xmrig | 1f132c8e6fb51b01e3d7e322e38cd49ecf74233f8dc9516fd6f59ea3db335730

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
Size 1.2MB
Sample240523-ct89tsaf57
SHA256 1f132c8e6fb51b01e3d7e322e38cd49ecf74233f8dc9516fd6f59ea3db335730
MD5 774a0f2d09bddbb80b8c3ef572d0f540
SHA1 dc1100547618337e902e39567023e3b789e45e06
SHA512 82f1677a11fa51c6030c8d94b3eef0470de1d33efbbffe8ee4d7dd74347dfe7e4b07f5b00569a9fa926ae1f2e25dbad26d7694d6f82d727c579bd1f4da169166
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxJ:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a00000002328e-3.dat	xmrig
behavioral2/files/0x000700000002341c-9.dat	xmrig
behavioral2/files/0x000700000002341d-8.dat	xmrig
behavioral2/files/0x000700000002341e-17.dat	xmrig
behavioral2/files/0x0007000000023422-43.dat	xmrig
behavioral2/files/0x0007000000023424-49.dat	xmrig
behavioral2/files/0x0007000000023425-57.dat	xmrig
behavioral2/files/0x0007000000023428-69.dat	xmrig
behavioral2/files/0x000700000002342a-83.dat	xmrig
behavioral2/files/0x0007000000023434-133.dat	xmrig
behavioral2/files/0x0007000000023438-155.dat	xmrig
behavioral2/files/0x000700000002343b-162.dat	xmrig
behavioral2/files/0x0007000000023439-160.dat	xmrig
behavioral2/files/0x000700000002343a-157.dat	xmrig
behavioral2/files/0x0007000000023437-150.dat	xmrig
behavioral2/files/0x0007000000023436-145.dat	xmrig
behavioral2/files/0x0007000000023435-137.dat	xmrig
behavioral2/files/0x0007000000023433-127.dat	xmrig
behavioral2/files/0x0007000000023432-123.dat	xmrig
behavioral2/files/0x0007000000023431-118.dat	xmrig
behavioral2/files/0x0007000000023430-112.dat	xmrig
behavioral2/files/0x000700000002342f-108.dat	xmrig
behavioral2/files/0x000700000002342e-103.dat	xmrig
behavioral2/files/0x000700000002342d-95.dat	xmrig
behavioral2/files/0x000700000002342c-93.dat	xmrig
behavioral2/files/0x000700000002342b-85.dat	xmrig
behavioral2/files/0x0007000000023429-77.dat	xmrig
behavioral2/files/0x0007000000023427-67.dat	xmrig
behavioral2/files/0x0007000000023426-63.dat	xmrig
behavioral2/files/0x0007000000023423-47.dat	xmrig
behavioral2/files/0x0007000000023421-35.dat	xmrig
behavioral2/files/0x0007000000023420-30.dat	xmrig
behavioral2/files/0x000700000002341f-25.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
232	yyuzxRi.exe
944	EvcXylg.exe
1148	ZSTLuAy.exe
3176	ZhgoHlN.exe
4144	OyPwhZj.exe
3492	HztTSkb.exe
1968	GrupnEG.exe
3948	XsuWzZJ.exe
1688	hnbCoPr.exe
4044	DvnzeQK.exe
2940	IpDxGBZ.exe
4520	YaQhqWy.exe
2544	vZNtOJr.exe
3648	qLzXXjO.exe
2764	MQRhCGW.exe
3680	igaEaec.exe
1604	JVefdOl.exe
3684	eZuJKOk.exe
4668	DwDPORW.exe
996	MJXbHrw.exe
1648	MRQFhKP.exe
4700	IInjNjq.exe
4540	gFZmbjk.exe
4068	NMwcGJN.exe
2252	KFUMbXS.exe
5104	ZHxyvDS.exe
3856	DUhNemy.exe
1156	xXwAYrD.exe
3876	SEBCudI.exe
3916	JyHFRyK.exe
3140	nveSJHp.exe
1540	uSmvVmV.exe
2760	TxOmAcJ.exe
2212	KMgWihl.exe
4820	zdrgwBn.exe
4448	SyOMJmy.exe
2792	nNXXhLG.exe
3540	jmcgOhw.exe
4432	cIUqHRS.exe
4908	HFzBmfB.exe
4816	kBoutsp.exe
5108	yNCGQiS.exe
3928	nmOIlvR.exe
2380	emDwjlq.exe
436	sierFdE.exe
2592	saOsyPK.exe
2876	WfLadPv.exe
3068	mQfOmHc.exe
3688	NIkEQSB.exe
632	qWnMhTC.exe
4512	TdqdkYV.exe
220	BcMfjSb.exe
348	JKJPOvS.exe
1464	jHQnGNt.exe
4456	OSGsNHF.exe
2632	vaavjJl.exe
1672	sFRLYlf.exe
4852	KXnaKTo.exe
5028	uvAGuuA.exe
2576	GVMazzD.exe
5020	cuodfON.exe
1888	PYESheL.exe
2444	WShRwAm.exe
1256	ucXPDqY.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xmeoYSF.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\coVISPJ.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\JJPMyxm.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\jHQnGNt.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\IeGrJoz.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\LdVVSLL.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\MRAvjwC.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\lSpZEPg.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\TMRyDBO.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\PvIVAYt.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\esITMsy.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\OoLPgDJ.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\yIQeAHm.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\ZrmJwKI.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\rADrCoA.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\yyuzxRi.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\CVrFYSW.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\IbapSmH.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\AfUueWY.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\VcBNDNJ.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\pUvYqbv.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\GWYHJBS.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\jGEZfJb.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\tdMtyWt.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\FpIAnig.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\zFPxrXU.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\DbVoHoh.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\PwXgNSG.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\OOsWwXR.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\RafaiBR.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\DPZPeME.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\gbvrdWD.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\Ktvlcxw.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\fbmtavy.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\dyUKqPX.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\GdGpJCs.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\KCxqnQF.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\hnNEZge.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\pHquSum.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\vQSkycb.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\hnOWbNA.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\qWnMhTC.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\uPcepnw.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\WWJLVyN.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\kuWMVnx.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\nKKhWPa.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\udRQaRG.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\RJkOVeV.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\lkTHWqA.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\wcJVGKx.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\HVyTEqo.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\FvPSEFy.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\jbPpCdg.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\MWkZYkx.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\PpfHGKQ.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\CzNzxwC.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\AqihAhl.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\qGBIhfE.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\IpDxGBZ.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\nhPBpbG.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\yRdaCKG.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\CxKeXSe.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\ZGISoyI.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\LyFoFyI.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17260	dwm.exe
Token: SeChangeNotifyPrivilege	17260	dwm.exe
Token: 33	17260	dwm.exe
Token: SeIncBasePriorityPrivilege	17260	dwm.exe
Token: SeShutdownPrivilege	17260	dwm.exe
Token: SeCreatePagefilePrivilege	17260	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 232	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	84
PID 2100 wrote to memory of 232	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	84
PID 2100 wrote to memory of 944	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	85
PID 2100 wrote to memory of 944	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	85
PID 2100 wrote to memory of 1148	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	86
PID 2100 wrote to memory of 1148	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	86
PID 2100 wrote to memory of 3176	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	87
PID 2100 wrote to memory of 3176	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	87
PID 2100 wrote to memory of 4144	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	88
PID 2100 wrote to memory of 4144	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	88
PID 2100 wrote to memory of 3492	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	89
PID 2100 wrote to memory of 3492	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	89
PID 2100 wrote to memory of 1968	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	90
PID 2100 wrote to memory of 1968	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	90
PID 2100 wrote to memory of 3948	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	91
PID 2100 wrote to memory of 3948	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	91
PID 2100 wrote to memory of 1688	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	92
PID 2100 wrote to memory of 1688	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	92
PID 2100 wrote to memory of 4044	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	93
PID 2100 wrote to memory of 4044	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	93
PID 2100 wrote to memory of 2940	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	94
PID 2100 wrote to memory of 2940	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	94
PID 2100 wrote to memory of 4520	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	95
PID 2100 wrote to memory of 4520	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	95
PID 2100 wrote to memory of 2544	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	96
PID 2100 wrote to memory of 2544	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	96
PID 2100 wrote to memory of 3648	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	97
PID 2100 wrote to memory of 3648	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	97
PID 2100 wrote to memory of 2764	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	98
PID 2100 wrote to memory of 2764	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	98
PID 2100 wrote to memory of 3680	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	99
PID 2100 wrote to memory of 3680	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	99
PID 2100 wrote to memory of 1604	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	100
PID 2100 wrote to memory of 1604	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	100
PID 2100 wrote to memory of 3684	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	101
PID 2100 wrote to memory of 3684	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	101
PID 2100 wrote to memory of 4668	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	102
PID 2100 wrote to memory of 4668	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	102
PID 2100 wrote to memory of 996	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	103
PID 2100 wrote to memory of 996	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	103
PID 2100 wrote to memory of 1648	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	104
PID 2100 wrote to memory of 1648	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	104
PID 2100 wrote to memory of 4700	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	105
PID 2100 wrote to memory of 4700	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	105
PID 2100 wrote to memory of 4540	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	106
PID 2100 wrote to memory of 4540	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	106
PID 2100 wrote to memory of 4068	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	107
PID 2100 wrote to memory of 4068	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	107
PID 2100 wrote to memory of 2252	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	108
PID 2100 wrote to memory of 2252	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	108
PID 2100 wrote to memory of 5104	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	109
PID 2100 wrote to memory of 5104	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	109
PID 2100 wrote to memory of 3856	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	110
PID 2100 wrote to memory of 3856	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	110
PID 2100 wrote to memory of 1156	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	111
PID 2100 wrote to memory of 1156	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	111
PID 2100 wrote to memory of 3876	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	112
PID 2100 wrote to memory of 3876	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	112
PID 2100 wrote to memory of 3916	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	113
PID 2100 wrote to memory of 3916	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	113
PID 2100 wrote to memory of 3140	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	114
PID 2100 wrote to memory of 3140	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	114
PID 2100 wrote to memory of 1540	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	115
PID 2100 wrote to memory of 1540	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\System\yyuzxRi.exe
  C:\Windows\System\yyuzxRi.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\EvcXylg.exe
  C:\Windows\System\EvcXylg.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\ZSTLuAy.exe
  C:\Windows\System\ZSTLuAy.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\ZhgoHlN.exe
  C:\Windows\System\ZhgoHlN.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\OyPwhZj.exe
  C:\Windows\System\OyPwhZj.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\HztTSkb.exe
  C:\Windows\System\HztTSkb.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\GrupnEG.exe
  C:\Windows\System\GrupnEG.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\XsuWzZJ.exe
  C:\Windows\System\XsuWzZJ.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\hnbCoPr.exe
  C:\Windows\System\hnbCoPr.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\DvnzeQK.exe
  C:\Windows\System\DvnzeQK.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\IpDxGBZ.exe
  C:\Windows\System\IpDxGBZ.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\YaQhqWy.exe
  C:\Windows\System\YaQhqWy.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\vZNtOJr.exe
  C:\Windows\System\vZNtOJr.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\qLzXXjO.exe
  C:\Windows\System\qLzXXjO.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\MQRhCGW.exe
  C:\Windows\System\MQRhCGW.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\igaEaec.exe
  C:\Windows\System\igaEaec.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\JVefdOl.exe
  C:\Windows\System\JVefdOl.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\eZuJKOk.exe
  C:\Windows\System\eZuJKOk.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\DwDPORW.exe
  C:\Windows\System\DwDPORW.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\MJXbHrw.exe
  C:\Windows\System\MJXbHrw.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\MRQFhKP.exe
  C:\Windows\System\MRQFhKP.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\IInjNjq.exe
  C:\Windows\System\IInjNjq.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\gFZmbjk.exe
  C:\Windows\System\gFZmbjk.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\NMwcGJN.exe
  C:\Windows\System\NMwcGJN.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\KFUMbXS.exe
  C:\Windows\System\KFUMbXS.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\ZHxyvDS.exe
  C:\Windows\System\ZHxyvDS.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\DUhNemy.exe
  C:\Windows\System\DUhNemy.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\xXwAYrD.exe
  C:\Windows\System\xXwAYrD.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\SEBCudI.exe
  C:\Windows\System\SEBCudI.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\JyHFRyK.exe
  C:\Windows\System\JyHFRyK.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\nveSJHp.exe
  C:\Windows\System\nveSJHp.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\uSmvVmV.exe
  C:\Windows\System\uSmvVmV.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\TxOmAcJ.exe
  C:\Windows\System\TxOmAcJ.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\KMgWihl.exe
  C:\Windows\System\KMgWihl.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\zdrgwBn.exe
  C:\Windows\System\zdrgwBn.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\SyOMJmy.exe
  C:\Windows\System\SyOMJmy.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\nNXXhLG.exe
  C:\Windows\System\nNXXhLG.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\jmcgOhw.exe
  C:\Windows\System\jmcgOhw.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\cIUqHRS.exe
  C:\Windows\System\cIUqHRS.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\HFzBmfB.exe
  C:\Windows\System\HFzBmfB.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\kBoutsp.exe
  C:\Windows\System\kBoutsp.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\yNCGQiS.exe
  C:\Windows\System\yNCGQiS.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\nmOIlvR.exe
  C:\Windows\System\nmOIlvR.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\emDwjlq.exe
  C:\Windows\System\emDwjlq.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\sierFdE.exe
  C:\Windows\System\sierFdE.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\saOsyPK.exe
  C:\Windows\System\saOsyPK.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\WfLadPv.exe
  C:\Windows\System\WfLadPv.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\mQfOmHc.exe
  C:\Windows\System\mQfOmHc.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\NIkEQSB.exe
  C:\Windows\System\NIkEQSB.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\qWnMhTC.exe
  C:\Windows\System\qWnMhTC.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\TdqdkYV.exe
  C:\Windows\System\TdqdkYV.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\BcMfjSb.exe
  C:\Windows\System\BcMfjSb.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\JKJPOvS.exe
  C:\Windows\System\JKJPOvS.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\jHQnGNt.exe
  C:\Windows\System\jHQnGNt.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\OSGsNHF.exe
  C:\Windows\System\OSGsNHF.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\vaavjJl.exe
  C:\Windows\System\vaavjJl.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\sFRLYlf.exe
  C:\Windows\System\sFRLYlf.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\KXnaKTo.exe
  C:\Windows\System\KXnaKTo.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\uvAGuuA.exe
  C:\Windows\System\uvAGuuA.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\GVMazzD.exe
  C:\Windows\System\GVMazzD.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\cuodfON.exe
  C:\Windows\System\cuodfON.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\PYESheL.exe
  C:\Windows\System\PYESheL.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\WShRwAm.exe
  C:\Windows\System\WShRwAm.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\ucXPDqY.exe
  C:\Windows\System\ucXPDqY.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\YWXGlKH.exe
  C:\Windows\System\YWXGlKH.exe
  2⤵
  PID:1924
- C:\Windows\System\sDwnMJd.exe
  C:\Windows\System\sDwnMJd.exe
  2⤵
  PID:1404
- C:\Windows\System\bEyrspC.exe
  C:\Windows\System\bEyrspC.exe
  2⤵
  PID:4440
- C:\Windows\System\ndIpGNX.exe
  C:\Windows\System\ndIpGNX.exe
  2⤵
  PID:3048
- C:\Windows\System\ShVsina.exe
  C:\Windows\System\ShVsina.exe
  2⤵
  PID:3716
- C:\Windows\System\beIzIuS.exe
  C:\Windows\System\beIzIuS.exe
  2⤵
  PID:3548
- C:\Windows\System\hiDgmIE.exe
  C:\Windows\System\hiDgmIE.exe
  2⤵
  PID:4616
- C:\Windows\System\RfdbQIE.exe
  C:\Windows\System\RfdbQIE.exe
  2⤵
  PID:4784
- C:\Windows\System\dznFvJj.exe
  C:\Windows\System\dznFvJj.exe
  2⤵
  PID:4528
- C:\Windows\System\kEJQBAU.exe
  C:\Windows\System\kEJQBAU.exe
  2⤵
  PID:4292
- C:\Windows\System\VoIQcPS.exe
  C:\Windows\System\VoIQcPS.exe
  2⤵
  PID:3712
- C:\Windows\System\kIGsVRF.exe
  C:\Windows\System\kIGsVRF.exe
  2⤵
  PID:1068
- C:\Windows\System\tKjIytO.exe
  C:\Windows\System\tKjIytO.exe
  2⤵
  PID:816
- C:\Windows\System\PFnrVMa.exe
  C:\Windows\System\PFnrVMa.exe
  2⤵
  PID:4752
- C:\Windows\System\sXTiMYB.exe
  C:\Windows\System\sXTiMYB.exe
  2⤵
  PID:5168
- C:\Windows\System\CzIDZRa.exe
  C:\Windows\System\CzIDZRa.exe
  2⤵
  PID:5192
- C:\Windows\System\oUFFhuT.exe
  C:\Windows\System\oUFFhuT.exe
  2⤵
  PID:5212
- C:\Windows\System\GpmQDKH.exe
  C:\Windows\System\GpmQDKH.exe
  2⤵
  PID:5236
- C:\Windows\System\jPVTRYH.exe
  C:\Windows\System\jPVTRYH.exe
  2⤵
  PID:5264
- C:\Windows\System\ZjnRMKk.exe
  C:\Windows\System\ZjnRMKk.exe
  2⤵
  PID:5284
- C:\Windows\System\DPZPeME.exe
  C:\Windows\System\DPZPeME.exe
  2⤵
  PID:5312
- C:\Windows\System\JrMaokh.exe
  C:\Windows\System\JrMaokh.exe
  2⤵
  PID:5340
- C:\Windows\System\GZtdIHL.exe
  C:\Windows\System\GZtdIHL.exe
  2⤵
  PID:5368
- C:\Windows\System\sjrQdAH.exe
  C:\Windows\System\sjrQdAH.exe
  2⤵
  PID:5396
- C:\Windows\System\JKmjzhn.exe
  C:\Windows\System\JKmjzhn.exe
  2⤵
  PID:5424
- C:\Windows\System\ChfHFhL.exe
  C:\Windows\System\ChfHFhL.exe
  2⤵
  PID:5452
- C:\Windows\System\pREhwWi.exe
  C:\Windows\System\pREhwWi.exe
  2⤵
  PID:5476
- C:\Windows\System\IiNbDTr.exe
  C:\Windows\System\IiNbDTr.exe
  2⤵
  PID:5508
- C:\Windows\System\gdgAglC.exe
  C:\Windows\System\gdgAglC.exe
  2⤵
  PID:5536
- C:\Windows\System\gYCgfwL.exe
  C:\Windows\System\gYCgfwL.exe
  2⤵
  PID:5564
- C:\Windows\System\JEJOSBH.exe
  C:\Windows\System\JEJOSBH.exe
  2⤵
  PID:5592
- C:\Windows\System\oQbAqhA.exe
  C:\Windows\System\oQbAqhA.exe
  2⤵
  PID:5620
- C:\Windows\System\mJNUxzp.exe
  C:\Windows\System\mJNUxzp.exe
  2⤵
  PID:5648
- C:\Windows\System\ppOtTYy.exe
  C:\Windows\System\ppOtTYy.exe
  2⤵
  PID:5676
- C:\Windows\System\GZVwmMX.exe
  C:\Windows\System\GZVwmMX.exe
  2⤵
  PID:5704
- C:\Windows\System\pWvhKce.exe
  C:\Windows\System\pWvhKce.exe
  2⤵
  PID:5732
- C:\Windows\System\rQZuXlT.exe
  C:\Windows\System\rQZuXlT.exe
  2⤵
  PID:5760
- C:\Windows\System\bJpgKNi.exe
  C:\Windows\System\bJpgKNi.exe
  2⤵
  PID:5788
- C:\Windows\System\KCxqnQF.exe
  C:\Windows\System\KCxqnQF.exe
  2⤵
  PID:5816
- C:\Windows\System\wVhmFtP.exe
  C:\Windows\System\wVhmFtP.exe
  2⤵
  PID:5844
- C:\Windows\System\sErDAJZ.exe
  C:\Windows\System\sErDAJZ.exe
  2⤵
  PID:5880
- C:\Windows\System\OOsWwXR.exe
  C:\Windows\System\OOsWwXR.exe
  2⤵
  PID:5900
- C:\Windows\System\YBsJhiU.exe
  C:\Windows\System\YBsJhiU.exe
  2⤵
  PID:5928
- C:\Windows\System\hnNEZge.exe
  C:\Windows\System\hnNEZge.exe
  2⤵
  PID:5956
- C:\Windows\System\kosnEHe.exe
  C:\Windows\System\kosnEHe.exe
  2⤵
  PID:5984
- C:\Windows\System\YDbYcEG.exe
  C:\Windows\System\YDbYcEG.exe
  2⤵
  PID:6016
- C:\Windows\System\zuSSwaE.exe
  C:\Windows\System\zuSSwaE.exe
  2⤵
  PID:6040
- C:\Windows\System\uWibXUz.exe
  C:\Windows\System\uWibXUz.exe
  2⤵
  PID:6072
- C:\Windows\System\GkYROga.exe
  C:\Windows\System\GkYROga.exe
  2⤵
  PID:6100
- C:\Windows\System\sQtPhSt.exe
  C:\Windows\System\sQtPhSt.exe
  2⤵
  PID:6128
- C:\Windows\System\AeeOuRO.exe
  C:\Windows\System\AeeOuRO.exe
  2⤵
  PID:688
- C:\Windows\System\gCdUyue.exe
  C:\Windows\System\gCdUyue.exe
  2⤵
  PID:4372
- C:\Windows\System\sErDtBh.exe
  C:\Windows\System\sErDtBh.exe
  2⤵
  PID:1744
- C:\Windows\System\pSeZvEb.exe
  C:\Windows\System\pSeZvEb.exe
  2⤵
  PID:2572
- C:\Windows\System\fdiMWDZ.exe
  C:\Windows\System\fdiMWDZ.exe
  2⤵
  PID:1472
- C:\Windows\System\vuwItrL.exe
  C:\Windows\System\vuwItrL.exe
  2⤵
  PID:4844
- C:\Windows\System\OoLPgDJ.exe
  C:\Windows\System\OoLPgDJ.exe
  2⤵
  PID:1420
- C:\Windows\System\cRCCVxD.exe
  C:\Windows\System\cRCCVxD.exe
  2⤵
  PID:5128
- C:\Windows\System\gbvrdWD.exe
  C:\Windows\System\gbvrdWD.exe
  2⤵
  PID:5188
- C:\Windows\System\zCYuCCw.exe
  C:\Windows\System\zCYuCCw.exe
  2⤵
  PID:5256
- C:\Windows\System\YpFPpBa.exe
  C:\Windows\System\YpFPpBa.exe
  2⤵
  PID:5304
- C:\Windows\System\VGrjkAt.exe
  C:\Windows\System\VGrjkAt.exe
  2⤵
  PID:5388
- C:\Windows\System\xpSInkP.exe
  C:\Windows\System\xpSInkP.exe
  2⤵
  PID:5444
- C:\Windows\System\IGVSZep.exe
  C:\Windows\System\IGVSZep.exe
  2⤵
  PID:5520
- C:\Windows\System\lzToAOK.exe
  C:\Windows\System\lzToAOK.exe
  2⤵
  PID:5580
- C:\Windows\System\xzEywyd.exe
  C:\Windows\System\xzEywyd.exe
  2⤵
  PID:5636
- C:\Windows\System\tNXXgKq.exe
  C:\Windows\System\tNXXgKq.exe
  2⤵
  PID:5692
- C:\Windows\System\PerlBWl.exe
  C:\Windows\System\PerlBWl.exe
  2⤵
  PID:5748
- C:\Windows\System\ScEkgeh.exe
  C:\Windows\System\ScEkgeh.exe
  2⤵
  PID:5808
- C:\Windows\System\NPKurXa.exe
  C:\Windows\System\NPKurXa.exe
  2⤵
  PID:5872
- C:\Windows\System\HcTFSLv.exe
  C:\Windows\System\HcTFSLv.exe
  2⤵
  PID:5920
- C:\Windows\System\fVRBDki.exe
  C:\Windows\System\fVRBDki.exe
  2⤵
  PID:5996
- C:\Windows\System\YROfqyn.exe
  C:\Windows\System\YROfqyn.exe
  2⤵
  PID:6056
- C:\Windows\System\AkDamqN.exe
  C:\Windows\System\AkDamqN.exe
  2⤵
  PID:6120
- C:\Windows\System\ekeIdMe.exe
  C:\Windows\System\ekeIdMe.exe
  2⤵
  PID:2268
- C:\Windows\System\KUXFjUx.exe
  C:\Windows\System\KUXFjUx.exe
  2⤵
  PID:3244
- C:\Windows\System\bGnXods.exe
  C:\Windows\System\bGnXods.exe
  2⤵
  PID:3192
- C:\Windows\System\DxXNuFH.exe
  C:\Windows\System\DxXNuFH.exe
  2⤵
  PID:5224
- C:\Windows\System\SuYmdCA.exe
  C:\Windows\System\SuYmdCA.exe
  2⤵
  PID:5356
- C:\Windows\System\pSUmfyz.exe
  C:\Windows\System\pSUmfyz.exe
  2⤵
  PID:5496
- C:\Windows\System\ClHBMzq.exe
  C:\Windows\System\ClHBMzq.exe
  2⤵
  PID:5664
- C:\Windows\System\bEjKCvS.exe
  C:\Windows\System\bEjKCvS.exe
  2⤵
  PID:6168
- C:\Windows\System\bGEFewo.exe
  C:\Windows\System\bGEFewo.exe
  2⤵
  PID:6184
- C:\Windows\System\lCeKNER.exe
  C:\Windows\System\lCeKNER.exe
  2⤵
  PID:6216
- C:\Windows\System\BBcmGqk.exe
  C:\Windows\System\BBcmGqk.exe
  2⤵
  PID:6240
- C:\Windows\System\YuwvvJi.exe
  C:\Windows\System\YuwvvJi.exe
  2⤵
  PID:6268
- C:\Windows\System\uPcepnw.exe
  C:\Windows\System\uPcepnw.exe
  2⤵
  PID:6296
- C:\Windows\System\GVnBPpo.exe
  C:\Windows\System\GVnBPpo.exe
  2⤵
  PID:6324
- C:\Windows\System\PYskPnJ.exe
  C:\Windows\System\PYskPnJ.exe
  2⤵
  PID:6352
- C:\Windows\System\XyzeyoA.exe
  C:\Windows\System\XyzeyoA.exe
  2⤵
  PID:6380
- C:\Windows\System\nhPBpbG.exe
  C:\Windows\System\nhPBpbG.exe
  2⤵
  PID:6408
- C:\Windows\System\YdVEWut.exe
  C:\Windows\System\YdVEWut.exe
  2⤵
  PID:6436
- C:\Windows\System\WVgbZOT.exe
  C:\Windows\System\WVgbZOT.exe
  2⤵
  PID:6464
- C:\Windows\System\yRdaCKG.exe
  C:\Windows\System\yRdaCKG.exe
  2⤵
  PID:6492
- C:\Windows\System\JjcAYyj.exe
  C:\Windows\System\JjcAYyj.exe
  2⤵
  PID:6516
- C:\Windows\System\HCyxJxe.exe
  C:\Windows\System\HCyxJxe.exe
  2⤵
  PID:6548
- C:\Windows\System\wrbNGBC.exe
  C:\Windows\System\wrbNGBC.exe
  2⤵
  PID:6576
- C:\Windows\System\oftuWgJ.exe
  C:\Windows\System\oftuWgJ.exe
  2⤵
  PID:6604
- C:\Windows\System\icNMhwq.exe
  C:\Windows\System\icNMhwq.exe
  2⤵
  PID:6632
- C:\Windows\System\KJAMXOQ.exe
  C:\Windows\System\KJAMXOQ.exe
  2⤵
  PID:6660
- C:\Windows\System\CrdNOqb.exe
  C:\Windows\System\CrdNOqb.exe
  2⤵
  PID:6688
- C:\Windows\System\yyZmTcJ.exe
  C:\Windows\System\yyZmTcJ.exe
  2⤵
  PID:6716
- C:\Windows\System\jbpRnnt.exe
  C:\Windows\System\jbpRnnt.exe
  2⤵
  PID:6744
- C:\Windows\System\kKDAkod.exe
  C:\Windows\System\kKDAkod.exe
  2⤵
  PID:6772
- C:\Windows\System\CxKeXSe.exe
  C:\Windows\System\CxKeXSe.exe
  2⤵
  PID:6800
- C:\Windows\System\qCfGOWM.exe
  C:\Windows\System\qCfGOWM.exe
  2⤵
  PID:6828
- C:\Windows\System\qEbQGPJ.exe
  C:\Windows\System\qEbQGPJ.exe
  2⤵
  PID:6856
- C:\Windows\System\ehRvvWm.exe
  C:\Windows\System\ehRvvWm.exe
  2⤵
  PID:6880
- C:\Windows\System\wmGitDA.exe
  C:\Windows\System\wmGitDA.exe
  2⤵
  PID:6912
- C:\Windows\System\SeWHFdE.exe
  C:\Windows\System\SeWHFdE.exe
  2⤵
  PID:6940
- C:\Windows\System\bLcxQmy.exe
  C:\Windows\System\bLcxQmy.exe
  2⤵
  PID:6968
- C:\Windows\System\JROwRBV.exe
  C:\Windows\System\JROwRBV.exe
  2⤵
  PID:6996
- C:\Windows\System\NqARvzL.exe
  C:\Windows\System\NqARvzL.exe
  2⤵
  PID:7088
- C:\Windows\System\fxxWOif.exe
  C:\Windows\System\fxxWOif.exe
  2⤵
  PID:7112
- C:\Windows\System\aPMLxMt.exe
  C:\Windows\System\aPMLxMt.exe
  2⤵
  PID:7136
- C:\Windows\System\ESdkRex.exe
  C:\Windows\System\ESdkRex.exe
  2⤵
  PID:7156
- C:\Windows\System\vOiUusj.exe
  C:\Windows\System\vOiUusj.exe
  2⤵
  PID:5896
- C:\Windows\System\FzAWETe.exe
  C:\Windows\System\FzAWETe.exe
  2⤵
  PID:6032
- C:\Windows\System\zxMuHfD.exe
  C:\Windows\System\zxMuHfD.exe
  2⤵
  PID:4552
- C:\Windows\System\IbapSmH.exe
  C:\Windows\System\IbapSmH.exe
  2⤵
  PID:924
- C:\Windows\System\bFEuMJD.exe
  C:\Windows\System\bFEuMJD.exe
  2⤵
  PID:2136
- C:\Windows\System\VWGTvSG.exe
  C:\Windows\System\VWGTvSG.exe
  2⤵
  PID:5300
- C:\Windows\System\GfzmuhM.exe
  C:\Windows\System\GfzmuhM.exe
  2⤵
  PID:2320
- C:\Windows\System\LhINCBe.exe
  C:\Windows\System\LhINCBe.exe
  2⤵
  PID:6180
- C:\Windows\System\wjMmIdv.exe
  C:\Windows\System\wjMmIdv.exe
  2⤵
  PID:6232
- C:\Windows\System\qRWWyOA.exe
  C:\Windows\System\qRWWyOA.exe
  2⤵
  PID:6364
- C:\Windows\System\FVXFvwq.exe
  C:\Windows\System\FVXFvwq.exe
  2⤵
  PID:6420
- C:\Windows\System\jjJKdzt.exe
  C:\Windows\System\jjJKdzt.exe
  2⤵
  PID:6456
- C:\Windows\System\faPojei.exe
  C:\Windows\System\faPojei.exe
  2⤵
  PID:6508
- C:\Windows\System\qeebKZc.exe
  C:\Windows\System\qeebKZc.exe
  2⤵
  PID:6536
- C:\Windows\System\XmVMrSQ.exe
  C:\Windows\System\XmVMrSQ.exe
  2⤵
  PID:6592
- C:\Windows\System\xmeoYSF.exe
  C:\Windows\System\xmeoYSF.exe
  2⤵
  PID:5088
- C:\Windows\System\FzIahLu.exe
  C:\Windows\System\FzIahLu.exe
  2⤵
  PID:3972
- C:\Windows\System\gdIvqbv.exe
  C:\Windows\System\gdIvqbv.exe
  2⤵
  PID:6704
- C:\Windows\System\jbPpCdg.exe
  C:\Windows\System\jbPpCdg.exe
  2⤵
  PID:6756
- C:\Windows\System\SvOzIaw.exe
  C:\Windows\System\SvOzIaw.exe
  2⤵
  PID:4188
- C:\Windows\System\FMUvxXF.exe
  C:\Windows\System\FMUvxXF.exe
  2⤵
  PID:3396
- C:\Windows\System\JADFFCi.exe
  C:\Windows\System\JADFFCi.exe
  2⤵
  PID:6820
- C:\Windows\System\DDxxMRx.exe
  C:\Windows\System\DDxxMRx.exe
  2⤵
  PID:4772
- C:\Windows\System\mVHCVaK.exe
  C:\Windows\System\mVHCVaK.exe
  2⤵
  PID:1848
- C:\Windows\System\teUQUMN.exe
  C:\Windows\System\teUQUMN.exe
  2⤵
  PID:7008
- C:\Windows\System\AqihAhl.exe
  C:\Windows\System\AqihAhl.exe
  2⤵
  PID:1440
- C:\Windows\System\qoIYDXw.exe
  C:\Windows\System\qoIYDXw.exe
  2⤵
  PID:540
- C:\Windows\System\xsYeGtP.exe
  C:\Windows\System\xsYeGtP.exe
  2⤵
  PID:6876
- C:\Windows\System\CXIkvfe.exe
  C:\Windows\System\CXIkvfe.exe
  2⤵
  PID:4684
- C:\Windows\System\AfUueWY.exe
  C:\Windows\System\AfUueWY.exe
  2⤵
  PID:7152
- C:\Windows\System\TxYeZCr.exe
  C:\Windows\System\TxYeZCr.exe
  2⤵
  PID:4976
- C:\Windows\System\HCwWWCH.exe
  C:\Windows\System\HCwWWCH.exe
  2⤵
  PID:6344
- C:\Windows\System\wDEWgzs.exe
  C:\Windows\System\wDEWgzs.exe
  2⤵
  PID:6452
- C:\Windows\System\pEnUqKT.exe
  C:\Windows\System\pEnUqKT.exe
  2⤵
  PID:2412
- C:\Windows\System\pHquSum.exe
  C:\Windows\System\pHquSum.exe
  2⤵
  PID:1920
- C:\Windows\System\obxGvvs.exe
  C:\Windows\System\obxGvvs.exe
  2⤵
  PID:6700
- C:\Windows\System\yQNUHJk.exe
  C:\Windows\System\yQNUHJk.exe
  2⤵
  PID:6848
- C:\Windows\System\NXQldBk.exe
  C:\Windows\System\NXQldBk.exe
  2⤵
  PID:4424
- C:\Windows\System\VdMKfrp.exe
  C:\Windows\System\VdMKfrp.exe
  2⤵
  PID:6984
- C:\Windows\System\jTgkOZn.exe
  C:\Windows\System\jTgkOZn.exe
  2⤵
  PID:2060
- C:\Windows\System\EtxqPtT.exe
  C:\Windows\System\EtxqPtT.exe
  2⤵
  PID:5836
- C:\Windows\System\Kjyulbh.exe
  C:\Windows\System\Kjyulbh.exe
  2⤵
  PID:5436
- C:\Windows\System\XkaZhMU.exe
  C:\Windows\System\XkaZhMU.exe
  2⤵
  PID:6176
- C:\Windows\System\BLmUyTQ.exe
  C:\Windows\System\BLmUyTQ.exe
  2⤵
  PID:6644
- C:\Windows\System\LrnVIXZ.exe
  C:\Windows\System\LrnVIXZ.exe
  2⤵
  PID:6652
- C:\Windows\System\SkmqIBQ.exe
  C:\Windows\System\SkmqIBQ.exe
  2⤵
  PID:6788
- C:\Windows\System\eLttuOo.exe
  C:\Windows\System\eLttuOo.exe
  2⤵
  PID:3732
- C:\Windows\System\hBMKssG.exe
  C:\Windows\System\hBMKssG.exe
  2⤵
  PID:7124
- C:\Windows\System\upiYwHq.exe
  C:\Windows\System\upiYwHq.exe
  2⤵
  PID:6212
- C:\Windows\System\zRrHQad.exe
  C:\Windows\System\zRrHQad.exe
  2⤵
  PID:6792
- C:\Windows\System\aYAfXue.exe
  C:\Windows\System\aYAfXue.exe
  2⤵
  PID:4172
- C:\Windows\System\dmfWIFO.exe
  C:\Windows\System\dmfWIFO.exe
  2⤵
  PID:7192
- C:\Windows\System\arzUvjQ.exe
  C:\Windows\System\arzUvjQ.exe
  2⤵
  PID:7208
- C:\Windows\System\DuvjPiq.exe
  C:\Windows\System\DuvjPiq.exe
  2⤵
  PID:7240
- C:\Windows\System\PHmfSiG.exe
  C:\Windows\System\PHmfSiG.exe
  2⤵
  PID:7272
- C:\Windows\System\ptJJqQY.exe
  C:\Windows\System\ptJJqQY.exe
  2⤵
  PID:7296
- C:\Windows\System\NIVTEIJ.exe
  C:\Windows\System\NIVTEIJ.exe
  2⤵
  PID:7352
- C:\Windows\System\jGEZfJb.exe
  C:\Windows\System\jGEZfJb.exe
  2⤵
  PID:7376
- C:\Windows\System\gVOTolV.exe
  C:\Windows\System\gVOTolV.exe
  2⤵
  PID:7404
- C:\Windows\System\NjbDepD.exe
  C:\Windows\System\NjbDepD.exe
  2⤵
  PID:7428
- C:\Windows\System\GFOfdoy.exe
  C:\Windows\System\GFOfdoy.exe
  2⤵
  PID:7448
- C:\Windows\System\iipiqkV.exe
  C:\Windows\System\iipiqkV.exe
  2⤵
  PID:7472
- C:\Windows\System\skmOrBI.exe
  C:\Windows\System\skmOrBI.exe
  2⤵
  PID:7500
- C:\Windows\System\vvZnZuW.exe
  C:\Windows\System\vvZnZuW.exe
  2⤵
  PID:7524
- C:\Windows\System\CjmKVOA.exe
  C:\Windows\System\CjmKVOA.exe
  2⤵
  PID:7552
- C:\Windows\System\MhchBlm.exe
  C:\Windows\System\MhchBlm.exe
  2⤵
  PID:7596
- C:\Windows\System\AASYAmx.exe
  C:\Windows\System\AASYAmx.exe
  2⤵
  PID:7632
- C:\Windows\System\IfCiFkr.exe
  C:\Windows\System\IfCiFkr.exe
  2⤵
  PID:7660
- C:\Windows\System\JUhDMjH.exe
  C:\Windows\System\JUhDMjH.exe
  2⤵
  PID:7684
- C:\Windows\System\zWEczMT.exe
  C:\Windows\System\zWEczMT.exe
  2⤵
  PID:7728
- C:\Windows\System\onBpWdN.exe
  C:\Windows\System\onBpWdN.exe
  2⤵
  PID:7756
- C:\Windows\System\ANaulAd.exe
  C:\Windows\System\ANaulAd.exe
  2⤵
  PID:7772
- C:\Windows\System\dgDaaSW.exe
  C:\Windows\System\dgDaaSW.exe
  2⤵
  PID:7812
- C:\Windows\System\pOPfdDY.exe
  C:\Windows\System\pOPfdDY.exe
  2⤵
  PID:7828
- C:\Windows\System\kqWCPLJ.exe
  C:\Windows\System\kqWCPLJ.exe
  2⤵
  PID:7856
- C:\Windows\System\WsVKvRU.exe
  C:\Windows\System\WsVKvRU.exe
  2⤵
  PID:7904
- C:\Windows\System\kLhnjiD.exe
  C:\Windows\System\kLhnjiD.exe
  2⤵
  PID:7920
- C:\Windows\System\udRQaRG.exe
  C:\Windows\System\udRQaRG.exe
  2⤵
  PID:7948
- C:\Windows\System\BGcZHvu.exe
  C:\Windows\System\BGcZHvu.exe
  2⤵
  PID:7976
- C:\Windows\System\hqHKHNW.exe
  C:\Windows\System\hqHKHNW.exe
  2⤵
  PID:8004
- C:\Windows\System\RJeUPiv.exe
  C:\Windows\System\RJeUPiv.exe
  2⤵
  PID:8020
- C:\Windows\System\aIAsxgy.exe
  C:\Windows\System\aIAsxgy.exe
  2⤵
  PID:8048
- C:\Windows\System\dbRQGMu.exe
  C:\Windows\System\dbRQGMu.exe
  2⤵
  PID:8072
- C:\Windows\System\gdFuDGg.exe
  C:\Windows\System\gdFuDGg.exe
  2⤵
  PID:8096
- C:\Windows\System\ctxecXc.exe
  C:\Windows\System\ctxecXc.exe
  2⤵
  PID:8120
- C:\Windows\System\xjfJmTF.exe
  C:\Windows\System\xjfJmTF.exe
  2⤵
  PID:8156
- C:\Windows\System\AiGqlFw.exe
  C:\Windows\System\AiGqlFw.exe
  2⤵
  PID:8176
- C:\Windows\System\AHvVcAE.exe
  C:\Windows\System\AHvVcAE.exe
  2⤵
  PID:3256
- C:\Windows\System\nRWQSEi.exe
  C:\Windows\System\nRWQSEi.exe
  2⤵
  PID:4436
- C:\Windows\System\XZEsCFM.exe
  C:\Windows\System\XZEsCFM.exe
  2⤵
  PID:7264
- C:\Windows\System\djjFtQG.exe
  C:\Windows\System\djjFtQG.exe
  2⤵
  PID:7288
- C:\Windows\System\JmqeElS.exe
  C:\Windows\System\JmqeElS.exe
  2⤵
  PID:7652
- C:\Windows\System\QDgePDP.exe
  C:\Windows\System\QDgePDP.exe
  2⤵
  PID:7720
- C:\Windows\System\lqkuFTJ.exe
  C:\Windows\System\lqkuFTJ.exe
  2⤵
  PID:7748
- C:\Windows\System\XMKNOlx.exe
  C:\Windows\System\XMKNOlx.exe
  2⤵
  PID:7984
- C:\Windows\System\ukhgUPW.exe
  C:\Windows\System\ukhgUPW.exe
  2⤵
  PID:8056
- C:\Windows\System\UsoKIJe.exe
  C:\Windows\System\UsoKIJe.exe
  2⤵
  PID:8080
- C:\Windows\System\RfVWZCi.exe
  C:\Windows\System\RfVWZCi.exe
  2⤵
  PID:8136
- C:\Windows\System\BYYQXKd.exe
  C:\Windows\System\BYYQXKd.exe
  2⤵
  PID:7344
- C:\Windows\System\bFbYQTz.exe
  C:\Windows\System\bFbYQTz.exe
  2⤵
  PID:7420
- C:\Windows\System\IZhbIDE.exe
  C:\Windows\System\IZhbIDE.exe
  2⤵
  PID:7456
- C:\Windows\System\vQSkycb.exe
  C:\Windows\System\vQSkycb.exe
  2⤵
  PID:7484
- C:\Windows\System\fhKTgTr.exe
  C:\Windows\System\fhKTgTr.exe
  2⤵
  PID:7520
- C:\Windows\System\IeGrJoz.exe
  C:\Windows\System\IeGrJoz.exe
  2⤵
  PID:7740
- C:\Windows\System\uAnmgBu.exe
  C:\Windows\System\uAnmgBu.exe
  2⤵
  PID:7232
- C:\Windows\System\MObJMMu.exe
  C:\Windows\System\MObJMMu.exe
  2⤵
  PID:7752
- C:\Windows\System\XrHIftK.exe
  C:\Windows\System\XrHIftK.exe
  2⤵
  PID:8040
- C:\Windows\System\EATqxKV.exe
  C:\Windows\System\EATqxKV.exe
  2⤵
  PID:8172
- C:\Windows\System\ddkbNNQ.exe
  C:\Windows\System\ddkbNNQ.exe
  2⤵
  PID:7604
- C:\Windows\System\dVTgXca.exe
  C:\Windows\System\dVTgXca.exe
  2⤵
  PID:8188
- C:\Windows\System\KdfruaR.exe
  C:\Windows\System\KdfruaR.exe
  2⤵
  PID:7704
- C:\Windows\System\eSnXeFl.exe
  C:\Windows\System\eSnXeFl.exe
  2⤵
  PID:7320
- C:\Windows\System\PTQszvM.exe
  C:\Windows\System\PTQszvM.exe
  2⤵
  PID:7444
- C:\Windows\System\OyVKRYS.exe
  C:\Windows\System\OyVKRYS.exe
  2⤵
  PID:8196
- C:\Windows\System\vAqnrQQ.exe
  C:\Windows\System\vAqnrQQ.exe
  2⤵
  PID:8224
- C:\Windows\System\VFgRCYa.exe
  C:\Windows\System\VFgRCYa.exe
  2⤵
  PID:8248
- C:\Windows\System\wTcgGzI.exe
  C:\Windows\System\wTcgGzI.exe
  2⤵
  PID:8276
- C:\Windows\System\wZQFJBD.exe
  C:\Windows\System\wZQFJBD.exe
  2⤵
  PID:8308
- C:\Windows\System\ESDylyO.exe
  C:\Windows\System\ESDylyO.exe
  2⤵
  PID:8332
- C:\Windows\System\fbYNEVb.exe
  C:\Windows\System\fbYNEVb.exe
  2⤵
  PID:8360
- C:\Windows\System\JqGYBvs.exe
  C:\Windows\System\JqGYBvs.exe
  2⤵
  PID:8384
- C:\Windows\System\BYKmlNr.exe
  C:\Windows\System\BYKmlNr.exe
  2⤵
  PID:8408
- C:\Windows\System\oZzPvwt.exe
  C:\Windows\System\oZzPvwt.exe
  2⤵
  PID:8464
- C:\Windows\System\JhxJZSb.exe
  C:\Windows\System\JhxJZSb.exe
  2⤵
  PID:8496
- C:\Windows\System\puccyGi.exe
  C:\Windows\System\puccyGi.exe
  2⤵
  PID:8516
- C:\Windows\System\NLHbQgR.exe
  C:\Windows\System\NLHbQgR.exe
  2⤵
  PID:8536
- C:\Windows\System\SUiogzu.exe
  C:\Windows\System\SUiogzu.exe
  2⤵
  PID:8568
- C:\Windows\System\QWoUIpz.exe
  C:\Windows\System\QWoUIpz.exe
  2⤵
  PID:8612
- C:\Windows\System\pknpaAn.exe
  C:\Windows\System\pknpaAn.exe
  2⤵
  PID:8636
- C:\Windows\System\ApAzuDA.exe
  C:\Windows\System\ApAzuDA.exe
  2⤵
  PID:8656
- C:\Windows\System\UPnzJRR.exe
  C:\Windows\System\UPnzJRR.exe
  2⤵
  PID:8688
- C:\Windows\System\JiEQanB.exe
  C:\Windows\System\JiEQanB.exe
  2⤵
  PID:8724
- C:\Windows\System\isUDpkM.exe
  C:\Windows\System\isUDpkM.exe
  2⤵
  PID:8752
- C:\Windows\System\lrKGpLA.exe
  C:\Windows\System\lrKGpLA.exe
  2⤵
  PID:8780
- C:\Windows\System\GSHIQec.exe
  C:\Windows\System\GSHIQec.exe
  2⤵
  PID:8808
- C:\Windows\System\MDYWFHN.exe
  C:\Windows\System\MDYWFHN.exe
  2⤵
  PID:8824
- C:\Windows\System\RJkOVeV.exe
  C:\Windows\System\RJkOVeV.exe
  2⤵
  PID:8844
- C:\Windows\System\acrbQQW.exe
  C:\Windows\System\acrbQQW.exe
  2⤵
  PID:8876
- C:\Windows\System\ZGBNLJB.exe
  C:\Windows\System\ZGBNLJB.exe
  2⤵
  PID:8896
- C:\Windows\System\ptfjIqz.exe
  C:\Windows\System\ptfjIqz.exe
  2⤵
  PID:8912
- C:\Windows\System\WdvRbeh.exe
  C:\Windows\System\WdvRbeh.exe
  2⤵
  PID:8928
- C:\Windows\System\nThehDs.exe
  C:\Windows\System\nThehDs.exe
  2⤵
  PID:8956
- C:\Windows\System\XGMLGhb.exe
  C:\Windows\System\XGMLGhb.exe
  2⤵
  PID:8996
- C:\Windows\System\oxXObEc.exe
  C:\Windows\System\oxXObEc.exe
  2⤵
  PID:9044
- C:\Windows\System\OjlGMuK.exe
  C:\Windows\System\OjlGMuK.exe
  2⤵
  PID:9072
- C:\Windows\System\GWASokB.exe
  C:\Windows\System\GWASokB.exe
  2⤵
  PID:9100
- C:\Windows\System\RafaiBR.exe
  C:\Windows\System\RafaiBR.exe
  2⤵
  PID:9120
- C:\Windows\System\jecVtrP.exe
  C:\Windows\System\jecVtrP.exe
  2⤵
  PID:9148
- C:\Windows\System\OgFgEbo.exe
  C:\Windows\System\OgFgEbo.exe
  2⤵
  PID:9172
- C:\Windows\System\WjNNqOc.exe
  C:\Windows\System\WjNNqOc.exe
  2⤵
  PID:9212
- C:\Windows\System\GsfPsKB.exe
  C:\Windows\System\GsfPsKB.exe
  2⤵
  PID:8236
- C:\Windows\System\hnOWbNA.exe
  C:\Windows\System\hnOWbNA.exe
  2⤵
  PID:8320
- C:\Windows\System\eZRqSqN.exe
  C:\Windows\System\eZRqSqN.exe
  2⤵
  PID:8296
- C:\Windows\System\NmGqMBB.exe
  C:\Windows\System\NmGqMBB.exe
  2⤵
  PID:8436
- C:\Windows\System\VcBNDNJ.exe
  C:\Windows\System\VcBNDNJ.exe
  2⤵
  PID:8460
- C:\Windows\System\BElIQTA.exe
  C:\Windows\System\BElIQTA.exe
  2⤵
  PID:8492
- C:\Windows\System\hdHevKC.exe
  C:\Windows\System\hdHevKC.exe
  2⤵
  PID:8556
- C:\Windows\System\qFcfqWt.exe
  C:\Windows\System\qFcfqWt.exe
  2⤵
  PID:8676
- C:\Windows\System\PKkoJGX.exe
  C:\Windows\System\PKkoJGX.exe
  2⤵
  PID:8744
- C:\Windows\System\YcNctga.exe
  C:\Windows\System\YcNctga.exe
  2⤵
  PID:8800
- C:\Windows\System\rBqqrAQ.exe
  C:\Windows\System\rBqqrAQ.exe
  2⤵
  PID:8860
- C:\Windows\System\mImUAiq.exe
  C:\Windows\System\mImUAiq.exe
  2⤵
  PID:8940
- C:\Windows\System\MWkZYkx.exe
  C:\Windows\System\MWkZYkx.exe
  2⤵
  PID:8992
- C:\Windows\System\mGXHABV.exe
  C:\Windows\System\mGXHABV.exe
  2⤵
  PID:9064
- C:\Windows\System\sJcEcUx.exe
  C:\Windows\System\sJcEcUx.exe
  2⤵
  PID:9188
- C:\Windows\System\AUhklNG.exe
  C:\Windows\System\AUhklNG.exe
  2⤵
  PID:8036
- C:\Windows\System\uwsZmSw.exe
  C:\Windows\System\uwsZmSw.exe
  2⤵
  PID:8376
- C:\Windows\System\TPkMNOj.exe
  C:\Windows\System\TPkMNOj.exe
  2⤵
  PID:8488
- C:\Windows\System\tjizrPs.exe
  C:\Windows\System\tjizrPs.exe
  2⤵
  PID:8632
- C:\Windows\System\AzPDfRE.exe
  C:\Windows\System\AzPDfRE.exe
  2⤵
  PID:8708
- C:\Windows\System\ZfDiNpR.exe
  C:\Windows\System\ZfDiNpR.exe
  2⤵
  PID:8892
- C:\Windows\System\vUNiPUB.exe
  C:\Windows\System\vUNiPUB.exe
  2⤵
  PID:9036
- C:\Windows\System\psLYXOF.exe
  C:\Windows\System\psLYXOF.exe
  2⤵
  PID:8208
- C:\Windows\System\sZlSFNz.exe
  C:\Windows\System\sZlSFNz.exe
  2⤵
  PID:8392
- C:\Windows\System\GflVgvC.exe
  C:\Windows\System\GflVgvC.exe
  2⤵
  PID:8836
- C:\Windows\System\qNxubmy.exe
  C:\Windows\System\qNxubmy.exe
  2⤵
  PID:9016
- C:\Windows\System\bRTdFEm.exe
  C:\Windows\System\bRTdFEm.exe
  2⤵
  PID:8716
- C:\Windows\System\fETofWM.exe
  C:\Windows\System\fETofWM.exe
  2⤵
  PID:9224
- C:\Windows\System\Ktvlcxw.exe
  C:\Windows\System\Ktvlcxw.exe
  2⤵
  PID:9248
- C:\Windows\System\ScOFTMV.exe
  C:\Windows\System\ScOFTMV.exe
  2⤵
  PID:9308
- C:\Windows\System\wckHqLA.exe
  C:\Windows\System\wckHqLA.exe
  2⤵
  PID:9332
- C:\Windows\System\gkabyUr.exe
  C:\Windows\System\gkabyUr.exe
  2⤵
  PID:9360
- C:\Windows\System\ageaNMx.exe
  C:\Windows\System\ageaNMx.exe
  2⤵
  PID:9384
- C:\Windows\System\mifMHrD.exe
  C:\Windows\System\mifMHrD.exe
  2⤵
  PID:9412
- C:\Windows\System\dDDyZMf.exe
  C:\Windows\System\dDDyZMf.exe
  2⤵
  PID:9440
- C:\Windows\System\KEnJjoc.exe
  C:\Windows\System\KEnJjoc.exe
  2⤵
  PID:9480
- C:\Windows\System\Brvagqy.exe
  C:\Windows\System\Brvagqy.exe
  2⤵
  PID:9508
- C:\Windows\System\FaQZeAL.exe
  C:\Windows\System\FaQZeAL.exe
  2⤵
  PID:9528
- C:\Windows\System\fcJYAXL.exe
  C:\Windows\System\fcJYAXL.exe
  2⤵
  PID:9556
- C:\Windows\System\gHmUYhh.exe
  C:\Windows\System\gHmUYhh.exe
  2⤵
  PID:9596
- C:\Windows\System\pUvYqbv.exe
  C:\Windows\System\pUvYqbv.exe
  2⤵
  PID:9616
- C:\Windows\System\vyCowUq.exe
  C:\Windows\System\vyCowUq.exe
  2⤵
  PID:9640
- C:\Windows\System\UJisOBv.exe
  C:\Windows\System\UJisOBv.exe
  2⤵
  PID:9664
- C:\Windows\System\TnXErtq.exe
  C:\Windows\System\TnXErtq.exe
  2⤵
  PID:9692
- C:\Windows\System\hljyLEy.exe
  C:\Windows\System\hljyLEy.exe
  2⤵
  PID:9724
- C:\Windows\System\CVKjVPX.exe
  C:\Windows\System\CVKjVPX.exe
  2⤵
  PID:9740
- C:\Windows\System\VWvmhhu.exe
  C:\Windows\System\VWvmhhu.exe
  2⤵
  PID:9780
- C:\Windows\System\SHCsNAU.exe
  C:\Windows\System\SHCsNAU.exe
  2⤵
  PID:9804
- C:\Windows\System\BVWdrin.exe
  C:\Windows\System\BVWdrin.exe
  2⤵
  PID:9840
- C:\Windows\System\auNFNxu.exe
  C:\Windows\System\auNFNxu.exe
  2⤵
  PID:9876
- C:\Windows\System\OSePDPL.exe
  C:\Windows\System\OSePDPL.exe
  2⤵
  PID:9896
- C:\Windows\System\tIXuLcg.exe
  C:\Windows\System\tIXuLcg.exe
  2⤵
  PID:9920
- C:\Windows\System\tnaWbED.exe
  C:\Windows\System\tnaWbED.exe
  2⤵
  PID:9940
- C:\Windows\System\INNhmYI.exe
  C:\Windows\System\INNhmYI.exe
  2⤵
  PID:9964
- C:\Windows\System\TVcdyRg.exe
  C:\Windows\System\TVcdyRg.exe
  2⤵
  PID:9992
- C:\Windows\System\geSMyrE.exe
  C:\Windows\System\geSMyrE.exe
  2⤵
  PID:10012
- C:\Windows\System\NCONDNP.exe
  C:\Windows\System\NCONDNP.exe
  2⤵
  PID:10036
- C:\Windows\System\wlHsirz.exe
  C:\Windows\System\wlHsirz.exe
  2⤵
  PID:10064
- C:\Windows\System\eJIivcx.exe
  C:\Windows\System\eJIivcx.exe
  2⤵
  PID:10092
- C:\Windows\System\xhKYgne.exe
  C:\Windows\System\xhKYgne.exe
  2⤵
  PID:10124
- C:\Windows\System\LCEafbl.exe
  C:\Windows\System\LCEafbl.exe
  2⤵
  PID:10148
- C:\Windows\System\ybZhcyW.exe
  C:\Windows\System\ybZhcyW.exe
  2⤵
  PID:10188
- C:\Windows\System\JwtAPPZ.exe
  C:\Windows\System\JwtAPPZ.exe
  2⤵
  PID:10216
- C:\Windows\System\ziwxUzx.exe
  C:\Windows\System\ziwxUzx.exe
  2⤵
  PID:9132
- C:\Windows\System\HWumWoS.exe
  C:\Windows\System\HWumWoS.exe
  2⤵
  PID:9220
- C:\Windows\System\PpfHGKQ.exe
  C:\Windows\System\PpfHGKQ.exe
  2⤵
  PID:9316
- C:\Windows\System\AjpIZNM.exe
  C:\Windows\System\AjpIZNM.exe
  2⤵
  PID:9348
- C:\Windows\System\RRKTqIj.exe
  C:\Windows\System\RRKTqIj.exe
  2⤵
  PID:9476
- C:\Windows\System\gijjNVB.exe
  C:\Windows\System\gijjNVB.exe
  2⤵
  PID:9544
- C:\Windows\System\tdMtyWt.exe
  C:\Windows\System\tdMtyWt.exe
  2⤵
  PID:9572
- C:\Windows\System\rIupvxV.exe
  C:\Windows\System\rIupvxV.exe
  2⤵
  PID:9636
- C:\Windows\System\nfhddCB.exe
  C:\Windows\System\nfhddCB.exe
  2⤵
  PID:9708
- C:\Windows\System\nzUkutz.exe
  C:\Windows\System\nzUkutz.exe
  2⤵
  PID:9764
- C:\Windows\System\ARhoLBc.exe
  C:\Windows\System\ARhoLBc.exe
  2⤵
  PID:9824
- C:\Windows\System\mBNojuw.exe
  C:\Windows\System\mBNojuw.exe
  2⤵
  PID:9912
- C:\Windows\System\qqvQrRX.exe
  C:\Windows\System\qqvQrRX.exe
  2⤵
  PID:9960
- C:\Windows\System\MLgFhDu.exe
  C:\Windows\System\MLgFhDu.exe
  2⤵
  PID:10008
- C:\Windows\System\hXcWewX.exe
  C:\Windows\System\hXcWewX.exe
  2⤵
  PID:10120
- C:\Windows\System\pBKYxwE.exe
  C:\Windows\System\pBKYxwE.exe
  2⤵
  PID:10180
- C:\Windows\System\qnBdyXX.exe
  C:\Windows\System\qnBdyXX.exe
  2⤵
  PID:10208
- C:\Windows\System\MrQPjyk.exe
  C:\Windows\System\MrQPjyk.exe
  2⤵
  PID:9328
- C:\Windows\System\cpcYpkJ.exe
  C:\Windows\System\cpcYpkJ.exe
  2⤵
  PID:9408
- C:\Windows\System\ACTQPzN.exe
  C:\Windows\System\ACTQPzN.exe
  2⤵
  PID:9716
- C:\Windows\System\KGyfCxK.exe
  C:\Windows\System\KGyfCxK.exe
  2⤵
  PID:9632
- C:\Windows\System\xtyHEpJ.exe
  C:\Windows\System\xtyHEpJ.exe
  2⤵
  PID:9812
- C:\Windows\System\iYwKeaM.exe
  C:\Windows\System\iYwKeaM.exe
  2⤵
  PID:10084
- C:\Windows\System\zNBjpXv.exe
  C:\Windows\System\zNBjpXv.exe
  2⤵
  PID:9344
- C:\Windows\System\AxNogkj.exe
  C:\Windows\System\AxNogkj.exe
  2⤵
  PID:9380
- C:\Windows\System\PEZQbfp.exe
  C:\Windows\System\PEZQbfp.exe
  2⤵
  PID:9868
- C:\Windows\System\feKENTM.exe
  C:\Windows\System\feKENTM.exe
  2⤵
  PID:9236
- C:\Windows\System\vnwTlny.exe
  C:\Windows\System\vnwTlny.exe
  2⤵
  PID:10244
- C:\Windows\System\GErpYLk.exe
  C:\Windows\System\GErpYLk.exe
  2⤵
  PID:10284
- C:\Windows\System\LcQbQnE.exe
  C:\Windows\System\LcQbQnE.exe
  2⤵
  PID:10304
- C:\Windows\System\zfhZBOD.exe
  C:\Windows\System\zfhZBOD.exe
  2⤵
  PID:10324
- C:\Windows\System\DwPVVzK.exe
  C:\Windows\System\DwPVVzK.exe
  2⤵
  PID:10360
- C:\Windows\System\tvyGYae.exe
  C:\Windows\System\tvyGYae.exe
  2⤵
  PID:10400
- C:\Windows\System\Pqdrrvj.exe
  C:\Windows\System\Pqdrrvj.exe
  2⤵
  PID:10428
- C:\Windows\System\UWwGWHM.exe
  C:\Windows\System\UWwGWHM.exe
  2⤵
  PID:10444
- C:\Windows\System\inKwWKK.exe
  C:\Windows\System\inKwWKK.exe
  2⤵
  PID:10472
- C:\Windows\System\ltnvNDS.exe
  C:\Windows\System\ltnvNDS.exe
  2⤵
  PID:10504
- C:\Windows\System\ZOWbwkF.exe
  C:\Windows\System\ZOWbwkF.exe
  2⤵
  PID:10528
- C:\Windows\System\ZTJRtUO.exe
  C:\Windows\System\ZTJRtUO.exe
  2⤵
  PID:10548
- C:\Windows\System\eRNiegN.exe
  C:\Windows\System\eRNiegN.exe
  2⤵
  PID:10584
- C:\Windows\System\nDuaWYI.exe
  C:\Windows\System\nDuaWYI.exe
  2⤵
  PID:10604
- C:\Windows\System\TzakWEP.exe
  C:\Windows\System\TzakWEP.exe
  2⤵
  PID:10624
- C:\Windows\System\gJvbDXC.exe
  C:\Windows\System\gJvbDXC.exe
  2⤵
  PID:10656
- C:\Windows\System\UFNPfjt.exe
  C:\Windows\System\UFNPfjt.exe
  2⤵
  PID:10680
- C:\Windows\System\UiVXoWG.exe
  C:\Windows\System\UiVXoWG.exe
  2⤵
  PID:10704
- C:\Windows\System\FkyHcqv.exe
  C:\Windows\System\FkyHcqv.exe
  2⤵
  PID:10728
- C:\Windows\System\bIJvCtA.exe
  C:\Windows\System\bIJvCtA.exe
  2⤵
  PID:10748
- C:\Windows\System\iWVvSWp.exe
  C:\Windows\System\iWVvSWp.exe
  2⤵
  PID:10768
- C:\Windows\System\Qqjjfvz.exe
  C:\Windows\System\Qqjjfvz.exe
  2⤵
  PID:10796
- C:\Windows\System\oIrhFzx.exe
  C:\Windows\System\oIrhFzx.exe
  2⤵
  PID:10836
- C:\Windows\System\irZyVLc.exe
  C:\Windows\System\irZyVLc.exe
  2⤵
  PID:10896
- C:\Windows\System\KPhRvdH.exe
  C:\Windows\System\KPhRvdH.exe
  2⤵
  PID:10920
- C:\Windows\System\zGGAKUz.exe
  C:\Windows\System\zGGAKUz.exe
  2⤵
  PID:10936
- C:\Windows\System\SJTmHSi.exe
  C:\Windows\System\SJTmHSi.exe
  2⤵
  PID:10968
- C:\Windows\System\LtdHbLd.exe
  C:\Windows\System\LtdHbLd.exe
  2⤵
  PID:10992
- C:\Windows\System\aHTIWgN.exe
  C:\Windows\System\aHTIWgN.exe
  2⤵
  PID:11012
- C:\Windows\System\SPUDAsI.exe
  C:\Windows\System\SPUDAsI.exe
  2⤵
  PID:11060
- C:\Windows\System\vWghOLq.exe
  C:\Windows\System\vWghOLq.exe
  2⤵
  PID:11076
- C:\Windows\System\jqaemCP.exe
  C:\Windows\System\jqaemCP.exe
  2⤵
  PID:11100
- C:\Windows\System\KyRZokb.exe
  C:\Windows\System\KyRZokb.exe
  2⤵
  PID:11156
- C:\Windows\System\FpIAnig.exe
  C:\Windows\System\FpIAnig.exe
  2⤵
  PID:11176
- C:\Windows\System\rnMsvkG.exe
  C:\Windows\System\rnMsvkG.exe
  2⤵
  PID:11204
- C:\Windows\System\dECaufc.exe
  C:\Windows\System\dECaufc.exe
  2⤵
  PID:11244
- C:\Windows\System\OGvrTLL.exe
  C:\Windows\System\OGvrTLL.exe
  2⤵
  PID:11260
- C:\Windows\System\YMEajZC.exe
  C:\Windows\System\YMEajZC.exe
  2⤵
  PID:10356
- C:\Windows\System\BXWRRNJ.exe
  C:\Windows\System\BXWRRNJ.exe
  2⤵
  PID:10420
- C:\Windows\System\AtYJRHG.exe
  C:\Windows\System\AtYJRHG.exe
  2⤵
  PID:10456
- C:\Windows\System\PayeFuZ.exe
  C:\Windows\System\PayeFuZ.exe
  2⤵
  PID:10520
- C:\Windows\System\WdhiMfV.exe
  C:\Windows\System\WdhiMfV.exe
  2⤵
  PID:10536
- C:\Windows\System\hiDjHNu.exe
  C:\Windows\System\hiDjHNu.exe
  2⤵
  PID:10572
- C:\Windows\System\FKOwmbx.exe
  C:\Windows\System\FKOwmbx.exe
  2⤵
  PID:10700
- C:\Windows\System\MRAvjwC.exe
  C:\Windows\System\MRAvjwC.exe
  2⤵
  PID:10736
- C:\Windows\System\oUwzrfP.exe
  C:\Windows\System\oUwzrfP.exe
  2⤵
  PID:10764
- C:\Windows\System\YkJEehL.exe
  C:\Windows\System\YkJEehL.exe
  2⤵
  PID:10852
- C:\Windows\System\rMryBdK.exe
  C:\Windows\System\rMryBdK.exe
  2⤵
  PID:10908
- C:\Windows\System\OleeSBc.exe
  C:\Windows\System\OleeSBc.exe
  2⤵
  PID:11008
- C:\Windows\System\siqLrcR.exe
  C:\Windows\System\siqLrcR.exe
  2⤵
  PID:11044
- C:\Windows\System\XFafftV.exe
  C:\Windows\System\XFafftV.exe
  2⤵
  PID:10212
- C:\Windows\System\YkWaLlz.exe
  C:\Windows\System\YkWaLlz.exe
  2⤵
  PID:11192
- C:\Windows\System\mszXFhn.exe
  C:\Windows\System\mszXFhn.exe
  2⤵
  PID:5064
- C:\Windows\System\cHrWBmM.exe
  C:\Windows\System\cHrWBmM.exe
  2⤵
  PID:10396
- C:\Windows\System\PFBXmEY.exe
  C:\Windows\System\PFBXmEY.exe
  2⤵
  PID:10416
- C:\Windows\System\bxQCJRg.exe
  C:\Windows\System\bxQCJRg.exe
  2⤵
  PID:10512
- C:\Windows\System\GUgCPNe.exe
  C:\Windows\System\GUgCPNe.exe
  2⤵
  PID:10636
- C:\Windows\System\LithRFX.exe
  C:\Windows\System\LithRFX.exe
  2⤵
  PID:10804
- C:\Windows\System\nsVLupu.exe
  C:\Windows\System\nsVLupu.exe
  2⤵
  PID:10980
- C:\Windows\System\yIQeAHm.exe
  C:\Windows\System\yIQeAHm.exe
  2⤵
  PID:11164
- C:\Windows\System\jHvqPvy.exe
  C:\Windows\System\jHvqPvy.exe
  2⤵
  PID:1560
- C:\Windows\System\vdiruYu.exe
  C:\Windows\System\vdiruYu.exe
  2⤵
  PID:10384
- C:\Windows\System\LCaUNTw.exe
  C:\Windows\System\LCaUNTw.exe
  2⤵
  PID:10488
- C:\Windows\System\XBSdSHC.exe
  C:\Windows\System\XBSdSHC.exe
  2⤵
  PID:11188
- C:\Windows\System\gsZRzre.exe
  C:\Windows\System\gsZRzre.exe
  2⤵
  PID:11000
- C:\Windows\System\kluwdAA.exe
  C:\Windows\System\kluwdAA.exe
  2⤵
  PID:10592
- C:\Windows\System\voXftrO.exe
  C:\Windows\System\voXftrO.exe
  2⤵
  PID:11292
- C:\Windows\System\MOdqmdA.exe
  C:\Windows\System\MOdqmdA.exe
  2⤵
  PID:11348
- C:\Windows\System\fwBhZOZ.exe
  C:\Windows\System\fwBhZOZ.exe
  2⤵
  PID:11368
- C:\Windows\System\apzeRxx.exe
  C:\Windows\System\apzeRxx.exe
  2⤵
  PID:11388
- C:\Windows\System\NrBcglk.exe
  C:\Windows\System\NrBcglk.exe
  2⤵
  PID:11432
- C:\Windows\System\PNkKZUC.exe
  C:\Windows\System\PNkKZUC.exe
  2⤵
  PID:11468
- C:\Windows\System\jnSzKRr.exe
  C:\Windows\System\jnSzKRr.exe
  2⤵
  PID:11488
- C:\Windows\System\yAGDPid.exe
  C:\Windows\System\yAGDPid.exe
  2⤵
  PID:11516
- C:\Windows\System\PnkzYmY.exe
  C:\Windows\System\PnkzYmY.exe
  2⤵
  PID:11540
- C:\Windows\System\iIqiCWg.exe
  C:\Windows\System\iIqiCWg.exe
  2⤵
  PID:11576
- C:\Windows\System\QKBvMcU.exe
  C:\Windows\System\QKBvMcU.exe
  2⤵
  PID:11604
- C:\Windows\System\ijzETAm.exe
  C:\Windows\System\ijzETAm.exe
  2⤵
  PID:11636
- C:\Windows\System\ZuFVhfr.exe
  C:\Windows\System\ZuFVhfr.exe
  2⤵
  PID:11684
- C:\Windows\System\fsjUPFb.exe
  C:\Windows\System\fsjUPFb.exe
  2⤵
  PID:11716
- C:\Windows\System\rFmgHjG.exe
  C:\Windows\System\rFmgHjG.exe
  2⤵
  PID:11736
- C:\Windows\System\fbmtavy.exe
  C:\Windows\System\fbmtavy.exe
  2⤵
  PID:11764
- C:\Windows\System\vFYqiEe.exe
  C:\Windows\System\vFYqiEe.exe
  2⤵
  PID:11788
- C:\Windows\System\IiiThxw.exe
  C:\Windows\System\IiiThxw.exe
  2⤵
  PID:11804
- C:\Windows\System\lbFTrKJ.exe
  C:\Windows\System\lbFTrKJ.exe
  2⤵
  PID:11832
- C:\Windows\System\ypVbUYN.exe
  C:\Windows\System\ypVbUYN.exe
  2⤵
  PID:11848
- C:\Windows\System\GWYHJBS.exe
  C:\Windows\System\GWYHJBS.exe
  2⤵
  PID:11916
- C:\Windows\System\JCFSZcY.exe
  C:\Windows\System\JCFSZcY.exe
  2⤵
  PID:11944
- C:\Windows\System\HfBDxNH.exe
  C:\Windows\System\HfBDxNH.exe
  2⤵
  PID:11968
- C:\Windows\System\aVzoeww.exe
  C:\Windows\System\aVzoeww.exe
  2⤵
  PID:11996
- C:\Windows\System\NtjNbvG.exe
  C:\Windows\System\NtjNbvG.exe
  2⤵
  PID:12032
- C:\Windows\System\uJeyGxM.exe
  C:\Windows\System\uJeyGxM.exe
  2⤵
  PID:12064
- C:\Windows\System\vSmpSSe.exe
  C:\Windows\System\vSmpSSe.exe
  2⤵
  PID:12092
- C:\Windows\System\bpTipHK.exe
  C:\Windows\System\bpTipHK.exe
  2⤵
  PID:12128
- C:\Windows\System\CEsBrnM.exe
  C:\Windows\System\CEsBrnM.exe
  2⤵
  PID:12148
- C:\Windows\System\AZspygl.exe
  C:\Windows\System\AZspygl.exe
  2⤵
  PID:12172
- C:\Windows\System\jbTCrVx.exe
  C:\Windows\System\jbTCrVx.exe
  2⤵
  PID:12216
- C:\Windows\System\jDlqfNL.exe
  C:\Windows\System\jDlqfNL.exe
  2⤵
  PID:12232
- C:\Windows\System\mOTWIpw.exe
  C:\Windows\System\mOTWIpw.exe
  2⤵
  PID:12260
- C:\Windows\System\oUpbBxx.exe
  C:\Windows\System\oUpbBxx.exe
  2⤵
  PID:12280
- C:\Windows\System\aextDqL.exe
  C:\Windows\System\aextDqL.exe
  2⤵
  PID:10436
- C:\Windows\System\JiNUdtm.exe
  C:\Windows\System\JiNUdtm.exe
  2⤵
  PID:11308
- C:\Windows\System\zFPxrXU.exe
  C:\Windows\System\zFPxrXU.exe
  2⤵
  PID:11364
- C:\Windows\System\OewLonR.exe
  C:\Windows\System\OewLonR.exe
  2⤵
  PID:11444
- C:\Windows\System\qcFGQQm.exe
  C:\Windows\System\qcFGQQm.exe
  2⤵
  PID:11428
- C:\Windows\System\OuUbuNh.exe
  C:\Windows\System\OuUbuNh.exe
  2⤵
  PID:11476
- C:\Windows\System\QAHDOgg.exe
  C:\Windows\System\QAHDOgg.exe
  2⤵
  PID:11564
- C:\Windows\System\yWsjAuV.exe
  C:\Windows\System\yWsjAuV.exe
  2⤵
  PID:11732
- C:\Windows\System\CMYvDyU.exe
  C:\Windows\System\CMYvDyU.exe
  2⤵
  PID:11796
- C:\Windows\System\yKbpCPw.exe
  C:\Windows\System\yKbpCPw.exe
  2⤵
  PID:11816
- C:\Windows\System\sJKRjDe.exe
  C:\Windows\System\sJKRjDe.exe
  2⤵
  PID:11984
- C:\Windows\System\XpVyORi.exe
  C:\Windows\System\XpVyORi.exe
  2⤵
  PID:12028
- C:\Windows\System\dZbgmVf.exe
  C:\Windows\System\dZbgmVf.exe
  2⤵
  PID:12076
- C:\Windows\System\coVISPJ.exe
  C:\Windows\System\coVISPJ.exe
  2⤵
  PID:12120
- C:\Windows\System\YoEcseM.exe
  C:\Windows\System\YoEcseM.exe
  2⤵
  PID:12228
- C:\Windows\System\PYxWRoT.exe
  C:\Windows\System\PYxWRoT.exe
  2⤵
  PID:10828
- C:\Windows\System\MEAQSBY.exe
  C:\Windows\System\MEAQSBY.exe
  2⤵
  PID:11412
- C:\Windows\System\vGJsjzD.exe
  C:\Windows\System\vGJsjzD.exe
  2⤵
  PID:11384
- C:\Windows\System\yrkSvPu.exe
  C:\Windows\System\yrkSvPu.exe
  2⤵
  PID:11592
- C:\Windows\System\cjfrFaA.exe
  C:\Windows\System\cjfrFaA.exe
  2⤵
  PID:11668
- C:\Windows\System\xqjskAh.exe
  C:\Windows\System\xqjskAh.exe
  2⤵
  PID:11872
- C:\Windows\System\xQGrYYM.exe
  C:\Windows\System\xQGrYYM.exe
  2⤵
  PID:12012
- C:\Windows\System\ExadgMZ.exe
  C:\Windows\System\ExadgMZ.exe
  2⤵
  PID:12084
- C:\Windows\System\prqEUFX.exe
  C:\Windows\System\prqEUFX.exe
  2⤵
  PID:12244
- C:\Windows\System\RbvudTC.exe
  C:\Windows\System\RbvudTC.exe
  2⤵
  PID:11280
- C:\Windows\System\GsIrCGQ.exe
  C:\Windows\System\GsIrCGQ.exe
  2⤵
  PID:12016
- C:\Windows\System\omMIltF.exe
  C:\Windows\System\omMIltF.exe
  2⤵
  PID:12304
- C:\Windows\System\RRSoUni.exe
  C:\Windows\System\RRSoUni.exe
  2⤵
  PID:12336
- C:\Windows\System\oYIALtM.exe
  C:\Windows\System\oYIALtM.exe
  2⤵
  PID:12352
- C:\Windows\System\TMRyDBO.exe
  C:\Windows\System\TMRyDBO.exe
  2⤵
  PID:12380
- C:\Windows\System\IuyhNAF.exe
  C:\Windows\System\IuyhNAF.exe
  2⤵
  PID:12404
- C:\Windows\System\VIygdWJ.exe
  C:\Windows\System\VIygdWJ.exe
  2⤵
  PID:12436
- C:\Windows\System\GDWoBBt.exe
  C:\Windows\System\GDWoBBt.exe
  2⤵
  PID:12456
- C:\Windows\System\AfgeQGe.exe
  C:\Windows\System\AfgeQGe.exe
  2⤵
  PID:12488
- C:\Windows\System\LMvGCTh.exe
  C:\Windows\System\LMvGCTh.exe
  2⤵
  PID:12512
- C:\Windows\System\JZIFQwa.exe
  C:\Windows\System\JZIFQwa.exe
  2⤵
  PID:12540
- C:\Windows\System\IjXPnbj.exe
  C:\Windows\System\IjXPnbj.exe
  2⤵
  PID:12564
- C:\Windows\System\VwoOaky.exe
  C:\Windows\System\VwoOaky.exe
  2⤵
  PID:12592
- C:\Windows\System\zxdyUnF.exe
  C:\Windows\System\zxdyUnF.exe
  2⤵
  PID:12620
- C:\Windows\System\mcpXhSN.exe
  C:\Windows\System\mcpXhSN.exe
  2⤵
  PID:12644
- C:\Windows\System\zKTWWAx.exe
  C:\Windows\System\zKTWWAx.exe
  2⤵
  PID:12668
- C:\Windows\System\yONTJyH.exe
  C:\Windows\System\yONTJyH.exe
  2⤵
  PID:12700
- C:\Windows\System\IVpyJER.exe
  C:\Windows\System\IVpyJER.exe
  2⤵
  PID:12720
- C:\Windows\System\pOagXfG.exe
  C:\Windows\System\pOagXfG.exe
  2⤵
  PID:12768
- C:\Windows\System\jpoggAb.exe
  C:\Windows\System\jpoggAb.exe
  2⤵
  PID:12792
- C:\Windows\System\kRfWkow.exe
  C:\Windows\System\kRfWkow.exe
  2⤵
  PID:12812
- C:\Windows\System\XviZnFj.exe
  C:\Windows\System\XviZnFj.exe
  2⤵
  PID:12860
- C:\Windows\System\lkTHWqA.exe
  C:\Windows\System\lkTHWqA.exe
  2⤵
  PID:12876
- C:\Windows\System\KSxmQZW.exe
  C:\Windows\System\KSxmQZW.exe
  2⤵
  PID:12916
- C:\Windows\System\ZUEHeSW.exe
  C:\Windows\System\ZUEHeSW.exe
  2⤵
  PID:12944
- C:\Windows\System\JInVfJO.exe
  C:\Windows\System\JInVfJO.exe
  2⤵
  PID:12960
- C:\Windows\System\VijwlhN.exe
  C:\Windows\System\VijwlhN.exe
  2⤵
  PID:12984
- C:\Windows\System\YbiuKLT.exe
  C:\Windows\System\YbiuKLT.exe
  2⤵
  PID:13004
- C:\Windows\System\ImsjBvG.exe
  C:\Windows\System\ImsjBvG.exe
  2⤵
  PID:13028
- C:\Windows\System\nriOcwn.exe
  C:\Windows\System\nriOcwn.exe
  2⤵
  PID:13084
- C:\Windows\System\egQGTYT.exe
  C:\Windows\System\egQGTYT.exe
  2⤵
  PID:13124
- C:\Windows\System\vDRxjIV.exe
  C:\Windows\System\vDRxjIV.exe
  2⤵
  PID:13144
- C:\Windows\System\ZKsbggQ.exe
  C:\Windows\System\ZKsbggQ.exe
  2⤵
  PID:13168
- C:\Windows\System\UXcpyAh.exe
  C:\Windows\System\UXcpyAh.exe
  2⤵
  PID:13184
- C:\Windows\System\GSZYKtn.exe
  C:\Windows\System\GSZYKtn.exe
  2⤵
  PID:13236
- C:\Windows\System\ovivcbF.exe
  C:\Windows\System\ovivcbF.exe
  2⤵
  PID:13264
- C:\Windows\System\YPJAuEP.exe
  C:\Windows\System\YPJAuEP.exe
  2⤵
  PID:13292
- C:\Windows\System\WndWNJP.exe
  C:\Windows\System\WndWNJP.exe
  2⤵
  PID:13308
- C:\Windows\System\LMBNzVd.exe
  C:\Windows\System\LMBNzVd.exe
  2⤵
  PID:11956
- C:\Windows\System\cvShDkr.exe
  C:\Windows\System\cvShDkr.exe
  2⤵
  PID:12376
- C:\Windows\System\eUsbtHZ.exe
  C:\Windows\System\eUsbtHZ.exe
  2⤵
  PID:12420
- C:\Windows\System\dVlxmeC.exe
  C:\Windows\System\dVlxmeC.exe
  2⤵
  PID:12504
- C:\Windows\System\HZvrXPl.exe
  C:\Windows\System\HZvrXPl.exe
  2⤵
  PID:12556
- C:\Windows\System\hNYeBhm.exe
  C:\Windows\System\hNYeBhm.exe
  2⤵
  PID:12588
- C:\Windows\System\NhiABoK.exe
  C:\Windows\System\NhiABoK.exe
  2⤵
  PID:12680
- C:\Windows\System\tbehErD.exe
  C:\Windows\System\tbehErD.exe
  2⤵
  PID:12736
- C:\Windows\System\aubDRKo.exe
  C:\Windows\System\aubDRKo.exe
  2⤵
  PID:12800
- C:\Windows\System\fEAGHIv.exe
  C:\Windows\System\fEAGHIv.exe
  2⤵
  PID:12900
- C:\Windows\System\PvIVAYt.exe
  C:\Windows\System\PvIVAYt.exe
  2⤵
  PID:12932
- C:\Windows\System\JSJLHiw.exe
  C:\Windows\System\JSJLHiw.exe
  2⤵
  PID:13000
- C:\Windows\System\RvedYBX.exe
  C:\Windows\System\RvedYBX.exe
  2⤵
  PID:13052
- C:\Windows\System\hQxMRbR.exe
  C:\Windows\System\hQxMRbR.exe
  2⤵
  PID:13140
- C:\Windows\System\yDDkuth.exe
  C:\Windows\System\yDDkuth.exe
  2⤵
  PID:13180
- C:\Windows\System\XNNMyUZ.exe
  C:\Windows\System\XNNMyUZ.exe
  2⤵
  PID:13224
- C:\Windows\System\CzNzxwC.exe
  C:\Windows\System\CzNzxwC.exe
  2⤵
  PID:13280
- C:\Windows\System\kFPQfgS.exe
  C:\Windows\System\kFPQfgS.exe
  2⤵
  PID:12144
- C:\Windows\System\JMpbGqG.exe
  C:\Windows\System\JMpbGqG.exe
  2⤵
  PID:12424
- C:\Windows\System\ZhjjOYo.exe
  C:\Windows\System\ZhjjOYo.exe
  2⤵
  PID:12480
- C:\Windows\System\QeJPZXt.exe
  C:\Windows\System\QeJPZXt.exe
  2⤵
  PID:12744
- C:\Windows\System\AUHrXgY.exe
  C:\Windows\System\AUHrXgY.exe
  2⤵
  PID:12872
- C:\Windows\System\OwrTsva.exe
  C:\Windows\System\OwrTsva.exe
  2⤵
  PID:11868
- C:\Windows\System\eMvpDXk.exe
  C:\Windows\System\eMvpDXk.exe
  2⤵
  PID:12992
- C:\Windows\System\JisVCVg.exe
  C:\Windows\System\JisVCVg.exe
  2⤵
  PID:13196
- C:\Windows\System\ZFraPDD.exe
  C:\Windows\System\ZFraPDD.exe
  2⤵
  PID:12584
- C:\Windows\System\SPTccFe.exe
  C:\Windows\System\SPTccFe.exe
  2⤵
  PID:13208
- C:\Windows\System\EvoIgFG.exe
  C:\Windows\System\EvoIgFG.exe
  2⤵
  PID:12952
- C:\Windows\System\dyUKqPX.exe
  C:\Windows\System\dyUKqPX.exe
  2⤵
  PID:13328
- C:\Windows\System\NoHnWsO.exe
  C:\Windows\System\NoHnWsO.exe
  2⤵
  PID:13352
- C:\Windows\System\RVqHRFs.exe
  C:\Windows\System\RVqHRFs.exe
  2⤵
  PID:13368
- C:\Windows\System\cCUPWUp.exe
  C:\Windows\System\cCUPWUp.exe
  2⤵
  PID:13388
- C:\Windows\System\yBdGepE.exe
  C:\Windows\System\yBdGepE.exe
  2⤵
  PID:13416
- C:\Windows\System\fjvZNri.exe
  C:\Windows\System\fjvZNri.exe
  2⤵
  PID:13432
- C:\Windows\System\NtzjhYH.exe
  C:\Windows\System\NtzjhYH.exe
  2⤵
  PID:13472
- C:\Windows\System\tRxBDIs.exe
  C:\Windows\System\tRxBDIs.exe
  2⤵
  PID:13500
- C:\Windows\System\ZyTezcW.exe
  C:\Windows\System\ZyTezcW.exe
  2⤵
  PID:13528
- C:\Windows\System\tHdvzKz.exe
  C:\Windows\System\tHdvzKz.exe
  2⤵
  PID:13552
- C:\Windows\System\KqFcYmX.exe
  C:\Windows\System\KqFcYmX.exe
  2⤵
  PID:13568
- C:\Windows\System\RpivFEP.exe
  C:\Windows\System\RpivFEP.exe
  2⤵
  PID:13592
- C:\Windows\System\mcFNvHF.exe
  C:\Windows\System\mcFNvHF.exe
  2⤵
  PID:13660
- C:\Windows\System\BDEoUsC.exe
  C:\Windows\System\BDEoUsC.exe
  2⤵
  PID:13680
- C:\Windows\System\dosHyyr.exe
  C:\Windows\System\dosHyyr.exe
  2⤵
  PID:13704
- C:\Windows\System\jnnQAeT.exe
  C:\Windows\System\jnnQAeT.exe
  2⤵
  PID:13736
- C:\Windows\System\sBkunkJ.exe
  C:\Windows\System\sBkunkJ.exe
  2⤵
  PID:13756
- C:\Windows\System\zkbWcHq.exe
  C:\Windows\System\zkbWcHq.exe
  2⤵
  PID:13796
- C:\Windows\System\Pxmdtkz.exe
  C:\Windows\System\Pxmdtkz.exe
  2⤵
  PID:13832
- C:\Windows\System\ZjOyFGY.exe
  C:\Windows\System\ZjOyFGY.exe
  2⤵
  PID:13856
- C:\Windows\System\GqSlaeO.exe
  C:\Windows\System\GqSlaeO.exe
  2⤵
  PID:13880
- C:\Windows\System\ViBTVNg.exe
  C:\Windows\System\ViBTVNg.exe
  2⤵
  PID:13904
- C:\Windows\System\zTwATFf.exe
  C:\Windows\System\zTwATFf.exe
  2⤵
  PID:13948
- C:\Windows\System\QCnAUXF.exe
  C:\Windows\System\QCnAUXF.exe
  2⤵
  PID:13968
- C:\Windows\System\cgchdOy.exe
  C:\Windows\System\cgchdOy.exe
  2⤵
  PID:13988
- C:\Windows\System\BWNlYvd.exe
  C:\Windows\System\BWNlYvd.exe
  2⤵
  PID:14028
- C:\Windows\System\ToYghyd.exe
  C:\Windows\System\ToYghyd.exe
  2⤵
  PID:14048
- C:\Windows\System\nTsecJh.exe
  C:\Windows\System\nTsecJh.exe
  2⤵
  PID:14084
- C:\Windows\System\BXjqFEB.exe
  C:\Windows\System\BXjqFEB.exe
  2⤵
  PID:14100
- C:\Windows\System\EhGEjdZ.exe
  C:\Windows\System\EhGEjdZ.exe
  2⤵
  PID:14116
- C:\Windows\System\WWJLVyN.exe
  C:\Windows\System\WWJLVyN.exe
  2⤵
  PID:14148
- C:\Windows\System\TRuiLSp.exe
  C:\Windows\System\TRuiLSp.exe
  2⤵
  PID:14192
- C:\Windows\System\LdVVSLL.exe
  C:\Windows\System\LdVVSLL.exe
  2⤵
  PID:14220
- C:\Windows\System\cbvFYwA.exe
  C:\Windows\System\cbvFYwA.exe
  2⤵
  PID:14244
- C:\Windows\System\nJYkiac.exe
  C:\Windows\System\nJYkiac.exe
  2⤵
  PID:14268
- C:\Windows\System\NZKsZNU.exe
  C:\Windows\System\NZKsZNU.exe
  2⤵
  PID:14300
- C:\Windows\System\LciHvGc.exe
  C:\Windows\System\LciHvGc.exe
  2⤵
  PID:14324
- C:\Windows\System\AehIrTB.exe
  C:\Windows\System\AehIrTB.exe
  2⤵
  PID:13344
- C:\Windows\System\gZHSvuz.exe
  C:\Windows\System\gZHSvuz.exe
  2⤵
  PID:13396
- C:\Windows\System\vWkewLf.exe
  C:\Windows\System\vWkewLf.exe
  2⤵
  PID:13428
- C:\Windows\System\aZiOimK.exe
  C:\Windows\System\aZiOimK.exe
  2⤵
  PID:13540
- C:\Windows\System\kntCzTJ.exe
  C:\Windows\System\kntCzTJ.exe
  2⤵
  PID:13616
- C:\Windows\System\hyzPDlM.exe
  C:\Windows\System\hyzPDlM.exe
  2⤵
  PID:13676
- C:\Windows\System\EcEBvWk.exe
  C:\Windows\System\EcEBvWk.exe
  2⤵
  PID:13752
- C:\Windows\System\jivTTIJ.exe
  C:\Windows\System\jivTTIJ.exe
  2⤵
  PID:13788
- C:\Windows\System\yqfHXFf.exe
  C:\Windows\System\yqfHXFf.exe
  2⤵
  PID:13864
- C:\Windows\System\xDudLqx.exe
  C:\Windows\System\xDudLqx.exe
  2⤵
  PID:13872
- C:\Windows\System\qmRxJfB.exe
  C:\Windows\System\qmRxJfB.exe
  2⤵
  PID:1816
- C:\Windows\System\eDGTHYE.exe
  C:\Windows\System\eDGTHYE.exe
  2⤵
  PID:14068
- C:\Windows\System\JrZMerm.exe
  C:\Windows\System\JrZMerm.exe
  2⤵
  PID:14092
- C:\Windows\System\WIYmmzf.exe
  C:\Windows\System\WIYmmzf.exe
  2⤵
  PID:4912
- C:\Windows\System\pExeMtL.exe
  C:\Windows\System\pExeMtL.exe
  2⤵
  PID:14176
- C:\Windows\System\ZrmJwKI.exe
  C:\Windows\System\ZrmJwKI.exe
  2⤵
  PID:14232
- C:\Windows\System\WJaiUvd.exe
  C:\Windows\System\WJaiUvd.exe
  2⤵
  PID:14252
- C:\Windows\System\zrNqofE.exe
  C:\Windows\System\zrNqofE.exe
  2⤵
  PID:13424
- C:\Windows\System\UWYcwKl.exe
  C:\Windows\System\UWYcwKl.exe
  2⤵
  PID:13492
- C:\Windows\System\dbKKKoE.exe
  C:\Windows\System\dbKKKoE.exe
  2⤵
  PID:13588
- C:\Windows\System\zhoPYSm.exe
  C:\Windows\System\zhoPYSm.exe
  2⤵
  PID:13808
- C:\Windows\System\sBKBLyh.exe
  C:\Windows\System\sBKBLyh.exe
  2⤵
  PID:13896
- C:\Windows\System\LgSttuh.exe
  C:\Windows\System\LgSttuh.exe
  2⤵
  PID:4116
- C:\Windows\System\EhkYiiz.exe
  C:\Windows\System\EhkYiiz.exe
  2⤵
  PID:14156
- C:\Windows\System\PEeQGPh.exe
  C:\Windows\System\PEeQGPh.exe
  2⤵
  PID:14312
- C:\Windows\System\CVrFYSW.exe
  C:\Windows\System\CVrFYSW.exe
  2⤵
  PID:13480
- C:\Windows\System\hrQyYLm.exe
  C:\Windows\System\hrQyYLm.exe
  2⤵
  PID:13748
- C:\Windows\System\rhWmkmJ.exe
  C:\Windows\System\rhWmkmJ.exe
  2⤵
  PID:12808
- C:\Windows\System\CMEbeqv.exe
  C:\Windows\System\CMEbeqv.exe
  2⤵
  PID:14228
- C:\Windows\System\NrTKXZY.exe
  C:\Windows\System\NrTKXZY.exe
  2⤵
  PID:14344
- C:\Windows\System\ebFuvIm.exe
  C:\Windows\System\ebFuvIm.exe
  2⤵
  PID:14364
- C:\Windows\System\MrgRdtL.exe
  C:\Windows\System\MrgRdtL.exe
  2⤵
  PID:14388
- C:\Windows\System\GdGpJCs.exe
  C:\Windows\System\GdGpJCs.exe
  2⤵
  PID:14408
- C:\Windows\System\CCDcAwS.exe
  C:\Windows\System\CCDcAwS.exe
  2⤵
  PID:14436
- C:\Windows\System\ThBcmKv.exe
  C:\Windows\System\ThBcmKv.exe
  2⤵
  PID:14460
- C:\Windows\System\nuwKjLU.exe
  C:\Windows\System\nuwKjLU.exe
  2⤵
  PID:14480
- C:\Windows\System\miYwlrt.exe
  C:\Windows\System\miYwlrt.exe
  2⤵
  PID:14500
- C:\Windows\System\NiGQbIW.exe
  C:\Windows\System\NiGQbIW.exe
  2⤵
  PID:14556
- C:\Windows\System\FLJvCFa.exe
  C:\Windows\System\FLJvCFa.exe
  2⤵
  PID:14572
- C:\Windows\System\bYiAaik.exe
  C:\Windows\System\bYiAaik.exe
  2⤵
  PID:14588
- C:\Windows\System\BVppfPJ.exe
  C:\Windows\System\BVppfPJ.exe
  2⤵
  PID:14648
- C:\Windows\System\tjhXMUS.exe
  C:\Windows\System\tjhXMUS.exe
  2⤵
  PID:14680
- C:\Windows\System\axpShac.exe
  C:\Windows\System\axpShac.exe
  2⤵
  PID:14696
- C:\Windows\System\eOOMLld.exe
  C:\Windows\System\eOOMLld.exe
  2⤵
  PID:14740
- C:\Windows\System\bLDgaAV.exe
  C:\Windows\System\bLDgaAV.exe
  2⤵
  PID:14756
- C:\Windows\System\UvpDrsX.exe
  C:\Windows\System\UvpDrsX.exe
  2⤵
  PID:14784
- C:\Windows\System\BFetjbW.exe
  C:\Windows\System\BFetjbW.exe
  2⤵
  PID:14804
- C:\Windows\System\IjSffOv.exe
  C:\Windows\System\IjSffOv.exe
  2⤵
  PID:14848
- C:\Windows\System\rADrCoA.exe
  C:\Windows\System\rADrCoA.exe
  2⤵
  PID:14872
- C:\Windows\System\WlVeZXm.exe
  C:\Windows\System\WlVeZXm.exe
  2⤵
  PID:14916
- C:\Windows\System\LbgzymL.exe
  C:\Windows\System\LbgzymL.exe
  2⤵
  PID:14944
- C:\Windows\System\wcJVGKx.exe
  C:\Windows\System\wcJVGKx.exe
  2⤵
  PID:14964
- C:\Windows\System\utcVgEe.exe
  C:\Windows\System\utcVgEe.exe
  2⤵
  PID:14984
- C:\Windows\System\ZEcIIUt.exe
  C:\Windows\System\ZEcIIUt.exe
  2⤵
  PID:15020
- C:\Windows\System\QQeBths.exe
  C:\Windows\System\QQeBths.exe
  2⤵
  PID:15060
- C:\Windows\System\JtbrDWK.exe
  C:\Windows\System\JtbrDWK.exe
  2⤵
  PID:15088
- C:\Windows\System\PBiNPjV.exe
  C:\Windows\System\PBiNPjV.exe
  2⤵
  PID:15116
- C:\Windows\System\gTAFFqB.exe
  C:\Windows\System\gTAFFqB.exe
  2⤵
  PID:15136
- C:\Windows\System\qblsmbB.exe
  C:\Windows\System\qblsmbB.exe
  2⤵
  PID:15160
- C:\Windows\System\vJgxqsH.exe
  C:\Windows\System\vJgxqsH.exe
  2⤵
  PID:15188
- C:\Windows\System\ZvAztSP.exe
  C:\Windows\System\ZvAztSP.exe
  2⤵
  PID:15244
- C:\Windows\System\fcTamEr.exe
  C:\Windows\System\fcTamEr.exe
  2⤵
  PID:15260
- C:\Windows\System\KZzROFq.exe
  C:\Windows\System\KZzROFq.exe
  2⤵
  PID:15276
- C:\Windows\System\CbsSidq.exe
  C:\Windows\System\CbsSidq.exe
  2⤵
  PID:15292
- C:\Windows\System\OHENvYA.exe
  C:\Windows\System\OHENvYA.exe
  2⤵
  PID:15312
- C:\Windows\System\ZGISoyI.exe
  C:\Windows\System\ZGISoyI.exe
  2⤵
  PID:15336
- C:\Windows\System\ZmoDsOv.exe
  C:\Windows\System\ZmoDsOv.exe
  2⤵
  PID:15352
- C:\Windows\System\UDnLiNM.exe
  C:\Windows\System\UDnLiNM.exe
  2⤵
  PID:14352
- C:\Windows\System\vMPrAaT.exe
  C:\Windows\System\vMPrAaT.exe
  2⤵
  PID:14524
- C:\Windows\System\vlLcunU.exe
  C:\Windows\System\vlLcunU.exe
  2⤵
  PID:404
- C:\Windows\System\xCphxEd.exe
  C:\Windows\System\xCphxEd.exe
  2⤵
  PID:14688
- C:\Windows\System\UdVswMu.exe
  C:\Windows\System\UdVswMu.exe
  2⤵
  PID:14732
- C:\Windows\System\HVyTEqo.exe
  C:\Windows\System\HVyTEqo.exe
  2⤵
  PID:14768
- C:\Windows\System\DXJlNWc.exe
  C:\Windows\System\DXJlNWc.exe
  2⤵
  PID:14812
- C:\Windows\System\WqrIJGa.exe
  C:\Windows\System\WqrIJGa.exe
  2⤵
  PID:14904
- C:\Windows\System\QwNglPH.exe
  C:\Windows\System\QwNglPH.exe
  2⤵
  PID:14992
- C:\Windows\System\BiqspUv.exe
  C:\Windows\System\BiqspUv.exe
  2⤵
  PID:15044
- C:\Windows\System\piwkypp.exe
  C:\Windows\System\piwkypp.exe
  2⤵
  PID:15124
- C:\Windows\System\MpUfqlW.exe
  C:\Windows\System\MpUfqlW.exe
  2⤵
  PID:15228
- C:\Windows\System\VylLMKB.exe
  C:\Windows\System\VylLMKB.exe
  2⤵
  PID:15220
- C:\Windows\System\rukUiCp.exe
  C:\Windows\System\rukUiCp.exe
  2⤵
  PID:15268
- C:\Windows\System\GNvWYpl.exe
  C:\Windows\System\GNvWYpl.exe
  2⤵
  PID:15348
- C:\Windows\System\jTBGLnN.exe
  C:\Windows\System\jTBGLnN.exe
  2⤵
  PID:14432
- C:\Windows\System\tdOfqwP.exe
  C:\Windows\System\tdOfqwP.exe
  2⤵
  PID:2796
- C:\Windows\System\ymKvUSP.exe
  C:\Windows\System\ymKvUSP.exe
  2⤵
  PID:14716
- C:\Windows\System\RIZDvsK.exe
  C:\Windows\System\RIZDvsK.exe
  2⤵
  PID:14956
- C:\Windows\System\WSFbYcj.exe
  C:\Windows\System\WSFbYcj.exe
  2⤵
  PID:14456
- C:\Windows\System\UTpnopy.exe
  C:\Windows\System\UTpnopy.exe
  2⤵
  PID:15324
- C:\Windows\System\IxgZMmV.exe
  C:\Windows\System\IxgZMmV.exe
  2⤵
  PID:14372
- C:\Windows\System\hbEzCBW.exe
  C:\Windows\System\hbEzCBW.exe
  2⤵
  PID:14728
- C:\Windows\System\SmuguuZ.exe
  C:\Windows\System\SmuguuZ.exe
  2⤵
  PID:15172
- C:\Windows\System\PGjZLox.exe
  C:\Windows\System\PGjZLox.exe
  2⤵
  PID:15056
- C:\Windows\System\jwKAVYX.exe
  C:\Windows\System\jwKAVYX.exe
  2⤵
  PID:14864
- C:\Windows\System\jHrEVlN.exe
  C:\Windows\System\jHrEVlN.exe
  2⤵
  PID:15364
- C:\Windows\System\lSpZEPg.exe
  C:\Windows\System\lSpZEPg.exe
  2⤵
  PID:15392
- C:\Windows\System\REtEeDp.exe
  C:\Windows\System\REtEeDp.exe
  2⤵
  PID:15420
- C:\Windows\System\bItIljY.exe
  C:\Windows\System\bItIljY.exe
  2⤵
  PID:15468
- C:\Windows\System\MqcOWpx.exe
  C:\Windows\System\MqcOWpx.exe
  2⤵
  PID:15488
- C:\Windows\System\JJSkvtM.exe
  C:\Windows\System\JJSkvtM.exe
  2⤵
  PID:15516
- C:\Windows\System\PqxZGiu.exe
  C:\Windows\System\PqxZGiu.exe
  2⤵
  PID:15560
- C:\Windows\System\jYUJhhH.exe
  C:\Windows\System\jYUJhhH.exe
  2⤵
  PID:15576
- C:\Windows\System\bXpzuZm.exe
  C:\Windows\System\bXpzuZm.exe
  2⤵
  PID:15596
- C:\Windows\System\cOUiapy.exe
  C:\Windows\System\cOUiapy.exe
  2⤵
  PID:15632
- C:\Windows\System\wvgzMir.exe
  C:\Windows\System\wvgzMir.exe
  2⤵
  PID:15648
- C:\Windows\System\LyFoFyI.exe
  C:\Windows\System\LyFoFyI.exe
  2⤵
  PID:15672
- C:\Windows\System\Vdaotbp.exe
  C:\Windows\System\Vdaotbp.exe
  2⤵
  PID:15692
- C:\Windows\System\kDtlwwz.exe
  C:\Windows\System\kDtlwwz.exe
  2⤵
  PID:15720
- C:\Windows\System\aEuDfKb.exe
  C:\Windows\System\aEuDfKb.exe
  2⤵
  PID:15756
- C:\Windows\System\vZcLSqf.exe
  C:\Windows\System\vZcLSqf.exe
  2⤵
  PID:15784
- C:\Windows\System\kuWMVnx.exe
  C:\Windows\System\kuWMVnx.exe
  2⤵
  PID:15812
- C:\Windows\System\osxfRLa.exe
  C:\Windows\System\osxfRLa.exe
  2⤵
  PID:15860
- C:\Windows\System\VYnljpI.exe
  C:\Windows\System\VYnljpI.exe
  2⤵
  PID:15876
- C:\Windows\System\OYkxTCA.exe
  C:\Windows\System\OYkxTCA.exe
  2⤵
  PID:15900
- C:\Windows\System\kCUAKyl.exe
  C:\Windows\System\kCUAKyl.exe
  2⤵
  PID:15956
- C:\Windows\System\KQuXqvh.exe
  C:\Windows\System\KQuXqvh.exe
  2⤵
  PID:15984
- C:\Windows\System\fNlPSOx.exe
  C:\Windows\System\fNlPSOx.exe
  2⤵
  PID:16012
- C:\Windows\System\gQpiLqv.exe
  C:\Windows\System\gQpiLqv.exe
  2⤵
  PID:16032
- C:\Windows\System\JCWKQyy.exe
  C:\Windows\System\JCWKQyy.exe
  2⤵
  PID:16056
- C:\Windows\System\QiGKaaw.exe
  C:\Windows\System\QiGKaaw.exe
  2⤵
  PID:16096
- C:\Windows\System\pvIYCmi.exe
  C:\Windows\System\pvIYCmi.exe
  2⤵
  PID:16124
- C:\Windows\System\JDaBUDr.exe
  C:\Windows\System\JDaBUDr.exe
  2⤵
  PID:16144
- C:\Windows\System\CXIHKrJ.exe
  C:\Windows\System\CXIHKrJ.exe
  2⤵
  PID:16168
- C:\Windows\System\tdpekdU.exe
  C:\Windows\System\tdpekdU.exe
  2⤵
  PID:16184
- C:\Windows\System\IyGTKEh.exe
  C:\Windows\System\IyGTKEh.exe
  2⤵
  PID:16212
- C:\Windows\System\aSzSJNY.exe
  C:\Windows\System\aSzSJNY.exe
  2⤵
  PID:16236
- C:\Windows\System\OgcPutW.exe
  C:\Windows\System\OgcPutW.exe
  2⤵
  PID:16272
- C:\Windows\System\xnKdrYg.exe
  C:\Windows\System\xnKdrYg.exe
  2⤵
  PID:16300
- C:\Windows\System\muTOuSD.exe
  C:\Windows\System\muTOuSD.exe
  2⤵
  PID:16320
- C:\Windows\System\qZvlgGU.exe
  C:\Windows\System\qZvlgGU.exe
  2⤵
  PID:16348
- C:\Windows\System\LDFiSlh.exe
  C:\Windows\System\LDFiSlh.exe
  2⤵
  PID:16368
- C:\Windows\System\nKKhWPa.exe
  C:\Windows\System\nKKhWPa.exe
  2⤵
  PID:15300
- C:\Windows\System\bDsTBwP.exe
  C:\Windows\System\bDsTBwP.exe
  2⤵
  PID:15416
- C:\Windows\System\CcZpsDk.exe
  C:\Windows\System\CcZpsDk.exe
  2⤵
  PID:15568
- C:\Windows\System\AtGltAU.exe
  C:\Windows\System\AtGltAU.exe
  2⤵
  PID:15616
- C:\Windows\System\leJDAqg.exe
  C:\Windows\System\leJDAqg.exe
  2⤵
  PID:15684
- C:\Windows\System\MIfuTBu.exe
  C:\Windows\System\MIfuTBu.exe
  2⤵
  PID:15776
- C:\Windows\System\mWPKMjO.exe
  C:\Windows\System\mWPKMjO.exe
  2⤵
  PID:15808
- C:\Windows\System\sPlyVIO.exe
  C:\Windows\System\sPlyVIO.exe
  2⤵
  PID:15872
- C:\Windows\System\UFZfPTB.exe
  C:\Windows\System\UFZfPTB.exe
  2⤵
  PID:15928
- C:\Windows\System\hQfzXpI.exe
  C:\Windows\System\hQfzXpI.exe
  2⤵
  PID:16004
- C:\Windows\System\tIblGYS.exe
  C:\Windows\System\tIblGYS.exe
  2⤵
  PID:16076
- C:\Windows\System\VKvraiJ.exe
  C:\Windows\System\VKvraiJ.exe
  2⤵
  PID:16088
- C:\Windows\System\FvPSEFy.exe
  C:\Windows\System\FvPSEFy.exe
  2⤵
  PID:16132
- C:\Windows\System\UlMCXTR.exe
  C:\Windows\System\UlMCXTR.exe
  2⤵
  PID:3360
- C:\Windows\System\egJPnNK.exe
  C:\Windows\System\egJPnNK.exe
  2⤵
  PID:16268
- C:\Windows\System\piGPhhZ.exe
  C:\Windows\System\piGPhhZ.exe
  2⤵
  PID:1140
- C:\Windows\System\qMgURcY.exe
  C:\Windows\System\qMgURcY.exe
  2⤵
  PID:16344
- C:\Windows\System\rhNKnPn.exe
  C:\Windows\System\rhNKnPn.exe
  2⤵
  PID:15372
- C:\Windows\System\SqtwqET.exe
  C:\Windows\System\SqtwqET.exe
  2⤵
  PID:15512
- C:\Windows\System\AlzPXOI.exe
  C:\Windows\System\AlzPXOI.exe
  2⤵
  PID:15604
- C:\Windows\System\nBrbXui.exe
  C:\Windows\System\nBrbXui.exe
  2⤵
  PID:15744
- C:\Windows\System\opvLEtc.exe
  C:\Windows\System\opvLEtc.exe
  2⤵
  PID:16048
- C:\Windows\System\DbVoHoh.exe
  C:\Windows\System\DbVoHoh.exe
  2⤵
  PID:16204
- C:\Windows\System\xVeBzJh.exe
  C:\Windows\System\xVeBzJh.exe
  2⤵
  PID:16296
- C:\Windows\System\fyISDPo.exe
  C:\Windows\System\fyISDPo.exe
  2⤵
  PID:16380
- C:\Windows\System\JBfXNrh.exe
  C:\Windows\System\JBfXNrh.exe
  2⤵
  PID:15668
- C:\Windows\System\svpBVpi.exe
  C:\Windows\System\svpBVpi.exe
  2⤵
  PID:15896
- C:\Windows\System\noOEDsb.exe
  C:\Windows\System\noOEDsb.exe
  2⤵
  PID:15436
- C:\Windows\System\PSEOtzn.exe
  C:\Windows\System\PSEOtzn.exe
  2⤵
  PID:16400
- C:\Windows\System\PwXgNSG.exe
  C:\Windows\System\PwXgNSG.exe
  2⤵
  PID:16428
- C:\Windows\System\mBaJelQ.exe
  C:\Windows\System\mBaJelQ.exe
  2⤵
  PID:16444
- C:\Windows\System\ijLVBtz.exe
  C:\Windows\System\ijLVBtz.exe
  2⤵
  PID:16460
- C:\Windows\System\jYcYWCt.exe
  C:\Windows\System\jYcYWCt.exe
  2⤵
  PID:16508
- C:\Windows\System\KltmuYS.exe
  C:\Windows\System\KltmuYS.exe
  2⤵
  PID:16528
- C:\Windows\System\ZfSTItY.exe
  C:\Windows\System\ZfSTItY.exe
  2⤵
  PID:16548
- C:\Windows\System\GKgJgGT.exe
  C:\Windows\System\GKgJgGT.exe
  2⤵
  PID:16572
- C:\Windows\System\InyTDcn.exe
  C:\Windows\System\InyTDcn.exe
  2⤵
  PID:16600
- C:\Windows\System\hxXnYok.exe
  C:\Windows\System\hxXnYok.exe
  2⤵
  PID:16636
- C:\Windows\System\DvgawBB.exe
  C:\Windows\System\DvgawBB.exe
  2⤵
  PID:16692
- C:\Windows\System\ReNlQXn.exe
  C:\Windows\System\ReNlQXn.exe
  2⤵
  PID:16712
- C:\Windows\System\swmBtDG.exe
  C:\Windows\System\swmBtDG.exe
  2⤵
  PID:16748
- C:\Windows\System\vcWKYuW.exe
  C:\Windows\System\vcWKYuW.exe
  2⤵
  PID:16776
- C:\Windows\System\nrvGdGo.exe
  C:\Windows\System\nrvGdGo.exe
  2⤵
  PID:16796
- C:\Windows\System\xHLjHWb.exe
  C:\Windows\System\xHLjHWb.exe
  2⤵
  PID:16832
- C:\Windows\System\YBLYHzC.exe
  C:\Windows\System\YBLYHzC.exe
  2⤵
  PID:16856
- C:\Windows\System\TgZtRws.exe
  C:\Windows\System\TgZtRws.exe
  2⤵
  PID:16876
- C:\Windows\System\EhVKhlu.exe
  C:\Windows\System\EhVKhlu.exe
  2⤵
  PID:16912
- C:\Windows\System\bwDnliX.exe
  C:\Windows\System\bwDnliX.exe
  2⤵
  PID:16928
- C:\Windows\System\ucqQRui.exe
  C:\Windows\System\ucqQRui.exe
  2⤵
  PID:16948
- C:\Windows\System\QQYITVG.exe
  C:\Windows\System\QQYITVG.exe
  2⤵
  PID:16980
- C:\Windows\System\FCmvoju.exe
  C:\Windows\System\FCmvoju.exe
  2⤵
  PID:17024
- C:\Windows\System\DBnQQkw.exe
  C:\Windows\System\DBnQQkw.exe
  2⤵
  PID:17040
- C:\Windows\System\OHVqztu.exe
  C:\Windows\System\OHVqztu.exe
  2⤵
  PID:17060
- C:\Windows\System\ZdXGXLy.exe
  C:\Windows\System\ZdXGXLy.exe
  2⤵
  PID:17080
- C:\Windows\System\FmIwloD.exe
  C:\Windows\System\FmIwloD.exe
  2⤵
  PID:17096
- C:\Windows\System\catRdaP.exe
  C:\Windows\System\catRdaP.exe
  2⤵
  PID:17128
- C:\Windows\System\sSOxIsF.exe
  C:\Windows\System\sSOxIsF.exe
  2⤵
  PID:17144
- C:\Windows\System\fGYgLoQ.exe
  C:\Windows\System\fGYgLoQ.exe
  2⤵
  PID:17172
- C:\Windows\System\wBGSLDJ.exe
  C:\Windows\System\wBGSLDJ.exe
  2⤵
  PID:17196
- C:\Windows\System\fPdbWGz.exe
  C:\Windows\System\fPdbWGz.exe
  2⤵
  PID:17220
- C:\Windows\System\BqxyBrq.exe
  C:\Windows\System\BqxyBrq.exe
  2⤵
  PID:17372
- C:\Windows\System\VnsFvAO.exe
  C:\Windows\System\VnsFvAO.exe
  2⤵
  PID:17392
- C:\Windows\System\eOkCiXe.exe
  C:\Windows\System\eOkCiXe.exe
  2⤵
  PID:16176

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DUhNemy.exe

Path C:\Windows\System\DUhNemy.exe
Size 1.2MB
SHA256 78022168b4e378bc1378ab8bc886a1813d000bf2908c28fb66aebf157e22920c
MD5 4c2c92e3547b03c7d5f9361df9ffadb5
SHA1 0015cfd8d6ecb6d56086823738bfeba553819936
SHA512 7e895f613087d85a9ff031ab1decafb096e8decbd632e03a822e90d83b4a96a788ac5b437f71f233f5019dab97cf90e6dcc63fbbb4eb4abf638e8daab6a8f476
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxT:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVD
MD5 SHA1 SHA512 SSDEEP

Submit Download

DvnzeQK.exe

Path C:\Windows\System\DvnzeQK.exe
Size 1.2MB
SHA256 b9f7a89dba75cfd5a5beb12cd9ab9924db133b8e63d061df6f5f89b2337fbc3f
MD5 8bb37cf599eb09632ff0a531a3d94b24
SHA1 25aa817fcf5b981a1426751487e73017812e01bc
SHA512 46f7028be336ad74d0ffa983904a444272d74e90a53bcadab39afde295f76df0350fb284041090fd188c31cc4e8620b47744f2f33945afb21eccb21ac459ed3b
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxh:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

DwDPORW.exe

Path C:\Windows\System\DwDPORW.exe
Size 1.2MB
SHA256 e270c71c76aaf7c478cd1cb2ed2a7fcf1c3eca363694bc9d274e083bd2347ab8
MD5 fccc5c605cd520e53f265e48d346d29b
SHA1 9f27512cfdb2db07364fcbc6197e05b44e61cdad
SHA512 5fad14bd96efbdc2c4cb14cbdee85bbfc0da89a2410988b6f5cf08604feb52749cfb4d1ed1a48a103f0830d44e9e05381e5fd762cb4bd5fc52c1efdd266349ff
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxf:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVv
MD5 SHA1 SHA512 SSDEEP

Submit Download

EvcXylg.exe

Path C:\Windows\System\EvcXylg.exe
Size 1.2MB
SHA256 9dc1566b9c3269a6837a28630a8a7f59f2b73d541356ee245e6f61b909550364
MD5 4c2dfc536e39d9af1168ba66ee476186
SHA1 ca7a56ff7b303daf1b57d2b38ad2d1d560b3275f
SHA512 cc56ef9386ee950cd9b5cc878df6de619a91203e386fa56a9d3eb1963c1d55b1b7139d018b40459fcf632258d9ddd299e048bef4626f70a881a9fb3fc5d043f0
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxa:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVK
MD5 SHA1 SHA512 SSDEEP

Submit Download

GrupnEG.exe

Path C:\Windows\System\GrupnEG.exe
Size 1.2MB
SHA256 6b3bd1838914651ee9b7439e6f9ca9716d75fceed1f77e6d67da8b5864b419fc
MD5 1fb6c913526d6966421cbc6d58dfbad3
SHA1 9d08e6123cd9ae74000b57de3d8ae26d34898e7a
SHA512 6675f1d083d3e588e6db62e7ab1ecdca5b270cf60e4078d7bce67c838f9329214a1d5b15f569ccb033197969fc0475c8dc967712d7b4169253f637b91bc9e1c7
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxT:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVD
MD5 SHA1 SHA512 SSDEEP

Submit Download

HztTSkb.exe

Path C:\Windows\System\HztTSkb.exe
Size 1.2MB
SHA256 67de67febb93b00e9345408bd724f34435dc8b580874b0ab0cfa1cb31b3d4d4b
MD5 34a2b69ca73fb2465c6fbc66c13c3c22
SHA1 4a95b3b38afc00d8793aa7d67769409806890b47
SHA512 4e9d2533ff3922e4e72e441e25bdc7e799bfd5f2f37a88f29896a6c6f3fb26244273e1ff643f8e2ce77107465749abd0ce89b264377f8663df41f48bec9f0abe
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUx8:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVs
MD5 SHA1 SHA512 SSDEEP

Submit Download

IInjNjq.exe

Path C:\Windows\System\IInjNjq.exe
Size 1.2MB
SHA256 6441272070791924f8252212024240c1871080a218e070f33a13f5fc1cc584de
MD5 a60298ec06d38471ecdb6689f04ed26f
SHA1 03c4f0fc0ff6c0d8e9ad21021da1f7f347c956e5
SHA512 a2b976d316d00b48c00a4909c8d2058e9bc5467b0623191b5d5d19460d2d38a8f4297fe4c049a7be291a204532b5ddbc188131898bfe1d3a03e9f11626250720
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxB:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

IpDxGBZ.exe

Path C:\Windows\System\IpDxGBZ.exe
Size 1.2MB
SHA256 62c40d4f8f3bbfa58f6a20e379b57a9391c72cfcd45452f07ceca98f6c9e6a75
MD5 34a9825aa9502d93e81c371bd44a26ef
SHA1 cd662a614e6f05b523f2de6df5df96434dd96e1d
SHA512 893e15ee4398eb86f573620f2380027003fe4c003da3912be79ce3efc984d7e6a6f483f42a5f641b55eaaa44fcf58606a00290b2ff96f89ed9e1d8d5fac1c564
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxJ:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

JVefdOl.exe

Path C:\Windows\System\JVefdOl.exe
Size 1.2MB
SHA256 0871c6dfab85936feffae69822e272eb8b759faf79b393d6d0fcefbc5f1d2d14
MD5 9ca416c5522805a4fabe91c5a23ead59
SHA1 e8408d4b2ad77c0788ea2bafb82845221e6dc1a8
SHA512 cd778d6033c96ed545304f17ef0a0737ca55e0011908eea11be94a510daee6a0b698257cfd73fb64f708f1d613b2b0ce556fdde70e5c39b70439b673b71d344e
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxs:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV8
MD5 SHA1 SHA512 SSDEEP

Submit Download

JyHFRyK.exe

Path C:\Windows\System\JyHFRyK.exe
Size 1.2MB
SHA256 b49e071da3c8857ab854d6c5167f9fa8a8458299aa4f913bde0a0c3f7eaa2a26
MD5 fbf5c2b82e7d0b9a60241d46f0aeda94
SHA1 f32c9c572d5bc4c30fa9e2bb060871767fe0c020
SHA512 f5d5d919b6cdb8ebdd86679d624587ff72ab5f4e786d03409809c2009731fc23207e9cd65eb4c6443434702f6e908fd61b02deb585f3032b32f8ee56c4f3a3e3
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxT:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVD
MD5 SHA1 SHA512 SSDEEP

Submit Download

KFUMbXS.exe

Path C:\Windows\System\KFUMbXS.exe
Size 1.2MB
SHA256 4ef65bdcc3b2837635af54b2b7ffca789b73a0a269346f53703d3e8f7c9c0683
MD5 27c98ce85a5d4e438c5b44de059d5077
SHA1 59747012e9231f83d3edd4e780ab3d8e5fcec74f
SHA512 c8c560b0ea69bf6f3322dac9041dd2674c8f1b42bae6e3ecc0441d879f26ad4b6ef799fd8f7e65a5b556c3214cb360fa009f04634dc28574ac0a66543e7743de
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxp:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MJXbHrw.exe

Path C:\Windows\System\MJXbHrw.exe
Size 1.2MB
SHA256 e719fcadb9ef0456771f7b4d103d42ed732dcd0f0e711f853fcb6ef50908f11d
MD5 0aa19a57ed2aa56fe210309d1fefc27b
SHA1 3f7e8f3874bd703633b9a2b4c947a7d4303e319f
SHA512 c1fb31e24126f52b2c684c9bdf52e2037818cb9edb20eefce98c5b0d0e9f3535240331afeba41b9624b6ea354d23e9b3bb51c32d788cd9d3c110c18e3c0f8f87
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxx:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVh
MD5 SHA1 SHA512 SSDEEP

Submit Download

MQRhCGW.exe

Path C:\Windows\System\MQRhCGW.exe
Size 1.2MB
SHA256 a58e12656c90815a991123c227222dcbd39af365d8139bbb87b6426e7c8b6f21
MD5 2455303c95ed69bea9f3ba5607d9ba10
SHA1 605b09f282a212b0e4e6402a8152c778bc71b0da
SHA512 f761b49302eddb19dfc367c781704ff144f9d2750c2742b0384b8582201d63f694f62682ee0db03e98a27e2245e8c3c86535eddad4a71a69cdc4b801b81ff65f
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxd:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVN
MD5 SHA1 SHA512 SSDEEP

Submit Download

MRQFhKP.exe

Path C:\Windows\System\MRQFhKP.exe
Size 1.2MB
SHA256 2a2fada3849614b1e3ca9f70d3c0716cb2b9decda87d7f3362451f45ec27ae4e
MD5 507e9f325d2f725e11b545e63d6c86e0
SHA1 8218f36366884c0b52baa95e6f539dd70513aee3
SHA512 15b8c450aeaafc73f18154cb5d81c7c4926a0c8fdaf56f2e0ddc7f6ad25226fc6306862b032beaf1757d69bca38fcfa22e0c05818b960e3ab26daf1e0342b306
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUx/:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVP
MD5 SHA1 SHA512 SSDEEP

Submit Download

NMwcGJN.exe

Path C:\Windows\System\NMwcGJN.exe
Size 1.2MB
SHA256 f50605297e1e52067c3ed007cf55e41fa89b6a6c61ba5585e5ee4999a6932d4e
MD5 7c519c8cac173aaf99c22e6ed2a938a4
SHA1 24bcafc33b6c7b55f03bb5249578aafaaabdc9a2
SHA512 4b04156b484b39a2084e5353ffded887bd633bdc338631b80032aad24ecca464755cad28f57a855ab0747ab53b2b9763ef14aebf5d6783ca18b2b948f7a38908
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxQ:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVg
MD5 SHA1 SHA512 SSDEEP

Submit Download

OyPwhZj.exe

Path C:\Windows\System\OyPwhZj.exe
Size 1.2MB
SHA256 f7d4fe8e5ba6ee35aab9017621f71956953d6329dd476f40b1d8d527d1fd57c8
MD5 6faa183a905c87077393d0ad189f4e80
SHA1 96ba48172940817f5f14b4c3ca448c66b33cacbd
SHA512 05c4101d1a70eee2bcafc79995b476fe1649198bf09387a26eee4ecfc1e86a40f294201bad8586b56da3402c093ec41a9b72fb32549ed90aca3a139d420998a4
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxj:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVz
MD5 SHA1 SHA512 SSDEEP

Submit Download

SEBCudI.exe

Path C:\Windows\System\SEBCudI.exe
Size 1.2MB
SHA256 ae7828e41578553c65aac99436e477d6abf203f8d438511593e8bb1f9973f534
MD5 8ff9a991d505d2df8fbcda406e50a26a
SHA1 dd4c17b194797ee4d91287d6bb264170a5e4ec03
SHA512 e3bbb6aeab5489203ea9045b7bef3f7278a8edc741678d9f46475ae5600d93b0115d2a75864177cb4115d1114284372cd0a882dbae72d79e004994a0e62a80b9
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxb:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVr
MD5 SHA1 SHA512 SSDEEP

Submit Download

TxOmAcJ.exe

Path C:\Windows\System\TxOmAcJ.exe
Size 1.2MB
SHA256 eee299863b9e52d679c59d3d2260bb846305c88ad6f58d31f3eac0a9ccbf4185
MD5 b3ebfdb7ddee694a19348ae9dc6063e2
SHA1 ff92a2e284940702b2b6e814a8cb7c62ffb02611
SHA512 498d0cec243ad782b886bd98450eb9a4a60eff0ff0175d67d7217a466adaa800729cbbdbc1b47fc9402edbf7eb9f58149c13cf28037c0fb9ac3aa1e0e80b5ec2
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxs:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV8
MD5 SHA1 SHA512 SSDEEP

Submit Download

XsuWzZJ.exe

Path C:\Windows\System\XsuWzZJ.exe
Size 1.2MB
SHA256 0b92117022148b0ba7980e901e7b027ce44a49ba929aa3288fc3253489535496
MD5 1ef2dc9fe4fdcfc75799828197593c98
SHA1 b7394ee2c87925897195969d8ced802bb54eeadd
SHA512 e72079dc8b85f83dd8f7928a9cdf9d04ec86147d1261702ba005beb889ed67e086b845764759e7c78dd842e42a5d10951a07b4c87de6db27d217de128e847d36
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxU:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVk
MD5 SHA1 SHA512 SSDEEP

Submit Download

YaQhqWy.exe

Path C:\Windows\System\YaQhqWy.exe
Size 1.2MB
SHA256 357586950198594503fc91908e96f5f0dff4dd1e1d1bebbbfcfdf7115e4c4e51
MD5 c9c3705b55f6907031139679a3d91a3f
SHA1 3e13b49be6e75b9aa1f9cf54f53452f2038bceb3
SHA512 f8bff0c6050ba3fdb72ad1b70917a2ce92f83046c56df04822425436d81817c920428a57cdb0bd40bd1a273d17c2c6f1099f2f9495ed693b2c0ad3db6a49fa19
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxx:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZHxyvDS.exe

Path C:\Windows\System\ZHxyvDS.exe
Size 1.2MB
SHA256 9c206c841a5bd232955939eb59ceea033302cece0abc9c88ff16f74168c4df70
MD5 cf52ed293b07e34034f900a8d635ee18
SHA1 c3f0a7e033071fa2ecb18cfb75aaec424da0c25a
SHA512 2dee303d30716b12ccafdc728b0129bd741c9b5b3e0bee3d5f48ed34c1fabf563432858bae3d00b5f8ae3c45b0090db80eabdc1d33b6bba6ddd03433b1fb3d50
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxJ:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZSTLuAy.exe

Path C:\Windows\System\ZSTLuAy.exe
Size 1.2MB
SHA256 14cc000a7cf1aabeb1d18397311f9c971ba23867f4b15e76b34df544858d6fa8
MD5 6b83962a207af02b6db7045250f0f38b
SHA1 9759095a5d91393ae8143f5a6af8a32c60ccfeb9
SHA512 bb25ac3aaa634583cbd8cfdbfe760dcaf9108d6bfd472dc9f050f90ccd78c484909effe0e7d30b2d2a15504e9174f6ad5b9b2545a58e94cc92dbae5cfe515c1c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxm:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZhgoHlN.exe

Path C:\Windows\System\ZhgoHlN.exe
Size 1.2MB
SHA256 4be874966b349a9cece2ee817bb025399a3698e246021a57fe065fccea30dbe5
MD5 abfbfc31445f321f10e024d47ce42899
SHA1 5b7e933886a4ec867801b06a9759f6bb203a3da3
SHA512 cd1eddda29d4edf58d31850505228b97e3b2a9202f13c66f3cc4940a1fafbeabd20b40f4bb2a09523ffb5bf775ed191574c03ae4300388a7357210a4a6d4a28c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxq:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV6
MD5 SHA1 SHA512 SSDEEP

Submit Download

eZuJKOk.exe

Path C:\Windows\System\eZuJKOk.exe
Size 1.2MB
SHA256 858ac790243b218933ff7d1c52a5b9ebc783d5e5ac40e27eaa78c80c61aa81fe
MD5 54dd61fa2c756c0b94a0ecda83e0c745
SHA1 98875fecc61f8fe15ec568f7ab940194677040fc
SHA512 a29c2e74eb9989f24a19fa6f191c7cb782c8520c9e584bbdec6b6bc99e5ce6dd74ba7a6988a12d4e7b17d18092fb96ad50b845f3caafad4ad5dff4837c67aa38
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxs:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV8
MD5 SHA1 SHA512 SSDEEP

Submit Download

gFZmbjk.exe

Path C:\Windows\System\gFZmbjk.exe
Size 1.2MB
SHA256 16d14e726f37b7ec3baf5807a22c4f11001b3b944992f051b9d65d9baface663
MD5 b0b1c7f9ba65fac489c80d4d72f7404b
SHA1 38f42a912e9a1fbf567de5dcad79cb96abfeb94d
SHA512 115c4d6a20f3d4b08f1ec8cb3c01bc93dc519cbec589cea6541f6ff5bf9b033db6979960c84fc29688cb87163279d26f0b8a62c3d23939e3f48fe1968f8f9008
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxN:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV9
MD5 SHA1 SHA512 SSDEEP

Submit Download

hnbCoPr.exe

Path C:\Windows\System\hnbCoPr.exe
Size 1.2MB
SHA256 5574b98cade2df90f911af8dfef4726af90255ccd3ed61ecfe885afe2d937321
MD5 5cafbda6ec0501c12f10756462691c44
SHA1 71b211e4ef4d83c44eea5a9eb3e7e19e63204ec6
SHA512 726c68493b7cea61649f4d1917ffe120cc4f9c667342c36cd8c770e52426e80381b629a204c6583ff0a7a54e5a12c1f7ffb386ff45840adfff34991880c8d05b
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxn:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVX
MD5 SHA1 SHA512 SSDEEP

Submit Download

igaEaec.exe

Path C:\Windows\System\igaEaec.exe
Size 1.2MB
SHA256 9791dbb5eba4d7d7b605265f27921c798e462799889143f68c2b5142423ceeab
MD5 f0886d42546f8e1b4b9bd7af24602339
SHA1 d14bc932337770d3bf9293769c840151ec175e6d
SHA512 eb1950819748d72f0f7fdb2bd32daad8fdf5ecb18b98afc24559d909629a7155c13e1f7218f5a29cf5bb55394b56ac4221306741c5c10fa77de9a25599985ee8
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxh:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

nveSJHp.exe

Path C:\Windows\System\nveSJHp.exe
Size 1.2MB
SHA256 18d163a9ec02fc192943bd4d19c18ca76679e637706c47b865e87ad893029afc
MD5 1d5ccea9d6a4f2f5624271154991e6bd
SHA1 4317a79ce5fa0c02b86511c1051e03b81f03c290
SHA512 0ad65195e9b0aac73d365821f762deb568af32523478f3b7f5830df932533b38ac88d3b7d0e7d7888873dea22757c3c102b4955333789116cee116d2ede83c0e
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxN:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVd
MD5 SHA1 SHA512 SSDEEP

Submit Download

qLzXXjO.exe

Path C:\Windows\System\qLzXXjO.exe
Size 1.2MB
SHA256 0d28bf07ccd1008c62db471075f87637a07272dfef2d860e13394b4372ab82a0
MD5 c64cfaf52846a84479d204bb64036f8e
SHA1 66397d1ca6c950dc2d04be278d58496c8b91e454
SHA512 c7bf7c66e7078bd405eb12857ce5c6cf5f24f395add90206c194c9d3d02cb89921b3ae8a1c1c6d0df12f07882a1fc4c6079da2e3dfb5461f2f29e429366f203d
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxL:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVb
MD5 SHA1 SHA512 SSDEEP

Submit Download

uSmvVmV.exe

Path C:\Windows\System\uSmvVmV.exe
Size 1.2MB
SHA256 78db1d8fcb7b9ed54944fc775ab3456b07338e468e5dc9b1cf210a1af3cf927e
MD5 b02dd7eedca674a2108acb6d3256d0e1
SHA1 30dfe464a89528bea95f795e1288b6cd89e5fad1
SHA512 b84c4e15c0a0c8ebca826bcb63332cec00b4b697b724f13c7d938724c52d43614cb527b279c0867c687c4baacf3aca1bbcefc71f178f0c406f405810411b8491
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxL:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVb
MD5 SHA1 SHA512 SSDEEP

Submit Download

vZNtOJr.exe

Path C:\Windows\System\vZNtOJr.exe
Size 1.2MB
SHA256 e52127bf26def755e2cdfeaafeef010ca71e3b4dc9d06cc28aee0778cd29accc
MD5 6bc13d0bcce306d42445a711867e2e10
SHA1 8aecfca8196a7593eecaccf849dfccd28cab6e37
SHA512 740cfa1c1380b148f141cc001309b9ded3b3e2f71a7b611d25d033214e211d943ebe2cd8e18f6a0fd8594b81a101bbeed6838211c47aa083be099208682b6dda
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxy:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVC
MD5 SHA1 SHA512 SSDEEP

Submit Download

xXwAYrD.exe

Path C:\Windows\System\xXwAYrD.exe
Size 1.2MB
SHA256 930343db08962883b7ba9d30c45878be86e5dcee33b0083cb66246599da66d68
MD5 2f31aff9e744f3c85e2396c90acffb9b
SHA1 121513e96f8afdcf56861d530bd5d4b296ead9e8
SHA512 0d2e1a1e28c8bdfb0e942b9a3ff474d013f5c5ef062e0a3755594e107ba96babbc4606b95e043fd629d924d6c1adb230cc6ce28f1e1d4f3c2c644f3f91384ceb
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxS:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVi
MD5 SHA1 SHA512 SSDEEP

Submit Download

yyuzxRi.exe

Path C:\Windows\System\yyuzxRi.exe
Size 1.2MB
SHA256 08931a30e74065e30b69a554c165b13a00115b1e3b15ba521d2756af7e5c9b4d
MD5 e3f82623dac2df14a73f160bc084d133
SHA1 8aebe7b63c98df4e4e44064be97114564cb68b7f
SHA512 7dbd4e0944a415f0ed4a4cc6802864ccb90bfb1ac4bb62b4a7a8102ec3947451e6abfdd2fdceb28f6be17ef42ab034614af7deceb72eaf923daf59fec4f28d08
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUx4:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2100-0-0x000001CAB4050000-0x000001CAB4060000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads