xmrig | 1afd6c9cd817620aec004a45ae7a40cfb3aa8bb76f33c3c7ecac68b7a58e4cc1

Analysis

max time kernel
148s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
Size 1.5MB
Sample240522-znffwsgc53
SHA256 1afd6c9cd817620aec004a45ae7a40cfb3aa8bb76f33c3c7ecac68b7a58e4cc1
MD5 3894584620c614f3360d9783d0804990
SHA1 7564f45537343d884a029a42e20ff717633bf366
SHA512 e24724a43738cd6b5b702c02dcb851409b2ea7150723222082e2cf53270c51a78ab1cc3785349260000bee1e619654ec8e8a33f06b90edc1f32e566e2637a00a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6K:GemTLkNdfE0pZac
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000700000002327c-4.dat	xmrig
behavioral2/files/0x0007000000023432-8.dat	xmrig
behavioral2/files/0x000800000002342e-9.dat	xmrig
behavioral2/files/0x0007000000023436-34.dat	xmrig
behavioral2/files/0x0007000000023435-29.dat	xmrig
behavioral2/files/0x0007000000023433-28.dat	xmrig
behavioral2/files/0x0007000000023439-46.dat	xmrig
behavioral2/files/0x000700000002343c-65.dat	xmrig
behavioral2/files/0x000700000002343e-78.dat	xmrig
behavioral2/files/0x0007000000023441-90.dat	xmrig
behavioral2/files/0x0007000000023440-88.dat	xmrig
behavioral2/files/0x000700000002343f-80.dat	xmrig
behavioral2/files/0x000700000002343d-76.dat	xmrig
behavioral2/files/0x000700000002343a-63.dat	xmrig
behavioral2/files/0x000700000002343b-59.dat	xmrig
behavioral2/files/0x0007000000023438-56.dat	xmrig
behavioral2/files/0x0007000000023437-54.dat	xmrig
behavioral2/files/0x000800000002342f-97.dat	xmrig
behavioral2/files/0x0007000000023442-98.dat	xmrig
behavioral2/files/0x0007000000023443-104.dat	xmrig
behavioral2/files/0x0007000000023444-110.dat	xmrig
behavioral2/files/0x0007000000023447-122.dat	xmrig
behavioral2/files/0x0007000000023448-128.dat	xmrig
behavioral2/files/0x000700000002344c-137.dat	xmrig
behavioral2/files/0x0007000000023449-141.dat	xmrig
behavioral2/files/0x000700000002344f-154.dat	xmrig
behavioral2/files/0x000700000002344e-152.dat	xmrig
behavioral2/files/0x000700000002344d-149.dat	xmrig
behavioral2/files/0x0007000000023450-159.dat	xmrig
behavioral2/files/0x0007000000023446-118.dat	xmrig
behavioral2/files/0x0007000000023445-121.dat	xmrig
behavioral2/files/0x0007000000023434-48.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3432	noOBOQw.exe
4312	QYJTxQc.exe
468	UyNncgs.exe
4984	AuaLmZB.exe
3588	cZcmliB.exe
3828	jgoXwdA.exe
2168	VUuwPzk.exe
3776	bGbQaKH.exe
2832	FiWuEWv.exe
4272	KxiZvsn.exe
1808	ueYnqNC.exe
3732	ttwZaVp.exe
2068	gSfYsUd.exe
4056	GFkqOoN.exe
4648	NIStBxy.exe
1804	ADvxilx.exe
456	vaDiAQE.exe
396	fPTpxjK.exe
4868	EziXTNu.exe
4716	ArtmPeV.exe
3932	zvqOmXw.exe
3696	EUUhIeE.exe
4616	MiJFBtb.exe
2060	LPBUoKR.exe
5036	rETcNnm.exe
2788	cuARawU.exe
4568	iRXCnME.exe
4068	aIApooC.exe
1664	DvRRBtF.exe
4912	qmNBUjt.exe
2988	OiXmrmJ.exe
4556	xqOtacu.exe
1380	mUiTKbt.exe
2224	OxSSmwu.exe
1968	bgsShGH.exe
3632	KnyQorZ.exe
4200	fcKhvev.exe
3712	XTVbfrJ.exe
4092	lZLNgOH.exe
4908	SEoeuBN.exe
1300	DlyAPWN.exe
4376	oRlNlFd.exe
4460	oAWKlwf.exe
116	GqNFTyg.exe
4400	zPZhLYJ.exe
2636	mqPazUc.exe
2204	PglQnBI.exe
4720	YUsrMTm.exe
4380	ZfWTTvm.exe
1444	JaWAWTA.exe
4932	PznnZMS.exe
436	WjJrOBr.exe
4952	rmPVUjC.exe
636	HRswzMC.exe
2564	nVEhtOa.exe
1532	mpkiYyX.exe
4512	duzUITG.exe
1284	aeILADO.exe
2040	AivUWeF.exe
3120	rlxTtgX.exe
4684	lMMBwls.exe
2228	UVWYzZY.exe
5108	bwpAMbN.exe
732	JTyDxFo.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UNtNvXd.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\dvjakNz.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\WVCgXcw.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\MwIXcTh.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\EKbxGCz.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\LLrbALd.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\EDgvAhu.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\MCrLNde.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\OCqMizv.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\rjsfSNs.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\MGTSwEl.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\BkyFuYB.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\GhWKEpe.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\xKZwlcl.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\lVkOtsd.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\DPZOzjF.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\mQillxG.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\bxnKYYU.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\cZcmliB.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\CGHYmvn.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\WgTAbvO.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\GpMiIxo.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\JYxASyk.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\DLjWeKA.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\rRqzQZd.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\CWUpVuR.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\hpbxrEA.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\dubvWUn.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\MzRwVTp.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\MTnRIJG.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\wavZfqX.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\npCDgag.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\KxiZvsn.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\ZYKPETF.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\JArwPOI.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\EknJjzJ.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\hHspFit.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\UReInNv.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\FZgQNxp.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\zphCnoM.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\VUuwPzk.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\ueYnqNC.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\ZSynazk.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\cGDAphx.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\dTQIyFC.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\avNlJnS.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\lbmKfXh.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\noOBOQw.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\mtZejAB.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\VjytdhV.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\egDhbNn.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\MEdyhFA.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\KWpdNKH.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\fhyvUhL.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\BCAExGr.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\DAKBWxm.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\zvqOmXw.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\ScMZwPY.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\VqFfAxW.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\VqyJbZm.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\eFssrLh.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\hEpnLQQ.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\MEaXnUG.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
File created	C:\Windows\System\qEYhQyI.exe	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18396	dwm.exe
Token: SeChangeNotifyPrivilege	18396	dwm.exe
Token: 33	18396	dwm.exe
Token: SeIncBasePriorityPrivilege	18396	dwm.exe
Token: SeCreateGlobalPrivilege	17876	dwm.exe
Token: SeChangeNotifyPrivilege	17876	dwm.exe
Token: 33	17876	dwm.exe
Token: SeIncBasePriorityPrivilege	17876	dwm.exe
Token: SeCreateGlobalPrivilege	18060	dwm.exe
Token: SeChangeNotifyPrivilege	18060	dwm.exe
Token: 33	18060	dwm.exe
Token: SeIncBasePriorityPrivilege	18060	dwm.exe
Token: SeCreateGlobalPrivilege	4656	dwm.exe
Token: SeChangeNotifyPrivilege	4656	dwm.exe
Token: 33	4656	dwm.exe
Token: SeIncBasePriorityPrivilege	4656	dwm.exe
Token: SeCreateGlobalPrivilege	18372	dwm.exe
Token: SeChangeNotifyPrivilege	18372	dwm.exe
Token: 33	18372	dwm.exe
Token: SeIncBasePriorityPrivilege	18372	dwm.exe
Token: SeCreateGlobalPrivilege	17344	dwm.exe
Token: SeChangeNotifyPrivilege	17344	dwm.exe
Token: 33	17344	dwm.exe
Token: SeIncBasePriorityPrivilege	17344	dwm.exe
Token: SeCreateGlobalPrivilege	17724	dwm.exe
Token: SeChangeNotifyPrivilege	17724	dwm.exe
Token: 33	17724	dwm.exe
Token: SeIncBasePriorityPrivilege	17724	dwm.exe
Token: SeShutdownPrivilege	17724	dwm.exe
Token: SeCreatePagefilePrivilege	17724	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 3432	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	83
PID 2116 wrote to memory of 3432	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	83
PID 2116 wrote to memory of 4312	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	84
PID 2116 wrote to memory of 4312	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	84
PID 2116 wrote to memory of 468	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	85
PID 2116 wrote to memory of 468	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	85
PID 2116 wrote to memory of 4984	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	86
PID 2116 wrote to memory of 4984	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	86
PID 2116 wrote to memory of 3588	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	87
PID 2116 wrote to memory of 3588	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	87
PID 2116 wrote to memory of 3828	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	88
PID 2116 wrote to memory of 3828	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	88
PID 2116 wrote to memory of 2168	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	89
PID 2116 wrote to memory of 2168	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	89
PID 2116 wrote to memory of 3776	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	90
PID 2116 wrote to memory of 3776	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	90
PID 2116 wrote to memory of 2832	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	91
PID 2116 wrote to memory of 2832	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	91
PID 2116 wrote to memory of 4272	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	92
PID 2116 wrote to memory of 4272	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	92
PID 2116 wrote to memory of 1808	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	93
PID 2116 wrote to memory of 1808	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	93
PID 2116 wrote to memory of 3732	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	94
PID 2116 wrote to memory of 3732	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	94
PID 2116 wrote to memory of 2068	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	95
PID 2116 wrote to memory of 2068	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	95
PID 2116 wrote to memory of 4056	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	96
PID 2116 wrote to memory of 4056	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	96
PID 2116 wrote to memory of 4648	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	97
PID 2116 wrote to memory of 4648	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	97
PID 2116 wrote to memory of 1804	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	98
PID 2116 wrote to memory of 1804	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	98
PID 2116 wrote to memory of 456	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	99
PID 2116 wrote to memory of 456	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	99
PID 2116 wrote to memory of 396	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	100
PID 2116 wrote to memory of 396	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	100
PID 2116 wrote to memory of 4868	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	101
PID 2116 wrote to memory of 4868	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	101
PID 2116 wrote to memory of 4716	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	102
PID 2116 wrote to memory of 4716	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	102
PID 2116 wrote to memory of 3932	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	103
PID 2116 wrote to memory of 3932	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	103
PID 2116 wrote to memory of 3696	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	104
PID 2116 wrote to memory of 3696	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	104
PID 2116 wrote to memory of 4616	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	105
PID 2116 wrote to memory of 4616	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	105
PID 2116 wrote to memory of 2060	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	106
PID 2116 wrote to memory of 2060	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	106
PID 2116 wrote to memory of 5036	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	107
PID 2116 wrote to memory of 5036	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	107
PID 2116 wrote to memory of 2788	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	108
PID 2116 wrote to memory of 2788	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	108
PID 2116 wrote to memory of 4568	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	109
PID 2116 wrote to memory of 4568	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	109
PID 2116 wrote to memory of 4068	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	110
PID 2116 wrote to memory of 4068	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	110
PID 2116 wrote to memory of 1664	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	111
PID 2116 wrote to memory of 1664	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	111
PID 2116 wrote to memory of 4912	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	112
PID 2116 wrote to memory of 4912	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	112
PID 2116 wrote to memory of 2988	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	113
PID 2116 wrote to memory of 2988	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	113
PID 2116 wrote to memory of 4556	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	114
PID 2116 wrote to memory of 4556	2116	3894584620c614f3360d9783d0804990_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\3894584620c614f3360d9783d0804990_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3894584620c614f3360d9783d0804990_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\System\noOBOQw.exe
  C:\Windows\System\noOBOQw.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\QYJTxQc.exe
  C:\Windows\System\QYJTxQc.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\UyNncgs.exe
  C:\Windows\System\UyNncgs.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\AuaLmZB.exe
  C:\Windows\System\AuaLmZB.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\cZcmliB.exe
  C:\Windows\System\cZcmliB.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\jgoXwdA.exe
  C:\Windows\System\jgoXwdA.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\VUuwPzk.exe
  C:\Windows\System\VUuwPzk.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\bGbQaKH.exe
  C:\Windows\System\bGbQaKH.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\FiWuEWv.exe
  C:\Windows\System\FiWuEWv.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\KxiZvsn.exe
  C:\Windows\System\KxiZvsn.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\ueYnqNC.exe
  C:\Windows\System\ueYnqNC.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\ttwZaVp.exe
  C:\Windows\System\ttwZaVp.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\gSfYsUd.exe
  C:\Windows\System\gSfYsUd.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\GFkqOoN.exe
  C:\Windows\System\GFkqOoN.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\NIStBxy.exe
  C:\Windows\System\NIStBxy.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\ADvxilx.exe
  C:\Windows\System\ADvxilx.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\vaDiAQE.exe
  C:\Windows\System\vaDiAQE.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\fPTpxjK.exe
  C:\Windows\System\fPTpxjK.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\EziXTNu.exe
  C:\Windows\System\EziXTNu.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\ArtmPeV.exe
  C:\Windows\System\ArtmPeV.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\zvqOmXw.exe
  C:\Windows\System\zvqOmXw.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\EUUhIeE.exe
  C:\Windows\System\EUUhIeE.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\MiJFBtb.exe
  C:\Windows\System\MiJFBtb.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\LPBUoKR.exe
  C:\Windows\System\LPBUoKR.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\rETcNnm.exe
  C:\Windows\System\rETcNnm.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\cuARawU.exe
  C:\Windows\System\cuARawU.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\iRXCnME.exe
  C:\Windows\System\iRXCnME.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\aIApooC.exe
  C:\Windows\System\aIApooC.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\DvRRBtF.exe
  C:\Windows\System\DvRRBtF.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\qmNBUjt.exe
  C:\Windows\System\qmNBUjt.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\OiXmrmJ.exe
  C:\Windows\System\OiXmrmJ.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\xqOtacu.exe
  C:\Windows\System\xqOtacu.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\mUiTKbt.exe
  C:\Windows\System\mUiTKbt.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\OxSSmwu.exe
  C:\Windows\System\OxSSmwu.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\bgsShGH.exe
  C:\Windows\System\bgsShGH.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\KnyQorZ.exe
  C:\Windows\System\KnyQorZ.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\fcKhvev.exe
  C:\Windows\System\fcKhvev.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\XTVbfrJ.exe
  C:\Windows\System\XTVbfrJ.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\lZLNgOH.exe
  C:\Windows\System\lZLNgOH.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\SEoeuBN.exe
  C:\Windows\System\SEoeuBN.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\DlyAPWN.exe
  C:\Windows\System\DlyAPWN.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\oRlNlFd.exe
  C:\Windows\System\oRlNlFd.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\oAWKlwf.exe
  C:\Windows\System\oAWKlwf.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\GqNFTyg.exe
  C:\Windows\System\GqNFTyg.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\zPZhLYJ.exe
  C:\Windows\System\zPZhLYJ.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\mqPazUc.exe
  C:\Windows\System\mqPazUc.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\PglQnBI.exe
  C:\Windows\System\PglQnBI.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\YUsrMTm.exe
  C:\Windows\System\YUsrMTm.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\ZfWTTvm.exe
  C:\Windows\System\ZfWTTvm.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\JaWAWTA.exe
  C:\Windows\System\JaWAWTA.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\PznnZMS.exe
  C:\Windows\System\PznnZMS.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\WjJrOBr.exe
  C:\Windows\System\WjJrOBr.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\rmPVUjC.exe
  C:\Windows\System\rmPVUjC.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\HRswzMC.exe
  C:\Windows\System\HRswzMC.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\nVEhtOa.exe
  C:\Windows\System\nVEhtOa.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\mpkiYyX.exe
  C:\Windows\System\mpkiYyX.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\duzUITG.exe
  C:\Windows\System\duzUITG.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\aeILADO.exe
  C:\Windows\System\aeILADO.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\AivUWeF.exe
  C:\Windows\System\AivUWeF.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\rlxTtgX.exe
  C:\Windows\System\rlxTtgX.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\lMMBwls.exe
  C:\Windows\System\lMMBwls.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\UVWYzZY.exe
  C:\Windows\System\UVWYzZY.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\bwpAMbN.exe
  C:\Windows\System\bwpAMbN.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\JTyDxFo.exe
  C:\Windows\System\JTyDxFo.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\MEiApAF.exe
  C:\Windows\System\MEiApAF.exe
  2⤵
  PID:1236
- C:\Windows\System\xKMKjdE.exe
  C:\Windows\System\xKMKjdE.exe
  2⤵
  PID:3668
- C:\Windows\System\GhWKEpe.exe
  C:\Windows\System\GhWKEpe.exe
  2⤵
  PID:3540
- C:\Windows\System\UNtNvXd.exe
  C:\Windows\System\UNtNvXd.exe
  2⤵
  PID:3656
- C:\Windows\System\FlMkYjj.exe
  C:\Windows\System\FlMkYjj.exe
  2⤵
  PID:8
- C:\Windows\System\Svaqgcp.exe
  C:\Windows\System\Svaqgcp.exe
  2⤵
  PID:3448
- C:\Windows\System\ZYKPETF.exe
  C:\Windows\System\ZYKPETF.exe
  2⤵
  PID:2948
- C:\Windows\System\kmXvVsG.exe
  C:\Windows\System\kmXvVsG.exe
  2⤵
  PID:2376
- C:\Windows\System\GwmSzyP.exe
  C:\Windows\System\GwmSzyP.exe
  2⤵
  PID:2364
- C:\Windows\System\LFIqdLR.exe
  C:\Windows\System\LFIqdLR.exe
  2⤵
  PID:3872
- C:\Windows\System\xaTRPvX.exe
  C:\Windows\System\xaTRPvX.exe
  2⤵
  PID:5068
- C:\Windows\System\COFsrgV.exe
  C:\Windows\System\COFsrgV.exe
  2⤵
  PID:880
- C:\Windows\System\OyGXftA.exe
  C:\Windows\System\OyGXftA.exe
  2⤵
  PID:4412
- C:\Windows\System\zZCWBIc.exe
  C:\Windows\System\zZCWBIc.exe
  2⤵
  PID:4624
- C:\Windows\System\ybxfTSQ.exe
  C:\Windows\System\ybxfTSQ.exe
  2⤵
  PID:3876
- C:\Windows\System\xZdAYSg.exe
  C:\Windows\System\xZdAYSg.exe
  2⤵
  PID:3760
- C:\Windows\System\FvrkcnB.exe
  C:\Windows\System\FvrkcnB.exe
  2⤵
  PID:3984
- C:\Windows\System\mhWOxbD.exe
  C:\Windows\System\mhWOxbD.exe
  2⤵
  PID:4964
- C:\Windows\System\lvKWCWA.exe
  C:\Windows\System\lvKWCWA.exe
  2⤵
  PID:3096
- C:\Windows\System\PZbtnlv.exe
  C:\Windows\System\PZbtnlv.exe
  2⤵
  PID:3928
- C:\Windows\System\JVVNBaG.exe
  C:\Windows\System\JVVNBaG.exe
  2⤵
  PID:4628
- C:\Windows\System\AUuAZQu.exe
  C:\Windows\System\AUuAZQu.exe
  2⤵
  PID:3584
- C:\Windows\System\PAaxpaS.exe
  C:\Windows\System\PAaxpaS.exe
  2⤵
  PID:2260
- C:\Windows\System\lqGOtLh.exe
  C:\Windows\System\lqGOtLh.exe
  2⤵
  PID:4708
- C:\Windows\System\qURNSZs.exe
  C:\Windows\System\qURNSZs.exe
  2⤵
  PID:440
- C:\Windows\System\YHkdGKs.exe
  C:\Windows\System\YHkdGKs.exe
  2⤵
  PID:5060
- C:\Windows\System\wCjrrNz.exe
  C:\Windows\System\wCjrrNz.exe
  2⤵
  PID:4456
- C:\Windows\System\VoXsfrw.exe
  C:\Windows\System\VoXsfrw.exe
  2⤵
  PID:4532
- C:\Windows\System\KihdBEG.exe
  C:\Windows\System\KihdBEG.exe
  2⤵
  PID:5128
- C:\Windows\System\VsEJlMZ.exe
  C:\Windows\System\VsEJlMZ.exe
  2⤵
  PID:5152
- C:\Windows\System\wrLITOg.exe
  C:\Windows\System\wrLITOg.exe
  2⤵
  PID:5184
- C:\Windows\System\ZXtNVjt.exe
  C:\Windows\System\ZXtNVjt.exe
  2⤵
  PID:5208
- C:\Windows\System\nIwPuHF.exe
  C:\Windows\System\nIwPuHF.exe
  2⤵
  PID:5240
- C:\Windows\System\dVJfCMv.exe
  C:\Windows\System\dVJfCMv.exe
  2⤵
  PID:5264
- C:\Windows\System\eRVoHKR.exe
  C:\Windows\System\eRVoHKR.exe
  2⤵
  PID:5292
- C:\Windows\System\RPLPpbI.exe
  C:\Windows\System\RPLPpbI.exe
  2⤵
  PID:5328
- C:\Windows\System\jfPDpQb.exe
  C:\Windows\System\jfPDpQb.exe
  2⤵
  PID:5348
- C:\Windows\System\xKZwlcl.exe
  C:\Windows\System\xKZwlcl.exe
  2⤵
  PID:5364
- C:\Windows\System\wGkzoKq.exe
  C:\Windows\System\wGkzoKq.exe
  2⤵
  PID:5388
- C:\Windows\System\JArwPOI.exe
  C:\Windows\System\JArwPOI.exe
  2⤵
  PID:5404
- C:\Windows\System\SJyngSX.exe
  C:\Windows\System\SJyngSX.exe
  2⤵
  PID:5428
- C:\Windows\System\gIYGrcJ.exe
  C:\Windows\System\gIYGrcJ.exe
  2⤵
  PID:5452
- C:\Windows\System\qbWoRWz.exe
  C:\Windows\System\qbWoRWz.exe
  2⤵
  PID:5484
- C:\Windows\System\BmLvPFt.exe
  C:\Windows\System\BmLvPFt.exe
  2⤵
  PID:5516
- C:\Windows\System\dwUCUoY.exe
  C:\Windows\System\dwUCUoY.exe
  2⤵
  PID:5556
- C:\Windows\System\BFxdJHh.exe
  C:\Windows\System\BFxdJHh.exe
  2⤵
  PID:5576
- C:\Windows\System\YRKLWrC.exe
  C:\Windows\System\YRKLWrC.exe
  2⤵
  PID:5604
- C:\Windows\System\LmEzaMr.exe
  C:\Windows\System\LmEzaMr.exe
  2⤵
  PID:5640
- C:\Windows\System\EZEuwYn.exe
  C:\Windows\System\EZEuwYn.exe
  2⤵
  PID:5668
- C:\Windows\System\RNVGTyJ.exe
  C:\Windows\System\RNVGTyJ.exe
  2⤵
  PID:5696
- C:\Windows\System\hpbxrEA.exe
  C:\Windows\System\hpbxrEA.exe
  2⤵
  PID:5724
- C:\Windows\System\VuhjbGJ.exe
  C:\Windows\System\VuhjbGJ.exe
  2⤵
  PID:5756
- C:\Windows\System\MswHXuK.exe
  C:\Windows\System\MswHXuK.exe
  2⤵
  PID:5796
- C:\Windows\System\TtkUSpT.exe
  C:\Windows\System\TtkUSpT.exe
  2⤵
  PID:5824
- C:\Windows\System\TJyMHbO.exe
  C:\Windows\System\TJyMHbO.exe
  2⤵
  PID:5852
- C:\Windows\System\lOoqPVX.exe
  C:\Windows\System\lOoqPVX.exe
  2⤵
  PID:5888
- C:\Windows\System\tBorkAF.exe
  C:\Windows\System\tBorkAF.exe
  2⤵
  PID:5908
- C:\Windows\System\ZSZjgRw.exe
  C:\Windows\System\ZSZjgRw.exe
  2⤵
  PID:5940
- C:\Windows\System\MywhJXn.exe
  C:\Windows\System\MywhJXn.exe
  2⤵
  PID:5976
- C:\Windows\System\boQNjzC.exe
  C:\Windows\System\boQNjzC.exe
  2⤵
  PID:6000
- C:\Windows\System\hdjISnF.exe
  C:\Windows\System\hdjISnF.exe
  2⤵
  PID:6036
- C:\Windows\System\hacEroG.exe
  C:\Windows\System\hacEroG.exe
  2⤵
  PID:6064
- C:\Windows\System\dubvWUn.exe
  C:\Windows\System\dubvWUn.exe
  2⤵
  PID:6092
- C:\Windows\System\JwGsUYp.exe
  C:\Windows\System\JwGsUYp.exe
  2⤵
  PID:6124
- C:\Windows\System\GJKkaGl.exe
  C:\Windows\System\GJKkaGl.exe
  2⤵
  PID:5144
- C:\Windows\System\lDFppUd.exe
  C:\Windows\System\lDFppUd.exe
  2⤵
  PID:2004
- C:\Windows\System\dnjeXYp.exe
  C:\Windows\System\dnjeXYp.exe
  2⤵
  PID:5256
- C:\Windows\System\rRRMtgj.exe
  C:\Windows\System\rRRMtgj.exe
  2⤵
  PID:5288
- C:\Windows\System\tvuRWeR.exe
  C:\Windows\System\tvuRWeR.exe
  2⤵
  PID:5340
- C:\Windows\System\tSUbeGR.exe
  C:\Windows\System\tSUbeGR.exe
  2⤵
  PID:5448
- C:\Windows\System\lwvgbbJ.exe
  C:\Windows\System\lwvgbbJ.exe
  2⤵
  PID:5540
- C:\Windows\System\nsWrMAp.exe
  C:\Windows\System\nsWrMAp.exe
  2⤵
  PID:5512
- C:\Windows\System\fsqQzOS.exe
  C:\Windows\System\fsqQzOS.exe
  2⤵
  PID:5624
- C:\Windows\System\yYhMOPb.exe
  C:\Windows\System\yYhMOPb.exe
  2⤵
  PID:5656
- C:\Windows\System\tqorQWh.exe
  C:\Windows\System\tqorQWh.exe
  2⤵
  PID:5768
- C:\Windows\System\qBDkubw.exe
  C:\Windows\System\qBDkubw.exe
  2⤵
  PID:5864
- C:\Windows\System\lVkOtsd.exe
  C:\Windows\System\lVkOtsd.exe
  2⤵
  PID:5948
- C:\Windows\System\QKsgtem.exe
  C:\Windows\System\QKsgtem.exe
  2⤵
  PID:6116
- C:\Windows\System\IstcEBt.exe
  C:\Windows\System\IstcEBt.exe
  2⤵
  PID:1556
- C:\Windows\System\HzfkyYf.exe
  C:\Windows\System\HzfkyYf.exe
  2⤵
  PID:5360
- C:\Windows\System\ENjIeJi.exe
  C:\Windows\System\ENjIeJi.exe
  2⤵
  PID:5496
- C:\Windows\System\HSRmhMa.exe
  C:\Windows\System\HSRmhMa.exe
  2⤵
  PID:5676
- C:\Windows\System\EnBuaRa.exe
  C:\Windows\System\EnBuaRa.exe
  2⤵
  PID:5920
- C:\Windows\System\ZNpKhcY.exe
  C:\Windows\System\ZNpKhcY.exe
  2⤵
  PID:4216
- C:\Windows\System\RHjLcSU.exe
  C:\Windows\System\RHjLcSU.exe
  2⤵
  PID:5904
- C:\Windows\System\zZgBBea.exe
  C:\Windows\System\zZgBBea.exe
  2⤵
  PID:5412
- C:\Windows\System\pLperjf.exe
  C:\Windows\System\pLperjf.exe
  2⤵
  PID:6152
- C:\Windows\System\aUZTNAR.exe
  C:\Windows\System\aUZTNAR.exe
  2⤵
  PID:6180
- C:\Windows\System\YdrDllx.exe
  C:\Windows\System\YdrDllx.exe
  2⤵
  PID:6208
- C:\Windows\System\BDqdqVQ.exe
  C:\Windows\System\BDqdqVQ.exe
  2⤵
  PID:6236
- C:\Windows\System\uOagqUz.exe
  C:\Windows\System\uOagqUz.exe
  2⤵
  PID:6264
- C:\Windows\System\DRmZtbA.exe
  C:\Windows\System\DRmZtbA.exe
  2⤵
  PID:6300
- C:\Windows\System\ORnqZFz.exe
  C:\Windows\System\ORnqZFz.exe
  2⤵
  PID:6328
- C:\Windows\System\YHLgEHZ.exe
  C:\Windows\System\YHLgEHZ.exe
  2⤵
  PID:6356
- C:\Windows\System\mRLYhxm.exe
  C:\Windows\System\mRLYhxm.exe
  2⤵
  PID:6384
- C:\Windows\System\oreKUeh.exe
  C:\Windows\System\oreKUeh.exe
  2⤵
  PID:6404
- C:\Windows\System\kdqRDTE.exe
  C:\Windows\System\kdqRDTE.exe
  2⤵
  PID:6452
- C:\Windows\System\doxUVWI.exe
  C:\Windows\System\doxUVWI.exe
  2⤵
  PID:6468
- C:\Windows\System\ScMZwPY.exe
  C:\Windows\System\ScMZwPY.exe
  2⤵
  PID:6504
- C:\Windows\System\hEOIQZx.exe
  C:\Windows\System\hEOIQZx.exe
  2⤵
  PID:6524
- C:\Windows\System\FxjIqgP.exe
  C:\Windows\System\FxjIqgP.exe
  2⤵
  PID:6544
- C:\Windows\System\kXVqjDs.exe
  C:\Windows\System\kXVqjDs.exe
  2⤵
  PID:6568
- C:\Windows\System\FVVLudn.exe
  C:\Windows\System\FVVLudn.exe
  2⤵
  PID:6604
- C:\Windows\System\JkttnwL.exe
  C:\Windows\System\JkttnwL.exe
  2⤵
  PID:6636
- C:\Windows\System\ETbRjmr.exe
  C:\Windows\System\ETbRjmr.exe
  2⤵
  PID:6668
- C:\Windows\System\lLOosoW.exe
  C:\Windows\System\lLOosoW.exe
  2⤵
  PID:6704
- C:\Windows\System\pqQuutL.exe
  C:\Windows\System\pqQuutL.exe
  2⤵
  PID:6740
- C:\Windows\System\jLyPdiJ.exe
  C:\Windows\System\jLyPdiJ.exe
  2⤵
  PID:6772
- C:\Windows\System\BUFDbZB.exe
  C:\Windows\System\BUFDbZB.exe
  2⤵
  PID:6808
- C:\Windows\System\LlzmgVM.exe
  C:\Windows\System\LlzmgVM.exe
  2⤵
  PID:6840
- C:\Windows\System\VGhdkXW.exe
  C:\Windows\System\VGhdkXW.exe
  2⤵
  PID:6872
- C:\Windows\System\UTaTgex.exe
  C:\Windows\System\UTaTgex.exe
  2⤵
  PID:6900
- C:\Windows\System\NLPzXjf.exe
  C:\Windows\System\NLPzXjf.exe
  2⤵
  PID:6928
- C:\Windows\System\fgallCs.exe
  C:\Windows\System\fgallCs.exe
  2⤵
  PID:6956
- C:\Windows\System\VqFfAxW.exe
  C:\Windows\System\VqFfAxW.exe
  2⤵
  PID:6984
- C:\Windows\System\MCFqlDB.exe
  C:\Windows\System\MCFqlDB.exe
  2⤵
  PID:7016
- C:\Windows\System\PpTyuTH.exe
  C:\Windows\System\PpTyuTH.exe
  2⤵
  PID:7040
- C:\Windows\System\qvVGSwL.exe
  C:\Windows\System\qvVGSwL.exe
  2⤵
  PID:7068
- C:\Windows\System\rOsAPDF.exe
  C:\Windows\System\rOsAPDF.exe
  2⤵
  PID:7096
- C:\Windows\System\rNeSJNL.exe
  C:\Windows\System\rNeSJNL.exe
  2⤵
  PID:7120
- C:\Windows\System\CpvppYX.exe
  C:\Windows\System\CpvppYX.exe
  2⤵
  PID:7152
- C:\Windows\System\BhhsYRL.exe
  C:\Windows\System\BhhsYRL.exe
  2⤵
  PID:6168
- C:\Windows\System\GuUuxaZ.exe
  C:\Windows\System\GuUuxaZ.exe
  2⤵
  PID:6232
- C:\Windows\System\HLctsCT.exe
  C:\Windows\System\HLctsCT.exe
  2⤵
  PID:6308
- C:\Windows\System\SuxvoKn.exe
  C:\Windows\System\SuxvoKn.exe
  2⤵
  PID:6380
- C:\Windows\System\CQgpBXC.exe
  C:\Windows\System\CQgpBXC.exe
  2⤵
  PID:2960
- C:\Windows\System\XZKUUxc.exe
  C:\Windows\System\XZKUUxc.exe
  2⤵
  PID:6448
- C:\Windows\System\GYUtPMj.exe
  C:\Windows\System\GYUtPMj.exe
  2⤵
  PID:3052
- C:\Windows\System\CHmrBfH.exe
  C:\Windows\System\CHmrBfH.exe
  2⤵
  PID:6512
- C:\Windows\System\mfdzagn.exe
  C:\Windows\System\mfdzagn.exe
  2⤵
  PID:6560
- C:\Windows\System\LYuGmEM.exe
  C:\Windows\System\LYuGmEM.exe
  2⤵
  PID:6644
- C:\Windows\System\zPpqQhv.exe
  C:\Windows\System\zPpqQhv.exe
  2⤵
  PID:6748
- C:\Windows\System\dVDLHOg.exe
  C:\Windows\System\dVDLHOg.exe
  2⤵
  PID:6804
- C:\Windows\System\vTWfZDX.exe
  C:\Windows\System\vTWfZDX.exe
  2⤵
  PID:6864
- C:\Windows\System\dutMcZk.exe
  C:\Windows\System\dutMcZk.exe
  2⤵
  PID:6924
- C:\Windows\System\MNrjGIA.exe
  C:\Windows\System\MNrjGIA.exe
  2⤵
  PID:6976
- C:\Windows\System\LIAVVtY.exe
  C:\Windows\System\LIAVVtY.exe
  2⤵
  PID:7032
- C:\Windows\System\CKYBboq.exe
  C:\Windows\System\CKYBboq.exe
  2⤵
  PID:7108
- C:\Windows\System\AQnZYCQ.exe
  C:\Windows\System\AQnZYCQ.exe
  2⤵
  PID:6148
- C:\Windows\System\GoizLsB.exe
  C:\Windows\System\GoizLsB.exe
  2⤵
  PID:6348
- C:\Windows\System\aDRVzDh.exe
  C:\Windows\System\aDRVzDh.exe
  2⤵
  PID:6420
- C:\Windows\System\MEaXnUG.exe
  C:\Windows\System\MEaXnUG.exe
  2⤵
  PID:6616
- C:\Windows\System\NeJvqHh.exe
  C:\Windows\System\NeJvqHh.exe
  2⤵
  PID:6764
- C:\Windows\System\iPisUTU.exe
  C:\Windows\System\iPisUTU.exe
  2⤵
  PID:6884
- C:\Windows\System\twkKaKh.exe
  C:\Windows\System\twkKaKh.exe
  2⤵
  PID:7024
- C:\Windows\System\BPCjYac.exe
  C:\Windows\System\BPCjYac.exe
  2⤵
  PID:6228
- C:\Windows\System\oCfqpBV.exe
  C:\Windows\System\oCfqpBV.exe
  2⤵
  PID:2756
- C:\Windows\System\kGXewCr.exe
  C:\Windows\System\kGXewCr.exe
  2⤵
  PID:7004
- C:\Windows\System\WYQyKDL.exe
  C:\Windows\System\WYQyKDL.exe
  2⤵
  PID:6436
- C:\Windows\System\iXzsRLd.exe
  C:\Windows\System\iXzsRLd.exe
  2⤵
  PID:7172
- C:\Windows\System\mLkOeyz.exe
  C:\Windows\System\mLkOeyz.exe
  2⤵
  PID:7196
- C:\Windows\System\gtLpmPa.exe
  C:\Windows\System\gtLpmPa.exe
  2⤵
  PID:7220
- C:\Windows\System\ukhIVlU.exe
  C:\Windows\System\ukhIVlU.exe
  2⤵
  PID:7252
- C:\Windows\System\kVPSWtt.exe
  C:\Windows\System\kVPSWtt.exe
  2⤵
  PID:7284
- C:\Windows\System\bRTSxXk.exe
  C:\Windows\System\bRTSxXk.exe
  2⤵
  PID:7316
- C:\Windows\System\RCCBQpr.exe
  C:\Windows\System\RCCBQpr.exe
  2⤵
  PID:7340
- C:\Windows\System\xLEzZad.exe
  C:\Windows\System\xLEzZad.exe
  2⤵
  PID:7376
- C:\Windows\System\qYnEEVL.exe
  C:\Windows\System\qYnEEVL.exe
  2⤵
  PID:7408
- C:\Windows\System\ssoTcHu.exe
  C:\Windows\System\ssoTcHu.exe
  2⤵
  PID:7448
- C:\Windows\System\MGBnCmh.exe
  C:\Windows\System\MGBnCmh.exe
  2⤵
  PID:7480
- C:\Windows\System\BIZAuCm.exe
  C:\Windows\System\BIZAuCm.exe
  2⤵
  PID:7508
- C:\Windows\System\zedAcge.exe
  C:\Windows\System\zedAcge.exe
  2⤵
  PID:7540
- C:\Windows\System\cPTPVZA.exe
  C:\Windows\System\cPTPVZA.exe
  2⤵
  PID:7592
- C:\Windows\System\YeoDJfR.exe
  C:\Windows\System\YeoDJfR.exe
  2⤵
  PID:7624
- C:\Windows\System\pHdOwUJ.exe
  C:\Windows\System\pHdOwUJ.exe
  2⤵
  PID:7652
- C:\Windows\System\KgemHGB.exe
  C:\Windows\System\KgemHGB.exe
  2⤵
  PID:7680
- C:\Windows\System\rSjuBXz.exe
  C:\Windows\System\rSjuBXz.exe
  2⤵
  PID:7708
- C:\Windows\System\WbunfoH.exe
  C:\Windows\System\WbunfoH.exe
  2⤵
  PID:7736
- C:\Windows\System\SORoEwe.exe
  C:\Windows\System\SORoEwe.exe
  2⤵
  PID:7768
- C:\Windows\System\JcbhEJL.exe
  C:\Windows\System\JcbhEJL.exe
  2⤵
  PID:7796
- C:\Windows\System\yIJoCiv.exe
  C:\Windows\System\yIJoCiv.exe
  2⤵
  PID:7820
- C:\Windows\System\VNlJgfr.exe
  C:\Windows\System\VNlJgfr.exe
  2⤵
  PID:7844
- C:\Windows\System\rkNQfeW.exe
  C:\Windows\System\rkNQfeW.exe
  2⤵
  PID:7884
- C:\Windows\System\FVmBMOR.exe
  C:\Windows\System\FVmBMOR.exe
  2⤵
  PID:7904
- C:\Windows\System\mhXdGPN.exe
  C:\Windows\System\mhXdGPN.exe
  2⤵
  PID:7940
- C:\Windows\System\CHrLZmI.exe
  C:\Windows\System\CHrLZmI.exe
  2⤵
  PID:7968
- C:\Windows\System\LLySAGB.exe
  C:\Windows\System\LLySAGB.exe
  2⤵
  PID:8008
- C:\Windows\System\eeaguub.exe
  C:\Windows\System\eeaguub.exe
  2⤵
  PID:8032
- C:\Windows\System\WXCpEAF.exe
  C:\Windows\System\WXCpEAF.exe
  2⤵
  PID:8064
- C:\Windows\System\uIiWleL.exe
  C:\Windows\System\uIiWleL.exe
  2⤵
  PID:8084
- C:\Windows\System\HCBNsph.exe
  C:\Windows\System\HCBNsph.exe
  2⤵
  PID:8120
- C:\Windows\System\liuWsmh.exe
  C:\Windows\System\liuWsmh.exe
  2⤵
  PID:8148
- C:\Windows\System\KIDHpiK.exe
  C:\Windows\System\KIDHpiK.exe
  2⤵
  PID:8172
- C:\Windows\System\ugjSLPI.exe
  C:\Windows\System\ugjSLPI.exe
  2⤵
  PID:6948
- C:\Windows\System\hSuBYMT.exe
  C:\Windows\System\hSuBYMT.exe
  2⤵
  PID:7208
- C:\Windows\System\LHTAoJW.exe
  C:\Windows\System\LHTAoJW.exe
  2⤵
  PID:7308
- C:\Windows\System\VQeDnGA.exe
  C:\Windows\System\VQeDnGA.exe
  2⤵
  PID:7388
- C:\Windows\System\TTUAWoX.exe
  C:\Windows\System\TTUAWoX.exe
  2⤵
  PID:7472
- C:\Windows\System\BhSKduZ.exe
  C:\Windows\System\BhSKduZ.exe
  2⤵
  PID:7600
- C:\Windows\System\ivskQpC.exe
  C:\Windows\System\ivskQpC.exe
  2⤵
  PID:7696
- C:\Windows\System\BAZIApI.exe
  C:\Windows\System\BAZIApI.exe
  2⤵
  PID:7732
- C:\Windows\System\hThOZZS.exe
  C:\Windows\System\hThOZZS.exe
  2⤵
  PID:7804
- C:\Windows\System\zKvItEc.exe
  C:\Windows\System\zKvItEc.exe
  2⤵
  PID:7868
- C:\Windows\System\xvUSXRV.exe
  C:\Windows\System\xvUSXRV.exe
  2⤵
  PID:7932
- C:\Windows\System\dZrGFIN.exe
  C:\Windows\System\dZrGFIN.exe
  2⤵
  PID:8028
- C:\Windows\System\pWriSUz.exe
  C:\Windows\System\pWriSUz.exe
  2⤵
  PID:8104
- C:\Windows\System\sGadwjM.exe
  C:\Windows\System\sGadwjM.exe
  2⤵
  PID:8168
- C:\Windows\System\tpecCfM.exe
  C:\Windows\System\tpecCfM.exe
  2⤵
  PID:7432
- C:\Windows\System\QFzpuzB.exe
  C:\Windows\System\QFzpuzB.exe
  2⤵
  PID:7568
- C:\Windows\System\OyHesSI.exe
  C:\Windows\System\OyHesSI.exe
  2⤵
  PID:7528
- C:\Windows\System\mxSPgjM.exe
  C:\Windows\System\mxSPgjM.exe
  2⤵
  PID:7964
- C:\Windows\System\cHWzAKl.exe
  C:\Windows\System\cHWzAKl.exe
  2⤵
  PID:7920
- C:\Windows\System\XOpzcjr.exe
  C:\Windows\System\XOpzcjr.exe
  2⤵
  PID:7332
- C:\Windows\System\GpCEBNB.exe
  C:\Windows\System\GpCEBNB.exe
  2⤵
  PID:7500
- C:\Windows\System\YcMYsXX.exe
  C:\Windows\System\YcMYsXX.exe
  2⤵
  PID:7952
- C:\Windows\System\okZRDph.exe
  C:\Windows\System\okZRDph.exe
  2⤵
  PID:8204
- C:\Windows\System\tZXoOwH.exe
  C:\Windows\System\tZXoOwH.exe
  2⤵
  PID:8224
- C:\Windows\System\MzRwVTp.exe
  C:\Windows\System\MzRwVTp.exe
  2⤵
  PID:8252
- C:\Windows\System\Xwhfkfz.exe
  C:\Windows\System\Xwhfkfz.exe
  2⤵
  PID:8276
- C:\Windows\System\liFICGo.exe
  C:\Windows\System\liFICGo.exe
  2⤵
  PID:8296
- C:\Windows\System\iAjufWs.exe
  C:\Windows\System\iAjufWs.exe
  2⤵
  PID:8316
- C:\Windows\System\xgnvBnp.exe
  C:\Windows\System\xgnvBnp.exe
  2⤵
  PID:8332
- C:\Windows\System\VzrRUxP.exe
  C:\Windows\System\VzrRUxP.exe
  2⤵
  PID:8352
- C:\Windows\System\xyqZELm.exe
  C:\Windows\System\xyqZELm.exe
  2⤵
  PID:8376
- C:\Windows\System\nEboSZW.exe
  C:\Windows\System\nEboSZW.exe
  2⤵
  PID:8396
- C:\Windows\System\smffZTn.exe
  C:\Windows\System\smffZTn.exe
  2⤵
  PID:8420
- C:\Windows\System\UscnvwK.exe
  C:\Windows\System\UscnvwK.exe
  2⤵
  PID:8452
- C:\Windows\System\VzeTeWX.exe
  C:\Windows\System\VzeTeWX.exe
  2⤵
  PID:8468
- C:\Windows\System\lDfDcbV.exe
  C:\Windows\System\lDfDcbV.exe
  2⤵
  PID:8492
- C:\Windows\System\CRbqxiV.exe
  C:\Windows\System\CRbqxiV.exe
  2⤵
  PID:8524
- C:\Windows\System\NwkAcJT.exe
  C:\Windows\System\NwkAcJT.exe
  2⤵
  PID:8556
- C:\Windows\System\gqjOSrz.exe
  C:\Windows\System\gqjOSrz.exe
  2⤵
  PID:8588
- C:\Windows\System\yJpvlJp.exe
  C:\Windows\System\yJpvlJp.exe
  2⤵
  PID:8628
- C:\Windows\System\GFvsAkW.exe
  C:\Windows\System\GFvsAkW.exe
  2⤵
  PID:8652
- C:\Windows\System\NsdKvkO.exe
  C:\Windows\System\NsdKvkO.exe
  2⤵
  PID:8692
- C:\Windows\System\yXbBTAx.exe
  C:\Windows\System\yXbBTAx.exe
  2⤵
  PID:8720
- C:\Windows\System\TNzVZNd.exe
  C:\Windows\System\TNzVZNd.exe
  2⤵
  PID:8756
- C:\Windows\System\PiIErUU.exe
  C:\Windows\System\PiIErUU.exe
  2⤵
  PID:8788
- C:\Windows\System\yfWshiC.exe
  C:\Windows\System\yfWshiC.exe
  2⤵
  PID:8816
- C:\Windows\System\bfQFtAh.exe
  C:\Windows\System\bfQFtAh.exe
  2⤵
  PID:8848
- C:\Windows\System\YLmeGlV.exe
  C:\Windows\System\YLmeGlV.exe
  2⤵
  PID:8876
- C:\Windows\System\JpFJXYA.exe
  C:\Windows\System\JpFJXYA.exe
  2⤵
  PID:8912
- C:\Windows\System\EKbxGCz.exe
  C:\Windows\System\EKbxGCz.exe
  2⤵
  PID:8944
- C:\Windows\System\qJyjRAZ.exe
  C:\Windows\System\qJyjRAZ.exe
  2⤵
  PID:8972
- C:\Windows\System\QVgWNEV.exe
  C:\Windows\System\QVgWNEV.exe
  2⤵
  PID:9004
- C:\Windows\System\KYddKUR.exe
  C:\Windows\System\KYddKUR.exe
  2⤵
  PID:9032
- C:\Windows\System\SfjxalE.exe
  C:\Windows\System\SfjxalE.exe
  2⤵
  PID:9060
- C:\Windows\System\DPZOzjF.exe
  C:\Windows\System\DPZOzjF.exe
  2⤵
  PID:9088
- C:\Windows\System\WwnTTaK.exe
  C:\Windows\System\WwnTTaK.exe
  2⤵
  PID:9120
- C:\Windows\System\CGHYmvn.exe
  C:\Windows\System\CGHYmvn.exe
  2⤵
  PID:9140
- C:\Windows\System\QIRQiQO.exe
  C:\Windows\System\QIRQiQO.exe
  2⤵
  PID:9168
- C:\Windows\System\zDtrOMP.exe
  C:\Windows\System\zDtrOMP.exe
  2⤵
  PID:9192
- C:\Windows\System\xfCndXd.exe
  C:\Windows\System\xfCndXd.exe
  2⤵
  PID:7976
- C:\Windows\System\vmMJXhx.exe
  C:\Windows\System\vmMJXhx.exe
  2⤵
  PID:8264
- C:\Windows\System\ldpLqoH.exe
  C:\Windows\System\ldpLqoH.exe
  2⤵
  PID:2684
- C:\Windows\System\jRkcTYi.exe
  C:\Windows\System\jRkcTYi.exe
  2⤵
  PID:8308
- C:\Windows\System\BsLkxkm.exe
  C:\Windows\System\BsLkxkm.exe
  2⤵
  PID:8460
- C:\Windows\System\KeHOxZG.exe
  C:\Windows\System\KeHOxZG.exe
  2⤵
  PID:8488
- C:\Windows\System\ldBTZKD.exe
  C:\Windows\System\ldBTZKD.exe
  2⤵
  PID:8432
- C:\Windows\System\OFApbHG.exe
  C:\Windows\System\OFApbHG.exe
  2⤵
  PID:8440
- C:\Windows\System\yCjlCTT.exe
  C:\Windows\System\yCjlCTT.exe
  2⤵
  PID:8708
- C:\Windows\System\edNQJAG.exe
  C:\Windows\System\edNQJAG.exe
  2⤵
  PID:8616
- C:\Windows\System\iLdZODM.exe
  C:\Windows\System\iLdZODM.exe
  2⤵
  PID:8784
- C:\Windows\System\WLAGsnf.exe
  C:\Windows\System\WLAGsnf.exe
  2⤵
  PID:8824
- C:\Windows\System\GpspyHu.exe
  C:\Windows\System\GpspyHu.exe
  2⤵
  PID:8872
- C:\Windows\System\OxULrvG.exe
  C:\Windows\System\OxULrvG.exe
  2⤵
  PID:8940
- C:\Windows\System\DeZTWHU.exe
  C:\Windows\System\DeZTWHU.exe
  2⤵
  PID:9052
- C:\Windows\System\BmCRjsI.exe
  C:\Windows\System\BmCRjsI.exe
  2⤵
  PID:9104
- C:\Windows\System\qIzuPOl.exe
  C:\Windows\System\qIzuPOl.exe
  2⤵
  PID:9164
- C:\Windows\System\cmUEVTR.exe
  C:\Windows\System\cmUEVTR.exe
  2⤵
  PID:9184
- C:\Windows\System\UClXNFc.exe
  C:\Windows\System\UClXNFc.exe
  2⤵
  PID:8240
- C:\Windows\System\yhSQhrL.exe
  C:\Windows\System\yhSQhrL.exe
  2⤵
  PID:8576
- C:\Windows\System\PMidSkp.exe
  C:\Windows\System\PMidSkp.exe
  2⤵
  PID:8684
- C:\Windows\System\SVBSJpB.exe
  C:\Windows\System\SVBSJpB.exe
  2⤵
  PID:8780
- C:\Windows\System\iYpHlFr.exe
  C:\Windows\System\iYpHlFr.exe
  2⤵
  PID:8660
- C:\Windows\System\MTnRIJG.exe
  C:\Windows\System\MTnRIJG.exe
  2⤵
  PID:8904
- C:\Windows\System\VqyJbZm.exe
  C:\Windows\System\VqyJbZm.exe
  2⤵
  PID:8312
- C:\Windows\System\RzioFIj.exe
  C:\Windows\System\RzioFIj.exe
  2⤵
  PID:8292
- C:\Windows\System\EYmXthB.exe
  C:\Windows\System\EYmXthB.exe
  2⤵
  PID:9232
- C:\Windows\System\wYteUtO.exe
  C:\Windows\System\wYteUtO.exe
  2⤵
  PID:9272
- C:\Windows\System\Jiczzhc.exe
  C:\Windows\System\Jiczzhc.exe
  2⤵
  PID:9304
- C:\Windows\System\biCZZZC.exe
  C:\Windows\System\biCZZZC.exe
  2⤵
  PID:9332
- C:\Windows\System\wavZfqX.exe
  C:\Windows\System\wavZfqX.exe
  2⤵
  PID:9352
- C:\Windows\System\PkLddaM.exe
  C:\Windows\System\PkLddaM.exe
  2⤵
  PID:9380
- C:\Windows\System\KOmulUs.exe
  C:\Windows\System\KOmulUs.exe
  2⤵
  PID:9412
- C:\Windows\System\HPvvzMe.exe
  C:\Windows\System\HPvvzMe.exe
  2⤵
  PID:9448
- C:\Windows\System\CSloiEj.exe
  C:\Windows\System\CSloiEj.exe
  2⤵
  PID:9476
- C:\Windows\System\wPCIsSK.exe
  C:\Windows\System\wPCIsSK.exe
  2⤵
  PID:9496
- C:\Windows\System\sajoJef.exe
  C:\Windows\System\sajoJef.exe
  2⤵
  PID:9524
- C:\Windows\System\JRbVFpN.exe
  C:\Windows\System\JRbVFpN.exe
  2⤵
  PID:9556
- C:\Windows\System\pFEIuyK.exe
  C:\Windows\System\pFEIuyK.exe
  2⤵
  PID:9584
- C:\Windows\System\PgBTFJh.exe
  C:\Windows\System\PgBTFJh.exe
  2⤵
  PID:9624
- C:\Windows\System\FtJgidf.exe
  C:\Windows\System\FtJgidf.exe
  2⤵
  PID:9656
- C:\Windows\System\HVoCHHl.exe
  C:\Windows\System\HVoCHHl.exe
  2⤵
  PID:9680
- C:\Windows\System\egDhbNn.exe
  C:\Windows\System\egDhbNn.exe
  2⤵
  PID:9712
- C:\Windows\System\mREPKIC.exe
  C:\Windows\System\mREPKIC.exe
  2⤵
  PID:9740
- C:\Windows\System\LezeYJb.exe
  C:\Windows\System\LezeYJb.exe
  2⤵
  PID:9768
- C:\Windows\System\hOAeiew.exe
  C:\Windows\System\hOAeiew.exe
  2⤵
  PID:9800
- C:\Windows\System\ZkFOmtN.exe
  C:\Windows\System\ZkFOmtN.exe
  2⤵
  PID:9824
- C:\Windows\System\EjUaNRk.exe
  C:\Windows\System\EjUaNRk.exe
  2⤵
  PID:9852
- C:\Windows\System\MCrLNde.exe
  C:\Windows\System\MCrLNde.exe
  2⤵
  PID:9880
- C:\Windows\System\NWcDXUp.exe
  C:\Windows\System\NWcDXUp.exe
  2⤵
  PID:9920
- C:\Windows\System\BvWehAh.exe
  C:\Windows\System\BvWehAh.exe
  2⤵
  PID:9948
- C:\Windows\System\VjiRJZU.exe
  C:\Windows\System\VjiRJZU.exe
  2⤵
  PID:9972
- C:\Windows\System\FZdtZRD.exe
  C:\Windows\System\FZdtZRD.exe
  2⤵
  PID:10004
- C:\Windows\System\ymzXqZF.exe
  C:\Windows\System\ymzXqZF.exe
  2⤵
  PID:10040
- C:\Windows\System\FjWhiPz.exe
  C:\Windows\System\FjWhiPz.exe
  2⤵
  PID:10068
- C:\Windows\System\UFUVVcr.exe
  C:\Windows\System\UFUVVcr.exe
  2⤵
  PID:10092
- C:\Windows\System\whOJxHH.exe
  C:\Windows\System\whOJxHH.exe
  2⤵
  PID:10132
- C:\Windows\System\PtRbgPM.exe
  C:\Windows\System\PtRbgPM.exe
  2⤵
  PID:10164
- C:\Windows\System\zggGhtC.exe
  C:\Windows\System\zggGhtC.exe
  2⤵
  PID:10188
- C:\Windows\System\dnNdnOE.exe
  C:\Windows\System\dnNdnOE.exe
  2⤵
  PID:10212
- C:\Windows\System\GNbHtkv.exe
  C:\Windows\System\GNbHtkv.exe
  2⤵
  PID:8748
- C:\Windows\System\UReInNv.exe
  C:\Windows\System\UReInNv.exe
  2⤵
  PID:9180
- C:\Windows\System\ReqDWpK.exe
  C:\Windows\System\ReqDWpK.exe
  2⤵
  PID:9224
- C:\Windows\System\NrLGKrT.exe
  C:\Windows\System\NrLGKrT.exe
  2⤵
  PID:9388
- C:\Windows\System\qVYJRwF.exe
  C:\Windows\System\qVYJRwF.exe
  2⤵
  PID:9432
- C:\Windows\System\EKixiTg.exe
  C:\Windows\System\EKixiTg.exe
  2⤵
  PID:9440
- C:\Windows\System\wrBikbh.exe
  C:\Windows\System\wrBikbh.exe
  2⤵
  PID:9512
- C:\Windows\System\SGqUIpJ.exe
  C:\Windows\System\SGqUIpJ.exe
  2⤵
  PID:9540
- C:\Windows\System\EFIQmlp.exe
  C:\Windows\System\EFIQmlp.exe
  2⤵
  PID:9708
- C:\Windows\System\UrWSmpE.exe
  C:\Windows\System\UrWSmpE.exe
  2⤵
  PID:9616
- C:\Windows\System\ochHXAw.exe
  C:\Windows\System\ochHXAw.exe
  2⤵
  PID:9780
- C:\Windows\System\zyAGGyH.exe
  C:\Windows\System\zyAGGyH.exe
  2⤵
  PID:9888
- C:\Windows\System\dvjakNz.exe
  C:\Windows\System\dvjakNz.exe
  2⤵
  PID:9916
- C:\Windows\System\VXHXGwA.exe
  C:\Windows\System\VXHXGwA.exe
  2⤵
  PID:10024
- C:\Windows\System\sxikvdH.exe
  C:\Windows\System\sxikvdH.exe
  2⤵
  PID:10060
- C:\Windows\System\NpSSHLk.exe
  C:\Windows\System\NpSSHLk.exe
  2⤵
  PID:10152
- C:\Windows\System\XvVpilH.exe
  C:\Windows\System\XvVpilH.exe
  2⤵
  PID:10220
- C:\Windows\System\cGOMwWq.exe
  C:\Windows\System\cGOMwWq.exe
  2⤵
  PID:10228
- C:\Windows\System\HDcwBGO.exe
  C:\Windows\System\HDcwBGO.exe
  2⤵
  PID:9288
- C:\Windows\System\vfGcTzo.exe
  C:\Windows\System\vfGcTzo.exe
  2⤵
  PID:9568
- C:\Windows\System\QziCRlj.exe
  C:\Windows\System\QziCRlj.exe
  2⤵
  PID:9728
- C:\Windows\System\yLThRAN.exe
  C:\Windows\System\yLThRAN.exe
  2⤵
  PID:9836
- C:\Windows\System\uxKxKwB.exe
  C:\Windows\System\uxKxKwB.exe
  2⤵
  PID:10144
- C:\Windows\System\XRamxtB.exe
  C:\Windows\System\XRamxtB.exe
  2⤵
  PID:10124
- C:\Windows\System\RJiybwL.exe
  C:\Windows\System\RJiybwL.exe
  2⤵
  PID:9404
- C:\Windows\System\MYCrbZW.exe
  C:\Windows\System\MYCrbZW.exe
  2⤵
  PID:9532
- C:\Windows\System\pIASIBg.exe
  C:\Windows\System\pIASIBg.exe
  2⤵
  PID:9968
- C:\Windows\System\BvCfLBq.exe
  C:\Windows\System\BvCfLBq.exe
  2⤵
  PID:8448
- C:\Windows\System\TydkKQy.exe
  C:\Windows\System\TydkKQy.exe
  2⤵
  PID:9520
- C:\Windows\System\sePVrvE.exe
  C:\Windows\System\sePVrvE.exe
  2⤵
  PID:10264
- C:\Windows\System\yQGaWbH.exe
  C:\Windows\System\yQGaWbH.exe
  2⤵
  PID:10292
- C:\Windows\System\Tupsbgq.exe
  C:\Windows\System\Tupsbgq.exe
  2⤵
  PID:10320
- C:\Windows\System\ZffEipn.exe
  C:\Windows\System\ZffEipn.exe
  2⤵
  PID:10356
- C:\Windows\System\rUyZqrh.exe
  C:\Windows\System\rUyZqrh.exe
  2⤵
  PID:10384
- C:\Windows\System\sQSaDJa.exe
  C:\Windows\System\sQSaDJa.exe
  2⤵
  PID:10412
- C:\Windows\System\WWgefMs.exe
  C:\Windows\System\WWgefMs.exe
  2⤵
  PID:10440
- C:\Windows\System\YSDXbQw.exe
  C:\Windows\System\YSDXbQw.exe
  2⤵
  PID:10456
- C:\Windows\System\EknJjzJ.exe
  C:\Windows\System\EknJjzJ.exe
  2⤵
  PID:10476
- C:\Windows\System\kAxzHts.exe
  C:\Windows\System\kAxzHts.exe
  2⤵
  PID:10512
- C:\Windows\System\CsrJqMR.exe
  C:\Windows\System\CsrJqMR.exe
  2⤵
  PID:10540
- C:\Windows\System\BRYiIPs.exe
  C:\Windows\System\BRYiIPs.exe
  2⤵
  PID:10572
- C:\Windows\System\AIszcbL.exe
  C:\Windows\System\AIszcbL.exe
  2⤵
  PID:10600
- C:\Windows\System\uvpznfJ.exe
  C:\Windows\System\uvpznfJ.exe
  2⤵
  PID:10628
- C:\Windows\System\WVCgXcw.exe
  C:\Windows\System\WVCgXcw.exe
  2⤵
  PID:10664
- C:\Windows\System\WZOuYEN.exe
  C:\Windows\System\WZOuYEN.exe
  2⤵
  PID:10692
- C:\Windows\System\wDewbCb.exe
  C:\Windows\System\wDewbCb.exe
  2⤵
  PID:10720
- C:\Windows\System\hvAbmFy.exe
  C:\Windows\System\hvAbmFy.exe
  2⤵
  PID:10748
- C:\Windows\System\zphCnoM.exe
  C:\Windows\System\zphCnoM.exe
  2⤵
  PID:10784
- C:\Windows\System\rRFScwn.exe
  C:\Windows\System\rRFScwn.exe
  2⤵
  PID:10812
- C:\Windows\System\yPnjbqn.exe
  C:\Windows\System\yPnjbqn.exe
  2⤵
  PID:10832
- C:\Windows\System\AqSEyxb.exe
  C:\Windows\System\AqSEyxb.exe
  2⤵
  PID:10860
- C:\Windows\System\WrbYzTP.exe
  C:\Windows\System\WrbYzTP.exe
  2⤵
  PID:10884
- C:\Windows\System\nyNeBTM.exe
  C:\Windows\System\nyNeBTM.exe
  2⤵
  PID:10920
- C:\Windows\System\nwNFkzx.exe
  C:\Windows\System\nwNFkzx.exe
  2⤵
  PID:10952
- C:\Windows\System\GCwoGAY.exe
  C:\Windows\System\GCwoGAY.exe
  2⤵
  PID:10984
- C:\Windows\System\dXpYaRq.exe
  C:\Windows\System\dXpYaRq.exe
  2⤵
  PID:11012
- C:\Windows\System\ZNNxtha.exe
  C:\Windows\System\ZNNxtha.exe
  2⤵
  PID:11036
- C:\Windows\System\wLTdpMy.exe
  C:\Windows\System\wLTdpMy.exe
  2⤵
  PID:11072
- C:\Windows\System\peqbYXa.exe
  C:\Windows\System\peqbYXa.exe
  2⤵
  PID:11092
- C:\Windows\System\gEtjEoD.exe
  C:\Windows\System\gEtjEoD.exe
  2⤵
  PID:11116
- C:\Windows\System\iQfPLDx.exe
  C:\Windows\System\iQfPLDx.exe
  2⤵
  PID:11156
- C:\Windows\System\YOCwdhH.exe
  C:\Windows\System\YOCwdhH.exe
  2⤵
  PID:11180
- C:\Windows\System\eFssrLh.exe
  C:\Windows\System\eFssrLh.exe
  2⤵
  PID:11200
- C:\Windows\System\inaKIxW.exe
  C:\Windows\System\inaKIxW.exe
  2⤵
  PID:11228
- C:\Windows\System\hHspFit.exe
  C:\Windows\System\hHspFit.exe
  2⤵
  PID:11260
- C:\Windows\System\cSzoTUr.exe
  C:\Windows\System\cSzoTUr.exe
  2⤵
  PID:10288
- C:\Windows\System\ltTpzpg.exe
  C:\Windows\System\ltTpzpg.exe
  2⤵
  PID:10352
- C:\Windows\System\xerNKIc.exe
  C:\Windows\System\xerNKIc.exe
  2⤵
  PID:10380
- C:\Windows\System\EXkDcmG.exe
  C:\Windows\System\EXkDcmG.exe
  2⤵
  PID:10436
- C:\Windows\System\lDpoDML.exe
  C:\Windows\System\lDpoDML.exe
  2⤵
  PID:10504
- C:\Windows\System\hNSqdVF.exe
  C:\Windows\System\hNSqdVF.exe
  2⤵
  PID:10580
- C:\Windows\System\fJpOmtn.exe
  C:\Windows\System\fJpOmtn.exe
  2⤵
  PID:10676
- C:\Windows\System\eGpxQlT.exe
  C:\Windows\System\eGpxQlT.exe
  2⤵
  PID:10732
- C:\Windows\System\sHLuDez.exe
  C:\Windows\System\sHLuDez.exe
  2⤵
  PID:10820
- C:\Windows\System\OlitToZ.exe
  C:\Windows\System\OlitToZ.exe
  2⤵
  PID:10928
- C:\Windows\System\ldaTNqA.exe
  C:\Windows\System\ldaTNqA.exe
  2⤵
  PID:10980
- C:\Windows\System\dXdgGgw.exe
  C:\Windows\System\dXdgGgw.exe
  2⤵
  PID:11056
- C:\Windows\System\sTJMpEs.exe
  C:\Windows\System\sTJMpEs.exe
  2⤵
  PID:11128
- C:\Windows\System\cCXYvJL.exe
  C:\Windows\System\cCXYvJL.exe
  2⤵
  PID:11148
- C:\Windows\System\gnHQPmb.exe
  C:\Windows\System\gnHQPmb.exe
  2⤵
  PID:11256
- C:\Windows\System\jXNTXKK.exe
  C:\Windows\System\jXNTXKK.exe
  2⤵
  PID:10328
- C:\Windows\System\fCPKVeb.exe
  C:\Windows\System\fCPKVeb.exe
  2⤵
  PID:10464
- C:\Windows\System\OefTiIX.exe
  C:\Windows\System\OefTiIX.exe
  2⤵
  PID:10624
- C:\Windows\System\GwxEHzU.exe
  C:\Windows\System\GwxEHzU.exe
  2⤵
  PID:10740
- C:\Windows\System\ngPiqZN.exe
  C:\Windows\System\ngPiqZN.exe
  2⤵
  PID:10868
- C:\Windows\System\wlinUpA.exe
  C:\Windows\System\wlinUpA.exe
  2⤵
  PID:10996
- C:\Windows\System\RUBrGAy.exe
  C:\Windows\System\RUBrGAy.exe
  2⤵
  PID:11248
- C:\Windows\System\UqfpDvC.exe
  C:\Windows\System\UqfpDvC.exe
  2⤵
  PID:10648
- C:\Windows\System\gvKmuPQ.exe
  C:\Windows\System\gvKmuPQ.exe
  2⤵
  PID:10808
- C:\Windows\System\HOaPbKo.exe
  C:\Windows\System\HOaPbKo.exe
  2⤵
  PID:10424
- C:\Windows\System\LxAvRcU.exe
  C:\Windows\System\LxAvRcU.exe
  2⤵
  PID:10716
- C:\Windows\System\EtExLGM.exe
  C:\Windows\System\EtExLGM.exe
  2⤵
  PID:11268
- C:\Windows\System\kxvGNxf.exe
  C:\Windows\System\kxvGNxf.exe
  2⤵
  PID:11308
- C:\Windows\System\yaYAuhg.exe
  C:\Windows\System\yaYAuhg.exe
  2⤵
  PID:11336
- C:\Windows\System\CiZqiHr.exe
  C:\Windows\System\CiZqiHr.exe
  2⤵
  PID:11364
- C:\Windows\System\qJTMDKx.exe
  C:\Windows\System\qJTMDKx.exe
  2⤵
  PID:11396
- C:\Windows\System\gJKHSTp.exe
  C:\Windows\System\gJKHSTp.exe
  2⤵
  PID:11424
- C:\Windows\System\hZYqWzj.exe
  C:\Windows\System\hZYqWzj.exe
  2⤵
  PID:11452
- C:\Windows\System\JYxASyk.exe
  C:\Windows\System\JYxASyk.exe
  2⤵
  PID:11468
- C:\Windows\System\LLrbALd.exe
  C:\Windows\System\LLrbALd.exe
  2⤵
  PID:11492
- C:\Windows\System\DhPvYEy.exe
  C:\Windows\System\DhPvYEy.exe
  2⤵
  PID:11512
- C:\Windows\System\dtgNpWX.exe
  C:\Windows\System\dtgNpWX.exe
  2⤵
  PID:11536
- C:\Windows\System\DdwqIba.exe
  C:\Windows\System\DdwqIba.exe
  2⤵
  PID:11552
- C:\Windows\System\frYcVWW.exe
  C:\Windows\System\frYcVWW.exe
  2⤵
  PID:11572
- C:\Windows\System\NlxTSfi.exe
  C:\Windows\System\NlxTSfi.exe
  2⤵
  PID:11608
- C:\Windows\System\xNNqzqX.exe
  C:\Windows\System\xNNqzqX.exe
  2⤵
  PID:11632
- C:\Windows\System\OCqMizv.exe
  C:\Windows\System\OCqMizv.exe
  2⤵
  PID:11664
- C:\Windows\System\UEZZuNM.exe
  C:\Windows\System\UEZZuNM.exe
  2⤵
  PID:11692
- C:\Windows\System\BxlXmgU.exe
  C:\Windows\System\BxlXmgU.exe
  2⤵
  PID:11716
- C:\Windows\System\FZgQNxp.exe
  C:\Windows\System\FZgQNxp.exe
  2⤵
  PID:11740
- C:\Windows\System\eZfwgEX.exe
  C:\Windows\System\eZfwgEX.exe
  2⤵
  PID:11772
- C:\Windows\System\weITKbZ.exe
  C:\Windows\System\weITKbZ.exe
  2⤵
  PID:11800
- C:\Windows\System\jxtRGjy.exe
  C:\Windows\System\jxtRGjy.exe
  2⤵
  PID:11832
- C:\Windows\System\wbJpoTm.exe
  C:\Windows\System\wbJpoTm.exe
  2⤵
  PID:11868
- C:\Windows\System\chzNjBj.exe
  C:\Windows\System\chzNjBj.exe
  2⤵
  PID:11896
- C:\Windows\System\zhJJoyU.exe
  C:\Windows\System\zhJJoyU.exe
  2⤵
  PID:11924
- C:\Windows\System\geaEslq.exe
  C:\Windows\System\geaEslq.exe
  2⤵
  PID:11944
- C:\Windows\System\dbCcbmP.exe
  C:\Windows\System\dbCcbmP.exe
  2⤵
  PID:11964
- C:\Windows\System\MEdyhFA.exe
  C:\Windows\System\MEdyhFA.exe
  2⤵
  PID:11996
- C:\Windows\System\GJZVBMO.exe
  C:\Windows\System\GJZVBMO.exe
  2⤵
  PID:12024
- C:\Windows\System\ltaYXbR.exe
  C:\Windows\System\ltaYXbR.exe
  2⤵
  PID:12052
- C:\Windows\System\MGqbcIt.exe
  C:\Windows\System\MGqbcIt.exe
  2⤵
  PID:12084
- C:\Windows\System\GduCzev.exe
  C:\Windows\System\GduCzev.exe
  2⤵
  PID:12116
- C:\Windows\System\GusRDqO.exe
  C:\Windows\System\GusRDqO.exe
  2⤵
  PID:12148
- C:\Windows\System\FPuCSoA.exe
  C:\Windows\System\FPuCSoA.exe
  2⤵
  PID:12176
- C:\Windows\System\slISjfc.exe
  C:\Windows\System\slISjfc.exe
  2⤵
  PID:12208
- C:\Windows\System\OdKNedc.exe
  C:\Windows\System\OdKNedc.exe
  2⤵
  PID:12240
- C:\Windows\System\jQXKsHK.exe
  C:\Windows\System\jQXKsHK.exe
  2⤵
  PID:12272
- C:\Windows\System\JmVySWX.exe
  C:\Windows\System\JmVySWX.exe
  2⤵
  PID:11288
- C:\Windows\System\EDeNfIB.exe
  C:\Windows\System\EDeNfIB.exe
  2⤵
  PID:11320
- C:\Windows\System\uGYdOkJ.exe
  C:\Windows\System\uGYdOkJ.exe
  2⤵
  PID:11404
- C:\Windows\System\DcChxtl.exe
  C:\Windows\System\DcChxtl.exe
  2⤵
  PID:11436
- C:\Windows\System\IYAerNP.exe
  C:\Windows\System\IYAerNP.exe
  2⤵
  PID:11500
- C:\Windows\System\SNFtBcE.exe
  C:\Windows\System\SNFtBcE.exe
  2⤵
  PID:11544
- C:\Windows\System\TGvNOnM.exe
  C:\Windows\System\TGvNOnM.exe
  2⤵
  PID:11652
- C:\Windows\System\hEpnLQQ.exe
  C:\Windows\System\hEpnLQQ.exe
  2⤵
  PID:11568
- C:\Windows\System\IZSIVRL.exe
  C:\Windows\System\IZSIVRL.exe
  2⤵
  PID:11708
- C:\Windows\System\qSnaDYW.exe
  C:\Windows\System\qSnaDYW.exe
  2⤵
  PID:11764
- C:\Windows\System\tmXlRAw.exe
  C:\Windows\System\tmXlRAw.exe
  2⤵
  PID:11816
- C:\Windows\System\aYrMzUy.exe
  C:\Windows\System\aYrMzUy.exe
  2⤵
  PID:11844
- C:\Windows\System\fOCpXVF.exe
  C:\Windows\System\fOCpXVF.exe
  2⤵
  PID:11972
- C:\Windows\System\OAkjqyn.exe
  C:\Windows\System\OAkjqyn.exe
  2⤵
  PID:12040
- C:\Windows\System\GRWvDdU.exe
  C:\Windows\System\GRWvDdU.exe
  2⤵
  PID:12136
- C:\Windows\System\HPavQRV.exe
  C:\Windows\System\HPavQRV.exe
  2⤵
  PID:12224
- C:\Windows\System\DLjWeKA.exe
  C:\Windows\System\DLjWeKA.exe
  2⤵
  PID:12268
- C:\Windows\System\ZSynazk.exe
  C:\Windows\System\ZSynazk.exe
  2⤵
  PID:10704
- C:\Windows\System\pljdllP.exe
  C:\Windows\System\pljdllP.exe
  2⤵
  PID:11328
- C:\Windows\System\HQaPGZY.exe
  C:\Windows\System\HQaPGZY.exe
  2⤵
  PID:11484
- C:\Windows\System\MhDPXzn.exe
  C:\Windows\System\MhDPXzn.exe
  2⤵
  PID:11624
- C:\Windows\System\FoJMHlq.exe
  C:\Windows\System\FoJMHlq.exe
  2⤵
  PID:11792
- C:\Windows\System\KxjBdGY.exe
  C:\Windows\System\KxjBdGY.exe
  2⤵
  PID:11892
- C:\Windows\System\cRpHLLd.exe
  C:\Windows\System\cRpHLLd.exe
  2⤵
  PID:12196
- C:\Windows\System\pDfEntY.exe
  C:\Windows\System\pDfEntY.exe
  2⤵
  PID:11440
- C:\Windows\System\YblnUoH.exe
  C:\Windows\System\YblnUoH.exe
  2⤵
  PID:11940
- C:\Windows\System\NPMlWHP.exe
  C:\Windows\System\NPMlWHP.exe
  2⤵
  PID:12300
- C:\Windows\System\ZLQTaVu.exe
  C:\Windows\System\ZLQTaVu.exe
  2⤵
  PID:12320
- C:\Windows\System\WLYlPrl.exe
  C:\Windows\System\WLYlPrl.exe
  2⤵
  PID:12352
- C:\Windows\System\cjWqvay.exe
  C:\Windows\System\cjWqvay.exe
  2⤵
  PID:12380
- C:\Windows\System\qcfJCUe.exe
  C:\Windows\System\qcfJCUe.exe
  2⤵
  PID:12400
- C:\Windows\System\oVELhoP.exe
  C:\Windows\System\oVELhoP.exe
  2⤵
  PID:12440
- C:\Windows\System\flmRZBO.exe
  C:\Windows\System\flmRZBO.exe
  2⤵
  PID:12468
- C:\Windows\System\BtRqdDP.exe
  C:\Windows\System\BtRqdDP.exe
  2⤵
  PID:12496
- C:\Windows\System\IRZhubc.exe
  C:\Windows\System\IRZhubc.exe
  2⤵
  PID:12524
- C:\Windows\System\KWpdNKH.exe
  C:\Windows\System\KWpdNKH.exe
  2⤵
  PID:12552
- C:\Windows\System\DwGjpmX.exe
  C:\Windows\System\DwGjpmX.exe
  2⤵
  PID:12568
- C:\Windows\System\tEqXUXr.exe
  C:\Windows\System\tEqXUXr.exe
  2⤵
  PID:12600
- C:\Windows\System\JmeNpNI.exe
  C:\Windows\System\JmeNpNI.exe
  2⤵
  PID:12628
- C:\Windows\System\UHiiqWO.exe
  C:\Windows\System\UHiiqWO.exe
  2⤵
  PID:12672
- C:\Windows\System\EfHdVOU.exe
  C:\Windows\System\EfHdVOU.exe
  2⤵
  PID:12692
- C:\Windows\System\fqUYRbK.exe
  C:\Windows\System\fqUYRbK.exe
  2⤵
  PID:12724
- C:\Windows\System\yyXkvXf.exe
  C:\Windows\System\yyXkvXf.exe
  2⤵
  PID:12748
- C:\Windows\System\Dajzsbc.exe
  C:\Windows\System\Dajzsbc.exe
  2⤵
  PID:12780
- C:\Windows\System\aYMhHwA.exe
  C:\Windows\System\aYMhHwA.exe
  2⤵
  PID:12804
- C:\Windows\System\lAQysbB.exe
  C:\Windows\System\lAQysbB.exe
  2⤵
  PID:12828
- C:\Windows\System\AjaKGDg.exe
  C:\Windows\System\AjaKGDg.exe
  2⤵
  PID:12852
- C:\Windows\System\EoGaaVY.exe
  C:\Windows\System\EoGaaVY.exe
  2⤵
  PID:12880
- C:\Windows\System\rGcGSpz.exe
  C:\Windows\System\rGcGSpz.exe
  2⤵
  PID:12908
- C:\Windows\System\RGKaUJx.exe
  C:\Windows\System\RGKaUJx.exe
  2⤵
  PID:12936
- C:\Windows\System\OFRfXHK.exe
  C:\Windows\System\OFRfXHK.exe
  2⤵
  PID:12972
- C:\Windows\System\dnWGpKp.exe
  C:\Windows\System\dnWGpKp.exe
  2⤵
  PID:13000
- C:\Windows\System\GwZLvJB.exe
  C:\Windows\System\GwZLvJB.exe
  2⤵
  PID:13028
- C:\Windows\System\aCISwTR.exe
  C:\Windows\System\aCISwTR.exe
  2⤵
  PID:13060
- C:\Windows\System\YJQAtbc.exe
  C:\Windows\System\YJQAtbc.exe
  2⤵
  PID:13088
- C:\Windows\System\yxlEles.exe
  C:\Windows\System\yxlEles.exe
  2⤵
  PID:13120
- C:\Windows\System\VDvFrFO.exe
  C:\Windows\System\VDvFrFO.exe
  2⤵
  PID:13140
- C:\Windows\System\yRoaSJM.exe
  C:\Windows\System\yRoaSJM.exe
  2⤵
  PID:13168
- C:\Windows\System\KBDwEQT.exe
  C:\Windows\System\KBDwEQT.exe
  2⤵
  PID:13200
- C:\Windows\System\xTqzqFP.exe
  C:\Windows\System\xTqzqFP.exe
  2⤵
  PID:13232
- C:\Windows\System\qEYhQyI.exe
  C:\Windows\System\qEYhQyI.exe
  2⤵
  PID:13260
- C:\Windows\System\ckWTaHI.exe
  C:\Windows\System\ckWTaHI.exe
  2⤵
  PID:13300
- C:\Windows\System\kJLLzoB.exe
  C:\Windows\System\kJLLzoB.exe
  2⤵
  PID:11784
- C:\Windows\System\LLdfMIc.exe
  C:\Windows\System\LLdfMIc.exe
  2⤵
  PID:12296
- C:\Windows\System\bizohub.exe
  C:\Windows\System\bizohub.exe
  2⤵
  PID:12332
- C:\Windows\System\XfkCmZm.exe
  C:\Windows\System\XfkCmZm.exe
  2⤵
  PID:12372
- C:\Windows\System\lbmKfXh.exe
  C:\Windows\System\lbmKfXh.exe
  2⤵
  PID:12368
- C:\Windows\System\rarwkDj.exe
  C:\Windows\System\rarwkDj.exe
  2⤵
  PID:12484
- C:\Windows\System\hEWoCNK.exe
  C:\Windows\System\hEWoCNK.exe
  2⤵
  PID:12580
- C:\Windows\System\CAJpBPg.exe
  C:\Windows\System\CAJpBPg.exe
  2⤵
  PID:12544
- C:\Windows\System\ohOoiWp.exe
  C:\Windows\System\ohOoiWp.exe
  2⤵
  PID:12720
- C:\Windows\System\uoltgev.exe
  C:\Windows\System\uoltgev.exe
  2⤵
  PID:12680
- C:\Windows\System\mtZejAB.exe
  C:\Windows\System\mtZejAB.exe
  2⤵
  PID:12740
- C:\Windows\System\FhhbzzH.exe
  C:\Windows\System\FhhbzzH.exe
  2⤵
  PID:12924
- C:\Windows\System\fBWowrh.exe
  C:\Windows\System\fBWowrh.exe
  2⤵
  PID:12848
- C:\Windows\System\bGitkWd.exe
  C:\Windows\System\bGitkWd.exe
  2⤵
  PID:11108
- C:\Windows\System\mdGjEuP.exe
  C:\Windows\System\mdGjEuP.exe
  2⤵
  PID:12992
- C:\Windows\System\YCnQYHU.exe
  C:\Windows\System\YCnQYHU.exe
  2⤵
  PID:13084
- C:\Windows\System\NwzbfDy.exe
  C:\Windows\System\NwzbfDy.exe
  2⤵
  PID:13272
- C:\Windows\System\VINCEPd.exe
  C:\Windows\System\VINCEPd.exe
  2⤵
  PID:11628
- C:\Windows\System\HMZgGSV.exe
  C:\Windows\System\HMZgGSV.exe
  2⤵
  PID:13248
- C:\Windows\System\MAMZmuS.exe
  C:\Windows\System\MAMZmuS.exe
  2⤵
  PID:12316
- C:\Windows\System\cGDAphx.exe
  C:\Windows\System\cGDAphx.exe
  2⤵
  PID:12560
- C:\Windows\System\KgGvxYK.exe
  C:\Windows\System\KgGvxYK.exe
  2⤵
  PID:12488
- C:\Windows\System\fhyvUhL.exe
  C:\Windows\System\fhyvUhL.exe
  2⤵
  PID:13048
- C:\Windows\System\GxCKhEb.exe
  C:\Windows\System\GxCKhEb.exe
  2⤵
  PID:13176
- C:\Windows\System\VCsAlFX.exe
  C:\Windows\System\VCsAlFX.exe
  2⤵
  PID:12956
- C:\Windows\System\ANQUIvz.exe
  C:\Windows\System\ANQUIvz.exe
  2⤵
  PID:13080
- C:\Windows\System\XrxoVnK.exe
  C:\Windows\System\XrxoVnK.exe
  2⤵
  PID:12796
- C:\Windows\System\SDuwUkS.exe
  C:\Windows\System\SDuwUkS.exe
  2⤵
  PID:12460
- C:\Windows\System\vaKiylI.exe
  C:\Windows\System\vaKiylI.exe
  2⤵
  PID:13320
- C:\Windows\System\nkLppAs.exe
  C:\Windows\System\nkLppAs.exe
  2⤵
  PID:13340
- C:\Windows\System\egTsdhD.exe
  C:\Windows\System\egTsdhD.exe
  2⤵
  PID:13360
- C:\Windows\System\aVZqdaP.exe
  C:\Windows\System\aVZqdaP.exe
  2⤵
  PID:13392
- C:\Windows\System\tMXJJqL.exe
  C:\Windows\System\tMXJJqL.exe
  2⤵
  PID:13420
- C:\Windows\System\qmDndUL.exe
  C:\Windows\System\qmDndUL.exe
  2⤵
  PID:13464
- C:\Windows\System\OyuQoat.exe
  C:\Windows\System\OyuQoat.exe
  2⤵
  PID:13492
- C:\Windows\System\SktLpBb.exe
  C:\Windows\System\SktLpBb.exe
  2⤵
  PID:13520
- C:\Windows\System\UjdozbD.exe
  C:\Windows\System\UjdozbD.exe
  2⤵
  PID:13548
- C:\Windows\System\yxmmmgS.exe
  C:\Windows\System\yxmmmgS.exe
  2⤵
  PID:13580
- C:\Windows\System\Suroqwy.exe
  C:\Windows\System\Suroqwy.exe
  2⤵
  PID:13612
- C:\Windows\System\dTVzZQW.exe
  C:\Windows\System\dTVzZQW.exe
  2⤵
  PID:13640
- C:\Windows\System\gVmtxlP.exe
  C:\Windows\System\gVmtxlP.exe
  2⤵
  PID:13668
- C:\Windows\System\dsBFlGJ.exe
  C:\Windows\System\dsBFlGJ.exe
  2⤵
  PID:13692
- C:\Windows\System\ctqqKFv.exe
  C:\Windows\System\ctqqKFv.exe
  2⤵
  PID:13724
- C:\Windows\System\veiOTVv.exe
  C:\Windows\System\veiOTVv.exe
  2⤵
  PID:13756
- C:\Windows\System\mQillxG.exe
  C:\Windows\System\mQillxG.exe
  2⤵
  PID:13784
- C:\Windows\System\jMQcVFR.exe
  C:\Windows\System\jMQcVFR.exe
  2⤵
  PID:13812
- C:\Windows\System\sFRrgDo.exe
  C:\Windows\System\sFRrgDo.exe
  2⤵
  PID:13840
- C:\Windows\System\UdnuFAw.exe
  C:\Windows\System\UdnuFAw.exe
  2⤵
  PID:13864
- C:\Windows\System\czjnnLx.exe
  C:\Windows\System\czjnnLx.exe
  2⤵
  PID:13896
- C:\Windows\System\kbuLUmF.exe
  C:\Windows\System\kbuLUmF.exe
  2⤵
  PID:13920
- C:\Windows\System\jQllLNr.exe
  C:\Windows\System\jQllLNr.exe
  2⤵
  PID:13948
- C:\Windows\System\CYNIYwu.exe
  C:\Windows\System\CYNIYwu.exe
  2⤵
  PID:13976
- C:\Windows\System\dTkoEdI.exe
  C:\Windows\System\dTkoEdI.exe
  2⤵
  PID:14000
- C:\Windows\System\wTZMWrz.exe
  C:\Windows\System\wTZMWrz.exe
  2⤵
  PID:14028
- C:\Windows\System\RJXByWJ.exe
  C:\Windows\System\RJXByWJ.exe
  2⤵
  PID:14052
- C:\Windows\System\XDHeuIw.exe
  C:\Windows\System\XDHeuIw.exe
  2⤵
  PID:14084
- C:\Windows\System\VFuXYWR.exe
  C:\Windows\System\VFuXYWR.exe
  2⤵
  PID:14104
- C:\Windows\System\utyRfjN.exe
  C:\Windows\System\utyRfjN.exe
  2⤵
  PID:14128
- C:\Windows\System\QORcACV.exe
  C:\Windows\System\QORcACV.exe
  2⤵
  PID:14152
- C:\Windows\System\tXcIseD.exe
  C:\Windows\System\tXcIseD.exe
  2⤵
  PID:14192
- C:\Windows\System\dTQIyFC.exe
  C:\Windows\System\dTQIyFC.exe
  2⤵
  PID:14220
- C:\Windows\System\nYKmdio.exe
  C:\Windows\System\nYKmdio.exe
  2⤵
  PID:14252
- C:\Windows\System\VBQouRF.exe
  C:\Windows\System\VBQouRF.exe
  2⤵
  PID:14280
- C:\Windows\System\nFFWsHe.exe
  C:\Windows\System\nFFWsHe.exe
  2⤵
  PID:14300
- C:\Windows\System\vrrERVZ.exe
  C:\Windows\System\vrrERVZ.exe
  2⤵
  PID:13184
- C:\Windows\System\fKovbUO.exe
  C:\Windows\System\fKovbUO.exe
  2⤵
  PID:13016
- C:\Windows\System\OcyZGse.exe
  C:\Windows\System\OcyZGse.exe
  2⤵
  PID:13316
- C:\Windows\System\zhRWtfF.exe
  C:\Windows\System\zhRWtfF.exe
  2⤵
  PID:13388
- C:\Windows\System\tuNbhwD.exe
  C:\Windows\System\tuNbhwD.exe
  2⤵
  PID:13512
- C:\Windows\System\MWLIHTu.exe
  C:\Windows\System\MWLIHTu.exe
  2⤵
  PID:13564
- C:\Windows\System\EkmnoCI.exe
  C:\Windows\System\EkmnoCI.exe
  2⤵
  PID:13444
- C:\Windows\System\yMOGDiG.exe
  C:\Windows\System\yMOGDiG.exe
  2⤵
  PID:13604
- C:\Windows\System\OszAKLG.exe
  C:\Windows\System\OszAKLG.exe
  2⤵
  PID:13652
- C:\Windows\System\iqWyoLJ.exe
  C:\Windows\System\iqWyoLJ.exe
  2⤵
  PID:13852
- C:\Windows\System\nfURyFe.exe
  C:\Windows\System\nfURyFe.exe
  2⤵
  PID:13776
- C:\Windows\System\BaeLvHH.exe
  C:\Windows\System\BaeLvHH.exe
  2⤵
  PID:13800
- C:\Windows\System\cxsIJVi.exe
  C:\Windows\System\cxsIJVi.exe
  2⤵
  PID:13944
- C:\Windows\System\rjsfSNs.exe
  C:\Windows\System\rjsfSNs.exe
  2⤵
  PID:13992
- C:\Windows\System\XiAxBFW.exe
  C:\Windows\System\XiAxBFW.exe
  2⤵
  PID:14048
- C:\Windows\System\dBnQHIg.exe
  C:\Windows\System\dBnQHIg.exe
  2⤵
  PID:14096
- C:\Windows\System\yjoPCKD.exe
  C:\Windows\System\yjoPCKD.exe
  2⤵
  PID:14272
- C:\Windows\System\nOZCVwI.exe
  C:\Windows\System\nOZCVwI.exe
  2⤵
  PID:12624
- C:\Windows\System\qzQRAUQ.exe
  C:\Windows\System\qzQRAUQ.exe
  2⤵
  PID:14248
- C:\Windows\System\wSFfGec.exe
  C:\Windows\System\wSFfGec.exe
  2⤵
  PID:14116
- C:\Windows\System\mMUWnwW.exe
  C:\Windows\System\mMUWnwW.exe
  2⤵
  PID:14332
- C:\Windows\System\fKhKAAk.exe
  C:\Windows\System\fKhKAAk.exe
  2⤵
  PID:13352
- C:\Windows\System\YYrcIxH.exe
  C:\Windows\System\YYrcIxH.exe
  2⤵
  PID:13404
- C:\Windows\System\XmDfEmO.exe
  C:\Windows\System\XmDfEmO.exe
  2⤵
  PID:13832
- C:\Windows\System\RynaHcC.exe
  C:\Windows\System\RynaHcC.exe
  2⤵
  PID:13704
- C:\Windows\System\MlXuHSA.exe
  C:\Windows\System\MlXuHSA.exe
  2⤵
  PID:14352
- C:\Windows\System\UJTilvX.exe
  C:\Windows\System\UJTilvX.exe
  2⤵
  PID:14388
- C:\Windows\System\yPxgfgG.exe
  C:\Windows\System\yPxgfgG.exe
  2⤵
  PID:14416
- C:\Windows\System\cCDivmg.exe
  C:\Windows\System\cCDivmg.exe
  2⤵
  PID:14436
- C:\Windows\System\rANQrhU.exe
  C:\Windows\System\rANQrhU.exe
  2⤵
  PID:14452
- C:\Windows\System\DsZjaRW.exe
  C:\Windows\System\DsZjaRW.exe
  2⤵
  PID:14468
- C:\Windows\System\gZwvdJL.exe
  C:\Windows\System\gZwvdJL.exe
  2⤵
  PID:14488
- C:\Windows\System\pgmhJRk.exe
  C:\Windows\System\pgmhJRk.exe
  2⤵
  PID:14516
- C:\Windows\System\sAZGOQt.exe
  C:\Windows\System\sAZGOQt.exe
  2⤵
  PID:14548
- C:\Windows\System\QcDCanT.exe
  C:\Windows\System\QcDCanT.exe
  2⤵
  PID:14572
- C:\Windows\System\RnfwMIE.exe
  C:\Windows\System\RnfwMIE.exe
  2⤵
  PID:14596
- C:\Windows\System\DmeVuyc.exe
  C:\Windows\System\DmeVuyc.exe
  2⤵
  PID:14620
- C:\Windows\System\EnVQfqR.exe
  C:\Windows\System\EnVQfqR.exe
  2⤵
  PID:14644
- C:\Windows\System\pLPZWYd.exe
  C:\Windows\System\pLPZWYd.exe
  2⤵
  PID:14672
- C:\Windows\System\skgtLwI.exe
  C:\Windows\System\skgtLwI.exe
  2⤵
  PID:14688
- C:\Windows\System\BjFsJGm.exe
  C:\Windows\System\BjFsJGm.exe
  2⤵
  PID:14704
- C:\Windows\System\GigvNNW.exe
  C:\Windows\System\GigvNNW.exe
  2⤵
  PID:14740
- C:\Windows\System\zxpIMeW.exe
  C:\Windows\System\zxpIMeW.exe
  2⤵
  PID:14768
- C:\Windows\System\UVaNgPQ.exe
  C:\Windows\System\UVaNgPQ.exe
  2⤵
  PID:14832
- C:\Windows\System\hCZpcjQ.exe
  C:\Windows\System\hCZpcjQ.exe
  2⤵
  PID:14868
- C:\Windows\System\CtTZelm.exe
  C:\Windows\System\CtTZelm.exe
  2⤵
  PID:14896
- C:\Windows\System\UmkdcSd.exe
  C:\Windows\System\UmkdcSd.exe
  2⤵
  PID:14924
- C:\Windows\System\jnoVXwZ.exe
  C:\Windows\System\jnoVXwZ.exe
  2⤵
  PID:14952
- C:\Windows\System\mfSZMQs.exe
  C:\Windows\System\mfSZMQs.exe
  2⤵
  PID:14968
- C:\Windows\System\QAqasXq.exe
  C:\Windows\System\QAqasXq.exe
  2⤵
  PID:14984
- C:\Windows\System\WzaamNC.exe
  C:\Windows\System\WzaamNC.exe
  2⤵
  PID:15016
- C:\Windows\System\SdbKoci.exe
  C:\Windows\System\SdbKoci.exe
  2⤵
  PID:15040
- C:\Windows\System\bJzyeuE.exe
  C:\Windows\System\bJzyeuE.exe
  2⤵
  PID:15068
- C:\Windows\System\xvHualp.exe
  C:\Windows\System\xvHualp.exe
  2⤵
  PID:15096
- C:\Windows\System\PKHwsEh.exe
  C:\Windows\System\PKHwsEh.exe
  2⤵
  PID:15128
- C:\Windows\System\HxijSrb.exe
  C:\Windows\System\HxijSrb.exe
  2⤵
  PID:15160
- C:\Windows\System\ocDhjDH.exe
  C:\Windows\System\ocDhjDH.exe
  2⤵
  PID:15184
- C:\Windows\System\RqvlbIh.exe
  C:\Windows\System\RqvlbIh.exe
  2⤵
  PID:15216
- C:\Windows\System\viDGqKD.exe
  C:\Windows\System\viDGqKD.exe
  2⤵
  PID:15244
- C:\Windows\System\iAbDqSX.exe
  C:\Windows\System\iAbDqSX.exe
  2⤵
  PID:15268
- C:\Windows\System\Jyzyqeb.exe
  C:\Windows\System\Jyzyqeb.exe
  2⤵
  PID:15292
- C:\Windows\System\NvBYfrR.exe
  C:\Windows\System\NvBYfrR.exe
  2⤵
  PID:15320
- C:\Windows\System\FNgXvai.exe
  C:\Windows\System\FNgXvai.exe
  2⤵
  PID:15356
- C:\Windows\System\TPlnaWX.exe
  C:\Windows\System\TPlnaWX.exe
  2⤵
  PID:14328
- C:\Windows\System\IctepPr.exe
  C:\Windows\System\IctepPr.exe
  2⤵
  PID:14148
- C:\Windows\System\yjTFHLK.exe
  C:\Windows\System\yjTFHLK.exe
  2⤵
  PID:14340
- C:\Windows\System\Eexkgab.exe
  C:\Windows\System\Eexkgab.exe
  2⤵
  PID:13928
- C:\Windows\System\lLdnEzI.exe
  C:\Windows\System\lLdnEzI.exe
  2⤵
  PID:14444
- C:\Windows\System\jNdJRFz.exe
  C:\Windows\System\jNdJRFz.exe
  2⤵
  PID:14368
- C:\Windows\System\CeJoBYq.exe
  C:\Windows\System\CeJoBYq.exe
  2⤵
  PID:14592
- C:\Windows\System\piCmWJY.exe
  C:\Windows\System\piCmWJY.exe
  2⤵
  PID:14640
- C:\Windows\System\xundiXn.exe
  C:\Windows\System\xundiXn.exe
  2⤵
  PID:14404
- C:\Windows\System\pqYDaEA.exe
  C:\Windows\System\pqYDaEA.exe
  2⤵
  PID:14764
- C:\Windows\System\rksllnR.exe
  C:\Windows\System\rksllnR.exe
  2⤵
  PID:14532
- C:\Windows\System\jNTrkCG.exe
  C:\Windows\System\jNTrkCG.exe
  2⤵
  PID:14860
- C:\Windows\System\EHNoTJV.exe
  C:\Windows\System\EHNoTJV.exe
  2⤵
  PID:14044
- C:\Windows\System\tuvjXWw.exe
  C:\Windows\System\tuvjXWw.exe
  2⤵
  PID:13936
- C:\Windows\System\IkNYzWw.exe
  C:\Windows\System\IkNYzWw.exe
  2⤵
  PID:14944
- C:\Windows\System\ajVrJxx.exe
  C:\Windows\System\ajVrJxx.exe
  2⤵
  PID:15052
- C:\Windows\System\GaEVFvu.exe
  C:\Windows\System\GaEVFvu.exe
  2⤵
  PID:13764
- C:\Windows\System\kInTNOq.exe
  C:\Windows\System\kInTNOq.exe
  2⤵
  PID:13380
- C:\Windows\System\IBBszoG.exe
  C:\Windows\System\IBBszoG.exe
  2⤵
  PID:14040
- C:\Windows\System\ZDrnQKe.exe
  C:\Windows\System\ZDrnQKe.exe
  2⤵
  PID:13632
- C:\Windows\System\HDMRiGw.exe
  C:\Windows\System\HDMRiGw.exe
  2⤵
  PID:14348
- C:\Windows\System\ATllOOZ.exe
  C:\Windows\System\ATllOOZ.exe
  2⤵
  PID:14808
- C:\Windows\System\drmauBa.exe
  C:\Windows\System\drmauBa.exe
  2⤵
  PID:15380
- C:\Windows\System\SjjxEpT.exe
  C:\Windows\System\SjjxEpT.exe
  2⤵
  PID:15404
- C:\Windows\System\PdUGNjT.exe
  C:\Windows\System\PdUGNjT.exe
  2⤵
  PID:15428
- C:\Windows\System\botlaBi.exe
  C:\Windows\System\botlaBi.exe
  2⤵
  PID:15460
- C:\Windows\System\rDzCnMz.exe
  C:\Windows\System\rDzCnMz.exe
  2⤵
  PID:15488
- C:\Windows\System\sDZGrTC.exe
  C:\Windows\System\sDZGrTC.exe
  2⤵
  PID:15508
- C:\Windows\System\EBnNPmb.exe
  C:\Windows\System\EBnNPmb.exe
  2⤵
  PID:15532
- C:\Windows\System\aDWDCaH.exe
  C:\Windows\System\aDWDCaH.exe
  2⤵
  PID:15568
- C:\Windows\System\NTVGZLc.exe
  C:\Windows\System\NTVGZLc.exe
  2⤵
  PID:15584
- C:\Windows\System\mTxSUiN.exe
  C:\Windows\System\mTxSUiN.exe
  2⤵
  PID:15604
- C:\Windows\System\VRcrjch.exe
  C:\Windows\System\VRcrjch.exe
  2⤵
  PID:15624
- C:\Windows\System\frMxjJu.exe
  C:\Windows\System\frMxjJu.exe
  2⤵
  PID:15652
- C:\Windows\System\WzBvZCj.exe
  C:\Windows\System\WzBvZCj.exe
  2⤵
  PID:15676
- C:\Windows\System\GHEyVWs.exe
  C:\Windows\System\GHEyVWs.exe
  2⤵
  PID:15708
- C:\Windows\System\GcYhSEp.exe
  C:\Windows\System\GcYhSEp.exe
  2⤵
  PID:15728
- C:\Windows\System\SyMxTko.exe
  C:\Windows\System\SyMxTko.exe
  2⤵
  PID:15760
- C:\Windows\System\bpfyLVt.exe
  C:\Windows\System\bpfyLVt.exe
  2⤵
  PID:15780
- C:\Windows\System\PbSeahZ.exe
  C:\Windows\System\PbSeahZ.exe
  2⤵
  PID:15812
- C:\Windows\System\EiHSLDc.exe
  C:\Windows\System\EiHSLDc.exe
  2⤵
  PID:15840
- C:\Windows\System\vRfwYoD.exe
  C:\Windows\System\vRfwYoD.exe
  2⤵
  PID:15868
- C:\Windows\System\KdofzWC.exe
  C:\Windows\System\KdofzWC.exe
  2⤵
  PID:15892
- C:\Windows\System\pidZoOj.exe
  C:\Windows\System\pidZoOj.exe
  2⤵
  PID:15916
- C:\Windows\System\fvFkGru.exe
  C:\Windows\System\fvFkGru.exe
  2⤵
  PID:15948
- C:\Windows\System\MagXlQo.exe
  C:\Windows\System\MagXlQo.exe
  2⤵
  PID:15968
- C:\Windows\System\KdVLPvY.exe
  C:\Windows\System\KdVLPvY.exe
  2⤵
  PID:15992
- C:\Windows\System\hLejMen.exe
  C:\Windows\System\hLejMen.exe
  2⤵
  PID:16012
- C:\Windows\System\yepBHLJ.exe
  C:\Windows\System\yepBHLJ.exe
  2⤵
  PID:16044
- C:\Windows\System\xdIbdvL.exe
  C:\Windows\System\xdIbdvL.exe
  2⤵
  PID:16076
- C:\Windows\System\rpDEOmt.exe
  C:\Windows\System\rpDEOmt.exe
  2⤵
  PID:16096
- C:\Windows\System\BDsOeUf.exe
  C:\Windows\System\BDsOeUf.exe
  2⤵
  PID:16124
- C:\Windows\System\DKLoIVc.exe
  C:\Windows\System\DKLoIVc.exe
  2⤵
  PID:16148
- C:\Windows\System\MVXbuuj.exe
  C:\Windows\System\MVXbuuj.exe
  2⤵
  PID:16176
- C:\Windows\System\waIoqdE.exe
  C:\Windows\System\waIoqdE.exe
  2⤵
  PID:16196
- C:\Windows\System\SCLnBPO.exe
  C:\Windows\System\SCLnBPO.exe
  2⤵
  PID:16228
- C:\Windows\System\npCDgag.exe
  C:\Windows\System\npCDgag.exe
  2⤵
  PID:16248
- C:\Windows\System\VHyIhMV.exe
  C:\Windows\System\VHyIhMV.exe
  2⤵
  PID:16272
- C:\Windows\System\wVlyIgk.exe
  C:\Windows\System\wVlyIgk.exe
  2⤵
  PID:16300
- C:\Windows\System\ZPapXlQ.exe
  C:\Windows\System\ZPapXlQ.exe
  2⤵
  PID:16324
- C:\Windows\System\BPZmDys.exe
  C:\Windows\System\BPZmDys.exe
  2⤵
  PID:16340
- C:\Windows\System\HmhTotn.exe
  C:\Windows\System\HmhTotn.exe
  2⤵
  PID:16368
- C:\Windows\System\pmnLAFj.exe
  C:\Windows\System\pmnLAFj.exe
  2⤵
  PID:15000
- C:\Windows\System\DItWsfD.exe
  C:\Windows\System\DItWsfD.exe
  2⤵
  PID:15416
- C:\Windows\System\BiNiLcy.exe
  C:\Windows\System\BiNiLcy.exe
  2⤵
  PID:13600
- C:\Windows\System\PVuMGZN.exe
  C:\Windows\System\PVuMGZN.exe
  2⤵
  PID:15544
- C:\Windows\System\iRHlxJg.exe
  C:\Windows\System\iRHlxJg.exe
  2⤵
  PID:15748
- C:\Windows\System\aRRcsvD.exe
  C:\Windows\System\aRRcsvD.exe
  2⤵
  PID:15828
- C:\Windows\System\xlPIuHo.exe
  C:\Windows\System\xlPIuHo.exe
  2⤵
  PID:15484
- C:\Windows\System\eORhPcX.exe
  C:\Windows\System\eORhPcX.exe
  2⤵
  PID:15752
- C:\Windows\System\OsPbDdm.exe
  C:\Windows\System\OsPbDdm.exe
  2⤵
  PID:15636
- C:\Windows\System\rIntYcI.exe
  C:\Windows\System\rIntYcI.exe
  2⤵
  PID:15904
- C:\Windows\System\EchffUP.exe
  C:\Windows\System\EchffUP.exe
  2⤵
  PID:15956
- C:\Windows\System\uEHXhjO.exe
  C:\Windows\System\uEHXhjO.exe
  2⤵
  PID:15940
- C:\Windows\System\boSKDDU.exe
  C:\Windows\System\boSKDDU.exe
  2⤵
  PID:14908
- C:\Windows\System\swDHKqx.exe
  C:\Windows\System\swDHKqx.exe
  2⤵
  PID:16244
- C:\Windows\System\PnsRaLX.exe
  C:\Windows\System\PnsRaLX.exe
  2⤵
  PID:16312
- C:\Windows\System\WgTAbvO.exe
  C:\Windows\System\WgTAbvO.exe
  2⤵
  PID:11936
- C:\Windows\System\TnceTAk.exe
  C:\Windows\System\TnceTAk.exe
  2⤵
  PID:16212
- C:\Windows\System\CWUpVuR.exe
  C:\Windows\System\CWUpVuR.exe
  2⤵
  PID:15312
- C:\Windows\System\DjBxPqk.exe
  C:\Windows\System\DjBxPqk.exe
  2⤵
  PID:15372
- C:\Windows\System\MwIXcTh.exe
  C:\Windows\System\MwIXcTh.exe
  2⤵
  PID:3144
- C:\Windows\System\pNKhTnW.exe
  C:\Windows\System\pNKhTnW.exe
  2⤵
  PID:16364
- C:\Windows\System\EkjLZOT.exe
  C:\Windows\System\EkjLZOT.exe
  2⤵
  PID:15648
- C:\Windows\System\jWmvVkf.exe
  C:\Windows\System\jWmvVkf.exe
  2⤵
  PID:15808
- C:\Windows\System\JjYnrUE.exe
  C:\Windows\System\JjYnrUE.exe
  2⤵
  PID:15884
- C:\Windows\System\okWmsbx.exe
  C:\Windows\System\okWmsbx.exe
  2⤵
  PID:16388
- C:\Windows\System\eACCoXY.exe
  C:\Windows\System\eACCoXY.exe
  2⤵
  PID:16408
- C:\Windows\System\vZaTPQo.exe
  C:\Windows\System\vZaTPQo.exe
  2⤵
  PID:16432
- C:\Windows\System\riKvIrL.exe
  C:\Windows\System\riKvIrL.exe
  2⤵
  PID:16460
- C:\Windows\System\OunJhWY.exe
  C:\Windows\System\OunJhWY.exe
  2⤵
  PID:16484
- C:\Windows\System\VbRxeeR.exe
  C:\Windows\System\VbRxeeR.exe
  2⤵
  PID:16512
- C:\Windows\System\fDAiiVc.exe
  C:\Windows\System\fDAiiVc.exe
  2⤵
  PID:16552
- C:\Windows\System\mexaXRM.exe
  C:\Windows\System\mexaXRM.exe
  2⤵
  PID:16572
- C:\Windows\System\YdANCCM.exe
  C:\Windows\System\YdANCCM.exe
  2⤵
  PID:16596
- C:\Windows\System\DKQZIRt.exe
  C:\Windows\System\DKQZIRt.exe
  2⤵
  PID:16620
- C:\Windows\System\NHMJuFq.exe
  C:\Windows\System\NHMJuFq.exe
  2⤵
  PID:16660
- C:\Windows\System\jNwZejc.exe
  C:\Windows\System\jNwZejc.exe
  2⤵
  PID:16688
- C:\Windows\System\XQByige.exe
  C:\Windows\System\XQByige.exe
  2⤵
  PID:16712
- C:\Windows\System\LXXwGcn.exe
  C:\Windows\System\LXXwGcn.exe
  2⤵
  PID:16732
- C:\Windows\System\ItfygZP.exe
  C:\Windows\System\ItfygZP.exe
  2⤵
  PID:16836
- C:\Windows\System\EISCVNj.exe
  C:\Windows\System\EISCVNj.exe
  2⤵
  PID:16852
- C:\Windows\System\sZMUXFF.exe
  C:\Windows\System\sZMUXFF.exe
  2⤵
  PID:16884
- C:\Windows\System\OqTHxzp.exe
  C:\Windows\System\OqTHxzp.exe
  2⤵
  PID:16908
- C:\Windows\System\CBIwFRv.exe
  C:\Windows\System\CBIwFRv.exe
  2⤵
  PID:16928
- C:\Windows\System\bWLAPwz.exe
  C:\Windows\System\bWLAPwz.exe
  2⤵
  PID:16952
- C:\Windows\System\hmdpmnY.exe
  C:\Windows\System\hmdpmnY.exe
  2⤵
  PID:16992
- C:\Windows\System\LIigKSj.exe
  C:\Windows\System\LIigKSj.exe
  2⤵
  PID:17020
- C:\Windows\System\ApiPiUI.exe
  C:\Windows\System\ApiPiUI.exe
  2⤵
  PID:17044
- C:\Windows\System\DiwaYkz.exe
  C:\Windows\System\DiwaYkz.exe
  2⤵
  PID:17072
- C:\Windows\System\XkqxLVj.exe
  C:\Windows\System\XkqxLVj.exe
  2⤵
  PID:17088
- C:\Windows\System\MGTSwEl.exe
  C:\Windows\System\MGTSwEl.exe
  2⤵
  PID:17116
- C:\Windows\System\liSEVxL.exe
  C:\Windows\System\liSEVxL.exe
  2⤵
  PID:17140
- C:\Windows\System\avNlJnS.exe
  C:\Windows\System\avNlJnS.exe
  2⤵
  PID:17156
- C:\Windows\System\SAkjIJa.exe
  C:\Windows\System\SAkjIJa.exe
  2⤵
  PID:17188
- C:\Windows\System\TwmHgnX.exe
  C:\Windows\System\TwmHgnX.exe
  2⤵
  PID:17212
- C:\Windows\System\KJrmHIG.exe
  C:\Windows\System\KJrmHIG.exe
  2⤵
  PID:17236
- C:\Windows\System\SZoqgRU.exe
  C:\Windows\System\SZoqgRU.exe
  2⤵
  PID:17252
- C:\Windows\System\dIHCKqj.exe
  C:\Windows\System\dIHCKqj.exe
  2⤵
  PID:17272
- C:\Windows\System\uJUiLgf.exe
  C:\Windows\System\uJUiLgf.exe
  2⤵
  PID:17308
- C:\Windows\System\zhKdTYT.exe
  C:\Windows\System\zhKdTYT.exe
  2⤵
  PID:17328
- C:\Windows\System\PMQDznk.exe
  C:\Windows\System\PMQDznk.exe
  2⤵
  PID:17348
- C:\Windows\System\zcEGLWd.exe
  C:\Windows\System\zcEGLWd.exe
  2⤵
  PID:17368
- C:\Windows\System\LWqOdcQ.exe
  C:\Windows\System\LWqOdcQ.exe
  2⤵
  PID:14384
- C:\Windows\System\VfdlzTe.exe
  C:\Windows\System\VfdlzTe.exe
  2⤵
  PID:16240
- C:\Windows\System\SnVNDYN.exe
  C:\Windows\System\SnVNDYN.exe
  2⤵
  PID:15772
- C:\Windows\System\PILhypa.exe
  C:\Windows\System\PILhypa.exe
  2⤵
  PID:16424
- C:\Windows\System\TaGJNSu.exe
  C:\Windows\System\TaGJNSu.exe
  2⤵
  PID:3944
- C:\Windows\System\kPuDdtV.exe
  C:\Windows\System\kPuDdtV.exe
  2⤵
  PID:16416
- C:\Windows\System\PpxOOdU.exe
  C:\Windows\System\PpxOOdU.exe
  2⤵
  PID:16480
- C:\Windows\System\YYnDEnV.exe
  C:\Windows\System\YYnDEnV.exe
  2⤵
  PID:16536
- C:\Windows\System\vqxXSzp.exe
  C:\Windows\System\vqxXSzp.exe
  2⤵
  PID:16420
- C:\Windows\System\GpMiIxo.exe
  C:\Windows\System\GpMiIxo.exe
  2⤵
  PID:16580
- C:\Windows\System\sklPKvd.exe
  C:\Windows\System\sklPKvd.exe
  2⤵
  PID:16924
- C:\Windows\System\UOKjdYy.exe
  C:\Windows\System\UOKjdYy.exe
  2⤵
  PID:16824
- C:\Windows\System\bAsYFZI.exe
  C:\Windows\System\bAsYFZI.exe
  2⤵
  PID:16940
- C:\Windows\System\jAEWmAF.exe
  C:\Windows\System\jAEWmAF.exe
  2⤵
  PID:17100
- C:\Windows\System\VkIPQbR.exe
  C:\Windows\System\VkIPQbR.exe
  2⤵
  PID:16960
- C:\Windows\System\WZdtIdO.exe
  C:\Windows\System\WZdtIdO.exe
  2⤵
  PID:17060
- C:\Windows\System\ctwVndO.exe
  C:\Windows\System\ctwVndO.exe
  2⤵
  PID:17176
- C:\Windows\System\FSpWYDx.exe
  C:\Windows\System\FSpWYDx.exe
  2⤵
  PID:17324
- C:\Windows\System\yUQvVae.exe
  C:\Windows\System\yUQvVae.exe
  2⤵
  PID:17228
- C:\Windows\System\DCyYQWx.exe
  C:\Windows\System\DCyYQWx.exe
  2⤵
  PID:15716
- C:\Windows\System\kxSIYEu.exe
  C:\Windows\System\kxSIYEu.exe
  2⤵
  PID:17296
- C:\Windows\System\bxnKYYU.exe
  C:\Windows\System\bxnKYYU.exe
  2⤵
  PID:15556
- C:\Windows\System\yYwjaZl.exe
  C:\Windows\System\yYwjaZl.exe
  2⤵
  PID:16060
- C:\Windows\System\iOcnptV.exe
  C:\Windows\System\iOcnptV.exe
  2⤵
  PID:16804
- C:\Windows\System\CVUeQyS.exe
  C:\Windows\System\CVUeQyS.exe
  2⤵
  PID:16184
- C:\Windows\System\kdmFIDs.exe
  C:\Windows\System\kdmFIDs.exe
  2⤵
  PID:16400
- C:\Windows\System\tJeSHTB.exe
  C:\Windows\System\tJeSHTB.exe
  2⤵
  PID:17620
- C:\Windows\System\ZquRKiv.exe
  C:\Windows\System\ZquRKiv.exe
  2⤵
  PID:17776

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18396

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17876

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18060

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18372

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17344

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ADvxilx.exe

Path C:\Windows\System\ADvxilx.exe
Size 1.5MB
SHA256 374bc4808af8f677212d20eccce2fd1a081a984196ced91804a7b70fa54bf2e4
MD5 372a90ec78bcc7aae9dedb75ddbeb83e
SHA1 36dbca6f9b3bda7cfc5e9eb4caf1f0016751db3b
SHA512 03db740695eca1224a9ac15bf12eecc649b04332b80c8486551a63448c6ebdc4c23f9e494beeafef6f614cf29d434aaba972e9d0cf22ff0001ae9f78755e0da4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6H:GemTLkNdfE0pZat
MD5 SHA1 SHA512 SSDEEP

Submit Download

ArtmPeV.exe

Path C:\Windows\System\ArtmPeV.exe
Size 1.5MB
SHA256 2519bb31da56ca4236bbf88b9cfe1743b8969f17b9c65bbad1e4943f7d44a18e
MD5 004de04893fd57ab507e73b238525002
SHA1 8df3538b0e84bb296ac8b7fe3f1742693fce0ddd
SHA512 c9315c2bd5cb5d90efdb7937113aa9821ce691604e4516ca62f8cf10dcdd5354e7ab239b845ddf56490e401961e85376485cc0e06a6cd33e28ad2d496886d146
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6J:GemTLkNdfE0pZan
MD5 SHA1 SHA512 SSDEEP

Submit Download

AuaLmZB.exe

Path C:\Windows\System\AuaLmZB.exe
Size 1.5MB
SHA256 dfde3793fd825f28b899ed92b1af7426c376750972fccaa70aaaa21d2b08437c
MD5 b5aeddae19aef7096951e79fd84a7704
SHA1 0a3ae240a8bb7afc77e4e87a206fca22bee975f5
SHA512 9610400a8c69dde3a7f6f5a4add6c79262c8cecec1b31c4674f57f5ff98400a21613847dc5c002cce0555be2ddaea1f366e74c4f9ce9b4d78f4cc79e8e424dab
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6A:GemTLkNdfE0pZaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

DvRRBtF.exe

Path C:\Windows\System\DvRRBtF.exe
Size 1.5MB
SHA256 6fcb781460ec27df58dacd38ffc9b266bf756ee34a1242a351cdd5c6cce8e2c2
MD5 966aec336a3e43ef04aa49f601bcc4ec
SHA1 1e5e2de38fc1cdfa87078201b4a129d88860464d
SHA512 0b56e85f8627c4abe9729eea5ffc202c4972df36c43fb4745f700c6c01b4099d47fe719be607f4507ec176330156930a79f7f4ba771b9c713037aa4c40363bd7
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU61:GemTLkNdfE0pZaP
MD5 SHA1 SHA512 SSDEEP

Submit Download

EUUhIeE.exe

Path C:\Windows\System\EUUhIeE.exe
Size 1.5MB
SHA256 c2663a76220fef352e150180ba6e3b07aac08419561d01e59a863065697448d2
MD5 6438a2a678d3f724f17b981c778dd5eb
SHA1 8d328773fe27de1a999b93b2eb02c1de818e7f8d
SHA512 b6f4cf0a17080779c41d322000171fcc554079f707961c2f5ad0868c7c56e94971de93acabf6c351acf96524d2b713833d2ff02931c6c54ad939a5dbae05e47b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU63:GemTLkNdfE0pZax
MD5 SHA1 SHA512 SSDEEP

Submit Download

EziXTNu.exe

Path C:\Windows\System\EziXTNu.exe
Size 1.5MB
SHA256 da6b508d7f00eae732044cf39d6f54134fa83997ea1278ea9abd004dd7b6099f
MD5 6cc21ceb4ca02404f4c8b20e5650a178
SHA1 18c16f613b6f1dcafce8e6c01431b6cf6f5b4039
SHA512 84372416bc3b8f1b398d2207026a4903e56d838e5eb9a388074a9bd1c9a6e72fbd22ca9d21b6811a2bbc9f094a81c13ef34d58da82e49d6b332fa50a7fcfced0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6Z:GemTLkNdfE0pZaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

FiWuEWv.exe

Path C:\Windows\System\FiWuEWv.exe
Size 1.5MB
SHA256 c19fbba2c7bb726e1ffe8c0689ac3731046d5ce5e86fe05ba1fbbcd8548fe40b
MD5 c76bff255f6b4000e72a242cf6216245
SHA1 8f0a0b35bccaf5964f3c6970c63ea44f06bb7391
SHA512 914a674eaac252fd563521d43160e70a0b3b758b7a5a1b3779aaafd2cdf853c73bfb49b1d38dfa1fe05dc19b84a7d99821ce8765cefc9b47f58f12909cf7aeb0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6C:GemTLkNdfE0pZaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

GFkqOoN.exe

Path C:\Windows\System\GFkqOoN.exe
Size 1.5MB
SHA256 541dd61f356e3627cfdd28135b20b9ae1becfb6e5d3c7fda8a8e7ef2fd374dcf
MD5 9de31b1a8659e0af6714b3f470303b42
SHA1 d9cbb71e3fa91d8a0e9e949d804900d4c36d49cd
SHA512 be4d2f68f77771efbd97c22aa4c60c6ce387cbd3c8e77a5104ae7b2697e6a2da2b15ce24a2ce7ee7d4837cab3b1ce9472eff81cf6cbacf01373106eae60b8fb3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6v:GemTLkNdfE0pZaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

KxiZvsn.exe

Path C:\Windows\System\KxiZvsn.exe
Size 1.5MB
SHA256 80c78f0415c43fad7fb37f7a61a3c921e0d825736d7532faf723c4ca26fabd32
MD5 1d35d6497ecded52b3e7968b23e8f53b
SHA1 af0bba4264ab4192f9c22c787a8479d5abd459d5
SHA512 9cdc004e34b4acb86dc5a0345d3c6067986f8b042f4aeae5cc6526f7204e202fbc2d43bfafc3162a39cc286f2ce03afb83e6ba0fdd853b03ad6bcfeb634092cb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6T:GemTLkNdfE0pZax
MD5 SHA1 SHA512 SSDEEP

Submit Download

LPBUoKR.exe

Path C:\Windows\System\LPBUoKR.exe
Size 1.5MB
SHA256 d39897712e4bad8799d7f91e610ab1128b55b2e95c627bef0666284f119e8036
MD5 70fff4dc596948f52f9ed8b5a9224c37
SHA1 f1d56a4ddca5b07d7da9e6fa72c76fcc1ba68998
SHA512 c33c8ea252aa1ae949559ee1f0cc368baee9b9563de23355e1645e7dd3dd855dec17ff2250baccb78ed4923cf29dd8263d2d4398eca9f061a7053540218cf760
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU62:GemTLkNdfE0pZaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

MiJFBtb.exe

Path C:\Windows\System\MiJFBtb.exe
Size 1.5MB
SHA256 a08ca9220e76e886df451b43ef7b0418df5783cac629ae3667d76544b796df90
MD5 b76863b1596148ef7fa904c9b30c6629
SHA1 31e4fdcf7b9f1f2b9910f360e13e87c3b4fb1304
SHA512 99569d2a05bbb2ce932e05c583ddc701583e68ea423d74b643e26dccfdb8754e5b16611044b30671c43388241ef875eab606d13a79c684535e814573c0322bc4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6+:GemTLkNdfE0pZac
MD5 SHA1 SHA512 SSDEEP

Submit Download

NIStBxy.exe

Path C:\Windows\System\NIStBxy.exe
Size 1.5MB
SHA256 935d202fb09890e6519f4b83219247d15bbb69ac22288aeec7ec7f85ff6f2dad
MD5 674fd2afb1e222dc7af37c61ce65063b
SHA1 7b5e9a0b84f813df844d0ea95e78ddbdb115b431
SHA512 f4cce2f6ae15aedbbd8ecb5769467ef5c30431031c6431178594e08ca5908073707098176fc0814846c44e5633b57484e167eb778c13aa630f2af31348afb4bf
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6H:GemTLkNdfE0pZaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

OiXmrmJ.exe

Path C:\Windows\System\OiXmrmJ.exe
Size 1.5MB
SHA256 cc91c053d458ede717fd945e6f2ac5e9721428c1d64efc50f9c4f15e23bf877e
MD5 4db3792600c0e17ed468df07b7821916
SHA1 d9fd0387bb92948465d5c57ebe6d1eb521d6e891
SHA512 e46492cd2583f92b405ca3ae6fddd2ffa5962b8fb261a693f7917d6025dbb2cd9fb5b19728d6f5cb87dedf6b2af99dac58825f8186f69415e2b39e113b3584b7
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6T:GemTLkNdfE0pZa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

QYJTxQc.exe

Path C:\Windows\System\QYJTxQc.exe
Size 1.5MB
SHA256 a9bbf495c4fc6eea407c6241d9a81c9550e0d3af6ccff23e77022daea37d5c1e
MD5 c496393ea1144a48e0c910e2bb7fc80f
SHA1 3789e581a69c835e2960f8262c057658dbd76180
SHA512 ee88560b6a408df2cd6166dcbce0aacc5bd3522f632282819a3d8a0db51ab74dfd72a0d8be5efeb5d4efbf7fa731938cf50c1b7b9f55138fe5020accebae8c7e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6y:GemTLkNdfE0pZaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

UyNncgs.exe

Path C:\Windows\System\UyNncgs.exe
Size 1.5MB
SHA256 a0cc5678c770f41eace0d6f9cdb5c712058b907e93398f7d3d23ff0b24449188
MD5 5051bbabdac82511d27f374505050e52
SHA1 052504c8c4c04755b1133d8f7c1bb36ccf8493f9
SHA512 b12d41c39ce2dd7cd662c854b3e603a9c8d8fcd988fc331d384dced19c97abeba6cbfffe78cfb160f77a2d1554153547eb09877c3ab999b4ca9d364f099d2fb1
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU64:GemTLkNdfE0pZau
MD5 SHA1 SHA512 SSDEEP

Submit Download

VUuwPzk.exe

Path C:\Windows\System\VUuwPzk.exe
Size 1.5MB
SHA256 6030ec6fca54ecf04c8f2ea0a55a51b84cf6ddbf061d2ed555c867ff234f8fe6
MD5 598d94b861bfc8a76f21efd05a0f25e5
SHA1 65fe792d00911a75d051e205f976601805348949
SHA512 0fc60f23071f22551296919751766fd9c53c226caf0a74ec2c7db11c4f5ba0c5649fc63e3eab509d5f6d9dcb67d242140ff12cadc50ab3abfa6ce3a0b07591b9
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6g:GemTLkNdfE0pZa6
MD5 SHA1 SHA512 SSDEEP

Submit Download

aIApooC.exe

Path C:\Windows\System\aIApooC.exe
Size 1.5MB
SHA256 31d7dd80207412af475ce9573c462ac4b0ef56a94936172b5169a3146a383c52
MD5 845545b4d1d9585e479384bc0d268629
SHA1 f5515a633b27df39af92daaa0fefb09972705c1e
SHA512 413ac90b73c87d95e50b6121ed3ce12874baf44ef43afbb9565dafff1c52db1b5ef5e1196e4a36e4dcecb4c24e0fdcf4a4c152c1e764896ddd73a904332b6ac7
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6WT:GemTLkNdfE0pZae
MD5 SHA1 SHA512 SSDEEP

Submit Download

bGbQaKH.exe

Path C:\Windows\System\bGbQaKH.exe
Size 1.5MB
SHA256 7ed445cc7da6ef62e35e60ce19a4194491892c728e38bbf682947a27c750d1c9
MD5 b0070c6816048d0647efb36de616aedf
SHA1 d9a1797effb85db8c5ccbd6b8ba0ef6ae1e94409
SHA512 972099a78796b98d36684b9dadae4a58e0a7cad7b95a30aa224500140bfe472afea4bdd01e948085c732422688b7dc3fed7b99230ee2e9514824f0ce2061ceb9
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6K:GemTLkNdfE0pZao
MD5 SHA1 SHA512 SSDEEP

Submit Download

cZcmliB.exe

Path C:\Windows\System\cZcmliB.exe
Size 1.5MB
SHA256 7553e2f2b4e8af1c685a69c64c9609d4bce4ebe9aa87df1812529d3e3f669827
MD5 6fd4bf89ba3f2d79ab98ea91aba49753
SHA1 e5e32f3e0ae77f957753088a122b800958b92f65
SHA512 5badf7bcb9d5d6f03a720bfebc33d051fd47eaef86633ef1d6b10bebaed685f97dd6876cb22016dec5314e831ef13cb4e18eb9390384bdaf6231a2e8d3e85532
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6Z:GemTLkNdfE0pZaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

cuARawU.exe

Path C:\Windows\System\cuARawU.exe
Size 1.5MB
SHA256 e93c6a44ee03e6432fb5bc4813606af8e632b5c478f07a94a44a141577c1fa1e
MD5 7104277d18b961a808427c7e2de1abb0
SHA1 e26ded0f49d7be20031e58ff5918c8562cad66d9
SHA512 44dc7743554b343ca6c2eafc06604cbf4f3a041e9da6105a7f3910c4f41040b3bea5c4304ecd0886018abf6283a2ee83a3c9111e0ceec455086a236f173a2f49
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU67:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Submit Download

fPTpxjK.exe

Path C:\Windows\System\fPTpxjK.exe
Size 1.5MB
SHA256 bdde2d8b8ca7917298614e1ac2b6fe742783ffef96774b22ac0d95ba14e9579f
MD5 b82eba1e4f4836995d75a9e68e1c6c7b
SHA1 7646a7d5c50653d9054a42fc39d118897cdcd6c6
SHA512 780805233dc32fb3f97fa72b020be8369aa5a23dfa0bd6d395209dc0999a8ccbf03b28a6f3a45af6b6b0a0c2e7f525398569deb239c7bba6bfcb37a345ea89f0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6B:GemTLkNdfE0pZaL
MD5 SHA1 SHA512 SSDEEP

Submit Download

gSfYsUd.exe

Path C:\Windows\System\gSfYsUd.exe
Size 1.5MB
SHA256 ee172b3cf3bcd88d699c3ca5fde33124be5469601232f33d73c21d530995a6c7
MD5 cdef459532858e19424c4f309340cc77
SHA1 59982040e828705497ce57f52e778903b1150e77
SHA512 ca74b82036199311af1bc4481d415b69c3d2ec83e3b543e8262e2fd5040596b769bcb2dec882ec132a94018ed63a4b5860911596f6b89b77f44e9842ad6a730d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6f:GemTLkNdfE0pZa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

iRXCnME.exe

Path C:\Windows\System\iRXCnME.exe
Size 1.5MB
SHA256 e875cbdf0c94161aedf0380b325cdf789bd415213b47250fc441373d34c534f4
MD5 41d7a20ed3b14a53d6f5cfcb2fddc9bb
SHA1 f29f9b0b007ebdcd92539bf178b3e05db2b9d44c
SHA512 0a956c4e30a514b3d2bfac3184deb57154500a76a0daad69830bbb232e7f581162aca5149ed9c7a2f6970fd8def87b6d83b507169b155024487f418348f8f4c0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6u:GemTLkNdfE0pZa8
MD5 SHA1 SHA512 SSDEEP

Submit Download

jgoXwdA.exe

Path C:\Windows\System\jgoXwdA.exe
Size 1.5MB
SHA256 f9f5142b8734b041145da111a577df7b03ace6578178fb1d6b0e65a4330757d7
MD5 3c0fc313c8913a4edcbb5a0f3b3a9bce
SHA1 f4c6b65a196ab28c1e51925671f59284bfb9f27b
SHA512 257aabb57c93626a96b258a5de34b3af255c74dc1a95e85bcf86e5cf8732eae34bd9635117fa498cf1d53a44521bec838c2a4782541cec62ea7e3ad21bb38fc5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6Y:GemTLkNdfE0pZa2
MD5 SHA1 SHA512 SSDEEP

Submit Download

noOBOQw.exe

Path C:\Windows\System\noOBOQw.exe
Size 1.5MB
SHA256 6221b1575e41cf85b94b2edc7e9cc9a0271bf04eaf01492e6b328d888201f28c
MD5 142cb42c52979d68aff1fb17231c8cd9
SHA1 5cb86cfc777b2b2b5fcc3916c6154af8d01747dc
SHA512 9b3c7ca93b15500e2460222b71c1f6ddd1df66c4dc7947758df21b1682717f767c072a182c4b6bb2e7ddc1942ca73568a77d579f5e500cbff70a994300001e26
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6B:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

qmNBUjt.exe

Path C:\Windows\System\qmNBUjt.exe
Size 1.5MB
SHA256 dfa6c6f4953496b265f78a2a3d1ec206508f98c937536c89c972bef71b10a8f9
MD5 703ecf5420a82973c4ae579705398349
SHA1 500801706c9af6c133cfb7a60423d6aa40c9f8f2
SHA512 af56b293560bebeb631568dab3f8d7e13e6ccf98b428bb10dbfee973fde7ab5f478ccb141ef15502fb2da04e0f028f175eab2e3caa36b5e24935b7094777695b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6I:GemTLkNdfE0pZam
MD5 SHA1 SHA512 SSDEEP

Submit Download

rETcNnm.exe

Path C:\Windows\System\rETcNnm.exe
Size 1.5MB
SHA256 f90a589790878b0defd0a4d98041102699d7c42f78f3011d6f0f58e2f8d0ef53
MD5 9eb98ac8bfc10a0119119b3d99ca9f84
SHA1 bcc317372f3d58fa583cdf056fd5c07c81446f56
SHA512 23bc9d3e0171657b5500c4ee3f8acf106762e36cbabad9c4adb27c811383ba712a9b0ee7fe74f2c7305445851889a32723e367c6a196a334fd20704dd569bf3f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU61:GemTLkNdfE0pZaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ttwZaVp.exe

Path C:\Windows\System\ttwZaVp.exe
Size 1.5MB
SHA256 d6786193458c50bed8ae93d449c81b8e4751d995a95a44121a16d23ea698ec8a
MD5 8b1cc2f2120dc15dbd372875ff0d8591
SHA1 fbfbdd99f3f1be5279d416615c3668a5f2cfda72
SHA512 b92beecd1f8a5157f0d89b32875469697bfbf6f1d3ec64f707eddc75834c9ea19c1e5a3696cc1cf6e1b4876fa456874a8e7164f6adfe120b1e4b39093d5b0a7d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU65:GemTLkNdfE0pZaL
MD5 SHA1 SHA512 SSDEEP

Submit Download

ueYnqNC.exe

Path C:\Windows\System\ueYnqNC.exe
Size 1.5MB
SHA256 8ce35dac5c3a7ecebc16dcbb4cd2822cd3cef94cac4205570bb31d608355f352
MD5 55e72d6c70517bc48c05d326b374f1fa
SHA1 c100157e0a9eaaef08c2a85294d146ee9c4a0927
SHA512 a609ef4d65d67cc9ae395f02483300fe8aa76135ebd71b805f84a62ae0a43fcbf5b112b5e82603346893f55b9c1c918f915f24676e69396f01ea3de7e709a9c5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU61:GemTLkNdfE0pZab
MD5 SHA1 SHA512 SSDEEP

Submit Download

vaDiAQE.exe

Path C:\Windows\System\vaDiAQE.exe
Size 1.5MB
SHA256 e1d45a4d07f27e2beae8ff181a9a1a7749647ed0619b40b65790dbc22991097a
MD5 290fd9c2a16ef258dfdcf9e51b44eed6
SHA1 9a0c1b9d087a74cbed63f3387e1fbf3e05bda7de
SHA512 76ec64431ddfa072514624109ce3a4d3f5b230bfe0176b0cfc5637a02e3aa50181b4401cccb531b7ecaffcd4959a87ff8c37610bc3bd714572d4049f664d89cb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6J:GemTLkNdfE0pZaH
MD5 SHA1 SHA512 SSDEEP

Submit Download

xqOtacu.exe

Path C:\Windows\System\xqOtacu.exe
Size 1.5MB
SHA256 a474fe17cc5e76acb12f643f545014b38bd787e34aed878618288f865de97bd9
MD5 fa0254479ed778f5e2e516c30e5c282c
SHA1 d60bb00001a3584a30fc24818e094d4b4f208cc1
SHA512 a43f0533d427127547806416eaadcce7b2b086fe9f412f848ad33d60797c1efa4da45606738b35e37aef4bd9f70cf7e1f8428b31b92a76901d7ebe7010ea07b5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6ix:GemTLkNdfE0pZas
MD5 SHA1 SHA512 SSDEEP

Submit Download

zvqOmXw.exe

Path C:\Windows\System\zvqOmXw.exe
Size 1.5MB
SHA256 d1f06072dc724666627d036ef4d9191dd078fdefe9da0d5a98d8c6791639283e
MD5 3874fd6fc2dca16492350532c9413719
SHA1 03d5a946f7ab3286b29a603383a64148334fd7e8
SHA512 0893c369f55611cffb9d896e3132ec28428b34413b81471f8fabe25fee2171769dabbf59f39b33d84c418d8e19e6e3bbce9f0cefac73570a6f819013061c2eef
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NU6p:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2116-0-0x0000029ACA4E0000-0x0000029ACA4F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads