
  C:\Windows\System\LrnbyyH.exe
  2⤵
  PID:5252
- C:\Windows\System\BiUZmkg.exe
  C:\Windows\System\BiUZmkg.exe
  2⤵
  PID:5276
- C:\Windows\System\eiLDeer.exe
  C:\Windows\System\eiLDeer.exe
  2⤵
  PID:5304
- C:\Windows\System\FmyHgyw.exe
  C:\Windows\System\FmyHgyw.exe
  2⤵
  PID:5336
- C:\Windows\System\xwGxlUc.exe
  C:\Windows\System\xwGxlUc.exe
  2⤵
  PID:5368
- C:\Windows\System\AZuJLlj.exe
  C:\Windows\System\AZuJLlj.exe
  2⤵
  PID:5404
- C:\Windows\System\ElMBucs.exe
  C:\Windows\System\ElMBucs.exe
  2⤵
  PID:5428
- C:\Windows\System\JzgcFUI.exe
  C:\Windows\System\JzgcFUI.exe
  2⤵
  PID:5448
- C:\Windows\System\byTaxcb.exe
  C:\Windows\System\byTaxcb.exe
  2⤵
  PID:5488
- C:\Windows\System\QqkQDSz.exe
  C:\Windows\System\QqkQDSz.exe
  2⤵
  PID:5520
- C:\Windows\System\ZLthvVd.exe
  C:\Windows\System\ZLthvVd.exe
  2⤵
  PID:5548
- C:\Windows\System\APjyYkh.exe
  C:\Windows\System\APjyYkh.exe
  2⤵
  PID:5576
- C:\Windows\System\jJlNjIZ.exe
  C:\Windows\System\jJlNjIZ.exe
  2⤵
  PID:5604
- C:\Windows\System\dCqprdN.exe
  C:\Windows\System\dCqprdN.exe
  2⤵
  PID:5640
- C:\Windows\System\YOnDRmF.exe
  C:\Windows\System\YOnDRmF.exe
  2⤵
  PID:5668
- C:\Windows\System\roZTZlO.exe
  C:\Windows\System\roZTZlO.exe
  2⤵
  PID:5696
- C:\Windows\System\SQFwqPe.exe
  C:\Windows\System\SQFwqPe.exe
  2⤵
  PID:5720
- C:\Windows\System\szZvimw.exe
  C:\Windows\System\szZvimw.exe
  2⤵
  PID:5752
- C:\Windows\System\wIqXFMp.exe
  C:\Windows\System\wIqXFMp.exe
  2⤵
  PID:5780
- C:\Windows\System\PNJclin.exe
  C:\Windows\System\PNJclin.exe
  2⤵
  PID:5812
- C:\Windows\System\ZxwmIFg.exe
  C:\Windows\System\ZxwmIFg.exe
  2⤵
  PID:5836
- C:\Windows\System\htphjMP.exe
  C:\Windows\System\htphjMP.exe
  2⤵
  PID:5864
- C:\Windows\System\rVqFeIa.exe
  C:\Windows\System\rVqFeIa.exe
  2⤵
  PID:5892
- C:\Windows\System\yFluNhf.exe
  C:\Windows\System\yFluNhf.exe
  2⤵
  PID:5924
- C:\Windows\System\VJvzzHa.exe
  C:\Windows\System\VJvzzHa.exe
  2⤵
  PID:5948
- C:\Windows\System\ZZLAKxw.exe
  C:\Windows\System\ZZLAKxw.exe
  2⤵
  PID:5976
- C:\Windows\System\ixnXrhR.exe
  C:\Windows\System\ixnXrhR.exe
  2⤵
  PID:6008
- C:\Windows\System\rcojDkv.exe
  C:\Windows\System\rcojDkv.exe
  2⤵
  PID:6032
- C:\Windows\System\IZvBrJX.exe
  C:\Windows\System\IZvBrJX.exe
  2⤵
  PID:6048
- C:\Windows\System\EBSfnTA.exe
  C:\Windows\System\EBSfnTA.exe
  2⤵
  PID:6076
- C:\Windows\System\BJyendb.exe
  C:\Windows\System\BJyendb.exe
  2⤵
  PID:6116
- C:\Windows\System\vlSkcmx.exe
  C:\Windows\System\vlSkcmx.exe
  2⤵
  PID:3456
- C:\Windows\System\lQdroIx.exe
  C:\Windows\System\lQdroIx.exe
  2⤵
  PID:5124
- C:\Windows\System\XvREDbg.exe
  C:\Windows\System\XvREDbg.exe
  2⤵
  PID:5184
- C:\Windows\System\dlLUqie.exe
  C:\Windows\System\dlLUqie.exe
  2⤵
  PID:5288
- C:\Windows\System\tRPZpWB.exe
  C:\Windows\System\tRPZpWB.exe
  2⤵
  PID:5312
- C:\Windows\System\dLLbEXr.exe
  C:\Windows\System\dLLbEXr.exe
  2⤵
  PID:5384
- C:\Windows\System\eWvdegT.exe
  C:\Windows\System\eWvdegT.exe
  2⤵
  PID:5444
- C:\Windows\System\RUqDHxZ.exe
  C:\Windows\System\RUqDHxZ.exe
  2⤵
  PID:5532
- C:\Windows\System\hCvkapd.exe
  C:\Windows\System\hCvkapd.exe
  2⤵
  PID:5588
- C:\Windows\System\RqxJtIj.exe
  C:\Windows\System\RqxJtIj.exe
  2⤵
  PID:5564
- C:\Windows\System\cONQwlL.exe
  C:\Windows\System\cONQwlL.exe
  2⤵
  PID:5680
- C:\Windows\System\KdBSgDy.exe
  C:\Windows\System\KdBSgDy.exe
  2⤵
  PID:5748
- C:\Windows\System\goGQuPh.exe
  C:\Windows\System\goGQuPh.exe
  2⤵
  PID:5852
- C:\Windows\System\KOWeqqs.exe
  C:\Windows\System\KOWeqqs.exe
  2⤵
  PID:5932
- C:\Windows\System\CJngKKs.exe
  C:\Windows\System\CJngKKs.exe
  2⤵
  PID:5996
- C:\Windows\System\NxRbCUT.exe
  C:\Windows\System\NxRbCUT.exe
  2⤵
  PID:6084
- C:\Windows\System\JHXaJNp.exe
  C:\Windows\System\JHXaJNp.exe
  2⤵
  PID:6128
- C:\Windows\System\DDmhPtQ.exe
  C:\Windows\System\DDmhPtQ.exe
  2⤵
  PID:5212
- C:\Windows\System\EWKkUpY.exe
  C:\Windows\System\EWKkUpY.exe
  2⤵
  PID:5480
- C:\Windows\System\VwwbCTG.exe
  C:\Windows\System\VwwbCTG.exe
  2⤵
  PID:5600
- C:\Windows\System\xIpKfrl.exe
  C:\Windows\System\xIpKfrl.exe
  2⤵
  PID:5708
- C:\Windows\System\vAWZdrk.exe
  C:\Windows\System\vAWZdrk.exe
  2⤵
  PID:5884
- C:\Windows\System\PEEVRHP.exe
  C:\Windows\System\PEEVRHP.exe
  2⤵
  PID:6040
- C:\Windows\System\FJHkfXD.exe
  C:\Windows\System\FJHkfXD.exe
  2⤵
  PID:4968
- C:\Windows\System\UJxqjBj.exe
  C:\Windows\System\UJxqjBj.exe
  2⤵
  PID:5420
- C:\Windows\System\yQKwdJk.exe
  C:\Windows\System\yQKwdJk.exe
  2⤵
  PID:5556
- C:\Windows\System\qhOAoqY.exe
  C:\Windows\System\qhOAoqY.exe
  2⤵
  PID:5832
- C:\Windows\System\RBndzqj.exe
  C:\Windows\System\RBndzqj.exe
  2⤵
  PID:5148
- C:\Windows\System\AdVmwFK.exe
  C:\Windows\System\AdVmwFK.exe
  2⤵
  PID:2696
- C:\Windows\System\edtOZhg.exe
  C:\Windows\System\edtOZhg.exe
  2⤵
  PID:5992
- C:\Windows\System\OhouGss.exe
  C:\Windows\System\OhouGss.exe
  2⤵
  PID:6152
- C:\Windows\System\ovbpYIw.exe
  C:\Windows\System\ovbpYIw.exe
  2⤵
  PID:6192
- C:\Windows\System\ooyZTUb.exe
  C:\Windows\System\ooyZTUb.exe
  2⤵
  PID:6220
- C:\Windows\System\IzgSbyN.exe
  C:\Windows\System\IzgSbyN.exe
  2⤵
  PID:6244
- C:\Windows\System\BPAqhpo.exe
  C:\Windows\System\BPAqhpo.exe
  2⤵
  PID:6268
- C:\Windows\System\xHrMypz.exe
  C:\Windows\System\xHrMypz.exe
  2⤵
  PID:6308
- C:\Windows\System\JUTHVFz.exe
  C:\Windows\System\JUTHVFz.exe
  2⤵
  PID:6348
- C:\Windows\System\cOTSrGX.exe
  C:\Windows\System\cOTSrGX.exe
  2⤵
  PID:6388
- C:\Windows\System\PhseOui.exe
  C:\Windows\System\PhseOui.exe
  2⤵
  PID:6412
- C:\Windows\System\OdOZqAS.exe
  C:\Windows\System\OdOZqAS.exe
  2⤵
  PID:6428
- C:\Windows\System\SLCszFg.exe
  C:\Windows\System\SLCszFg.exe
  2⤵
  PID:6456
- C:\Windows\System\XTBIRbU.exe
  C:\Windows\System\XTBIRbU.exe
  2⤵
  PID:6488
- C:\Windows\System\KwCrzqi.exe
  C:\Windows\System\KwCrzqi.exe
  2⤵
  PID:6524
- C:\Windows\System\LPOVuxC.exe
  C:\Windows\System\LPOVuxC.exe
  2⤵
  PID:6540
- C:\Windows\System\uytcrez.exe
  C:\Windows\System\uytcrez.exe
  2⤵
  PID:6572
- C:\Windows\System\AJcPOXW.exe
  C:\Windows\System\AJcPOXW.exe
  2⤵
  PID:6612
- C:\Windows\System\LhrGUNo.exe
  C:\Windows\System\LhrGUNo.exe
  2⤵
  PID:6648
- C:\Windows\System\bLZcBxl.exe
  C:\Windows\System\bLZcBxl.exe
  2⤵
  PID:6676
- C:\Windows\System\fWyFTqf.exe
  C:\Windows\System\fWyFTqf.exe
  2⤵
  PID:6708
- C:\Windows\System\YWhXeVu.exe
  C:\Windows\System\YWhXeVu.exe
  2⤵
  PID:6732
- C:\Windows\System\CteeJFz.exe
  C:\Windows\System\CteeJFz.exe
  2⤵
  PID:6756
- C:\Windows\System\ORfECDY.exe
  C:\Windows\System\ORfECDY.exe
  2⤵
  PID:6788
- C:\Windows\System\gcRtBqx.exe
  C:\Windows\System\gcRtBqx.exe
  2⤵
  PID:6816
- C:\Windows\System\zZYCDOP.exe
  C:\Windows\System\zZYCDOP.exe
  2⤵
  PID:6848
- C:\Windows\System\NeaUxvT.exe
  C:\Windows\System\NeaUxvT.exe
  2⤵
  PID:6864
- C:\Windows\System\hwTVQHV.exe
  C:\Windows\System\hwTVQHV.exe
  2⤵
  PID:6896
- C:\Windows\System\KpXkzau.exe
  C:\Windows\System\KpXkzau.exe
  2⤵
  PID:6932
- C:\Windows\System\WjrbdvP.exe
  C:\Windows\System\WjrbdvP.exe
  2⤵
  PID:6964
- C:\Windows\System\IDYpCut.exe
  C:\Windows\System\IDYpCut.exe
  2⤵
  PID:6992
- C:\Windows\System\wyeJHeX.exe
  C:\Windows\System\wyeJHeX.exe
  2⤵
  PID:7020
- C:\Windows\System\gQHBPEU.exe
  C:\Windows\System\gQHBPEU.exe
  2⤵
  PID:7048
- C:\Windows\System\LGGpGpX.exe
  C:\Windows\System\LGGpGpX.exe
  2⤵
  PID:7076
- C:\Windows\System\KteqCUs.exe
  C:\Windows\System\KteqCUs.exe
  2⤵
  PID:7108
- C:\Windows\System\JSovOot.exe
  C:\Windows\System\JSovOot.exe
  2⤵
  PID:7124
- C:\Windows\System\rgVgBke.exe
  C:\Windows\System\rgVgBke.exe
  2⤵
  PID:7140
- C:\Windows\System\tRGuWes.exe
  C:\Windows\System\tRGuWes.exe
  2⤵
  PID:7164
- C:\Windows\System\OpxnJtE.exe
  C:\Windows\System\OpxnJtE.exe
  2⤵
  PID:6208
- C:\Windows\System\zgQUDEb.exe
  C:\Windows\System\zgQUDEb.exe
  2⤵
  PID:6180
- C:\Windows\System\VSZJIUS.exe
  C:\Windows\System\VSZJIUS.exe
  2⤵
  PID:6264
- C:\Windows\System\YAKRHws.exe
  C:\Windows\System\YAKRHws.exe
  2⤵
  PID:6340
- C:\Windows\System\taJmOwP.exe
  C:\Windows\System\taJmOwP.exe
  2⤵
  PID:6424
- C:\Windows\System\CInGeFf.exe
  C:\Windows\System\CInGeFf.exe
  2⤵
  PID:6496
- C:\Windows\System\yMhEYZl.exe
  C:\Windows\System\yMhEYZl.exe
  2⤵
  PID:6600
- C:\Windows\System\DKQdcbT.exe
  C:\Windows\System\DKQdcbT.exe
  2⤵
  PID:6672
- C:\Windows\System\Pmgdixw.exe
  C:\Windows\System\Pmgdixw.exe
  2⤵
  PID:6752
- C:\Windows\System\yYccVXu.exe
  C:\Windows\System\yYccVXu.exe
  2⤵
  PID:6844
- C:\Windows\System\NAHykuD.exe
  C:\Windows\System\NAHykuD.exe
  2⤵
  PID:6892
- C:\Windows\System\hDjrQCV.exe
  C:\Windows\System\hDjrQCV.exe
  2⤵
  PID:6976
- C:\Windows\System\GrvXxWj.exe
  C:\Windows\System\GrvXxWj.exe
  2⤵
  PID:7060
- C:\Windows\System\NMkELaJ.exe
  C:\Windows\System\NMkELaJ.exe
  2⤵
  PID:7104
- C:\Windows\System\XFmqPKE.exe
  C:\Windows\System\XFmqPKE.exe
  2⤵
  PID:6148
- C:\Windows\System\dRWPnJh.exe
  C:\Windows\System\dRWPnJh.exe
  2⤵
  PID:6296
- C:\Windows\System\JBqVfBL.exe
  C:\Windows\System\JBqVfBL.exe
  2⤵
  PID:6444
- C:\Windows\System\aCFAAlT.exe
  C:\Windows\System\aCFAAlT.exe
  2⤵
  PID:6636
- C:\Windows\System\uxOjpqQ.exe
  C:\Windows\System\uxOjpqQ.exe
  2⤵
  PID:6780
- C:\Windows\System\mvCGiGp.exe
  C:\Windows\System\mvCGiGp.exe
  2⤵
  PID:6944
- C:\Windows\System\neloTpg.exe
  C:\Windows\System\neloTpg.exe
  2⤵
  PID:7120
- C:\Windows\System\XwGctje.exe
  C:\Windows\System\XwGctje.exe
  2⤵
  PID:6288
- C:\Windows\System\UyYPOFP.exe
  C:\Windows\System\UyYPOFP.exe
  2⤵
  PID:6724
- C:\Windows\System\YZIGmld.exe
  C:\Windows\System\YZIGmld.exe
  2⤵
  PID:7044
- C:\Windows\System\HVFuSCL.exe
  C:\Windows\System\HVFuSCL.exe
  2⤵
  PID:6176
- C:\Windows\System\kcIYKQA.exe
  C:\Windows\System\kcIYKQA.exe
  2⤵
  PID:7196
- C:\Windows\System\fyfDTyn.exe
  C:\Windows\System\fyfDTyn.exe
  2⤵
  PID:7216
- C:\Windows\System\MzPxUaQ.exe
  C:\Windows\System\MzPxUaQ.exe
  2⤵
  PID:7252
- C:\Windows\System\NlVTvJs.exe
  C:\Windows\System\NlVTvJs.exe
  2⤵
  PID:7268
- C:\Windows\System\ViJsdfA.exe
  C:\Windows\System\ViJsdfA.exe
  2⤵
  PID:7300
- C:\Windows\System\aKLPLeD.exe
  C:\Windows\System\aKLPLeD.exe
  2⤵
  PID:7332
- C:\Windows\System\YeVyVOm.exe
  C:\Windows\System\YeVyVOm.exe
  2⤵
  PID:7352
- C:\Windows\System\aBbsXkd.exe
  C:\Windows\System\aBbsXkd.exe
  2⤵
  PID:7384
- C:\Windows\System\rXYjjNR.exe
  C:\Windows\System\rXYjjNR.exe
  2⤵
  PID:7420
- C:\Windows\System\JXGgBqi.exe
  C:\Windows\System\JXGgBqi.exe
  2⤵
  PID:7448
- C:\Windows\System\sdTMnWy.exe
  C:\Windows\System\sdTMnWy.exe
  2⤵
  PID:7464
- C:\Windows\System\evCNycP.exe
  C:\Windows\System\evCNycP.exe
  2⤵
  PID:7480
- C:\Windows\System\NpWHBOB.exe
  C:\Windows\System\NpWHBOB.exe
  2⤵
  PID:7504
- C:\Windows\System\PSnZxDS.exe
  C:\Windows\System\PSnZxDS.exe
  2⤵
  PID:7528
- C:\Windows\System\vDjNiKX.exe
  C:\Windows\System\vDjNiKX.exe
  2⤵
  PID:7548
- C:\Windows\System\mWydjJt.exe
  C:\Windows\System\mWydjJt.exe
  2⤵
  PID:7580
- C:\Windows\System\whrQNml.exe
  C:\Windows\System\whrQNml.exe
  2⤵
  PID:7608
- C:\Windows\System\VaJNxap.exe
  C:\Windows\System\VaJNxap.exe
  2⤵
  PID:7640
- C:\Windows\System\WWFGAkU.exe
  C:\Windows\System\WWFGAkU.exe
  2⤵
  PID:7676
- C:\Windows\System\dfhDVWD.exe
  C:\Windows\System\dfhDVWD.exe
  2⤵
  PID:7708
- C:\Windows\System\nYmaYTZ.exe
  C:\Windows\System\nYmaYTZ.exe
  2⤵
  PID:7744
- C:\Windows\System\WzPsjHV.exe
  C:\Windows\System\WzPsjHV.exe
  2⤵
  PID:7780
- C:\Windows\System\ZmVFrjZ.exe
  C:\Windows\System\ZmVFrjZ.exe
  2⤵
  PID:7812
- C:\Windows\System\iwpCoOq.exe
  C:\Windows\System\iwpCoOq.exe
  2⤵
  PID:7828
- C:\Windows\System\DQFhcTl.exe
  C:\Windows\System\DQFhcTl.exe
  2⤵
  PID:7860
- C:\Windows\System\vHAYVUW.exe
  C:\Windows\System\vHAYVUW.exe
  2⤵
  PID:7888
- C:\Windows\System\mSdYulH.exe
  C:\Windows\System\mSdYulH.exe
  2⤵
  PID:7928
- C:\Windows\System\dOTPswu.exe
  C:\Windows\System\dOTPswu.exe
  2⤵
  PID:7952
- C:\Windows\System\VLOEGlt.exe
  C:\Windows\System\VLOEGlt.exe
  2⤵
  PID:7968
- C:\Windows\System\qEGFvEI.exe
  C:\Windows\System\qEGFvEI.exe
  2⤵
  PID:7984
- C:\Windows\System\hjSqIfa.exe
  C:\Windows\System\hjSqIfa.exe
  2⤵
  PID:8000
- C:\Windows\System\ZyAUVaS.exe
  C:\Windows\System\ZyAUVaS.exe
  2⤵
  PID:8016
- C:\Windows\System\RJlaVzb.exe
  C:\Windows\System\RJlaVzb.exe
  2⤵
  PID:8032
- C:\Windows\System\hJsUtCO.exe
  C:\Windows\System\hJsUtCO.exe
  2⤵
  PID:8048
- C:\Windows\System\DVkzhwY.exe
  C:\Windows\System\DVkzhwY.exe
  2⤵
  PID:8068
- C:\Windows\System\XYZJKaD.exe
  C:\Windows\System\XYZJKaD.exe
  2⤵
  PID:8096
- C:\Windows\System\TsXypPD.exe
  C:\Windows\System\TsXypPD.exe
  2⤵
  PID:8128
- C:\Windows\System\VNIJTjl.exe
  C:\Windows\System\VNIJTjl.exe
  2⤵
  PID:8160
- C:\Windows\System\hZLxYIu.exe
  C:\Windows\System\hZLxYIu.exe
  2⤵
  PID:6884
- C:\Windows\System\uzjkrKJ.exe
  C:\Windows\System\uzjkrKJ.exe
  2⤵
  PID:7260
- C:\Windows\System\dtlHoJh.exe
  C:\Windows\System\dtlHoJh.exe
  2⤵
  PID:7296
- C:\Windows\System\arVjCMg.exe
  C:\Windows\System\arVjCMg.exe
  2⤵
  PID:7364
- C:\Windows\System\MJPwWAe.exe
  C:\Windows\System\MJPwWAe.exe
  2⤵
  PID:7432
- C:\Windows\System\wZHRiQx.exe
  C:\Windows\System\wZHRiQx.exe
  2⤵
  PID:7496
- C:\Windows\System\ooDzxxy.exe
  C:\Windows\System\ooDzxxy.exe
  2⤵
  PID:7596
- C:\Windows\System\WEyFjJQ.exe
  C:\Windows\System\WEyFjJQ.exe
  2⤵
  PID:7688
- C:\Windows\System\sRUsXDw.exe
  C:\Windows\System\sRUsXDw.exe
  2⤵
  PID:7704
- C:\Windows\System\bPxDbrh.exe
  C:\Windows\System\bPxDbrh.exe
  2⤵
  PID:7772
- C:\Windows\System\ZyrsjcI.exe
  C:\Windows\System\ZyrsjcI.exe
  2⤵
  PID:7824
- C:\Windows\System\jEvmhLx.exe
  C:\Windows\System\jEvmhLx.exe
  2⤵
  PID:7908
- C:\Windows\System\uEwNuwT.exe
  C:\Windows\System\uEwNuwT.exe
  2⤵
  PID:8008
- C:\Windows\System\AgumdTY.exe
  C:\Windows\System\AgumdTY.exe
  2⤵
  PID:8012
- C:\Windows\System\SAFDXbT.exe
  C:\Windows\System\SAFDXbT.exe
  2⤵
  PID:7180
- C:\Windows\System\fZZHJYK.exe
  C:\Windows\System\fZZHJYK.exe
  2⤵
  PID:8076
- C:\Windows\System\BLWxiyY.exe
  C:\Windows\System\BLWxiyY.exe
  2⤵
  PID:8124
- C:\Windows\System\IgUAFkG.exe
  C:\Windows\System\IgUAFkG.exe
  2⤵
  PID:8180
- C:\Windows\System\nnDMTDV.exe
  C:\Windows\System\nnDMTDV.exe
  2⤵
  PID:7236
- C:\Windows\System\dOuvOPf.exe
  C:\Windows\System\dOuvOPf.exe
  2⤵
  PID:7472
- C:\Windows\System\VaZxaxz.exe
  C:\Windows\System\VaZxaxz.exe
  2⤵
  PID:7740
- C:\Windows\System\Gfyrzsk.exe
  C:\Windows\System\Gfyrzsk.exe
  2⤵
  PID:7840
- C:\Windows\System\pzEZTGe.exe
  C:\Windows\System\pzEZTGe.exe
  2⤵
  PID:7212
- C:\Windows\System\bbnsfxu.exe
  C:\Windows\System\bbnsfxu.exe
  2⤵
  PID:7264
- C:\Windows\System\JJiGkpf.exe
  C:\Windows\System\JJiGkpf.exe
  2⤵
  PID:7288
- C:\Windows\System\AylijJu.exe
  C:\Windows\System\AylijJu.exe
  2⤵
  PID:7660
- C:\Windows\System\bbZanKX.exe
  C:\Windows\System\bbZanKX.exe
  2⤵
  PID:8220
- C:\Windows\System\zTDsZBA.exe
  C:\Windows\System\zTDsZBA.exe
  2⤵
  PID:8256
- C:\Windows\System\fKYeKqB.exe
  C:\Windows\System\fKYeKqB.exe
  2⤵
  PID:8288
- C:\Windows\System\MvLDOPB.exe
  C:\Windows\System\MvLDOPB.exe
  2⤵
  PID:8316
- C:\Windows\System\DiGkqgw.exe
  C:\Windows\System\DiGkqgw.exe
  2⤵
  PID:8336
- C:\Windows\System\SXcBvBZ.exe
  C:\Windows\System\SXcBvBZ.exe
  2⤵
  PID:8368
- C:\Windows\System\PDalcaN.exe
  C:\Windows\System\PDalcaN.exe
  2⤵
  PID:8400
- C:\Windows\System\ljMjkbh.exe
  C:\Windows\System\ljMjkbh.exe
  2⤵
  PID:8424
- C:\Windows\System\dRpLxhR.exe
  C:\Windows\System\dRpLxhR.exe
  2⤵
  PID:8456
- C:\Windows\System\jqDOUua.exe
  C:\Windows\System\jqDOUua.exe
  2⤵
  PID:8484
- C:\Windows\System\hYyIfhm.exe
  C:\Windows\System\hYyIfhm.exe
  2⤵
  PID:8512
- C:\Windows\System\fjQRGzS.exe
  C:\Windows\System\fjQRGzS.exe
  2⤵
  PID:8540
- C:\Windows\System\SlhSvGT.exe
  C:\Windows\System\SlhSvGT.exe
  2⤵
  PID:8572
- C:\Windows\System\XIlwVua.exe
  C:\Windows\System\XIlwVua.exe
  2⤵
  PID:8612
- C:\Windows\System\mlVlsSo.exe
  C:\Windows\System\mlVlsSo.exe
  2⤵
  PID:8632
- C:\Windows\System\LtUERLc.exe
  C:\Windows\System\LtUERLc.exe
  2⤵
  PID:8660
- C:\Windows\System\xWAKJXv.exe
  C:\Windows\System\xWAKJXv.exe
  2⤵
  PID:8688
- C:\Windows\System\ymUHlRX.exe
  C:\Windows\System\ymUHlRX.exe
  2⤵
  PID:8712
- C:\Windows\System\BMIjVPm.exe
  C:\Windows\System\BMIjVPm.exe
  2⤵
  PID:8732
- C:\Windows\System\lQvDwDf.exe
  C:\Windows\System\lQvDwDf.exe
  2⤵
  PID:8768
- C:\Windows\System\lfgZSzp.exe
  C:\Windows\System\lfgZSzp.exe
  2⤵
  PID:8792
- C:\Windows\System\ACQGsyS.exe
  C:\Windows\System\ACQGsyS.exe
  2⤵
  PID:8816
- C:\Windows\System\JJpnOtd.exe
  C:\Windows\System\JJpnOtd.exe
  2⤵
  PID:8840
- C:\Windows\System\zsncyKp.exe
  C:\Windows\System\zsncyKp.exe
  2⤵
  PID:8872
- C:\Windows\System\rGftgvB.exe
  C:\Windows\System\rGftgvB.exe
  2⤵
  PID:8912
- C:\Windows\System\misUwMs.exe
  C:\Windows\System\misUwMs.exe
  2⤵
  PID:8940
- C:\Windows\System\jstkveS.exe
  C:\Windows\System\jstkveS.exe
  2⤵
  PID:8956
- C:\Windows\System\zYopEFP.exe
  C:\Windows\System\zYopEFP.exe
  2⤵
  PID:8972
- C:\Windows\System\ijaIvxB.exe
  C:\Windows\System\ijaIvxB.exe
  2⤵
  PID:9004
- C:\Windows\System\UWFuwLY.exe
  C:\Windows\System\UWFuwLY.exe
  2⤵
  PID:9028
- C:\Windows\System\cKyElcQ.exe
  C:\Windows\System\cKyElcQ.exe
  2⤵
  PID:9064
- C:\Windows\System\rtGYscf.exe
  C:\Windows\System\rtGYscf.exe
  2⤵
  PID:9088
- C:\Windows\System\qjEyoGN.exe
  C:\Windows\System\qjEyoGN.exe
  2⤵
  PID:9124
- C:\Windows\System\kXDdjzP.exe
  C:\Windows\System\kXDdjzP.exe
  2⤵
  PID:9160
- C:\Windows\System\IQbKbRV.exe
  C:\Windows\System\IQbKbRV.exe
  2⤵
  PID:9188
- C:\Windows\System\fZxzLsX.exe
  C:\Windows\System\fZxzLsX.exe
  2⤵
  PID:7808
- C:\Windows\System\SqNjvLp.exe
  C:\Windows\System\SqNjvLp.exe
  2⤵
  PID:8208
- C:\Windows\System\zdbNvGK.exe
  C:\Windows\System\zdbNvGK.exe
  2⤵
  PID:8280
- C:\Windows\System\TLtcADu.exe
  C:\Windows\System\TLtcADu.exe
  2⤵
  PID:8312
- C:\Windows\System\XNqyLep.exe
  C:\Windows\System\XNqyLep.exe
  2⤵
  PID:8348
- C:\Windows\System\KZenLsq.exe
  C:\Windows\System\KZenLsq.exe
  2⤵
  PID:8468
- C:\Windows\System\RtTSucd.exe
  C:\Windows\System\RtTSucd.exe
  2⤵
  PID:8536
- C:\Windows\System\GfqlHuz.exe
  C:\Windows\System\GfqlHuz.exe
  2⤵
  PID:8668
- C:\Windows\System\dPhtDNZ.exe
  C:\Windows\System\dPhtDNZ.exe
  2⤵
  PID:8652
- C:\Windows\System\bRwJmCB.exe
  C:\Windows\System\bRwJmCB.exe
  2⤵
  PID:8704
- C:\Windows\System\ezQMbKK.exe
  C:\Windows\System\ezQMbKK.exe
  2⤵
  PID:8808
- C:\Windows\System\kPgegrM.exe
  C:\Windows\System\kPgegrM.exe
  2⤵
  PID:8880
- C:\Windows\System\ohErMoW.exe
  C:\Windows\System\ohErMoW.exe
  2⤵
  PID:8936
- C:\Windows\System\DyStSpN.exe
  C:\Windows\System\DyStSpN.exe
  2⤵
  PID:9056
- C:\Windows\System\OEgzxAA.exe
  C:\Windows\System\OEgzxAA.exe
  2⤵
  PID:9140
- C:\Windows\System\jWyFytt.exe
  C:\Windows\System\jWyFytt.exe
  2⤵
  PID:9180
- C:\Windows\System\mwqwqNb.exe
  C:\Windows\System\mwqwqNb.exe
  2⤵
  PID:7500
- C:\Windows\System\QMZDDKZ.exe
  C:\Windows\System\QMZDDKZ.exe
  2⤵
  PID:8328
- C:\Windows\System\bYofVfh.exe
  C:\Windows\System\bYofVfh.exe
  2⤵
  PID:8448
- C:\Windows\System\gvevZjm.exe
  C:\Windows\System\gvevZjm.exe
  2⤵
  PID:8580
- C:\Windows\System\ncsJWFy.exe
  C:\Windows\System\ncsJWFy.exe
  2⤵
  PID:8784
- C:\Windows\System\PqdRHld.exe
  C:\Windows\System\PqdRHld.exe
  2⤵
  PID:8888
- C:\Windows\System\lEnYzLX.exe
  C:\Windows\System\lEnYzLX.exe
  2⤵
  PID:8996
- C:\Windows\System\aqhBFiM.exe
  C:\Windows\System\aqhBFiM.exe
  2⤵
  PID:8232
- C:\Windows\System\wmjRMHC.exe
  C:\Windows\System\wmjRMHC.exe
  2⤵
  PID:8548
- C:\Windows\System\QDIELcW.exe
  C:\Windows\System\QDIELcW.exe
  2⤵
  PID:8836
- C:\Windows\System\htVVMiC.exe
  C:\Windows\System\htVVMiC.exe
  2⤵
  PID:9152
- C:\Windows\System\RnkbnTo.exe
  C:\Windows\System\RnkbnTo.exe
  2⤵
  PID:9016
- C:\Windows\System\DrEjnXl.exe
  C:\Windows\System\DrEjnXl.exe
  2⤵
  PID:9232
- C:\Windows\System\BYuRswQ.exe
  C:\Windows\System\BYuRswQ.exe
  2⤵
  PID:9264
- C:\Windows\System\gdtMOHu.exe
  C:\Windows\System\gdtMOHu.exe
  2⤵
  PID:9292
- C:\Windows\System\qlGMPRy.exe
  C:\Windows\System\qlGMPRy.exe
  2⤵
  PID:9320
- C:\Windows\System\hLlrNlV.exe
  C:\Windows\System\hLlrNlV.exe
  2⤵
  PID:9348
- C:\Windows\System\vDRtdAU.exe
  C:\Windows\System\vDRtdAU.exe
  2⤵
  PID:9376
- C:\Windows\System\pGtjlpN.exe
  C:\Windows\System\pGtjlpN.exe
  2⤵
  PID:9404
- C:\Windows\System\xLrIhTC.exe
  C:\Windows\System\xLrIhTC.exe
  2⤵
  PID:9432
- C:\Windows\System\oiWccQl.exe
  C:\Windows\System\oiWccQl.exe
  2⤵
  PID:9460
- C:\Windows\System\NCfyJWS.exe
  C:\Windows\System\NCfyJWS.exe
  2⤵
  PID:9488
- C:\Windows\System\fCyfzFC.exe
  C:\Windows\System\fCyfzFC.exe
  2⤵
  PID:9516
- C:\Windows\System\vsmuyLF.exe
  C:\Windows\System\vsmuyLF.exe
  2⤵
  PID:9544
- C:\Windows\System\QyykRHT.exe
  C:\Windows\System\QyykRHT.exe
  2⤵
  PID:9572
- C:\Windows\System\sLRAMtq.exe
  C:\Windows\System\sLRAMtq.exe
  2⤵
  PID:9600
- C:\Windows\System\OhDouxo.exe
  C:\Windows\System\OhDouxo.exe
  2⤵
  PID:9636
- C:\Windows\System\kqbiPGr.exe
  C:\Windows\System\kqbiPGr.exe
  2⤵
  PID:9660
- C:\Windows\System\dRUErLD.exe
  C:\Windows\System\dRUErLD.exe
  2⤵
  PID:9676
- C:\Windows\System\AeRZzYa.exe
  C:\Windows\System\AeRZzYa.exe
  2⤵
  PID:9704
- C:\Windows\System\PbgTtba.exe
  C:\Windows\System\PbgTtba.exe
  2⤵
  PID:9732
- C:\Windows\System\VnNiNig.exe
  C:\Windows\System\VnNiNig.exe
  2⤵
  PID:9752
- C:\Windows\System\sfNXwwZ.exe
  C:\Windows\System\sfNXwwZ.exe
  2⤵
  PID:9776
- C:\Windows\System\cNYCfSJ.exe
  C:\Windows\System\cNYCfSJ.exe
  2⤵
  PID:9792
- C:\Windows\System\ZRxkTNJ.exe
  C:\Windows\System\ZRxkTNJ.exe
  2⤵
  PID:9820
- C:\Windows\System\MeVVCto.exe
  C:\Windows\System\MeVVCto.exe
  2⤵
  PID:9844
- C:\Windows\System\wsavblo.exe
  C:\Windows\System\wsavblo.exe
  2⤵
  PID:9872
- C:\Windows\System\yfSxoQC.exe
  C:\Windows\System\yfSxoQC.exe
  2⤵
  PID:9900
- C:\Windows\System\qLDKqLp.exe
  C:\Windows\System\qLDKqLp.exe
  2⤵
  PID:9924
- C:\Windows\System\QOfZQLK.exe
  C:\Windows\System\QOfZQLK.exe
  2⤵
  PID:9960
- C:\Windows\System\hRlXVCB.exe
  C:\Windows\System\hRlXVCB.exe
  2⤵
  PID:9992
- C:\Windows\System\AgdBbgZ.exe
  C:\Windows\System\AgdBbgZ.exe
  2⤵
  PID:10024
- C:\Windows\System\WigGySh.exe
  C:\Windows\System\WigGySh.exe
  2⤵
  PID:10048
- C:\Windows\System\ZrazDWD.exe
  C:\Windows\System\ZrazDWD.exe
  2⤵
  PID:10128
- C:\Windows\System\LRhyFRg.exe
  C:\Windows\System\LRhyFRg.exe
  2⤵
  PID:10152
- C:\Windows\System\FjMKUxV.exe
  C:\Windows\System\FjMKUxV.exe
  2⤵
  PID:10188
- C:\Windows\System\whUTPmk.exe
  C:\Windows\System\whUTPmk.exe
  2⤵
  PID:10216
- C:\Windows\System\iHRcXxx.exe
  C:\Windows\System\iHRcXxx.exe
  2⤵
  PID:9220
- C:\Windows\System\qdlRxvS.exe
  C:\Windows\System\qdlRxvS.exe
  2⤵
  PID:9304
- C:\Windows\System\SpNaQzT.exe
  C:\Windows\System\SpNaQzT.exe
  2⤵
  PID:9344
- C:\Windows\System\AcyFTmW.exe
  C:\Windows\System\AcyFTmW.exe
  2⤵
  PID:9388
- C:\Windows\System\RFmDlbQ.exe
  C:\Windows\System\RFmDlbQ.exe
  2⤵
  PID:9448
- C:\Windows\System\NRUyLgV.exe
  C:\Windows\System\NRUyLgV.exe
  2⤵
  PID:9528
- C:\Windows\System\WvjVnbh.exe
  C:\Windows\System\WvjVnbh.exe
  2⤵
  PID:9592
- C:\Windows\System\ljHEuOz.exe
  C:\Windows\System\ljHEuOz.exe
  2⤵
  PID:9668
- C:\Windows\System\JpUUYrd.exe
  C:\Windows\System\JpUUYrd.exe
  2⤵
  PID:9748
- C:\Windows\System\RkXcuzA.exe
  C:\Windows\System\RkXcuzA.exe
  2⤵
  PID:9788
- C:\Windows\System\cHktrXw.exe
  C:\Windows\System\cHktrXw.exe
  2⤵
  PID:9836
- C:\Windows\System\MdmokHB.exe
  C:\Windows\System\MdmokHB.exe
  2⤵
  PID:9948
- C:\Windows\System\cDQwiYq.exe
  C:\Windows\System\cDQwiYq.exe
  2⤵
  PID:10020
- C:\Windows\System\bDtgvHT.exe
  C:\Windows\System\bDtgvHT.exe
  2⤵
  PID:10072
- C:\Windows\System\IVChaXj.exe
  C:\Windows\System\IVChaXj.exe
  2⤵
  PID:10164
- C:\Windows\System\CiYRNjm.exe
  C:\Windows\System\CiYRNjm.exe
  2⤵
  PID:10204
- C:\Windows\System\SJmbqNn.exe
  C:\Windows\System\SJmbqNn.exe
  2⤵
  PID:9360
- C:\Windows\System\Xvqdpno.exe
  C:\Windows\System\Xvqdpno.exe
  2⤵
  PID:9472
- C:\Windows\System\zdCBOIn.exe
  C:\Windows\System\zdCBOIn.exe
  2⤵
  PID:9880
- C:\Windows\System\ZxTSyuT.exe
  C:\Windows\System\ZxTSyuT.exe
  2⤵
  PID:9936
- C:\Windows\System\HuXltse.exe
  C:\Windows\System\HuXltse.exe
  2⤵
  PID:10064
- C:\Windows\System\LYrnXxJ.exe
  C:\Windows\System\LYrnXxJ.exe
  2⤵
  PID:9260
- C:\Windows\System\VpYQAxo.exe
  C:\Windows\System\VpYQAxo.exe
  2⤵
  PID:9484
- C:\Windows\System\OzDWbSj.exe
  C:\Windows\System\OzDWbSj.exe
  2⤵
  PID:10116
- C:\Windows\System\QPwkIZS.exe
  C:\Windows\System\QPwkIZS.exe
  2⤵
  PID:9416
- C:\Windows\System\lUYvSXG.exe
  C:\Windows\System\lUYvSXG.exe
  2⤵
  PID:10256
- C:\Windows\System\FkasqUK.exe
  C:\Windows\System\FkasqUK.exe
  2⤵
  PID:10288
- C:\Windows\System\nTJtncZ.exe
  C:\Windows\System\nTJtncZ.exe
  2⤵
  PID:10320
- C:\Windows\System\IciXbVu.exe
  C:\Windows\System\IciXbVu.exe
  2⤵
  PID:10348
- C:\Windows\System\zOpaiDM.exe
  C:\Windows\System\zOpaiDM.exe
  2⤵
  PID:10368
- C:\Windows\System\qowbOXz.exe
  C:\Windows\System\qowbOXz.exe
  2⤵
  PID:10392
- C:\Windows\System\DPZRWkv.exe
  C:\Windows\System\DPZRWkv.exe
  2⤵
  PID:10412
- C:\Windows\System\XRnosqr.exe
  C:\Windows\System\XRnosqr.exe
  2⤵
  PID:10448
- C:\Windows\System\OWLnStv.exe
  C:\Windows\System\OWLnStv.exe
  2⤵
  PID:10476
- C:\Windows\System\bEylcvc.exe
  C:\Windows\System\bEylcvc.exe
  2⤵
  PID:10516
- C:\Windows\System\wQuNElM.exe
  C:\Windows\System\wQuNElM.exe
  2⤵
  PID:10544
- C:\Windows\System\DJdiSJl.exe
  C:\Windows\System\DJdiSJl.exe
  2⤵
  PID:10572
- C:\Windows\System\NVPrcES.exe
  C:\Windows\System\NVPrcES.exe
  2⤵
  PID:10588
- C:\Windows\System\VyExVDf.exe
  C:\Windows\System\VyExVDf.exe
  2⤵
  PID:10616
- C:\Windows\System\LvXFgSN.exe
  C:\Windows\System\LvXFgSN.exe
  2⤵
  PID:10644
- C:\Windows\System\ClgSsHp.exe
  C:\Windows\System\ClgSsHp.exe
  2⤵
  PID:10672
- C:\Windows\System\IoMjMDz.exe
  C:\Windows\System\IoMjMDz.exe
  2⤵
  PID:10708
- C:\Windows\System\fRYCcvV.exe
  C:\Windows\System\fRYCcvV.exe
  2⤵
  PID:10740
- C:\Windows\System\AsJTEck.exe
  C:\Windows\System\AsJTEck.exe
  2⤵
  PID:10772
- C:\Windows\System\Vltaszg.exe
  C:\Windows\System\Vltaszg.exe
  2⤵
  PID:10800
- C:\Windows\System\gFXGwCC.exe
  C:\Windows\System\gFXGwCC.exe
  2⤵
  PID:10816
- C:\Windows\System\zQXeizc.exe
  C:\Windows\System\zQXeizc.exe
  2⤵
  PID:10836
- C:\Windows\System\WNHdwvw.exe
  C:\Windows\System\WNHdwvw.exe
  2⤵
  PID:10860
- C:\Windows\System\eyMbkyC.exe
  C:\Windows\System\eyMbkyC.exe
  2⤵
  PID:10888
- C:\Windows\System\rZLfFbF.exe
  C:\Windows\System\rZLfFbF.exe
  2⤵
  PID:10920
- C:\Windows\System\PoHRwLu.exe
  C:\Windows\System\PoHRwLu.exe
  2⤵
  PID:10956
- C:\Windows\System\RVSheYN.exe
  C:\Windows\System\RVSheYN.exe
  2⤵
  PID:10988
- C:\Windows\System\SeWKXVE.exe
  C:\Windows\System\SeWKXVE.exe
  2⤵
  PID:11024
- C:\Windows\System\LMbYrSQ.exe
  C:\Windows\System\LMbYrSQ.exe
  2⤵
  PID:11052
- C:\Windows\System\UjoFmyG.exe
  C:\Windows\System\UjoFmyG.exe
  2⤵
  PID:11080
- C:\Windows\System\UovZotj.exe
  C:\Windows\System\UovZotj.exe
  2⤵
  PID:11104
- C:\Windows\System\DFGUIea.exe
  C:\Windows\System\DFGUIea.exe
  2⤵
  PID:11120
- C:\Windows\System\xsOBMMO.exe
  C:\Windows\System\xsOBMMO.exe
  2⤵
  PID:11144
- C:\Windows\System\rRfUeVN.exe
  C:\Windows\System\rRfUeVN.exe
  2⤵
  PID:11164
- C:\Windows\System\PVzeeSV.exe
  C:\Windows\System\PVzeeSV.exe
  2⤵
  PID:11188
- C:\Windows\System\mPnUtkV.exe
  C:\Windows\System\mPnUtkV.exe
  2⤵
  PID:11216
- C:\Windows\System\zFHSeEZ.exe
  C:\Windows\System\zFHSeEZ.exe
  2⤵
  PID:11244
- C:\Windows\System\ICLuNQj.exe
  C:\Windows\System\ICLuNQj.exe
  2⤵
  PID:9864
- C:\Windows\System\lYTXnkC.exe
  C:\Windows\System\lYTXnkC.exe
  2⤵
  PID:10308
- C:\Windows\System\ivxfsUy.exe
  C:\Windows\System\ivxfsUy.exe
  2⤵
  PID:10376
- C:\Windows\System\BPpOFfz.exe
  C:\Windows\System\BPpOFfz.exe
  2⤵
  PID:10444
- C:\Windows\System\zsTiYBJ.exe
  C:\Windows\System\zsTiYBJ.exe
  2⤵
  PID:10532
- C:\Windows\System\sxugJHj.exe
  C:\Windows\System\sxugJHj.exe
  2⤵
  PID:10728
- C:\Windows\System\icXlnTw.exe
  C:\Windows\System\icXlnTw.exe
  2⤵
  PID:10808
- C:\Windows\System\QckTeti.exe
  C:\Windows\System\QckTeti.exe
  2⤵
  PID:10852
- C:\Windows\System\JgQYPHq.exe
  C:\Windows\System\JgQYPHq.exe
  2⤵
  PID:10944
- C:\Windows\System\VKhfdix.exe
  C:\Windows\System\VKhfdix.exe
  2⤵
  PID:10996
- C:\Windows\System\UoLkDvD.exe
  C:\Windows\System\UoLkDvD.exe
  2⤵
  PID:11072
- C:\Windows\System\hTVGidY.exe
  C:\Windows\System\hTVGidY.exe
  2⤵
  PID:11180
- C:\Windows\System\pRxbHSr.exe
  C:\Windows\System\pRxbHSr.exe
  2⤵
  PID:11236
- C:\Windows\System\mCMTTtm.exe
  C:\Windows\System\mCMTTtm.exe
  2⤵
  PID:10252
- C:\Windows\System\GWtORlz.exe
  C:\Windows\System\GWtORlz.exe
  2⤵
  PID:10420
- C:\Windows\System\rttTqyU.exe
  C:\Windows\System\rttTqyU.exe
  2⤵
  PID:10784
- C:\Windows\System\wblZLOg.exe
  C:\Windows\System\wblZLOg.exe
  2⤵
  PID:10908
- C:\Windows\System\PUWKUwh.exe
  C:\Windows\System\PUWKUwh.exe
  2⤵
  PID:11044
- C:\Windows\System\lcIWhzp.exe
  C:\Windows\System\lcIWhzp.exe
  2⤵
  PID:11152
- C:\Windows\System\zsiDwtc.exe
  C:\Windows\System\zsiDwtc.exe
  2⤵
  PID:10568
- C:\Windows\System\kfWJMZd.exe
  C:\Windows\System\kfWJMZd.exe
  2⤵
  PID:11116
- C:\Windows\System\HNPFsWr.exe
  C:\Windows\System\HNPFsWr.exe
  2⤵
  PID:11276
- C:\Windows\System\ZDfSOKr.exe
  C:\Windows\System\ZDfSOKr.exe
  2⤵
  PID:11296
- C:\Windows\System\tZnDCYd.exe
  C:\Windows\System\tZnDCYd.exe
  2⤵
  PID:11324
- C:\Windows\System\HRSMSxt.exe
  C:\Windows\System\HRSMSxt.exe
  2⤵
  PID:11352
- C:\Windows\System\oOVjlHn.exe
  C:\Windows\System\oOVjlHn.exe
  2⤵
  PID:11384
- C:\Windows\System\zEBjlLM.exe
  C:\Windows\System\zEBjlLM.exe
  2⤵
  PID:11404
- C:\Windows\System\JpepNbA.exe
  C:\Windows\System\JpepNbA.exe
  2⤵
  PID:11444
- C:\Windows\System\jaGiRLG.exe
  C:\Windows\System\jaGiRLG.exe
  2⤵
  PID:11484
- C:\Windows\System\zvwBrSO.exe
  C:\Windows\System\zvwBrSO.exe
  2⤵
  PID:11516
- C:\Windows\System\DfQHFzj.exe
  C:\Windows\System\DfQHFzj.exe
  2⤵
  PID:11548
- C:\Windows\System\MkoGcBA.exe
  C:\Windows\System\MkoGcBA.exe
  2⤵
  PID:11584
- C:\Windows\System\aeWhOHQ.exe
  C:\Windows\System\aeWhOHQ.exe
  2⤵
  PID:11608
- C:\Windows\System\aKnUeDp.exe
  C:\Windows\System\aKnUeDp.exe
  2⤵
  PID:11644
- C:\Windows\System\lGeyjCo.exe
  C:\Windows\System\lGeyjCo.exe
  2⤵
  PID:11664
- C:\Windows\System\GIpWgAv.exe
  C:\Windows\System\GIpWgAv.exe
  2⤵
  PID:11680
- C:\Windows\System\xaBahcx.exe
  C:\Windows\System\xaBahcx.exe
  2⤵
  PID:11708
- C:\Windows\System\xZQmtCY.exe
  C:\Windows\System\xZQmtCY.exe
  2⤵
  PID:11736
- C:\Windows\System\jeSgtPO.exe
  C:\Windows\System\jeSgtPO.exe
  2⤵
  PID:11764
- C:\Windows\System\jyqjqSu.exe
  C:\Windows\System\jyqjqSu.exe
  2⤵
  PID:11796
- C:\Windows\System\rxdnmiF.exe
  C:\Windows\System\rxdnmiF.exe
  2⤵
  PID:11820
- C:\Windows\System\UhuFVqp.exe
  C:\Windows\System\UhuFVqp.exe
  2⤵
  PID:11844
- C:\Windows\System\rOtHhWh.exe
  C:\Windows\System\rOtHhWh.exe
  2⤵
  PID:11864
- C:\Windows\System\fsPRcHs.exe
  C:\Windows\System\fsPRcHs.exe
  2⤵
  PID:11896
- C:\Windows\System\DbQXzgV.exe
  C:\Windows\System\DbQXzgV.exe
  2⤵
  PID:11924
- C:\Windows\System\JKIqXpP.exe
  C:\Windows\System\JKIqXpP.exe
  2⤵
  PID:11956
- C:\Windows\System\FnbBZhT.exe
  C:\Windows\System\FnbBZhT.exe
  2⤵
  PID:11984
- C:\Windows\System\ICXaAfV.exe
  C:\Windows\System\ICXaAfV.exe
  2⤵
  PID:12016
- C:\Windows\System\RBdsuVg.exe
  C:\Windows\System\RBdsuVg.exe
  2⤵
  PID:12044
- C:\Windows\System\CnYcbSD.exe
  C:\Windows\System\CnYcbSD.exe
  2⤵
  PID:12072
- C:\Windows\System\EtOpfSE.exe
  C:\Windows\System\EtOpfSE.exe
  2⤵
  PID:12100
- C:\Windows\System\YlNGHCo.exe
  C:\Windows\System\YlNGHCo.exe
  2⤵
  PID:12128
- C:\Windows\System\AYYxDLO.exe
  C:\Windows\System\AYYxDLO.exe
  2⤵
  PID:12164
- C:\Windows\System\YlUumgk.exe
  C:\Windows\System\YlUumgk.exe
  2⤵
  PID:12192
- C:\Windows\System\blCbVln.exe
  C:\Windows\System\blCbVln.exe
  2⤵
  PID:12220
- C:\Windows\System\nuPbSKg.exe
  C:\Windows\System\nuPbSKg.exe
  2⤵
  PID:12256
- C:\Windows\System\KNicBEY.exe
  C:\Windows\System\KNicBEY.exe
  2⤵
  PID:11020
- C:\Windows\System\uFSqgmt.exe
  C:\Windows\System\uFSqgmt.exe
  2⤵
  PID:11292
- C:\Windows\System\aAYtLjV.exe
  C:\Windows\System\aAYtLjV.exe
  2⤵
  PID:11312
- C:\Windows\System\NyPyPvZ.exe
  C:\Windows\System\NyPyPvZ.exe
  2⤵
  PID:11476
- C:\Windows\System\HvGVglR.exe
  C:\Windows\System\HvGVglR.exe
  2⤵
  PID:11464
- C:\Windows\System\TuuKmLT.exe
  C:\Windows\System\TuuKmLT.exe
  2⤵
  PID:11572
- C:\Windows\System\GCXiRfZ.exe
  C:\Windows\System\GCXiRfZ.exe
  2⤵
  PID:11720
- C:\Windows\System\sLQzmuX.exe
  C:\Windows\System\sLQzmuX.exe
  2⤵
  PID:11660
- C:\Windows\System\dEHuDAj.exe
  C:\Windows\System\dEHuDAj.exe
  2⤵
  PID:11812
- C:\Windows\System\rPEIuNQ.exe
  C:\Windows\System\rPEIuNQ.exe
  2⤵
  PID:11840
- C:\Windows\System\ugbXrNo.exe
  C:\Windows\System\ugbXrNo.exe
  2⤵
  PID:11964
- C:\Windows\System\CopjJHa.exe
  C:\Windows\System\CopjJHa.exe
  2⤵
  PID:12036
- C:\Windows\System\JYUsXiM.exe
  C:\Windows\System\JYUsXiM.exe
  2⤵
  PID:12068
- C:\Windows\System\fRhnkcz.exe
  C:\Windows\System\fRhnkcz.exe
  2⤵
  PID:12148
- C:\Windows\System\SjhvPLH.exe
  C:\Windows\System\SjhvPLH.exe
  2⤵
  PID:12232
- C:\Windows\System\odmbklj.exe
  C:\Windows\System\odmbklj.exe
  2⤵
  PID:12212
- C:\Windows\System\bsyeqny.exe
  C:\Windows\System\bsyeqny.exe
  2⤵
  PID:11436
- C:\Windows\System\vSOvrdX.exe
  C:\Windows\System\vSOvrdX.exe
  2⤵
  PID:11728
- C:\Windows\System\JodSuBt.exe
  C:\Windows\System\JodSuBt.exe
  2⤵
  PID:11636
- C:\Windows\System\HsIwvAr.exe
  C:\Windows\System\HsIwvAr.exe
  2⤵
  PID:11704
- C:\Windows\System\bsJeaUu.exe
  C:\Windows\System\bsJeaUu.exe
  2⤵
  PID:12160
- C:\Windows\System\bNbprsK.exe
  C:\Windows\System\bNbprsK.exe
  2⤵
  PID:12116
- C:\Windows\System\ILBYRDl.exe
  C:\Windows\System\ILBYRDl.exe
  2⤵
  PID:11332
- C:\Windows\System\HheILKF.exe
  C:\Windows\System\HheILKF.exe
  2⤵
  PID:10760
- C:\Windows\System\kHJMFxf.exe
  C:\Windows\System\kHJMFxf.exe
  2⤵
  PID:12308
- C:\Windows\System\hmNbBpH.exe
  C:\Windows\System\hmNbBpH.exe
  2⤵
  PID:12340
- C:\Windows\System\mQhznYf.exe
  C:\Windows\System\mQhznYf.exe
  2⤵
  PID:12364
- C:\Windows\System\CcSclFO.exe
  C:\Windows\System\CcSclFO.exe
  2⤵
  PID:12392
- C:\Windows\System\xBkKtcs.exe
  C:\Windows\System\xBkKtcs.exe
  2⤵
  PID:12420
- C:\Windows\System\kACkzTl.exe
  C:\Windows\System\kACkzTl.exe
  2⤵
  PID:12436
- C:\Windows\System\CXMapFX.exe
  C:\Windows\System\CXMapFX.exe
  2⤵
  PID:12456
- C:\Windows\System\nTOBFNE.exe
  C:\Windows\System\nTOBFNE.exe
  2⤵
  PID:12480
- C:\Windows\System\gxhnddX.exe
  C:\Windows\System\gxhnddX.exe
  2⤵
  PID:12512
- C:\Windows\System\XOsVbDX.exe
  C:\Windows\System\XOsVbDX.exe
  2⤵
  PID:12532
- C:\Windows\System\guwJGwG.exe
  C:\Windows\System\guwJGwG.exe
  2⤵
  PID:12552
- C:\Windows\System\lEXaBwk.exe
  C:\Windows\System\lEXaBwk.exe
  2⤵
  PID:12568
- C:\Windows\System\pYBqrEG.exe
  C:\Windows\System\pYBqrEG.exe
  2⤵
  PID:12604
- C:\Windows\System\HKHRXxJ.exe
  C:\Windows\System\HKHRXxJ.exe
  2⤵
  PID:12632
- C:\Windows\System\Qhjeram.exe
  C:\Windows\System\Qhjeram.exe
  2⤵
  PID:12656
- C:\Windows\System\SsRACDv.exe
  C:\Windows\System\SsRACDv.exe
  2⤵
  PID:12672
- C:\Windows\System\tLPmPjT.exe
  C:\Windows\System\tLPmPjT.exe
  2⤵
  PID:12688
- C:\Windows\System\fenMAhj.exe
  C:\Windows\System\fenMAhj.exe
  2⤵
  PID:12704
- C:\Windows\System\wrrJCYV.exe
  C:\Windows\System\wrrJCYV.exe
  2⤵
  PID:12736
- C:\Windows\System\hEfVDpR.exe
  C:\Windows\System\hEfVDpR.exe
  2⤵
  PID:12756
- C:\Windows\System\nYDsmsF.exe
  C:\Windows\System\nYDsmsF.exe
  2⤵
  PID:12780
- C:\Windows\System\WclrOYv.exe
  C:\Windows\System\WclrOYv.exe
  2⤵
  PID:12800
- C:\Windows\System\TOAFxuy.exe
  C:\Windows\System\TOAFxuy.exe
  2⤵
  PID:12832
- C:\Windows\System\GqsNHDn.exe
  C:\Windows\System\GqsNHDn.exe
  2⤵
  PID:12848
- C:\Windows\System\dWftxUt.exe
  C:\Windows\System\dWftxUt.exe
  2⤵
  PID:12868
- C:\Windows\System\DjAawwV.exe
  C:\Windows\System\DjAawwV.exe
  2⤵
  PID:12896
- C:\Windows\System\cMHKynV.exe
  C:\Windows\System\cMHKynV.exe
  2⤵
  PID:12948
- C:\Windows\System\FHJvRVA.exe
  C:\Windows\System\FHJvRVA.exe
  2⤵
  PID:12976
- C:\Windows\System\grTpyrk.exe
  C:\Windows\System\grTpyrk.exe
  2⤵
  PID:13004
- C:\Windows\System\SWORfir.exe
  C:\Windows\System\SWORfir.exe
  2⤵
  PID:13044
- C:\Windows\System\gQytsct.exe
  C:\Windows\System\gQytsct.exe
  2⤵
  PID:13084
- C:\Windows\System\lcmczbp.exe
  C:\Windows\System\lcmczbp.exe
  2⤵
  PID:13116
- C:\Windows\System\CtyZbVl.exe
  C:\Windows\System\CtyZbVl.exe
  2⤵
  PID:13152
- C:\Windows\System\vOPNgcq.exe
  C:\Windows\System\vOPNgcq.exe
  2⤵
  PID:13188
- C:\Windows\System\USqoAka.exe
  C:\Windows\System\USqoAka.exe
  2⤵
  PID:13228
- C:\Windows\System\hMXQOJt.exe
  C:\Windows\System\hMXQOJt.exe
  2⤵
  PID:13260
- C:\Windows\System\mlHjGeP.exe
  C:\Windows\System\mlHjGeP.exe
  2⤵
  PID:13284
- C:\Windows\System\zjODkBF.exe
  C:\Windows\System\zjODkBF.exe
  2⤵
  PID:11912
- C:\Windows\System\UWLDAec.exe
  C:\Windows\System\UWLDAec.exe
  2⤵
  PID:12356
- C:\Windows\System\xINQYND.exe
  C:\Windows\System\xINQYND.exe
  2⤵
  PID:12380
- C:\Windows\System\XlJHBzU.exe
  C:\Windows\System\XlJHBzU.exe
  2⤵
  PID:12468
- C:\Windows\System\KLXZztT.exe
  C:\Windows\System\KLXZztT.exe
  2⤵
  PID:12444
- C:\Windows\System\rJhPZTd.exe
  C:\Windows\System\rJhPZTd.exe
  2⤵
  PID:12492
- C:\Windows\System\sfdzkXT.exe
  C:\Windows\System\sfdzkXT.exe
  2⤵
  PID:12528
- C:\Windows\System\JNXkFQl.exe
  C:\Windows\System\JNXkFQl.exe
  2⤵
  PID:12432
- C:\Windows\System\iWeNnYr.exe
  C:\Windows\System\iWeNnYr.exe
  2⤵
  PID:12732
- C:\Windows\System\xYXbCOr.exe
  C:\Windows\System\xYXbCOr.exe
  2⤵
  PID:12788
- C:\Windows\System\vQiehDk.exe
  C:\Windows\System\vQiehDk.exe
  2⤵
  PID:12864
- C:\Windows\System\iEvhihZ.exe
  C:\Windows\System\iEvhihZ.exe
  2⤵
  PID:12884
- C:\Windows\System\ebkzQYp.exe
  C:\Windows\System\ebkzQYp.exe
  2⤵
  PID:12680
- C:\Windows\System\kGrFVsF.exe
  C:\Windows\System\kGrFVsF.exe
  2⤵
  PID:12960
- C:\Windows\System\TkGMfTs.exe
  C:\Windows\System\TkGMfTs.exe
  2⤵
  PID:13136
- C:\Windows\System\ERCvWVm.exe
  C:\Windows\System\ERCvWVm.exe
  2⤵
  PID:13176
- C:\Windows\System\WIVxvOc.exe
  C:\Windows\System\WIVxvOc.exe
  2⤵
  PID:13248
- C:\Windows\System\BfrkTpz.exe
  C:\Windows\System\BfrkTpz.exe
  2⤵
  PID:11284
- C:\Windows\System\CaCbJfv.exe
  C:\Windows\System\CaCbJfv.exe
  2⤵
  PID:13280
- C:\Windows\System\NyXcBwH.exe
  C:\Windows\System\NyXcBwH.exe
  2⤵
  PID:12696
- C:\Windows\System\CmsRsvR.exe
  C:\Windows\System\CmsRsvR.exe
  2⤵
  PID:12560
- C:\Windows\System\fIUycyb.exe
  C:\Windows\System\fIUycyb.exe
  2⤵
  PID:12992
- C:\Windows\System\xhCasAw.exe
  C:\Windows\System\xhCasAw.exe
  2⤵
  PID:12668
- C:\Windows\System\PPrPUkp.exe
  C:\Windows\System\PPrPUkp.exe
  2⤵
  PID:11600
- C:\Windows\System\rWZYznL.exe
  C:\Windows\System\rWZYznL.exe
  2⤵
  PID:12548
- C:\Windows\System\RDxlCye.exe
  C:\Windows\System\RDxlCye.exe
  2⤵
  PID:12968
- C:\Windows\System\NEmqoyH.exe
  C:\Windows\System\NEmqoyH.exe
  2⤵
  PID:13328
- C:\Windows\System\yWxrFhY.exe
  C:\Windows\System\yWxrFhY.exe
  2⤵
  PID:13352
- C:\Windows\System\JBnXqoC.exe
  C:\Windows\System\JBnXqoC.exe
  2⤵
  PID:13376
- C:\Windows\System\kNshcHt.exe
  C:\Windows\System\kNshcHt.exe
  2⤵
  PID:13404
- C:\Windows\System\RmbInAF.exe
  C:\Windows\System\RmbInAF.exe
  2⤵
  PID:13440
- C:\Windows\System\EwYFRaq.exe
  C:\Windows\System\EwYFRaq.exe
  2⤵
  PID:13464
- C:\Windows\System\UBOrHoN.exe
  C:\Windows\System\UBOrHoN.exe
  2⤵
  PID:13504
- C:\Windows\System\RysnpFl.exe
  C:\Windows\System\RysnpFl.exe
  2⤵
  PID:13536
- C:\Windows\System\LxbkLJE.exe
  C:\Windows\System\LxbkLJE.exe
  2⤵
  PID:13576
- C:\Windows\System\VvniKGE.exe
  C:\Windows\System\VvniKGE.exe
  2⤵
  PID:13596
- C:\Windows\System\vOyQsNj.exe
  C:\Windows\System\vOyQsNj.exe
  2⤵
  PID:13628
- C:\Windows\System\FAxfBMk.exe
  C:\Windows\System\FAxfBMk.exe
  2⤵
  PID:13648
- C:\Windows\System\LORCWCW.exe
  C:\Windows\System\LORCWCW.exe
  2⤵
  PID:13672
- C:\Windows\System\BytLzQH.exe
  C:\Windows\System\BytLzQH.exe
  2⤵
  PID:13696
- C:\Windows\System\WHjcFEC.exe
  C:\Windows\System\WHjcFEC.exe
  2⤵
  PID:13720
- C:\Windows\System\FmdlfuT.exe
  C:\Windows\System\FmdlfuT.exe
  2⤵
  PID:13752
- C:\Windows\System\RwxwqDD.exe
  C:\Windows\System\RwxwqDD.exe
  2⤵
  PID:13772
- C:\Windows\System\EOlPEEB.exe
  C:\Windows\System\EOlPEEB.exe
  2⤵
  PID:13808
- C:\Windows\System\IuOaWiQ.exe
  C:\Windows\System\IuOaWiQ.exe
  2⤵
  PID:13836
- C:\Windows\System\pViKcNb.exe
  C:\Windows\System\pViKcNb.exe
  2⤵
  PID:13856
- C:\Windows\System\zgdDfiV.exe
  C:\Windows\System\zgdDfiV.exe
  2⤵
  PID:13884
- C:\Windows\System\TTeAWzm.exe
  C:\Windows\System\TTeAWzm.exe
  2⤵
  PID:13900
- C:\Windows\System\SaHDEeD.exe
  C:\Windows\System\SaHDEeD.exe
  2⤵
  PID:13936
- C:\Windows\System\qkGDaSr.exe
  C:\Windows\System\qkGDaSr.exe
  2⤵
  PID:13960
- C:\Windows\System\WgTRkaA.exe
  C:\Windows\System\WgTRkaA.exe
  2⤵
  PID:13996
- C:\Windows\System\OBsPpQc.exe
  C:\Windows\System\OBsPpQc.exe
  2⤵
  PID:14020
- C:\Windows\System\ipfZDJR.exe
  C:\Windows\System\ipfZDJR.exe
  2⤵
  PID:14064
- C:\Windows\System\nrQaxHl.exe
  C:\Windows\System\nrQaxHl.exe
  2⤵
  PID:14088
- C:\Windows\System\qBwVAGq.exe
  C:\Windows\System\qBwVAGq.exe
  2⤵
  PID:14112
- C:\Windows\System\WOoYfkv.exe
  C:\Windows\System\WOoYfkv.exe
  2⤵
  PID:14140
- C:\Windows\System\ppEzYLW.exe
  C:\Windows\System\ppEzYLW.exe
  2⤵
  PID:14164
- C:\Windows\System\jDIIsvw.exe
  C:\Windows\System\jDIIsvw.exe
  2⤵
  PID:14188
- C:\Windows\System\nunHxao.exe
  C:\Windows\System\nunHxao.exe
  2⤵
  PID:14224
- C:\Windows\System\qzYWNBB.exe
  C:\Windows\System\qzYWNBB.exe
  2⤵
  PID:14252
- C:\Windows\System\JJgnwQN.exe
  C:\Windows\System\JJgnwQN.exe
  2⤵
  PID:14280
- C:\Windows\System\oKnuFxA.exe
  C:\Windows\System\oKnuFxA.exe
  2⤵
  PID:14316
- C:\Windows\System\lGNnDqj.exe
  C:\Windows\System\lGNnDqj.exe
  2⤵
  PID:12592
- C:\Windows\System\tOkfjjj.exe
  C:\Windows\System\tOkfjjj.exe
  2⤵
  PID:13372
- C:\Windows\System\dLHnnCB.exe
  C:\Windows\System\dLHnnCB.exe
  2⤵
  PID:13388
- C:\Windows\System\zqMUwMf.exe
  C:\Windows\System\zqMUwMf.exe
  2⤵
  PID:13336
- C:\Windows\System\bacuCKv.exe
  C:\Windows\System\bacuCKv.exe
  2⤵
  PID:13524
- C:\Windows\System\Whveqzq.exe
  C:\Windows\System\Whveqzq.exe
  2⤵
  PID:13452
- C:\Windows\System\jOCtKzZ.exe
  C:\Windows\System\jOCtKzZ.exe
  2⤵
  PID:13612
- C:\Windows\System\VNbbiSW.exe
  C:\Windows\System\VNbbiSW.exe
  2⤵
  PID:13684
- C:\Windows\System\COnQurC.exe
  C:\Windows\System\COnQurC.exe
  2⤵
  PID:13744
- C:\Windows\System\nUzIWRG.exe
  C:\Windows\System\nUzIWRG.exe
  2⤵
  PID:13764
- C:\Windows\System\RNhcyFa.exe
  C:\Windows\System\RNhcyFa.exe
  2⤵
  PID:13716
- C:\Windows\System\rskIMqT.exe
  C:\Windows\System\rskIMqT.exe
  2⤵
  PID:13828
- C:\Windows\System\bTWqfOS.exe
  C:\Windows\System\bTWqfOS.exe
  2⤵
  PID:14044
- C:\Windows\System\uHPPeem.exe
  C:\Windows\System\uHPPeem.exe
  2⤵
  PID:14032
- C:\Windows\System\acRAheX.exe
  C:\Windows\System\acRAheX.exe
  2⤵
  PID:14176
- C:\Windows\System\HophyrC.exe
  C:\Windows\System\HophyrC.exe
  2⤵
  PID:14124
- C:\Windows\System\qnCslJH.exe
  C:\Windows\System\qnCslJH.exe
  2⤵
  PID:14300
- C:\Windows\System\oijQnDV.exe
  C:\Windows\System\oijQnDV.exe
  2⤵
  PID:12816
- C:\Windows\System\XFJAAVI.exe
  C:\Windows\System\XFJAAVI.exe
  2⤵
  PID:13340
- C:\Windows\System\wfptxby.exe
  C:\Windows\System\wfptxby.exe
  2⤵
  PID:13552
- C:\Windows\System\NwhiNkU.exe
  C:\Windows\System\NwhiNkU.exe
  2⤵
  PID:13424
- C:\Windows\System\FrFFtir.exe
  C:\Windows\System\FrFFtir.exe
  2⤵
  PID:13740
- C:\Windows\System\uHlVRMD.exe
  C:\Windows\System\uHlVRMD.exe
  2⤵
  PID:13876
- C:\Windows\System\jZundRt.exe
  C:\Windows\System\jZundRt.exe
  2⤵
  PID:13588
- C:\Windows\System\GsVooQK.exe
  C:\Windows\System\GsVooQK.exe
  2⤵
  PID:14232
- C:\Windows\System\ssnBZjV.exe
  C:\Windows\System\ssnBZjV.exe
  2⤵
  PID:14308
- C:\Windows\System\ufgFNnn.exe
  C:\Windows\System\ufgFNnn.exe
  2⤵
  PID:13640
- C:\Windows\System\pSSVpVA.exe
  C:\Windows\System\pSSVpVA.exe
  2⤵
  PID:13892
- C:\Windows\System\QdUagjp.exe
  C:\Windows\System\QdUagjp.exe
  2⤵
  PID:14352
- C:\Windows\System\wshuaiX.exe
  C:\Windows\System\wshuaiX.exe
  2⤵
  PID:14380
- C:\Windows\System\VdYEuVB.exe
  C:\Windows\System\VdYEuVB.exe
  2⤵
  PID:14404
- C:\Windows\System\fyoNcNs.exe
  C:\Windows\System\fyoNcNs.exe
  2⤵
  PID:14444
- C:\Windows\System\SXrsSlT.exe
  C:\Windows\System\SXrsSlT.exe
  2⤵
  PID:14480
- C:\Windows\System\PvKREDV.exe
  C:\Windows\System\PvKREDV.exe
  2⤵
  PID:14512
- C:\Windows\System\ExGBsRo.exe
  C:\Windows\System\ExGBsRo.exe
  2⤵
  PID:14548
- C:\Windows\System\lHFOpFh.exe
  C:\Windows\System\lHFOpFh.exe
  2⤵
  PID:14576
- C:\Windows\System\sQiRMoc.exe
  C:\Windows\System\sQiRMoc.exe
  2⤵
  PID:14608
- C:\Windows\System\QHqMHoT.exe
  C:\Windows\System\QHqMHoT.exe
  2⤵
  PID:14632
- C:\Windows\System\RXPBMCz.exe
  C:\Windows\System\RXPBMCz.exe
  2⤵
  PID:14656
- C:\Windows\System\frBskuG.exe
  C:\Windows\System\frBskuG.exe
  2⤵
  PID:14688
- C:\Windows\System\NPKPwAu.exe
  C:\Windows\System\NPKPwAu.exe
  2⤵
  PID:14708
- C:\Windows\System\iqMqnfn.exe
  C:\Windows\System\iqMqnfn.exe
  2⤵
  PID:14732
- C:\Windows\System\DHmzdQG.exe
  C:\Windows\System\DHmzdQG.exe
  2⤵
  PID:14760
- C:\Windows\System\ZdoEjTG.exe
  C:\Windows\System\ZdoEjTG.exe
  2⤵
  PID:14792
- C:\Windows\System\dduxSZa.exe
  C:\Windows\System\dduxSZa.exe
  2⤵
  PID:14824
- C:\Windows\System\dtHHHqs.exe
  C:\Windows\System\dtHHHqs.exe
  2⤵
  PID:14848
- C:\Windows\System\XHzCntS.exe
  C:\Windows\System\XHzCntS.exe
  2⤵
  PID:14888
- C:\Windows\System\SXENttQ.exe
  C:\Windows\System\SXENttQ.exe
  2⤵
  PID:14920
- C:\Windows\System\ABctxIo.exe
  C:\Windows\System\ABctxIo.exe
  2⤵
  PID:14940
- C:\Windows\System\MzQaxYv.exe
  C:\Windows\System\MzQaxYv.exe
  2⤵
  PID:14960
- C:\Windows\System\JGNHsxi.exe
  C:\Windows\System\JGNHsxi.exe
  2⤵
  PID:14976
- C:\Windows\System\HNvTwKn.exe
  C:\Windows\System\HNvTwKn.exe
  2⤵
  PID:15004
- C:\Windows\System\LSgyMVt.exe
  C:\Windows\System\LSgyMVt.exe
  2⤵
  PID:15028
- C:\Windows\System\ijeoBMo.exe
  C:\Windows\System\ijeoBMo.exe
  2⤵
  PID:15068
- C:\Windows\System\DhBxJdO.exe
  C:\Windows\System\DhBxJdO.exe
  2⤵
  PID:15088
- C:\Windows\System\TOzkIyh.exe
  C:\Windows\System\TOzkIyh.exe
  2⤵
  PID:15112
- C:\Windows\System\nRGioxO.exe
  C:\Windows\System\nRGioxO.exe
  2⤵
  PID:15132
- C:\Windows\System\tjjKcBz.exe
  C:\Windows\System\tjjKcBz.exe
  2⤵
  PID:15164
- C:\Windows\System\IvjcfSj.exe
  C:\Windows\System\IvjcfSj.exe
  2⤵
  PID:15192
- C:\Windows\System\sFLSluG.exe
  C:\Windows\System\sFLSluG.exe
  2⤵
  PID:15212
- C:\Windows\System\jxibTnk.exe
  C:\Windows\System\jxibTnk.exe
  2⤵
  PID:15236
- C:\Windows\System\hISqQGD.exe
  C:\Windows\System\hISqQGD.exe
  2⤵
  PID:15260
- C:\Windows\System\cdLrwDo.exe
  C:\Windows\System\cdLrwDo.exe
  2⤵
  PID:15296
- C:\Windows\System\ikjwccP.exe
  C:\Windows\System\ikjwccP.exe
  2⤵
  PID:15316
- C:\Windows\System\UCYRcSI.exe
  C:\Windows\System\UCYRcSI.exe
  2⤵
  PID:15336
- C:\Windows\System\JQrcsjc.exe
  C:\Windows\System\JQrcsjc.exe
  2⤵
  PID:13036
- C:\Windows\System\JaBfSBy.exe
  C:\Windows\System\JaBfSBy.exe
  2⤵
  PID:14240
- C:\Windows\System\WIRrBrQ.exe
  C:\Windows\System\WIRrBrQ.exe
  2⤵
  PID:14364
- C:\Windows\System\epSxGGD.exe
  C:\Windows\System\epSxGGD.exe
  2⤵
  PID:14344
- C:\Windows\System\NOmwYbe.exe
  C:\Windows\System\NOmwYbe.exe
  2⤵
  PID:14560
- C:\Windows\System\FerHErA.exe
  C:\Windows\System\FerHErA.exe
  2⤵
  PID:14600
- C:\Windows\System\sznELHi.exe
  C:\Windows\System\sznELHi.exe
  2⤵
  PID:14568
- C:\Windows\System\jAQEhTL.exe
  C:\Windows\System\jAQEhTL.exe
  2⤵
  PID:14680
- C:\Windows\System\zsMtlBS.exe
  C:\Windows\System\zsMtlBS.exe
  2⤵
  PID:14740
- C:\Windows\System\OapDeMW.exe
  C:\Windows\System\OapDeMW.exe
  2⤵
  PID:14812
- C:\Windows\System\dWFszDN.exe
  C:\Windows\System\dWFszDN.exe
  2⤵
  PID:14972
- C:\Windows\System\YStQcYI.exe
  C:\Windows\System\YStQcYI.exe
  2⤵
  PID:15060
- C:\Windows\System\dYvWUcQ.exe
  C:\Windows\System\dYvWUcQ.exe
  2⤵
  PID:14992
- C:\Windows\System\kVhaWaC.exe
  C:\Windows\System\kVhaWaC.exe
  2⤵
  PID:15080
- C:\Windows\System\OPyerAA.exe
  C:\Windows\System\OPyerAA.exe
  2⤵
  PID:15128
- C:\Windows\System\dMrkpzs.exe
  C:\Windows\System\dMrkpzs.exe
  2⤵
  PID:15312
- C:\Windows\System\yoBjIvQ.exe
  C:\Windows\System\yoBjIvQ.exe
  2⤵
  PID:15272
- C:\Windows\System\HJAJmwi.exe
  C:\Windows\System\HJAJmwi.exe
  2⤵
  PID:15328
- C:\Windows\System\NJGSjFv.exe
  C:\Windows\System\NJGSjFv.exe
  2⤵
  PID:14500
- C:\Windows\System\YOByMMx.exe
  C:\Windows\System\YOByMMx.exe
  2⤵
  PID:14412
- C:\Windows\System\lnfyqEM.exe
  C:\Windows\System\lnfyqEM.exe
  2⤵
  PID:14728
- C:\Windows\System\wtPWAXN.exe
  C:\Windows\System\wtPWAXN.exe
  2⤵
  PID:14948
- C:\Windows\System\DiaSJnb.exe
  C:\Windows\System\DiaSJnb.exe
  2⤵
  PID:15284
- C:\Windows\System\CtgBklT.exe
  C:\Windows\System\CtgBklT.exe
  2⤵
  PID:15104
- C:\Windows\System\mUNxNxV.exe
  C:\Windows\System\mUNxNxV.exe
  2⤵
  PID:15372
- C:\Windows\System\cKebADx.exe
  C:\Windows\System\cKebADx.exe
  2⤵
  PID:15404
- C:\Windows\System\IbzqABR.exe
  C:\Windows\System\IbzqABR.exe
  2⤵
  PID:15432
- C:\Windows\System\EWwTLUj.exe
  C:\Windows\System\EWwTLUj.exe
  2⤵
  PID:15452
- C:\Windows\System\NQZEwXE.exe
  C:\Windows\System\NQZEwXE.exe
  2⤵
  PID:15480
- C:\Windows\System\vRCDxNY.exe
  C:\Windows\System\vRCDxNY.exe
  2⤵
  PID:15516
- C:\Windows\System\UwLHnGq.exe
  C:\Windows\System\UwLHnGq.exe
  2⤵
  PID:15544
- C:\Windows\System\bDocaun.exe
  C:\Windows\System\bDocaun.exe
  2⤵
  PID:15568
- C:\Windows\System\YkKbzOE.exe
  C:\Windows\System\YkKbzOE.exe
  2⤵
  PID:15588
- C:\Windows\System\CHOiqkM.exe
  C:\Windows\System\CHOiqkM.exe
  2⤵
  PID:15612
- C:\Windows\System\XfeiPiI.exe
  C:\Windows\System\XfeiPiI.exe
  2⤵
  PID:15640
- C:\Windows\System\aLrDQZg.exe
  C:\Windows\System\aLrDQZg.exe
  2⤵
  PID:15660
- C:\Windows\System\uKFKinc.exe
  C:\Windows\System\uKFKinc.exe
  2⤵
  PID:15700
- C:\Windows\System\wZxEUWb.exe
  C:\Windows\System\wZxEUWb.exe
  2⤵
  PID:15724
- C:\Windows\System\TDKSWbs.exe
  C:\Windows\System\TDKSWbs.exe
  2⤵
  PID:15740
- C:\Windows\System\WuAfIPt.exe
  C:\Windows\System\WuAfIPt.exe
  2⤵
  PID:15760
- C:\Windows\System\FOgyiIg.exe
  C:\Windows\System\FOgyiIg.exe
  2⤵
  PID:15788
- C:\Windows\System\EyyxBFz.exe
  C:\Windows\System\EyyxBFz.exe
  2⤵
  PID:15812
- C:\Windows\System\LffuVUv.exe
  C:\Windows\System\LffuVUv.exe
  2⤵
  PID:15844
- C:\Windows\System\ueSoJuC.exe
  C:\Windows\System\ueSoJuC.exe
  2⤵
  PID:15860
- C:\Windows\System\iZNjEgW.exe
  C:\Windows\System\iZNjEgW.exe
  2⤵
  PID:15892
- C:\Windows\System\LhVXXSR.exe
  C:\Windows\System\LhVXXSR.exe
  2⤵
  PID:15932
- C:\Windows\System\UGjhdXa.exe
  C:\Windows\System\UGjhdXa.exe
  2⤵
  PID:15956
- C:\Windows\System\diGzjqQ.exe
  C:\Windows\System\diGzjqQ.exe
  2⤵
  PID:15980
- C:\Windows\System\mffKDMI.exe
  C:\Windows\System\mffKDMI.exe
  2⤵
  PID:16008
- C:\Windows\System\jOrPcBP.exe
  C:\Windows\System\jOrPcBP.exe
  2⤵
  PID:16052
- C:\Windows\System\IMysnjF.exe
  C:\Windows\System\IMysnjF.exe
  2⤵
  PID:16076
- C:\Windows\System\lsglPZG.exe
  C:\Windows\System\lsglPZG.exe
  2⤵
  PID:16108
- C:\Windows\System\NgYxzgT.exe
  C:\Windows\System\NgYxzgT.exe
  2⤵
  PID:16136
- C:\Windows\System\ZhJnuEu.exe
  C:\Windows\System\ZhJnuEu.exe
  2⤵
  PID:16160
- C:\Windows\System\kigwJou.exe
  C:\Windows\System\kigwJou.exe
  2⤵
  PID:16176
- C:\Windows\System\uEhfUwY.exe
  C:\Windows\System\uEhfUwY.exe
  2⤵
  PID:16200
- C:\Windows\System\iAwEEca.exe
  C:\Windows\System\iAwEEca.exe
  2⤵
  PID:16228
- C:\Windows\System\KjaqiQe.exe
  C:\Windows\System\KjaqiQe.exe
  2⤵
  PID:16260
- C:\Windows\System\pWmQzeC.exe
  C:\Windows\System\pWmQzeC.exe
  2⤵
  PID:16284
- C:\Windows\System\wNnWPvs.exe
  C:\Windows\System\wNnWPvs.exe
  2⤵
  PID:16308
- C:\Windows\System\vXMCMTQ.exe
  C:\Windows\System\vXMCMTQ.exe
  2⤵
  PID:16340
- C:\Windows\System\waAUKAT.exe
  C:\Windows\System\waAUKAT.exe
  2⤵
  PID:16356
- C:\Windows\System\pSFtvei.exe
  C:\Windows\System\pSFtvei.exe
  2⤵
  PID:14340
- C:\Windows\System\eJKSzQP.exe
  C:\Windows\System\eJKSzQP.exe
  2⤵
  PID:14464
- C:\Windows\System\LSgLwVZ.exe
  C:\Windows\System\LSgLwVZ.exe
  2⤵
  PID:14720
- C:\Windows\System\JgPnXzG.exe
  C:\Windows\System\JgPnXzG.exe
  2⤵
  PID:15504
- C:\Windows\System\UWejgOY.exe
  C:\Windows\System\UWejgOY.exe
  2⤵
  PID:13932
- C:\Windows\System\PlijmQP.exe
  C:\Windows\System\PlijmQP.exe
  2⤵
  PID:14700
- C:\Windows\System\LHxaDkY.exe
  C:\Windows\System\LHxaDkY.exe
  2⤵
  PID:14784
- C:\Windows\System\QiXDUai.exe
  C:\Windows\System\QiXDUai.exe
  2⤵
  PID:15688
- C:\Windows\System\QtCjWPq.exe
  C:\Windows\System\QtCjWPq.exe
  2⤵
  PID:15652
- C:\Windows\System\EhigVdn.exe
  C:\Windows\System\EhigVdn.exe
  2⤵
  PID:15856
- C:\Windows\System\UUwlwQr.exe
  C:\Windows\System\UUwlwQr.exe
  2⤵
  PID:15876
- C:\Windows\System\PqNFyjh.exe
  C:\Windows\System\PqNFyjh.exe
  2⤵
  PID:15756
- C:\Windows\System\hDRgIxJ.exe
  C:\Windows\System\hDRgIxJ.exe
  2⤵
  PID:15776
- C:\Windows\System\OFBkIFm.exe
  C:\Windows\System\OFBkIFm.exe
  2⤵
  PID:16172
- C:\Windows\System\jgbEGTN.exe
  C:\Windows\System\jgbEGTN.exe
  2⤵
  PID:15908
- C:\Windows\System\ODjOdBU.exe
  C:\Windows\System\ODjOdBU.exe
  2⤵
  PID:15948
- C:\Windows\System\QCAtGjh.exe
  C:\Windows\System\QCAtGjh.exe
  2⤵
  PID:16324
- C:\Windows\System\HnnfudA.exe
  C:\Windows\System\HnnfudA.exe
  2⤵
  PID:16352
- C:\Windows\System\VzWvMjj.exe
  C:\Windows\System\VzWvMjj.exe
  2⤵
  PID:15392
- C:\Windows\System\XolzCoe.exe
  C:\Windows\System\XolzCoe.exe
  2⤵
  PID:14324
- C:\Windows\System\uOlmXct.exe
  C:\Windows\System\uOlmXct.exe
  2⤵
  PID:16296
- C:\Windows\System\lJYITqm.exe
  C:\Windows\System\lJYITqm.exe
  2⤵
  PID:15444
- C:\Windows\System\cJxTRzE.exe
  C:\Windows\System\cJxTRzE.exe
  2⤵
  PID:15736
- C:\Windows\System\GTcpTYQ.exe
  C:\Windows\System\GTcpTYQ.exe
  2⤵
  PID:15540
- C:\Windows\System\AhQaAkF.exe
  C:\Windows\System\AhQaAkF.exe
  2⤵
  PID:15972
- C:\Windows\System\JhjydOm.exe
  C:\Windows\System\JhjydOm.exe
  2⤵
  PID:16216
- C:\Windows\System\VCJDopI.exe
  C:\Windows\System\VCJDopI.exe
  2⤵
  PID:16420
- C:\Windows\System\hvZYMBp.exe
  C:\Windows\System\hvZYMBp.exe
  2⤵
  PID:16448
- C:\Windows\System\KjQqJSo.exe
  C:\Windows\System\KjQqJSo.exe
  2⤵
  PID:16472
- C:\Windows\System\FwObFHw.exe
  C:\Windows\System\FwObFHw.exe
  2⤵
  PID:16512
- C:\Windows\System\RDxyiUP.exe
  C:\Windows\System\RDxyiUP.exe
  2⤵
  PID:16548
- C:\Windows\System\GTSLYcc.exe
  C:\Windows\System\GTSLYcc.exe
  2⤵
  PID:16572
- C:\Windows\System\pfoyRRF.exe
  C:\Windows\System\pfoyRRF.exe
  2⤵
  PID:16600
- C:\Windows\System\DBcDLMd.exe
  C:\Windows\System\DBcDLMd.exe
  2⤵
  PID:16628
- C:\Windows\System\igwLYgf.exe
  C:\Windows\System\igwLYgf.exe
  2⤵
  PID:16656
- C:\Windows\System\fNSISjv.exe
  C:\Windows\System\fNSISjv.exe
  2⤵
  PID:16680
- C:\Windows\System\YtbxWTk.exe
  C:\Windows\System\YtbxWTk.exe
  2⤵
  PID:16704
- C:\Windows\System\xruDrRJ.exe
  C:\Windows\System\xruDrRJ.exe
  2⤵
  PID:16728
- C:\Windows\System\cQcXSyw.exe
  C:\Windows\System\cQcXSyw.exe
  2⤵
  PID:16756
- C:\Windows\System\XTdEuUI.exe
  C:\Windows\System\XTdEuUI.exe
  2⤵
  PID:16772
- C:\Windows\System\QLCaTOj.exe
  C:\Windows\System\QLCaTOj.exe
  2⤵
  PID:16796
- C:\Windows\System\xgmOcru.exe
  C:\Windows\System\xgmOcru.exe
  2⤵
  PID:16824
- C:\Windows\System\QmfcBgQ.exe
  C:\Windows\System\QmfcBgQ.exe
  2⤵
  PID:16848
- C:\Windows\System\gjKfCir.exe
  C:\Windows\System\gjKfCir.exe
  2⤵
  PID:16880
- C:\Windows\System\JLdwsJv.exe
  C:\Windows\System\JLdwsJv.exe
  2⤵
  PID:16916
- C:\Windows\System\VcXFnaO.exe
  C:\Windows\System\VcXFnaO.exe
  2⤵
  PID:16952
- C:\Windows\System\JBcLtvK.exe
  C:\Windows\System\JBcLtvK.exe
  2⤵
  PID:16976
- C:\Windows\System\QDCyCvf.exe
  C:\Windows\System\QDCyCvf.exe
  2⤵
  PID:17004
- C:\Windows\System\YCdXEAD.exe
  C:\Windows\System\YCdXEAD.exe
  2⤵
  PID:17040
- C:\Windows\System\QMBYiZL.exe
  C:\Windows\System\QMBYiZL.exe
  2⤵
  PID:17064
- C:\Windows\System\lolLdnN.exe
  C:\Windows\System\lolLdnN.exe
  2⤵
  PID:17088
- C:\Windows\System\wTJuKJy.exe
  C:\Windows\System\wTJuKJy.exe
  2⤵
  PID:17108
- C:\Windows\System\hCcEPJF.exe
  C:\Windows\System\hCcEPJF.exe
  2⤵
  PID:17168
- C:\Windows\System\cgNGZVb.exe
  C:\Windows\System\cgNGZVb.exe
  2⤵
  PID:17200
- C:\Windows\System\gsOpPdc.exe
  C:\Windows\System\gsOpPdc.exe
  2⤵
  PID:17228
- C:\Windows\System\UxGTKlr.exe
  C:\Windows\System\UxGTKlr.exe
  2⤵
  PID:17256
- C:\Windows\System\WufZaEO.exe
  C:\Windows\System\WufZaEO.exe
  2⤵
  PID:17308
- C:\Windows\System\FeokqQE.exe
  C:\Windows\System\FeokqQE.exe
  2⤵
  PID:17364
- C:\Windows\System\ricRbxq.exe
  C:\Windows\System\ricRbxq.exe
  2⤵
  PID:17380
- C:\Windows\System\XWNTzAj.exe
  C:\Windows\System\XWNTzAj.exe
  2⤵
  PID:15732
- C:\Windows\System\kRtSyHH.exe
  C:\Windows\System\kRtSyHH.exe
  2⤵
  PID:16088
- C:\Windows\System\ONuqnpU.exe
  C:\Windows\System\ONuqnpU.exe
  2⤵
  PID:16380
- C:\Windows\System\ZNrKWGi.exe
  C:\Windows\System\ZNrKWGi.exe
  2⤵
  PID:15872
- C:\Windows\System\pvEwIkS.exe
  C:\Windows\System\pvEwIkS.exe
  2⤵
  PID:16468
- C:\Windows\System\gltjRDk.exe
  C:\Windows\System\gltjRDk.exe
  2⤵
  PID:15500
- C:\Windows\System\srxcXut.exe
  C:\Windows\System\srxcXut.exe
  2⤵
  PID:1168
- C:\Windows\System\NRXLbHG.exe
  C:\Windows\System\NRXLbHG.exe
  2⤵
  PID:16396
- C:\Windows\System\QFNadGn.exe
  C:\Windows\System\QFNadGn.exe
  2⤵
  PID:15564
- C:\Windows\System\AdXyXlJ.exe
  C:\Windows\System\AdXyXlJ.exe
  2⤵
  PID:16696
- C:\Windows\System\BeJKhic.exe
  C:\Windows\System\BeJKhic.exe
  2⤵
  PID:16564
- C:\Windows\System\oGUrbRI.exe
  C:\Windows\System\oGUrbRI.exe
  2⤵
  PID:16536
- C:\Windows\System\taIggoJ.exe
  C:\Windows\System\taIggoJ.exe
  2⤵
  PID:16904
- C:\Windows\System\hPuEBCn.exe
  C:\Windows\System\hPuEBCn.exe
  2⤵
  PID:17216
- C:\Windows\System\fEEjSPl.exe
  C:\Windows\System\fEEjSPl.exe
  2⤵
  PID:17056
- C:\Windows\System\dJOaJZE.exe
  C:\Windows\System\dJOaJZE.exe
  2⤵
  PID:17224
- C:\Windows\System\mJpzsKN.exe
  C:\Windows\System\mJpzsKN.exe
  2⤵
  PID:15924
- C:\Windows\System\hjGgtzE.exe
  C:\Windows\System\hjGgtzE.exe
  2⤵
  PID:17372
- C:\Windows\System\FeItUIA.exe
  C:\Windows\System\FeItUIA.exe
  2⤵
  PID:16460
- C:\Windows\System\MnHNSaY.exe
  C:\Windows\System\MnHNSaY.exe
  2⤵
  PID:16716
- C:\Windows\System\ydrQsvC.exe
  C:\Windows\System\ydrQsvC.exe
  2⤵
  PID:16748
- C:\Windows\System\mWNuFeP.exe
  C:\Windows\System\mWNuFeP.exe
  2⤵
  PID:16820
- C:\Windows\System\UdoKwJu.exe
  C:\Windows\System\UdoKwJu.exe
  2⤵
  PID:16840
- C:\Windows\System\gCldzwe.exe
  C:\Windows\System\gCldzwe.exe
  2⤵
  PID:17188
- C:\Windows\System\udpUegc.exe
  C:\Windows\System\udpUegc.exe
  2⤵
  PID:15720
- C:\Windows\System\pVXicEa.exe
  C:\Windows\System\pVXicEa.exe
  2⤵
  PID:17392

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DNhZJeo.exe

Path C:\Windows\System\DNhZJeo.exe
Size 1.6MB
SHA256 19eb99aed5d0424807bf5413697a1f91f324439f7449a4f9b962e898b586d194
MD5 75f2a0919013726cf1060b5d9b031b0a
SHA1 a7c9764e0c4778af412140b943844df5a15f5391
SHA512 0cc823ce10d3ac309adade9fac907691fc3ae7d01f7bf53381e3826c3605dbec254bd5854143c2d127dc50e964c41a9aeb575bdba5ab2acf42c220a6c74994b5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2Qf:GemTLkNdfE0pZaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

FOYDMDA.exe

Path C:\Windows\System\FOYDMDA.exe
Size 1.6MB
SHA256 0d8e4b8ea75b731080f5970bd6d446012b49e47da5cf8e42359df3ffbd68eff6
MD5 9bb9f22118ecd403454fba083b085b5d
SHA1 ee815279d6287fa4667abff7794e542820d77913
SHA512 4a0a354c179953d405ecd54fcbbe543830283d036cd3dc4421a02c01ecfb7b119885bb49dcd7a8c1caef96caa6224d44f77e684d4f61bad81501dbd5a1a1a2e1
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2A:GemTLkNdfE0pZaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

GbqjAMa.exe

Path C:\Windows\System\GbqjAMa.exe
Size 1.6MB
SHA256 dacb93dfb1fc60add20670d42ca93d374429a9bbc8199bb37246cdfa2836b6fe
MD5 b15b022344151cf775debaa5010e0f27
SHA1 9ddb604bfdcd43112f00d6506e1e936fe8c34fc9
SHA512 fcc5bccb85b1f5c846c412d877fbee54cd3443c7c6cf4885e75593f9ec37d615351203c37e4b3bdd8c0ce27cbc1ae388dac55c42b503ff6d931a6b460596693b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2B:GemTLkNdfE0pZas
MD5 SHA1 SHA512 SSDEEP

Submit Download

HKuCero.exe

Path C:\Windows\System\HKuCero.exe
Size 1.6MB
SHA256 a8fdf11d7f9da06db617005687cee9eaaf3d515af19c629989ee6016a143776c
MD5 b05ed63af905444dabb50c255660debf
SHA1 81ebd259d33c735d1bb0c1f37c1828c3322582f6
SHA512 3ad81179c2487a3894c454a04e6ae32621bc84bbc21c8e71dede158816c7d338c8ffba4b6c74e772a644819af60b2779369bba83bd8ca24fef025f2fc4022873
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2m:GemTLkNdfE0pZa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IPomzwg.exe

Path C:\Windows\System\IPomzwg.exe
Size 1.6MB
SHA256 f191c775530135ef665c165d8416db5b9ae3f03d20e2c7b0c1fd36cebe3344f8
MD5 fea10292b684983a0d3b9bce2fadd724
SHA1 18fd241dbf07aeae596d98d089c305e4e16f4ed7
SHA512 7f921dc6feb1bb9b71923576e5e9fd8fccf870e8dc4c5556c0088cb7a64ca6f7ed7ee7eafd2b9756b087d5b51ef7905731e8b9bd712fb9e44dbcac5f90ee9606
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2/:GemTLkNdfE0pZaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

IjBMbPn.exe

Path C:\Windows\System\IjBMbPn.exe
Size 1.6MB
SHA256 4b3e85bdc55831bb324ad6ad60309cdc240ac67d26cbc6c399ea2429c7bbd0c2
MD5 faa7f314dfbd08a461e441866bf6c4e1
SHA1 cd81083c929e3b1925708aaaed4f42def43950a1
SHA512 94c000391a10b0daccdc95a0c632ea395e128041ba2f8da5407fda6b06627baed348472b14ca402f0fe023454809e0c7a85f68c2bafc15a897df05de48743199
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2f:GemTLkNdfE0pZac
MD5 SHA1 SHA512 SSDEEP

Submit Download

JEEMvdh.exe

Path C:\Windows\System\JEEMvdh.exe
Size 1.6MB
SHA256 cade97ff49f1745d09db4d8dc81f6725951c88606af0c6a3d46e061cd9445c5f
MD5 e4fa1de8aeee77a646438ca9d604e909
SHA1 6bf2785ae1a7938b9ee4d460e113908dc012e4a3
SHA512 5ed1e0666b357cbf4d99952faff5ca3d6b66a755923af866a92a65ed02f8e71c7d909589edb4672729076832c167d5e6cd3022783372f5f499870d93eb521243
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2n:GemTLkNdfE0pZai
MD5 SHA1 SHA512 SSDEEP

Submit Download

JYqKxKD.exe

Path C:\Windows\System\JYqKxKD.exe
Size 1.6MB
SHA256 9b772f37e8ab998efa68fc31f8471999e91d0b7db827970fdf28bf4d8416b260
MD5 ab1db608239299cd2718c772360c7336
SHA1 565f39b5abdfac36f781fc9e7f09804e8651dd48
SHA512 5644cc48538117fb80e0158caa95d232a6d444d16194b331886b4fe5ea58d59026728dfd8ae60ced2b267f1cc0b56fa8c2517cf90398272a808fdbd60e8aca68
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2w:GemTLkNdfE0pZaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

JdDjtba.exe

Path C:\Windows\System\JdDjtba.exe
Size 1.6MB
SHA256 551e2e9a56570ff773bebc37882433e731fdf67d47350c019c469cb3147a5303
MD5 1ce25c336021f0781826aad91d9a9190
SHA1 edc718cc778cb9ce23cc655ef0e54f98efe063a3
SHA512 515f11c8608ba9ab88b1fdecd86abded6c7984096ca9e9385189b8a27c8158982ada21358651edc040276b110d9e00ec3591c707cc448e01a6f315f8a8cec35c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2D+:GemTLkNdfE0pZan
MD5 SHA1 SHA512 SSDEEP

Submit Download

ORCjcUc.exe

Path C:\Windows\System\ORCjcUc.exe
Size 1.6MB
SHA256 d4c5d163871b1fd44d44cd79405568741146dcbf1f40d0aeec85cd8f66b7f9ec
MD5 3f6e52192099d8ad1338cf2341581ace
SHA1 5a3eccb7278625c65e152118469b6c173aca83ab
SHA512 bf8a40663a5327b4dc9ea0f665ff880b042b3564c2201e0a21312ce6d2602961b55035d2ca66b4a16fd969f820d6e765f3fe08cfb645b35518b135c91863ed9b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2U:GemTLkNdfE0pZaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

OYIIfGZ.exe

Path C:\Windows\System\OYIIfGZ.exe
Size 1.6MB
SHA256 7da5d981c0132852f0cacbcfe0cb8c13cca16400dac2a0f20d7a90bbbd63c76f
MD5 0e991909e70d038a45c5d2646abaca46
SHA1 3439f32151c5ec17186e9b5bd89185e68a20c704
SHA512 28ddd5ad91983e38b0962f688193e9d780b113851532aa192b7dc38df102d6e486be978a27ea1f8f3e74b62b213cd6dac0f623ee9b89a010f02ec0b656ced052
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2R:GemTLkNdfE0pZaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

PuuVKdX.exe

Path C:\Windows\System\PuuVKdX.exe
Size 1.6MB
SHA256 da1aec51db59c6451a2d13d111e49b7d3afa7bbbd5f1994c18bdf087f34728b3
MD5 7b971c4c4d76c351d2b70e20d513b575
SHA1 c09b2957ec6b6d70bed9d27fbb20a13c8032e627
SHA512 fb99447c89d6da382f9cfb98a300cfed22c9bac14af6bb8c99ffc185c92ce94595eb565f3737f769c2b0173f56519cc45d1713b4e77f06400c6d16a2373dc0b3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2V:GemTLkNdfE0pZae
MD5 SHA1 SHA512 SSDEEP

Submit Download

RQRcyOS.exe

Path C:\Windows\System\RQRcyOS.exe
Size 1.6MB
SHA256 447ce84ca4e9e877bb095be737c4555a7d28a77b9e31b1faf75a52e0b471ef0f
MD5 cfc583f7f17dbcd91c3015b06dca83f1
SHA1 4ecc26912517a4b9ac8761e9055834b140dac5cc
SHA512 aeb73a49b1cc2234a24fdd681c1fe3a8415c5dbd9a52fd222cd738566d2a62a47438dc7ec6d126cfc3979322f9b834e53ac7a2f541d03eaba14eb112fc20f535
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b24:GemTLkNdfE0pZaP
MD5 SHA1 SHA512 SSDEEP

Submit Download

RYFDURe.exe

Path C:\Windows\System\RYFDURe.exe
Size 1.6MB
SHA256 110ee0dedf123dd4824b4c80223acd0e2b7360dae80ce17766206f5271433fbb
MD5 f346216b7e56d69f9ba088562d0ed2cc
SHA1 7a853eafab13fedac93231f70d552d2f32aa7ebc
SHA512 9c2283b4d309170420753fe1a5be8dec8888108f0297fe25055a4f5b07bd2bb9207dc6b9200fcff8fffd92e8c7b691f27bee9d730b1349081ba860c40a21b637
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2Nd:GemTLkNdfE0pZac
MD5 SHA1 SHA512 SSDEEP

Submit Download

UyEqxkx.exe

Path C:\Windows\System\UyEqxkx.exe
Size 1.6MB
SHA256 145115ccb4c27c895a27f5076589c36ae8b996b99dba2e96ad265ef55463af52
MD5 dcfc537a80d4a1df2246b5752c2950df
SHA1 d5c9f90f72195d96622dd15b324700e55ace8f13
SHA512 fed2fe5dd0bf76e0cba8ae01b55d88d9a2503b542c2e7f450b56f4693fa43b47221dbde871a7b466e166e47b1cb52339ee4a5cdaba45bb7492bc52b864819e85
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2r:GemTLkNdfE0pZaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VuiOyQe.exe

Path C:\Windows\System\VuiOyQe.exe
Size 1.6MB
SHA256 b17b15d69a4a559d8bfaa18fd15f6b0068840f0d7bb3cba12a35f33046e1e696
MD5 b083725ed709ed2eaa236018aafe19bf
SHA1 f80037f0790a86c654530dd57d44f6d0ba223626
SHA512 0e3ddb716cc4924829bd6d076d0d5b929fadd572c62310ddde9955d48248a5a12eab2bdcc3e072881b257af453f720923038f9b6730fb84a9a163ced903ec641
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2X:GemTLkNdfE0pZae
MD5 SHA1 SHA512 SSDEEP

Submit Download

WtuKZyw.exe

Path C:\Windows\System\WtuKZyw.exe
Size 1.6MB
SHA256 064880475038a4b185953b3081dc392852ed797be2c4965d24020f230d929ba6
MD5 376163b13cbb9aa54d888b5f05bcb6ae
SHA1 7ead4e7efcb319a682737d60171dcf21348bd89a
SHA512 9ec210ea3066c194229814f2e73703e8536932405256286605c5d34c91a284bc9d37a0fa0c91a91d6061fe6ce82570c965a3aa9c25587a2c4dc0ede08c582f98
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2a:GemTLkNdfE0pZaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

XWolXDd.exe

Path C:\Windows\System\XWolXDd.exe
Size 1.6MB
SHA256 f1ac2d8f91eeffab4d2ad8936525fd411c0b710255802d5bf9cd5d8aef81910b
MD5 9e67b2d4c03ad7d6c48baa29e1500898
SHA1 d4f4ad0ec20132392088e59fc28252a22c2ba042
SHA512 0fa44238cbebacee68a624e698fc7779d3ea065757889a570b6c2318e3ac402ba81a6b80a58790dfa3316f8bea0209318170dc501af442075e47b7eb5a247994
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b25:GemTLkNdfE0pZaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

YjvvaBc.exe

Path C:\Windows\System\YjvvaBc.exe
Size 1.6MB
SHA256 28a64af2484c5c67c9bbe28d357f9ed742d5a2a8974905efd5111388a163c16a
MD5 adf180f1ef34c35e89caa47c33a20bc7
SHA1 db4cfa636e0ad9db55dc617e6893688db2ae4ff7
SHA512 857b65935e57fe968d39f339b105ec21942de50ab5d0bde5691bb5266a499d95d1d80a765dcfd4f8efc6addda8bf2cc89c06fb81379f85cbde2045602c95fdb1
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2W:GemTLkNdfE0pZaH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZOghWxL.exe

Path C:\Windows\System\ZOghWxL.exe
Size 1.6MB
SHA256 3ee63c9f433298715d4af7497546bee528fefa8b44d766a00a131cd0b0f974b2
MD5 a3b5575329d9ba07c478acd1edcc029c
SHA1 940a9712ed9a27b877d74fcb4eafc717651bfa07
SHA512 86cbe2fd193ea48e19d8a4b0488f82394b8202d389c9fc915f12a84fd17d2397c39ab7223d5d296e3947570e633a5d87ebeced24ddfa4e0dcd68e7bb59e75b3f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2k:GemTLkNdfE0pZa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

cQhPSgg.exe

Path C:\Windows\System\cQhPSgg.exe
Size 1.6MB
SHA256 c2416244c69e85f9596fca1f240293cdf6cf4ba27abdbd2c0099b017400f323f
MD5 2dba4fbce2c7f1a2ca51fd85dcad8b90
SHA1 7cacf0734703bf80990a7133f632487002b8c373
SHA512 38906e0eda039b6849948956ecfb8638afa17fd73767e2dd98bb2f105513a1a01bd1823c786f15b5ad4bad17cf5cc879109c08befd71f2dfbcf1fd6feef21115
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2Z:GemTLkNdfE0pZau
MD5 SHA1 SHA512 SSDEEP

Submit Download

fjYoOKk.exe

Path C:\Windows\System\fjYoOKk.exe
Size 1.6MB
SHA256 87d29c4a840d9fd716a227dfc4bc8ac1a5873e853615d72daf0284feb92cc0c9
MD5 adfd301810bb6f4c24e288503cf5de40
SHA1 418eb174caf021e2803f2eb1be7dea30d4e28266
SHA512 a1f271e676d97b12f9562cb8428b352d579fc3ebad01c2b32f18b35922ef9a206efe26c37bcdf858dbeb7e50fb45dca591de0fc0e590b0f110e326c019b8a6ff
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2t:GemTLkNdfE0pZao
MD5 SHA1 SHA512 SSDEEP

Submit Download

hDjGnZO.exe

Path C:\Windows\System\hDjGnZO.exe
Size 1.6MB
SHA256 c9ff3de9b77a4282945e1cb6756d8f030f6c4da47d991455fcfb1b36a631c84d
MD5 517e8b8232529cbf0f2cc9270b6ba4f9
SHA1 57f0f5f2c3ddcc434683e7c848c9fa02975d0b85
SHA512 09d02f67921ff0f028f2adc01999d4db31da4bafd56f4909e7672a1f4709bff21609168ad87bdf2a9c9a5a52af94d290cedbe2e41802c2a5159f0fa886e10112
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2kp:GemTLkNdfE0pZaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ozwKLgt.exe

Path C:\Windows\System\ozwKLgt.exe
Size 1.6MB
SHA256 13b810fc341f9cc4707191578f2e9b55f4c9a92855b83931f7db03f5703c8274
MD5 abd05c421570284c406bd646b8189396
SHA1 b68305d38f78f59119d1dcdc8d89c36b0b98a685
SHA512 4ac80880bc806fb4c8e051cfe8e383ed73c9e853ba8f792598ce015e4dad9e5d03b102beb9d13d9a974b26a41aaea77ea83cf7aa799a90f18ce9e79fab04fbfa
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b27:GemTLkNdfE0pZag
MD5 SHA1 SHA512 SSDEEP

Submit Download

pBBaQrI.exe

Path C:\Windows\System\pBBaQrI.exe
Size 1.6MB
SHA256 078f68f74905b006dd98ef77189803e1ac3e5e01996fc8d8f1a34976c2f1c81a
MD5 0d1eb6238196335d3d5ddb0471b32807
SHA1 5222abe1be114ff71d27e9a081d50e61085f9bc9
SHA512 e916ee41c5ee55b972a4e98df3e83ed79f22802607914edde753f9b02a378bbe9a76b40e3201f19ca9f41544bbe2b45e5ff95b5a277f0b9f93aa714427c41c69
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2T:GemTLkNdfE0pZam
MD5 SHA1 SHA512 SSDEEP

Submit Download

qjyCDsx.exe

Path C:\Windows\System\qjyCDsx.exe
Size 1.6MB
SHA256 46a450167bd9764d620dcd957421c3d972d4ce35726bf7c2a1ed8a9239fa2f46
MD5 6a9c085c41c596afae5c5481ac6a2c9d
SHA1 1143ba5479b5270072b94fe388b1ce3b1ae2f7ae
SHA512 70ba41a043f634f1cf9495672708a2b6366dbbef1801b34a196d0ebc41a9b1476ee947237ef83a52b8ac17a5be4400fb551b5211d65654dc06afa019da98e5b8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2q:GemTLkNdfE0pZa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

sCTBLWS.exe

Path C:\Windows\System\sCTBLWS.exe
Size 1.6MB
SHA256 2b3b14464845ec12717bc4ef59809a51bbe87834e1f4b19b1cbfabe9ff47c0d1
MD5 2ed73eed786a39cd766f0138f43e814c
SHA1 0bccca62b74bb4001c38e92379b4b9915e57e66e
SHA512 698daefa0101de881cc39f2ddd73aa5a83cc8ca778dc59c80b668027524eb705d2c4688de8f39ec465c7d31c08052aa0072204beceba15371dd88f1ddc4f30f3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2B:GemTLkNdfE0pZao
MD5 SHA1 SHA512 SSDEEP

Submit Download

tqExzid.exe

Path C:\Windows\System\tqExzid.exe
Size 1.6MB
SHA256 e94b90a95ccb6b835b98fe93f8d16249dccfd7ed840d9a13a36ccaea24ed7b28
MD5 8022ebb5c5f6a14aa448fe1d5988aab3
SHA1 621f1eb2773617892cb8fba207a611110923bd56
SHA512 74ab5bd7a404498b882cf2fb4d2cb10f1a7a8c3539cd6f070bf41d5080e56a59b18500a5e45a66c28422e5bb5bec6c70c841cb9e9955549b6876c65ad4093230
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2A:GemTLkNdfE0pZaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

uFGGXcG.exe

Path C:\Windows\System\uFGGXcG.exe
Size 1.6MB
SHA256 d3ace1fdaf70098fa8e9585b2431e817066e7beb92cea73cfc11408b2be6f54e
MD5 59593cd1c0cdf473972061ab64137d96
SHA1 5cd5c1d0f558fec4f5bc5d3514e9cd63598641a4
SHA512 f6a69b596757a551ffa8320eb7400e4cf9e21b8c6037a966eaa65fbbeeaaccded509b917b768eb4ce035ac93829391aa5ca9e1167cf07f11b589627099eac9ee
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2Z:GemTLkNdfE0pZa0
MD5 SHA1 SHA512 SSDEEP

Submit Download

uiCvzFF.exe

Path C:\Windows\System\uiCvzFF.exe
Size 1.6MB
SHA256 475dffdf761c3ab89bdfcd69120ca2bdfb711bac6694d45349b5c52fbaf6c577
MD5 c5628b74bdd33a0c6447bc677e488eb7
SHA1 a543a69c175180616c0e43fd98f19d261c228f20
SHA512 05b616e61d70521986b6bfc31d241babdf6d196871ed6fded726a9d9a23a128f7ef546579eb61f967a8905f842699f0ff6bc37b25542b94b7eb9e93ece9ed3f4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2A:GemTLkNdfE0pZar
MD5 SHA1 SHA512 SSDEEP

Submit Download

yBcqQwA.exe

Path C:\Windows\System\yBcqQwA.exe
Size 1.6MB
SHA256 7de7dcb45dab6d01c7c8b0faf1c153b2b9dd1af4da6890453a9178ddbce7e10d
MD5 63608a5fe63a279a4ee4850a0fb60849
SHA1 a936d31ae0e1492b17fbe2a0590adaf675af8240
SHA512 fa0ce17eb44525989865e9300b76f3382dce1daf3119d7ba11d2fe3f391ba41673914c2d6089c68bb23db5fa12f4ce71a063acc37220f3dab67a8228e191b379
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2a:GemTLkNdfE0pZap
MD5 SHA1 SHA512 SSDEEP

Submit Download

yvQWHFK.exe

Path C:\Windows\System\yvQWHFK.exe
Size 1.6MB
SHA256 213a6dab4e897cdbe2364b2301e4021efecb857422559bd6da61c81b902c77ea
MD5 04e58bb54e89fb96c733ab0c84b883ea
SHA1 6039c853ee008e119d370811f1dc6a0f7f560d21
SHA512 ba7511417db1fedb0c31a5f959b42caece2d8e6c252b4e85a25057dac8c6d4c3bbaeac45da302e0e932a180b5cd874f5cb80a83dfb1263c0bb6762e6006d8368
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2AW:GemTLkNdfE0pZai
MD5 SHA1 SHA512 SSDEEP

Submit Download

zzmVwuD.exe

Path C:\Windows\System\zzmVwuD.exe
Size 1.6MB
SHA256 5f9f6a63ce9a5001e9488631b12172abc7d4ca644653b1c2e50896e68c22809d
MD5 63d4b0bceb8718476bd37d47b11c9df8
SHA1 fddf64524e490fb1c192fca113d8016782f41bea
SHA512 63350135e0255896eabb02aa2a53ec5d20aaa89708fd07e36ed5aef39923cae94b85becfc1d35264c58511880244e619d383a69dc93fa5f6fa8264ca29fcc2e4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c7b2X:GemTLkNdfE0pZam
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4508-0-0x00000206F0C20000-0x00000206F0C30000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads