xmrig | 7abc84a7c843c1cd3ceb343b22454beb59c86fa724c54aae71f6e040285ca399

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 13:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
Size 1.7MB
Sample240522-qtstqsdc48
SHA256 7abc84a7c843c1cd3ceb343b22454beb59c86fa724c54aae71f6e040285ca399
MD5 342ab96a6c9610712aa9e1597eedf020
SHA1 e1f8cbaba4888c9b7811156857b77407bc2d6933
SHA512 df07e990736a77c13dc69a0150a4aaa8426c43b22706eede7b7192e26a058bdf2132863179f2297176d74441123103ccb984cb1227310079a6ed3c76f57c4c14
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02i:GemTLkNdfE0pZaU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023297-4.dat	xmrig
behavioral2/files/0x0007000000023456-8.dat	xmrig
behavioral2/files/0x0007000000023455-10.dat	xmrig
behavioral2/files/0x0007000000023457-18.dat	xmrig
behavioral2/files/0x0007000000023458-21.dat	xmrig
behavioral2/files/0x0007000000023459-29.dat	xmrig
behavioral2/files/0x000700000002345a-34.dat	xmrig
behavioral2/files/0x0008000000023452-39.dat	xmrig
behavioral2/files/0x000700000002345b-44.dat	xmrig
behavioral2/files/0x000700000002345c-48.dat	xmrig
behavioral2/files/0x000700000002345e-61.dat	xmrig
behavioral2/files/0x000700000002345f-63.dat	xmrig
behavioral2/files/0x0007000000023460-70.dat	xmrig
behavioral2/files/0x000700000002345d-57.dat	xmrig
behavioral2/files/0x0007000000023461-75.dat	xmrig
behavioral2/files/0x0007000000023463-85.dat	xmrig
behavioral2/files/0x0007000000023466-94.dat	xmrig
behavioral2/files/0x0007000000023467-103.dat	xmrig
behavioral2/files/0x000700000002346a-112.dat	xmrig
behavioral2/files/0x000700000002346e-140.dat	xmrig
behavioral2/files/0x0007000000023474-162.dat	xmrig
behavioral2/files/0x0007000000023472-160.dat	xmrig
behavioral2/files/0x0007000000023473-157.dat	xmrig
behavioral2/files/0x0007000000023471-155.dat	xmrig
behavioral2/files/0x0007000000023470-150.dat	xmrig
behavioral2/files/0x000700000002346f-145.dat	xmrig
behavioral2/files/0x000700000002346d-135.dat	xmrig
behavioral2/files/0x000700000002346c-128.dat	xmrig
behavioral2/files/0x000700000002346b-122.dat	xmrig
behavioral2/files/0x0007000000023469-113.dat	xmrig
behavioral2/files/0x0007000000023468-108.dat	xmrig
behavioral2/files/0x0007000000023465-90.dat	xmrig
behavioral2/files/0x0007000000023464-86.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1924	inkfvTi.exe
4708	DZkpjiI.exe
2524	kahVspT.exe
736	EXDWGyh.exe
864	ZZHfXPa.exe
4752	mJsdahd.exe
2236	yukJDNY.exe
1988	QocoaXa.exe
2596	bsNnLrb.exe
1196	omrWLBB.exe
4060	puTHzgk.exe
3696	zQsBTNo.exe
3724	xteIJBQ.exe
2300	kAyrBnp.exe
3896	JPOOdrh.exe
1220	CTujwwO.exe
3676	mzCeJnN.exe
3464	btuWmKy.exe
4640	mGJMKov.exe
4616	pQmzVFo.exe
4636	RvUmsMv.exe
876	UkYzDcT.exe
5040	xpcdpBW.exe
3416	JiDOVtM.exe
3160	XqHFEzj.exe
3504	XZGZFEX.exe
4544	ZnFVhNT.exe
1180	xqViRcB.exe
4876	cfNGQWj.exe
1896	JGCgEFp.exe
1136	CfWXdHJ.exe
2708	CZeyLZe.exe
4860	FOrvzNB.exe
2720	mNhmbfZ.exe
3396	nuhjZPq.exe
2112	YbyrQUn.exe
1628	jGXKjJp.exe
2348	EAdCCQh.exe
2880	kezFRdN.exe
4372	sIxSYVs.exe
2384	HnekqQb.exe
4256	ulJEiYl.exe
4668	NhhbZEb.exe
764	SvmlyOg.exe
4300	fWOwSxs.exe
1472	iAfaogC.exe
3864	qkAEvtB.exe
2480	YDZqQpk.exe
3612	UOsylGW.exe
3664	RWmaKAV.exe
1368	xToEUMI.exe
1448	kyBqkVh.exe
2088	LvOaBIK.exe
2428	gbfYLAN.exe
1396	icrHLYi.exe
4908	hOCDvAf.exe
4460	YqcDZBA.exe
2464	zWdvbtb.exe
920	zjvMneN.exe
2340	VmEmOLG.exe
4444	iRzAVLV.exe
5100	BZqxvYw.exe
4112	lBHhCxv.exe
2920	zoHMFEl.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ljvpSYu.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\SenLIvB.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\Zdrulmf.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\uVEhsoC.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\SquPTMt.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\iynQBSZ.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\WXxlXFZ.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\blgzxqK.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\svDiQVp.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\JGtwOiJ.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\OEpJMjp.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\RWmaKAV.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\eorGllb.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\pbzlwSN.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\xoFEAis.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\huGxlbe.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\WdJAXvi.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\pwUqNzb.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\PLQNyMc.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\bSyNviD.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\IdWlXOf.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\uhBOVaJ.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\KzKTccD.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\uZhOpeF.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\GQUxzsX.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\iTBAXcd.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\DErXMwe.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\oBTwkIU.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\BllcOjW.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\xCNrulq.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\bfKOZwD.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\BCRukSc.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\sEoDiYo.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\AoyuVRS.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\CoRlhzJ.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\xaGKczo.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\CxOQWrB.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\LBJTrSL.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\hqOESEL.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\nTAlcDc.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\ogHMoeT.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\iJZgGZo.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\MmGWDjz.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\SkqJSOL.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\SmcEEXB.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\xIdSIUy.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\CTujwwO.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\mGJMKov.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\cLKHaPN.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\tiDRfdu.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\rVekNJS.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\uYmwOVp.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\tsbtlpF.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\FylAvbc.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\dIekvIk.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\gacXjRR.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\OnNAxCg.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\mzCeJnN.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\yqFUtQO.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\IUxlKnl.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\rRhrcMB.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\tkbGCcG.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\PaWsgGz.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
File created	C:\Windows\System\LNMspbY.exe	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17256	dwm.exe
Token: SeChangeNotifyPrivilege	17256	dwm.exe
Token: 33	17256	dwm.exe
Token: SeIncBasePriorityPrivilege	17256	dwm.exe
Token: SeShutdownPrivilege	17256	dwm.exe
Token: SeCreatePagefilePrivilege	17256	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1924	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	86
PID 1768 wrote to memory of 1924	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	86
PID 1768 wrote to memory of 4708	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	87
PID 1768 wrote to memory of 4708	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	87
PID 1768 wrote to memory of 2524	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	88
PID 1768 wrote to memory of 2524	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	88
PID 1768 wrote to memory of 736	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	89
PID 1768 wrote to memory of 736	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	89
PID 1768 wrote to memory of 864	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	90
PID 1768 wrote to memory of 864	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	90
PID 1768 wrote to memory of 4752	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	91
PID 1768 wrote to memory of 4752	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	91
PID 1768 wrote to memory of 2236	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	92
PID 1768 wrote to memory of 2236	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	92
PID 1768 wrote to memory of 1988	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	93
PID 1768 wrote to memory of 1988	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	93
PID 1768 wrote to memory of 2596	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	94
PID 1768 wrote to memory of 2596	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	94
PID 1768 wrote to memory of 1196	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	95
PID 1768 wrote to memory of 1196	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	95
PID 1768 wrote to memory of 4060	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	96
PID 1768 wrote to memory of 4060	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	96
PID 1768 wrote to memory of 3696	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	97
PID 1768 wrote to memory of 3696	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	97
PID 1768 wrote to memory of 3724	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	98
PID 1768 wrote to memory of 3724	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	98
PID 1768 wrote to memory of 2300	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	99
PID 1768 wrote to memory of 2300	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	99
PID 1768 wrote to memory of 3896	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	100
PID 1768 wrote to memory of 3896	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	100
PID 1768 wrote to memory of 1220	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	102
PID 1768 wrote to memory of 1220	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	102
PID 1768 wrote to memory of 3676	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	103
PID 1768 wrote to memory of 3676	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	103
PID 1768 wrote to memory of 3464	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	104
PID 1768 wrote to memory of 3464	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	104
PID 1768 wrote to memory of 4640	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	105
PID 1768 wrote to memory of 4640	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	105
PID 1768 wrote to memory of 4616	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	106
PID 1768 wrote to memory of 4616	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	106
PID 1768 wrote to memory of 4636	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	107
PID 1768 wrote to memory of 4636	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	107
PID 1768 wrote to memory of 876	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	108
PID 1768 wrote to memory of 876	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	108
PID 1768 wrote to memory of 5040	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	109
PID 1768 wrote to memory of 5040	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	109
PID 1768 wrote to memory of 3416	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	110
PID 1768 wrote to memory of 3416	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	110
PID 1768 wrote to memory of 3160	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	111
PID 1768 wrote to memory of 3160	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	111
PID 1768 wrote to memory of 3504	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	112
PID 1768 wrote to memory of 3504	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	112
PID 1768 wrote to memory of 4544	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	113
PID 1768 wrote to memory of 4544	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	113
PID 1768 wrote to memory of 1180	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	114
PID 1768 wrote to memory of 1180	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	114
PID 1768 wrote to memory of 4876	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	115
PID 1768 wrote to memory of 4876	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	115
PID 1768 wrote to memory of 1896	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	116
PID 1768 wrote to memory of 1896	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	116
PID 1768 wrote to memory of 1136	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	117
PID 1768 wrote to memory of 1136	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	117
PID 1768 wrote to memory of 2708	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	118
PID 1768 wrote to memory of 2708	1768	342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe	118

C:\Users\Admin\AppData\Local\Temp\342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\342ab96a6c9610712aa9e1597eedf020_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\System\inkfvTi.exe
  C:\Windows\System\inkfvTi.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\DZkpjiI.exe
  C:\Windows\System\DZkpjiI.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\kahVspT.exe
  C:\Windows\System\kahVspT.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\EXDWGyh.exe
  C:\Windows\System\EXDWGyh.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\ZZHfXPa.exe
  C:\Windows\System\ZZHfXPa.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\mJsdahd.exe
  C:\Windows\System\mJsdahd.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\yukJDNY.exe
  C:\Windows\System\yukJDNY.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\QocoaXa.exe
  C:\Windows\System\QocoaXa.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\bsNnLrb.exe
  C:\Windows\System\bsNnLrb.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\omrWLBB.exe
  C:\Windows\System\omrWLBB.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\puTHzgk.exe
  C:\Windows\System\puTHzgk.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\zQsBTNo.exe
  C:\Windows\System\zQsBTNo.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\xteIJBQ.exe
  C:\Windows\System\xteIJBQ.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\kAyrBnp.exe
  C:\Windows\System\kAyrBnp.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\JPOOdrh.exe
  C:\Windows\System\JPOOdrh.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\CTujwwO.exe
  C:\Windows\System\CTujwwO.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\mzCeJnN.exe
  C:\Windows\System\mzCeJnN.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\btuWmKy.exe
  C:\Windows\System\btuWmKy.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\mGJMKov.exe
  C:\Windows\System\mGJMKov.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\pQmzVFo.exe
  C:\Windows\System\pQmzVFo.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\RvUmsMv.exe
  C:\Windows\System\RvUmsMv.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\UkYzDcT.exe
  C:\Windows\System\UkYzDcT.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\xpcdpBW.exe
  C:\Windows\System\xpcdpBW.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\JiDOVtM.exe
  C:\Windows\System\JiDOVtM.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\XqHFEzj.exe
  C:\Windows\System\XqHFEzj.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\XZGZFEX.exe
  C:\Windows\System\XZGZFEX.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\ZnFVhNT.exe
  C:\Windows\System\ZnFVhNT.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\xqViRcB.exe
  C:\Windows\System\xqViRcB.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\cfNGQWj.exe
  C:\Windows\System\cfNGQWj.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\JGCgEFp.exe
  C:\Windows\System\JGCgEFp.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\CfWXdHJ.exe
  C:\Windows\System\CfWXdHJ.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\CZeyLZe.exe
  C:\Windows\System\CZeyLZe.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\FOrvzNB.exe
  C:\Windows\System\FOrvzNB.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\mNhmbfZ.exe
  C:\Windows\System\mNhmbfZ.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\nuhjZPq.exe
  C:\Windows\System\nuhjZPq.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\YbyrQUn.exe
  C:\Windows\System\YbyrQUn.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\jGXKjJp.exe
  C:\Windows\System\jGXKjJp.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\EAdCCQh.exe
  C:\Windows\System\EAdCCQh.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\kezFRdN.exe
  C:\Windows\System\kezFRdN.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\sIxSYVs.exe
  C:\Windows\System\sIxSYVs.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\HnekqQb.exe
  C:\Windows\System\HnekqQb.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\ulJEiYl.exe
  C:\Windows\System\ulJEiYl.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\NhhbZEb.exe
  C:\Windows\System\NhhbZEb.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\SvmlyOg.exe
  C:\Windows\System\SvmlyOg.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\fWOwSxs.exe
  C:\Windows\System\fWOwSxs.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\iAfaogC.exe
  C:\Windows\System\iAfaogC.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\qkAEvtB.exe
  C:\Windows\System\qkAEvtB.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\YDZqQpk.exe
  C:\Windows\System\YDZqQpk.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\UOsylGW.exe
  C:\Windows\System\UOsylGW.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\RWmaKAV.exe
  C:\Windows\System\RWmaKAV.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\xToEUMI.exe
  C:\Windows\System\xToEUMI.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\kyBqkVh.exe
  C:\Windows\System\kyBqkVh.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\LvOaBIK.exe
  C:\Windows\System\LvOaBIK.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\gbfYLAN.exe
  C:\Windows\System\gbfYLAN.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\icrHLYi.exe
  C:\Windows\System\icrHLYi.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\hOCDvAf.exe
  C:\Windows\System\hOCDvAf.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\YqcDZBA.exe
  C:\Windows\System\YqcDZBA.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\zWdvbtb.exe
  C:\Windows\System\zWdvbtb.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\zjvMneN.exe
  C:\Windows\System\zjvMneN.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\VmEmOLG.exe
  C:\Windows\System\VmEmOLG.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\iRzAVLV.exe
  C:\Windows\System\iRzAVLV.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\BZqxvYw.exe
  C:\Windows\System\BZqxvYw.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\lBHhCxv.exe
  C:\Windows\System\lBHhCxv.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\zoHMFEl.exe
  C:\Windows\System\zoHMFEl.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\WXxlXFZ.exe
  C:\Windows\System\WXxlXFZ.exe
  2⤵
  PID:3860
- C:\Windows\System\BwoVVgN.exe
  C:\Windows\System\BwoVVgN.exe
  2⤵
  PID:2284
- C:\Windows\System\eEpaMws.exe
  C:\Windows\System\eEpaMws.exe
  2⤵
  PID:3300
- C:\Windows\System\BRVFCUn.exe
  C:\Windows\System\BRVFCUn.exe
  2⤵
  PID:4776
- C:\Windows\System\hlPmQVm.exe
  C:\Windows\System\hlPmQVm.exe
  2⤵
  PID:2472
- C:\Windows\System\vJEUjZC.exe
  C:\Windows\System\vJEUjZC.exe
  2⤵
  PID:1972
- C:\Windows\System\EOEllKX.exe
  C:\Windows\System\EOEllKX.exe
  2⤵
  PID:1680
- C:\Windows\System\qYENugb.exe
  C:\Windows\System\qYENugb.exe
  2⤵
  PID:2056
- C:\Windows\System\uYmwOVp.exe
  C:\Windows\System\uYmwOVp.exe
  2⤵
  PID:1608
- C:\Windows\System\domKdTV.exe
  C:\Windows\System\domKdTV.exe
  2⤵
  PID:1812
- C:\Windows\System\ASSNKKk.exe
  C:\Windows\System\ASSNKKk.exe
  2⤵
  PID:5148
- C:\Windows\System\NAxMJhA.exe
  C:\Windows\System\NAxMJhA.exe
  2⤵
  PID:5172
- C:\Windows\System\bGzQJsY.exe
  C:\Windows\System\bGzQJsY.exe
  2⤵
  PID:5200
- C:\Windows\System\GjwjArQ.exe
  C:\Windows\System\GjwjArQ.exe
  2⤵
  PID:5228
- C:\Windows\System\uFTVnbg.exe
  C:\Windows\System\uFTVnbg.exe
  2⤵
  PID:5256
- C:\Windows\System\YbaghVq.exe
  C:\Windows\System\YbaghVq.exe
  2⤵
  PID:5288
- C:\Windows\System\OueSzti.exe
  C:\Windows\System\OueSzti.exe
  2⤵
  PID:5312
- C:\Windows\System\PPwJoMg.exe
  C:\Windows\System\PPwJoMg.exe
  2⤵
  PID:5340
- C:\Windows\System\nVxIUBn.exe
  C:\Windows\System\nVxIUBn.exe
  2⤵
  PID:5368
- C:\Windows\System\jDVbtQy.exe
  C:\Windows\System\jDVbtQy.exe
  2⤵
  PID:5396
- C:\Windows\System\yqFUtQO.exe
  C:\Windows\System\yqFUtQO.exe
  2⤵
  PID:5424
- C:\Windows\System\YrOMuIi.exe
  C:\Windows\System\YrOMuIi.exe
  2⤵
  PID:5452
- C:\Windows\System\LNMspbY.exe
  C:\Windows\System\LNMspbY.exe
  2⤵
  PID:5476
- C:\Windows\System\lZRmxmh.exe
  C:\Windows\System\lZRmxmh.exe
  2⤵
  PID:5504
- C:\Windows\System\ZmzVVdw.exe
  C:\Windows\System\ZmzVVdw.exe
  2⤵
  PID:5536
- C:\Windows\System\CoIJQzU.exe
  C:\Windows\System\CoIJQzU.exe
  2⤵
  PID:5564
- C:\Windows\System\bfKOZwD.exe
  C:\Windows\System\bfKOZwD.exe
  2⤵
  PID:5592
- C:\Windows\System\rFyYNlk.exe
  C:\Windows\System\rFyYNlk.exe
  2⤵
  PID:5620
- C:\Windows\System\bnYVYxc.exe
  C:\Windows\System\bnYVYxc.exe
  2⤵
  PID:5648
- C:\Windows\System\jtoTRlL.exe
  C:\Windows\System\jtoTRlL.exe
  2⤵
  PID:5676
- C:\Windows\System\bwycgie.exe
  C:\Windows\System\bwycgie.exe
  2⤵
  PID:5704
- C:\Windows\System\APYUwBF.exe
  C:\Windows\System\APYUwBF.exe
  2⤵
  PID:5732
- C:\Windows\System\OppsAvq.exe
  C:\Windows\System\OppsAvq.exe
  2⤵
  PID:5760
- C:\Windows\System\xpjyvPF.exe
  C:\Windows\System\xpjyvPF.exe
  2⤵
  PID:5788
- C:\Windows\System\lMDqqxK.exe
  C:\Windows\System\lMDqqxK.exe
  2⤵
  PID:5816
- C:\Windows\System\ZtddILz.exe
  C:\Windows\System\ZtddILz.exe
  2⤵
  PID:5844
- C:\Windows\System\TWGLwKd.exe
  C:\Windows\System\TWGLwKd.exe
  2⤵
  PID:5872
- C:\Windows\System\pcBARKo.exe
  C:\Windows\System\pcBARKo.exe
  2⤵
  PID:5900
- C:\Windows\System\MgiVNFs.exe
  C:\Windows\System\MgiVNFs.exe
  2⤵
  PID:5924
- C:\Windows\System\bpmnabz.exe
  C:\Windows\System\bpmnabz.exe
  2⤵
  PID:5952
- C:\Windows\System\DBRlIRo.exe
  C:\Windows\System\DBRlIRo.exe
  2⤵
  PID:5984
- C:\Windows\System\GnoOAnt.exe
  C:\Windows\System\GnoOAnt.exe
  2⤵
  PID:6012
- C:\Windows\System\sDzvciO.exe
  C:\Windows\System\sDzvciO.exe
  2⤵
  PID:6040
- C:\Windows\System\iBtwndY.exe
  C:\Windows\System\iBtwndY.exe
  2⤵
  PID:6068
- C:\Windows\System\CBZrUaL.exe
  C:\Windows\System\CBZrUaL.exe
  2⤵
  PID:6096
- C:\Windows\System\aBQaqzI.exe
  C:\Windows\System\aBQaqzI.exe
  2⤵
  PID:6124
- C:\Windows\System\LuGCeqD.exe
  C:\Windows\System\LuGCeqD.exe
  2⤵
  PID:3372
- C:\Windows\System\JGtwOiJ.exe
  C:\Windows\System\JGtwOiJ.exe
  2⤵
  PID:1200
- C:\Windows\System\AtNKXsl.exe
  C:\Windows\System\AtNKXsl.exe
  2⤵
  PID:5132
- C:\Windows\System\WImIjkh.exe
  C:\Windows\System\WImIjkh.exe
  2⤵
  PID:5244
- C:\Windows\System\kTaAcUf.exe
  C:\Windows\System\kTaAcUf.exe
  2⤵
  PID:5284
- C:\Windows\System\OclQIdZ.exe
  C:\Windows\System\OclQIdZ.exe
  2⤵
  PID:5356
- C:\Windows\System\vwmIRwe.exe
  C:\Windows\System\vwmIRwe.exe
  2⤵
  PID:5416
- C:\Windows\System\BmqorNG.exe
  C:\Windows\System\BmqorNG.exe
  2⤵
  PID:5492
- C:\Windows\System\CmVzGNI.exe
  C:\Windows\System\CmVzGNI.exe
  2⤵
  PID:5548
- C:\Windows\System\NCpKuHf.exe
  C:\Windows\System\NCpKuHf.exe
  2⤵
  PID:5636
- C:\Windows\System\QHYDdnA.exe
  C:\Windows\System\QHYDdnA.exe
  2⤵
  PID:5688
- C:\Windows\System\dIekvIk.exe
  C:\Windows\System\dIekvIk.exe
  2⤵
  PID:5748
- C:\Windows\System\xegnnlq.exe
  C:\Windows\System\xegnnlq.exe
  2⤵
  PID:5804
- C:\Windows\System\NrPhGGA.exe
  C:\Windows\System\NrPhGGA.exe
  2⤵
  PID:5832
- C:\Windows\System\iiLuzbl.exe
  C:\Windows\System\iiLuzbl.exe
  2⤵
  PID:5888
- C:\Windows\System\dafhzoV.exe
  C:\Windows\System\dafhzoV.exe
  2⤵
  PID:1956
- C:\Windows\System\iejVzuG.exe
  C:\Windows\System\iejVzuG.exe
  2⤵
  PID:2724
- C:\Windows\System\olQMdLB.exe
  C:\Windows\System\olQMdLB.exe
  2⤵
  PID:4796
- C:\Windows\System\PGTZGME.exe
  C:\Windows\System\PGTZGME.exe
  2⤵
  PID:6084
- C:\Windows\System\KsUgIxI.exe
  C:\Windows\System\KsUgIxI.exe
  2⤵
  PID:1560
- C:\Windows\System\arxpwIL.exe
  C:\Windows\System\arxpwIL.exe
  2⤵
  PID:2964
- C:\Windows\System\jHQuYok.exe
  C:\Windows\System\jHQuYok.exe
  2⤵
  PID:4528
- C:\Windows\System\QrSwuGf.exe
  C:\Windows\System\QrSwuGf.exe
  2⤵
  PID:1576
- C:\Windows\System\ZhQkXgi.exe
  C:\Windows\System\ZhQkXgi.exe
  2⤵
  PID:348
- C:\Windows\System\OmptpWB.exe
  C:\Windows\System\OmptpWB.exe
  2⤵
  PID:2252
- C:\Windows\System\qibAKoh.exe
  C:\Windows\System\qibAKoh.exe
  2⤵
  PID:2952
- C:\Windows\System\ccEhfJy.exe
  C:\Windows\System\ccEhfJy.exe
  2⤵
  PID:1872
- C:\Windows\System\QFQFLCB.exe
  C:\Windows\System\QFQFLCB.exe
  2⤵
  PID:2044
- C:\Windows\System\ezkBFLo.exe
  C:\Windows\System\ezkBFLo.exe
  2⤵
  PID:5116
- C:\Windows\System\bbvEdqM.exe
  C:\Windows\System\bbvEdqM.exe
  2⤵
  PID:3980
- C:\Windows\System\mhvPtaW.exe
  C:\Windows\System\mhvPtaW.exe
  2⤵
  PID:668
- C:\Windows\System\gaLjVxu.exe
  C:\Windows\System\gaLjVxu.exe
  2⤵
  PID:5216
- C:\Windows\System\cbBREtT.exe
  C:\Windows\System\cbBREtT.exe
  2⤵
  PID:5308
- C:\Windows\System\gIlrjWr.exe
  C:\Windows\System\gIlrjWr.exe
  2⤵
  PID:5580
- C:\Windows\System\yUkYrXG.exe
  C:\Windows\System\yUkYrXG.exe
  2⤵
  PID:5744
- C:\Windows\System\BWSbbdj.exe
  C:\Windows\System\BWSbbdj.exe
  2⤵
  PID:1428
- C:\Windows\System\XZNwZTw.exe
  C:\Windows\System\XZNwZTw.exe
  2⤵
  PID:5920
- C:\Windows\System\VVZoiVL.exe
  C:\Windows\System\VVZoiVL.exe
  2⤵
  PID:6024
- C:\Windows\System\tCEgqcf.exe
  C:\Windows\System\tCEgqcf.exe
  2⤵
  PID:6060
- C:\Windows\System\FZumLaU.exe
  C:\Windows\System\FZumLaU.exe
  2⤵
  PID:1736
- C:\Windows\System\pNxfMjV.exe
  C:\Windows\System\pNxfMjV.exe
  2⤵
  PID:4564
- C:\Windows\System\GWaEBaL.exe
  C:\Windows\System\GWaEBaL.exe
  2⤵
  PID:5072
- C:\Windows\System\clGZJNT.exe
  C:\Windows\System\clGZJNT.exe
  2⤵
  PID:5128
- C:\Windows\System\kNhEzfO.exe
  C:\Windows\System\kNhEzfO.exe
  2⤵
  PID:1520
- C:\Windows\System\MQzaBaY.exe
  C:\Windows\System\MQzaBaY.exe
  2⤵
  PID:5860
- C:\Windows\System\pEgvoii.exe
  C:\Windows\System\pEgvoii.exe
  2⤵
  PID:2296
- C:\Windows\System\caKTsfi.exe
  C:\Windows\System\caKTsfi.exe
  2⤵
  PID:6004
- C:\Windows\System\Jcbnpok.exe
  C:\Windows\System\Jcbnpok.exe
  2⤵
  PID:2900
- C:\Windows\System\fpvfiwz.exe
  C:\Windows\System\fpvfiwz.exe
  2⤵
  PID:4224
- C:\Windows\System\NrclIAa.exe
  C:\Windows\System\NrclIAa.exe
  2⤵
  PID:4560
- C:\Windows\System\fhMSLAm.exe
  C:\Windows\System\fhMSLAm.exe
  2⤵
  PID:5168
- C:\Windows\System\nNFIUja.exe
  C:\Windows\System\nNFIUja.exe
  2⤵
  PID:4812
- C:\Windows\System\iEwIUas.exe
  C:\Windows\System\iEwIUas.exe
  2⤵
  PID:1780
- C:\Windows\System\SmcEEXB.exe
  C:\Windows\System\SmcEEXB.exe
  2⤵
  PID:6160
- C:\Windows\System\hOliybP.exe
  C:\Windows\System\hOliybP.exe
  2⤵
  PID:6204
- C:\Windows\System\rIWmNVu.exe
  C:\Windows\System\rIWmNVu.exe
  2⤵
  PID:6232
- C:\Windows\System\pllhQQa.exe
  C:\Windows\System\pllhQQa.exe
  2⤵
  PID:6256
- C:\Windows\System\ojjaMmo.exe
  C:\Windows\System\ojjaMmo.exe
  2⤵
  PID:6288
- C:\Windows\System\semvAUx.exe
  C:\Windows\System\semvAUx.exe
  2⤵
  PID:6316
- C:\Windows\System\kySGTRC.exe
  C:\Windows\System\kySGTRC.exe
  2⤵
  PID:6344
- C:\Windows\System\cvNoHjL.exe
  C:\Windows\System\cvNoHjL.exe
  2⤵
  PID:6368
- C:\Windows\System\yuSseFr.exe
  C:\Windows\System\yuSseFr.exe
  2⤵
  PID:6396
- C:\Windows\System\LsWhSaQ.exe
  C:\Windows\System\LsWhSaQ.exe
  2⤵
  PID:6432
- C:\Windows\System\WddTmTV.exe
  C:\Windows\System\WddTmTV.exe
  2⤵
  PID:6456
- C:\Windows\System\lsIMnFj.exe
  C:\Windows\System\lsIMnFj.exe
  2⤵
  PID:6488
- C:\Windows\System\wSAhIGG.exe
  C:\Windows\System\wSAhIGG.exe
  2⤵
  PID:6516
- C:\Windows\System\YvDFkHf.exe
  C:\Windows\System\YvDFkHf.exe
  2⤵
  PID:6544
- C:\Windows\System\NwptkDi.exe
  C:\Windows\System\NwptkDi.exe
  2⤵
  PID:6564
- C:\Windows\System\IwDzMym.exe
  C:\Windows\System\IwDzMym.exe
  2⤵
  PID:6588
- C:\Windows\System\Rzmrnqr.exe
  C:\Windows\System\Rzmrnqr.exe
  2⤵
  PID:6612
- C:\Windows\System\RYdGqcL.exe
  C:\Windows\System\RYdGqcL.exe
  2⤵
  PID:6648
- C:\Windows\System\uVOwtMZ.exe
  C:\Windows\System\uVOwtMZ.exe
  2⤵
  PID:6672
- C:\Windows\System\DvVCbgR.exe
  C:\Windows\System\DvVCbgR.exe
  2⤵
  PID:6696
- C:\Windows\System\UsUwoFv.exe
  C:\Windows\System\UsUwoFv.exe
  2⤵
  PID:6728
- C:\Windows\System\UpAwgKX.exe
  C:\Windows\System\UpAwgKX.exe
  2⤵
  PID:6760
- C:\Windows\System\CPXweLe.exe
  C:\Windows\System\CPXweLe.exe
  2⤵
  PID:6792
- C:\Windows\System\gmolXzg.exe
  C:\Windows\System\gmolXzg.exe
  2⤵
  PID:6824
- C:\Windows\System\dYssfSi.exe
  C:\Windows\System\dYssfSi.exe
  2⤵
  PID:6864
- C:\Windows\System\hVDrGPF.exe
  C:\Windows\System\hVDrGPF.exe
  2⤵
  PID:6900
- C:\Windows\System\CHEpatJ.exe
  C:\Windows\System\CHEpatJ.exe
  2⤵
  PID:6920
- C:\Windows\System\izdmqIN.exe
  C:\Windows\System\izdmqIN.exe
  2⤵
  PID:6948
- C:\Windows\System\cLLmSvK.exe
  C:\Windows\System\cLLmSvK.exe
  2⤵
  PID:6976
- C:\Windows\System\htLZiRR.exe
  C:\Windows\System\htLZiRR.exe
  2⤵
  PID:7004
- C:\Windows\System\lhKZTfc.exe
  C:\Windows\System\lhKZTfc.exe
  2⤵
  PID:7032
- C:\Windows\System\czsmMXv.exe
  C:\Windows\System\czsmMXv.exe
  2⤵
  PID:7052
- C:\Windows\System\cEMLUlM.exe
  C:\Windows\System\cEMLUlM.exe
  2⤵
  PID:7076
- C:\Windows\System\RDklALy.exe
  C:\Windows\System\RDklALy.exe
  2⤵
  PID:7116
- C:\Windows\System\QASBFgm.exe
  C:\Windows\System\QASBFgm.exe
  2⤵
  PID:7132
- C:\Windows\System\MmGWDjz.exe
  C:\Windows\System\MmGWDjz.exe
  2⤵
  PID:7164
- C:\Windows\System\YJSvjwE.exe
  C:\Windows\System\YJSvjwE.exe
  2⤵
  PID:6180
- C:\Windows\System\qDXnquC.exe
  C:\Windows\System\qDXnquC.exe
  2⤵
  PID:6240
- C:\Windows\System\RnhXiwz.exe
  C:\Windows\System\RnhXiwz.exe
  2⤵
  PID:6312
- C:\Windows\System\KVJIUMt.exe
  C:\Windows\System\KVJIUMt.exe
  2⤵
  PID:6384
- C:\Windows\System\aaCcHBW.exe
  C:\Windows\System\aaCcHBW.exe
  2⤵
  PID:6412
- C:\Windows\System\QGKlxQF.exe
  C:\Windows\System\QGKlxQF.exe
  2⤵
  PID:6480
- C:\Windows\System\rojRQJv.exe
  C:\Windows\System\rojRQJv.exe
  2⤵
  PID:6536
- C:\Windows\System\xdIimhG.exe
  C:\Windows\System\xdIimhG.exe
  2⤵
  PID:6608
- C:\Windows\System\KvwhtOy.exe
  C:\Windows\System\KvwhtOy.exe
  2⤵
  PID:6640
- C:\Windows\System\amvqRYG.exe
  C:\Windows\System\amvqRYG.exe
  2⤵
  PID:6744
- C:\Windows\System\NnOfJDb.exe
  C:\Windows\System\NnOfJDb.exe
  2⤵
  PID:6780
- C:\Windows\System\gXoyfPy.exe
  C:\Windows\System\gXoyfPy.exe
  2⤵
  PID:6876
- C:\Windows\System\cUqRuYb.exe
  C:\Windows\System\cUqRuYb.exe
  2⤵
  PID:6944
- C:\Windows\System\nszGXEY.exe
  C:\Windows\System\nszGXEY.exe
  2⤵
  PID:7016
- C:\Windows\System\DMvNqyF.exe
  C:\Windows\System\DMvNqyF.exe
  2⤵
  PID:7108
- C:\Windows\System\DErXMwe.exe
  C:\Windows\System\DErXMwe.exe
  2⤵
  PID:7160
- C:\Windows\System\SkqJSOL.exe
  C:\Windows\System\SkqJSOL.exe
  2⤵
  PID:936
- C:\Windows\System\uJhKqvm.exe
  C:\Windows\System\uJhKqvm.exe
  2⤵
  PID:6340
- C:\Windows\System\bjlJHtB.exe
  C:\Windows\System\bjlJHtB.exe
  2⤵
  PID:6440
- C:\Windows\System\WfHBZMj.exe
  C:\Windows\System\WfHBZMj.exe
  2⤵
  PID:6624
- C:\Windows\System\knHPReH.exe
  C:\Windows\System\knHPReH.exe
  2⤵
  PID:6776
- C:\Windows\System\wymfwJN.exe
  C:\Windows\System\wymfwJN.exe
  2⤵
  PID:7068
- C:\Windows\System\ryXXPkj.exe
  C:\Windows\System\ryXXPkj.exe
  2⤵
  PID:6280
- C:\Windows\System\cWKWCnr.exe
  C:\Windows\System\cWKWCnr.exe
  2⤵
  PID:6800
- C:\Windows\System\HNXVdPA.exe
  C:\Windows\System\HNXVdPA.exe
  2⤵
  PID:5916
- C:\Windows\System\gfEspmJ.exe
  C:\Windows\System\gfEspmJ.exe
  2⤵
  PID:7172
- C:\Windows\System\fQVRROJ.exe
  C:\Windows\System\fQVRROJ.exe
  2⤵
  PID:7200
- C:\Windows\System\ptVFKOO.exe
  C:\Windows\System\ptVFKOO.exe
  2⤵
  PID:7228
- C:\Windows\System\ErFPVFD.exe
  C:\Windows\System\ErFPVFD.exe
  2⤵
  PID:7256
- C:\Windows\System\ZNqhkAO.exe
  C:\Windows\System\ZNqhkAO.exe
  2⤵
  PID:7284
- C:\Windows\System\ifkhQaD.exe
  C:\Windows\System\ifkhQaD.exe
  2⤵
  PID:7312
- C:\Windows\System\lfdLBUr.exe
  C:\Windows\System\lfdLBUr.exe
  2⤵
  PID:7340
- C:\Windows\System\LfjrnYp.exe
  C:\Windows\System\LfjrnYp.exe
  2⤵
  PID:7368
- C:\Windows\System\QfjROcJ.exe
  C:\Windows\System\QfjROcJ.exe
  2⤵
  PID:7396
- C:\Windows\System\QfudRjc.exe
  C:\Windows\System\QfudRjc.exe
  2⤵
  PID:7428
- C:\Windows\System\AwNdjUp.exe
  C:\Windows\System\AwNdjUp.exe
  2⤵
  PID:7444
- C:\Windows\System\qqjRHvV.exe
  C:\Windows\System\qqjRHvV.exe
  2⤵
  PID:7476
- C:\Windows\System\meXuMed.exe
  C:\Windows\System\meXuMed.exe
  2⤵
  PID:7512
- C:\Windows\System\mmItEuK.exe
  C:\Windows\System\mmItEuK.exe
  2⤵
  PID:7544
- C:\Windows\System\SGUznVL.exe
  C:\Windows\System\SGUznVL.exe
  2⤵
  PID:7572
- C:\Windows\System\dUygleq.exe
  C:\Windows\System\dUygleq.exe
  2⤵
  PID:7600
- C:\Windows\System\wFzGwxf.exe
  C:\Windows\System\wFzGwxf.exe
  2⤵
  PID:7624
- C:\Windows\System\rCXlsyp.exe
  C:\Windows\System\rCXlsyp.exe
  2⤵
  PID:7656
- C:\Windows\System\vqzlgtv.exe
  C:\Windows\System\vqzlgtv.exe
  2⤵
  PID:7684
- C:\Windows\System\jAErESZ.exe
  C:\Windows\System\jAErESZ.exe
  2⤵
  PID:7700
- C:\Windows\System\uknJHDC.exe
  C:\Windows\System\uknJHDC.exe
  2⤵
  PID:7740
- C:\Windows\System\PLQNyMc.exe
  C:\Windows\System\PLQNyMc.exe
  2⤵
  PID:7756
- C:\Windows\System\PQRfmkQ.exe
  C:\Windows\System\PQRfmkQ.exe
  2⤵
  PID:7784
- C:\Windows\System\BriIHPJ.exe
  C:\Windows\System\BriIHPJ.exe
  2⤵
  PID:7808
- C:\Windows\System\VxOlUqR.exe
  C:\Windows\System\VxOlUqR.exe
  2⤵
  PID:7852
- C:\Windows\System\xFePmud.exe
  C:\Windows\System\xFePmud.exe
  2⤵
  PID:7880
- C:\Windows\System\GXUlDtf.exe
  C:\Windows\System\GXUlDtf.exe
  2⤵
  PID:7908
- C:\Windows\System\BZGUzle.exe
  C:\Windows\System\BZGUzle.exe
  2⤵
  PID:7924
- C:\Windows\System\yGVaEvL.exe
  C:\Windows\System\yGVaEvL.exe
  2⤵
  PID:7952
- C:\Windows\System\WPjuvwB.exe
  C:\Windows\System\WPjuvwB.exe
  2⤵
  PID:7992
- C:\Windows\System\PzdPPki.exe
  C:\Windows\System\PzdPPki.exe
  2⤵
  PID:8008
- C:\Windows\System\inmDruw.exe
  C:\Windows\System\inmDruw.exe
  2⤵
  PID:8024
- C:\Windows\System\GsbZpod.exe
  C:\Windows\System\GsbZpod.exe
  2⤵
  PID:8052
- C:\Windows\System\thQWpMJ.exe
  C:\Windows\System\thQWpMJ.exe
  2⤵
  PID:8104
- C:\Windows\System\wlCikNw.exe
  C:\Windows\System\wlCikNw.exe
  2⤵
  PID:8120
- C:\Windows\System\GpRRWfP.exe
  C:\Windows\System\GpRRWfP.exe
  2⤵
  PID:8136
- C:\Windows\System\IUxlKnl.exe
  C:\Windows\System\IUxlKnl.exe
  2⤵
  PID:8172
- C:\Windows\System\mfNOZyU.exe
  C:\Windows\System\mfNOZyU.exe
  2⤵
  PID:7128
- C:\Windows\System\LBJTrSL.exe
  C:\Windows\System\LBJTrSL.exe
  2⤵
  PID:7240
- C:\Windows\System\oBTwkIU.exe
  C:\Windows\System\oBTwkIU.exe
  2⤵
  PID:7296
- C:\Windows\System\JWjdPVJ.exe
  C:\Windows\System\JWjdPVJ.exe
  2⤵
  PID:7380
- C:\Windows\System\lXZzZBW.exe
  C:\Windows\System\lXZzZBW.exe
  2⤵
  PID:7440
- C:\Windows\System\IlFufRA.exe
  C:\Windows\System\IlFufRA.exe
  2⤵
  PID:7528
- C:\Windows\System\MwyenCH.exe
  C:\Windows\System\MwyenCH.exe
  2⤵
  PID:7612
- C:\Windows\System\ZMYdOKB.exe
  C:\Windows\System\ZMYdOKB.exe
  2⤵
  PID:7644
- C:\Windows\System\tKojCWX.exe
  C:\Windows\System\tKojCWX.exe
  2⤵
  PID:7716
- C:\Windows\System\zeITCuT.exe
  C:\Windows\System\zeITCuT.exe
  2⤵
  PID:7780
- C:\Windows\System\KEGOuKN.exe
  C:\Windows\System\KEGOuKN.exe
  2⤵
  PID:7836
- C:\Windows\System\ifvxhiE.exe
  C:\Windows\System\ifvxhiE.exe
  2⤵
  PID:7936
- C:\Windows\System\Pyqewzw.exe
  C:\Windows\System\Pyqewzw.exe
  2⤵
  PID:7940
- C:\Windows\System\IuuPZYR.exe
  C:\Windows\System\IuuPZYR.exe
  2⤵
  PID:8040
- C:\Windows\System\vRNjkQm.exe
  C:\Windows\System\vRNjkQm.exe
  2⤵
  PID:8088
- C:\Windows\System\PgZHcnP.exe
  C:\Windows\System\PgZHcnP.exe
  2⤵
  PID:8128
- C:\Windows\System\YBpEADC.exe
  C:\Windows\System\YBpEADC.exe
  2⤵
  PID:8148
- C:\Windows\System\STzUund.exe
  C:\Windows\System\STzUund.exe
  2⤵
  PID:7412
- C:\Windows\System\IdWlXOf.exe
  C:\Windows\System\IdWlXOf.exe
  2⤵
  PID:7560
- C:\Windows\System\ZrVsOzc.exe
  C:\Windows\System\ZrVsOzc.exe
  2⤵
  PID:7668
- C:\Windows\System\hXYZnMN.exe
  C:\Windows\System\hXYZnMN.exe
  2⤵
  PID:7800
- C:\Windows\System\Xrefyyz.exe
  C:\Windows\System\Xrefyyz.exe
  2⤵
  PID:8016
- C:\Windows\System\eukbfHT.exe
  C:\Windows\System\eukbfHT.exe
  2⤵
  PID:8112
- C:\Windows\System\ODayASJ.exe
  C:\Windows\System\ODayASJ.exe
  2⤵
  PID:7420
- C:\Windows\System\CQltvpO.exe
  C:\Windows\System\CQltvpO.exe
  2⤵
  PID:4760
- C:\Windows\System\QuVVkjm.exe
  C:\Windows\System\QuVVkjm.exe
  2⤵
  PID:7896
- C:\Windows\System\Ekdzmen.exe
  C:\Windows\System\Ekdzmen.exe
  2⤵
  PID:6740
- C:\Windows\System\aaVXhJj.exe
  C:\Windows\System\aaVXhJj.exe
  2⤵
  PID:7640
- C:\Windows\System\MoEolog.exe
  C:\Windows\System\MoEolog.exe
  2⤵
  PID:1564
- C:\Windows\System\jQBlUTy.exe
  C:\Windows\System\jQBlUTy.exe
  2⤵
  PID:8216
- C:\Windows\System\eUbXYUg.exe
  C:\Windows\System\eUbXYUg.exe
  2⤵
  PID:8260
- C:\Windows\System\vRfVegm.exe
  C:\Windows\System\vRfVegm.exe
  2⤵
  PID:8276
- C:\Windows\System\EewslsH.exe
  C:\Windows\System\EewslsH.exe
  2⤵
  PID:8304
- C:\Windows\System\GYDcgFL.exe
  C:\Windows\System\GYDcgFL.exe
  2⤵
  PID:8332
- C:\Windows\System\wwmENhY.exe
  C:\Windows\System\wwmENhY.exe
  2⤵
  PID:8356
- C:\Windows\System\ZkOciWf.exe
  C:\Windows\System\ZkOciWf.exe
  2⤵
  PID:8400
- C:\Windows\System\rOifcQb.exe
  C:\Windows\System\rOifcQb.exe
  2⤵
  PID:8416
- C:\Windows\System\trZwOoU.exe
  C:\Windows\System\trZwOoU.exe
  2⤵
  PID:8444
- C:\Windows\System\DLGCPau.exe
  C:\Windows\System\DLGCPau.exe
  2⤵
  PID:8472
- C:\Windows\System\vMeJmhL.exe
  C:\Windows\System\vMeJmhL.exe
  2⤵
  PID:8500
- C:\Windows\System\HOwbxOl.exe
  C:\Windows\System\HOwbxOl.exe
  2⤵
  PID:8528
- C:\Windows\System\IDRjAnO.exe
  C:\Windows\System\IDRjAnO.exe
  2⤵
  PID:8556
- C:\Windows\System\xjzynSe.exe
  C:\Windows\System\xjzynSe.exe
  2⤵
  PID:8584
- C:\Windows\System\pCLfRUH.exe
  C:\Windows\System\pCLfRUH.exe
  2⤵
  PID:8616
- C:\Windows\System\OOoXNRN.exe
  C:\Windows\System\OOoXNRN.exe
  2⤵
  PID:8636
- C:\Windows\System\wnTFsjZ.exe
  C:\Windows\System\wnTFsjZ.exe
  2⤵
  PID:8652
- C:\Windows\System\qqPDKzu.exe
  C:\Windows\System\qqPDKzu.exe
  2⤵
  PID:8676
- C:\Windows\System\NTUskut.exe
  C:\Windows\System\NTUskut.exe
  2⤵
  PID:8736
- C:\Windows\System\QkjXwCC.exe
  C:\Windows\System\QkjXwCC.exe
  2⤵
  PID:8764
- C:\Windows\System\MhLggGL.exe
  C:\Windows\System\MhLggGL.exe
  2⤵
  PID:8792
- C:\Windows\System\IIKvZwE.exe
  C:\Windows\System\IIKvZwE.exe
  2⤵
  PID:8808
- C:\Windows\System\qqtHHlv.exe
  C:\Windows\System\qqtHHlv.exe
  2⤵
  PID:8840
- C:\Windows\System\NMZgpga.exe
  C:\Windows\System\NMZgpga.exe
  2⤵
  PID:8868
- C:\Windows\System\OPWrIuX.exe
  C:\Windows\System\OPWrIuX.exe
  2⤵
  PID:8892
- C:\Windows\System\GRZxxZm.exe
  C:\Windows\System\GRZxxZm.exe
  2⤵
  PID:8924
- C:\Windows\System\AozEumF.exe
  C:\Windows\System\AozEumF.exe
  2⤵
  PID:8952
- C:\Windows\System\jvfHKUr.exe
  C:\Windows\System\jvfHKUr.exe
  2⤵
  PID:8976
- C:\Windows\System\grtdKxT.exe
  C:\Windows\System\grtdKxT.exe
  2⤵
  PID:9016
- C:\Windows\System\aZofsVc.exe
  C:\Windows\System\aZofsVc.exe
  2⤵
  PID:9044
- C:\Windows\System\buVfhAN.exe
  C:\Windows\System\buVfhAN.exe
  2⤵
  PID:9064
- C:\Windows\System\wKtAcQT.exe
  C:\Windows\System\wKtAcQT.exe
  2⤵
  PID:9088
- C:\Windows\System\apElcPa.exe
  C:\Windows\System\apElcPa.exe
  2⤵
  PID:9104
- C:\Windows\System\fFnfXsa.exe
  C:\Windows\System\fFnfXsa.exe
  2⤵
  PID:9128
- C:\Windows\System\aHJLIHG.exe
  C:\Windows\System\aHJLIHG.exe
  2⤵
  PID:9164
- C:\Windows\System\MedArFe.exe
  C:\Windows\System\MedArFe.exe
  2⤵
  PID:9196
- C:\Windows\System\pYeSxCf.exe
  C:\Windows\System\pYeSxCf.exe
  2⤵
  PID:7268
- C:\Windows\System\XAYrITS.exe
  C:\Windows\System\XAYrITS.exe
  2⤵
  PID:8204
- C:\Windows\System\gMgkCGb.exe
  C:\Windows\System\gMgkCGb.exe
  2⤵
  PID:8236
- C:\Windows\System\KwVunzB.exe
  C:\Windows\System\KwVunzB.exe
  2⤵
  PID:8292
- C:\Windows\System\FLlevlL.exe
  C:\Windows\System\FLlevlL.exe
  2⤵
  PID:8376
- C:\Windows\System\HuzTCIw.exe
  C:\Windows\System\HuzTCIw.exe
  2⤵
  PID:8484
- C:\Windows\System\nIFbaDy.exe
  C:\Windows\System\nIFbaDy.exe
  2⤵
  PID:8548
- C:\Windows\System\AoyuVRS.exe
  C:\Windows\System\AoyuVRS.exe
  2⤵
  PID:8612
- C:\Windows\System\NHmNlxz.exe
  C:\Windows\System\NHmNlxz.exe
  2⤵
  PID:8748
- C:\Windows\System\BmahQGC.exe
  C:\Windows\System\BmahQGC.exe
  2⤵
  PID:8788
- C:\Windows\System\rsEkTuh.exe
  C:\Windows\System\rsEkTuh.exe
  2⤵
  PID:8888
- C:\Windows\System\fikHfYu.exe
  C:\Windows\System\fikHfYu.exe
  2⤵
  PID:8904
- C:\Windows\System\KgvLHwa.exe
  C:\Windows\System\KgvLHwa.exe
  2⤵
  PID:8988
- C:\Windows\System\BCRukSc.exe
  C:\Windows\System\BCRukSc.exe
  2⤵
  PID:9052
- C:\Windows\System\cRCrVSj.exe
  C:\Windows\System\cRCrVSj.exe
  2⤵
  PID:9124
- C:\Windows\System\tfosPKJ.exe
  C:\Windows\System\tfosPKJ.exe
  2⤵
  PID:9204
- C:\Windows\System\YOXVjYX.exe
  C:\Windows\System\YOXVjYX.exe
  2⤵
  PID:8268
- C:\Windows\System\gacXjRR.exe
  C:\Windows\System\gacXjRR.exe
  2⤵
  PID:8412
- C:\Windows\System\PeOKcoZ.exe
  C:\Windows\System\PeOKcoZ.exe
  2⤵
  PID:8512
- C:\Windows\System\NBqjeaG.exe
  C:\Windows\System\NBqjeaG.exe
  2⤵
  PID:8672
- C:\Windows\System\KdoHOXE.exe
  C:\Windows\System\KdoHOXE.exe
  2⤵
  PID:8940
- C:\Windows\System\RUlsoWX.exe
  C:\Windows\System\RUlsoWX.exe
  2⤵
  PID:8972
- C:\Windows\System\dKhjxjT.exe
  C:\Windows\System\dKhjxjT.exe
  2⤵
  PID:9100
- C:\Windows\System\MGLSdMk.exe
  C:\Windows\System\MGLSdMk.exe
  2⤵
  PID:8288
- C:\Windows\System\xGOdglY.exe
  C:\Windows\System\xGOdglY.exe
  2⤵
  PID:8604
- C:\Windows\System\HgDsfRb.exe
  C:\Windows\System\HgDsfRb.exe
  2⤵
  PID:8968
- C:\Windows\System\XoPTvaY.exe
  C:\Windows\System\XoPTvaY.exe
  2⤵
  PID:8456
- C:\Windows\System\oeGKvfw.exe
  C:\Windows\System\oeGKvfw.exe
  2⤵
  PID:8800
- C:\Windows\System\OkrTmvu.exe
  C:\Windows\System\OkrTmvu.exe
  2⤵
  PID:9232
- C:\Windows\System\bIyEKOU.exe
  C:\Windows\System\bIyEKOU.exe
  2⤵
  PID:9260
- C:\Windows\System\nyiJFYj.exe
  C:\Windows\System\nyiJFYj.exe
  2⤵
  PID:9288
- C:\Windows\System\akwYUAy.exe
  C:\Windows\System\akwYUAy.exe
  2⤵
  PID:9308
- C:\Windows\System\GchfVMa.exe
  C:\Windows\System\GchfVMa.exe
  2⤵
  PID:9348
- C:\Windows\System\kTgfUag.exe
  C:\Windows\System\kTgfUag.exe
  2⤵
  PID:9380
- C:\Windows\System\eYNDwJF.exe
  C:\Windows\System\eYNDwJF.exe
  2⤵
  PID:9404
- C:\Windows\System\TmFjTVM.exe
  C:\Windows\System\TmFjTVM.exe
  2⤵
  PID:9428
- C:\Windows\System\sMciNEM.exe
  C:\Windows\System\sMciNEM.exe
  2⤵
  PID:9468
- C:\Windows\System\nHuYMjq.exe
  C:\Windows\System\nHuYMjq.exe
  2⤵
  PID:9500
- C:\Windows\System\nNljNEH.exe
  C:\Windows\System\nNljNEH.exe
  2⤵
  PID:9528
- C:\Windows\System\cxcqgPI.exe
  C:\Windows\System\cxcqgPI.exe
  2⤵
  PID:9544
- C:\Windows\System\iMrfobL.exe
  C:\Windows\System\iMrfobL.exe
  2⤵
  PID:9584
- C:\Windows\System\eorGllb.exe
  C:\Windows\System\eorGllb.exe
  2⤵
  PID:9600
- C:\Windows\System\dDZlwse.exe
  C:\Windows\System\dDZlwse.exe
  2⤵
  PID:9616
- C:\Windows\System\bnEIOrx.exe
  C:\Windows\System\bnEIOrx.exe
  2⤵
  PID:9644
- C:\Windows\System\yJZMsdM.exe
  C:\Windows\System\yJZMsdM.exe
  2⤵
  PID:9672
- C:\Windows\System\Vnvwnxx.exe
  C:\Windows\System\Vnvwnxx.exe
  2⤵
  PID:9700
- C:\Windows\System\aPZdKlh.exe
  C:\Windows\System\aPZdKlh.exe
  2⤵
  PID:9728
- C:\Windows\System\yluRtiL.exe
  C:\Windows\System\yluRtiL.exe
  2⤵
  PID:9752
- C:\Windows\System\MyaBctV.exe
  C:\Windows\System\MyaBctV.exe
  2⤵
  PID:9772
- C:\Windows\System\RvetMBx.exe
  C:\Windows\System\RvetMBx.exe
  2⤵
  PID:9800
- C:\Windows\System\GKdugxj.exe
  C:\Windows\System\GKdugxj.exe
  2⤵
  PID:9828
- C:\Windows\System\YwLolyU.exe
  C:\Windows\System\YwLolyU.exe
  2⤵
  PID:9876
- C:\Windows\System\nTAlcDc.exe
  C:\Windows\System\nTAlcDc.exe
  2⤵
  PID:9904
- C:\Windows\System\uhBOVaJ.exe
  C:\Windows\System\uhBOVaJ.exe
  2⤵
  PID:9936
- C:\Windows\System\tsbtlpF.exe
  C:\Windows\System\tsbtlpF.exe
  2⤵
  PID:9960
- C:\Windows\System\LeAtnOR.exe
  C:\Windows\System\LeAtnOR.exe
  2⤵
  PID:9980
- C:\Windows\System\xHuvLka.exe
  C:\Windows\System\xHuvLka.exe
  2⤵
  PID:9996
- C:\Windows\System\sJtNhzk.exe
  C:\Windows\System\sJtNhzk.exe
  2⤵
  PID:10028
- C:\Windows\System\VEYYEuk.exe
  C:\Windows\System\VEYYEuk.exe
  2⤵
  PID:10088
- C:\Windows\System\xIdSIUy.exe
  C:\Windows\System\xIdSIUy.exe
  2⤵
  PID:10104
- C:\Windows\System\OucmoBW.exe
  C:\Windows\System\OucmoBW.exe
  2⤵
  PID:10136
- C:\Windows\System\Zdrulmf.exe
  C:\Windows\System\Zdrulmf.exe
  2⤵
  PID:10160
- C:\Windows\System\BncgzKw.exe
  C:\Windows\System\BncgzKw.exe
  2⤵
  PID:10188
- C:\Windows\System\ywyinKa.exe
  C:\Windows\System\ywyinKa.exe
  2⤵
  PID:10216
- C:\Windows\System\siHIZca.exe
  C:\Windows\System\siHIZca.exe
  2⤵
  PID:9224
- C:\Windows\System\HsQOlyo.exe
  C:\Windows\System\HsQOlyo.exe
  2⤵
  PID:9280
- C:\Windows\System\mjqwYgx.exe
  C:\Windows\System\mjqwYgx.exe
  2⤵
  PID:9372
- C:\Windows\System\SnEXufm.exe
  C:\Windows\System\SnEXufm.exe
  2⤵
  PID:9460
- C:\Windows\System\viLZCBY.exe
  C:\Windows\System\viLZCBY.exe
  2⤵
  PID:9524
- C:\Windows\System\ZAGKagY.exe
  C:\Windows\System\ZAGKagY.exe
  2⤵
  PID:9536
- C:\Windows\System\DZmNvYY.exe
  C:\Windows\System\DZmNvYY.exe
  2⤵
  PID:9612
- C:\Windows\System\OBKBTpg.exe
  C:\Windows\System\OBKBTpg.exe
  2⤵
  PID:9680
- C:\Windows\System\DQBAydP.exe
  C:\Windows\System\DQBAydP.exe
  2⤵
  PID:9736
- C:\Windows\System\ZOyDatk.exe
  C:\Windows\System\ZOyDatk.exe
  2⤵
  PID:9812
- C:\Windows\System\PNqwMLy.exe
  C:\Windows\System\PNqwMLy.exe
  2⤵
  PID:9900
- C:\Windows\System\GoyQHwO.exe
  C:\Windows\System\GoyQHwO.exe
  2⤵
  PID:9916
- C:\Windows\System\auHlOrr.exe
  C:\Windows\System\auHlOrr.exe
  2⤵
  PID:10016
- C:\Windows\System\YjlZuhS.exe
  C:\Windows\System\YjlZuhS.exe
  2⤵
  PID:10024
- C:\Windows\System\wIKZSoc.exe
  C:\Windows\System\wIKZSoc.exe
  2⤵
  PID:10096
- C:\Windows\System\vQNFZmr.exe
  C:\Windows\System\vQNFZmr.exe
  2⤵
  PID:10200
- C:\Windows\System\zEpTeKp.exe
  C:\Windows\System\zEpTeKp.exe
  2⤵
  PID:9244
- C:\Windows\System\SmucYYM.exe
  C:\Windows\System\SmucYYM.exe
  2⤵
  PID:9368
- C:\Windows\System\OEpJMjp.exe
  C:\Windows\System\OEpJMjp.exe
  2⤵
  PID:9492
- C:\Windows\System\fpwZugA.exe
  C:\Windows\System\fpwZugA.exe
  2⤵
  PID:9660
- C:\Windows\System\nldNfUu.exe
  C:\Windows\System\nldNfUu.exe
  2⤵
  PID:9796
- C:\Windows\System\bNUxDeN.exe
  C:\Windows\System\bNUxDeN.exe
  2⤵
  PID:10020
- C:\Windows\System\HvcbuQR.exe
  C:\Windows\System\HvcbuQR.exe
  2⤵
  PID:10212
- C:\Windows\System\vDvBxRZ.exe
  C:\Windows\System\vDvBxRZ.exe
  2⤵
  PID:9488
- C:\Windows\System\SeQaKNl.exe
  C:\Windows\System\SeQaKNl.exe
  2⤵
  PID:9724
- C:\Windows\System\UyQXIPQ.exe
  C:\Windows\System\UyQXIPQ.exe
  2⤵
  PID:10172
- C:\Windows\System\pGLPKNo.exe
  C:\Windows\System\pGLPKNo.exe
  2⤵
  PID:9324
- C:\Windows\System\epMPoVO.exe
  C:\Windows\System\epMPoVO.exe
  2⤵
  PID:10276
- C:\Windows\System\fHJsJag.exe
  C:\Windows\System\fHJsJag.exe
  2⤵
  PID:10304
- C:\Windows\System\lIWRdsD.exe
  C:\Windows\System\lIWRdsD.exe
  2⤵
  PID:10332
- C:\Windows\System\mFVzbHC.exe
  C:\Windows\System\mFVzbHC.exe
  2⤵
  PID:10372
- C:\Windows\System\dimRqCI.exe
  C:\Windows\System\dimRqCI.exe
  2⤵
  PID:10400
- C:\Windows\System\PFpaEVd.exe
  C:\Windows\System\PFpaEVd.exe
  2⤵
  PID:10424
- C:\Windows\System\FMCoLfh.exe
  C:\Windows\System\FMCoLfh.exe
  2⤵
  PID:10456
- C:\Windows\System\mgyDhLi.exe
  C:\Windows\System\mgyDhLi.exe
  2⤵
  PID:10484
- C:\Windows\System\uPEqiCF.exe
  C:\Windows\System\uPEqiCF.exe
  2⤵
  PID:10624
- C:\Windows\System\GiyGNAi.exe
  C:\Windows\System\GiyGNAi.exe
  2⤵
  PID:10640
- C:\Windows\System\EmLDAeV.exe
  C:\Windows\System\EmLDAeV.exe
  2⤵
  PID:10656
- C:\Windows\System\cPnwQOU.exe
  C:\Windows\System\cPnwQOU.exe
  2⤵
  PID:10676
- C:\Windows\System\kUKWMWi.exe
  C:\Windows\System\kUKWMWi.exe
  2⤵
  PID:10700
- C:\Windows\System\wkScqUQ.exe
  C:\Windows\System\wkScqUQ.exe
  2⤵
  PID:10728
- C:\Windows\System\CvvGogu.exe
  C:\Windows\System\CvvGogu.exe
  2⤵
  PID:10744
- C:\Windows\System\SjjfFWA.exe
  C:\Windows\System\SjjfFWA.exe
  2⤵
  PID:10780
- C:\Windows\System\TFLXgFL.exe
  C:\Windows\System\TFLXgFL.exe
  2⤵
  PID:10812
- C:\Windows\System\jgvRsjg.exe
  C:\Windows\System\jgvRsjg.exe
  2⤵
  PID:10840
- C:\Windows\System\oggprlI.exe
  C:\Windows\System\oggprlI.exe
  2⤵
  PID:10872
- C:\Windows\System\IMpljrD.exe
  C:\Windows\System\IMpljrD.exe
  2⤵
  PID:10904
- C:\Windows\System\niLYkbP.exe
  C:\Windows\System\niLYkbP.exe
  2⤵
  PID:10928
- C:\Windows\System\dSicxXO.exe
  C:\Windows\System\dSicxXO.exe
  2⤵
  PID:10964
- C:\Windows\System\MPxpfuq.exe
  C:\Windows\System\MPxpfuq.exe
  2⤵
  PID:10992
- C:\Windows\System\bSyNviD.exe
  C:\Windows\System\bSyNviD.exe
  2⤵
  PID:11024
- C:\Windows\System\ResOVMz.exe
  C:\Windows\System\ResOVMz.exe
  2⤵
  PID:11052
- C:\Windows\System\nGVpdYr.exe
  C:\Windows\System\nGVpdYr.exe
  2⤵
  PID:11088
- C:\Windows\System\bwqrvdj.exe
  C:\Windows\System\bwqrvdj.exe
  2⤵
  PID:11104
- C:\Windows\System\oWXMTUe.exe
  C:\Windows\System\oWXMTUe.exe
  2⤵
  PID:11128
- C:\Windows\System\wFLQDmZ.exe
  C:\Windows\System\wFLQDmZ.exe
  2⤵
  PID:11160
- C:\Windows\System\OqhiWdd.exe
  C:\Windows\System\OqhiWdd.exe
  2⤵
  PID:11192
- C:\Windows\System\wuyCuRW.exe
  C:\Windows\System\wuyCuRW.exe
  2⤵
  PID:11208
- C:\Windows\System\blgzxqK.exe
  C:\Windows\System\blgzxqK.exe
  2⤵
  PID:11236
- C:\Windows\System\oooufoC.exe
  C:\Windows\System\oooufoC.exe
  2⤵
  PID:10144
- C:\Windows\System\lxYCciq.exe
  C:\Windows\System\lxYCciq.exe
  2⤵
  PID:10312
- C:\Windows\System\rhTaiFo.exe
  C:\Windows\System\rhTaiFo.exe
  2⤵
  PID:10364
- C:\Windows\System\mZOHJOa.exe
  C:\Windows\System\mZOHJOa.exe
  2⤵
  PID:10432
- C:\Windows\System\JiopNke.exe
  C:\Windows\System\JiopNke.exe
  2⤵
  PID:10520
- C:\Windows\System\nYVQvPk.exe
  C:\Windows\System\nYVQvPk.exe
  2⤵
  PID:6500
- C:\Windows\System\exeeGxA.exe
  C:\Windows\System\exeeGxA.exe
  2⤵
  PID:10648
- C:\Windows\System\xMxoTEN.exe
  C:\Windows\System\xMxoTEN.exe
  2⤵
  PID:10668
- C:\Windows\System\HTpUtcs.exe
  C:\Windows\System\HTpUtcs.exe
  2⤵
  PID:10712
- C:\Windows\System\IDxbaRm.exe
  C:\Windows\System\IDxbaRm.exe
  2⤵
  PID:10808
- C:\Windows\System\ANhJZhr.exe
  C:\Windows\System\ANhJZhr.exe
  2⤵
  PID:10892
- C:\Windows\System\iANBHcj.exe
  C:\Windows\System\iANBHcj.exe
  2⤵
  PID:10916
- C:\Windows\System\daypbzu.exe
  C:\Windows\System\daypbzu.exe
  2⤵
  PID:11016
- C:\Windows\System\xggDVLt.exe
  C:\Windows\System\xggDVLt.exe
  2⤵
  PID:11076
- C:\Windows\System\ATNntYn.exe
  C:\Windows\System\ATNntYn.exe
  2⤵
  PID:11152
- C:\Windows\System\YGBVSWJ.exe
  C:\Windows\System\YGBVSWJ.exe
  2⤵
  PID:11204
- C:\Windows\System\LvPeOHi.exe
  C:\Windows\System\LvPeOHi.exe
  2⤵
  PID:9592
- C:\Windows\System\ITqpIXO.exe
  C:\Windows\System\ITqpIXO.exe
  2⤵
  PID:10328
- C:\Windows\System\PojBeCi.exe
  C:\Windows\System\PojBeCi.exe
  2⤵
  PID:6276
- C:\Windows\System\iUpKsOK.exe
  C:\Windows\System\iUpKsOK.exe
  2⤵
  PID:10764
- C:\Windows\System\AdumBgh.exe
  C:\Windows\System\AdumBgh.exe
  2⤵
  PID:10800
- C:\Windows\System\SarGzGe.exe
  C:\Windows\System\SarGzGe.exe
  2⤵
  PID:11040
- C:\Windows\System\iSSkBzE.exe
  C:\Windows\System\iSSkBzE.exe
  2⤵
  PID:11100
- C:\Windows\System\NNZRKvl.exe
  C:\Windows\System\NNZRKvl.exe
  2⤵
  PID:10272
- C:\Windows\System\rtQUudL.exe
  C:\Windows\System\rtQUudL.exe
  2⤵
  PID:6528
- C:\Windows\System\SquPTMt.exe
  C:\Windows\System\SquPTMt.exe
  2⤵
  PID:10984
- C:\Windows\System\eWUkhYX.exe
  C:\Windows\System\eWUkhYX.exe
  2⤵
  PID:11224
- C:\Windows\System\zJBhacB.exe
  C:\Windows\System\zJBhacB.exe
  2⤵
  PID:11096
- C:\Windows\System\OsYEYvx.exe
  C:\Windows\System\OsYEYvx.exe
  2⤵
  PID:11284
- C:\Windows\System\zJjDTiC.exe
  C:\Windows\System\zJjDTiC.exe
  2⤵
  PID:11312
- C:\Windows\System\fOHhBdm.exe
  C:\Windows\System\fOHhBdm.exe
  2⤵
  PID:11348
- C:\Windows\System\OnncMJs.exe
  C:\Windows\System\OnncMJs.exe
  2⤵
  PID:11380
- C:\Windows\System\bStvFyp.exe
  C:\Windows\System\bStvFyp.exe
  2⤵
  PID:11404
- C:\Windows\System\XumDDBn.exe
  C:\Windows\System\XumDDBn.exe
  2⤵
  PID:11432
- C:\Windows\System\rffbblm.exe
  C:\Windows\System\rffbblm.exe
  2⤵
  PID:11460
- C:\Windows\System\iynQBSZ.exe
  C:\Windows\System\iynQBSZ.exe
  2⤵
  PID:11488
- C:\Windows\System\TPgTZBJ.exe
  C:\Windows\System\TPgTZBJ.exe
  2⤵
  PID:11516
- C:\Windows\System\kseSuLy.exe
  C:\Windows\System\kseSuLy.exe
  2⤵
  PID:11540
- C:\Windows\System\hqOESEL.exe
  C:\Windows\System\hqOESEL.exe
  2⤵
  PID:11572
- C:\Windows\System\vbIYLNq.exe
  C:\Windows\System\vbIYLNq.exe
  2⤵
  PID:11592
- C:\Windows\System\OnNAxCg.exe
  C:\Windows\System\OnNAxCg.exe
  2⤵
  PID:11620
- C:\Windows\System\VGjNZIY.exe
  C:\Windows\System\VGjNZIY.exe
  2⤵
  PID:11656
- C:\Windows\System\ZlBKSuE.exe
  C:\Windows\System\ZlBKSuE.exe
  2⤵
  PID:11672
- C:\Windows\System\QTUrGlq.exe
  C:\Windows\System\QTUrGlq.exe
  2⤵
  PID:11700
- C:\Windows\System\RvRSnHH.exe
  C:\Windows\System\RvRSnHH.exe
  2⤵
  PID:11716
- C:\Windows\System\GcbiemV.exe
  C:\Windows\System\GcbiemV.exe
  2⤵
  PID:11744
- C:\Windows\System\cLKHaPN.exe
  C:\Windows\System\cLKHaPN.exe
  2⤵
  PID:11772
- C:\Windows\System\isvKVeh.exe
  C:\Windows\System\isvKVeh.exe
  2⤵
  PID:11796
- C:\Windows\System\huGxlbe.exe
  C:\Windows\System\huGxlbe.exe
  2⤵
  PID:11824
- C:\Windows\System\OOsBNkB.exe
  C:\Windows\System\OOsBNkB.exe
  2⤵
  PID:11860
- C:\Windows\System\HsbrUHq.exe
  C:\Windows\System\HsbrUHq.exe
  2⤵
  PID:11908
- C:\Windows\System\uczLNVW.exe
  C:\Windows\System\uczLNVW.exe
  2⤵
  PID:11940
- C:\Windows\System\hnxjFZO.exe
  C:\Windows\System\hnxjFZO.exe
  2⤵
  PID:11980
- C:\Windows\System\SmwCJZz.exe
  C:\Windows\System\SmwCJZz.exe
  2⤵
  PID:12000
- C:\Windows\System\VtkIiyI.exe
  C:\Windows\System\VtkIiyI.exe
  2⤵
  PID:12024
- C:\Windows\System\MdctIey.exe
  C:\Windows\System\MdctIey.exe
  2⤵
  PID:12044
- C:\Windows\System\xGMjtZm.exe
  C:\Windows\System\xGMjtZm.exe
  2⤵
  PID:12068
- C:\Windows\System\BapjGMX.exe
  C:\Windows\System\BapjGMX.exe
  2⤵
  PID:12100
- C:\Windows\System\EPxuDOB.exe
  C:\Windows\System\EPxuDOB.exe
  2⤵
  PID:12132
- C:\Windows\System\hVSimyU.exe
  C:\Windows\System\hVSimyU.exe
  2⤵
  PID:12168
- C:\Windows\System\BgqYMfJ.exe
  C:\Windows\System\BgqYMfJ.exe
  2⤵
  PID:12204
- C:\Windows\System\bJUCYjX.exe
  C:\Windows\System\bJUCYjX.exe
  2⤵
  PID:12232
- C:\Windows\System\SQFhjCF.exe
  C:\Windows\System\SQFhjCF.exe
  2⤵
  PID:12260
- C:\Windows\System\EiJOgbX.exe
  C:\Windows\System\EiJOgbX.exe
  2⤵
  PID:10500
- C:\Windows\System\WeqdCjv.exe
  C:\Windows\System\WeqdCjv.exe
  2⤵
  PID:11176
- C:\Windows\System\eSKJRbw.exe
  C:\Windows\System\eSKJRbw.exe
  2⤵
  PID:11344
- C:\Windows\System\RYxmkLg.exe
  C:\Windows\System\RYxmkLg.exe
  2⤵
  PID:11456
- C:\Windows\System\uVEhsoC.exe
  C:\Windows\System\uVEhsoC.exe
  2⤵
  PID:11476
- C:\Windows\System\gfnNeJF.exe
  C:\Windows\System\gfnNeJF.exe
  2⤵
  PID:11560
- C:\Windows\System\GulAwwR.exe
  C:\Windows\System\GulAwwR.exe
  2⤵
  PID:11644
- C:\Windows\System\HAVSHPU.exe
  C:\Windows\System\HAVSHPU.exe
  2⤵
  PID:11708
- C:\Windows\System\kmexluB.exe
  C:\Windows\System\kmexluB.exe
  2⤵
  PID:11692
- C:\Windows\System\nKmyksE.exe
  C:\Windows\System\nKmyksE.exe
  2⤵
  PID:11792
- C:\Windows\System\aSenyEl.exe
  C:\Windows\System\aSenyEl.exe
  2⤵
  PID:11848
- C:\Windows\System\jKGYKNV.exe
  C:\Windows\System\jKGYKNV.exe
  2⤵
  PID:11896
- C:\Windows\System\GwQTQIz.exe
  C:\Windows\System\GwQTQIz.exe
  2⤵
  PID:11988
- C:\Windows\System\UfIxtbu.exe
  C:\Windows\System\UfIxtbu.exe
  2⤵
  PID:12040
- C:\Windows\System\zkRreKr.exe
  C:\Windows\System\zkRreKr.exe
  2⤵
  PID:12108
- C:\Windows\System\hKMynKP.exe
  C:\Windows\System\hKMynKP.exe
  2⤵
  PID:12224
- C:\Windows\System\RGyuPbI.exe
  C:\Windows\System\RGyuPbI.exe
  2⤵
  PID:12280
- C:\Windows\System\NlPklHc.exe
  C:\Windows\System\NlPklHc.exe
  2⤵
  PID:11396
- C:\Windows\System\ctlBfVG.exe
  C:\Windows\System\ctlBfVG.exe
  2⤵
  PID:11500
- C:\Windows\System\CEexYVu.exe
  C:\Windows\System\CEexYVu.exe
  2⤵
  PID:11628
- C:\Windows\System\iWTetce.exe
  C:\Windows\System\iWTetce.exe
  2⤵
  PID:11808
- C:\Windows\System\WdJAXvi.exe
  C:\Windows\System\WdJAXvi.exe
  2⤵
  PID:12016
- C:\Windows\System\lsDtaEi.exe
  C:\Windows\System\lsDtaEi.exe
  2⤵
  PID:12156
- C:\Windows\System\AZiyOhN.exe
  C:\Windows\System\AZiyOhN.exe
  2⤵
  PID:12252
- C:\Windows\System\cytZCZP.exe
  C:\Windows\System\cytZCZP.exe
  2⤵
  PID:11552
- C:\Windows\System\WUgjWaM.exe
  C:\Windows\System\WUgjWaM.exe
  2⤵
  PID:11904
- C:\Windows\System\rRhrcMB.exe
  C:\Windows\System\rRhrcMB.exe
  2⤵
  PID:12216
- C:\Windows\System\NHBKUIo.exe
  C:\Windows\System\NHBKUIo.exe
  2⤵
  PID:12116
- C:\Windows\System\qZtPjgZ.exe
  C:\Windows\System\qZtPjgZ.exe
  2⤵
  PID:12316
- C:\Windows\System\Vdezssd.exe
  C:\Windows\System\Vdezssd.exe
  2⤵
  PID:12332
- C:\Windows\System\tUjtVJd.exe
  C:\Windows\System\tUjtVJd.exe
  2⤵
  PID:12352
- C:\Windows\System\lwiiLiK.exe
  C:\Windows\System\lwiiLiK.exe
  2⤵
  PID:12376
- C:\Windows\System\oIlVhDe.exe
  C:\Windows\System\oIlVhDe.exe
  2⤵
  PID:12412
- C:\Windows\System\BARNerN.exe
  C:\Windows\System\BARNerN.exe
  2⤵
  PID:12444
- C:\Windows\System\tofpWEP.exe
  C:\Windows\System\tofpWEP.exe
  2⤵
  PID:12484
- C:\Windows\System\BWZeffv.exe
  C:\Windows\System\BWZeffv.exe
  2⤵
  PID:12500
- C:\Windows\System\ppgPwpG.exe
  C:\Windows\System\ppgPwpG.exe
  2⤵
  PID:12532
- C:\Windows\System\KhUxTuG.exe
  C:\Windows\System\KhUxTuG.exe
  2⤵
  PID:12548
- C:\Windows\System\pwUqNzb.exe
  C:\Windows\System\pwUqNzb.exe
  2⤵
  PID:12576
- C:\Windows\System\fKuLFUP.exe
  C:\Windows\System\fKuLFUP.exe
  2⤵
  PID:12624
- C:\Windows\System\pbzlwSN.exe
  C:\Windows\System\pbzlwSN.exe
  2⤵
  PID:12652
- C:\Windows\System\xoFEAis.exe
  C:\Windows\System\xoFEAis.exe
  2⤵
  PID:12680
- C:\Windows\System\bPIqRTv.exe
  C:\Windows\System\bPIqRTv.exe
  2⤵
  PID:12708
- C:\Windows\System\qQEGpcB.exe
  C:\Windows\System\qQEGpcB.exe
  2⤵
  PID:12736
- C:\Windows\System\dEElFjt.exe
  C:\Windows\System\dEElFjt.exe
  2⤵
  PID:12764
- C:\Windows\System\aGKrouT.exe
  C:\Windows\System\aGKrouT.exe
  2⤵
  PID:12792
- C:\Windows\System\osUkYjw.exe
  C:\Windows\System\osUkYjw.exe
  2⤵
  PID:12820
- C:\Windows\System\XtDswFm.exe
  C:\Windows\System\XtDswFm.exe
  2⤵
  PID:12848
- C:\Windows\System\HIUOvjO.exe
  C:\Windows\System\HIUOvjO.exe
  2⤵
  PID:12864
- C:\Windows\System\tkbGCcG.exe
  C:\Windows\System\tkbGCcG.exe
  2⤵
  PID:12892
- C:\Windows\System\ggYEuEU.exe
  C:\Windows\System\ggYEuEU.exe
  2⤵
  PID:12920
- C:\Windows\System\ikyaTPE.exe
  C:\Windows\System\ikyaTPE.exe
  2⤵
  PID:12960
- C:\Windows\System\BllcOjW.exe
  C:\Windows\System\BllcOjW.exe
  2⤵
  PID:12976
- C:\Windows\System\nTUoYeY.exe
  C:\Windows\System\nTUoYeY.exe
  2⤵
  PID:13016
- C:\Windows\System\XByqPCq.exe
  C:\Windows\System\XByqPCq.exe
  2⤵
  PID:13036
- C:\Windows\System\wYxZhao.exe
  C:\Windows\System\wYxZhao.exe
  2⤵
  PID:13060
- C:\Windows\System\NsohPeo.exe
  C:\Windows\System\NsohPeo.exe
  2⤵
  PID:13088
- C:\Windows\System\ioLLqCb.exe
  C:\Windows\System\ioLLqCb.exe
  2⤵
  PID:13128
- C:\Windows\System\qQEkyAn.exe
  C:\Windows\System\qQEkyAn.exe
  2⤵
  PID:13148
- C:\Windows\System\NuIFOQp.exe
  C:\Windows\System\NuIFOQp.exe
  2⤵
  PID:13172
- C:\Windows\System\MSQfRoQ.exe
  C:\Windows\System\MSQfRoQ.exe
  2⤵
  PID:13204
- C:\Windows\System\yWnwkmY.exe
  C:\Windows\System\yWnwkmY.exe
  2⤵
  PID:13244
- C:\Windows\System\QApuHLc.exe
  C:\Windows\System\QApuHLc.exe
  2⤵
  PID:13260
- C:\Windows\System\vJEHxfV.exe
  C:\Windows\System\vJEHxfV.exe
  2⤵
  PID:13288
- C:\Windows\System\WHvOymf.exe
  C:\Windows\System\WHvOymf.exe
  2⤵
  PID:13304
- C:\Windows\System\JZcaGGW.exe
  C:\Windows\System\JZcaGGW.exe
  2⤵
  PID:12300
- C:\Windows\System\EUcySci.exe
  C:\Windows\System\EUcySci.exe
  2⤵
  PID:12348
- C:\Windows\System\LfkzppP.exe
  C:\Windows\System\LfkzppP.exe
  2⤵
  PID:12496
- C:\Windows\System\ASsGCrg.exe
  C:\Windows\System\ASsGCrg.exe
  2⤵
  PID:12556
- C:\Windows\System\PQbVQuv.exe
  C:\Windows\System\PQbVQuv.exe
  2⤵
  PID:12616
- C:\Windows\System\FfpcCnh.exe
  C:\Windows\System\FfpcCnh.exe
  2⤵
  PID:12664
- C:\Windows\System\CJmsMxO.exe
  C:\Windows\System\CJmsMxO.exe
  2⤵
  PID:12732
- C:\Windows\System\UWgXBxg.exe
  C:\Windows\System\UWgXBxg.exe
  2⤵
  PID:12788
- C:\Windows\System\hRGEAIo.exe
  C:\Windows\System\hRGEAIo.exe
  2⤵
  PID:12840
- C:\Windows\System\zCBixLB.exe
  C:\Windows\System\zCBixLB.exe
  2⤵
  PID:12952
- C:\Windows\System\ePkkpNG.exe
  C:\Windows\System\ePkkpNG.exe
  2⤵
  PID:13008
- C:\Windows\System\dPaUZMV.exe
  C:\Windows\System\dPaUZMV.exe
  2⤵
  PID:13080
- C:\Windows\System\rbnCRku.exe
  C:\Windows\System\rbnCRku.exe
  2⤵
  PID:13144
- C:\Windows\System\agTYJkk.exe
  C:\Windows\System\agTYJkk.exe
  2⤵
  PID:13224
- C:\Windows\System\oDRkxAB.exe
  C:\Windows\System\oDRkxAB.exe
  2⤵
  PID:13256
- C:\Windows\System\yJboRlC.exe
  C:\Windows\System\yJboRlC.exe
  2⤵
  PID:11760
- C:\Windows\System\WXOstqW.exe
  C:\Windows\System\WXOstqW.exe
  2⤵
  PID:12432
- C:\Windows\System\aIyLpcv.exe
  C:\Windows\System\aIyLpcv.exe
  2⤵
  PID:12620
- C:\Windows\System\SMimlZE.exe
  C:\Windows\System\SMimlZE.exe
  2⤵
  PID:12692
- C:\Windows\System\tSpYPmS.exe
  C:\Windows\System\tSpYPmS.exe
  2⤵
  PID:12904
- C:\Windows\System\UlMKrVO.exe
  C:\Windows\System\UlMKrVO.exe
  2⤵
  PID:13052
- C:\Windows\System\YZEhHvo.exe
  C:\Windows\System\YZEhHvo.exe
  2⤵
  PID:13236
- C:\Windows\System\tBVTQrb.exe
  C:\Windows\System\tBVTQrb.exe
  2⤵
  PID:12428
- C:\Windows\System\svDiQVp.exe
  C:\Windows\System\svDiQVp.exe
  2⤵
  PID:12844
- C:\Windows\System\qIHAbXV.exe
  C:\Windows\System\qIHAbXV.exe
  2⤵
  PID:13116
- C:\Windows\System\iiUBJAW.exe
  C:\Windows\System\iiUBJAW.exe
  2⤵
  PID:12092
- C:\Windows\System\YEjeRFs.exe
  C:\Windows\System\YEjeRFs.exe
  2⤵
  PID:12992
- C:\Windows\System\WXpbwQL.exe
  C:\Windows\System\WXpbwQL.exe
  2⤵
  PID:13332
- C:\Windows\System\QdVQHpD.exe
  C:\Windows\System\QdVQHpD.exe
  2⤵
  PID:13360
- C:\Windows\System\uaVQuKw.exe
  C:\Windows\System\uaVQuKw.exe
  2⤵
  PID:13388
- C:\Windows\System\QTcVkPO.exe
  C:\Windows\System\QTcVkPO.exe
  2⤵
  PID:13428
- C:\Windows\System\CAUznPw.exe
  C:\Windows\System\CAUznPw.exe
  2⤵
  PID:13452
- C:\Windows\System\dNQBwgW.exe
  C:\Windows\System\dNQBwgW.exe
  2⤵
  PID:13484
- C:\Windows\System\EfKaEKx.exe
  C:\Windows\System\EfKaEKx.exe
  2⤵
  PID:13500
- C:\Windows\System\khZVVys.exe
  C:\Windows\System\khZVVys.exe
  2⤵
  PID:13516
- C:\Windows\System\alYRnXA.exe
  C:\Windows\System\alYRnXA.exe
  2⤵
  PID:13536
- C:\Windows\System\xCNrulq.exe
  C:\Windows\System\xCNrulq.exe
  2⤵
  PID:13560
- C:\Windows\System\ODvjLJH.exe
  C:\Windows\System\ODvjLJH.exe
  2⤵
  PID:13604
- C:\Windows\System\XQINEPT.exe
  C:\Windows\System\XQINEPT.exe
  2⤵
  PID:13628
- C:\Windows\System\OdvLvIU.exe
  C:\Windows\System\OdvLvIU.exe
  2⤵
  PID:13664
- C:\Windows\System\ezpCfNl.exe
  C:\Windows\System\ezpCfNl.exe
  2⤵
  PID:13696
- C:\Windows\System\juDfgxY.exe
  C:\Windows\System\juDfgxY.exe
  2⤵
  PID:13720
- C:\Windows\System\biIbzkC.exe
  C:\Windows\System\biIbzkC.exe
  2⤵
  PID:13752
- C:\Windows\System\ZDcGIoF.exe
  C:\Windows\System\ZDcGIoF.exe
  2⤵
  PID:13780
- C:\Windows\System\zIzsPiv.exe
  C:\Windows\System\zIzsPiv.exe
  2⤵
  PID:13808
- C:\Windows\System\PbTTcdK.exe
  C:\Windows\System\PbTTcdK.exe
  2⤵
  PID:13848
- C:\Windows\System\tgcDDLg.exe
  C:\Windows\System\tgcDDLg.exe
  2⤵
  PID:13864
- C:\Windows\System\Izuazyp.exe
  C:\Windows\System\Izuazyp.exe
  2⤵
  PID:13896
- C:\Windows\System\bnIVUVA.exe
  C:\Windows\System\bnIVUVA.exe
  2⤵
  PID:13924
- C:\Windows\System\TVvxCpH.exe
  C:\Windows\System\TVvxCpH.exe
  2⤵
  PID:13960
- C:\Windows\System\VcDNhEM.exe
  C:\Windows\System\VcDNhEM.exe
  2⤵
  PID:13976
- C:\Windows\System\KzKTccD.exe
  C:\Windows\System\KzKTccD.exe
  2⤵
  PID:14008
- C:\Windows\System\pXQklYK.exe
  C:\Windows\System\pXQklYK.exe
  2⤵
  PID:14036
- C:\Windows\System\oARWMol.exe
  C:\Windows\System\oARWMol.exe
  2⤵
  PID:14060
- C:\Windows\System\SditJeh.exe
  C:\Windows\System\SditJeh.exe
  2⤵
  PID:14100
- C:\Windows\System\bfgGJJN.exe
  C:\Windows\System\bfgGJJN.exe
  2⤵
  PID:14120
- C:\Windows\System\izeGaie.exe
  C:\Windows\System\izeGaie.exe
  2⤵
  PID:14144
- C:\Windows\System\IbCsjgl.exe
  C:\Windows\System\IbCsjgl.exe
  2⤵
  PID:14168
- C:\Windows\System\ykFJiwY.exe
  C:\Windows\System\ykFJiwY.exe
  2⤵
  PID:14200
- C:\Windows\System\KUpGsJQ.exe
  C:\Windows\System\KUpGsJQ.exe
  2⤵
  PID:14228
- C:\Windows\System\nAckBiG.exe
  C:\Windows\System\nAckBiG.exe
  2⤵
  PID:14268
- C:\Windows\System\aWvPtgc.exe
  C:\Windows\System\aWvPtgc.exe
  2⤵
  PID:14292
- C:\Windows\System\RnpkCMW.exe
  C:\Windows\System\RnpkCMW.exe
  2⤵
  PID:14324
- C:\Windows\System\oorulyS.exe
  C:\Windows\System\oorulyS.exe
  2⤵
  PID:13168
- C:\Windows\System\yKACBtp.exe
  C:\Windows\System\yKACBtp.exe
  2⤵
  PID:13380
- C:\Windows\System\pYhiqkK.exe
  C:\Windows\System\pYhiqkK.exe
  2⤵
  PID:13424
- C:\Windows\System\CZkIEep.exe
  C:\Windows\System\CZkIEep.exe
  2⤵
  PID:13472
- C:\Windows\System\YhIhdhS.exe
  C:\Windows\System\YhIhdhS.exe
  2⤵
  PID:13508
- C:\Windows\System\uZhOpeF.exe
  C:\Windows\System\uZhOpeF.exe
  2⤵
  PID:13616
- C:\Windows\System\EQPSfEs.exe
  C:\Windows\System\EQPSfEs.exe
  2⤵
  PID:13744
- C:\Windows\System\bfCxebl.exe
  C:\Windows\System\bfCxebl.exe
  2⤵
  PID:13768
- C:\Windows\System\rDelCWm.exe
  C:\Windows\System\rDelCWm.exe
  2⤵
  PID:13824
- C:\Windows\System\tvCEjbN.exe
  C:\Windows\System\tvCEjbN.exe
  2⤵
  PID:13912
- C:\Windows\System\CYwISdy.exe
  C:\Windows\System\CYwISdy.exe
  2⤵
  PID:13944
- C:\Windows\System\ljvpSYu.exe
  C:\Windows\System\ljvpSYu.exe
  2⤵
  PID:14044
- C:\Windows\System\WnrMmjI.exe
  C:\Windows\System\WnrMmjI.exe
  2⤵
  PID:14088
- C:\Windows\System\KjTcrTd.exe
  C:\Windows\System\KjTcrTd.exe
  2⤵
  PID:14176
- C:\Windows\System\QPWBarA.exe
  C:\Windows\System\QPWBarA.exe
  2⤵
  PID:14212
- C:\Windows\System\RBxwkqb.exe
  C:\Windows\System\RBxwkqb.exe
  2⤵
  PID:14240
- C:\Windows\System\LpSfWxL.exe
  C:\Windows\System\LpSfWxL.exe
  2⤵
  PID:13324
- C:\Windows\System\RwheAcW.exe
  C:\Windows\System\RwheAcW.exe
  2⤵
  PID:13400
- C:\Windows\System\Caznsit.exe
  C:\Windows\System\Caznsit.exe
  2⤵
  PID:13436
- C:\Windows\System\lXkIrnS.exe
  C:\Windows\System\lXkIrnS.exe
  2⤵
  PID:13624
- C:\Windows\System\trpdFGY.exe
  C:\Windows\System\trpdFGY.exe
  2⤵
  PID:13888
- C:\Windows\System\CoRlhzJ.exe
  C:\Windows\System\CoRlhzJ.exe
  2⤵
  PID:14128
- C:\Windows\System\TWqJeQv.exe
  C:\Windows\System\TWqJeQv.exe
  2⤵
  PID:14192
- C:\Windows\System\TjrClEy.exe
  C:\Windows\System\TjrClEy.exe
  2⤵
  PID:13588
- C:\Windows\System\PIOfBOp.exe
  C:\Windows\System\PIOfBOp.exe
  2⤵
  PID:13800
- C:\Windows\System\FylAvbc.exe
  C:\Windows\System\FylAvbc.exe
  2⤵
  PID:13992
- C:\Windows\System\QEquGPl.exe
  C:\Windows\System\QEquGPl.exe
  2⤵
  PID:14300
- C:\Windows\System\roKmxQz.exe
  C:\Windows\System\roKmxQz.exe
  2⤵
  PID:14092
- C:\Windows\System\cOkJhfW.exe
  C:\Windows\System\cOkJhfW.exe
  2⤵
  PID:14368
- C:\Windows\System\zxttrYd.exe
  C:\Windows\System\zxttrYd.exe
  2⤵
  PID:14404
- C:\Windows\System\rsDrkgu.exe
  C:\Windows\System\rsDrkgu.exe
  2⤵
  PID:14420
- C:\Windows\System\mgWfiwU.exe
  C:\Windows\System\mgWfiwU.exe
  2⤵
  PID:14448
- C:\Windows\System\gtwKDEZ.exe
  C:\Windows\System\gtwKDEZ.exe
  2⤵
  PID:14476
- C:\Windows\System\MGWQOlA.exe
  C:\Windows\System\MGWQOlA.exe
  2⤵
  PID:14508
- C:\Windows\System\GQUxzsX.exe
  C:\Windows\System\GQUxzsX.exe
  2⤵
  PID:14544
- C:\Windows\System\ynNlZUP.exe
  C:\Windows\System\ynNlZUP.exe
  2⤵
  PID:14572
- C:\Windows\System\JDMBqxu.exe
  C:\Windows\System\JDMBqxu.exe
  2⤵
  PID:14588
- C:\Windows\System\oCvWopw.exe
  C:\Windows\System\oCvWopw.exe
  2⤵
  PID:14616
- C:\Windows\System\LmgYHoh.exe
  C:\Windows\System\LmgYHoh.exe
  2⤵
  PID:14632
- C:\Windows\System\JHKxgnN.exe
  C:\Windows\System\JHKxgnN.exe
  2⤵
  PID:14648
- C:\Windows\System\vExqEYd.exe
  C:\Windows\System\vExqEYd.exe
  2⤵
  PID:14712
- C:\Windows\System\ZDkQbhb.exe
  C:\Windows\System\ZDkQbhb.exe
  2⤵
  PID:14740
- C:\Windows\System\lzaJdXy.exe
  C:\Windows\System\lzaJdXy.exe
  2⤵
  PID:14756
- C:\Windows\System\IousXRC.exe
  C:\Windows\System\IousXRC.exe
  2⤵
  PID:14784
- C:\Windows\System\PsmFLdO.exe
  C:\Windows\System\PsmFLdO.exe
  2⤵
  PID:14812
- C:\Windows\System\ptNSdfV.exe
  C:\Windows\System\ptNSdfV.exe
  2⤵
  PID:14848
- C:\Windows\System\xKOOyJQ.exe
  C:\Windows\System\xKOOyJQ.exe
  2⤵
  PID:14876
- C:\Windows\System\dOMQlpr.exe
  C:\Windows\System\dOMQlpr.exe
  2⤵
  PID:14900
- C:\Windows\System\BeCfNvA.exe
  C:\Windows\System\BeCfNvA.exe
  2⤵
  PID:14936
- C:\Windows\System\vdMzGFC.exe
  C:\Windows\System\vdMzGFC.exe
  2⤵
  PID:14952
- C:\Windows\System\AjFNTFA.exe
  C:\Windows\System\AjFNTFA.exe
  2⤵
  PID:14980
- C:\Windows\System\FblZgSH.exe
  C:\Windows\System\FblZgSH.exe
  2⤵
  PID:15020
- C:\Windows\System\KbCiitl.exe
  C:\Windows\System\KbCiitl.exe
  2⤵
  PID:15036
- C:\Windows\System\rCqysAi.exe
  C:\Windows\System\rCqysAi.exe
  2⤵
  PID:15076
- C:\Windows\System\xzaHyTm.exe
  C:\Windows\System\xzaHyTm.exe
  2⤵
  PID:15092
- C:\Windows\System\dwhoABb.exe
  C:\Windows\System\dwhoABb.exe
  2⤵
  PID:15128
- C:\Windows\System\sNOAktJ.exe
  C:\Windows\System\sNOAktJ.exe
  2⤵
  PID:15160
- C:\Windows\System\DznXCKB.exe
  C:\Windows\System\DznXCKB.exe
  2⤵
  PID:15188
- C:\Windows\System\xobPFbg.exe
  C:\Windows\System\xobPFbg.exe
  2⤵
  PID:15220
- C:\Windows\System\nqSdhmT.exe
  C:\Windows\System\nqSdhmT.exe
  2⤵
  PID:15248
- C:\Windows\System\FtdYbCB.exe
  C:\Windows\System\FtdYbCB.exe
  2⤵
  PID:15276
- C:\Windows\System\hSDNdMj.exe
  C:\Windows\System\hSDNdMj.exe
  2⤵
  PID:15304
- C:\Windows\System\PYGpNfY.exe
  C:\Windows\System\PYGpNfY.exe
  2⤵
  PID:15320
- C:\Windows\System\qqWHYJs.exe
  C:\Windows\System\qqWHYJs.exe
  2⤵
  PID:13904
- C:\Windows\System\yMLbuIc.exe
  C:\Windows\System\yMLbuIc.exe
  2⤵
  PID:14376
- C:\Windows\System\CtIhBDi.exe
  C:\Windows\System\CtIhBDi.exe
  2⤵
  PID:14412
- C:\Windows\System\kuBFfwD.exe
  C:\Windows\System\kuBFfwD.exe
  2⤵
  PID:14516
- C:\Windows\System\MnpORMG.exe
  C:\Windows\System\MnpORMG.exe
  2⤵
  PID:14536
- C:\Windows\System\SenLIvB.exe
  C:\Windows\System\SenLIvB.exe
  2⤵
  PID:14600
- C:\Windows\System\JZoYMnV.exe
  C:\Windows\System\JZoYMnV.exe
  2⤵
  PID:14664
- C:\Windows\System\rlmDemr.exe
  C:\Windows\System\rlmDemr.exe
  2⤵
  PID:14736
- C:\Windows\System\iTBAXcd.exe
  C:\Windows\System\iTBAXcd.exe
  2⤵
  PID:14800
- C:\Windows\System\OTWkStf.exe
  C:\Windows\System\OTWkStf.exe
  2⤵
  PID:14868
- C:\Windows\System\ruYiHGU.exe
  C:\Windows\System\ruYiHGU.exe
  2⤵
  PID:14928
- C:\Windows\System\nPzkmvE.exe
  C:\Windows\System\nPzkmvE.exe
  2⤵
  PID:15012
- C:\Windows\System\sDHPdYi.exe
  C:\Windows\System\sDHPdYi.exe
  2⤵
  PID:15072
- C:\Windows\System\ZoLnAmf.exe
  C:\Windows\System\ZoLnAmf.exe
  2⤵
  PID:15140
- C:\Windows\System\CzgjMrv.exe
  C:\Windows\System\CzgjMrv.exe
  2⤵
  PID:15176
- C:\Windows\System\TRbilfD.exe
  C:\Windows\System\TRbilfD.exe
  2⤵
  PID:15264
- C:\Windows\System\UJdffHK.exe
  C:\Windows\System\UJdffHK.exe
  2⤵
  PID:15316
- C:\Windows\System\koKSdKj.exe
  C:\Windows\System\koKSdKj.exe
  2⤵
  PID:13712
- C:\Windows\System\PaWsgGz.exe
  C:\Windows\System\PaWsgGz.exe
  2⤵
  PID:14540
- C:\Windows\System\pZqKvMI.exe
  C:\Windows\System\pZqKvMI.exe
  2⤵
  PID:14624
- C:\Windows\System\QGuecmf.exe
  C:\Windows\System\QGuecmf.exe
  2⤵
  PID:14772
- C:\Windows\System\gCVZzbW.exe
  C:\Windows\System\gCVZzbW.exe
  2⤵
  PID:14924
- C:\Windows\System\MkjNlIj.exe
  C:\Windows\System\MkjNlIj.exe
  2⤵
  PID:15032
- C:\Windows\System\fCpSPqU.exe
  C:\Windows\System\fCpSPqU.exe
  2⤵
  PID:15260
- C:\Windows\System\UHMweFu.exe
  C:\Windows\System\UHMweFu.exe
  2⤵
  PID:14348
- C:\Windows\System\WAfFbtF.exe
  C:\Windows\System\WAfFbtF.exe
  2⤵
  PID:14604
- C:\Windows\System\xaGKczo.exe
  C:\Windows\System\xaGKczo.exe
  2⤵
  PID:15172
- C:\Windows\System\jkLeTWs.exe
  C:\Windows\System\jkLeTWs.exe
  2⤵
  PID:15344
- C:\Windows\System\yIGKusZ.exe
  C:\Windows\System\yIGKusZ.exe
  2⤵
  PID:15120
- C:\Windows\System\lbhySKG.exe
  C:\Windows\System\lbhySKG.exe
  2⤵
  PID:15412
- C:\Windows\System\DomCuNm.exe
  C:\Windows\System\DomCuNm.exe
  2⤵
  PID:15440
- C:\Windows\System\deDTZUi.exe
  C:\Windows\System\deDTZUi.exe
  2⤵
  PID:15468
- C:\Windows\System\luqogsj.exe
  C:\Windows\System\luqogsj.exe
  2⤵
  PID:15496
- C:\Windows\System\zIZtavt.exe
  C:\Windows\System\zIZtavt.exe
  2⤵
  PID:15512
- C:\Windows\System\NSHSbNL.exe
  C:\Windows\System\NSHSbNL.exe
  2⤵
  PID:15552
- C:\Windows\System\qOWPmOH.exe
  C:\Windows\System\qOWPmOH.exe
  2⤵
  PID:15588
- C:\Windows\System\xlDRHDK.exe
  C:\Windows\System\xlDRHDK.exe
  2⤵
  PID:15604
- C:\Windows\System\mWuVRSC.exe
  C:\Windows\System\mWuVRSC.exe
  2⤵
  PID:15632
- C:\Windows\System\LCuCMDi.exe
  C:\Windows\System\LCuCMDi.exe
  2⤵
  PID:15656
- C:\Windows\System\FUZjYpv.exe
  C:\Windows\System\FUZjYpv.exe
  2⤵
  PID:15700
- C:\Windows\System\hUzPjeH.exe
  C:\Windows\System\hUzPjeH.exe
  2⤵
  PID:15744
- C:\Windows\System\tiDRfdu.exe
  C:\Windows\System\tiDRfdu.exe
  2⤵
  PID:15760
- C:\Windows\System\GRmUeHi.exe
  C:\Windows\System\GRmUeHi.exe
  2⤵
  PID:15788
- C:\Windows\System\hNLDlBp.exe
  C:\Windows\System\hNLDlBp.exe
  2⤵
  PID:15840
- C:\Windows\System\lutmSUx.exe
  C:\Windows\System\lutmSUx.exe
  2⤵
  PID:15860
- C:\Windows\System\jqMGDOQ.exe
  C:\Windows\System\jqMGDOQ.exe
  2⤵
  PID:15904
- C:\Windows\System\GfJJInL.exe
  C:\Windows\System\GfJJInL.exe
  2⤵
  PID:15932
- C:\Windows\System\QZPifeg.exe
  C:\Windows\System\QZPifeg.exe
  2⤵
  PID:15964
- C:\Windows\System\ogHMoeT.exe
  C:\Windows\System\ogHMoeT.exe
  2⤵
  PID:15992
- C:\Windows\System\rVekNJS.exe
  C:\Windows\System\rVekNJS.exe
  2⤵
  PID:16020
- C:\Windows\System\FzbAEdS.exe
  C:\Windows\System\FzbAEdS.exe
  2⤵
  PID:16036
- C:\Windows\System\QPjPwwC.exe
  C:\Windows\System\QPjPwwC.exe
  2⤵
  PID:16052
- C:\Windows\System\oSkWKjq.exe
  C:\Windows\System\oSkWKjq.exe
  2⤵
  PID:16096
- C:\Windows\System\XZJycZM.exe
  C:\Windows\System\XZJycZM.exe
  2⤵
  PID:16128
- C:\Windows\System\JxMENly.exe
  C:\Windows\System\JxMENly.exe
  2⤵
  PID:16160
- C:\Windows\System\rlEMCVP.exe
  C:\Windows\System\rlEMCVP.exe
  2⤵
  PID:16180
- C:\Windows\System\bYktEIG.exe
  C:\Windows\System\bYktEIG.exe
  2⤵
  PID:16204
- C:\Windows\System\uzlOevR.exe
  C:\Windows\System\uzlOevR.exe
  2⤵
  PID:16232
- C:\Windows\System\TyQOLWJ.exe
  C:\Windows\System\TyQOLWJ.exe
  2⤵
  PID:16260
- C:\Windows\System\XXEASOB.exe
  C:\Windows\System\XXEASOB.exe
  2⤵
  PID:16300
- C:\Windows\System\EsVmCdp.exe
  C:\Windows\System\EsVmCdp.exe
  2⤵
  PID:16316
- C:\Windows\System\XKgonTs.exe
  C:\Windows\System\XKgonTs.exe
  2⤵
  PID:16340
- C:\Windows\System\KPPHzck.exe
  C:\Windows\System\KPPHzck.exe
  2⤵
  PID:16372
- C:\Windows\System\ZeOPXAm.exe
  C:\Windows\System\ZeOPXAm.exe
  2⤵
  PID:15404
- C:\Windows\System\wQCdOFQ.exe
  C:\Windows\System\wQCdOFQ.exe
  2⤵
  PID:15408
- C:\Windows\System\FDFtqQe.exe
  C:\Windows\System\FDFtqQe.exe
  2⤵
  PID:15464
- C:\Windows\System\oBjGpBs.exe
  C:\Windows\System\oBjGpBs.exe
  2⤵
  PID:15596
- C:\Windows\System\FVgKcfJ.exe
  C:\Windows\System\FVgKcfJ.exe
  2⤵
  PID:15640
- C:\Windows\System\jpvJNEP.exe
  C:\Windows\System\jpvJNEP.exe
  2⤵
  PID:15732
- C:\Windows\System\ewlHXoS.exe
  C:\Windows\System\ewlHXoS.exe
  2⤵
  PID:464
- C:\Windows\System\IdDqlyU.exe
  C:\Windows\System\IdDqlyU.exe
  2⤵
  PID:15776
- C:\Windows\System\jJqqblc.exe
  C:\Windows\System\jJqqblc.exe
  2⤵
  PID:15848
- C:\Windows\System\TdIiBkv.exe
  C:\Windows\System\TdIiBkv.exe
  2⤵
  PID:15928
- C:\Windows\System\WrDgFJH.exe
  C:\Windows\System\WrDgFJH.exe
  2⤵
  PID:16008
- C:\Windows\System\LDxMCdU.exe
  C:\Windows\System\LDxMCdU.exe
  2⤵
  PID:16048
- C:\Windows\System\SscfmFY.exe
  C:\Windows\System\SscfmFY.exe
  2⤵
  PID:16104
- C:\Windows\System\zCwlKyI.exe
  C:\Windows\System\zCwlKyI.exe
  2⤵
  PID:16176
- C:\Windows\System\mPCABVA.exe
  C:\Windows\System\mPCABVA.exe
  2⤵
  PID:16280
- C:\Windows\System\NSKuuqE.exe
  C:\Windows\System\NSKuuqE.exe
  2⤵
  PID:16312
- C:\Windows\System\NMEJLdR.exe
  C:\Windows\System\NMEJLdR.exe
  2⤵
  PID:16352
- C:\Windows\System\dLLJWsb.exe
  C:\Windows\System\dLLJWsb.exe
  2⤵
  PID:15400
- C:\Windows\System\NKjSaJr.exe
  C:\Windows\System\NKjSaJr.exe
  2⤵
  PID:15528
- C:\Windows\System\qFHrYox.exe
  C:\Windows\System\qFHrYox.exe
  2⤵
  PID:15708
- C:\Windows\System\iJZgGZo.exe
  C:\Windows\System\iJZgGZo.exe
  2⤵
  PID:15832
- C:\Windows\System\cdmtLbo.exe
  C:\Windows\System\cdmtLbo.exe
  2⤵
  PID:16080
- C:\Windows\System\UfwThHe.exe
  C:\Windows\System\UfwThHe.exe
  2⤵
  PID:16220
- C:\Windows\System\CaGKASM.exe
  C:\Windows\System\CaGKASM.exe
  2⤵
  PID:16328
- C:\Windows\System\aflgnqw.exe
  C:\Windows\System\aflgnqw.exe
  2⤵
  PID:15624
- C:\Windows\System\nAAREaU.exe
  C:\Windows\System\nAAREaU.exe
  2⤵
  PID:16032
- C:\Windows\System\yIobsmQ.exe
  C:\Windows\System\yIobsmQ.exe
  2⤵
  PID:16360
- C:\Windows\System\wTqLYyp.exe
  C:\Windows\System\wTqLYyp.exe
  2⤵
  PID:15652
- C:\Windows\System\JanwFJF.exe
  C:\Windows\System\JanwFJF.exe
  2⤵
  PID:16408
- C:\Windows\System\KTkriai.exe
  C:\Windows\System\KTkriai.exe
  2⤵
  PID:16428
- C:\Windows\System\HCWqIcT.exe
  C:\Windows\System\HCWqIcT.exe
  2⤵
  PID:16460
- C:\Windows\System\GzNcXkW.exe
  C:\Windows\System\GzNcXkW.exe
  2⤵
  PID:16500
- C:\Windows\System\XjbUgGy.exe
  C:\Windows\System\XjbUgGy.exe
  2⤵
  PID:16528
- C:\Windows\System\PGJjWQv.exe
  C:\Windows\System\PGJjWQv.exe
  2⤵
  PID:16576
- C:\Windows\System\ZEDBLfc.exe
  C:\Windows\System\ZEDBLfc.exe
  2⤵
  PID:16604
- C:\Windows\System\XrHDJZz.exe
  C:\Windows\System\XrHDJZz.exe
  2⤵
  PID:16632
- C:\Windows\System\pGvrtXb.exe
  C:\Windows\System\pGvrtXb.exe
  2⤵
  PID:16660
- C:\Windows\System\XjOWXHg.exe
  C:\Windows\System\XjOWXHg.exe
  2⤵
  PID:16680
- C:\Windows\System\NvcGQgf.exe
  C:\Windows\System\NvcGQgf.exe
  2⤵
  PID:16704
- C:\Windows\System\KOjnurf.exe
  C:\Windows\System\KOjnurf.exe
  2⤵
  PID:16728
- C:\Windows\System\CiwaULF.exe
  C:\Windows\System\CiwaULF.exe
  2⤵
  PID:16760
- C:\Windows\System\AbXVXQb.exe
  C:\Windows\System\AbXVXQb.exe
  2⤵
  PID:16776
- C:\Windows\System\qPHMEAl.exe
  C:\Windows\System\qPHMEAl.exe
  2⤵
  PID:16804
- C:\Windows\System\WADiiOC.exe
  C:\Windows\System\WADiiOC.exe
  2⤵
  PID:16840
- C:\Windows\System\vpwbJnd.exe
  C:\Windows\System\vpwbJnd.exe
  2⤵
  PID:16900
- C:\Windows\System\fPMoCQT.exe
  C:\Windows\System\fPMoCQT.exe
  2⤵
  PID:16920
- C:\Windows\System\tytvWKc.exe
  C:\Windows\System\tytvWKc.exe
  2⤵
  PID:16940
- C:\Windows\System\oASoWov.exe
  C:\Windows\System\oASoWov.exe
  2⤵
  PID:16956
- C:\Windows\System\vjBzZVA.exe
  C:\Windows\System\vjBzZVA.exe
  2⤵
  PID:16980
- C:\Windows\System\EFtzvrA.exe
  C:\Windows\System\EFtzvrA.exe
  2⤵
  PID:17008
- C:\Windows\System\sXrezBO.exe
  C:\Windows\System\sXrezBO.exe
  2⤵
  PID:17040
- C:\Windows\System\ZMBXGgS.exe
  C:\Windows\System\ZMBXGgS.exe
  2⤵
  PID:17060
- C:\Windows\System\aAnNFHd.exe
  C:\Windows\System\aAnNFHd.exe
  2⤵
  PID:17088
- C:\Windows\System\sEoDiYo.exe
  C:\Windows\System\sEoDiYo.exe
  2⤵
  PID:17112
- C:\Windows\System\fQoCalk.exe
  C:\Windows\System\fQoCalk.exe
  2⤵
  PID:17144
- C:\Windows\System\jogSBsF.exe
  C:\Windows\System\jogSBsF.exe
  2⤵
  PID:17172
- C:\Windows\System\YTqadvb.exe
  C:\Windows\System\YTqadvb.exe
  2⤵
  PID:17228
- C:\Windows\System\PuSVbHm.exe
  C:\Windows\System\PuSVbHm.exe
  2⤵
  PID:17268
- C:\Windows\System\HBglxmH.exe
  C:\Windows\System\HBglxmH.exe
  2⤵
  PID:17300
- C:\Windows\System\ppQUclH.exe
  C:\Windows\System\ppQUclH.exe
  2⤵
  PID:17344
- C:\Windows\System\IHPkvIy.exe
  C:\Windows\System\IHPkvIy.exe
  2⤵
  PID:17388
- C:\Windows\System\aZdvpiu.exe
  C:\Windows\System\aZdvpiu.exe
  2⤵
  PID:16392
- C:\Windows\System\bivfmfM.exe
  C:\Windows\System\bivfmfM.exe
  2⤵
  PID:16424
- C:\Windows\System\okAivxf.exe
  C:\Windows\System\okAivxf.exe
  2⤵
  PID:16564
- C:\Windows\System\DXTKjiQ.exe
  C:\Windows\System\DXTKjiQ.exe
  2⤵
  PID:16668
- C:\Windows\System\lWRNoYQ.exe
  C:\Windows\System\lWRNoYQ.exe
  2⤵
  PID:16740
- C:\Windows\System\jugTQFr.exe
  C:\Windows\System\jugTQFr.exe
  2⤵
  PID:16824

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CTujwwO.exe

Path C:\Windows\System\CTujwwO.exe
Size 1.7MB
SHA256 fed8cbc5d667f9646db3618ae5ea5c69c426ea44e05a45da8b97b0f13ffa9d62
MD5 b99b2880691045756f122e803f1f714f
SHA1 501743fea57c3cd05e28d08fa3affc414b6f7403
SHA512 9e1b64c671ff2e0f9f8dbef3090d3639e2a745531a542dfd05a0c351570bc9c0fd4225562e0c0c29a477c9a302fd3ef19bbaa1aafa256896f07b69973b02c80d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02T:GemTLkNdfE0pZaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CZeyLZe.exe

Path C:\Windows\System\CZeyLZe.exe
Size 1.7MB
SHA256 06d8ba84eaf3b7a677103b3fa06faae60fd0875b0b3a8f681c0fb0825780c927
MD5 db5aaea4872fd5c0812428848cdd2f8f
SHA1 44c9fc5b356652fbee515bca57179ec477b00098
SHA512 027f247e187c8a9b4ff194fcebde74dcd7a9a86fef47e56255b53f5f95501e49408401abb4bbe7583181506b08b6f42cb9a8f0a08e9d08a5dc09df08239b6039
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02D:GemTLkNdfE0pZaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

CfWXdHJ.exe

Path C:\Windows\System\CfWXdHJ.exe
Size 1.7MB
SHA256 84fc2f78be46bb2cb6a06e0a041bdd96bb266fdef6fea81633f62cd0cb418cb0
MD5 64ea13e781006e8721094f50d2a0dcba
SHA1 393598b76213a165417e553af2e6ad06661ee44e
SHA512 99355e5ed43483eb90141dd874e3a2828019a9f63d9d66fa147fdbe9661b27b6bc661ddc3fe4acf326d1328a705d0789e42c71edecf0b70ff5675891291d7cdd
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02a:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

DZkpjiI.exe

Path C:\Windows\System\DZkpjiI.exe
Size 1.7MB
SHA256 01a40210247ce6698a29b700d1c12002217632015efe0303cf3d9b8b338de1ec
MD5 68947c3a4ebd70c7aaa14075cde100d6
SHA1 3067c7aa359d04e1a17b46a361b3f1ff00b9f197
SHA512 f05341014b7b6e493cfab6a849c840c301ea96f3b2efbf1aeb43c49f7a5babcc65b67c29cc2562ec0dd00fb2dd8cc2744bc21cea4b464c96a816396a313ed998
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02V:GemTLkNdfE0pZa7
MD5 SHA1 SHA512 SSDEEP

Submit Download

EXDWGyh.exe

Path C:\Windows\System\EXDWGyh.exe
Size 1.7MB
SHA256 43ad794a3069f8dad8bcbd5591083be0c1678783accbf0d941863def999d7f16
MD5 215519479cc396bed3b45d23766aba60
SHA1 7430bc98d1da5478ce6d9ca3d40b3b8567ab8c7f
SHA512 6d65728509bd92857785661745604f3edc8c60509e03b7bb32049dce984aa3b80cfe571d19dc0a766d1c1c2283957196f69d57f3a1191dffd92790a824625985
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02g:GemTLkNdfE0pZae
MD5 SHA1 SHA512 SSDEEP

Submit Download

FOrvzNB.exe

Path C:\Windows\System\FOrvzNB.exe
Size 1.7MB
SHA256 91be73943fdd93f88b0260348b8b467e677ba98b23bc47cdeaaae29148493a56
MD5 a9ddb9eb18397d10581df99c18c89c71
SHA1 59829c09c018a193bf03e7338a726bf4b4f911bc
SHA512 03b1dc78fe55877c5830a90f080cc8659fa53fecf13b0e11ada9540f8b03d3db7ffd4ce9b417b2c07c2bee81f7be0267934b539833947cda7c10aa7a5dc5e338
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02W:GemTLkNdfE0pZaI
MD5 SHA1 SHA512 SSDEEP

Submit Download

JGCgEFp.exe

Path C:\Windows\System\JGCgEFp.exe
Size 1.7MB
SHA256 bfc2b69c487265a9ff9cf5d0cab53a6c7ad32e9feab3cbf910bf6b10e02745ac
MD5 26f56d81655efd18ae9d5ff57a9da897
SHA1 cbb62602a796d70c8e3fe0013c0144ecaa852d89
SHA512 9ae1cd9556932c80f2a7483240a79e7111c6d8d25c0cbcf0becb4042fedcd0629e98efb95f4e02622873a77962312f840e36bafbdf855b57f4fe6a95664c5058
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02n:GemTLkNdfE0pZa5
MD5 SHA1 SHA512 SSDEEP

Submit Download

JPOOdrh.exe

Path C:\Windows\System\JPOOdrh.exe
Size 1.7MB
SHA256 ecb440213c6e4d984ab083489a39641e15aabeeecabb8859ce9b54739b083327
MD5 f8b2ec81a8cff4458ffc848f469e9a6d
SHA1 7821a099e990b72f1be0c246816bc9194626791a
SHA512 611e961bc2ead2257f0173677908a50d31b759b0b5dbd4e1666ff9110306a7a68817bf77d4dc206cf57c239719e75f0ac24cadbf2c78b9ca978a962cac7b0c7c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc027:GemTLkNdfE0pZat
MD5 SHA1 SHA512 SSDEEP

Submit Download

JiDOVtM.exe

Path C:\Windows\System\JiDOVtM.exe
Size 1.7MB
SHA256 aba8ec77dd0c8db6d6cb24e0c22f8e3e29a191df77c11014b11b5ec08ab9a7b3
MD5 20a87049a56ec79cdd84ec4010c8b6ba
SHA1 0d89ecbb935009b77573dd7d5be26434c3094216
SHA512 161dab044faec074a46b1484d7fb449a05b9826648ab95025fb085b8b9719cb1c0c2d1f298fff6908e65c9047ea59ad77c1410c28a8e25088182d69083302780
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02a:GemTLkNdfE0pZaQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

QocoaXa.exe

Path C:\Windows\System\QocoaXa.exe
Size 1.7MB
SHA256 96220381d8a802ab6116de85b839af883ed367a34e5c16426b31c471b51145f6
MD5 fefff1285ee18d0a9558a8962638de56
SHA1 b07df98dbd7ab61a82b80d882862e55751b7952f
SHA512 2547abf5cbe4f5b23aec0b2faf3bc8d58489a51a0f5852c901561a0cd69614b64285df5807ae637aa8cd40c3e55362ebc7f6ece8840b1175deeb74ea4ad08afa
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02Y:GemTLkNdfE0pZaq
MD5 SHA1 SHA512 SSDEEP

Submit Download

RvUmsMv.exe

Path C:\Windows\System\RvUmsMv.exe
Size 1.7MB
SHA256 445408b0323d21ca95cab4520997151d0dc9809b6ab76f8458b6b75861a821c8
MD5 f4b4d266a5fb1fff66b3fbab7746e679
SHA1 9852d7956bde6accbb57165ab51c0e9908c88cec
SHA512 ffc9082f2ab885ab0133835d975d30803f9a6cde9fb55951bff4acacb1359b9c674dca05b4854b71b2e91b737a1f4f8cc73d376522ff3fc4c61e038866af7743
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02D:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Submit Download

UkYzDcT.exe

Path C:\Windows\System\UkYzDcT.exe
Size 1.7MB
SHA256 bda29bc7ce47469dcc42301fe83f03b2e0edd2b3855e836d323e57d3e625dafd
MD5 bf203753103167a8b7d51df32f7b6352
SHA1 7627fa999484a5bb57a867c0d4e9e5b6720bff71
SHA512 2503e07110b6bd73d3c72f36619cf9499cc7d0894d2e59e5b83ffde2d0ce9ed7cd90c135bcbf91441e903b3c9069a642aa7bc6fe3caf77f1e34f30d6ce4d103e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02Q:GemTLkNdfE0pZaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

XZGZFEX.exe

Path C:\Windows\System\XZGZFEX.exe
Size 1.7MB
SHA256 6efc1550325868846758e096fffbe9972c244053ee59eec8dc34a2632abbe71d
MD5 0a8956c03cb3e93ad3c1518bb566c673
SHA1 6da0206711c6f5cd048863b16fb244c9be189fa1
SHA512 a40ac8c4593331c9c48f9519aedcd68c197b06e5e974102a2d1f146b054e9a07300fb7acb135518ff4cb8e257625d09c534b8e501b6cd7ac6d4512160f8274fe
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02+:GemTLkNdfE0pZa8
MD5 SHA1 SHA512 SSDEEP

Submit Download

XqHFEzj.exe

Path C:\Windows\System\XqHFEzj.exe
Size 1.7MB
SHA256 e4f1e66eb9644694cbbd7857ef1fad68b6da88044f0b685b48a32ed0715c21e1
MD5 7b4c011a353f30f3d206dec18f539c90
SHA1 79e6bb71ed02a174a961192180bcbf9a1e490c8b
SHA512 92a87b19b8ae59a4844eb1bcfbade557266e95418fc1d128d9346875edc692ad8272fdf07e6b2ba8b24d08394c12924589c52c59b1f28a4675ea4670c1466112
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02H:GemTLkNdfE0pZaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZZHfXPa.exe

Path C:\Windows\System\ZZHfXPa.exe
Size 1.7MB
SHA256 f0bee4415f5194830f3cc0e8a36cd6b33de1eca093cfceb08c3546b18a1a0183
MD5 90bf81f7533b3a4ec80e0de910179b53
SHA1 3b93951cc3db9b789a71f02e1be0f86afd9b7b1f
SHA512 67123e5172487a5172ee8140245c57b427b0fae0877e6fb086658a6253051cb97f41d345db57d810e4887a2903be98b2d4af63832a12673b3f6e5523c3512a69
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02W:GemTLkNdfE0pZa0
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZnFVhNT.exe

Path C:\Windows\System\ZnFVhNT.exe
Size 1.7MB
SHA256 018cc27c714b755339ba21a89c7d8668991f1f6af5f6a709876267246249831d
MD5 fe13b50145d111fe2a43ab41f8e18bb6
SHA1 75bf52d81ab04aa8bd42eb8b695bf720cb3f25d3
SHA512 0730fc0ce244c82b8f12f447f0f16d796beef3e6967beab45bba6b003f9d08a3e1e56a905e4aefe4268ae728b3250a34c27ff341c20e3739667634bb31fec56c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02u:GemTLkNdfE0pZas
MD5 SHA1 SHA512 SSDEEP

Submit Download

bsNnLrb.exe

Path C:\Windows\System\bsNnLrb.exe
Size 1.7MB
SHA256 34404011d07d8a63f7d5305c87b13c1c449a640a80c9abc488b72ecfef0758ac
MD5 cb0b072c2e72bb41c3d5cf435c257f4e
SHA1 c3f109d59489e7a1b9fa92e938007e995ac61465
SHA512 ee1f4e19d467d176a2ed15ab633aca907428ba3bc5dde97775aa64389fd3d5cceb95792a62776b285ac9f7fe7f9ed80eaa0578d029c968b19db8aa85e10bc74a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc023:GemTLkNdfE0pZa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

btuWmKy.exe

Path C:\Windows\System\btuWmKy.exe
Size 1.7MB
SHA256 032f1b53b28c9ea461327f2dc3cd4b47f02815fc14387eef9519a8b3d94bd082
MD5 432d8c3c209e98c99ae4412730035b15
SHA1 e415d79875a568fdda32d2506ebdca8fc532542b
SHA512 4d1e5d5f3806b384631e59037308bd522ad543cd3e193ce5c2cc6ea2a080397d0a678bb8d7f08e901f5117a6f5d2c008136d5e36f52e55194dd192d3f0cf9a07
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02F:GemTLkNdfE0pZaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

cfNGQWj.exe

Path C:\Windows\System\cfNGQWj.exe
Size 1.7MB
SHA256 2733c817424f2acaf536f6533fafd12127a57f4ca984a0e0382e8d5b98ad970b
MD5 742a78497e5d8ee4b66353b5627bb0d3
SHA1 33a66e8232a0a6e45180c1d3bd075bd8c08f4a0d
SHA512 af69f251eaa02902b13f723e158f7b63ba9603b1f643ec0007559af897fb8d813869d2baf5a4aeceee77b09a32e17ed5e94e96ef38c66ded2b2a539340050019
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02V:GemTLkNdfE0pZa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

inkfvTi.exe

Path C:\Windows\System\inkfvTi.exe
Size 1.7MB
SHA256 44ce903ee22536c2465393709a2c457033a4a2377fd3e39fe2e9ed67ecbde350
MD5 886cb6404f54715a8894498dd902d20e
SHA1 d8246ccbb079e224706e10210e6103c5faab309e
SHA512 e155c70d56e971cafa89352cfaaa25f9494ee9b37dfa3cbb0ea7316b69ff840a85c9a1fffa95d417d69c71940508f18e3d7c71f0c5d158e7574fbc5fafa93ddd
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02E:GemTLkNdfE0pZaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

kAyrBnp.exe

Path C:\Windows\System\kAyrBnp.exe
Size 1.7MB
SHA256 265c1b1d53f428ab90d7e69b152a1c9c9fe629ad185f9870ec8ec49c932517ce
MD5 2d5d00620f70b73974c712849444ecf9
SHA1 0f9acf06b34c24e71ed25676ad8baee2f6a0ed94
SHA512 f6163f24aee171a77cef28399216d7dab46e93be72d7d205aba1cb4b9dcdd8d969353b4c60daab635067ad271f2fc1fe7d26054642251b4b73b9f4f6f3de4ca3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc024:GemTLkNdfE0pZau
MD5 SHA1 SHA512 SSDEEP

Submit Download

kahVspT.exe

Path C:\Windows\System\kahVspT.exe
Size 1.7MB
SHA256 8fc3aee234c1d81a479f88e74524d9f4f89d1f72f4fb67c4834f129b4d6d3644
MD5 6183fb016a95fa0fb9d4ecc9fcf98029
SHA1 7d7c30b5753f6482d4bfed8ea2c9beed47840082
SHA512 8845ebe9a2828ec500e79d5af575804623bf56682ffe47ddd8dbff95dc4a00f51e72484e48ccce0f82072c0eb8419648434ac8b8a2f90885188207b3383b5beb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc021:GemTLkNdfE0pZan
MD5 SHA1 SHA512 SSDEEP

Submit Download

mGJMKov.exe

Path C:\Windows\System\mGJMKov.exe
Size 1.7MB
SHA256 27da268d90304303d4c8e2c40617ad2c66a5b730a300214ac4a154403b61dc4b
MD5 e9fdf97e0cd5f148c746a18b0aac7eeb
SHA1 a3106438840b8d35ac9312e12658d6501ef9b2d0
SHA512 85086cad57eee01646ef56b76a9d943b84b77169455737116e3c34bb4f5c9eed5884fdfd10f2a8bf8fed0a2de9d85f63d49ebb21b4192b553e8e556c15023f16
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02x:GemTLkNdfE0pZav
MD5 SHA1 SHA512 SSDEEP

Submit Download

mJsdahd.exe

Path C:\Windows\System\mJsdahd.exe
Size 1.7MB
SHA256 01cfc23a0f49055394e87b913c1f46c0c9ae627c8ed77bfb57110e4d876fcb00
MD5 db561eabe2d4cb6e8a27e584cd4d3d0f
SHA1 5af35a04545bb091e99e203d7b2de334aa9822b0
SHA512 4b0e6513adba4ae413d9e36e7c3f4f57d6602b662889846f3f683ac193e57db53c9b8d8c3ea88b2dea551c684d82bc92cbf1f067045560908c47e2dcb317a834
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc020:GemTLkNdfE0pZau
MD5 SHA1 SHA512 SSDEEP

Submit Download

mzCeJnN.exe

Path C:\Windows\System\mzCeJnN.exe
Size 1.7MB
SHA256 65429d385390ef1a3891f30288d2892b1bb2375f13611fadb0c9b6225f351e5b
MD5 304efe7da9baf23f8f4f267123872bb1
SHA1 8b66e948676fd8deb97c0ed8d35aff7e1dee4dbf
SHA512 e7df05bea62a8866a5cefc260be0f14c4ce431a9f0042fb0f66f5241a1905aec94d1f94e4bd8f2f90b0f797e027e1021743e4cf6e8f4083795caa31f5b12f0ea
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02O:GemTLkNdfE0pZak
MD5 SHA1 SHA512 SSDEEP

Submit Download

omrWLBB.exe

Path C:\Windows\System\omrWLBB.exe
Size 1.7MB
SHA256 3646168b3f06e1218e6fb0f689475509f7fc8532d697770efd7017d73804da57
MD5 adcbe882c3a473ea72331b9c1b6db204
SHA1 27f090a768a4405bb7c87802cf6f8a6578f60b6c
SHA512 66ceefc4b8db2c9097e24552049c4ef2ef46f2f8852854724849352b26b9aaa48bc0cc6a34df5256b0e11647b943a5da2b2cd6a68a4d6e873b259323dc7c82bd
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02p:GemTLkNdfE0pZaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

pQmzVFo.exe

Path C:\Windows\System\pQmzVFo.exe
Size 1.7MB
SHA256 0ce7d4ed18e763f4b001b2a57d2b02473675e0da0b212725bf42262caf879e12
MD5 1d2f1e17d9f357480afdd1736608251f
SHA1 fb55ddf4ec45173ea37557ebc24f30f5998de4d3
SHA512 48ef6fc5d47d4342e942c706557ea7214defd1a09648857d96a319988d6cd4560aff5a1521dd41ba143747e0b648986746075eb3d3d7ec298004bc85caa372c4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02J:GemTLkNdfE0pZaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

puTHzgk.exe

Path C:\Windows\System\puTHzgk.exe
Size 1.7MB
SHA256 95b080e2e7da250d06481612a3472a5feadf0ab4940393f215c500a4340c3fc6
MD5 834c92d9541640a4a256a54202367d42
SHA1 c851ed1d24c5794c0824b979545a3fd2df012a1f
SHA512 c02e184b46906745e4dee352b5b5fb8edf100b268c5c7663719461b3991460f11ff8b273202d12cfcecf961c969f94fe55e8c0ad8d033fa7ae194da9885b24d5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02/:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Submit Download

xpcdpBW.exe

Path C:\Windows\System\xpcdpBW.exe
Size 1.7MB
SHA256 dbdac3199cbf923dfdf02c70d469786635222f421b555d6542e70d09cf34a5f3
MD5 f3e48a872ae44a4462156ba6a4531895
SHA1 a28ba701d385f4ca986a71adb1d1112ebf26472e
SHA512 3c765727ac664def31f1838dcaceae5746ee07a2cd283a92c8c5d10d845be82094c77e65846904f2cddb3004085641257920825cfd595d8cf6d212feed1d67f4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc023:GemTLkNdfE0pZaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

xqViRcB.exe

Path C:\Windows\System\xqViRcB.exe
Size 1.7MB
SHA256 1bda64c80d8ca2a3324f02b94c5a61a5289ca28c678a8dcbd5b09cd8fa66fe29
MD5 4145275390cf0c557437595ee2c24477
SHA1 8feec17e32a8354e596ab3fc100c48c224d42797
SHA512 c2e862febe50ace33f1b47d326cbfa909daf4e8025198478bce58073420e23a4cc6d2d6a189e9c7098453c3ee0fbcec5ea80c844afc53c30956038c2efdc9a26
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02M:GemTLkNdfE0pZa6
MD5 SHA1 SHA512 SSDEEP

Submit Download

xteIJBQ.exe

Path C:\Windows\System\xteIJBQ.exe
Size 1.7MB
SHA256 189fb12555d8cff94fecd524b7dd78cbeacb6c1485cb9f4114733b81ba100cc0
MD5 da4edc059dca4f9f723aedd97e7dad63
SHA1 e274ee55ec502954f717c91a7587cf3c1ea6f2c8
SHA512 499e5fdb3a07513c20130bc64dfc373810a2101e42ceb09cf37bb619531f4007472e9d93bb904a269d3d6f5c078964c9c87e3441578033423f4db63736ddfe2c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc026:GemTLkNdfE0pZa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

yukJDNY.exe

Path C:\Windows\System\yukJDNY.exe
Size 1.7MB
SHA256 bb69bdbd3f478381a313ff7bed6026800037a462713baaaa85d5f1b574698a39
MD5 590c58955f05d9fcaba60bd3f065247c
SHA1 9f5c713b1c947f09e734179b02fe5e5a5d9b469f
SHA512 0112819b571c6cd12578c7bbd8ca01a9e5bc219fd34ed2fb30b40251cf45d4c4be286cc14e0e2603a58da0baa6696c1c57fe1d23a8f097c08034945b36d1c5de
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02G:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

zQsBTNo.exe

Path C:\Windows\System\zQsBTNo.exe
Size 1.7MB
SHA256 329004127462f24e1655752a93fef578ee136f33b81ce00061162305da89cd65
MD5 221b10ba8d0f4ff387b56d0dee633d72
SHA1 1f5a14d0dcdcb071d21b3bbe3d5d28167b4fead9
SHA512 fcef517d2662227dac5147020e4656486ef71fbbec24bdcb1a0fdba2ca8cddbe4a0884ea63640293d66e7c349d631596c0e7145485e11d78b956a044cc2fd8ae
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc02f:GemTLkNdfE0pZah
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1768-0-0x0000014241BB0000-0x0000014241BC0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads