xmrig | b18c03925b2c456e73564b7fa71689ba2ec2ae0c77afd2d3125b864ea31ec293

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
Size 1.5MB
Sample240519-rhmzsabc34
SHA256 b18c03925b2c456e73564b7fa71689ba2ec2ae0c77afd2d3125b864ea31ec293
MD5 d32eb5b215288effba05bde7e9ff2eb0
SHA1 fe4f2576b623aa42016834900ea52a4cc524db1e
SHA512 9e8f398c50ae7505d5da89a05974610569bf091cf1dc27f161eca8e0e93ded7ec06ced0d9282e5535eb4b36ab35dff9798217dc3e10d0a323c4a6d35e468ca80
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NzM:GemTLkNdfE0pZaY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0006000000022fa8-4.dat	xmrig
behavioral2/files/0x0008000000023468-8.dat	xmrig
behavioral2/files/0x000700000002346a-16.dat	xmrig
behavioral2/files/0x000700000002346e-30.dat	xmrig
behavioral2/files/0x000700000002346d-41.dat	xmrig
behavioral2/files/0x0007000000023479-95.dat	xmrig
behavioral2/files/0x0007000000023485-155.dat	xmrig
behavioral2/files/0x0007000000023488-162.dat	xmrig
behavioral2/files/0x0007000000023486-160.dat	xmrig
behavioral2/files/0x0007000000023487-157.dat	xmrig
behavioral2/files/0x0007000000023484-150.dat	xmrig
behavioral2/files/0x0007000000023483-145.dat	xmrig
behavioral2/files/0x0007000000023482-140.dat	xmrig
behavioral2/files/0x0007000000023481-135.dat	xmrig
behavioral2/files/0x0007000000023480-130.dat	xmrig
behavioral2/files/0x000700000002347f-125.dat	xmrig
behavioral2/files/0x000700000002347e-120.dat	xmrig
behavioral2/files/0x000700000002347d-115.dat	xmrig
behavioral2/files/0x000700000002347c-110.dat	xmrig
behavioral2/files/0x000700000002347b-105.dat	xmrig
behavioral2/files/0x000700000002347a-100.dat	xmrig
behavioral2/files/0x0007000000023478-90.dat	xmrig
behavioral2/files/0x0007000000023477-85.dat	xmrig
behavioral2/files/0x0007000000023476-80.dat	xmrig
behavioral2/files/0x0007000000023475-75.dat	xmrig
behavioral2/files/0x0007000000023474-70.dat	xmrig
behavioral2/files/0x0007000000023473-65.dat	xmrig
behavioral2/files/0x0007000000023472-60.dat	xmrig
behavioral2/files/0x0007000000023471-55.dat	xmrig
behavioral2/files/0x0007000000023470-50.dat	xmrig
behavioral2/files/0x000700000002346f-48.dat	xmrig
behavioral2/files/0x000700000002346c-35.dat	xmrig
behavioral2/files/0x000700000002346b-28.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
548	iqFHxrL.exe
2996	soieAYk.exe
4612	kSgYBZZ.exe
3348	MuONElC.exe
2136	opplHGy.exe
4320	ikmgOqF.exe
1312	ADamads.exe
2476	nIqsilV.exe
4136	xkJOxRQ.exe
4772	NmvkPSD.exe
920	EhKZhXr.exe
4524	zlPOwpj.exe
4040	XaxgMoW.exe
3944	qkfnbLt.exe
668	TMWrHpc.exe
904	mlAiusR.exe
664	EtHTQku.exe
4624	wixJsri.exe
1796	RSeHFNt.exe
1168	lhiaONn.exe
3172	hAVLXQl.exe
3004	bScxDsK.exe
4928	ZHPjNKx.exe
3680	mFcOLGt.exe
2628	JQWGRYI.exe
3152	baIUOFN.exe
4244	npSfHyH.exe
3928	pRlUdtQ.exe
1948	jjJQGQN.exe
4964	CITGvMa.exe
1228	OTJUtaw.exe
5112	sDNwUmR.exe
3572	nANMZwD.exe
2620	jXHxTum.exe
2440	scJmXAv.exe
1612	HnwnDAj.exe
4180	tUEhTHh.exe
3588	AWtiGoR.exe
3904	SYuHvzZ.exe
2376	iqWQrQG.exe
3704	OnceEEr.exe
2852	jXnYOmL.exe
3492	PDNzdJO.exe
3200	SlvojEq.exe
3988	WJpqIdp.exe
3460	DtMNqeE.exe
4744	pxruxsT.exe
2920	qlPgpcz.exe
4512	tODgKur.exe
2124	hZzVgAO.exe
2432	wxFxaHG.exe
3820	khmVxiH.exe
1376	DNNkQtS.exe
4252	MyfCuXI.exe
1040	dWIyZow.exe
3036	IcVxJFJ.exe
1908	AzHiVNf.exe
3672	mQoAlca.exe
4204	YotNXED.exe
5044	VJoGNGv.exe
4164	TQehPgX.exe
3084	nyxqtKg.exe
4552	rXbqiuF.exe
2908	iBBaYqG.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QZnUpYe.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\DOxDorP.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\gwYUnXD.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\gCIPvTl.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\jSsLLzD.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\TryyeHq.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\WFumvmW.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\LWwxBdo.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\xDZonPK.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\xcCfsSE.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\COxrmzK.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\bBxZBbm.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\qNapbZu.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\SxyXUeP.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\lIPMYKh.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\grnwOUE.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\WmqkfHG.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\NEYtQhH.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\znLbtqP.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\nKKIJAb.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\jACVXRV.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\mvAkFwP.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\jgIuKje.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\aNdqwhe.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\AdLnTyH.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\okenJvK.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\tPtjWFP.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\TMWrHpc.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\IuStgof.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\maBDlWp.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\YBnbjnS.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\dafFSoW.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\VyLUwNv.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\IYPcCQx.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\FJTJJgX.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\CxBQIKz.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\TduVFPs.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\isCLUeE.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\ddpxzpz.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\cRjTYjl.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\LaKmcMG.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\KfmySRH.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\UEBYKnZ.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\gmYmlOT.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\INmgJTS.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\noFrxBZ.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\ddeGOCj.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\vWcHfhp.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\FEjkIwl.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\DgRSLSI.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\xkJOxRQ.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\ZzDsxzW.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\EfWAZUv.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\qLksxkF.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\xsGOocd.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\qkfnbLt.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\atZWYWP.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\vEMizCQ.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\UPxdzkO.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\KTQZMnC.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\nzXeqGr.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\rtfFwDs.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\XaxgMoW.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
File created	C:\Windows\System\jXnYOmL.exe	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17340	dwm.exe
Token: SeChangeNotifyPrivilege	17340	dwm.exe
Token: 33	17340	dwm.exe
Token: SeIncBasePriorityPrivilege	17340	dwm.exe
Token: SeShutdownPrivilege	17340	dwm.exe
Token: SeCreatePagefilePrivilege	17340	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 548	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	84
PID 804 wrote to memory of 548	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	84
PID 804 wrote to memory of 2996	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	85
PID 804 wrote to memory of 2996	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	85
PID 804 wrote to memory of 4612	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	86
PID 804 wrote to memory of 4612	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	86
PID 804 wrote to memory of 3348	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	87
PID 804 wrote to memory of 3348	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	87
PID 804 wrote to memory of 2136	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	88
PID 804 wrote to memory of 2136	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	88
PID 804 wrote to memory of 4320	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	89
PID 804 wrote to memory of 4320	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	89
PID 804 wrote to memory of 1312	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	90
PID 804 wrote to memory of 1312	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	90
PID 804 wrote to memory of 2476	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	91
PID 804 wrote to memory of 2476	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	91
PID 804 wrote to memory of 4136	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	92
PID 804 wrote to memory of 4136	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	92
PID 804 wrote to memory of 4772	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	93
PID 804 wrote to memory of 4772	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	93
PID 804 wrote to memory of 920	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	94
PID 804 wrote to memory of 920	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	94
PID 804 wrote to memory of 4524	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	95
PID 804 wrote to memory of 4524	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	95
PID 804 wrote to memory of 4040	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	96
PID 804 wrote to memory of 4040	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	96
PID 804 wrote to memory of 3944	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	97
PID 804 wrote to memory of 3944	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	97
PID 804 wrote to memory of 668	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	98
PID 804 wrote to memory of 668	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	98
PID 804 wrote to memory of 904	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	99
PID 804 wrote to memory of 904	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	99
PID 804 wrote to memory of 664	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	100
PID 804 wrote to memory of 664	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	100
PID 804 wrote to memory of 4624	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	101
PID 804 wrote to memory of 4624	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	101
PID 804 wrote to memory of 1796	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	102
PID 804 wrote to memory of 1796	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	102
PID 804 wrote to memory of 1168	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	103
PID 804 wrote to memory of 1168	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	103
PID 804 wrote to memory of 3172	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	104
PID 804 wrote to memory of 3172	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	104
PID 804 wrote to memory of 3004	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	105
PID 804 wrote to memory of 3004	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	105
PID 804 wrote to memory of 4928	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	106
PID 804 wrote to memory of 4928	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	106
PID 804 wrote to memory of 3680	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	107
PID 804 wrote to memory of 3680	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	107
PID 804 wrote to memory of 2628	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	108
PID 804 wrote to memory of 2628	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	108
PID 804 wrote to memory of 3152	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	109
PID 804 wrote to memory of 3152	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	109
PID 804 wrote to memory of 4244	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	110
PID 804 wrote to memory of 4244	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	110
PID 804 wrote to memory of 3928	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	111
PID 804 wrote to memory of 3928	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	111
PID 804 wrote to memory of 1948	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	112
PID 804 wrote to memory of 1948	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	112
PID 804 wrote to memory of 4964	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	113
PID 804 wrote to memory of 4964	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	113
PID 804 wrote to memory of 1228	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	114
PID 804 wrote to memory of 1228	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	114
PID 804 wrote to memory of 5112	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	115
PID 804 wrote to memory of 5112	804	d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d32eb5b215288effba05bde7e9ff2eb0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\System\iqFHxrL.exe
  C:\Windows\System\iqFHxrL.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\soieAYk.exe
  C:\Windows\System\soieAYk.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\kSgYBZZ.exe
  C:\Windows\System\kSgYBZZ.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\MuONElC.exe
  C:\Windows\System\MuONElC.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\opplHGy.exe
  C:\Windows\System\opplHGy.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\ikmgOqF.exe
  C:\Windows\System\ikmgOqF.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\ADamads.exe
  C:\Windows\System\ADamads.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\nIqsilV.exe
  C:\Windows\System\nIqsilV.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\xkJOxRQ.exe
  C:\Windows\System\xkJOxRQ.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\NmvkPSD.exe
  C:\Windows\System\NmvkPSD.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\EhKZhXr.exe
  C:\Windows\System\EhKZhXr.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\zlPOwpj.exe
  C:\Windows\System\zlPOwpj.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\XaxgMoW.exe
  C:\Windows\System\XaxgMoW.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\qkfnbLt.exe
  C:\Windows\System\qkfnbLt.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\TMWrHpc.exe
  C:\Windows\System\TMWrHpc.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\mlAiusR.exe
  C:\Windows\System\mlAiusR.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\EtHTQku.exe
  C:\Windows\System\EtHTQku.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\wixJsri.exe
  C:\Windows\System\wixJsri.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\RSeHFNt.exe
  C:\Windows\System\RSeHFNt.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\lhiaONn.exe
  C:\Windows\System\lhiaONn.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\hAVLXQl.exe
  C:\Windows\System\hAVLXQl.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\bScxDsK.exe
  C:\Windows\System\bScxDsK.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\ZHPjNKx.exe
  C:\Windows\System\ZHPjNKx.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\mFcOLGt.exe
  C:\Windows\System\mFcOLGt.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\JQWGRYI.exe
  C:\Windows\System\JQWGRYI.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\baIUOFN.exe
  C:\Windows\System\baIUOFN.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\npSfHyH.exe
  C:\Windows\System\npSfHyH.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\pRlUdtQ.exe
  C:\Windows\System\pRlUdtQ.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\jjJQGQN.exe
  C:\Windows\System\jjJQGQN.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\CITGvMa.exe
  C:\Windows\System\CITGvMa.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\OTJUtaw.exe
  C:\Windows\System\OTJUtaw.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\sDNwUmR.exe
  C:\Windows\System\sDNwUmR.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\nANMZwD.exe
  C:\Windows\System\nANMZwD.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\jXHxTum.exe
  C:\Windows\System\jXHxTum.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\scJmXAv.exe
  C:\Windows\System\scJmXAv.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\HnwnDAj.exe
  C:\Windows\System\HnwnDAj.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\tUEhTHh.exe
  C:\Windows\System\tUEhTHh.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\AWtiGoR.exe
  C:\Windows\System\AWtiGoR.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\SYuHvzZ.exe
  C:\Windows\System\SYuHvzZ.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\iqWQrQG.exe
  C:\Windows\System\iqWQrQG.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\OnceEEr.exe
  C:\Windows\System\OnceEEr.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\jXnYOmL.exe
  C:\Windows\System\jXnYOmL.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\PDNzdJO.exe
  C:\Windows\System\PDNzdJO.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\SlvojEq.exe
  C:\Windows\System\SlvojEq.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\WJpqIdp.exe
  C:\Windows\System\WJpqIdp.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\DtMNqeE.exe
  C:\Windows\System\DtMNqeE.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\pxruxsT.exe
  C:\Windows\System\pxruxsT.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\qlPgpcz.exe
  C:\Windows\System\qlPgpcz.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\tODgKur.exe
  C:\Windows\System\tODgKur.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\hZzVgAO.exe
  C:\Windows\System\hZzVgAO.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\wxFxaHG.exe
  C:\Windows\System\wxFxaHG.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\khmVxiH.exe
  C:\Windows\System\khmVxiH.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\DNNkQtS.exe
  C:\Windows\System\DNNkQtS.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\MyfCuXI.exe
  C:\Windows\System\MyfCuXI.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\dWIyZow.exe
  C:\Windows\System\dWIyZow.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\IcVxJFJ.exe
  C:\Windows\System\IcVxJFJ.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\AzHiVNf.exe
  C:\Windows\System\AzHiVNf.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\mQoAlca.exe
  C:\Windows\System\mQoAlca.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\YotNXED.exe
  C:\Windows\System\YotNXED.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\VJoGNGv.exe
  C:\Windows\System\VJoGNGv.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\TQehPgX.exe
  C:\Windows\System\TQehPgX.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\nyxqtKg.exe
  C:\Windows\System\nyxqtKg.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\rXbqiuF.exe
  C:\Windows\System\rXbqiuF.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\iBBaYqG.exe
  C:\Windows\System\iBBaYqG.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\EoCVKTf.exe
  C:\Windows\System\EoCVKTf.exe
  2⤵
  PID:544
- C:\Windows\System\ckbJOfW.exe
  C:\Windows\System\ckbJOfW.exe
  2⤵
  PID:4628
- C:\Windows\System\lsxbOdb.exe
  C:\Windows\System\lsxbOdb.exe
  2⤵
  PID:2880
- C:\Windows\System\leVKEKb.exe
  C:\Windows\System\leVKEKb.exe
  2⤵
  PID:3352
- C:\Windows\System\KEmlJyC.exe
  C:\Windows\System\KEmlJyC.exe
  2⤵
  PID:2604
- C:\Windows\System\RKEfwFy.exe
  C:\Windows\System\RKEfwFy.exe
  2⤵
  PID:4212
- C:\Windows\System\ZzDsxzW.exe
  C:\Windows\System\ZzDsxzW.exe
  2⤵
  PID:436
- C:\Windows\System\GYDFugn.exe
  C:\Windows\System\GYDFugn.exe
  2⤵
  PID:4084
- C:\Windows\System\AGJztLQ.exe
  C:\Windows\System\AGJztLQ.exe
  2⤵
  PID:116
- C:\Windows\System\UwECnCr.exe
  C:\Windows\System\UwECnCr.exe
  2⤵
  PID:3456
- C:\Windows\System\IaXMcNy.exe
  C:\Windows\System\IaXMcNy.exe
  2⤵
  PID:4560
- C:\Windows\System\vDIMXNU.exe
  C:\Windows\System\vDIMXNU.exe
  2⤵
  PID:4924
- C:\Windows\System\mHtnTqS.exe
  C:\Windows\System\mHtnTqS.exe
  2⤵
  PID:1284
- C:\Windows\System\gqkETRd.exe
  C:\Windows\System\gqkETRd.exe
  2⤵
  PID:2740
- C:\Windows\System\tmgaXME.exe
  C:\Windows\System\tmgaXME.exe
  2⤵
  PID:1608
- C:\Windows\System\JUDWZkq.exe
  C:\Windows\System\JUDWZkq.exe
  2⤵
  PID:5148
- C:\Windows\System\zzHCzEz.exe
  C:\Windows\System\zzHCzEz.exe
  2⤵
  PID:5176
- C:\Windows\System\qJHtfuT.exe
  C:\Windows\System\qJHtfuT.exe
  2⤵
  PID:5216
- C:\Windows\System\TduVFPs.exe
  C:\Windows\System\TduVFPs.exe
  2⤵
  PID:5244
- C:\Windows\System\gKZOLMc.exe
  C:\Windows\System\gKZOLMc.exe
  2⤵
  PID:5272
- C:\Windows\System\oRHnaXT.exe
  C:\Windows\System\oRHnaXT.exe
  2⤵
  PID:5300
- C:\Windows\System\uOBhELo.exe
  C:\Windows\System\uOBhELo.exe
  2⤵
  PID:5328
- C:\Windows\System\PrMagNd.exe
  C:\Windows\System\PrMagNd.exe
  2⤵
  PID:5356
- C:\Windows\System\MOKcbee.exe
  C:\Windows\System\MOKcbee.exe
  2⤵
  PID:5392
- C:\Windows\System\tHathXa.exe
  C:\Windows\System\tHathXa.exe
  2⤵
  PID:5412
- C:\Windows\System\lIPMYKh.exe
  C:\Windows\System\lIPMYKh.exe
  2⤵
  PID:5436
- C:\Windows\System\XbRUwdT.exe
  C:\Windows\System\XbRUwdT.exe
  2⤵
  PID:5464
- C:\Windows\System\CISXAHT.exe
  C:\Windows\System\CISXAHT.exe
  2⤵
  PID:5484
- C:\Windows\System\clqMLWx.exe
  C:\Windows\System\clqMLWx.exe
  2⤵
  PID:5512
- C:\Windows\System\BxjIrKt.exe
  C:\Windows\System\BxjIrKt.exe
  2⤵
  PID:5540
- C:\Windows\System\dJiDAgK.exe
  C:\Windows\System\dJiDAgK.exe
  2⤵
  PID:5568
- C:\Windows\System\tQoovcg.exe
  C:\Windows\System\tQoovcg.exe
  2⤵
  PID:5596
- C:\Windows\System\JnleJto.exe
  C:\Windows\System\JnleJto.exe
  2⤵
  PID:5624
- C:\Windows\System\uEnQlMt.exe
  C:\Windows\System\uEnQlMt.exe
  2⤵
  PID:5648
- C:\Windows\System\tCiUFle.exe
  C:\Windows\System\tCiUFle.exe
  2⤵
  PID:5676
- C:\Windows\System\yniTHuA.exe
  C:\Windows\System\yniTHuA.exe
  2⤵
  PID:5708
- C:\Windows\System\chHDDwg.exe
  C:\Windows\System\chHDDwg.exe
  2⤵
  PID:5736
- C:\Windows\System\lUCAcBK.exe
  C:\Windows\System\lUCAcBK.exe
  2⤵
  PID:5764
- C:\Windows\System\HyVGHhZ.exe
  C:\Windows\System\HyVGHhZ.exe
  2⤵
  PID:5788
- C:\Windows\System\NQbhHxt.exe
  C:\Windows\System\NQbhHxt.exe
  2⤵
  PID:5816
- C:\Windows\System\dINtxmO.exe
  C:\Windows\System\dINtxmO.exe
  2⤵
  PID:5848
- C:\Windows\System\bwLxhae.exe
  C:\Windows\System\bwLxhae.exe
  2⤵
  PID:5876
- C:\Windows\System\pnQcXXM.exe
  C:\Windows\System\pnQcXXM.exe
  2⤵
  PID:5900
- C:\Windows\System\GVRiUcG.exe
  C:\Windows\System\GVRiUcG.exe
  2⤵
  PID:5928
- C:\Windows\System\MkQhvlG.exe
  C:\Windows\System\MkQhvlG.exe
  2⤵
  PID:5956
- C:\Windows\System\hxpPHja.exe
  C:\Windows\System\hxpPHja.exe
  2⤵
  PID:5984
- C:\Windows\System\rTxwZcL.exe
  C:\Windows\System\rTxwZcL.exe
  2⤵
  PID:6012
- C:\Windows\System\TbwyXcP.exe
  C:\Windows\System\TbwyXcP.exe
  2⤵
  PID:6040
- C:\Windows\System\KkGyZXx.exe
  C:\Windows\System\KkGyZXx.exe
  2⤵
  PID:6072
- C:\Windows\System\XaZIkax.exe
  C:\Windows\System\XaZIkax.exe
  2⤵
  PID:6100
- C:\Windows\System\GdNGPjz.exe
  C:\Windows\System\GdNGPjz.exe
  2⤵
  PID:6124
- C:\Windows\System\ZPgshCD.exe
  C:\Windows\System\ZPgshCD.exe
  2⤵
  PID:2924
- C:\Windows\System\EBpWJJs.exe
  C:\Windows\System\EBpWJJs.exe
  2⤵
  PID:3872
- C:\Windows\System\xjOhKku.exe
  C:\Windows\System\xjOhKku.exe
  2⤵
  PID:368
- C:\Windows\System\MwHnZGi.exe
  C:\Windows\System\MwHnZGi.exe
  2⤵
  PID:4984
- C:\Windows\System\pOfjaST.exe
  C:\Windows\System\pOfjaST.exe
  2⤵
  PID:5072
- C:\Windows\System\hQQmKXs.exe
  C:\Windows\System\hQQmKXs.exe
  2⤵
  PID:1588
- C:\Windows\System\VuliHOB.exe
  C:\Windows\System\VuliHOB.exe
  2⤵
  PID:4240
- C:\Windows\System\edKAnfq.exe
  C:\Windows\System\edKAnfq.exe
  2⤵
  PID:4268
- C:\Windows\System\PiCxZPw.exe
  C:\Windows\System\PiCxZPw.exe
  2⤵
  PID:5168
- C:\Windows\System\NiTBAkD.exe
  C:\Windows\System\NiTBAkD.exe
  2⤵
  PID:5232
- C:\Windows\System\iZGZqvA.exe
  C:\Windows\System\iZGZqvA.exe
  2⤵
  PID:5292
- C:\Windows\System\VcjsUmC.exe
  C:\Windows\System\VcjsUmC.exe
  2⤵
  PID:5372
- C:\Windows\System\RyOwexU.exe
  C:\Windows\System\RyOwexU.exe
  2⤵
  PID:5428
- C:\Windows\System\cfGdSOc.exe
  C:\Windows\System\cfGdSOc.exe
  2⤵
  PID:5500
- C:\Windows\System\CKooZrj.exe
  C:\Windows\System\CKooZrj.exe
  2⤵
  PID:5580
- C:\Windows\System\ajbRIhr.exe
  C:\Windows\System\ajbRIhr.exe
  2⤵
  PID:5636
- C:\Windows\System\KXmwblp.exe
  C:\Windows\System\KXmwblp.exe
  2⤵
  PID:5696
- C:\Windows\System\SpDgFXI.exe
  C:\Windows\System\SpDgFXI.exe
  2⤵
  PID:5756
- C:\Windows\System\Mkxchbz.exe
  C:\Windows\System\Mkxchbz.exe
  2⤵
  PID:5812
- C:\Windows\System\rzDTLQQ.exe
  C:\Windows\System\rzDTLQQ.exe
  2⤵
  PID:5888
- C:\Windows\System\owRueIz.exe
  C:\Windows\System\owRueIz.exe
  2⤵
  PID:5948
- C:\Windows\System\bKMakBN.exe
  C:\Windows\System\bKMakBN.exe
  2⤵
  PID:6028
- C:\Windows\System\dlaYVrM.exe
  C:\Windows\System\dlaYVrM.exe
  2⤵
  PID:6084
- C:\Windows\System\oKcLcrv.exe
  C:\Windows\System\oKcLcrv.exe
  2⤵
  PID:3764
- C:\Windows\System\YZzHlRu.exe
  C:\Windows\System\YZzHlRu.exe
  2⤵
  PID:4832
- C:\Windows\System\EXgSQYc.exe
  C:\Windows\System\EXgSQYc.exe
  2⤵
  PID:1032
- C:\Windows\System\iDGLGgB.exe
  C:\Windows\System\iDGLGgB.exe
  2⤵
  PID:4064
- C:\Windows\System\pExvGdM.exe
  C:\Windows\System\pExvGdM.exe
  2⤵
  PID:5204
- C:\Windows\System\sdmOqoZ.exe
  C:\Windows\System\sdmOqoZ.exe
  2⤵
  PID:5348
- C:\Windows\System\nNBPCWJ.exe
  C:\Windows\System\nNBPCWJ.exe
  2⤵
  PID:6172
- C:\Windows\System\fnlxkGX.exe
  C:\Windows\System\fnlxkGX.exe
  2⤵
  PID:6196
- C:\Windows\System\VybyLBO.exe
  C:\Windows\System\VybyLBO.exe
  2⤵
  PID:6224
- C:\Windows\System\gsSvjhN.exe
  C:\Windows\System\gsSvjhN.exe
  2⤵
  PID:6252
- C:\Windows\System\CZcyhvM.exe
  C:\Windows\System\CZcyhvM.exe
  2⤵
  PID:6284
- C:\Windows\System\SYLWIRv.exe
  C:\Windows\System\SYLWIRv.exe
  2⤵
  PID:6308
- C:\Windows\System\OUHfVHR.exe
  C:\Windows\System\OUHfVHR.exe
  2⤵
  PID:6336
- C:\Windows\System\VBBatuq.exe
  C:\Windows\System\VBBatuq.exe
  2⤵
  PID:6364
- C:\Windows\System\irgVcdV.exe
  C:\Windows\System\irgVcdV.exe
  2⤵
  PID:6392
- C:\Windows\System\OmSkYwD.exe
  C:\Windows\System\OmSkYwD.exe
  2⤵
  PID:6424
- C:\Windows\System\rfcVXdY.exe
  C:\Windows\System\rfcVXdY.exe
  2⤵
  PID:6448
- C:\Windows\System\QnpMiXO.exe
  C:\Windows\System\QnpMiXO.exe
  2⤵
  PID:6476
- C:\Windows\System\hUjcQka.exe
  C:\Windows\System\hUjcQka.exe
  2⤵
  PID:6508
- C:\Windows\System\lTFJWyb.exe
  C:\Windows\System\lTFJWyb.exe
  2⤵
  PID:6536
- C:\Windows\System\VmpweJn.exe
  C:\Windows\System\VmpweJn.exe
  2⤵
  PID:6560
- C:\Windows\System\GNfDgoa.exe
  C:\Windows\System\GNfDgoa.exe
  2⤵
  PID:6588
- C:\Windows\System\LWwxBdo.exe
  C:\Windows\System\LWwxBdo.exe
  2⤵
  PID:6620
- C:\Windows\System\AfkfxWr.exe
  C:\Windows\System\AfkfxWr.exe
  2⤵
  PID:6648
- C:\Windows\System\xLcGbsj.exe
  C:\Windows\System\xLcGbsj.exe
  2⤵
  PID:6676
- C:\Windows\System\ylqtmSO.exe
  C:\Windows\System\ylqtmSO.exe
  2⤵
  PID:6700
- C:\Windows\System\qmScZlh.exe
  C:\Windows\System\qmScZlh.exe
  2⤵
  PID:6728
- C:\Windows\System\TvdDJsM.exe
  C:\Windows\System\TvdDJsM.exe
  2⤵
  PID:6756
- C:\Windows\System\aVGynJO.exe
  C:\Windows\System\aVGynJO.exe
  2⤵
  PID:6784
- C:\Windows\System\GQZKsMi.exe
  C:\Windows\System\GQZKsMi.exe
  2⤵
  PID:6816
- C:\Windows\System\euRFubZ.exe
  C:\Windows\System\euRFubZ.exe
  2⤵
  PID:6844
- C:\Windows\System\uImouvb.exe
  C:\Windows\System\uImouvb.exe
  2⤵
  PID:6872
- C:\Windows\System\XivQVdY.exe
  C:\Windows\System\XivQVdY.exe
  2⤵
  PID:6900
- C:\Windows\System\HGuyjTx.exe
  C:\Windows\System\HGuyjTx.exe
  2⤵
  PID:6924
- C:\Windows\System\CmQvwih.exe
  C:\Windows\System\CmQvwih.exe
  2⤵
  PID:6952
- C:\Windows\System\MJNjceN.exe
  C:\Windows\System\MJNjceN.exe
  2⤵
  PID:6984
- C:\Windows\System\BiFzUjA.exe
  C:\Windows\System\BiFzUjA.exe
  2⤵
  PID:7008
- C:\Windows\System\wPezKQx.exe
  C:\Windows\System\wPezKQx.exe
  2⤵
  PID:7040
- C:\Windows\System\NaXhDSv.exe
  C:\Windows\System\NaXhDSv.exe
  2⤵
  PID:7068
- C:\Windows\System\QZnUpYe.exe
  C:\Windows\System\QZnUpYe.exe
  2⤵
  PID:7096
- C:\Windows\System\zgqrNkC.exe
  C:\Windows\System\zgqrNkC.exe
  2⤵
  PID:7120
- C:\Windows\System\IRNcZwg.exe
  C:\Windows\System\IRNcZwg.exe
  2⤵
  PID:7152
- C:\Windows\System\bAIabRr.exe
  C:\Windows\System\bAIabRr.exe
  2⤵
  PID:5476
- C:\Windows\System\cJgtaXF.exe
  C:\Windows\System\cJgtaXF.exe
  2⤵
  PID:5612
- C:\Windows\System\wOHAIDQ.exe
  C:\Windows\System\wOHAIDQ.exe
  2⤵
  PID:5748
- C:\Windows\System\qaqRwZX.exe
  C:\Windows\System\qaqRwZX.exe
  2⤵
  PID:5920
- C:\Windows\System\eCjTDcN.exe
  C:\Windows\System\eCjTDcN.exe
  2⤵
  PID:6056
- C:\Windows\System\EfWAZUv.exe
  C:\Windows\System\EfWAZUv.exe
  2⤵
  PID:4588
- C:\Windows\System\PRQfEjP.exe
  C:\Windows\System\PRQfEjP.exe
  2⤵
  PID:4248
- C:\Windows\System\xrOXBGS.exe
  C:\Windows\System\xrOXBGS.exe
  2⤵
  PID:6156
- C:\Windows\System\hbQRSpW.exe
  C:\Windows\System\hbQRSpW.exe
  2⤵
  PID:6212
- C:\Windows\System\KGsWnrV.exe
  C:\Windows\System\KGsWnrV.exe
  2⤵
  PID:6272
- C:\Windows\System\UOZrtAk.exe
  C:\Windows\System\UOZrtAk.exe
  2⤵
  PID:6352
- C:\Windows\System\nhfFBJt.exe
  C:\Windows\System\nhfFBJt.exe
  2⤵
  PID:6408
- C:\Windows\System\dPvLVrh.exe
  C:\Windows\System\dPvLVrh.exe
  2⤵
  PID:6468
- C:\Windows\System\IzZGZEF.exe
  C:\Windows\System\IzZGZEF.exe
  2⤵
  PID:6528
- C:\Windows\System\WCRnzyq.exe
  C:\Windows\System\WCRnzyq.exe
  2⤵
  PID:6604
- C:\Windows\System\BAdtGnb.exe
  C:\Windows\System\BAdtGnb.exe
  2⤵
  PID:6640
- C:\Windows\System\Wloillg.exe
  C:\Windows\System\Wloillg.exe
  2⤵
  PID:6716
- C:\Windows\System\pHLaWEY.exe
  C:\Windows\System\pHLaWEY.exe
  2⤵
  PID:6772
- C:\Windows\System\zIhIgfO.exe
  C:\Windows\System\zIhIgfO.exe
  2⤵
  PID:6832
- C:\Windows\System\FWKHwYJ.exe
  C:\Windows\System\FWKHwYJ.exe
  2⤵
  PID:6888
- C:\Windows\System\UiAnaMm.exe
  C:\Windows\System\UiAnaMm.exe
  2⤵
  PID:6948
- C:\Windows\System\qUHmkYM.exe
  C:\Windows\System\qUHmkYM.exe
  2⤵
  PID:7004
- C:\Windows\System\yApZhSn.exe
  C:\Windows\System\yApZhSn.exe
  2⤵
  PID:5724
- C:\Windows\System\SpNHWbk.exe
  C:\Windows\System\SpNHWbk.exe
  2⤵
  PID:5980
- C:\Windows\System\xiosZjo.exe
  C:\Windows\System\xiosZjo.exe
  2⤵
  PID:6140
- C:\Windows\System\eGSbFvG.exe
  C:\Windows\System\eGSbFvG.exe
  2⤵
  PID:5200
- C:\Windows\System\CMwxpBB.exe
  C:\Windows\System\CMwxpBB.exe
  2⤵
  PID:6244
- C:\Windows\System\qNapbZu.exe
  C:\Windows\System\qNapbZu.exe
  2⤵
  PID:6384
- C:\Windows\System\IURJwPr.exe
  C:\Windows\System\IURJwPr.exe
  2⤵
  PID:6524
- C:\Windows\System\IMvstzV.exe
  C:\Windows\System\IMvstzV.exe
  2⤵
  PID:6636
- C:\Windows\System\qaTONsq.exe
  C:\Windows\System\qaTONsq.exe
  2⤵
  PID:4172
- C:\Windows\System\ZneKLMW.exe
  C:\Windows\System\ZneKLMW.exe
  2⤵
  PID:6884
- C:\Windows\System\LzZEewy.exe
  C:\Windows\System\LzZEewy.exe
  2⤵
  PID:6804
- C:\Windows\System\LWABnBp.exe
  C:\Windows\System\LWABnBp.exe
  2⤵
  PID:5588
- C:\Windows\System\fxtWeDV.exe
  C:\Windows\System\fxtWeDV.exe
  2⤵
  PID:5532
- C:\Windows\System\Zerwwac.exe
  C:\Windows\System\Zerwwac.exe
  2⤵
  PID:864
- C:\Windows\System\gTEjGZY.exe
  C:\Windows\System\gTEjGZY.exe
  2⤵
  PID:3712
- C:\Windows\System\DOVrNmg.exe
  C:\Windows\System\DOVrNmg.exe
  2⤵
  PID:6192
- C:\Windows\System\FywlCFc.exe
  C:\Windows\System\FywlCFc.exe
  2⤵
  PID:316
- C:\Windows\System\baeeHFm.exe
  C:\Windows\System\baeeHFm.exe
  2⤵
  PID:6328
- C:\Windows\System\hvAvGby.exe
  C:\Windows\System\hvAvGby.exe
  2⤵
  PID:1976
- C:\Windows\System\aNdqwhe.exe
  C:\Windows\System\aNdqwhe.exe
  2⤵
  PID:6464
- C:\Windows\System\yRKuLNU.exe
  C:\Windows\System\yRKuLNU.exe
  2⤵
  PID:6632
- C:\Windows\System\FTLmOsB.exe
  C:\Windows\System\FTLmOsB.exe
  2⤵
  PID:3932
- C:\Windows\System\eCVRwcJ.exe
  C:\Windows\System\eCVRwcJ.exe
  2⤵
  PID:1072
- C:\Windows\System\ZRylKVm.exe
  C:\Windows\System\ZRylKVm.exe
  2⤵
  PID:2120
- C:\Windows\System\RzJTbrn.exe
  C:\Windows\System\RzJTbrn.exe
  2⤵
  PID:2268
- C:\Windows\System\PyMYgGE.exe
  C:\Windows\System\PyMYgGE.exe
  2⤵
  PID:4300
- C:\Windows\System\TxxsonA.exe
  C:\Windows\System\TxxsonA.exe
  2⤵
  PID:4616
- C:\Windows\System\jWTJMWB.exe
  C:\Windows\System\jWTJMWB.exe
  2⤵
  PID:2540
- C:\Windows\System\WgwUZMO.exe
  C:\Windows\System\WgwUZMO.exe
  2⤵
  PID:640
- C:\Windows\System\zweiiOZ.exe
  C:\Windows\System\zweiiOZ.exe
  2⤵
  PID:7184
- C:\Windows\System\nguOaio.exe
  C:\Windows\System\nguOaio.exe
  2⤵
  PID:7216
- C:\Windows\System\EfNQXRt.exe
  C:\Windows\System\EfNQXRt.exe
  2⤵
  PID:7236
- C:\Windows\System\vkLVRZH.exe
  C:\Windows\System\vkLVRZH.exe
  2⤵
  PID:7264
- C:\Windows\System\ukgPuUN.exe
  C:\Windows\System\ukgPuUN.exe
  2⤵
  PID:7288
- C:\Windows\System\nmommHW.exe
  C:\Windows\System\nmommHW.exe
  2⤵
  PID:7312
- C:\Windows\System\kOOogPj.exe
  C:\Windows\System\kOOogPj.exe
  2⤵
  PID:7404
- C:\Windows\System\xFiEBoQ.exe
  C:\Windows\System\xFiEBoQ.exe
  2⤵
  PID:7432
- C:\Windows\System\Tnnkmty.exe
  C:\Windows\System\Tnnkmty.exe
  2⤵
  PID:7452
- C:\Windows\System\pdGOxUF.exe
  C:\Windows\System\pdGOxUF.exe
  2⤵
  PID:7476
- C:\Windows\System\wfFHIvt.exe
  C:\Windows\System\wfFHIvt.exe
  2⤵
  PID:7496
- C:\Windows\System\wNLrgNf.exe
  C:\Windows\System\wNLrgNf.exe
  2⤵
  PID:7512
- C:\Windows\System\nMnFwRp.exe
  C:\Windows\System\nMnFwRp.exe
  2⤵
  PID:7544
- C:\Windows\System\umXnCKB.exe
  C:\Windows\System\umXnCKB.exe
  2⤵
  PID:7580
- C:\Windows\System\HogKIsX.exe
  C:\Windows\System\HogKIsX.exe
  2⤵
  PID:7604
- C:\Windows\System\tGFEnKW.exe
  C:\Windows\System\tGFEnKW.exe
  2⤵
  PID:7620
- C:\Windows\System\FVBykgC.exe
  C:\Windows\System\FVBykgC.exe
  2⤵
  PID:7644
- C:\Windows\System\lVlyakq.exe
  C:\Windows\System\lVlyakq.exe
  2⤵
  PID:7660
- C:\Windows\System\aCXRJeG.exe
  C:\Windows\System\aCXRJeG.exe
  2⤵
  PID:7732
- C:\Windows\System\XrFNarh.exe
  C:\Windows\System\XrFNarh.exe
  2⤵
  PID:7768
- C:\Windows\System\NYQmzEv.exe
  C:\Windows\System\NYQmzEv.exe
  2⤵
  PID:7796
- C:\Windows\System\lrFUxqy.exe
  C:\Windows\System\lrFUxqy.exe
  2⤵
  PID:7824
- C:\Windows\System\sqdZfxV.exe
  C:\Windows\System\sqdZfxV.exe
  2⤵
  PID:7860
- C:\Windows\System\wxVxyFN.exe
  C:\Windows\System\wxVxyFN.exe
  2⤵
  PID:7884
- C:\Windows\System\sbluqNg.exe
  C:\Windows\System\sbluqNg.exe
  2⤵
  PID:7916
- C:\Windows\System\LHjjvHW.exe
  C:\Windows\System\LHjjvHW.exe
  2⤵
  PID:7952
- C:\Windows\System\AmSoLpJ.exe
  C:\Windows\System\AmSoLpJ.exe
  2⤵
  PID:7980
- C:\Windows\System\WmqkfHG.exe
  C:\Windows\System\WmqkfHG.exe
  2⤵
  PID:8008
- C:\Windows\System\Bqqfjbp.exe
  C:\Windows\System\Bqqfjbp.exe
  2⤵
  PID:8036
- C:\Windows\System\wbJlyvO.exe
  C:\Windows\System\wbJlyvO.exe
  2⤵
  PID:8052
- C:\Windows\System\PTMCdba.exe
  C:\Windows\System\PTMCdba.exe
  2⤵
  PID:8092
- C:\Windows\System\zxBvweY.exe
  C:\Windows\System\zxBvweY.exe
  2⤵
  PID:8108
- C:\Windows\System\xikTnWx.exe
  C:\Windows\System\xikTnWx.exe
  2⤵
  PID:8148
- C:\Windows\System\ymPSwHH.exe
  C:\Windows\System\ymPSwHH.exe
  2⤵
  PID:8172
- C:\Windows\System\SWMvfya.exe
  C:\Windows\System\SWMvfya.exe
  2⤵
  PID:3568
- C:\Windows\System\cdjTMOI.exe
  C:\Windows\System\cdjTMOI.exe
  2⤵
  PID:7180
- C:\Windows\System\FVhiCzZ.exe
  C:\Windows\System\FVhiCzZ.exe
  2⤵
  PID:2200
- C:\Windows\System\GsBSrCa.exe
  C:\Windows\System\GsBSrCa.exe
  2⤵
  PID:7172
- C:\Windows\System\jFJpScu.exe
  C:\Windows\System\jFJpScu.exe
  2⤵
  PID:7280
- C:\Windows\System\Jbptuwp.exe
  C:\Windows\System\Jbptuwp.exe
  2⤵
  PID:7304
- C:\Windows\System\jUhMGeB.exe
  C:\Windows\System\jUhMGeB.exe
  2⤵
  PID:7420
- C:\Windows\System\yDbRliM.exe
  C:\Windows\System\yDbRliM.exe
  2⤵
  PID:7576
- C:\Windows\System\PzVzsYp.exe
  C:\Windows\System\PzVzsYp.exe
  2⤵
  PID:7616
- C:\Windows\System\iNInNrE.exe
  C:\Windows\System\iNInNrE.exe
  2⤵
  PID:7712
- C:\Windows\System\rukOZOb.exe
  C:\Windows\System\rukOZOb.exe
  2⤵
  PID:7788
- C:\Windows\System\cUOyoNP.exe
  C:\Windows\System\cUOyoNP.exe
  2⤵
  PID:7784
- C:\Windows\System\FJTJJgX.exe
  C:\Windows\System\FJTJJgX.exe
  2⤵
  PID:7900
- C:\Windows\System\keoGKJB.exe
  C:\Windows\System\keoGKJB.exe
  2⤵
  PID:7964
- C:\Windows\System\IuStgof.exe
  C:\Windows\System\IuStgof.exe
  2⤵
  PID:8004
- C:\Windows\System\wgGrDVc.exe
  C:\Windows\System\wgGrDVc.exe
  2⤵
  PID:8064
- C:\Windows\System\HlBuDpi.exe
  C:\Windows\System\HlBuDpi.exe
  2⤵
  PID:8084
- C:\Windows\System\fkjNSKW.exe
  C:\Windows\System\fkjNSKW.exe
  2⤵
  PID:8144
- C:\Windows\System\YWleDfm.exe
  C:\Windows\System\YWleDfm.exe
  2⤵
  PID:5424
- C:\Windows\System\QoBOyjc.exe
  C:\Windows\System\QoBOyjc.exe
  2⤵
  PID:7588
- C:\Windows\System\wNTquvY.exe
  C:\Windows\System\wNTquvY.exe
  2⤵
  PID:7592
- C:\Windows\System\poSLTjO.exe
  C:\Windows\System\poSLTjO.exe
  2⤵
  PID:7764
- C:\Windows\System\QBuBRQf.exe
  C:\Windows\System\QBuBRQf.exe
  2⤵
  PID:7936
- C:\Windows\System\DvDvJFi.exe
  C:\Windows\System\DvDvJFi.exe
  2⤵
  PID:7948
- C:\Windows\System\tCXrYgn.exe
  C:\Windows\System\tCXrYgn.exe
  2⤵
  PID:8100
- C:\Windows\System\IFrFkfg.exe
  C:\Windows\System\IFrFkfg.exe
  2⤵
  PID:7424
- C:\Windows\System\qdFpNXa.exe
  C:\Windows\System\qdFpNXa.exe
  2⤵
  PID:6940
- C:\Windows\System\HHloQpu.exe
  C:\Windows\System\HHloQpu.exe
  2⤵
  PID:7528
- C:\Windows\System\DSGYPXm.exe
  C:\Windows\System\DSGYPXm.exe
  2⤵
  PID:8224
- C:\Windows\System\SUtErRK.exe
  C:\Windows\System\SUtErRK.exe
  2⤵
  PID:8244
- C:\Windows\System\XlkeiiK.exe
  C:\Windows\System\XlkeiiK.exe
  2⤵
  PID:8276
- C:\Windows\System\uzuRdAw.exe
  C:\Windows\System\uzuRdAw.exe
  2⤵
  PID:8328
- C:\Windows\System\GddztHW.exe
  C:\Windows\System\GddztHW.exe
  2⤵
  PID:8356
- C:\Windows\System\OIGQqVH.exe
  C:\Windows\System\OIGQqVH.exe
  2⤵
  PID:8372
- C:\Windows\System\WydjcoN.exe
  C:\Windows\System\WydjcoN.exe
  2⤵
  PID:8392
- C:\Windows\System\noFrxBZ.exe
  C:\Windows\System\noFrxBZ.exe
  2⤵
  PID:8440
- C:\Windows\System\mbyTXwm.exe
  C:\Windows\System\mbyTXwm.exe
  2⤵
  PID:8468
- C:\Windows\System\yqyTWoZ.exe
  C:\Windows\System\yqyTWoZ.exe
  2⤵
  PID:8484
- C:\Windows\System\GplNPnk.exe
  C:\Windows\System\GplNPnk.exe
  2⤵
  PID:8504
- C:\Windows\System\mlABZpe.exe
  C:\Windows\System\mlABZpe.exe
  2⤵
  PID:8536
- C:\Windows\System\bXXybGq.exe
  C:\Windows\System\bXXybGq.exe
  2⤵
  PID:8564
- C:\Windows\System\jBDIcnq.exe
  C:\Windows\System\jBDIcnq.exe
  2⤵
  PID:8596
- C:\Windows\System\YIgUmci.exe
  C:\Windows\System\YIgUmci.exe
  2⤵
  PID:8624
- C:\Windows\System\oOvTiQx.exe
  C:\Windows\System\oOvTiQx.exe
  2⤵
  PID:8652
- C:\Windows\System\kXiSmBd.exe
  C:\Windows\System\kXiSmBd.exe
  2⤵
  PID:8672
- C:\Windows\System\XimNgMN.exe
  C:\Windows\System\XimNgMN.exe
  2⤵
  PID:8688
- C:\Windows\System\QTYrxfL.exe
  C:\Windows\System\QTYrxfL.exe
  2⤵
  PID:8748
- C:\Windows\System\Nocnpno.exe
  C:\Windows\System\Nocnpno.exe
  2⤵
  PID:8772
- C:\Windows\System\EIZeVqg.exe
  C:\Windows\System\EIZeVqg.exe
  2⤵
  PID:8792
- C:\Windows\System\yIzjBkH.exe
  C:\Windows\System\yIzjBkH.exe
  2⤵
  PID:8820
- C:\Windows\System\ebpqBhZ.exe
  C:\Windows\System\ebpqBhZ.exe
  2⤵
  PID:8848
- C:\Windows\System\kubPFUJ.exe
  C:\Windows\System\kubPFUJ.exe
  2⤵
  PID:8876
- C:\Windows\System\bksBBia.exe
  C:\Windows\System\bksBBia.exe
  2⤵
  PID:8904
- C:\Windows\System\JEYARRj.exe
  C:\Windows\System\JEYARRj.exe
  2⤵
  PID:8940
- C:\Windows\System\ZEinDaA.exe
  C:\Windows\System\ZEinDaA.exe
  2⤵
  PID:8960
- C:\Windows\System\mgVQdOL.exe
  C:\Windows\System\mgVQdOL.exe
  2⤵
  PID:8992
- C:\Windows\System\IlvSVOM.exe
  C:\Windows\System\IlvSVOM.exe
  2⤵
  PID:9012
- C:\Windows\System\YaglFxx.exe
  C:\Windows\System\YaglFxx.exe
  2⤵
  PID:9028
- C:\Windows\System\atZWYWP.exe
  C:\Windows\System\atZWYWP.exe
  2⤵
  PID:9048
- C:\Windows\System\KwznFVX.exe
  C:\Windows\System\KwznFVX.exe
  2⤵
  PID:9064
- C:\Windows\System\uHSwjmr.exe
  C:\Windows\System\uHSwjmr.exe
  2⤵
  PID:9132
- C:\Windows\System\sIHPDWH.exe
  C:\Windows\System\sIHPDWH.exe
  2⤵
  PID:9152
- C:\Windows\System\VBifLDv.exe
  C:\Windows\System\VBifLDv.exe
  2⤵
  PID:9176
- C:\Windows\System\prIqkkN.exe
  C:\Windows\System\prIqkkN.exe
  2⤵
  PID:9212
- C:\Windows\System\ZzCQcQW.exe
  C:\Windows\System\ZzCQcQW.exe
  2⤵
  PID:7460
- C:\Windows\System\JJMFnOQ.exe
  C:\Windows\System\JJMFnOQ.exe
  2⤵
  PID:8204
- C:\Windows\System\ddeGOCj.exe
  C:\Windows\System\ddeGOCj.exe
  2⤵
  PID:8236
- C:\Windows\System\tsBEbOL.exe
  C:\Windows\System\tsBEbOL.exe
  2⤵
  PID:8308
- C:\Windows\System\ZgxFrPr.exe
  C:\Windows\System\ZgxFrPr.exe
  2⤵
  PID:8388
- C:\Windows\System\soceSJK.exe
  C:\Windows\System\soceSJK.exe
  2⤵
  PID:8456
- C:\Windows\System\TBRXqMG.exe
  C:\Windows\System\TBRXqMG.exe
  2⤵
  PID:8588
- C:\Windows\System\ifIOllb.exe
  C:\Windows\System\ifIOllb.exe
  2⤵
  PID:8636
- C:\Windows\System\iUEaQeD.exe
  C:\Windows\System\iUEaQeD.exe
  2⤵
  PID:8660
- C:\Windows\System\dilqqTc.exe
  C:\Windows\System\dilqqTc.exe
  2⤵
  PID:8736
- C:\Windows\System\OuckLHU.exe
  C:\Windows\System\OuckLHU.exe
  2⤵
  PID:8804
- C:\Windows\System\oQgEOLe.exe
  C:\Windows\System\oQgEOLe.exe
  2⤵
  PID:8896
- C:\Windows\System\whEPSye.exe
  C:\Windows\System\whEPSye.exe
  2⤵
  PID:8932
- C:\Windows\System\DtKsFXO.exe
  C:\Windows\System\DtKsFXO.exe
  2⤵
  PID:8984
- C:\Windows\System\mxxlRCd.exe
  C:\Windows\System\mxxlRCd.exe
  2⤵
  PID:9036
- C:\Windows\System\QhudHmT.exe
  C:\Windows\System\QhudHmT.exe
  2⤵
  PID:9088
- C:\Windows\System\paAhbFv.exe
  C:\Windows\System\paAhbFv.exe
  2⤵
  PID:8032
- C:\Windows\System\AUTxcrG.exe
  C:\Windows\System\AUTxcrG.exe
  2⤵
  PID:8272
- C:\Windows\System\djerezi.exe
  C:\Windows\System\djerezi.exe
  2⤵
  PID:8300
- C:\Windows\System\TMiNDXn.exe
  C:\Windows\System\TMiNDXn.exe
  2⤵
  PID:8548
- C:\Windows\System\XsnTibL.exe
  C:\Windows\System\XsnTibL.exe
  2⤵
  PID:8640
- C:\Windows\System\grnwOUE.exe
  C:\Windows\System\grnwOUE.exe
  2⤵
  PID:8840
- C:\Windows\System\OJagdNP.exe
  C:\Windows\System\OJagdNP.exe
  2⤵
  PID:8956
- C:\Windows\System\JwYfmVX.exe
  C:\Windows\System\JwYfmVX.exe
  2⤵
  PID:9060
- C:\Windows\System\luwArcr.exe
  C:\Windows\System\luwArcr.exe
  2⤵
  PID:8368
- C:\Windows\System\Waplufg.exe
  C:\Windows\System\Waplufg.exe
  2⤵
  PID:8784
- C:\Windows\System\pYDTNIs.exe
  C:\Windows\System\pYDTNIs.exe
  2⤵
  PID:9056
- C:\Windows\System\qLksxkF.exe
  C:\Windows\System\qLksxkF.exe
  2⤵
  PID:8832
- C:\Windows\System\BrUERug.exe
  C:\Windows\System\BrUERug.exe
  2⤵
  PID:9232
- C:\Windows\System\NEYtQhH.exe
  C:\Windows\System\NEYtQhH.exe
  2⤵
  PID:9252
- C:\Windows\System\eCqyayJ.exe
  C:\Windows\System\eCqyayJ.exe
  2⤵
  PID:9272
- C:\Windows\System\NXAuzcn.exe
  C:\Windows\System\NXAuzcn.exe
  2⤵
  PID:9292
- C:\Windows\System\KAQpFyF.exe
  C:\Windows\System\KAQpFyF.exe
  2⤵
  PID:9348
- C:\Windows\System\RTmcgNm.exe
  C:\Windows\System\RTmcgNm.exe
  2⤵
  PID:9376
- C:\Windows\System\vNggxrl.exe
  C:\Windows\System\vNggxrl.exe
  2⤵
  PID:9392
- C:\Windows\System\aypFNPn.exe
  C:\Windows\System\aypFNPn.exe
  2⤵
  PID:9416
- C:\Windows\System\gBXTNWV.exe
  C:\Windows\System\gBXTNWV.exe
  2⤵
  PID:9460
- C:\Windows\System\MmRjeDl.exe
  C:\Windows\System\MmRjeDl.exe
  2⤵
  PID:9484
- C:\Windows\System\vdSdWls.exe
  C:\Windows\System\vdSdWls.exe
  2⤵
  PID:9508
- C:\Windows\System\MVHNNxx.exe
  C:\Windows\System\MVHNNxx.exe
  2⤵
  PID:9544
- C:\Windows\System\dSmgvjl.exe
  C:\Windows\System\dSmgvjl.exe
  2⤵
  PID:9584
- C:\Windows\System\WfYbmNv.exe
  C:\Windows\System\WfYbmNv.exe
  2⤵
  PID:9600
- C:\Windows\System\msbRLKM.exe
  C:\Windows\System\msbRLKM.exe
  2⤵
  PID:9624
- C:\Windows\System\SxyXUeP.exe
  C:\Windows\System\SxyXUeP.exe
  2⤵
  PID:9644
- C:\Windows\System\WbSnbgE.exe
  C:\Windows\System\WbSnbgE.exe
  2⤵
  PID:9684
- C:\Windows\System\rKUTphD.exe
  C:\Windows\System\rKUTphD.exe
  2⤵
  PID:9708
- C:\Windows\System\KHiYWbG.exe
  C:\Windows\System\KHiYWbG.exe
  2⤵
  PID:9728
- C:\Windows\System\mrRtzgV.exe
  C:\Windows\System\mrRtzgV.exe
  2⤵
  PID:9752
- C:\Windows\System\AdLnTyH.exe
  C:\Windows\System\AdLnTyH.exe
  2⤵
  PID:9784
- C:\Windows\System\Qwoghay.exe
  C:\Windows\System\Qwoghay.exe
  2⤵
  PID:9816
- C:\Windows\System\paTpWQb.exe
  C:\Windows\System\paTpWQb.exe
  2⤵
  PID:9832
- C:\Windows\System\lbYxHba.exe
  C:\Windows\System\lbYxHba.exe
  2⤵
  PID:9856
- C:\Windows\System\muKHDOv.exe
  C:\Windows\System\muKHDOv.exe
  2⤵
  PID:9888
- C:\Windows\System\XkBIIDN.exe
  C:\Windows\System\XkBIIDN.exe
  2⤵
  PID:9916
- C:\Windows\System\UHUninr.exe
  C:\Windows\System\UHUninr.exe
  2⤵
  PID:9940
- C:\Windows\System\DiRulnc.exe
  C:\Windows\System\DiRulnc.exe
  2⤵
  PID:10000
- C:\Windows\System\bFZLpRR.exe
  C:\Windows\System\bFZLpRR.exe
  2⤵
  PID:10020
- C:\Windows\System\xsGOocd.exe
  C:\Windows\System\xsGOocd.exe
  2⤵
  PID:10036
- C:\Windows\System\IZbDAQh.exe
  C:\Windows\System\IZbDAQh.exe
  2⤵
  PID:10060
- C:\Windows\System\HUBUltx.exe
  C:\Windows\System\HUBUltx.exe
  2⤵
  PID:10096
- C:\Windows\System\jQzTJOh.exe
  C:\Windows\System\jQzTJOh.exe
  2⤵
  PID:10132
- C:\Windows\System\HCztdmJ.exe
  C:\Windows\System\HCztdmJ.exe
  2⤵
  PID:10156
- C:\Windows\System\HPMHUCA.exe
  C:\Windows\System\HPMHUCA.exe
  2⤵
  PID:10172
- C:\Windows\System\VpDbgEq.exe
  C:\Windows\System\VpDbgEq.exe
  2⤵
  PID:10200
- C:\Windows\System\TKwIzjQ.exe
  C:\Windows\System\TKwIzjQ.exe
  2⤵
  PID:10224
- C:\Windows\System\NHeaMLS.exe
  C:\Windows\System\NHeaMLS.exe
  2⤵
  PID:9224
- C:\Windows\System\HySsoQp.exe
  C:\Windows\System\HySsoQp.exe
  2⤵
  PID:9260
- C:\Windows\System\kSJdfvJ.exe
  C:\Windows\System\kSJdfvJ.exe
  2⤵
  PID:9364
- C:\Windows\System\EVwKDdw.exe
  C:\Windows\System\EVwKDdw.exe
  2⤵
  PID:9384
- C:\Windows\System\URBRexb.exe
  C:\Windows\System\URBRexb.exe
  2⤵
  PID:9412
- C:\Windows\System\uldxnru.exe
  C:\Windows\System\uldxnru.exe
  2⤵
  PID:9476
- C:\Windows\System\zQSVcJZ.exe
  C:\Windows\System\zQSVcJZ.exe
  2⤵
  PID:9576
- C:\Windows\System\kdKYtAb.exe
  C:\Windows\System\kdKYtAb.exe
  2⤵
  PID:9592
- C:\Windows\System\LaKmcMG.exe
  C:\Windows\System\LaKmcMG.exe
  2⤵
  PID:9700
- C:\Windows\System\rySMXit.exe
  C:\Windows\System\rySMXit.exe
  2⤵
  PID:9780
- C:\Windows\System\GuauOJT.exe
  C:\Windows\System\GuauOJT.exe
  2⤵
  PID:9852
- C:\Windows\System\NhYzTCw.exe
  C:\Windows\System\NhYzTCw.exe
  2⤵
  PID:9912
- C:\Windows\System\LcdnHzG.exe
  C:\Windows\System\LcdnHzG.exe
  2⤵
  PID:9996
- C:\Windows\System\DPAaUMx.exe
  C:\Windows\System\DPAaUMx.exe
  2⤵
  PID:10080
- C:\Windows\System\xDZonPK.exe
  C:\Windows\System\xDZonPK.exe
  2⤵
  PID:10124
- C:\Windows\System\vWcHfhp.exe
  C:\Windows\System\vWcHfhp.exe
  2⤵
  PID:10216
- C:\Windows\System\THzMjBF.exe
  C:\Windows\System\THzMjBF.exe
  2⤵
  PID:9268
- C:\Windows\System\QIKKAZa.exe
  C:\Windows\System\QIKKAZa.exe
  2⤵
  PID:9404
- C:\Windows\System\UWALlcl.exe
  C:\Windows\System\UWALlcl.exe
  2⤵
  PID:9540
- C:\Windows\System\cVhleCu.exe
  C:\Windows\System\cVhleCu.exe
  2⤵
  PID:9748
- C:\Windows\System\FEjkIwl.exe
  C:\Windows\System\FEjkIwl.exe
  2⤵
  PID:9896
- C:\Windows\System\zTSaGrl.exe
  C:\Windows\System\zTSaGrl.exe
  2⤵
  PID:10052
- C:\Windows\System\USDBmTw.exe
  C:\Windows\System\USDBmTw.exe
  2⤵
  PID:9612
- C:\Windows\System\XAGqoQB.exe
  C:\Windows\System\XAGqoQB.exe
  2⤵
  PID:9556
- C:\Windows\System\LZTuBQS.exe
  C:\Windows\System\LZTuBQS.exe
  2⤵
  PID:10112
- C:\Windows\System\qPQnxzK.exe
  C:\Windows\System\qPQnxzK.exe
  2⤵
  PID:9672
- C:\Windows\System\takffAb.exe
  C:\Windows\System\takffAb.exe
  2⤵
  PID:10248
- C:\Windows\System\Ywoubke.exe
  C:\Windows\System\Ywoubke.exe
  2⤵
  PID:10280
- C:\Windows\System\ABaAYUj.exe
  C:\Windows\System\ABaAYUj.exe
  2⤵
  PID:10308
- C:\Windows\System\kxwVsaz.exe
  C:\Windows\System\kxwVsaz.exe
  2⤵
  PID:10336
- C:\Windows\System\KTQZMnC.exe
  C:\Windows\System\KTQZMnC.exe
  2⤵
  PID:10372
- C:\Windows\System\GPEweBz.exe
  C:\Windows\System\GPEweBz.exe
  2⤵
  PID:10400
- C:\Windows\System\mRmXHjP.exe
  C:\Windows\System\mRmXHjP.exe
  2⤵
  PID:10440
- C:\Windows\System\FZZmZod.exe
  C:\Windows\System\FZZmZod.exe
  2⤵
  PID:10456
- C:\Windows\System\MOWSiee.exe
  C:\Windows\System\MOWSiee.exe
  2⤵
  PID:10476
- C:\Windows\System\ADfdnYc.exe
  C:\Windows\System\ADfdnYc.exe
  2⤵
  PID:10500
- C:\Windows\System\vsxAxEq.exe
  C:\Windows\System\vsxAxEq.exe
  2⤵
  PID:10540
- C:\Windows\System\Ixwldwj.exe
  C:\Windows\System\Ixwldwj.exe
  2⤵
  PID:10584
- C:\Windows\System\DOxDorP.exe
  C:\Windows\System\DOxDorP.exe
  2⤵
  PID:10612
- C:\Windows\System\KYYaljS.exe
  C:\Windows\System\KYYaljS.exe
  2⤵
  PID:10628
- C:\Windows\System\cVxrEcq.exe
  C:\Windows\System\cVxrEcq.exe
  2⤵
  PID:10652
- C:\Windows\System\BlwjsTx.exe
  C:\Windows\System\BlwjsTx.exe
  2⤵
  PID:10680
- C:\Windows\System\KfmySRH.exe
  C:\Windows\System\KfmySRH.exe
  2⤵
  PID:10700
- C:\Windows\System\BDlxbtL.exe
  C:\Windows\System\BDlxbtL.exe
  2⤵
  PID:10720
- C:\Windows\System\HktgMoC.exe
  C:\Windows\System\HktgMoC.exe
  2⤵
  PID:10756
- C:\Windows\System\nKKIJAb.exe
  C:\Windows\System\nKKIJAb.exe
  2⤵
  PID:10784
- C:\Windows\System\UopBsTT.exe
  C:\Windows\System\UopBsTT.exe
  2⤵
  PID:10812
- C:\Windows\System\nkUXmyN.exe
  C:\Windows\System\nkUXmyN.exe
  2⤵
  PID:10856
- C:\Windows\System\JmSpWlj.exe
  C:\Windows\System\JmSpWlj.exe
  2⤵
  PID:10892
- C:\Windows\System\wOTcSSl.exe
  C:\Windows\System\wOTcSSl.exe
  2⤵
  PID:10920
- C:\Windows\System\maBDlWp.exe
  C:\Windows\System\maBDlWp.exe
  2⤵
  PID:10940
- C:\Windows\System\DtNSskk.exe
  C:\Windows\System\DtNSskk.exe
  2⤵
  PID:10964
- C:\Windows\System\GtjHKYq.exe
  C:\Windows\System\GtjHKYq.exe
  2⤵
  PID:11004
- C:\Windows\System\PRyHWFs.exe
  C:\Windows\System\PRyHWFs.exe
  2⤵
  PID:11032
- C:\Windows\System\MwPnpeN.exe
  C:\Windows\System\MwPnpeN.exe
  2⤵
  PID:11052
- C:\Windows\System\VJicmob.exe
  C:\Windows\System\VJicmob.exe
  2⤵
  PID:11076
- C:\Windows\System\qRkmnjo.exe
  C:\Windows\System\qRkmnjo.exe
  2⤵
  PID:11092
- C:\Windows\System\jceybIM.exe
  C:\Windows\System\jceybIM.exe
  2⤵
  PID:11108
- C:\Windows\System\vKOeCNi.exe
  C:\Windows\System\vKOeCNi.exe
  2⤵
  PID:11136
- C:\Windows\System\UKWIWlW.exe
  C:\Windows\System\UKWIWlW.exe
  2⤵
  PID:11168
- C:\Windows\System\nOVJHMw.exe
  C:\Windows\System\nOVJHMw.exe
  2⤵
  PID:11184
- C:\Windows\System\hQGWOtS.exe
  C:\Windows\System\hQGWOtS.exe
  2⤵
  PID:11212
- C:\Windows\System\vEMizCQ.exe
  C:\Windows\System\vEMizCQ.exe
  2⤵
  PID:11240
- C:\Windows\System\UEBYKnZ.exe
  C:\Windows\System\UEBYKnZ.exe
  2⤵
  PID:9480
- C:\Windows\System\MYkbRFB.exe
  C:\Windows\System\MYkbRFB.exe
  2⤵
  PID:10292
- C:\Windows\System\JgMDWBn.exe
  C:\Windows\System\JgMDWBn.exe
  2⤵
  PID:10424
- C:\Windows\System\WQmGhMW.exe
  C:\Windows\System\WQmGhMW.exe
  2⤵
  PID:10468
- C:\Windows\System\QBVtJKV.exe
  C:\Windows\System\QBVtJKV.exe
  2⤵
  PID:8044
- C:\Windows\System\ObQWMrQ.exe
  C:\Windows\System\ObQWMrQ.exe
  2⤵
  PID:10624
- C:\Windows\System\RIJTtWT.exe
  C:\Windows\System\RIJTtWT.exe
  2⤵
  PID:10668
- C:\Windows\System\EdLKTJL.exe
  C:\Windows\System\EdLKTJL.exe
  2⤵
  PID:10740
- C:\Windows\System\wsVmTXN.exe
  C:\Windows\System\wsVmTXN.exe
  2⤵
  PID:10804
- C:\Windows\System\sEThrRb.exe
  C:\Windows\System\sEThrRb.exe
  2⤵
  PID:10916
- C:\Windows\System\EMyJfIj.exe
  C:\Windows\System\EMyJfIj.exe
  2⤵
  PID:10952
- C:\Windows\System\gbXXAMu.exe
  C:\Windows\System\gbXXAMu.exe
  2⤵
  PID:11068
- C:\Windows\System\eFRQuVz.exe
  C:\Windows\System\eFRQuVz.exe
  2⤵
  PID:11084
- C:\Windows\System\MPrUxlH.exe
  C:\Windows\System\MPrUxlH.exe
  2⤵
  PID:11176
- C:\Windows\System\QzvSHLP.exe
  C:\Windows\System\QzvSHLP.exe
  2⤵
  PID:11220
- C:\Windows\System\IWdohOS.exe
  C:\Windows\System\IWdohOS.exe
  2⤵
  PID:10332
- C:\Windows\System\koMltGq.exe
  C:\Windows\System\koMltGq.exe
  2⤵
  PID:10608
- C:\Windows\System\SFjLjYN.exe
  C:\Windows\System\SFjLjYN.exe
  2⤵
  PID:10648
- C:\Windows\System\AiQvaiK.exe
  C:\Windows\System\AiQvaiK.exe
  2⤵
  PID:10876
- C:\Windows\System\oLpBsdq.exe
  C:\Windows\System\oLpBsdq.exe
  2⤵
  PID:10840
- C:\Windows\System\xGZOMDN.exe
  C:\Windows\System\xGZOMDN.exe
  2⤵
  PID:11104
- C:\Windows\System\PFdduCb.exe
  C:\Windows\System\PFdduCb.exe
  2⤵
  PID:10272
- C:\Windows\System\bEGPYCp.exe
  C:\Windows\System\bEGPYCp.exe
  2⤵
  PID:10492
- C:\Windows\System\ocUAZwC.exe
  C:\Windows\System\ocUAZwC.exe
  2⤵
  PID:10988
- C:\Windows\System\NcTGVOk.exe
  C:\Windows\System\NcTGVOk.exe
  2⤵
  PID:10556
- C:\Windows\System\zbJWmJl.exe
  C:\Windows\System\zbJWmJl.exe
  2⤵
  PID:10452
- C:\Windows\System\jACVXRV.exe
  C:\Windows\System\jACVXRV.exe
  2⤵
  PID:11280
- C:\Windows\System\jrQKzIG.exe
  C:\Windows\System\jrQKzIG.exe
  2⤵
  PID:11320
- C:\Windows\System\nqNWfBn.exe
  C:\Windows\System\nqNWfBn.exe
  2⤵
  PID:11336
- C:\Windows\System\gfFtPdk.exe
  C:\Windows\System\gfFtPdk.exe
  2⤵
  PID:11364
- C:\Windows\System\tTmkCsG.exe
  C:\Windows\System\tTmkCsG.exe
  2⤵
  PID:11392
- C:\Windows\System\sAChgVS.exe
  C:\Windows\System\sAChgVS.exe
  2⤵
  PID:11408
- C:\Windows\System\lEYKHpu.exe
  C:\Windows\System\lEYKHpu.exe
  2⤵
  PID:11460
- C:\Windows\System\DJpiflq.exe
  C:\Windows\System\DJpiflq.exe
  2⤵
  PID:11488
- C:\Windows\System\IloCkjF.exe
  C:\Windows\System\IloCkjF.exe
  2⤵
  PID:11516
- C:\Windows\System\xcCfsSE.exe
  C:\Windows\System\xcCfsSE.exe
  2⤵
  PID:11532
- C:\Windows\System\FXhdLAv.exe
  C:\Windows\System\FXhdLAv.exe
  2⤵
  PID:11548
- C:\Windows\System\vqnEnEv.exe
  C:\Windows\System\vqnEnEv.exe
  2⤵
  PID:11592
- C:\Windows\System\QquNWMb.exe
  C:\Windows\System\QquNWMb.exe
  2⤵
  PID:11620
- C:\Windows\System\LkInNXB.exe
  C:\Windows\System\LkInNXB.exe
  2⤵
  PID:11656
- C:\Windows\System\jojUsVh.exe
  C:\Windows\System\jojUsVh.exe
  2⤵
  PID:11676
- C:\Windows\System\FESKEUU.exe
  C:\Windows\System\FESKEUU.exe
  2⤵
  PID:11740
- C:\Windows\System\RGTPXei.exe
  C:\Windows\System\RGTPXei.exe
  2⤵
  PID:11756
- C:\Windows\System\BHiFWwl.exe
  C:\Windows\System\BHiFWwl.exe
  2⤵
  PID:11772
- C:\Windows\System\BcNpqCS.exe
  C:\Windows\System\BcNpqCS.exe
  2⤵
  PID:11812
- C:\Windows\System\JOIZfGF.exe
  C:\Windows\System\JOIZfGF.exe
  2⤵
  PID:11840
- C:\Windows\System\nvxEhum.exe
  C:\Windows\System\nvxEhum.exe
  2⤵
  PID:11864
- C:\Windows\System\XRDGgOY.exe
  C:\Windows\System\XRDGgOY.exe
  2⤵
  PID:11884
- C:\Windows\System\SKiTmoZ.exe
  C:\Windows\System\SKiTmoZ.exe
  2⤵
  PID:11908
- C:\Windows\System\qLYidUX.exe
  C:\Windows\System\qLYidUX.exe
  2⤵
  PID:11928
- C:\Windows\System\UGSqheM.exe
  C:\Windows\System\UGSqheM.exe
  2⤵
  PID:11948
- C:\Windows\System\mhrJZmS.exe
  C:\Windows\System\mhrJZmS.exe
  2⤵
  PID:11988
- C:\Windows\System\hYifRpR.exe
  C:\Windows\System\hYifRpR.exe
  2⤵
  PID:12024
- C:\Windows\System\PuoebPA.exe
  C:\Windows\System\PuoebPA.exe
  2⤵
  PID:12048
- C:\Windows\System\wVAPCkr.exe
  C:\Windows\System\wVAPCkr.exe
  2⤵
  PID:12076
- C:\Windows\System\vrLdIFe.exe
  C:\Windows\System\vrLdIFe.exe
  2⤵
  PID:12096
- C:\Windows\System\aycckvs.exe
  C:\Windows\System\aycckvs.exe
  2⤵
  PID:12120
- C:\Windows\System\SQKWIbx.exe
  C:\Windows\System\SQKWIbx.exe
  2⤵
  PID:12164
- C:\Windows\System\vBIvNna.exe
  C:\Windows\System\vBIvNna.exe
  2⤵
  PID:12204
- C:\Windows\System\HnASLNE.exe
  C:\Windows\System\HnASLNE.exe
  2⤵
  PID:12236
- C:\Windows\System\uYLvWTI.exe
  C:\Windows\System\uYLvWTI.exe
  2⤵
  PID:12264
- C:\Windows\System\zatGwIn.exe
  C:\Windows\System\zatGwIn.exe
  2⤵
  PID:12280
- C:\Windows\System\mvAkFwP.exe
  C:\Windows\System\mvAkFwP.exe
  2⤵
  PID:11292
- C:\Windows\System\ZPjbETh.exe
  C:\Windows\System\ZPjbETh.exe
  2⤵
  PID:11348
- C:\Windows\System\IgrsWTr.exe
  C:\Windows\System\IgrsWTr.exe
  2⤵
  PID:11420
- C:\Windows\System\PAekkXn.exe
  C:\Windows\System\PAekkXn.exe
  2⤵
  PID:11484
- C:\Windows\System\xbJsfUy.exe
  C:\Windows\System\xbJsfUy.exe
  2⤵
  PID:10488
- C:\Windows\System\isCLUeE.exe
  C:\Windows\System\isCLUeE.exe
  2⤵
  PID:11528
- C:\Windows\System\ivMlLmC.exe
  C:\Windows\System\ivMlLmC.exe
  2⤵
  PID:11588
- C:\Windows\System\dduoSkB.exe
  C:\Windows\System\dduoSkB.exe
  2⤵
  PID:11668
- C:\Windows\System\CxBQIKz.exe
  C:\Windows\System\CxBQIKz.exe
  2⤵
  PID:11728
- C:\Windows\System\HPBgYDV.exe
  C:\Windows\System\HPBgYDV.exe
  2⤵
  PID:11768
- C:\Windows\System\YBnbjnS.exe
  C:\Windows\System\YBnbjnS.exe
  2⤵
  PID:11808
- C:\Windows\System\xtIQLXV.exe
  C:\Windows\System\xtIQLXV.exe
  2⤵
  PID:11880
- C:\Windows\System\nZQEmVQ.exe
  C:\Windows\System\nZQEmVQ.exe
  2⤵
  PID:11956
- C:\Windows\System\hzJIGcL.exe
  C:\Windows\System\hzJIGcL.exe
  2⤵
  PID:11984
- C:\Windows\System\NnpvxvW.exe
  C:\Windows\System\NnpvxvW.exe
  2⤵
  PID:12060
- C:\Windows\System\GPDnFDE.exe
  C:\Windows\System\GPDnFDE.exe
  2⤵
  PID:12064
- C:\Windows\System\jKeugzj.exe
  C:\Windows\System\jKeugzj.exe
  2⤵
  PID:12188
- C:\Windows\System\wdEPfLS.exe
  C:\Windows\System\wdEPfLS.exe
  2⤵
  PID:12224
- C:\Windows\System\gCIPvTl.exe
  C:\Windows\System\gCIPvTl.exe
  2⤵
  PID:11328
- C:\Windows\System\gBLlkbs.exe
  C:\Windows\System\gBLlkbs.exe
  2⤵
  PID:11576
- C:\Windows\System\plvtCqe.exe
  C:\Windows\System\plvtCqe.exe
  2⤵
  PID:11716
- C:\Windows\System\sjbSIPo.exe
  C:\Windows\System\sjbSIPo.exe
  2⤵
  PID:11804
- C:\Windows\System\EIAwWkQ.exe
  C:\Windows\System\EIAwWkQ.exe
  2⤵
  PID:11936
- C:\Windows\System\COxrmzK.exe
  C:\Windows\System\COxrmzK.exe
  2⤵
  PID:11968
- C:\Windows\System\CgahQpH.exe
  C:\Windows\System\CgahQpH.exe
  2⤵
  PID:12156
- C:\Windows\System\FbYpQor.exe
  C:\Windows\System\FbYpQor.exe
  2⤵
  PID:11000
- C:\Windows\System\CbJbIUm.exe
  C:\Windows\System\CbJbIUm.exe
  2⤵
  PID:11800
- C:\Windows\System\mwXGHTH.exe
  C:\Windows\System\mwXGHTH.exe
  2⤵
  PID:11764
- C:\Windows\System\qFHIpBL.exe
  C:\Windows\System\qFHIpBL.exe
  2⤵
  PID:11856
- C:\Windows\System\bYsFjhI.exe
  C:\Windows\System\bYsFjhI.exe
  2⤵
  PID:12296
- C:\Windows\System\gEWjagd.exe
  C:\Windows\System\gEWjagd.exe
  2⤵
  PID:12320
- C:\Windows\System\hyyjFFV.exe
  C:\Windows\System\hyyjFFV.exe
  2⤵
  PID:12344
- C:\Windows\System\GXxDWms.exe
  C:\Windows\System\GXxDWms.exe
  2⤵
  PID:12360
- C:\Windows\System\LJyiQdy.exe
  C:\Windows\System\LJyiQdy.exe
  2⤵
  PID:12384
- C:\Windows\System\TUoXeSs.exe
  C:\Windows\System\TUoXeSs.exe
  2⤵
  PID:12456
- C:\Windows\System\voNwgbf.exe
  C:\Windows\System\voNwgbf.exe
  2⤵
  PID:12484
- C:\Windows\System\EaCUPWN.exe
  C:\Windows\System\EaCUPWN.exe
  2⤵
  PID:12512
- C:\Windows\System\uevncOI.exe
  C:\Windows\System\uevncOI.exe
  2⤵
  PID:12540
- C:\Windows\System\zytyzTy.exe
  C:\Windows\System\zytyzTy.exe
  2⤵
  PID:12568
- C:\Windows\System\YFoFpKk.exe
  C:\Windows\System\YFoFpKk.exe
  2⤵
  PID:12588
- C:\Windows\System\PrIIIUS.exe
  C:\Windows\System\PrIIIUS.exe
  2⤵
  PID:12612
- C:\Windows\System\ICScrfY.exe
  C:\Windows\System\ICScrfY.exe
  2⤵
  PID:12652
- C:\Windows\System\ePSJIjH.exe
  C:\Windows\System\ePSJIjH.exe
  2⤵
  PID:12668
- C:\Windows\System\xnkYccX.exe
  C:\Windows\System\xnkYccX.exe
  2⤵
  PID:12700
- C:\Windows\System\iwkdZkA.exe
  C:\Windows\System\iwkdZkA.exe
  2⤵
  PID:12724
- C:\Windows\System\QSKPfgN.exe
  C:\Windows\System\QSKPfgN.exe
  2⤵
  PID:12748
- C:\Windows\System\CCgrYsg.exe
  C:\Windows\System\CCgrYsg.exe
  2⤵
  PID:12796
- C:\Windows\System\rshBxXs.exe
  C:\Windows\System\rshBxXs.exe
  2⤵
  PID:12812
- C:\Windows\System\uLAPicv.exe
  C:\Windows\System\uLAPicv.exe
  2⤵
  PID:12828
- C:\Windows\System\rOahnHS.exe
  C:\Windows\System\rOahnHS.exe
  2⤵
  PID:12864
- C:\Windows\System\rLMGkpP.exe
  C:\Windows\System\rLMGkpP.exe
  2⤵
  PID:12888
- C:\Windows\System\qqCmAjU.exe
  C:\Windows\System\qqCmAjU.exe
  2⤵
  PID:12916
- C:\Windows\System\WbPFfZW.exe
  C:\Windows\System\WbPFfZW.exe
  2⤵
  PID:12948
- C:\Windows\System\aVZmZWK.exe
  C:\Windows\System\aVZmZWK.exe
  2⤵
  PID:12992
- C:\Windows\System\FQCGUQS.exe
  C:\Windows\System\FQCGUQS.exe
  2⤵
  PID:13020
- C:\Windows\System\gMjETlf.exe
  C:\Windows\System\gMjETlf.exe
  2⤵
  PID:13036
- C:\Windows\System\VwWKNcV.exe
  C:\Windows\System\VwWKNcV.exe
  2⤵
  PID:13076
- C:\Windows\System\iihwlCM.exe
  C:\Windows\System\iihwlCM.exe
  2⤵
  PID:13104
- C:\Windows\System\nPKFrnH.exe
  C:\Windows\System\nPKFrnH.exe
  2⤵
  PID:13120
- C:\Windows\System\oCNNmLY.exe
  C:\Windows\System\oCNNmLY.exe
  2⤵
  PID:13144
- C:\Windows\System\FmgNHtd.exe
  C:\Windows\System\FmgNHtd.exe
  2⤵
  PID:13172
- C:\Windows\System\hqunbTx.exe
  C:\Windows\System\hqunbTx.exe
  2⤵
  PID:13196
- C:\Windows\System\CHeDJgq.exe
  C:\Windows\System\CHeDJgq.exe
  2⤵
  PID:13216
- C:\Windows\System\NSANjzm.exe
  C:\Windows\System\NSANjzm.exe
  2⤵
  PID:13252
- C:\Windows\System\ecXTWsO.exe
  C:\Windows\System\ecXTWsO.exe
  2⤵
  PID:13280
- C:\Windows\System\FTICNnj.exe
  C:\Windows\System\FTICNnj.exe
  2⤵
  PID:13304
- C:\Windows\System\sUFHYEg.exe
  C:\Windows\System\sUFHYEg.exe
  2⤵
  PID:12308
- C:\Windows\System\oukwYpf.exe
  C:\Windows\System\oukwYpf.exe
  2⤵
  PID:12328
- C:\Windows\System\SmHKbes.exe
  C:\Windows\System\SmHKbes.exe
  2⤵
  PID:12420
- C:\Windows\System\yivPcBJ.exe
  C:\Windows\System\yivPcBJ.exe
  2⤵
  PID:12480
- C:\Windows\System\UJhEFAj.exe
  C:\Windows\System\UJhEFAj.exe
  2⤵
  PID:12580
- C:\Windows\System\RYdsjAW.exe
  C:\Windows\System\RYdsjAW.exe
  2⤵
  PID:12640
- C:\Windows\System\zNhtczZ.exe
  C:\Windows\System\zNhtczZ.exe
  2⤵
  PID:12680
- C:\Windows\System\XRWEtbk.exe
  C:\Windows\System\XRWEtbk.exe
  2⤵
  PID:12768
- C:\Windows\System\gCqMTzY.exe
  C:\Windows\System\gCqMTzY.exe
  2⤵
  PID:12840
- C:\Windows\System\YtGmkCy.exe
  C:\Windows\System\YtGmkCy.exe
  2⤵
  PID:12936
- C:\Windows\System\ywwIoIK.exe
  C:\Windows\System\ywwIoIK.exe
  2⤵
  PID:13008
- C:\Windows\System\ldvcdoP.exe
  C:\Windows\System\ldvcdoP.exe
  2⤵
  PID:13088
- C:\Windows\System\dlWErfR.exe
  C:\Windows\System\dlWErfR.exe
  2⤵
  PID:13168
- C:\Windows\System\JwNbkmd.exe
  C:\Windows\System\JwNbkmd.exe
  2⤵
  PID:13232
- C:\Windows\System\anGJBHa.exe
  C:\Windows\System\anGJBHa.exe
  2⤵
  PID:13272
- C:\Windows\System\VZdiUPB.exe
  C:\Windows\System\VZdiUPB.exe
  2⤵
  PID:4540
- C:\Windows\System\bZcIDxC.exe
  C:\Windows\System\bZcIDxC.exe
  2⤵
  PID:12352
- C:\Windows\System\ewjjOvU.exe
  C:\Windows\System\ewjjOvU.exe
  2⤵
  PID:12604
- C:\Windows\System\rARxaMP.exe
  C:\Windows\System\rARxaMP.exe
  2⤵
  PID:12736
- C:\Windows\System\jVpzlGc.exe
  C:\Windows\System\jVpzlGc.exe
  2⤵
  PID:12884
- C:\Windows\System\oWxfbKH.exe
  C:\Windows\System\oWxfbKH.exe
  2⤵
  PID:13032
- C:\Windows\System\CwLAKKw.exe
  C:\Windows\System\CwLAKKw.exe
  2⤵
  PID:13112
- C:\Windows\System\RLKeUlM.exe
  C:\Windows\System\RLKeUlM.exe
  2⤵
  PID:12408
- C:\Windows\System\rfhHJmx.exe
  C:\Windows\System\rfhHJmx.exe
  2⤵
  PID:12664
- C:\Windows\System\BhzOPif.exe
  C:\Windows\System\BhzOPif.exe
  2⤵
  PID:13212
- C:\Windows\System\dzehamY.exe
  C:\Windows\System\dzehamY.exe
  2⤵
  PID:13136
- C:\Windows\System\mGSdOES.exe
  C:\Windows\System\mGSdOES.exe
  2⤵
  PID:12824
- C:\Windows\System\jqwDNqQ.exe
  C:\Windows\System\jqwDNqQ.exe
  2⤵
  PID:13336
- C:\Windows\System\LfAuxKL.exe
  C:\Windows\System\LfAuxKL.exe
  2⤵
  PID:13364
- C:\Windows\System\kBCairW.exe
  C:\Windows\System\kBCairW.exe
  2⤵
  PID:13408
- C:\Windows\System\JefBbYM.exe
  C:\Windows\System\JefBbYM.exe
  2⤵
  PID:13448
- C:\Windows\System\XLRmeEN.exe
  C:\Windows\System\XLRmeEN.exe
  2⤵
  PID:13464
- C:\Windows\System\AvwMirH.exe
  C:\Windows\System\AvwMirH.exe
  2⤵
  PID:13480
- C:\Windows\System\WFumvmW.exe
  C:\Windows\System\WFumvmW.exe
  2⤵
  PID:13516
- C:\Windows\System\JjdbQrK.exe
  C:\Windows\System\JjdbQrK.exe
  2⤵
  PID:13536
- C:\Windows\System\liwfoPt.exe
  C:\Windows\System\liwfoPt.exe
  2⤵
  PID:13568
- C:\Windows\System\iXPFxwN.exe
  C:\Windows\System\iXPFxwN.exe
  2⤵
  PID:13604
- C:\Windows\System\qciwJbG.exe
  C:\Windows\System\qciwJbG.exe
  2⤵
  PID:13628
- C:\Windows\System\VaSXGdD.exe
  C:\Windows\System\VaSXGdD.exe
  2⤵
  PID:13652
- C:\Windows\System\fJiqTRi.exe
  C:\Windows\System\fJiqTRi.exe
  2⤵
  PID:13692
- C:\Windows\System\xlVKZdi.exe
  C:\Windows\System\xlVKZdi.exe
  2⤵
  PID:13716
- C:\Windows\System\MYlaWhR.exe
  C:\Windows\System\MYlaWhR.exe
  2⤵
  PID:13740
- C:\Windows\System\AnYMjBC.exe
  C:\Windows\System\AnYMjBC.exe
  2⤵
  PID:13764
- C:\Windows\System\NviqVVc.exe
  C:\Windows\System\NviqVVc.exe
  2⤵
  PID:13804
- C:\Windows\System\lUwmtmw.exe
  C:\Windows\System\lUwmtmw.exe
  2⤵
  PID:13836
- C:\Windows\System\jzEeaCX.exe
  C:\Windows\System\jzEeaCX.exe
  2⤵
  PID:13864
- C:\Windows\System\gmYmlOT.exe
  C:\Windows\System\gmYmlOT.exe
  2⤵
  PID:13884
- C:\Windows\System\YAAeBOk.exe
  C:\Windows\System\YAAeBOk.exe
  2⤵
  PID:13912
- C:\Windows\System\Amipecr.exe
  C:\Windows\System\Amipecr.exe
  2⤵
  PID:13936
- C:\Windows\System\BcAKJLg.exe
  C:\Windows\System\BcAKJLg.exe
  2⤵
  PID:13960
- C:\Windows\System\wceKgbQ.exe
  C:\Windows\System\wceKgbQ.exe
  2⤵
  PID:13976
- C:\Windows\System\UFPLDvz.exe
  C:\Windows\System\UFPLDvz.exe
  2⤵
  PID:13996
- C:\Windows\System\JpwSXyk.exe
  C:\Windows\System\JpwSXyk.exe
  2⤵
  PID:14052
- C:\Windows\System\XmIzeKN.exe
  C:\Windows\System\XmIzeKN.exe
  2⤵
  PID:14092
- C:\Windows\System\JGcZEkA.exe
  C:\Windows\System\JGcZEkA.exe
  2⤵
  PID:14132
- C:\Windows\System\HuKZWRN.exe
  C:\Windows\System\HuKZWRN.exe
  2⤵
  PID:14152
- C:\Windows\System\eugMbAs.exe
  C:\Windows\System\eugMbAs.exe
  2⤵
  PID:14172
- C:\Windows\System\afHcJoR.exe
  C:\Windows\System\afHcJoR.exe
  2⤵
  PID:14192
- C:\Windows\System\nUWELtk.exe
  C:\Windows\System\nUWELtk.exe
  2⤵
  PID:14244
- C:\Windows\System\CkAXnAg.exe
  C:\Windows\System\CkAXnAg.exe
  2⤵
  PID:14260
- C:\Windows\System\zWPVXXE.exe
  C:\Windows\System\zWPVXXE.exe
  2⤵
  PID:14284
- C:\Windows\System\wUZSCxB.exe
  C:\Windows\System\wUZSCxB.exe
  2⤵
  PID:14308
- C:\Windows\System\ddpxzpz.exe
  C:\Windows\System\ddpxzpz.exe
  2⤵
  PID:14328
- C:\Windows\System\ircGadJ.exe
  C:\Windows\System\ircGadJ.exe
  2⤵
  PID:13348
- C:\Windows\System\qBoGmOa.exe
  C:\Windows\System\qBoGmOa.exe
  2⤵
  PID:13384
- C:\Windows\System\ZiqgRVu.exe
  C:\Windows\System\ZiqgRVu.exe
  2⤵
  PID:13504
- C:\Windows\System\oBvqmey.exe
  C:\Windows\System\oBvqmey.exe
  2⤵
  PID:13528
- C:\Windows\System\akcDNYM.exe
  C:\Windows\System\akcDNYM.exe
  2⤵
  PID:13596
- C:\Windows\System\owELlwt.exe
  C:\Windows\System\owELlwt.exe
  2⤵
  PID:13648
- C:\Windows\System\eIXFrXn.exe
  C:\Windows\System\eIXFrXn.exe
  2⤵
  PID:13712
- C:\Windows\System\iXlWWcF.exe
  C:\Windows\System\iXlWWcF.exe
  2⤵
  PID:13792
- C:\Windows\System\stNCcvX.exe
  C:\Windows\System\stNCcvX.exe
  2⤵
  PID:13856
- C:\Windows\System\CYNZokh.exe
  C:\Windows\System\CYNZokh.exe
  2⤵
  PID:13880
- C:\Windows\System\jTnkXth.exe
  C:\Windows\System\jTnkXth.exe
  2⤵
  PID:14020
- C:\Windows\System\nzXeqGr.exe
  C:\Windows\System\nzXeqGr.exe
  2⤵
  PID:14088
- C:\Windows\System\EqCwuBQ.exe
  C:\Windows\System\EqCwuBQ.exe
  2⤵
  PID:14160
- C:\Windows\System\ejqeIaA.exe
  C:\Windows\System\ejqeIaA.exe
  2⤵
  PID:14256
- C:\Windows\System\BSxxPJy.exe
  C:\Windows\System\BSxxPJy.exe
  2⤵
  PID:14304
- C:\Windows\System\cXVgEQa.exe
  C:\Windows\System\cXVgEQa.exe
  2⤵
  PID:12740
- C:\Windows\System\HhgEYiR.exe
  C:\Windows\System\HhgEYiR.exe
  2⤵
  PID:13420
- C:\Windows\System\yIEpcMZ.exe
  C:\Windows\System\yIEpcMZ.exe
  2⤵
  PID:13476
- C:\Windows\System\iNXpJAn.exe
  C:\Windows\System\iNXpJAn.exe
  2⤵
  PID:13848
- C:\Windows\System\GsVjVtz.exe
  C:\Windows\System\GsVjVtz.exe
  2⤵
  PID:13908
- C:\Windows\System\VyLUwNv.exe
  C:\Windows\System\VyLUwNv.exe
  2⤵
  PID:14084
- C:\Windows\System\sxvwDsz.exe
  C:\Windows\System\sxvwDsz.exe
  2⤵
  PID:14272
- C:\Windows\System\XPriRou.exe
  C:\Windows\System\XPriRou.exe
  2⤵
  PID:14296
- C:\Windows\System\Kweyqha.exe
  C:\Windows\System\Kweyqha.exe
  2⤵
  PID:13828
- C:\Windows\System\PTgLqzO.exe
  C:\Windows\System\PTgLqzO.exe
  2⤵
  PID:13872
- C:\Windows\System\EmlyQhd.exe
  C:\Windows\System\EmlyQhd.exe
  2⤵
  PID:13564
- C:\Windows\System\SdUIVey.exe
  C:\Windows\System\SdUIVey.exe
  2⤵
  PID:14348
- C:\Windows\System\jErLOFV.exe
  C:\Windows\System\jErLOFV.exe
  2⤵
  PID:14368
- C:\Windows\System\ywsRIhy.exe
  C:\Windows\System\ywsRIhy.exe
  2⤵
  PID:14388
- C:\Windows\System\yzQffSt.exe
  C:\Windows\System\yzQffSt.exe
  2⤵
  PID:14416
- C:\Windows\System\TggQDNn.exe
  C:\Windows\System\TggQDNn.exe
  2⤵
  PID:14460
- C:\Windows\System\okenJvK.exe
  C:\Windows\System\okenJvK.exe
  2⤵
  PID:14484
- C:\Windows\System\EmNvghd.exe
  C:\Windows\System\EmNvghd.exe
  2⤵
  PID:14508
- C:\Windows\System\oAIdMtl.exe
  C:\Windows\System\oAIdMtl.exe
  2⤵
  PID:14524
- C:\Windows\System\AdmkiqL.exe
  C:\Windows\System\AdmkiqL.exe
  2⤵
  PID:14568
- C:\Windows\System\INmgJTS.exe
  C:\Windows\System\INmgJTS.exe
  2⤵
  PID:14604
- C:\Windows\System\UgBjesd.exe
  C:\Windows\System\UgBjesd.exe
  2⤵
  PID:14620
- C:\Windows\System\GcIOLIJ.exe
  C:\Windows\System\GcIOLIJ.exe
  2⤵
  PID:14672
- C:\Windows\System\GIDopvX.exe
  C:\Windows\System\GIDopvX.exe
  2⤵
  PID:14692
- C:\Windows\System\WMpuavu.exe
  C:\Windows\System\WMpuavu.exe
  2⤵
  PID:14708
- C:\Windows\System\jUYnqlR.exe
  C:\Windows\System\jUYnqlR.exe
  2⤵
  PID:14748
- C:\Windows\System\WtgSfhU.exe
  C:\Windows\System\WtgSfhU.exe
  2⤵
  PID:14764
- C:\Windows\System\WXTsZzp.exe
  C:\Windows\System\WXTsZzp.exe
  2⤵
  PID:14816
- C:\Windows\System\LCRJAsT.exe
  C:\Windows\System\LCRJAsT.exe
  2⤵
  PID:14832
- C:\Windows\System\aLSbsOY.exe
  C:\Windows\System\aLSbsOY.exe
  2⤵
  PID:14856
- C:\Windows\System\ETDfKqX.exe
  C:\Windows\System\ETDfKqX.exe
  2⤵
  PID:14880
- C:\Windows\System\UPxdzkO.exe
  C:\Windows\System\UPxdzkO.exe
  2⤵
  PID:14900
- C:\Windows\System\iHDNsOg.exe
  C:\Windows\System\iHDNsOg.exe
  2⤵
  PID:14940
- C:\Windows\System\zLgsvsy.exe
  C:\Windows\System\zLgsvsy.exe
  2⤵
  PID:14960
- C:\Windows\System\cDhARPR.exe
  C:\Windows\System\cDhARPR.exe
  2⤵
  PID:14984
- C:\Windows\System\ilLNLIC.exe
  C:\Windows\System\ilLNLIC.exe
  2⤵
  PID:15016
- C:\Windows\System\kenwlnH.exe
  C:\Windows\System\kenwlnH.exe
  2⤵
  PID:15036
- C:\Windows\System\tPtjWFP.exe
  C:\Windows\System\tPtjWFP.exe
  2⤵
  PID:15064
- C:\Windows\System\GKcUgLF.exe
  C:\Windows\System\GKcUgLF.exe
  2⤵
  PID:15112
- C:\Windows\System\DCkcJdv.exe
  C:\Windows\System\DCkcJdv.exe
  2⤵
  PID:15136
- C:\Windows\System\QfrfUwq.exe
  C:\Windows\System\QfrfUwq.exe
  2⤵
  PID:15168
- C:\Windows\System\ZPMwScD.exe
  C:\Windows\System\ZPMwScD.exe
  2⤵
  PID:15196
- C:\Windows\System\tcicVho.exe
  C:\Windows\System\tcicVho.exe
  2⤵
  PID:15220
- C:\Windows\System\bCODKuB.exe
  C:\Windows\System\bCODKuB.exe
  2⤵
  PID:15252
- C:\Windows\System\HHquzQi.exe
  C:\Windows\System\HHquzQi.exe
  2⤵
  PID:15268
- C:\Windows\System\nxvDsnJ.exe
  C:\Windows\System\nxvDsnJ.exe
  2⤵
  PID:15320
- C:\Windows\System\YauEIpD.exe
  C:\Windows\System\YauEIpD.exe
  2⤵
  PID:15336
- C:\Windows\System\BmDYcKY.exe
  C:\Windows\System\BmDYcKY.exe
  2⤵
  PID:15352
- C:\Windows\System\jgIuKje.exe
  C:\Windows\System\jgIuKje.exe
  2⤵
  PID:14340
- C:\Windows\System\nUdYpGr.exe
  C:\Windows\System\nUdYpGr.exe
  2⤵
  PID:14468
- C:\Windows\System\AOaBiYL.exe
  C:\Windows\System\AOaBiYL.exe
  2⤵
  PID:14548
- C:\Windows\System\MuRDvZW.exe
  C:\Windows\System\MuRDvZW.exe
  2⤵
  PID:14588
- C:\Windows\System\jGKYQJZ.exe
  C:\Windows\System\jGKYQJZ.exe
  2⤵
  PID:14612
- C:\Windows\System\YbdmDwF.exe
  C:\Windows\System\YbdmDwF.exe
  2⤵
  PID:14644
- C:\Windows\System\sXmhYES.exe
  C:\Windows\System\sXmhYES.exe
  2⤵
  PID:14740
- C:\Windows\System\IYPcCQx.exe
  C:\Windows\System\IYPcCQx.exe
  2⤵
  PID:14800
- C:\Windows\System\NgaqcaX.exe
  C:\Windows\System\NgaqcaX.exe
  2⤵
  PID:14844
- C:\Windows\System\KIGhThF.exe
  C:\Windows\System\KIGhThF.exe
  2⤵
  PID:14932
- C:\Windows\System\zOMxXGY.exe
  C:\Windows\System\zOMxXGY.exe
  2⤵
  PID:14952
- C:\Windows\System\ZMNeaFS.exe
  C:\Windows\System\ZMNeaFS.exe
  2⤵
  PID:15004
- C:\Windows\System\ZWLCWrJ.exe
  C:\Windows\System\ZWLCWrJ.exe
  2⤵
  PID:15024
- C:\Windows\System\Hhgorfg.exe
  C:\Windows\System\Hhgorfg.exe
  2⤵
  PID:15108
- C:\Windows\System\UyYeIDf.exe
  C:\Windows\System\UyYeIDf.exe
  2⤵
  PID:15152
- C:\Windows\System\XoEdtqT.exe
  C:\Windows\System\XoEdtqT.exe
  2⤵
  PID:15188
- C:\Windows\System\huNmkCx.exe
  C:\Windows\System\huNmkCx.exe
  2⤵
  PID:15244
- C:\Windows\System\GGZbXMV.exe
  C:\Windows\System\GGZbXMV.exe
  2⤵
  PID:15312
- C:\Windows\System\TtECeYD.exe
  C:\Windows\System\TtECeYD.exe
  2⤵
  PID:14360
- C:\Windows\System\uBLbulU.exe
  C:\Windows\System\uBLbulU.exe
  2⤵
  PID:14440
- C:\Windows\System\bcXqfpA.exe
  C:\Windows\System\bcXqfpA.exe
  2⤵
  PID:14480
- C:\Windows\System\ythwTJX.exe
  C:\Windows\System\ythwTJX.exe
  2⤵
  PID:14632
- C:\Windows\System\qQgrCYa.exe
  C:\Windows\System\qQgrCYa.exe
  2⤵
  PID:14876
- C:\Windows\System\KKqpTlF.exe
  C:\Windows\System\KKqpTlF.exe
  2⤵
  PID:15056
- C:\Windows\System\znLbtqP.exe
  C:\Windows\System\znLbtqP.exe
  2⤵
  PID:15000
- C:\Windows\System\vwiFRXQ.exe
  C:\Windows\System\vwiFRXQ.exe
  2⤵
  PID:15144
- C:\Windows\System\fJXVWRt.exe
  C:\Windows\System\fJXVWRt.exe
  2⤵
  PID:15260
- C:\Windows\System\zqLKuWq.exe
  C:\Windows\System\zqLKuWq.exe
  2⤵
  PID:15368
- C:\Windows\System\ufuPxuo.exe
  C:\Windows\System\ufuPxuo.exe
  2⤵
  PID:15388
- C:\Windows\System\QsgnYLS.exe
  C:\Windows\System\QsgnYLS.exe
  2⤵
  PID:15408
- C:\Windows\System\iomBfSE.exe
  C:\Windows\System\iomBfSE.exe
  2⤵
  PID:15428
- C:\Windows\System\okkzqIo.exe
  C:\Windows\System\okkzqIo.exe
  2⤵
  PID:15452
- C:\Windows\System\aEgMZzi.exe
  C:\Windows\System\aEgMZzi.exe
  2⤵
  PID:15476
- C:\Windows\System\HhAFxdy.exe
  C:\Windows\System\HhAFxdy.exe
  2⤵
  PID:15504
- C:\Windows\System\DLZBSoh.exe
  C:\Windows\System\DLZBSoh.exe
  2⤵
  PID:15520
- C:\Windows\System\Vkuhbeb.exe
  C:\Windows\System\Vkuhbeb.exe
  2⤵
  PID:15544
- C:\Windows\System\sQeTopf.exe
  C:\Windows\System\sQeTopf.exe
  2⤵
  PID:15560
- C:\Windows\System\eVqidqI.exe
  C:\Windows\System\eVqidqI.exe
  2⤵
  PID:15584
- C:\Windows\System\zWCYgPA.exe
  C:\Windows\System\zWCYgPA.exe
  2⤵
  PID:15604
- C:\Windows\System\TYWmwFE.exe
  C:\Windows\System\TYWmwFE.exe
  2⤵
  PID:15624
- C:\Windows\System\LgvcwJH.exe
  C:\Windows\System\LgvcwJH.exe
  2⤵
  PID:15644
- C:\Windows\System\ERoREhU.exe
  C:\Windows\System\ERoREhU.exe
  2⤵
  PID:15664
- C:\Windows\System\rALqqwE.exe
  C:\Windows\System\rALqqwE.exe
  2⤵
  PID:15680
- C:\Windows\System\QasSVtv.exe
  C:\Windows\System\QasSVtv.exe
  2⤵
  PID:15708
- C:\Windows\System\kmNwsOp.exe
  C:\Windows\System\kmNwsOp.exe
  2⤵
  PID:15732
- C:\Windows\System\quWRkQj.exe
  C:\Windows\System\quWRkQj.exe
  2⤵
  PID:15756
- C:\Windows\System\digydZa.exe
  C:\Windows\System\digydZa.exe
  2⤵
  PID:15776
- C:\Windows\System\OPZRaMp.exe
  C:\Windows\System\OPZRaMp.exe
  2⤵
  PID:15800
- C:\Windows\System\yTfbVCA.exe
  C:\Windows\System\yTfbVCA.exe
  2⤵
  PID:15816
- C:\Windows\System\XvKEjNE.exe
  C:\Windows\System\XvKEjNE.exe
  2⤵
  PID:15832
- C:\Windows\System\HEnqubm.exe
  C:\Windows\System\HEnqubm.exe
  2⤵
  PID:15848
- C:\Windows\System\bIZpWqS.exe
  C:\Windows\System\bIZpWqS.exe
  2⤵
  PID:15876
- C:\Windows\System\hJCIEWW.exe
  C:\Windows\System\hJCIEWW.exe
  2⤵
  PID:15892
- C:\Windows\System\isLTOzw.exe
  C:\Windows\System\isLTOzw.exe
  2⤵
  PID:15912
- C:\Windows\System\ZgScpez.exe
  C:\Windows\System\ZgScpez.exe
  2⤵
  PID:15952
- C:\Windows\System\UZhGmHK.exe
  C:\Windows\System\UZhGmHK.exe
  2⤵
  PID:15972
- C:\Windows\System\qClppyN.exe
  C:\Windows\System\qClppyN.exe
  2⤵
  PID:16000
- C:\Windows\System\IMFRyZF.exe
  C:\Windows\System\IMFRyZF.exe
  2⤵
  PID:16020
- C:\Windows\System\idonnvF.exe
  C:\Windows\System\idonnvF.exe
  2⤵
  PID:16040
- C:\Windows\System\sIkZLkG.exe
  C:\Windows\System\sIkZLkG.exe
  2⤵
  PID:16068
- C:\Windows\System\QuoRZaZ.exe
  C:\Windows\System\QuoRZaZ.exe
  2⤵
  PID:16096
- C:\Windows\System\DgRSLSI.exe
  C:\Windows\System\DgRSLSI.exe
  2⤵
  PID:16120
- C:\Windows\System\XPoVspB.exe
  C:\Windows\System\XPoVspB.exe
  2⤵
  PID:16136
- C:\Windows\System\qgUMlhz.exe
  C:\Windows\System\qgUMlhz.exe
  2⤵
  PID:16152
- C:\Windows\System\IZDcqlv.exe
  C:\Windows\System\IZDcqlv.exe
  2⤵
  PID:16184
- C:\Windows\System\CKpnzBF.exe
  C:\Windows\System\CKpnzBF.exe
  2⤵
  PID:16200
- C:\Windows\System\VJIXzna.exe
  C:\Windows\System\VJIXzna.exe
  2⤵
  PID:16244
- C:\Windows\System\DMfaqWJ.exe
  C:\Windows\System\DMfaqWJ.exe
  2⤵
  PID:16260
- C:\Windows\System\rbXwBGQ.exe
  C:\Windows\System\rbXwBGQ.exe
  2⤵
  PID:16276
- C:\Windows\System\BueRywQ.exe
  C:\Windows\System\BueRywQ.exe
  2⤵
  PID:16300
- C:\Windows\System\SbhALSQ.exe
  C:\Windows\System\SbhALSQ.exe
  2⤵
  PID:16332
- C:\Windows\System\bBxZBbm.exe
  C:\Windows\System\bBxZBbm.exe
  2⤵
  PID:16352
- C:\Windows\System\HoKKIUH.exe
  C:\Windows\System\HoKKIUH.exe
  2⤵
  PID:16376
- C:\Windows\System\SRmWtho.exe
  C:\Windows\System\SRmWtho.exe
  2⤵
  PID:15184
- C:\Windows\System\weThPQV.exe
  C:\Windows\System\weThPQV.exe
  2⤵
  PID:15216
- C:\Windows\System\eQSzbuh.exe
  C:\Windows\System\eQSzbuh.exe
  2⤵
  PID:15400
- C:\Windows\System\sjWDNef.exe
  C:\Windows\System\sjWDNef.exe
  2⤵
  PID:220
- C:\Windows\System\YTuraRN.exe
  C:\Windows\System\YTuraRN.exe
  2⤵
  PID:14868
- C:\Windows\System\jSsLLzD.exe
  C:\Windows\System\jSsLLzD.exe
  2⤵
  PID:15532
- C:\Windows\System\GugemeM.exe
  C:\Windows\System\GugemeM.exe
  2⤵
  PID:15592
- C:\Windows\System\lnNAVMN.exe
  C:\Windows\System\lnNAVMN.exe
  2⤵
  PID:15460
- C:\Windows\System\msgURom.exe
  C:\Windows\System\msgURom.exe
  2⤵
  PID:15132
- C:\Windows\System\EhlaRAC.exe
  C:\Windows\System\EhlaRAC.exe
  2⤵
  PID:15660
- C:\Windows\System\gwYUnXD.exe
  C:\Windows\System\gwYUnXD.exe
  2⤵
  PID:15536
- C:\Windows\System\cRjTYjl.exe
  C:\Windows\System\cRjTYjl.exe
  2⤵
  PID:15552
- C:\Windows\System\KnjIgei.exe
  C:\Windows\System\KnjIgei.exe
  2⤵
  PID:15792
- C:\Windows\System\WEHnoqe.exe
  C:\Windows\System\WEHnoqe.exe
  2⤵
  PID:15808
- C:\Windows\System\JeSmAEv.exe
  C:\Windows\System\JeSmAEv.exe
  2⤵
  PID:3068
- C:\Windows\System\LWHSprl.exe
  C:\Windows\System\LWHSprl.exe
  2⤵
  PID:15728
- C:\Windows\System\BqGsIlq.exe
  C:\Windows\System\BqGsIlq.exe
  2⤵
  PID:15752
- C:\Windows\System\YjBsdFw.exe
  C:\Windows\System\YjBsdFw.exe
  2⤵
  PID:16168
- C:\Windows\System\qNiwYGF.exe
  C:\Windows\System\qNiwYGF.exe
  2⤵
  PID:16196
- C:\Windows\System\VXLJbgf.exe
  C:\Windows\System\VXLJbgf.exe
  2⤵
  PID:15908
- C:\Windows\System\mbNsRPU.exe
  C:\Windows\System\mbNsRPU.exe
  2⤵
  PID:16240
- C:\Windows\System\cNbVffu.exe
  C:\Windows\System\cNbVffu.exe
  2⤵
  PID:16228
- C:\Windows\System\OpCPpvF.exe
  C:\Windows\System\OpCPpvF.exe
  2⤵
  PID:15932
- C:\Windows\System\mPPdVAU.exe
  C:\Windows\System\mPPdVAU.exe
  2⤵
  PID:14660
- C:\Windows\System\qRVRkoG.exe
  C:\Windows\System\qRVRkoG.exe
  2⤵
  PID:15512
- C:\Windows\System\xylppTf.exe
  C:\Windows\System\xylppTf.exe
  2⤵
  PID:15496
- C:\Windows\System\qBbSZbA.exe
  C:\Windows\System\qBbSZbA.exe
  2⤵
  PID:15556
- C:\Windows\System\EXArLSU.exe
  C:\Windows\System\EXArLSU.exe
  2⤵
  PID:14280
- C:\Windows\System\epDlVVw.exe
  C:\Windows\System\epDlVVw.exe
  2⤵
  PID:14896
- C:\Windows\System\JorsIIg.exe
  C:\Windows\System\JorsIIg.exe
  2⤵
  PID:16252
- C:\Windows\System\QZXtRqW.exe
  C:\Windows\System\QZXtRqW.exe
  2⤵
  PID:1460
- C:\Windows\System\STupirm.exe
  C:\Windows\System\STupirm.exe
  2⤵
  PID:15724
- C:\Windows\System\RBSRiSj.exe
  C:\Windows\System\RBSRiSj.exe
  2⤵
  PID:16400
- C:\Windows\System\HpSCqVa.exe
  C:\Windows\System\HpSCqVa.exe
  2⤵
  PID:16416
- C:\Windows\System\cTuvnYL.exe
  C:\Windows\System\cTuvnYL.exe
  2⤵
  PID:16432
- C:\Windows\System\ObvMvbf.exe
  C:\Windows\System\ObvMvbf.exe
  2⤵
  PID:16464
- C:\Windows\System\RwvKxzw.exe
  C:\Windows\System\RwvKxzw.exe
  2⤵
  PID:16504
- C:\Windows\System\HCDmgeG.exe
  C:\Windows\System\HCDmgeG.exe
  2⤵
  PID:16540
- C:\Windows\System\pYuzdHI.exe
  C:\Windows\System\pYuzdHI.exe
  2⤵
  PID:16568
- C:\Windows\System\ytTteKu.exe
  C:\Windows\System\ytTteKu.exe
  2⤵
  PID:16592
- C:\Windows\System\sbTOjUi.exe
  C:\Windows\System\sbTOjUi.exe
  2⤵
  PID:16608
- C:\Windows\System\VPiEwTs.exe
  C:\Windows\System\VPiEwTs.exe
  2⤵
  PID:16640
- C:\Windows\System\guYrCAU.exe
  C:\Windows\System\guYrCAU.exe
  2⤵
  PID:16660
- C:\Windows\System\TZHaXcF.exe
  C:\Windows\System\TZHaXcF.exe
  2⤵
  PID:16676
- C:\Windows\System\eHZPbyI.exe
  C:\Windows\System\eHZPbyI.exe
  2⤵
  PID:16700
- C:\Windows\System\USKVlMA.exe
  C:\Windows\System\USKVlMA.exe
  2⤵
  PID:16724
- C:\Windows\System\aeFaDYE.exe
  C:\Windows\System\aeFaDYE.exe
  2⤵
  PID:16756
- C:\Windows\System\orMXsIT.exe
  C:\Windows\System\orMXsIT.exe
  2⤵
  PID:16772
- C:\Windows\System\QGIHAQD.exe
  C:\Windows\System\QGIHAQD.exe
  2⤵
  PID:16788
- C:\Windows\System\fUuNziV.exe
  C:\Windows\System\fUuNziV.exe
  2⤵
  PID:16804
- C:\Windows\System\LlXXlfm.exe
  C:\Windows\System\LlXXlfm.exe
  2⤵
  PID:16836
- C:\Windows\System\KVMhvex.exe
  C:\Windows\System\KVMhvex.exe
  2⤵
  PID:16868
- C:\Windows\System\SCTNeOa.exe
  C:\Windows\System\SCTNeOa.exe
  2⤵
  PID:16884
- C:\Windows\System\PQkUMEr.exe
  C:\Windows\System\PQkUMEr.exe
  2⤵
  PID:16932
- C:\Windows\System\wLHNmGD.exe
  C:\Windows\System\wLHNmGD.exe
  2⤵
  PID:16960
- C:\Windows\System\liOwnga.exe
  C:\Windows\System\liOwnga.exe
  2⤵
  PID:16980
- C:\Windows\System\GsbgpvL.exe
  C:\Windows\System\GsbgpvL.exe
  2⤵
  PID:17000
- C:\Windows\System\tOvZJLj.exe
  C:\Windows\System\tOvZJLj.exe
  2⤵
  PID:17016
- C:\Windows\System\VoiFfzt.exe
  C:\Windows\System\VoiFfzt.exe
  2⤵
  PID:17044
- C:\Windows\System\IcSVGrf.exe
  C:\Windows\System\IcSVGrf.exe
  2⤵
  PID:17064

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ADamads.exe

Path C:\Windows\System\ADamads.exe
Size 1.5MB
SHA256 b6713b93a2b0e7ec7477efdec2df2831bcb1da5712c0ab448d20974a292e8145
MD5 0a555bd6d24e0e6f780b2d0a50e37ece
SHA1 ab12b72bd61697919b3fea3b6f1d40f5b44b2b51
SHA512 e56de1388609ba775eaf49619ad5d230b675165a394d68758bc6fccd98c9b706abb6cf99394ca23103085c755a5efbde01a27a78acd9be67b37daab48e878fdc
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nzs:GemTLkNdfE0pZaI
MD5 SHA1 SHA512 SSDEEP

Submit Download

CITGvMa.exe

Path C:\Windows\System\CITGvMa.exe
Size 1.6MB
SHA256 60a571987deb1d9a0a64a7cd71dadf8172cfe0cb2c89908f89a517a4535416b7
MD5 a6e5c50100b7bd82ced54c8d5c6be8ee
SHA1 47b9b5f54f62d6a0616a16282b806f80c5f6d874
SHA512 d6e322532b608ff81c31abcf8c96a80998cdd70ebc3599b22e41f07c19fbe99a4c9f64e557959f06924b872a2297f12a6cfa53ff074656240abab60a81c76447
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NzA:GemTLkNdfE0pZa0
MD5 SHA1 SHA512 SSDEEP

Submit Download

EhKZhXr.exe

Path C:\Windows\System\EhKZhXr.exe
Size 1.6MB
SHA256 e6bb1c65c5470852a0febb36b390723a773800e083e6ab3de11aa2cdfc839df4
MD5 2ba6da4e15998ffa6a783bdcff69de97
SHA1 57cfe1c6f8c8acb80108bf06ed685f4c3a9c6201
SHA512 246df8d0d82c895ea132b94aff9b527b8c4cadd813bd44313831615d0df313a0fb3b15b380ddd7d58bd105775bb213194d54aaabc5168db5b336fc8537f98784
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nz4:GemTLkNdfE0pZaM
MD5 SHA1 SHA512 SSDEEP

Submit Download

EtHTQku.exe

Path C:\Windows\System\EtHTQku.exe
Size 1.6MB
SHA256 c1488e6072de4c4d9132dd088bdf6b15b094685e298f0186d0af9f00137b4ea9
MD5 3736629a04c0b0af88bd08b8c7b5c5c4
SHA1 178b63f585e500b1be096ab01c32ac056a3c50a8
SHA512 76a68bfdfe1139d01b704672be1de5c14239aaed574f83813755f33a96cb3fbcd34c14cf37f6397c867997e8b66356a7ab5f348fc703ceed265db11bfc50ef67
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nzi:GemTLkNdfE0pZa2
MD5 SHA1 SHA512 SSDEEP

Submit Download

JQWGRYI.exe

Path C:\Windows\System\JQWGRYI.exe
Size 1.6MB
SHA256 36c3a7d09b61526732b3fe9e31d05f8bdf1761b4bafa2b7b4e68158b3600885b
MD5 a1741ad60d0428c7d5ea8358133372fb
SHA1 99ebfdbd22a2e91da35c8d648d0423d81b10c461
SHA512 dc7e605b2849a3f7f8f30cc7df7dbf1da1e5e918966f79da9ed0fa73ee0e3a99d5bc7a8242d2c3d5ea1b819f8e29ccb1c61dd3bed6ac0084ea749fad9c672272
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nzl:GemTLkNdfE0pZax
MD5 SHA1 SHA512 SSDEEP

Submit Download

MuONElC.exe

Path C:\Windows\System\MuONElC.exe
Size 1.5MB
SHA256 1fe50c1183f11c8c80aa97d405deab8d8a841d69f5d5a7e31cc9bae35b24d0db
MD5 c736552901f0173c695e50e637d43302
SHA1 14cb7806d569a6f3eb2f305db62ae289cac3ef23
SHA512 63ad346c9fcac72b65ad8a5360668eabd9674eae0869aba0b6e171323900059162c7cb08f723c28f525424589a3f8a8e81bedbc96c16be1bd1ba48583568b2fd
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nzb:GemTLkNdfE0pZaH
MD5 SHA1 SHA512 SSDEEP

Submit Download

NmvkPSD.exe

Path C:\Windows\System\NmvkPSD.exe
Size 1.6MB
SHA256 aaade44af9a3810da569d5a01243d353609dd78e27c3a20841989c7bb65d5e81
MD5 23792bb8d5a399beb8a9177f8e4b56d3
SHA1 e00d9d952f2be472a50d432fbe8f26f0530d7110
SHA512 d929bab6506c61730579883b1c1c08dcfe0870894144337981837f206fba328390572adb95e94598c6aaec79e235cd791ee7ef868b9666155fa87a340544fbcb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nz3:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

OTJUtaw.exe

Path C:\Windows\System\OTJUtaw.exe
Size 1.6MB
SHA256 4f23b89e2439db836a439c13f8a62b96e43de3a675d5e13f972da6f83aca659a
MD5 07ee2e47afe9c68acaa5dcc9fcd3d778
SHA1 c9dc1c1740a24b7375364045bcbfee8939896af4
SHA512 bf68a840129381bec17afa33b3aeb4c530415085c807b0745a3680b1f15297341cb7875fbb57c012ce735401b690e53d1388a10a37f0dd01efec974ebeb5f963
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NzL:GemTLkNdfE0pZa/
MD5 SHA1 SHA512 SSDEEP

Submit Download

RSeHFNt.exe

Path C:\Windows\System\RSeHFNt.exe
Size 1.6MB
SHA256 87341a504fe8c5efaa44117305f9569aabbefdb00e38609d2c1a4f4f89af735d
MD5 d1d360c66eb7869c8ab9698e5d49129c
SHA1 3967e233d60fff1ea3c86dd9aebe014130de3421
SHA512 b883e680c47348cc9c1b625cb3c77973f4a09342ec757bb1e8128c38fec13a4762301870fa41ea2459500cd7ee4547165f69cb467e8e3a873cd7cdd3ceacd8c5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nzc:GemTLkNdfE0pZao
MD5 SHA1 SHA512 SSDEEP

Submit Download

TMWrHpc.exe

Path C:\Windows\System\TMWrHpc.exe
Size 1.6MB
SHA256 bd1780f2689b2f6c473e26137821a03accaf6534f4d6848d372028520df250b3
MD5 10c1c1f01923d92770273eb8d91c2888
SHA1 7c83da01fe3731631799f7391a8777cf3f1a263d
SHA512 6bf4aed7f30837768b42164ee33a090a36620148d37acf8b5473a9d720148662b69b691bf0e10ec6662bbb3c0b9f68cc7515539e7228bd6c0574bbc6f6bf1793
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NzW:GemTLkNdfE0pZaq
MD5 SHA1 SHA512 SSDEEP

Submit Download

XaxgMoW.exe

Path C:\Windows\System\XaxgMoW.exe
Size 1.6MB
SHA256 e02a4053587673c7448f63a2b606b92e3f7514c9d53d057d6119555a67f84212
MD5 6373adf5be0a2f8bf1ce0846c781ee22
SHA1 41f995a2053943964fe9abc8f4e3672d137bf514
SHA512 18bb419e8d96bebe68f54bc4fbc4c574ff3d08666658c42740b94e83d7861fbc952235211a821fd6d69b927b8bb1f6626f54a654cb4cb0d4bf6b9ab8c03e7e9f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NzF:GemTLkNdfE0pZaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZHPjNKx.exe

Path C:\Windows\System\ZHPjNKx.exe
Size 1.6MB
SHA256 be7af8bb1ce171f8a352222e1a1f4d86e753c35cf690fb34c4750db0d8a6783d
MD5 666265a97da53cc820a884d89f988a99
SHA1 c3562d8ff34bd253bd4bd7d34625a31d14d7c712
SHA512 c0628a6aaf74fb91efa737021830b062f96621b8a22f3de6cae19fe314ed96cb8ec162872dbb427ab20746e87cd5a383026db8a7c0e3f7239481e9f346461816
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nzo:GemTLkNdfE0pZaM
MD5 SHA1 SHA512 SSDEEP

Submit Download

bScxDsK.exe

Path C:\Windows\System\bScxDsK.exe
Size 1.6MB
SHA256 f3b11b6241f1d606bc98441d5a336d2bd7eaef460cdc286b2b1c4fcad397ccce
MD5 72ba3074053719a634066c279982cb37
SHA1 004a4182923178079827f943dac595c3eea7b1c4
SHA512 2e62795d88d6364373906d82c92bafb1de2d222013c293c072a5231578d7f6a813aff3cdb413cede6593164866887758dce111552bac1f0d97c07ef0f008a493
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nzx:GemTLkNdfE0pZal
MD5 SHA1 SHA512 SSDEEP

Submit Download

baIUOFN.exe

Path C:\Windows\System\baIUOFN.exe
Size 1.6MB
SHA256 eed01d1e9e9c265d1e8532b62d9a3c7c9d03c97533f8f8b8ad6f70652d3526ca
MD5 389e44fc83f6bf8655037e9da6c88188
SHA1 2d527b24166f4cc099e0768122ed440c7e08e562
SHA512 e8794a7cfebff5e4192145c50b0e7255793f94ab239f4c51a794a516c73a55e3e38b8e6f683ceaa84baf60a01a2eae521e9fd91b4f9e0f64390767dfb98a6948
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nzl:GemTLkNdfE0pZa5
MD5 SHA1 SHA512 SSDEEP

Submit Download

hAVLXQl.exe

Path C:\Windows\System\hAVLXQl.exe
Size 1.6MB
SHA256 4426e0071a38ccf0c5a79c6bc7b3dcaa267f4515bd005cacecf0b126264b4690
MD5 fa719e8b5057c4adbf1efce746403ae1
SHA1 156f3e8164147e46b0c8edd9ce2a8c6e5537691d
SHA512 824aa51e40963b21c4fbf1fc330ff591d5e7ced977dadf0de8ae15852a67613c45b5af60123e48d948b184c3ac1c67834429b07a66467d6ee493b572c32e5be0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nz5:GemTLkNdfE0pZaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ikmgOqF.exe

Path C:\Windows\System\ikmgOqF.exe
Size 1.5MB
SHA256 cf0611d95b1191d47e1029f6c2bf693fc005ebbbb9afc95f462c560c8edb8500
MD5 26452abae33fd5aa81a319b4cdd6b235
SHA1 553160ebbf84ed2cea423869c69277da64c3c5c8
SHA512 8a10fd39a9f3a515cd50f0104f6e073b7e7bc691dc09ed3639f4fe61639684210c28512cb2bd1a05fa8b477bb6d862cff9fc84740e60010b43f93bfe1793e3eb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nzs:GemTLkNdfE0pZag
MD5 SHA1 SHA512 SSDEEP

Submit Download

iqFHxrL.exe

Path C:\Windows\System\iqFHxrL.exe
Size 1.5MB
SHA256 dfbe4abefc8f2dcf653d5a10417afee3ad51d2d20c62650faece514ab75b1062
MD5 56f5e8d944ff8ccadeb651e1a00b0d9b
SHA1 7523186410394c9adb6ad4ebb8956d7c60be1b44
SHA512 1a2b1755926c5dcbbc87e5baddc0b9d2d1937d807c9d84efb488062effcfbb4639a3c7f022b169011db0071a6302f7e000f3478dee5350a13b0c0247bf75d701
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nzb:GemTLkNdfE0pZaH
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjJQGQN.exe

Path C:\Windows\System\jjJQGQN.exe
Size 1.6MB
SHA256 87b0be7340b9d2140a718db1eb724875d084f716b853071512ce1dbf369fded6
MD5 d7aad6745f057aab85bf4ff89f4a1d59
SHA1 83065bfa4fe457affcf075ed981e4005b16522f3
SHA512 0466d235708c8f820078ce246f651e0bed729b638245d6f945d3239f4a04c855c5cd2233c92318e456baff2c6cbd7edfd7a025688c6276b25b24a68d9ad03e84
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NzbT:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

kSgYBZZ.exe

Path C:\Windows\System\kSgYBZZ.exe
Size 1.5MB
SHA256 62cf904e6f6291a760219c6d311ce0ab3cd16e4293206c83897ca29fa3ac6fff
MD5 186820932bb016d842fa8c1ee91eb3ec
SHA1 4732f059f78bb0963cc3f025c08d6beb778f50dd
SHA512 f11d6497ccc510aeb166137b7bf3993c513ede99fbecf3aa51d9f27d6cb6f80917c67c0bbf6e3c95c11c37263401e613e156bf3a101337786dd9ba24065bba5d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nze:GemTLkNdfE0pZaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

lhiaONn.exe

Path C:\Windows\System\lhiaONn.exe
Size 1.6MB
SHA256 73c156d0ab488ab14b244e0ac0f0dd3f560a646dff6b0e4e29c21395f2b2087f
MD5 e992307ae2db5852c67b37f5876ff284
SHA1 cc414d928ddf960aca2a414488048eb5d3721418
SHA512 3700dea80c7e8fdc0ce09cacc65b403e327c02f94c81893a7b50dc5b55f978b93904a37b4264e8c54d3b85d92796e2c224cc6fbce311c65bac34cce76f754b48
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nz2:GemTLkNdfE0pZa6
MD5 SHA1 SHA512 SSDEEP

Submit Download

mFcOLGt.exe

Path C:\Windows\System\mFcOLGt.exe
Size 1.6MB
SHA256 86a9406e71280b1337f132d74ac58457573dab209e983e87467bdd831e160cfc
MD5 4287d481a0e10f57b079966c08bac62c
SHA1 884b1dbdc335e6ac6bc75294c22ee32b39707738
SHA512 d5448484e7854da14d978dd6c360a83392398c2a3640304ed73692116da85246f7b361c7dcc24cf0dfd49d0565658e55c3f299d04848bf8bb76d1f50e23f05a3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NzO:GemTLkNdfE0pZay
MD5 SHA1 SHA512 SSDEEP

Submit Download

mlAiusR.exe

Path C:\Windows\System\mlAiusR.exe
Size 1.6MB
SHA256 fe333c2e659326c19c47e661c75649152b8056b2a92788ae181332a954da1500
MD5 dea02da81b41cd527fe7cfcd4936dcb3
SHA1 a5bba2d7e9f3c1bf1153fe8fd566a5ae49209aec
SHA512 b7468a8888cf5e022e8c8fb9e9aabd49c0060026aecbfc137e541fc4850f4a90a29f622d0fdca1a6fea937bcd0bdace2c923878c7cdde282dc18c3f689805fbf
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NzV:GemTLkNdfE0pZaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

nANMZwD.exe

Path C:\Windows\System\nANMZwD.exe
Size 1.6MB
SHA256 a762a635077fbfdcf0ee3a03878df1ed5536d0615e0488689425a1bcf4c71f3c
MD5 a8f8559092bddf06f12962ba33fd6daf
SHA1 f5b3824b1aa60e57a73772d4b37b0c3dddf7157d
SHA512 9f6469fdd241101305e3f0f0990a9d2346348f89b558cf41bb93b5ec6b2164e867535b12d2cd0eee766e42ba44748d2a162232bad131105132e395d69c73283b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NzO:GemTLkNdfE0pZaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

nIqsilV.exe

Path C:\Windows\System\nIqsilV.exe
Size 1.5MB
SHA256 04516260eddfa657e03b3c6f1a28e53df639e539079f57628b83b585140a59b6
MD5 4d51489b00363537e8f98eb134327e76
SHA1 374e3d0bd2a3318e06984d361a7592ec3bd411a5
SHA512 d55db5c12120622c58eb95b2bf7df59522c9186e4a3e2a0be58ffe5cbbd7d84ec28ec02f1b02e42a8e9b602d2473c2b6dc7327b7b0f8909b5bfdf232cbeeab8a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nzk:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

npSfHyH.exe

Path C:\Windows\System\npSfHyH.exe
Size 1.6MB
SHA256 ef1d4d2f6fdf401f257fbe5538985f53f7daba4b814b58855636cfd34ffeafeb
MD5 340ff38c6227ee723e60f0f531b9238c
SHA1 a011c85f1948051f16a15abb01b48ae573282208
SHA512 c0203c4a456630c7e5992f1342e252dd38a443add68cccb1bc9d7f6290f0cb3f68ab2da06f051581a9e36d89060d4721d800be46dc4ff8d70a790e39108d82ca
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nz2h:GemTLkNdfE0pZaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

opplHGy.exe

Path C:\Windows\System\opplHGy.exe
Size 1.5MB
SHA256 6f300666af7b8261b8ff2382627d50087b5ba75013d4b097d9b8862fc9dc5f49
MD5 a6dc776ce7d31f56b6225ce5e6e7774b
SHA1 17538e9aaf37d6be6ec92d8f2709b478152f8316
SHA512 d64c1a41301c9f83729988ff832e8c0a517c420bd5d4cf04555f8c4ab59a08ba37217724aeee04dc2b36a96cf649b8237d7f02cc2475e0202264d2a9967eee37
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NzJ:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Submit Download

pRlUdtQ.exe

Path C:\Windows\System\pRlUdtQ.exe
Size 1.6MB
SHA256 c00f24bf61763855e10404cddcf94e16b2eae90e0a9bedd9d12a9e147a60cf24
MD5 c214305cb2a8a6dcdb76de884b8c5ef2
SHA1 480bdc503f87e780e74dd1357435d1a72f674854
SHA512 91a470280f503507023da11946a0fbcd48f786fe9e41623f60fd4f1963bc78bfa0ff1e2a5a5a83502a00a059d7c4f2fb114052ef487b634b54e9b83b5b31832b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NzWD:GemTLkNdfE0pZau
MD5 SHA1 SHA512 SSDEEP

Submit Download

qkfnbLt.exe

Path C:\Windows\System\qkfnbLt.exe
Size 1.6MB
SHA256 67d57524d4bfba2a5d8c98e48c5764a2658540d53d46b983da150ec347988079
MD5 c21fbbf371b02c58c70a7717291428b3
SHA1 bff6b7a3a52bad595449772df9d5b47f3eecf173
SHA512 195667dd808207bcf2534c0a21923c9308e084e9e34f31b2e23ed4619a7cbe0c573af5437ffcff5f3a70542cea995fba6a0d2b989b6c9030f8870dae07f7ce69
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NzD:GemTLkNdfE0pZaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

sDNwUmR.exe

Path C:\Windows\System\sDNwUmR.exe
Size 1.6MB
SHA256 fabd7696bc6d0b8575741c1fee27f7207cf0d358ea93fd5cf22b23d5cfd9d86d
MD5 59d2b0cc5de9a15f59c7e2b7da63c915
SHA1 e67f4424d202b8d57a860232b1f3dbbf2d6e7f7d
SHA512 59825ada7d590f4408bac389fc05c0e547f30132efe428e0a96c6727a0652cbc2dd6461a54586df6aeef97fa261f66c9ad9e63d3e979fefd91e172e98133720c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NzL:GemTLkNdfE0pZaH
MD5 SHA1 SHA512 SSDEEP

Submit Download

soieAYk.exe

Path C:\Windows\System\soieAYk.exe
Size 1.5MB
SHA256 ffd43ce3afe376fec50c2d0b6acb4449ef0263ecec703d1b228514a398d31e82
MD5 9f7aba04f30750c286dc477dfe5eb1a7
SHA1 1de2e5163761a4559e688780dcd2a6f07fce9d2b
SHA512 9857773e03df6307c03181b4c35cb7dc7451e56e90733795952b7a746949c92ef7744221239387986f98417421c4cda0c6402c5f937b91ea790b78456e2931b6
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nzl:GemTLkNdfE0pZa5
MD5 SHA1 SHA512 SSDEEP

Submit Download

wixJsri.exe

Path C:\Windows\System\wixJsri.exe
Size 1.6MB
SHA256 326c8d5be05dd7a75f3e067ee4b86a716a8ccceaccfe20698f9689d88ec4d34b
MD5 7fc792400f3c5a148704c546d7d3cb45
SHA1 1b01a54bbada633b426682526bfe4890c864ba98
SHA512 32efe8b6d5e452948068082e1a6e2152bb23248abf0f695d3426e894add77be5c2dd180ef24f39a4dea41c4e96a8f30442ff5e39f8b6ca0727f0ccf073ce3909
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NzH:GemTLkNdfE0pZaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

xkJOxRQ.exe

Path C:\Windows\System\xkJOxRQ.exe
Size 1.5MB
SHA256 f8ccd467decd20fe14da83121e3ce291632727695757b6e52a5ad7b34731b039
MD5 68d632103be05bd2026c908f44fc853b
SHA1 3d761b3ce0ed687333f1de7e33754c02a052685e
SHA512 9879b61a3470f6223542a612aecaba4679cf2507a7a4a9c0f6eed45fffaa54adc7f147794abf988f33bb553b54e65a31d9908f91c229677884a8178d7eca83cb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nzh:GemTLkNdfE0pZaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlPOwpj.exe

Path C:\Windows\System\zlPOwpj.exe
Size 1.6MB
SHA256 eef4db7b468e232a9f2f33d4b3842dee83e9567fc12ce265e2c537b1c93cfd02
MD5 c31ce268a588c10e424b76c6098f862b
SHA1 dd493c94a179b58bd7250c0da8544ee6760a2b16
SHA512 9284883f84c3354752d296a1c9f757665366cb0e8eea41888b0be8e9f871ff68426fb951bd9dd5295cf9d07335480077f9e2a051a06b5be3c368edc4fff46146
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nzy:GemTLkNdfE0pZaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/804-0-0x0000023127FE0000-0x0000023127FF0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads