xmrig | 0e1758a194aaf79b8ca662e3311d75e328ad35421d3251ce28bcb9a7d0c8797e

Analysis

max time kernel
121s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
Size 1.3MB
Sample240526-sc54vabb69
SHA256 0e1758a194aaf79b8ca662e3311d75e328ad35421d3251ce28bcb9a7d0c8797e
MD5 0b944ae81f2b4d6b47daa9b91734f370
SHA1 da67bc65dece9dcc74a9d540e857559cadf29bb1
SHA512 2723c87b7445459934ed0eba13ea0c257de598216c9b6e25d10f08d4d75b6db2501cc7df001e4af80abcfe3c1b1f1d26aa0abeb00d8971a13b690945ce877f0f
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUt:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023423-4.dat	xmrig
behavioral2/files/0x0008000000023427-15.dat	xmrig
behavioral2/files/0x000700000002342b-12.dat	xmrig
behavioral2/files/0x000700000002342c-20.dat	xmrig
behavioral2/files/0x000700000002342d-24.dat	xmrig
behavioral2/files/0x000700000002342f-31.dat	xmrig
behavioral2/files/0x0007000000023434-59.dat	xmrig
behavioral2/files/0x0007000000023436-67.dat	xmrig
behavioral2/files/0x0007000000023441-122.dat	xmrig
behavioral2/files/0x0007000000023447-152.dat	xmrig
behavioral2/files/0x0007000000023449-162.dat	xmrig
behavioral2/files/0x0007000000023448-157.dat	xmrig
behavioral2/files/0x0007000000023446-155.dat	xmrig
behavioral2/files/0x0007000000023445-150.dat	xmrig
behavioral2/files/0x0007000000023444-145.dat	xmrig
behavioral2/files/0x0007000000023443-140.dat	xmrig
behavioral2/files/0x0007000000023442-135.dat	xmrig
behavioral2/files/0x0007000000023440-125.dat	xmrig
behavioral2/files/0x000700000002343f-120.dat	xmrig
behavioral2/files/0x000700000002343e-115.dat	xmrig
behavioral2/files/0x000700000002343d-110.dat	xmrig
behavioral2/files/0x000700000002343c-105.dat	xmrig
behavioral2/files/0x000700000002343b-100.dat	xmrig
behavioral2/files/0x000700000002343a-95.dat	xmrig
behavioral2/files/0x0007000000023439-90.dat	xmrig
behavioral2/files/0x0007000000023438-85.dat	xmrig
behavioral2/files/0x0007000000023437-80.dat	xmrig
behavioral2/files/0x0007000000023435-70.dat	xmrig
behavioral2/files/0x0007000000023433-55.dat	xmrig
behavioral2/files/0x0007000000023432-50.dat	xmrig
behavioral2/files/0x0007000000023431-48.dat	xmrig
behavioral2/files/0x0007000000023430-43.dat	xmrig
behavioral2/files/0x000700000002342e-34.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1820	pptaofn.exe
3064	ZwvHyhU.exe
2312	OkLWggR.exe
3716	QFPCcDi.exe
1228	vlJNWNt.exe
3036	hUnsNsc.exe
4900	qaQNGQa.exe
3648	WFyMbqe.exe
1372	xOjrQKI.exe
4572	wOGgvyB.exe
3872	DceTsBt.exe
4792	yjqoayN.exe
1972	BiJeNGo.exe
980	htNFBeg.exe
3376	CVCwjWQ.exe
4184	oDTHgLk.exe
936	yYEfsaT.exe
4332	BqFeItx.exe
3524	Pmakqpp.exe
3896	RSxRmrf.exe
4720	YDuEETq.exe
5080	vkiOreb.exe
4068	FbeqQJZ.exe
2512	yobIPsE.exe
712	cwMKDhr.exe
1792	BQYZCcs.exe
2056	DVRSmUh.exe
816	vcnrPly.exe
1220	wnNLpfw.exe
1700	YdWJqOn.exe
1868	EvIzIMA.exe
896	AxvdwQq.exe
1620	pFpQvbZ.exe
4116	JtLrLET.exe
3580	jUPiwQn.exe
1688	oQrNeoU.exe
436	pjhPfxc.exe
4656	TIGEhxN.exe
4708	XjMuwyE.exe
4060	qbWwlff.exe
1768	bMlYyGv.exe
3916	RnLdsZb.exe
4700	fRpqlNC.exe
4648	gFBMsvK.exe
536	XaEUzxP.exe
2420	rGQgvXE.exe
3216	WOCuSLh.exe
3696	mOWIfdi.exe
116	TJKwUOq.exe
5056	TmqnCQT.exe
2556	KDktBRv.exe
3368	fmstDJY.exe
3184	yvhvBxC.exe
4468	acVyFwa.exe
4488	mtsylHS.exe
1440	xOnRvkF.exe
1740	gddFUfv.exe
2492	ffaqFpt.exe
2396	tMBcpmV.exe
4764	DhNivZd.exe
5016	IWBdkdD.exe
4908	SDzUknn.exe
2104	RwXLtQK.exe
2768	hLgDSgV.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FMQDJwN.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\mCvzUyH.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\XOrAbbF.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\hpTqZXs.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\UriVYdF.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\ObOhNst.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\TJKwUOq.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\KOHhldc.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\mBMWKUj.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\ssriMAA.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\SDzUknn.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\DbiztHO.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\RiPweyh.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\ECRHuIN.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\fLajzko.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\gtnQxaV.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\BqFeItx.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\yuFXiLy.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\gLeyRVq.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\pRIzxYq.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\PYskkol.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\bMlYyGv.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\xbeGssN.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\RbJTgtp.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\Wutrinq.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\EsjHzTQ.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\FrtQCLl.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\THgrSuf.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\bPNxSfq.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\ErEmBLr.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\vyJpTOy.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\YUcKesd.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\XFPCdpq.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\JRwOxDi.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\FHkzPWI.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\asxLuDK.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\BbpXMwH.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\GCRaNAK.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\pKQxifJ.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\JQbIYRM.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\YcxmVRd.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\kgAESdn.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\uWTNYwY.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\mKTrdeC.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\PyFSwbg.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\pwRmGtC.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\pcPyAKo.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\hAPGOxP.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\YkZWSvE.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\dtGIkBX.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\bDwtcli.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\ytjxBKg.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\iDLNQdM.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\BgHgckx.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\buEJyig.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\wKAwgch.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\alXSegX.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\gDTAVtQ.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\bZiCLVD.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\IASRKVb.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\IPERTZl.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\ycVvqts.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\PnVKLmY.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
File created	C:\Windows\System\wCJQDJg.exe	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16996	dwm.exe
Token: SeChangeNotifyPrivilege	16996	dwm.exe
Token: 33	16996	dwm.exe
Token: SeIncBasePriorityPrivilege	16996	dwm.exe
Token: SeShutdownPrivilege	16996	dwm.exe
Token: SeCreatePagefilePrivilege	16996	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 1820	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	83
PID 4832 wrote to memory of 1820	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	83
PID 4832 wrote to memory of 3064	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	84
PID 4832 wrote to memory of 3064	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	84
PID 4832 wrote to memory of 2312	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	85
PID 4832 wrote to memory of 2312	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	85
PID 4832 wrote to memory of 3716	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	86
PID 4832 wrote to memory of 3716	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	86
PID 4832 wrote to memory of 1228	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	87
PID 4832 wrote to memory of 1228	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	87
PID 4832 wrote to memory of 3036	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	88
PID 4832 wrote to memory of 3036	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	88
PID 4832 wrote to memory of 4900	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	89
PID 4832 wrote to memory of 4900	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	89
PID 4832 wrote to memory of 3648	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	90
PID 4832 wrote to memory of 3648	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	90
PID 4832 wrote to memory of 1372	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	91
PID 4832 wrote to memory of 1372	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	91
PID 4832 wrote to memory of 4572	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	92
PID 4832 wrote to memory of 4572	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	92
PID 4832 wrote to memory of 3872	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	93
PID 4832 wrote to memory of 3872	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	93
PID 4832 wrote to memory of 4792	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	94
PID 4832 wrote to memory of 4792	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	94
PID 4832 wrote to memory of 1972	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	95
PID 4832 wrote to memory of 1972	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	95
PID 4832 wrote to memory of 980	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	96
PID 4832 wrote to memory of 980	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	96
PID 4832 wrote to memory of 3376	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	97
PID 4832 wrote to memory of 3376	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	97
PID 4832 wrote to memory of 4184	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	98
PID 4832 wrote to memory of 4184	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	98
PID 4832 wrote to memory of 936	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	99
PID 4832 wrote to memory of 936	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	99
PID 4832 wrote to memory of 4332	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	100
PID 4832 wrote to memory of 4332	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	100
PID 4832 wrote to memory of 3524	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	101
PID 4832 wrote to memory of 3524	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	101
PID 4832 wrote to memory of 3896	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	102
PID 4832 wrote to memory of 3896	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	102
PID 4832 wrote to memory of 4720	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	103
PID 4832 wrote to memory of 4720	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	103
PID 4832 wrote to memory of 5080	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	104
PID 4832 wrote to memory of 5080	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	104
PID 4832 wrote to memory of 4068	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	105
PID 4832 wrote to memory of 4068	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	105
PID 4832 wrote to memory of 2512	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	106
PID 4832 wrote to memory of 2512	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	106
PID 4832 wrote to memory of 712	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	107
PID 4832 wrote to memory of 712	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	107
PID 4832 wrote to memory of 1792	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	108
PID 4832 wrote to memory of 1792	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	108
PID 4832 wrote to memory of 2056	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	109
PID 4832 wrote to memory of 2056	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	109
PID 4832 wrote to memory of 816	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	110
PID 4832 wrote to memory of 816	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	110
PID 4832 wrote to memory of 1220	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	111
PID 4832 wrote to memory of 1220	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	111
PID 4832 wrote to memory of 1700	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	112
PID 4832 wrote to memory of 1700	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	112
PID 4832 wrote to memory of 1868	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	113
PID 4832 wrote to memory of 1868	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	113
PID 4832 wrote to memory of 896	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	114
PID 4832 wrote to memory of 896	4832	0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0b944ae81f2b4d6b47daa9b91734f370_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\System\pptaofn.exe
  C:\Windows\System\pptaofn.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\ZwvHyhU.exe
  C:\Windows\System\ZwvHyhU.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\OkLWggR.exe
  C:\Windows\System\OkLWggR.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\QFPCcDi.exe
  C:\Windows\System\QFPCcDi.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\vlJNWNt.exe
  C:\Windows\System\vlJNWNt.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\hUnsNsc.exe
  C:\Windows\System\hUnsNsc.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\qaQNGQa.exe
  C:\Windows\System\qaQNGQa.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\WFyMbqe.exe
  C:\Windows\System\WFyMbqe.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\xOjrQKI.exe
  C:\Windows\System\xOjrQKI.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\wOGgvyB.exe
  C:\Windows\System\wOGgvyB.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\DceTsBt.exe
  C:\Windows\System\DceTsBt.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\yjqoayN.exe
  C:\Windows\System\yjqoayN.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\BiJeNGo.exe
  C:\Windows\System\BiJeNGo.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\htNFBeg.exe
  C:\Windows\System\htNFBeg.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\CVCwjWQ.exe
  C:\Windows\System\CVCwjWQ.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\oDTHgLk.exe
  C:\Windows\System\oDTHgLk.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\yYEfsaT.exe
  C:\Windows\System\yYEfsaT.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\BqFeItx.exe
  C:\Windows\System\BqFeItx.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\Pmakqpp.exe
  C:\Windows\System\Pmakqpp.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\RSxRmrf.exe
  C:\Windows\System\RSxRmrf.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\YDuEETq.exe
  C:\Windows\System\YDuEETq.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\vkiOreb.exe
  C:\Windows\System\vkiOreb.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\FbeqQJZ.exe
  C:\Windows\System\FbeqQJZ.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\yobIPsE.exe
  C:\Windows\System\yobIPsE.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\cwMKDhr.exe
  C:\Windows\System\cwMKDhr.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\BQYZCcs.exe
  C:\Windows\System\BQYZCcs.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\DVRSmUh.exe
  C:\Windows\System\DVRSmUh.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\vcnrPly.exe
  C:\Windows\System\vcnrPly.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\wnNLpfw.exe
  C:\Windows\System\wnNLpfw.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\YdWJqOn.exe
  C:\Windows\System\YdWJqOn.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\EvIzIMA.exe
  C:\Windows\System\EvIzIMA.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\AxvdwQq.exe
  C:\Windows\System\AxvdwQq.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\pFpQvbZ.exe
  C:\Windows\System\pFpQvbZ.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\JtLrLET.exe
  C:\Windows\System\JtLrLET.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\jUPiwQn.exe
  C:\Windows\System\jUPiwQn.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\oQrNeoU.exe
  C:\Windows\System\oQrNeoU.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\pjhPfxc.exe
  C:\Windows\System\pjhPfxc.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\TIGEhxN.exe
  C:\Windows\System\TIGEhxN.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\XjMuwyE.exe
  C:\Windows\System\XjMuwyE.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\qbWwlff.exe
  C:\Windows\System\qbWwlff.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\bMlYyGv.exe
  C:\Windows\System\bMlYyGv.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\RnLdsZb.exe
  C:\Windows\System\RnLdsZb.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\fRpqlNC.exe
  C:\Windows\System\fRpqlNC.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\gFBMsvK.exe
  C:\Windows\System\gFBMsvK.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\XaEUzxP.exe
  C:\Windows\System\XaEUzxP.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\rGQgvXE.exe
  C:\Windows\System\rGQgvXE.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\WOCuSLh.exe
  C:\Windows\System\WOCuSLh.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\mOWIfdi.exe
  C:\Windows\System\mOWIfdi.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\TJKwUOq.exe
  C:\Windows\System\TJKwUOq.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\TmqnCQT.exe
  C:\Windows\System\TmqnCQT.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\KDktBRv.exe
  C:\Windows\System\KDktBRv.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\fmstDJY.exe
  C:\Windows\System\fmstDJY.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\yvhvBxC.exe
  C:\Windows\System\yvhvBxC.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\acVyFwa.exe
  C:\Windows\System\acVyFwa.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\mtsylHS.exe
  C:\Windows\System\mtsylHS.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\xOnRvkF.exe
  C:\Windows\System\xOnRvkF.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\gddFUfv.exe
  C:\Windows\System\gddFUfv.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\ffaqFpt.exe
  C:\Windows\System\ffaqFpt.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\tMBcpmV.exe
  C:\Windows\System\tMBcpmV.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\DhNivZd.exe
  C:\Windows\System\DhNivZd.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\IWBdkdD.exe
  C:\Windows\System\IWBdkdD.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\SDzUknn.exe
  C:\Windows\System\SDzUknn.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\RwXLtQK.exe
  C:\Windows\System\RwXLtQK.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\hLgDSgV.exe
  C:\Windows\System\hLgDSgV.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\BjbTtAX.exe
  C:\Windows\System\BjbTtAX.exe
  2⤵
  PID:2432
- C:\Windows\System\NWKhsvi.exe
  C:\Windows\System\NWKhsvi.exe
  2⤵
  PID:1068
- C:\Windows\System\DBeUGjo.exe
  C:\Windows\System\DBeUGjo.exe
  2⤵
  PID:4740
- C:\Windows\System\IslQMJp.exe
  C:\Windows\System\IslQMJp.exe
  2⤵
  PID:3336
- C:\Windows\System\rHXUoTh.exe
  C:\Windows\System\rHXUoTh.exe
  2⤵
  PID:956
- C:\Windows\System\hORkZfe.exe
  C:\Windows\System\hORkZfe.exe
  2⤵
  PID:4228
- C:\Windows\System\OgFVUUc.exe
  C:\Windows\System\OgFVUUc.exe
  2⤵
  PID:3384
- C:\Windows\System\tLqhqJn.exe
  C:\Windows\System\tLqhqJn.exe
  2⤵
  PID:4008
- C:\Windows\System\mBLWGTS.exe
  C:\Windows\System\mBLWGTS.exe
  2⤵
  PID:4860
- C:\Windows\System\KJASiMd.exe
  C:\Windows\System\KJASiMd.exe
  2⤵
  PID:964
- C:\Windows\System\bRunZil.exe
  C:\Windows\System\bRunZil.exe
  2⤵
  PID:2652
- C:\Windows\System\VfifpwJ.exe
  C:\Windows\System\VfifpwJ.exe
  2⤵
  PID:1672
- C:\Windows\System\mKTrdeC.exe
  C:\Windows\System\mKTrdeC.exe
  2⤵
  PID:3652
- C:\Windows\System\pSfTWhU.exe
  C:\Windows\System\pSfTWhU.exe
  2⤵
  PID:3172
- C:\Windows\System\kWidfRj.exe
  C:\Windows\System\kWidfRj.exe
  2⤵
  PID:5000
- C:\Windows\System\UfhhMXt.exe
  C:\Windows\System\UfhhMXt.exe
  2⤵
  PID:368
- C:\Windows\System\SsqAOQe.exe
  C:\Windows\System\SsqAOQe.exe
  2⤵
  PID:3516
- C:\Windows\System\zxIYHLo.exe
  C:\Windows\System\zxIYHLo.exe
  2⤵
  PID:468
- C:\Windows\System\LmcLvuK.exe
  C:\Windows\System\LmcLvuK.exe
  2⤵
  PID:2036
- C:\Windows\System\HiYmVJB.exe
  C:\Windows\System\HiYmVJB.exe
  2⤵
  PID:4692
- C:\Windows\System\wtDJPYD.exe
  C:\Windows\System\wtDJPYD.exe
  2⤵
  PID:4156
- C:\Windows\System\vMcbcTi.exe
  C:\Windows\System\vMcbcTi.exe
  2⤵
  PID:3488
- C:\Windows\System\edYILfU.exe
  C:\Windows\System\edYILfU.exe
  2⤵
  PID:2248
- C:\Windows\System\fwSIHaN.exe
  C:\Windows\System\fwSIHaN.exe
  2⤵
  PID:5124
- C:\Windows\System\bfsrkNi.exe
  C:\Windows\System\bfsrkNi.exe
  2⤵
  PID:5152
- C:\Windows\System\oRDswnh.exe
  C:\Windows\System\oRDswnh.exe
  2⤵
  PID:5180
- C:\Windows\System\tcSPdTX.exe
  C:\Windows\System\tcSPdTX.exe
  2⤵
  PID:5204
- C:\Windows\System\LQPhoRb.exe
  C:\Windows\System\LQPhoRb.exe
  2⤵
  PID:5236
- C:\Windows\System\aEyoKDT.exe
  C:\Windows\System\aEyoKDT.exe
  2⤵
  PID:5304
- C:\Windows\System\patpoLY.exe
  C:\Windows\System\patpoLY.exe
  2⤵
  PID:5320
- C:\Windows\System\fPYUKQf.exe
  C:\Windows\System\fPYUKQf.exe
  2⤵
  PID:5336
- C:\Windows\System\Ulcagav.exe
  C:\Windows\System\Ulcagav.exe
  2⤵
  PID:5360
- C:\Windows\System\IGFFwhf.exe
  C:\Windows\System\IGFFwhf.exe
  2⤵
  PID:5380
- C:\Windows\System\FMQDJwN.exe
  C:\Windows\System\FMQDJwN.exe
  2⤵
  PID:5408
- C:\Windows\System\wCJQDJg.exe
  C:\Windows\System\wCJQDJg.exe
  2⤵
  PID:5432
- C:\Windows\System\fDCrCXp.exe
  C:\Windows\System\fDCrCXp.exe
  2⤵
  PID:5460
- C:\Windows\System\rznVIei.exe
  C:\Windows\System\rznVIei.exe
  2⤵
  PID:5488
- C:\Windows\System\VlSRASW.exe
  C:\Windows\System\VlSRASW.exe
  2⤵
  PID:5516
- C:\Windows\System\XyckzxK.exe
  C:\Windows\System\XyckzxK.exe
  2⤵
  PID:5544
- C:\Windows\System\RZrCpno.exe
  C:\Windows\System\RZrCpno.exe
  2⤵
  PID:5572
- C:\Windows\System\RAwJvKy.exe
  C:\Windows\System\RAwJvKy.exe
  2⤵
  PID:5600
- C:\Windows\System\YkZWSvE.exe
  C:\Windows\System\YkZWSvE.exe
  2⤵
  PID:5628
- C:\Windows\System\RQxqZCU.exe
  C:\Windows\System\RQxqZCU.exe
  2⤵
  PID:5656
- C:\Windows\System\nrQSRka.exe
  C:\Windows\System\nrQSRka.exe
  2⤵
  PID:5692
- C:\Windows\System\lrUZQuZ.exe
  C:\Windows\System\lrUZQuZ.exe
  2⤵
  PID:5716
- C:\Windows\System\XpJwFgs.exe
  C:\Windows\System\XpJwFgs.exe
  2⤵
  PID:5744
- C:\Windows\System\kyPijiu.exe
  C:\Windows\System\kyPijiu.exe
  2⤵
  PID:5776
- C:\Windows\System\QZoRicV.exe
  C:\Windows\System\QZoRicV.exe
  2⤵
  PID:5804
- C:\Windows\System\eQiuyhk.exe
  C:\Windows\System\eQiuyhk.exe
  2⤵
  PID:5828
- C:\Windows\System\QmzGWzm.exe
  C:\Windows\System\QmzGWzm.exe
  2⤵
  PID:5856
- C:\Windows\System\mwchrXP.exe
  C:\Windows\System\mwchrXP.exe
  2⤵
  PID:5884
- C:\Windows\System\tqNaaLv.exe
  C:\Windows\System\tqNaaLv.exe
  2⤵
  PID:5912
- C:\Windows\System\HTKvySU.exe
  C:\Windows\System\HTKvySU.exe
  2⤵
  PID:5940
- C:\Windows\System\FvsfhBu.exe
  C:\Windows\System\FvsfhBu.exe
  2⤵
  PID:5968
- C:\Windows\System\nsFbqUC.exe
  C:\Windows\System\nsFbqUC.exe
  2⤵
  PID:5992
- C:\Windows\System\saNCkUR.exe
  C:\Windows\System\saNCkUR.exe
  2⤵
  PID:6032
- C:\Windows\System\fhwYayL.exe
  C:\Windows\System\fhwYayL.exe
  2⤵
  PID:6052
- C:\Windows\System\sLSLujb.exe
  C:\Windows\System\sLSLujb.exe
  2⤵
  PID:6100
- C:\Windows\System\JlCEzkN.exe
  C:\Windows\System\JlCEzkN.exe
  2⤵
  PID:4144
- C:\Windows\System\bPNxSfq.exe
  C:\Windows\System\bPNxSfq.exe
  2⤵
  PID:1108
- C:\Windows\System\SVAnruN.exe
  C:\Windows\System\SVAnruN.exe
  2⤵
  PID:4108
- C:\Windows\System\PyFSwbg.exe
  C:\Windows\System\PyFSwbg.exe
  2⤵
  PID:4748
- C:\Windows\System\nXAZqUn.exe
  C:\Windows\System\nXAZqUn.exe
  2⤵
  PID:4752
- C:\Windows\System\yWiyVeT.exe
  C:\Windows\System\yWiyVeT.exe
  2⤵
  PID:5144
- C:\Windows\System\ubdHmeD.exe
  C:\Windows\System\ubdHmeD.exe
  2⤵
  PID:5228
- C:\Windows\System\ZeNSPsM.exe
  C:\Windows\System\ZeNSPsM.exe
  2⤵
  PID:5312
- C:\Windows\System\gDTAVtQ.exe
  C:\Windows\System\gDTAVtQ.exe
  2⤵
  PID:5348
- C:\Windows\System\xbeGssN.exe
  C:\Windows\System\xbeGssN.exe
  2⤵
  PID:5372
- C:\Windows\System\KmpQQMh.exe
  C:\Windows\System\KmpQQMh.exe
  2⤵
  PID:5400
- C:\Windows\System\OmCpQwA.exe
  C:\Windows\System\OmCpQwA.exe
  2⤵
  PID:5448
- C:\Windows\System\zxladZi.exe
  C:\Windows\System\zxladZi.exe
  2⤵
  PID:5484
- C:\Windows\System\IqOsqGa.exe
  C:\Windows\System\IqOsqGa.exe
  2⤵
  PID:5540
- C:\Windows\System\gyhxEeR.exe
  C:\Windows\System\gyhxEeR.exe
  2⤵
  PID:5596
- C:\Windows\System\bZiCLVD.exe
  C:\Windows\System\bZiCLVD.exe
  2⤵
  PID:5652
- C:\Windows\System\ebfmAPh.exe
  C:\Windows\System\ebfmAPh.exe
  2⤵
  PID:5708
- C:\Windows\System\tPwvUnp.exe
  C:\Windows\System\tPwvUnp.exe
  2⤵
  PID:5896
- C:\Windows\System\bIMmLBH.exe
  C:\Windows\System\bIMmLBH.exe
  2⤵
  PID:4892
- C:\Windows\System\KOHhldc.exe
  C:\Windows\System\KOHhldc.exe
  2⤵
  PID:5984
- C:\Windows\System\ZydWYBu.exe
  C:\Windows\System\ZydWYBu.exe
  2⤵
  PID:2648
- C:\Windows\System\YIPpxqx.exe
  C:\Windows\System\YIPpxqx.exe
  2⤵
  PID:6028
- C:\Windows\System\PcLiTYS.exe
  C:\Windows\System\PcLiTYS.exe
  2⤵
  PID:6120
- C:\Windows\System\wKAwgch.exe
  C:\Windows\System\wKAwgch.exe
  2⤵
  PID:6136
- C:\Windows\System\nnigqVO.exe
  C:\Windows\System\nnigqVO.exe
  2⤵
  PID:1060
- C:\Windows\System\juCPgLP.exe
  C:\Windows\System\juCPgLP.exe
  2⤵
  PID:1540
- C:\Windows\System\DMNAPQW.exe
  C:\Windows\System\DMNAPQW.exe
  2⤵
  PID:4504
- C:\Windows\System\YrEZZWg.exe
  C:\Windows\System\YrEZZWg.exe
  2⤵
  PID:4328
- C:\Windows\System\NiVvyvY.exe
  C:\Windows\System\NiVvyvY.exe
  2⤵
  PID:1396
- C:\Windows\System\GojLJIh.exe
  C:\Windows\System\GojLJIh.exe
  2⤵
  PID:5196
- C:\Windows\System\GgXEbye.exe
  C:\Windows\System\GgXEbye.exe
  2⤵
  PID:5268
- C:\Windows\System\DnSczxt.exe
  C:\Windows\System\DnSczxt.exe
  2⤵
  PID:3788
- C:\Windows\System\aAHeGdc.exe
  C:\Windows\System\aAHeGdc.exe
  2⤵
  PID:5332
- C:\Windows\System\QQXnIfE.exe
  C:\Windows\System\QQXnIfE.exe
  2⤵
  PID:5592
- C:\Windows\System\IrgOaCt.exe
  C:\Windows\System\IrgOaCt.exe
  2⤵
  PID:5760
- C:\Windows\System\guiJuKC.exe
  C:\Windows\System\guiJuKC.exe
  2⤵
  PID:5956
- C:\Windows\System\LhaqHZn.exe
  C:\Windows\System\LhaqHZn.exe
  2⤵
  PID:6044
- C:\Windows\System\zbpkCoD.exe
  C:\Windows\System\zbpkCoD.exe
  2⤵
  PID:3940
- C:\Windows\System\kWvmAPx.exe
  C:\Windows\System\kWvmAPx.exe
  2⤵
  PID:4476
- C:\Windows\System\pEmwWfe.exe
  C:\Windows\System\pEmwWfe.exe
  2⤵
  PID:4084
- C:\Windows\System\dYEhDAA.exe
  C:\Windows\System\dYEhDAA.exe
  2⤵
  PID:1684
- C:\Windows\System\DmgFmqr.exe
  C:\Windows\System\DmgFmqr.exe
  2⤵
  PID:5508
- C:\Windows\System\gsuFrnj.exe
  C:\Windows\System\gsuFrnj.exe
  2⤵
  PID:740
- C:\Windows\System\RkMWUHK.exe
  C:\Windows\System\RkMWUHK.exe
  2⤵
  PID:3356
- C:\Windows\System\FUkDeJF.exe
  C:\Windows\System\FUkDeJF.exe
  2⤵
  PID:5624
- C:\Windows\System\QVCOiDG.exe
  C:\Windows\System\QVCOiDG.exe
  2⤵
  PID:5140
- C:\Windows\System\IPhuyjp.exe
  C:\Windows\System\IPhuyjp.exe
  2⤵
  PID:4728
- C:\Windows\System\nmoOJTX.exe
  C:\Windows\System\nmoOJTX.exe
  2⤵
  PID:6168
- C:\Windows\System\KNmgSfN.exe
  C:\Windows\System\KNmgSfN.exe
  2⤵
  PID:6196
- C:\Windows\System\YYGPNye.exe
  C:\Windows\System\YYGPNye.exe
  2⤵
  PID:6224
- C:\Windows\System\dZslPrl.exe
  C:\Windows\System\dZslPrl.exe
  2⤵
  PID:6248
- C:\Windows\System\FrtQCLl.exe
  C:\Windows\System\FrtQCLl.exe
  2⤵
  PID:6280
- C:\Windows\System\bKPjnGc.exe
  C:\Windows\System\bKPjnGc.exe
  2⤵
  PID:6308
- C:\Windows\System\xMrkirz.exe
  C:\Windows\System\xMrkirz.exe
  2⤵
  PID:6336
- C:\Windows\System\ivwcPZO.exe
  C:\Windows\System\ivwcPZO.exe
  2⤵
  PID:6364
- C:\Windows\System\JftzMOH.exe
  C:\Windows\System\JftzMOH.exe
  2⤵
  PID:6392
- C:\Windows\System\eWhDvEK.exe
  C:\Windows\System\eWhDvEK.exe
  2⤵
  PID:6420
- C:\Windows\System\rKAyheQ.exe
  C:\Windows\System\rKAyheQ.exe
  2⤵
  PID:6440
- C:\Windows\System\AJMddtU.exe
  C:\Windows\System\AJMddtU.exe
  2⤵
  PID:6476
- C:\Windows\System\pyqRCsH.exe
  C:\Windows\System\pyqRCsH.exe
  2⤵
  PID:6504
- C:\Windows\System\HiBTvOS.exe
  C:\Windows\System\HiBTvOS.exe
  2⤵
  PID:6528
- C:\Windows\System\sfEKrTh.exe
  C:\Windows\System\sfEKrTh.exe
  2⤵
  PID:6560
- C:\Windows\System\osCzkhr.exe
  C:\Windows\System\osCzkhr.exe
  2⤵
  PID:6584
- C:\Windows\System\RbJTgtp.exe
  C:\Windows\System\RbJTgtp.exe
  2⤵
  PID:6604
- C:\Windows\System\YkhnqhA.exe
  C:\Windows\System\YkhnqhA.exe
  2⤵
  PID:6632
- C:\Windows\System\qgEBITr.exe
  C:\Windows\System\qgEBITr.exe
  2⤵
  PID:6660
- C:\Windows\System\EApGLjq.exe
  C:\Windows\System\EApGLjq.exe
  2⤵
  PID:6688
- C:\Windows\System\HnhYLsG.exe
  C:\Windows\System\HnhYLsG.exe
  2⤵
  PID:6708
- C:\Windows\System\LlLTvyR.exe
  C:\Windows\System\LlLTvyR.exe
  2⤵
  PID:6736
- C:\Windows\System\zWgIWol.exe
  C:\Windows\System\zWgIWol.exe
  2⤵
  PID:6784
- C:\Windows\System\NTZgWJf.exe
  C:\Windows\System\NTZgWJf.exe
  2⤵
  PID:6800
- C:\Windows\System\BaNVQhr.exe
  C:\Windows\System\BaNVQhr.exe
  2⤵
  PID:6816
- C:\Windows\System\VOUBGCM.exe
  C:\Windows\System\VOUBGCM.exe
  2⤵
  PID:6836
- C:\Windows\System\liNIIpd.exe
  C:\Windows\System\liNIIpd.exe
  2⤵
  PID:6868
- C:\Windows\System\dVRXlUX.exe
  C:\Windows\System\dVRXlUX.exe
  2⤵
  PID:6928
- C:\Windows\System\EJBanuo.exe
  C:\Windows\System\EJBanuo.exe
  2⤵
  PID:6956
- C:\Windows\System\adomikO.exe
  C:\Windows\System\adomikO.exe
  2⤵
  PID:6980
- C:\Windows\System\uWTNYwY.exe
  C:\Windows\System\uWTNYwY.exe
  2⤵
  PID:7012
- C:\Windows\System\ojFQehd.exe
  C:\Windows\System\ojFQehd.exe
  2⤵
  PID:7036
- C:\Windows\System\oxqFtVY.exe
  C:\Windows\System\oxqFtVY.exe
  2⤵
  PID:7068
- C:\Windows\System\dioLYsj.exe
  C:\Windows\System\dioLYsj.exe
  2⤵
  PID:7100
- C:\Windows\System\yuFXiLy.exe
  C:\Windows\System\yuFXiLy.exe
  2⤵
  PID:7116
- C:\Windows\System\QDLfrkb.exe
  C:\Windows\System\QDLfrkb.exe
  2⤵
  PID:7160
- C:\Windows\System\NajHBXV.exe
  C:\Windows\System\NajHBXV.exe
  2⤵
  PID:6012
- C:\Windows\System\WpqXENW.exe
  C:\Windows\System\WpqXENW.exe
  2⤵
  PID:6192
- C:\Windows\System\nKfvUMQ.exe
  C:\Windows\System\nKfvUMQ.exe
  2⤵
  PID:6276
- C:\Windows\System\PeCnVUH.exe
  C:\Windows\System\PeCnVUH.exe
  2⤵
  PID:6320
- C:\Windows\System\sXQryZy.exe
  C:\Windows\System\sXQryZy.exe
  2⤵
  PID:6416
- C:\Windows\System\fyBnXgE.exe
  C:\Windows\System\fyBnXgE.exe
  2⤵
  PID:6456
- C:\Windows\System\ZVDUDbB.exe
  C:\Windows\System\ZVDUDbB.exe
  2⤵
  PID:6536
- C:\Windows\System\mEzatGr.exe
  C:\Windows\System\mEzatGr.exe
  2⤵
  PID:6600
- C:\Windows\System\HJYzJRI.exe
  C:\Windows\System\HJYzJRI.exe
  2⤵
  PID:6648
- C:\Windows\System\FJQpVHQ.exe
  C:\Windows\System\FJQpVHQ.exe
  2⤵
  PID:6672
- C:\Windows\System\uiooVpU.exe
  C:\Windows\System\uiooVpU.exe
  2⤵
  PID:6772
- C:\Windows\System\ssMtvgf.exe
  C:\Windows\System\ssMtvgf.exe
  2⤵
  PID:6812
- C:\Windows\System\mCvzUyH.exe
  C:\Windows\System\mCvzUyH.exe
  2⤵
  PID:6920
- C:\Windows\System\HtiXAac.exe
  C:\Windows\System\HtiXAac.exe
  2⤵
  PID:6996
- C:\Windows\System\raNUFFi.exe
  C:\Windows\System\raNUFFi.exe
  2⤵
  PID:7056
- C:\Windows\System\CDnjuMl.exe
  C:\Windows\System\CDnjuMl.exe
  2⤵
  PID:7152
- C:\Windows\System\oBCpveY.exe
  C:\Windows\System\oBCpveY.exe
  2⤵
  PID:5456
- C:\Windows\System\BLTEUvH.exe
  C:\Windows\System\BLTEUvH.exe
  2⤵
  PID:6484
- C:\Windows\System\uBsJRFp.exe
  C:\Windows\System\uBsJRFp.exe
  2⤵
  PID:6744
- C:\Windows\System\yFlWQbs.exe
  C:\Windows\System\yFlWQbs.exe
  2⤵
  PID:7108
- C:\Windows\System\tBYozOl.exe
  C:\Windows\System\tBYozOl.exe
  2⤵
  PID:6160
- C:\Windows\System\pYTkpTv.exe
  C:\Windows\System\pYTkpTv.exe
  2⤵
  PID:7004
- C:\Windows\System\tvBLufC.exe
  C:\Windows\System\tvBLufC.exe
  2⤵
  PID:6792
- C:\Windows\System\NiVnHzu.exe
  C:\Windows\System\NiVnHzu.exe
  2⤵
  PID:7196
- C:\Windows\System\PnVKLmY.exe
  C:\Windows\System\PnVKLmY.exe
  2⤵
  PID:7224
- C:\Windows\System\hKqRgqB.exe
  C:\Windows\System\hKqRgqB.exe
  2⤵
  PID:7240
- C:\Windows\System\qClUpBo.exe
  C:\Windows\System\qClUpBo.exe
  2⤵
  PID:7280
- C:\Windows\System\pRRDGxp.exe
  C:\Windows\System\pRRDGxp.exe
  2⤵
  PID:7308
- C:\Windows\System\WiTTHvl.exe
  C:\Windows\System\WiTTHvl.exe
  2⤵
  PID:7328
- C:\Windows\System\LqYTBes.exe
  C:\Windows\System\LqYTBes.exe
  2⤵
  PID:7352
- C:\Windows\System\HkvdmUr.exe
  C:\Windows\System\HkvdmUr.exe
  2⤵
  PID:7376
- C:\Windows\System\ycFzfXE.exe
  C:\Windows\System\ycFzfXE.exe
  2⤵
  PID:7420
- C:\Windows\System\JwccgHG.exe
  C:\Windows\System\JwccgHG.exe
  2⤵
  PID:7440
- C:\Windows\System\nNWAObq.exe
  C:\Windows\System\nNWAObq.exe
  2⤵
  PID:7464
- C:\Windows\System\KZeCElz.exe
  C:\Windows\System\KZeCElz.exe
  2⤵
  PID:7484
- C:\Windows\System\hVBJwWJ.exe
  C:\Windows\System\hVBJwWJ.exe
  2⤵
  PID:7508
- C:\Windows\System\xCkLnEC.exe
  C:\Windows\System\xCkLnEC.exe
  2⤵
  PID:7532
- C:\Windows\System\dtGIkBX.exe
  C:\Windows\System\dtGIkBX.exe
  2⤵
  PID:7588
- C:\Windows\System\YYvHnSB.exe
  C:\Windows\System\YYvHnSB.exe
  2⤵
  PID:7616
- C:\Windows\System\hcLyukT.exe
  C:\Windows\System\hcLyukT.exe
  2⤵
  PID:7632
- C:\Windows\System\DHCnOAZ.exe
  C:\Windows\System\DHCnOAZ.exe
  2⤵
  PID:7652
- C:\Windows\System\srLIoGz.exe
  C:\Windows\System\srLIoGz.exe
  2⤵
  PID:7680
- C:\Windows\System\TlDoTqv.exe
  C:\Windows\System\TlDoTqv.exe
  2⤵
  PID:7700
- C:\Windows\System\CCjONeQ.exe
  C:\Windows\System\CCjONeQ.exe
  2⤵
  PID:7728
- C:\Windows\System\WNqtDhE.exe
  C:\Windows\System\WNqtDhE.exe
  2⤵
  PID:7756
- C:\Windows\System\fofzEuV.exe
  C:\Windows\System\fofzEuV.exe
  2⤵
  PID:7788
- C:\Windows\System\FMZJaYu.exe
  C:\Windows\System\FMZJaYu.exe
  2⤵
  PID:7812
- C:\Windows\System\FVmUQuG.exe
  C:\Windows\System\FVmUQuG.exe
  2⤵
  PID:7840
- C:\Windows\System\rwcumCs.exe
  C:\Windows\System\rwcumCs.exe
  2⤵
  PID:7872
- C:\Windows\System\ULKZMgk.exe
  C:\Windows\System\ULKZMgk.exe
  2⤵
  PID:7896
- C:\Windows\System\MjGfUsg.exe
  C:\Windows\System\MjGfUsg.exe
  2⤵
  PID:7924
- C:\Windows\System\aRXhupw.exe
  C:\Windows\System\aRXhupw.exe
  2⤵
  PID:7960
- C:\Windows\System\wYCybNq.exe
  C:\Windows\System\wYCybNq.exe
  2⤵
  PID:7992
- C:\Windows\System\FnBJFyO.exe
  C:\Windows\System\FnBJFyO.exe
  2⤵
  PID:8024
- C:\Windows\System\FnXuICO.exe
  C:\Windows\System\FnXuICO.exe
  2⤵
  PID:8056
- C:\Windows\System\DCsJcvf.exe
  C:\Windows\System\DCsJcvf.exe
  2⤵
  PID:8080
- C:\Windows\System\hPcPOuL.exe
  C:\Windows\System\hPcPOuL.exe
  2⤵
  PID:8112
- C:\Windows\System\asxLuDK.exe
  C:\Windows\System\asxLuDK.exe
  2⤵
  PID:8148
- C:\Windows\System\QEgcIUJ.exe
  C:\Windows\System\QEgcIUJ.exe
  2⤵
  PID:8164
- C:\Windows\System\mvcLbOZ.exe
  C:\Windows\System\mvcLbOZ.exe
  2⤵
  PID:6244
- C:\Windows\System\dfpJltT.exe
  C:\Windows\System\dfpJltT.exe
  2⤵
  PID:7208
- C:\Windows\System\Miaeevv.exe
  C:\Windows\System\Miaeevv.exe
  2⤵
  PID:7268
- C:\Windows\System\lMpKEhP.exe
  C:\Windows\System\lMpKEhP.exe
  2⤵
  PID:7320
- C:\Windows\System\QSmGkVR.exe
  C:\Windows\System\QSmGkVR.exe
  2⤵
  PID:7336
- C:\Windows\System\RAItEFv.exe
  C:\Windows\System\RAItEFv.exe
  2⤵
  PID:7472
- C:\Windows\System\aYOgrzD.exe
  C:\Windows\System\aYOgrzD.exe
  2⤵
  PID:7520
- C:\Windows\System\ChqgRlW.exe
  C:\Windows\System\ChqgRlW.exe
  2⤵
  PID:7568
- C:\Windows\System\kvdFyml.exe
  C:\Windows\System\kvdFyml.exe
  2⤵
  PID:7692
- C:\Windows\System\ECRHuIN.exe
  C:\Windows\System\ECRHuIN.exe
  2⤵
  PID:7716
- C:\Windows\System\lehhpic.exe
  C:\Windows\System\lehhpic.exe
  2⤵
  PID:7832
- C:\Windows\System\YnTZhUp.exe
  C:\Windows\System\YnTZhUp.exe
  2⤵
  PID:7888
- C:\Windows\System\wpamkpI.exe
  C:\Windows\System\wpamkpI.exe
  2⤵
  PID:7920
- C:\Windows\System\QqedYRP.exe
  C:\Windows\System\QqedYRP.exe
  2⤵
  PID:7980
- C:\Windows\System\PYKIvtp.exe
  C:\Windows\System\PYKIvtp.exe
  2⤵
  PID:8052
- C:\Windows\System\pwRmGtC.exe
  C:\Windows\System\pwRmGtC.exe
  2⤵
  PID:8132
- C:\Windows\System\nkYKOLY.exe
  C:\Windows\System\nkYKOLY.exe
  2⤵
  PID:7188
- C:\Windows\System\tWvsCuQ.exe
  C:\Windows\System\tWvsCuQ.exe
  2⤵
  PID:7292
- C:\Windows\System\IYpXwmm.exe
  C:\Windows\System\IYpXwmm.exe
  2⤵
  PID:7492
- C:\Windows\System\YcxmVRd.exe
  C:\Windows\System\YcxmVRd.exe
  2⤵
  PID:7608
- C:\Windows\System\LIWdNdo.exe
  C:\Windows\System\LIWdNdo.exe
  2⤵
  PID:7892
- C:\Windows\System\OMAZYLb.exe
  C:\Windows\System\OMAZYLb.exe
  2⤵
  PID:7880
- C:\Windows\System\pcPyAKo.exe
  C:\Windows\System\pcPyAKo.exe
  2⤵
  PID:8044
- C:\Windows\System\tYnoitm.exe
  C:\Windows\System\tYnoitm.exe
  2⤵
  PID:7212
- C:\Windows\System\BDATEQQ.exe
  C:\Windows\System\BDATEQQ.exe
  2⤵
  PID:7604
- C:\Windows\System\UTbKTXS.exe
  C:\Windows\System\UTbKTXS.exe
  2⤵
  PID:7804
- C:\Windows\System\RBPBpsI.exe
  C:\Windows\System\RBPBpsI.exe
  2⤵
  PID:8092
- C:\Windows\System\VoQVVJG.exe
  C:\Windows\System\VoQVVJG.exe
  2⤵
  PID:8096
- C:\Windows\System\xmFnpWc.exe
  C:\Windows\System\xmFnpWc.exe
  2⤵
  PID:8216
- C:\Windows\System\uZdnhyW.exe
  C:\Windows\System\uZdnhyW.exe
  2⤵
  PID:8236
- C:\Windows\System\uKOkOIt.exe
  C:\Windows\System\uKOkOIt.exe
  2⤵
  PID:8272
- C:\Windows\System\UwFARHI.exe
  C:\Windows\System\UwFARHI.exe
  2⤵
  PID:8292
- C:\Windows\System\jvDghQh.exe
  C:\Windows\System\jvDghQh.exe
  2⤵
  PID:8316
- C:\Windows\System\YOvblWa.exe
  C:\Windows\System\YOvblWa.exe
  2⤵
  PID:8340
- C:\Windows\System\UhidiFO.exe
  C:\Windows\System\UhidiFO.exe
  2⤵
  PID:8380
- C:\Windows\System\jcujlMZ.exe
  C:\Windows\System\jcujlMZ.exe
  2⤵
  PID:8404
- C:\Windows\System\OluoFua.exe
  C:\Windows\System\OluoFua.exe
  2⤵
  PID:8436
- C:\Windows\System\uklgYlg.exe
  C:\Windows\System\uklgYlg.exe
  2⤵
  PID:8484
- C:\Windows\System\OmPdGyZ.exe
  C:\Windows\System\OmPdGyZ.exe
  2⤵
  PID:8512
- C:\Windows\System\afGZrmt.exe
  C:\Windows\System\afGZrmt.exe
  2⤵
  PID:8540
- C:\Windows\System\kKNPVoZ.exe
  C:\Windows\System\kKNPVoZ.exe
  2⤵
  PID:8556
- C:\Windows\System\lxrocxp.exe
  C:\Windows\System\lxrocxp.exe
  2⤵
  PID:8576
- C:\Windows\System\QVkKvUv.exe
  C:\Windows\System\QVkKvUv.exe
  2⤵
  PID:8600
- C:\Windows\System\ayHZlXe.exe
  C:\Windows\System\ayHZlXe.exe
  2⤵
  PID:8628
- C:\Windows\System\NnGBghB.exe
  C:\Windows\System\NnGBghB.exe
  2⤵
  PID:8656
- C:\Windows\System\TchJltb.exe
  C:\Windows\System\TchJltb.exe
  2⤵
  PID:8692
- C:\Windows\System\fAxdcSo.exe
  C:\Windows\System\fAxdcSo.exe
  2⤵
  PID:8728
- C:\Windows\System\qgnsRLY.exe
  C:\Windows\System\qgnsRLY.exe
  2⤵
  PID:8764
- C:\Windows\System\OnalCTK.exe
  C:\Windows\System\OnalCTK.exe
  2⤵
  PID:8780
- C:\Windows\System\OwTZhJf.exe
  C:\Windows\System\OwTZhJf.exe
  2⤵
  PID:8808
- C:\Windows\System\SFjGDNw.exe
  C:\Windows\System\SFjGDNw.exe
  2⤵
  PID:8836
- C:\Windows\System\LrBxoPQ.exe
  C:\Windows\System\LrBxoPQ.exe
  2⤵
  PID:8872
- C:\Windows\System\aifUMxY.exe
  C:\Windows\System\aifUMxY.exe
  2⤵
  PID:8904
- C:\Windows\System\GUCkBSv.exe
  C:\Windows\System\GUCkBSv.exe
  2⤵
  PID:8932
- C:\Windows\System\GTKDAIj.exe
  C:\Windows\System\GTKDAIj.exe
  2⤵
  PID:8948
- C:\Windows\System\BNZtgQf.exe
  C:\Windows\System\BNZtgQf.exe
  2⤵
  PID:8988
- C:\Windows\System\MHoyyPq.exe
  C:\Windows\System\MHoyyPq.exe
  2⤵
  PID:9016
- C:\Windows\System\vSQFXEW.exe
  C:\Windows\System\vSQFXEW.exe
  2⤵
  PID:9032
- C:\Windows\System\AkbzhVb.exe
  C:\Windows\System\AkbzhVb.exe
  2⤵
  PID:9056
- C:\Windows\System\EvPIbJc.exe
  C:\Windows\System\EvPIbJc.exe
  2⤵
  PID:9088
- C:\Windows\System\BkFspSL.exe
  C:\Windows\System\BkFspSL.exe
  2⤵
  PID:9116
- C:\Windows\System\HpUIkuA.exe
  C:\Windows\System\HpUIkuA.exe
  2⤵
  PID:9148
- C:\Windows\System\EqJwyYS.exe
  C:\Windows\System\EqJwyYS.exe
  2⤵
  PID:9172
- C:\Windows\System\OyyNdnB.exe
  C:\Windows\System\OyyNdnB.exe
  2⤵
  PID:9212
- C:\Windows\System\ltuOwYJ.exe
  C:\Windows\System\ltuOwYJ.exe
  2⤵
  PID:8012
- C:\Windows\System\NHBAvPt.exe
  C:\Windows\System\NHBAvPt.exe
  2⤵
  PID:8244
- C:\Windows\System\ezUjVlP.exe
  C:\Windows\System\ezUjVlP.exe
  2⤵
  PID:8352
- C:\Windows\System\qlEqSfN.exe
  C:\Windows\System\qlEqSfN.exe
  2⤵
  PID:8416
- C:\Windows\System\MXWsuOq.exe
  C:\Windows\System\MXWsuOq.exe
  2⤵
  PID:8464
- C:\Windows\System\bOVASVJ.exe
  C:\Windows\System\bOVASVJ.exe
  2⤵
  PID:8508
- C:\Windows\System\fhAReWg.exe
  C:\Windows\System\fhAReWg.exe
  2⤵
  PID:8596
- C:\Windows\System\kxzKbuG.exe
  C:\Windows\System\kxzKbuG.exe
  2⤵
  PID:8644
- C:\Windows\System\uYOveZP.exe
  C:\Windows\System\uYOveZP.exe
  2⤵
  PID:8688
- C:\Windows\System\QaPCYPe.exe
  C:\Windows\System\QaPCYPe.exe
  2⤵
  PID:8800
- C:\Windows\System\MKRkZbQ.exe
  C:\Windows\System\MKRkZbQ.exe
  2⤵
  PID:8828
- C:\Windows\System\pAVarBN.exe
  C:\Windows\System\pAVarBN.exe
  2⤵
  PID:8920
- C:\Windows\System\HPGXJSm.exe
  C:\Windows\System\HPGXJSm.exe
  2⤵
  PID:8968
- C:\Windows\System\buyHgjg.exe
  C:\Windows\System\buyHgjg.exe
  2⤵
  PID:9028
- C:\Windows\System\bqzLBob.exe
  C:\Windows\System\bqzLBob.exe
  2⤵
  PID:9068
- C:\Windows\System\LEfHNUi.exe
  C:\Windows\System\LEfHNUi.exe
  2⤵
  PID:9160
- C:\Windows\System\DbiztHO.exe
  C:\Windows\System\DbiztHO.exe
  2⤵
  PID:7452
- C:\Windows\System\zIpPias.exe
  C:\Windows\System\zIpPias.exe
  2⤵
  PID:8372
- C:\Windows\System\kgAESdn.exe
  C:\Windows\System\kgAESdn.exe
  2⤵
  PID:8500
- C:\Windows\System\mNEUQmA.exe
  C:\Windows\System\mNEUQmA.exe
  2⤵
  PID:8748
- C:\Windows\System\nmGuleF.exe
  C:\Windows\System\nmGuleF.exe
  2⤵
  PID:8820
- C:\Windows\System\ZtZKZNC.exe
  C:\Windows\System\ZtZKZNC.exe
  2⤵
  PID:8928
- C:\Windows\System\PIRwwWt.exe
  C:\Windows\System\PIRwwWt.exe
  2⤵
  PID:9108
- C:\Windows\System\XNeIxha.exe
  C:\Windows\System\XNeIxha.exe
  2⤵
  PID:7372
- C:\Windows\System\SxbgMKE.exe
  C:\Windows\System\SxbgMKE.exe
  2⤵
  PID:8608
- C:\Windows\System\jaHGQLW.exe
  C:\Windows\System\jaHGQLW.exe
  2⤵
  PID:8892
- C:\Windows\System\EzbomhY.exe
  C:\Windows\System\EzbomhY.exe
  2⤵
  PID:9188
- C:\Windows\System\yotTgZa.exe
  C:\Windows\System\yotTgZa.exe
  2⤵
  PID:8260
- C:\Windows\System\FOWSNIM.exe
  C:\Windows\System\FOWSNIM.exe
  2⤵
  PID:9240
- C:\Windows\System\XOrAbbF.exe
  C:\Windows\System\XOrAbbF.exe
  2⤵
  PID:9268
- C:\Windows\System\FOpPQXe.exe
  C:\Windows\System\FOpPQXe.exe
  2⤵
  PID:9288
- C:\Windows\System\BbpXMwH.exe
  C:\Windows\System\BbpXMwH.exe
  2⤵
  PID:9336
- C:\Windows\System\bDwtcli.exe
  C:\Windows\System\bDwtcli.exe
  2⤵
  PID:9372
- C:\Windows\System\ikcweUV.exe
  C:\Windows\System\ikcweUV.exe
  2⤵
  PID:9388
- C:\Windows\System\MtJOgXG.exe
  C:\Windows\System\MtJOgXG.exe
  2⤵
  PID:9416
- C:\Windows\System\MSIhpJr.exe
  C:\Windows\System\MSIhpJr.exe
  2⤵
  PID:9444
- C:\Windows\System\Kuwyosi.exe
  C:\Windows\System\Kuwyosi.exe
  2⤵
  PID:9464
- C:\Windows\System\QXcMJfb.exe
  C:\Windows\System\QXcMJfb.exe
  2⤵
  PID:9496
- C:\Windows\System\dXzaRNZ.exe
  C:\Windows\System\dXzaRNZ.exe
  2⤵
  PID:9536
- C:\Windows\System\LSDSRmD.exe
  C:\Windows\System\LSDSRmD.exe
  2⤵
  PID:9560
- C:\Windows\System\iOLBBkV.exe
  C:\Windows\System\iOLBBkV.exe
  2⤵
  PID:9584
- C:\Windows\System\habYuNZ.exe
  C:\Windows\System\habYuNZ.exe
  2⤵
  PID:9604
- C:\Windows\System\SeLbMfW.exe
  C:\Windows\System\SeLbMfW.exe
  2⤵
  PID:9624
- C:\Windows\System\pizyXic.exe
  C:\Windows\System\pizyXic.exe
  2⤵
  PID:9676
- C:\Windows\System\dYmKouV.exe
  C:\Windows\System\dYmKouV.exe
  2⤵
  PID:9692
- C:\Windows\System\AMvrozC.exe
  C:\Windows\System\AMvrozC.exe
  2⤵
  PID:9712
- C:\Windows\System\bXRqrDy.exe
  C:\Windows\System\bXRqrDy.exe
  2⤵
  PID:9740
- C:\Windows\System\MALGNgH.exe
  C:\Windows\System\MALGNgH.exe
  2⤵
  PID:9764
- C:\Windows\System\PDchziE.exe
  C:\Windows\System\PDchziE.exe
  2⤵
  PID:9784
- C:\Windows\System\GrJXQcY.exe
  C:\Windows\System\GrJXQcY.exe
  2⤵
  PID:9808
- C:\Windows\System\EDjabIm.exe
  C:\Windows\System\EDjabIm.exe
  2⤵
  PID:9844
- C:\Windows\System\ytjxBKg.exe
  C:\Windows\System\ytjxBKg.exe
  2⤵
  PID:9864
- C:\Windows\System\LpehArt.exe
  C:\Windows\System\LpehArt.exe
  2⤵
  PID:9936
- C:\Windows\System\iLmGfzf.exe
  C:\Windows\System\iLmGfzf.exe
  2⤵
  PID:9956
- C:\Windows\System\PPCRIhf.exe
  C:\Windows\System\PPCRIhf.exe
  2⤵
  PID:9980
- C:\Windows\System\FoxxSbo.exe
  C:\Windows\System\FoxxSbo.exe
  2⤵
  PID:9996
- C:\Windows\System\ggUzJSJ.exe
  C:\Windows\System\ggUzJSJ.exe
  2⤵
  PID:10012
- C:\Windows\System\eKmudWC.exe
  C:\Windows\System\eKmudWC.exe
  2⤵
  PID:10040
- C:\Windows\System\UHeDXoO.exe
  C:\Windows\System\UHeDXoO.exe
  2⤵
  PID:10084
- C:\Windows\System\gLeyRVq.exe
  C:\Windows\System\gLeyRVq.exe
  2⤵
  PID:10132
- C:\Windows\System\LnGlLPV.exe
  C:\Windows\System\LnGlLPV.exe
  2⤵
  PID:10148
- C:\Windows\System\yOsZKwR.exe
  C:\Windows\System\yOsZKwR.exe
  2⤵
  PID:10176
- C:\Windows\System\wPcVxCX.exe
  C:\Windows\System\wPcVxCX.exe
  2⤵
  PID:10192
- C:\Windows\System\nydZkuH.exe
  C:\Windows\System\nydZkuH.exe
  2⤵
  PID:10220
- C:\Windows\System\uLqKQXn.exe
  C:\Windows\System\uLqKQXn.exe
  2⤵
  PID:8304
- C:\Windows\System\RPuBSFO.exe
  C:\Windows\System\RPuBSFO.exe
  2⤵
  PID:9308
- C:\Windows\System\MaDaKrd.exe
  C:\Windows\System\MaDaKrd.exe
  2⤵
  PID:9328
- C:\Windows\System\tBZzjPM.exe
  C:\Windows\System\tBZzjPM.exe
  2⤵
  PID:9364
- C:\Windows\System\fRSXGxm.exe
  C:\Windows\System\fRSXGxm.exe
  2⤵
  PID:9408
- C:\Windows\System\CDweYqA.exe
  C:\Windows\System\CDweYqA.exe
  2⤵
  PID:9460
- C:\Windows\System\CRWidfu.exe
  C:\Windows\System\CRWidfu.exe
  2⤵
  PID:9600
- C:\Windows\System\WfYirWo.exe
  C:\Windows\System\WfYirWo.exe
  2⤵
  PID:9700
- C:\Windows\System\DsJZypN.exe
  C:\Windows\System\DsJZypN.exe
  2⤵
  PID:9800
- C:\Windows\System\knFWDpa.exe
  C:\Windows\System\knFWDpa.exe
  2⤵
  PID:9776
- C:\Windows\System\OIqWKzO.exe
  C:\Windows\System\OIqWKzO.exe
  2⤵
  PID:9836
- C:\Windows\System\HUpgYEN.exe
  C:\Windows\System\HUpgYEN.exe
  2⤵
  PID:9944
- C:\Windows\System\MbizgSU.exe
  C:\Windows\System\MbizgSU.exe
  2⤵
  PID:9992
- C:\Windows\System\rmVtPSl.exe
  C:\Windows\System\rmVtPSl.exe
  2⤵
  PID:10080
- C:\Windows\System\grKCqAB.exe
  C:\Windows\System\grKCqAB.exe
  2⤵
  PID:10164
- C:\Windows\System\dBSetjl.exe
  C:\Windows\System\dBSetjl.exe
  2⤵
  PID:8796
- C:\Windows\System\psPxXEc.exe
  C:\Windows\System\psPxXEc.exe
  2⤵
  PID:9252
- C:\Windows\System\sCnZsgm.exe
  C:\Windows\System\sCnZsgm.exe
  2⤵
  PID:8376
- C:\Windows\System\cUVkirf.exe
  C:\Windows\System\cUVkirf.exe
  2⤵
  PID:9436
- C:\Windows\System\GpGaHXw.exe
  C:\Windows\System\GpGaHXw.exe
  2⤵
  PID:9732
- C:\Windows\System\ESqpftZ.exe
  C:\Windows\System\ESqpftZ.exe
  2⤵
  PID:9824
- C:\Windows\System\GCRaNAK.exe
  C:\Windows\System\GCRaNAK.exe
  2⤵
  PID:9900
- C:\Windows\System\OcVaEAP.exe
  C:\Windows\System\OcVaEAP.exe
  2⤵
  PID:10108
- C:\Windows\System\ZPKEFXY.exe
  C:\Windows\System\ZPKEFXY.exe
  2⤵
  PID:9224
- C:\Windows\System\hhwJftV.exe
  C:\Windows\System\hhwJftV.exe
  2⤵
  PID:10216
- C:\Windows\System\pKQxifJ.exe
  C:\Windows\System\pKQxifJ.exe
  2⤵
  PID:9260
- C:\Windows\System\nGIVdNj.exe
  C:\Windows\System\nGIVdNj.exe
  2⤵
  PID:10168
- C:\Windows\System\tnOBKBi.exe
  C:\Windows\System\tnOBKBi.exe
  2⤵
  PID:10260
- C:\Windows\System\koweGRQ.exe
  C:\Windows\System\koweGRQ.exe
  2⤵
  PID:10280
- C:\Windows\System\FTwylBE.exe
  C:\Windows\System\FTwylBE.exe
  2⤵
  PID:10308
- C:\Windows\System\alXSegX.exe
  C:\Windows\System\alXSegX.exe
  2⤵
  PID:10336
- C:\Windows\System\fLajzko.exe
  C:\Windows\System\fLajzko.exe
  2⤵
  PID:10364
- C:\Windows\System\NfgnmWI.exe
  C:\Windows\System\NfgnmWI.exe
  2⤵
  PID:10392
- C:\Windows\System\IjdAwpD.exe
  C:\Windows\System\IjdAwpD.exe
  2⤵
  PID:10420
- C:\Windows\System\wmUcoYS.exe
  C:\Windows\System\wmUcoYS.exe
  2⤵
  PID:10456
- C:\Windows\System\LkULsIC.exe
  C:\Windows\System\LkULsIC.exe
  2⤵
  PID:10496
- C:\Windows\System\BhHvdJF.exe
  C:\Windows\System\BhHvdJF.exe
  2⤵
  PID:10524
- C:\Windows\System\VWHBNCS.exe
  C:\Windows\System\VWHBNCS.exe
  2⤵
  PID:10540
- C:\Windows\System\bfhUfyF.exe
  C:\Windows\System\bfhUfyF.exe
  2⤵
  PID:10568
- C:\Windows\System\KqUiDpf.exe
  C:\Windows\System\KqUiDpf.exe
  2⤵
  PID:10584
- C:\Windows\System\pRIzxYq.exe
  C:\Windows\System\pRIzxYq.exe
  2⤵
  PID:10600
- C:\Windows\System\ATcKmhR.exe
  C:\Windows\System\ATcKmhR.exe
  2⤵
  PID:10628
- C:\Windows\System\IASRKVb.exe
  C:\Windows\System\IASRKVb.exe
  2⤵
  PID:10652
- C:\Windows\System\emNvUNb.exe
  C:\Windows\System\emNvUNb.exe
  2⤵
  PID:10728
- C:\Windows\System\ciaFRiI.exe
  C:\Windows\System\ciaFRiI.exe
  2⤵
  PID:10760
- C:\Windows\System\rvghHbK.exe
  C:\Windows\System\rvghHbK.exe
  2⤵
  PID:10788
- C:\Windows\System\BGnjjiV.exe
  C:\Windows\System\BGnjjiV.exe
  2⤵
  PID:10816
- C:\Windows\System\qSYamEl.exe
  C:\Windows\System\qSYamEl.exe
  2⤵
  PID:10844
- C:\Windows\System\CTwEjuP.exe
  C:\Windows\System\CTwEjuP.exe
  2⤵
  PID:10864
- C:\Windows\System\xATYIib.exe
  C:\Windows\System\xATYIib.exe
  2⤵
  PID:10880
- C:\Windows\System\NXHdRCH.exe
  C:\Windows\System\NXHdRCH.exe
  2⤵
  PID:10896
- C:\Windows\System\vDoFWOw.exe
  C:\Windows\System\vDoFWOw.exe
  2⤵
  PID:10912
- C:\Windows\System\TVAdjYU.exe
  C:\Windows\System\TVAdjYU.exe
  2⤵
  PID:10948
- C:\Windows\System\kxlBtQj.exe
  C:\Windows\System\kxlBtQj.exe
  2⤵
  PID:10968
- C:\Windows\System\MSsoXnz.exe
  C:\Windows\System\MSsoXnz.exe
  2⤵
  PID:10992
- C:\Windows\System\NtOTZhL.exe
  C:\Windows\System\NtOTZhL.exe
  2⤵
  PID:11012
- C:\Windows\System\JQbIYRM.exe
  C:\Windows\System\JQbIYRM.exe
  2⤵
  PID:11052
- C:\Windows\System\QTlCMXg.exe
  C:\Windows\System\QTlCMXg.exe
  2⤵
  PID:11088
- C:\Windows\System\TmqebVQ.exe
  C:\Windows\System\TmqebVQ.exe
  2⤵
  PID:11148
- C:\Windows\System\lBElnht.exe
  C:\Windows\System\lBElnht.exe
  2⤵
  PID:11188
- C:\Windows\System\lsDtfAR.exe
  C:\Windows\System\lsDtfAR.exe
  2⤵
  PID:11204
- C:\Windows\System\EZOCQma.exe
  C:\Windows\System\EZOCQma.exe
  2⤵
  PID:11228
- C:\Windows\System\pEhmVFN.exe
  C:\Windows\System\pEhmVFN.exe
  2⤵
  PID:11248
- C:\Windows\System\ErEmBLr.exe
  C:\Windows\System\ErEmBLr.exe
  2⤵
  PID:10256
- C:\Windows\System\MlJFYnJ.exe
  C:\Windows\System\MlJFYnJ.exe
  2⤵
  PID:10268
- C:\Windows\System\AkQHDet.exe
  C:\Windows\System\AkQHDet.exe
  2⤵
  PID:10404
- C:\Windows\System\CWHbtTZ.exe
  C:\Windows\System\CWHbtTZ.exe
  2⤵
  PID:10476
- C:\Windows\System\JUtzsIf.exe
  C:\Windows\System\JUtzsIf.exe
  2⤵
  PID:10560
- C:\Windows\System\KMXJoEM.exe
  C:\Windows\System\KMXJoEM.exe
  2⤵
  PID:10616
- C:\Windows\System\sfJxCEE.exe
  C:\Windows\System\sfJxCEE.exe
  2⤵
  PID:10624
- C:\Windows\System\eJVnHQd.exe
  C:\Windows\System\eJVnHQd.exe
  2⤵
  PID:10692
- C:\Windows\System\MelJxYK.exe
  C:\Windows\System\MelJxYK.exe
  2⤵
  PID:10828
- C:\Windows\System\RiPweyh.exe
  C:\Windows\System\RiPweyh.exe
  2⤵
  PID:10876
- C:\Windows\System\XOsdYpp.exe
  C:\Windows\System\XOsdYpp.exe
  2⤵
  PID:10888
- C:\Windows\System\YrwSVre.exe
  C:\Windows\System\YrwSVre.exe
  2⤵
  PID:10988
- C:\Windows\System\XAZtilW.exe
  C:\Windows\System\XAZtilW.exe
  2⤵
  PID:11040
- C:\Windows\System\iDLNQdM.exe
  C:\Windows\System\iDLNQdM.exe
  2⤵
  PID:11104
- C:\Windows\System\IcPPlaz.exe
  C:\Windows\System\IcPPlaz.exe
  2⤵
  PID:11136
- C:\Windows\System\GwgxcBY.exe
  C:\Windows\System\GwgxcBY.exe
  2⤵
  PID:11220
- C:\Windows\System\zvWDbMm.exe
  C:\Windows\System\zvWDbMm.exe
  2⤵
  PID:9720
- C:\Windows\System\hpTqZXs.exe
  C:\Windows\System\hpTqZXs.exe
  2⤵
  PID:10304
- C:\Windows\System\mGCgPpj.exe
  C:\Windows\System\mGCgPpj.exe
  2⤵
  PID:10596
- C:\Windows\System\cGyCzFl.exe
  C:\Windows\System\cGyCzFl.exe
  2⤵
  PID:9552
- C:\Windows\System\osDkKrA.exe
  C:\Windows\System\osDkKrA.exe
  2⤵
  PID:11028
- C:\Windows\System\IygmGcg.exe
  C:\Windows\System\IygmGcg.exe
  2⤵
  PID:11236
- C:\Windows\System\klXHMUr.exe
  C:\Windows\System\klXHMUr.exe
  2⤵
  PID:10428
- C:\Windows\System\vyJpTOy.exe
  C:\Windows\System\vyJpTOy.exe
  2⤵
  PID:10772
- C:\Windows\System\zqHBbtt.exe
  C:\Windows\System\zqHBbtt.exe
  2⤵
  PID:11076
- C:\Windows\System\xZszuCq.exe
  C:\Windows\System\xZszuCq.exe
  2⤵
  PID:11268
- C:\Windows\System\fgFZbNr.exe
  C:\Windows\System\fgFZbNr.exe
  2⤵
  PID:11312
- C:\Windows\System\GvOVyQA.exe
  C:\Windows\System\GvOVyQA.exe
  2⤵
  PID:11332
- C:\Windows\System\JlpEMWj.exe
  C:\Windows\System\JlpEMWj.exe
  2⤵
  PID:11356
- C:\Windows\System\UriVYdF.exe
  C:\Windows\System\UriVYdF.exe
  2⤵
  PID:11380
- C:\Windows\System\lCjzDEw.exe
  C:\Windows\System\lCjzDEw.exe
  2⤵
  PID:11424
- C:\Windows\System\IPERTZl.exe
  C:\Windows\System\IPERTZl.exe
  2⤵
  PID:11452
- C:\Windows\System\zQgKtTs.exe
  C:\Windows\System\zQgKtTs.exe
  2⤵
  PID:11480
- C:\Windows\System\gFWoIxK.exe
  C:\Windows\System\gFWoIxK.exe
  2⤵
  PID:11500
- C:\Windows\System\NDruMeo.exe
  C:\Windows\System\NDruMeo.exe
  2⤵
  PID:11520
- C:\Windows\System\bYAMRUT.exe
  C:\Windows\System\bYAMRUT.exe
  2⤵
  PID:11540
- C:\Windows\System\cpnlTTu.exe
  C:\Windows\System\cpnlTTu.exe
  2⤵
  PID:11596
- C:\Windows\System\MMeBEOe.exe
  C:\Windows\System\MMeBEOe.exe
  2⤵
  PID:11616
- C:\Windows\System\TjQOwDG.exe
  C:\Windows\System\TjQOwDG.exe
  2⤵
  PID:11652
- C:\Windows\System\aCaNKke.exe
  C:\Windows\System\aCaNKke.exe
  2⤵
  PID:11676
- C:\Windows\System\mPakUvx.exe
  C:\Windows\System\mPakUvx.exe
  2⤵
  PID:11696
- C:\Windows\System\anXmdqc.exe
  C:\Windows\System\anXmdqc.exe
  2⤵
  PID:11716
- C:\Windows\System\zixSMLX.exe
  C:\Windows\System\zixSMLX.exe
  2⤵
  PID:11756
- C:\Windows\System\GsqCSxf.exe
  C:\Windows\System\GsqCSxf.exe
  2⤵
  PID:11780
- C:\Windows\System\pJVlduq.exe
  C:\Windows\System\pJVlduq.exe
  2⤵
  PID:11796
- C:\Windows\System\sFgSFxh.exe
  C:\Windows\System\sFgSFxh.exe
  2⤵
  PID:11816
- C:\Windows\System\HdvEdfu.exe
  C:\Windows\System\HdvEdfu.exe
  2⤵
  PID:11844
- C:\Windows\System\ocEsRqA.exe
  C:\Windows\System\ocEsRqA.exe
  2⤵
  PID:11876
- C:\Windows\System\UQKMNPq.exe
  C:\Windows\System\UQKMNPq.exe
  2⤵
  PID:11904
- C:\Windows\System\btPMzTC.exe
  C:\Windows\System\btPMzTC.exe
  2⤵
  PID:11928
- C:\Windows\System\lryiaTh.exe
  C:\Windows\System\lryiaTh.exe
  2⤵
  PID:11956
- C:\Windows\System\zbQqNDz.exe
  C:\Windows\System\zbQqNDz.exe
  2⤵
  PID:12008
- C:\Windows\System\ZLolbgB.exe
  C:\Windows\System\ZLolbgB.exe
  2⤵
  PID:12032
- C:\Windows\System\raAUDcq.exe
  C:\Windows\System\raAUDcq.exe
  2⤵
  PID:12060
- C:\Windows\System\fmXMTrA.exe
  C:\Windows\System\fmXMTrA.exe
  2⤵
  PID:12092
- C:\Windows\System\cMNubKA.exe
  C:\Windows\System\cMNubKA.exe
  2⤵
  PID:12120
- C:\Windows\System\Aqvcumt.exe
  C:\Windows\System\Aqvcumt.exe
  2⤵
  PID:12148
- C:\Windows\System\lfkdrGk.exe
  C:\Windows\System\lfkdrGk.exe
  2⤵
  PID:12176
- C:\Windows\System\eFYDpbB.exe
  C:\Windows\System\eFYDpbB.exe
  2⤵
  PID:12192
- C:\Windows\System\tfmmMiw.exe
  C:\Windows\System\tfmmMiw.exe
  2⤵
  PID:12244
- C:\Windows\System\RzATZrF.exe
  C:\Windows\System\RzATZrF.exe
  2⤵
  PID:12264
- C:\Windows\System\KZqCBww.exe
  C:\Windows\System\KZqCBww.exe
  2⤵
  PID:10644
- C:\Windows\System\aUXABOh.exe
  C:\Windows\System\aUXABOh.exe
  2⤵
  PID:10532
- C:\Windows\System\EDkLvdI.exe
  C:\Windows\System\EDkLvdI.exe
  2⤵
  PID:11348
- C:\Windows\System\BMQqPYv.exe
  C:\Windows\System\BMQqPYv.exe
  2⤵
  PID:11400
- C:\Windows\System\sFPVkoX.exe
  C:\Windows\System\sFPVkoX.exe
  2⤵
  PID:11468
- C:\Windows\System\PmKIamP.exe
  C:\Windows\System\PmKIamP.exe
  2⤵
  PID:11580
- C:\Windows\System\HCnjZLc.exe
  C:\Windows\System\HCnjZLc.exe
  2⤵
  PID:11644
- C:\Windows\System\OKTTslL.exe
  C:\Windows\System\OKTTslL.exe
  2⤵
  PID:11712
- C:\Windows\System\RtJMYKc.exe
  C:\Windows\System\RtJMYKc.exe
  2⤵
  PID:11788
- C:\Windows\System\iWeLEPs.exe
  C:\Windows\System\iWeLEPs.exe
  2⤵
  PID:11836
- C:\Windows\System\cwMJdSw.exe
  C:\Windows\System\cwMJdSw.exe
  2⤵
  PID:11892
- C:\Windows\System\lZEmIWJ.exe
  C:\Windows\System\lZEmIWJ.exe
  2⤵
  PID:11920
- C:\Windows\System\YUcKesd.exe
  C:\Windows\System\YUcKesd.exe
  2⤵
  PID:11948
- C:\Windows\System\mlXyCST.exe
  C:\Windows\System\mlXyCST.exe
  2⤵
  PID:12048
- C:\Windows\System\izusatu.exe
  C:\Windows\System\izusatu.exe
  2⤵
  PID:12104
- C:\Windows\System\JWrHqiU.exe
  C:\Windows\System\JWrHqiU.exe
  2⤵
  PID:12160
- C:\Windows\System\mBMWKUj.exe
  C:\Windows\System\mBMWKUj.exe
  2⤵
  PID:12220
- C:\Windows\System\gGvSrfl.exe
  C:\Windows\System\gGvSrfl.exe
  2⤵
  PID:11376
- C:\Windows\System\nXYgMEM.exe
  C:\Windows\System\nXYgMEM.exe
  2⤵
  PID:11532
- C:\Windows\System\piCfLUy.exe
  C:\Windows\System\piCfLUy.exe
  2⤵
  PID:11640
- C:\Windows\System\jOFkLOf.exe
  C:\Windows\System\jOFkLOf.exe
  2⤵
  PID:11764
- C:\Windows\System\vPNiYqr.exe
  C:\Windows\System\vPNiYqr.exe
  2⤵
  PID:11888
- C:\Windows\System\XFPCdpq.exe
  C:\Windows\System\XFPCdpq.exe
  2⤵
  PID:12112
- C:\Windows\System\LOGTdjN.exe
  C:\Windows\System\LOGTdjN.exe
  2⤵
  PID:11296
- C:\Windows\System\XsFBLBC.exe
  C:\Windows\System\XsFBLBC.exe
  2⤵
  PID:11436
- C:\Windows\System\RwEfghE.exe
  C:\Windows\System\RwEfghE.exe
  2⤵
  PID:11868
- C:\Windows\System\pbrTOme.exe
  C:\Windows\System\pbrTOme.exe
  2⤵
  PID:12232
- C:\Windows\System\cWYUDRB.exe
  C:\Windows\System\cWYUDRB.exe
  2⤵
  PID:11736
- C:\Windows\System\vvCcAnB.exe
  C:\Windows\System\vvCcAnB.exe
  2⤵
  PID:12292
- C:\Windows\System\BOCgNfz.exe
  C:\Windows\System\BOCgNfz.exe
  2⤵
  PID:12320
- C:\Windows\System\MkoOcGs.exe
  C:\Windows\System\MkoOcGs.exe
  2⤵
  PID:12368
- C:\Windows\System\rauzmxx.exe
  C:\Windows\System\rauzmxx.exe
  2⤵
  PID:12396
- C:\Windows\System\XXwmlcW.exe
  C:\Windows\System\XXwmlcW.exe
  2⤵
  PID:12416
- C:\Windows\System\PZRlMEd.exe
  C:\Windows\System\PZRlMEd.exe
  2⤵
  PID:12440
- C:\Windows\System\rMPUrEE.exe
  C:\Windows\System\rMPUrEE.exe
  2⤵
  PID:12456
- C:\Windows\System\AvurAGD.exe
  C:\Windows\System\AvurAGD.exe
  2⤵
  PID:12484
- C:\Windows\System\JDjCRVB.exe
  C:\Windows\System\JDjCRVB.exe
  2⤵
  PID:12520
- C:\Windows\System\iURudhj.exe
  C:\Windows\System\iURudhj.exe
  2⤵
  PID:12552
- C:\Windows\System\mwFbAUk.exe
  C:\Windows\System\mwFbAUk.exe
  2⤵
  PID:12588
- C:\Windows\System\TtVotnG.exe
  C:\Windows\System\TtVotnG.exe
  2⤵
  PID:12620
- C:\Windows\System\WViSApO.exe
  C:\Windows\System\WViSApO.exe
  2⤵
  PID:12640
- C:\Windows\System\aErigFm.exe
  C:\Windows\System\aErigFm.exe
  2⤵
  PID:12664
- C:\Windows\System\nhGPrDo.exe
  C:\Windows\System\nhGPrDo.exe
  2⤵
  PID:12684
- C:\Windows\System\htBAOlq.exe
  C:\Windows\System\htBAOlq.exe
  2⤵
  PID:12716
- C:\Windows\System\kFNcQkC.exe
  C:\Windows\System\kFNcQkC.exe
  2⤵
  PID:12744
- C:\Windows\System\mibgPFc.exe
  C:\Windows\System\mibgPFc.exe
  2⤵
  PID:12780
- C:\Windows\System\DhzJoxu.exe
  C:\Windows\System\DhzJoxu.exe
  2⤵
  PID:12804
- C:\Windows\System\OjpiKAj.exe
  C:\Windows\System\OjpiKAj.exe
  2⤵
  PID:12828
- C:\Windows\System\CSxNFjd.exe
  C:\Windows\System\CSxNFjd.exe
  2⤵
  PID:12860
- C:\Windows\System\hrciXJy.exe
  C:\Windows\System\hrciXJy.exe
  2⤵
  PID:12888
- C:\Windows\System\KVUtkjQ.exe
  C:\Windows\System\KVUtkjQ.exe
  2⤵
  PID:12928
- C:\Windows\System\twhUJBx.exe
  C:\Windows\System\twhUJBx.exe
  2⤵
  PID:12956
- C:\Windows\System\lTtrOVn.exe
  C:\Windows\System\lTtrOVn.exe
  2⤵
  PID:12972
- C:\Windows\System\vCqLyLi.exe
  C:\Windows\System\vCqLyLi.exe
  2⤵
  PID:13000
- C:\Windows\System\ktWVrPd.exe
  C:\Windows\System\ktWVrPd.exe
  2⤵
  PID:13016
- C:\Windows\System\BDnljPG.exe
  C:\Windows\System\BDnljPG.exe
  2⤵
  PID:13068
- C:\Windows\System\KckYhrz.exe
  C:\Windows\System\KckYhrz.exe
  2⤵
  PID:13096
- C:\Windows\System\wnbSAja.exe
  C:\Windows\System\wnbSAja.exe
  2⤵
  PID:13112
- C:\Windows\System\NFoFFWC.exe
  C:\Windows\System\NFoFFWC.exe
  2⤵
  PID:13144
- C:\Windows\System\vNMqcie.exe
  C:\Windows\System\vNMqcie.exe
  2⤵
  PID:13176
- C:\Windows\System\ZBvjxgc.exe
  C:\Windows\System\ZBvjxgc.exe
  2⤵
  PID:13200
- C:\Windows\System\nUcnQOU.exe
  C:\Windows\System\nUcnQOU.exe
  2⤵
  PID:13228
- C:\Windows\System\vBqpXig.exe
  C:\Windows\System\vBqpXig.exe
  2⤵
  PID:13256
- C:\Windows\System\lsLKful.exe
  C:\Windows\System\lsLKful.exe
  2⤵
  PID:13296
- C:\Windows\System\SINCQHq.exe
  C:\Windows\System\SINCQHq.exe
  2⤵
  PID:11444
- C:\Windows\System\viudenk.exe
  C:\Windows\System\viudenk.exe
  2⤵
  PID:12344
- C:\Windows\System\VanVmaX.exe
  C:\Windows\System\VanVmaX.exe
  2⤵
  PID:12380
- C:\Windows\System\hjtgnMV.exe
  C:\Windows\System\hjtgnMV.exe
  2⤵
  PID:12448
- C:\Windows\System\CcfMcXD.exe
  C:\Windows\System\CcfMcXD.exe
  2⤵
  PID:12548
- C:\Windows\System\GiZoSpb.exe
  C:\Windows\System\GiZoSpb.exe
  2⤵
  PID:12608
- C:\Windows\System\EcUIbmC.exe
  C:\Windows\System\EcUIbmC.exe
  2⤵
  PID:12660
- C:\Windows\System\OcoHpYT.exe
  C:\Windows\System\OcoHpYT.exe
  2⤵
  PID:12736
- C:\Windows\System\TOvCRno.exe
  C:\Windows\System\TOvCRno.exe
  2⤵
  PID:12776
- C:\Windows\System\PMVaBzA.exe
  C:\Windows\System\PMVaBzA.exe
  2⤵
  PID:12872
- C:\Windows\System\DpRznik.exe
  C:\Windows\System\DpRznik.exe
  2⤵
  PID:12924
- C:\Windows\System\aCeBxfY.exe
  C:\Windows\System\aCeBxfY.exe
  2⤵
  PID:12952
- C:\Windows\System\VJzMJzp.exe
  C:\Windows\System\VJzMJzp.exe
  2⤵
  PID:12996
- C:\Windows\System\gBURyJH.exe
  C:\Windows\System\gBURyJH.exe
  2⤵
  PID:13052
- C:\Windows\System\fwFwoLP.exe
  C:\Windows\System\fwFwoLP.exe
  2⤵
  PID:13168
- C:\Windows\System\AgjsHEa.exe
  C:\Windows\System\AgjsHEa.exe
  2⤵
  PID:13192
- C:\Windows\System\bcuoSOo.exe
  C:\Windows\System\bcuoSOo.exe
  2⤵
  PID:12364
- C:\Windows\System\wPiYtdR.exe
  C:\Windows\System\wPiYtdR.exe
  2⤵
  PID:12388
- C:\Windows\System\dNLAtDQ.exe
  C:\Windows\System\dNLAtDQ.exe
  2⤵
  PID:12424
- C:\Windows\System\mqqIwUs.exe
  C:\Windows\System\mqqIwUs.exe
  2⤵
  PID:12772
- C:\Windows\System\CReSsHQ.exe
  C:\Windows\System\CReSsHQ.exe
  2⤵
  PID:12916
- C:\Windows\System\nsRFfaV.exe
  C:\Windows\System\nsRFfaV.exe
  2⤵
  PID:13032
- C:\Windows\System\yNVwWFt.exe
  C:\Windows\System\yNVwWFt.exe
  2⤵
  PID:13212
- C:\Windows\System\DfDxHAz.exe
  C:\Windows\System\DfDxHAz.exe
  2⤵
  PID:13272
- C:\Windows\System\XyQrlOK.exe
  C:\Windows\System\XyQrlOK.exe
  2⤵
  PID:12584
- C:\Windows\System\COAUjYC.exe
  C:\Windows\System\COAUjYC.exe
  2⤵
  PID:13136
- C:\Windows\System\xgLGMje.exe
  C:\Windows\System\xgLGMje.exe
  2⤵
  PID:12408
- C:\Windows\System\FTLdIVf.exe
  C:\Windows\System\FTLdIVf.exe
  2⤵
  PID:12852
- C:\Windows\System\bVXaGeX.exe
  C:\Windows\System\bVXaGeX.exe
  2⤵
  PID:12984
- C:\Windows\System\eONEgge.exe
  C:\Windows\System\eONEgge.exe
  2⤵
  PID:13320
- C:\Windows\System\eufGrUX.exe
  C:\Windows\System\eufGrUX.exe
  2⤵
  PID:13356
- C:\Windows\System\jzTNrAQ.exe
  C:\Windows\System\jzTNrAQ.exe
  2⤵
  PID:13380
- C:\Windows\System\FUXYjLd.exe
  C:\Windows\System\FUXYjLd.exe
  2⤵
  PID:13404
- C:\Windows\System\aOueYOC.exe
  C:\Windows\System\aOueYOC.exe
  2⤵
  PID:13440
- C:\Windows\System\hwhocjf.exe
  C:\Windows\System\hwhocjf.exe
  2⤵
  PID:13472
- C:\Windows\System\IyRetrw.exe
  C:\Windows\System\IyRetrw.exe
  2⤵
  PID:13500
- C:\Windows\System\PwzwrGQ.exe
  C:\Windows\System\PwzwrGQ.exe
  2⤵
  PID:13540
- C:\Windows\System\qGpQokx.exe
  C:\Windows\System\qGpQokx.exe
  2⤵
  PID:13564
- C:\Windows\System\hwCbden.exe
  C:\Windows\System\hwCbden.exe
  2⤵
  PID:13596
- C:\Windows\System\jAVuPNf.exe
  C:\Windows\System\jAVuPNf.exe
  2⤵
  PID:13612
- C:\Windows\System\RHDJusl.exe
  C:\Windows\System\RHDJusl.exe
  2⤵
  PID:13652
- C:\Windows\System\onezTnL.exe
  C:\Windows\System\onezTnL.exe
  2⤵
  PID:13692
- C:\Windows\System\ZykIxHO.exe
  C:\Windows\System\ZykIxHO.exe
  2⤵
  PID:13720
- C:\Windows\System\gdwVxtO.exe
  C:\Windows\System\gdwVxtO.exe
  2⤵
  PID:13748
- C:\Windows\System\cOWrjsV.exe
  C:\Windows\System\cOWrjsV.exe
  2⤵
  PID:13776
- C:\Windows\System\oTtAYRX.exe
  C:\Windows\System\oTtAYRX.exe
  2⤵
  PID:13804
- C:\Windows\System\UOwuzIn.exe
  C:\Windows\System\UOwuzIn.exe
  2⤵
  PID:13824
- C:\Windows\System\cwXAmfH.exe
  C:\Windows\System\cwXAmfH.exe
  2⤵
  PID:13844
- C:\Windows\System\VrQqokE.exe
  C:\Windows\System\VrQqokE.exe
  2⤵
  PID:13864
- C:\Windows\System\JPFZdHw.exe
  C:\Windows\System\JPFZdHw.exe
  2⤵
  PID:13884
- C:\Windows\System\YdKTelo.exe
  C:\Windows\System\YdKTelo.exe
  2⤵
  PID:13916
- C:\Windows\System\ulwfoqj.exe
  C:\Windows\System\ulwfoqj.exe
  2⤵
  PID:13944
- C:\Windows\System\dvtvBsv.exe
  C:\Windows\System\dvtvBsv.exe
  2⤵
  PID:13992
- C:\Windows\System\aietTyG.exe
  C:\Windows\System\aietTyG.exe
  2⤵
  PID:14028
- C:\Windows\System\QLBGKiW.exe
  C:\Windows\System\QLBGKiW.exe
  2⤵
  PID:14048
- C:\Windows\System\uyEGvuo.exe
  C:\Windows\System\uyEGvuo.exe
  2⤵
  PID:14076
- C:\Windows\System\NvxmIuW.exe
  C:\Windows\System\NvxmIuW.exe
  2⤵
  PID:14108
- C:\Windows\System\XuOBBgk.exe
  C:\Windows\System\XuOBBgk.exe
  2⤵
  PID:14132
- C:\Windows\System\gdurUEo.exe
  C:\Windows\System\gdurUEo.exe
  2⤵
  PID:14160
- C:\Windows\System\OsDOoiK.exe
  C:\Windows\System\OsDOoiK.exe
  2⤵
  PID:14184
- C:\Windows\System\ErSUfMN.exe
  C:\Windows\System\ErSUfMN.exe
  2⤵
  PID:14208
- C:\Windows\System\swsUYtG.exe
  C:\Windows\System\swsUYtG.exe
  2⤵
  PID:14236
- C:\Windows\System\NsIVEgR.exe
  C:\Windows\System\NsIVEgR.exe
  2⤵
  PID:14272
- C:\Windows\System\wUdlcXC.exe
  C:\Windows\System\wUdlcXC.exe
  2⤵
  PID:14296
- C:\Windows\System\jfAgRhy.exe
  C:\Windows\System\jfAgRhy.exe
  2⤵
  PID:12312
- C:\Windows\System\JIErjBX.exe
  C:\Windows\System\JIErjBX.exe
  2⤵
  PID:13332
- C:\Windows\System\jEkagoi.exe
  C:\Windows\System\jEkagoi.exe
  2⤵
  PID:13432
- C:\Windows\System\prOMxfJ.exe
  C:\Windows\System\prOMxfJ.exe
  2⤵
  PID:13520
- C:\Windows\System\pbKUuGm.exe
  C:\Windows\System\pbKUuGm.exe
  2⤵
  PID:13548
- C:\Windows\System\gnwpEbn.exe
  C:\Windows\System\gnwpEbn.exe
  2⤵
  PID:13604
- C:\Windows\System\BHKkCMP.exe
  C:\Windows\System\BHKkCMP.exe
  2⤵
  PID:13648
- C:\Windows\System\PYskkol.exe
  C:\Windows\System\PYskkol.exe
  2⤵
  PID:13764
- C:\Windows\System\dtmaYru.exe
  C:\Windows\System\dtmaYru.exe
  2⤵
  PID:13840
- C:\Windows\System\JhuldBm.exe
  C:\Windows\System\JhuldBm.exe
  2⤵
  PID:13856
- C:\Windows\System\YaoQgGt.exe
  C:\Windows\System\YaoQgGt.exe
  2⤵
  PID:13892
- C:\Windows\System\GUKuTDZ.exe
  C:\Windows\System\GUKuTDZ.exe
  2⤵
  PID:14000
- C:\Windows\System\satfHUO.exe
  C:\Windows\System\satfHUO.exe
  2⤵
  PID:14060
- C:\Windows\System\izUzovm.exe
  C:\Windows\System\izUzovm.exe
  2⤵
  PID:14088
- C:\Windows\System\TLwmYnI.exe
  C:\Windows\System\TLwmYnI.exe
  2⤵
  PID:14176
- C:\Windows\System\BJLujIJ.exe
  C:\Windows\System\BJLujIJ.exe
  2⤵
  PID:14264
- C:\Windows\System\fMNQfXc.exe
  C:\Windows\System\fMNQfXc.exe
  2⤵
  PID:14292
- C:\Windows\System\nDULeoo.exe
  C:\Windows\System\nDULeoo.exe
  2⤵
  PID:13368
- C:\Windows\System\EjxbJAp.exe
  C:\Windows\System\EjxbJAp.exe
  2⤵
  PID:13580
- C:\Windows\System\CQMgfLG.exe
  C:\Windows\System\CQMgfLG.exe
  2⤵
  PID:13668
- C:\Windows\System\fvRklht.exe
  C:\Windows\System\fvRklht.exe
  2⤵
  PID:13788
- C:\Windows\System\HbCHjdN.exe
  C:\Windows\System\HbCHjdN.exe
  2⤵
  PID:13900
- C:\Windows\System\MToUHUn.exe
  C:\Windows\System\MToUHUn.exe
  2⤵
  PID:14012
- C:\Windows\System\aToAoip.exe
  C:\Windows\System\aToAoip.exe
  2⤵
  PID:14256
- C:\Windows\System\CWXGaWM.exe
  C:\Windows\System\CWXGaWM.exe
  2⤵
  PID:13624
- C:\Windows\System\ObOhNst.exe
  C:\Windows\System\ObOhNst.exe
  2⤵
  PID:13964
- C:\Windows\System\ioPxvBi.exe
  C:\Windows\System\ioPxvBi.exe
  2⤵
  PID:14232
- C:\Windows\System\BhBZzMA.exe
  C:\Windows\System\BhBZzMA.exe
  2⤵
  PID:14148
- C:\Windows\System\AqvboeX.exe
  C:\Windows\System\AqvboeX.exe
  2⤵
  PID:14352
- C:\Windows\System\DvgbtQD.exe
  C:\Windows\System\DvgbtQD.exe
  2⤵
  PID:14376
- C:\Windows\System\UiTLJAI.exe
  C:\Windows\System\UiTLJAI.exe
  2⤵
  PID:14392
- C:\Windows\System\caeEYNv.exe
  C:\Windows\System\caeEYNv.exe
  2⤵
  PID:14416
- C:\Windows\System\vSXxagL.exe
  C:\Windows\System\vSXxagL.exe
  2⤵
  PID:14444
- C:\Windows\System\LjFIRws.exe
  C:\Windows\System\LjFIRws.exe
  2⤵
  PID:14496
- C:\Windows\System\QEVTXEr.exe
  C:\Windows\System\QEVTXEr.exe
  2⤵
  PID:14528
- C:\Windows\System\rXQzLLM.exe
  C:\Windows\System\rXQzLLM.exe
  2⤵
  PID:14556
- C:\Windows\System\YstmDoF.exe
  C:\Windows\System\YstmDoF.exe
  2⤵
  PID:14584
- C:\Windows\System\ylAdxNl.exe
  C:\Windows\System\ylAdxNl.exe
  2⤵
  PID:14612
- C:\Windows\System\nVoKTMd.exe
  C:\Windows\System\nVoKTMd.exe
  2⤵
  PID:14632
- C:\Windows\System\FGktVfs.exe
  C:\Windows\System\FGktVfs.exe
  2⤵
  PID:14652
- C:\Windows\System\GiMSuxi.exe
  C:\Windows\System\GiMSuxi.exe
  2⤵
  PID:14696
- C:\Windows\System\fSqkFzJ.exe
  C:\Windows\System\fSqkFzJ.exe
  2⤵
  PID:14720
- C:\Windows\System\hjZyGQF.exe
  C:\Windows\System\hjZyGQF.exe
  2⤵
  PID:14764
- C:\Windows\System\OFwiLtx.exe
  C:\Windows\System\OFwiLtx.exe
  2⤵
  PID:14792
- C:\Windows\System\mpltmxd.exe
  C:\Windows\System\mpltmxd.exe
  2⤵
  PID:14820
- C:\Windows\System\WtYyTpd.exe
  C:\Windows\System\WtYyTpd.exe
  2⤵
  PID:14836
- C:\Windows\System\hFCqgDP.exe
  C:\Windows\System\hFCqgDP.exe
  2⤵
  PID:14852
- C:\Windows\System\MhfWKrN.exe
  C:\Windows\System\MhfWKrN.exe
  2⤵
  PID:14884
- C:\Windows\System\XxjSopZ.exe
  C:\Windows\System\XxjSopZ.exe
  2⤵
  PID:14920
- C:\Windows\System\OCIsyLG.exe
  C:\Windows\System\OCIsyLG.exe
  2⤵
  PID:14944
- C:\Windows\System\BgHgckx.exe
  C:\Windows\System\BgHgckx.exe
  2⤵
  PID:14968
- C:\Windows\System\rbnnzWI.exe
  C:\Windows\System\rbnnzWI.exe
  2⤵
  PID:14988
- C:\Windows\System\THIvctt.exe
  C:\Windows\System\THIvctt.exe
  2⤵
  PID:15040
- C:\Windows\System\AMzuSpc.exe
  C:\Windows\System\AMzuSpc.exe
  2⤵
  PID:15060
- C:\Windows\System\dLklCJV.exe
  C:\Windows\System\dLklCJV.exe
  2⤵
  PID:15096
- C:\Windows\System\KgXbDTz.exe
  C:\Windows\System\KgXbDTz.exe
  2⤵
  PID:15136
- C:\Windows\System\MwaHBHo.exe
  C:\Windows\System\MwaHBHo.exe
  2⤵
  PID:15156
- C:\Windows\System\LxIoZCL.exe
  C:\Windows\System\LxIoZCL.exe
  2⤵
  PID:15184
- C:\Windows\System\sMOqyKP.exe
  C:\Windows\System\sMOqyKP.exe
  2⤵
  PID:15212
- C:\Windows\System\UNyJSwI.exe
  C:\Windows\System\UNyJSwI.exe
  2⤵
  PID:15236
- C:\Windows\System\MvvWUsf.exe
  C:\Windows\System\MvvWUsf.exe
  2⤵
  PID:15260
- C:\Windows\System\piSMaiv.exe
  C:\Windows\System\piSMaiv.exe
  2⤵
  PID:15292
- C:\Windows\System\XsJgyLO.exe
  C:\Windows\System\XsJgyLO.exe
  2⤵
  PID:15316
- C:\Windows\System\sLhsIwL.exe
  C:\Windows\System\sLhsIwL.exe
  2⤵
  PID:15336
- C:\Windows\System\mQgUbSZ.exe
  C:\Windows\System\mQgUbSZ.exe
  2⤵
  PID:14388
- C:\Windows\System\xAExbMn.exe
  C:\Windows\System\xAExbMn.exe
  2⤵
  PID:14404
- C:\Windows\System\TpbsKEr.exe
  C:\Windows\System\TpbsKEr.exe
  2⤵
  PID:14472
- C:\Windows\System\AlgOstg.exe
  C:\Windows\System\AlgOstg.exe
  2⤵
  PID:14596
- C:\Windows\System\aRQAVfv.exe
  C:\Windows\System\aRQAVfv.exe
  2⤵
  PID:14624
- C:\Windows\System\OtAMvoo.exe
  C:\Windows\System\OtAMvoo.exe
  2⤵
  PID:14684
- C:\Windows\System\JXsGLte.exe
  C:\Windows\System\JXsGLte.exe
  2⤵
  PID:14772
- C:\Windows\System\BoydgSO.exe
  C:\Windows\System\BoydgSO.exe
  2⤵
  PID:14832
- C:\Windows\System\vUxcEve.exe
  C:\Windows\System\vUxcEve.exe
  2⤵
  PID:14892
- C:\Windows\System\pOmkurU.exe
  C:\Windows\System\pOmkurU.exe
  2⤵
  PID:14940
- C:\Windows\System\fvuSxgi.exe
  C:\Windows\System\fvuSxgi.exe
  2⤵
  PID:14976
- C:\Windows\System\qvCdrit.exe
  C:\Windows\System\qvCdrit.exe
  2⤵
  PID:15076
- C:\Windows\System\JBKKqNU.exe
  C:\Windows\System\JBKKqNU.exe
  2⤵
  PID:15152
- C:\Windows\System\wOqqHUf.exe
  C:\Windows\System\wOqqHUf.exe
  2⤵
  PID:15192
- C:\Windows\System\gmQCODX.exe
  C:\Windows\System\gmQCODX.exe
  2⤵
  PID:15280
- C:\Windows\System\scscKAd.exe
  C:\Windows\System\scscKAd.exe
  2⤵
  PID:15328
- C:\Windows\System\XFETivz.exe
  C:\Windows\System\XFETivz.exe
  2⤵
  PID:14544
- C:\Windows\System\jeQqvxt.exe
  C:\Windows\System\jeQqvxt.exe
  2⤵
  PID:14672
- C:\Windows\System\GQxvgla.exe
  C:\Windows\System\GQxvgla.exe
  2⤵
  PID:14812
- C:\Windows\System\ziSRIhO.exe
  C:\Windows\System\ziSRIhO.exe
  2⤵
  PID:15012
- C:\Windows\System\VQUCSsa.exe
  C:\Windows\System\VQUCSsa.exe
  2⤵
  PID:15120
- C:\Windows\System\Psrnxnh.exe
  C:\Windows\System\Psrnxnh.exe
  2⤵
  PID:15232
- C:\Windows\System\yVvenOA.exe
  C:\Windows\System\yVvenOA.exe
  2⤵
  PID:14440
- C:\Windows\System\KrKTCuw.exe
  C:\Windows\System\KrKTCuw.exe
  2⤵
  PID:14848
- C:\Windows\System\wnOgHNd.exe
  C:\Windows\System\wnOgHNd.exe
  2⤵
  PID:14932
- C:\Windows\System\fETWUwQ.exe
  C:\Windows\System\fETWUwQ.exe
  2⤵
  PID:15392
- C:\Windows\System\qHBoMsA.exe
  C:\Windows\System\qHBoMsA.exe
  2⤵
  PID:15408
- C:\Windows\System\lRALoCb.exe
  C:\Windows\System\lRALoCb.exe
  2⤵
  PID:15424
- C:\Windows\System\zWFhJaD.exe
  C:\Windows\System\zWFhJaD.exe
  2⤵
  PID:15448
- C:\Windows\System\jlLYInL.exe
  C:\Windows\System\jlLYInL.exe
  2⤵
  PID:15492
- C:\Windows\System\pzbfgIg.exe
  C:\Windows\System\pzbfgIg.exe
  2⤵
  PID:15516
- C:\Windows\System\vpvjFXL.exe
  C:\Windows\System\vpvjFXL.exe
  2⤵
  PID:15540
- C:\Windows\System\lhUoANH.exe
  C:\Windows\System\lhUoANH.exe
  2⤵
  PID:15564
- C:\Windows\System\qvjKBwC.exe
  C:\Windows\System\qvjKBwC.exe
  2⤵
  PID:15592
- C:\Windows\System\JOILHiM.exe
  C:\Windows\System\JOILHiM.exe
  2⤵
  PID:15620
- C:\Windows\System\atYurvj.exe
  C:\Windows\System\atYurvj.exe
  2⤵
  PID:15660
- C:\Windows\System\hIeIMbp.exe
  C:\Windows\System\hIeIMbp.exe
  2⤵
  PID:15684
- C:\Windows\System\OVVrvqs.exe
  C:\Windows\System\OVVrvqs.exe
  2⤵
  PID:15712
- C:\Windows\System\lsLnDxd.exe
  C:\Windows\System\lsLnDxd.exe
  2⤵
  PID:15744
- C:\Windows\System\MHqoePL.exe
  C:\Windows\System\MHqoePL.exe
  2⤵
  PID:15776
- C:\Windows\System\IrSlXee.exe
  C:\Windows\System\IrSlXee.exe
  2⤵
  PID:15796
- C:\Windows\System\PQGRngf.exe
  C:\Windows\System\PQGRngf.exe
  2⤵
  PID:15820
- C:\Windows\System\XyMAHXc.exe
  C:\Windows\System\XyMAHXc.exe
  2⤵
  PID:15844
- C:\Windows\System\MToEuEa.exe
  C:\Windows\System\MToEuEa.exe
  2⤵
  PID:15876
- C:\Windows\System\JQLYkTR.exe
  C:\Windows\System\JQLYkTR.exe
  2⤵
  PID:15896
- C:\Windows\System\nYgXrIe.exe
  C:\Windows\System\nYgXrIe.exe
  2⤵
  PID:15924
- C:\Windows\System\BhUbKIV.exe
  C:\Windows\System\BhUbKIV.exe
  2⤵
  PID:15944
- C:\Windows\System\xIGQxsy.exe
  C:\Windows\System\xIGQxsy.exe
  2⤵
  PID:15976
- C:\Windows\System\IBObNQl.exe
  C:\Windows\System\IBObNQl.exe
  2⤵
  PID:15992
- C:\Windows\System\RpxWHMQ.exe
  C:\Windows\System\RpxWHMQ.exe
  2⤵
  PID:16040
- C:\Windows\System\vavuVAH.exe
  C:\Windows\System\vavuVAH.exe
  2⤵
  PID:16068
- C:\Windows\System\bebSByj.exe
  C:\Windows\System\bebSByj.exe
  2⤵
  PID:16108
- C:\Windows\System\GqtbuOD.exe
  C:\Windows\System\GqtbuOD.exe
  2⤵
  PID:16136
- C:\Windows\System\dTdpHTB.exe
  C:\Windows\System\dTdpHTB.exe
  2⤵
  PID:16176
- C:\Windows\System\QUjXVav.exe
  C:\Windows\System\QUjXVav.exe
  2⤵
  PID:16204
- C:\Windows\System\uFBXaSm.exe
  C:\Windows\System\uFBXaSm.exe
  2⤵
  PID:16232
- C:\Windows\System\qxsdokJ.exe
  C:\Windows\System\qxsdokJ.exe
  2⤵
  PID:16248
- C:\Windows\System\BXsjtSG.exe
  C:\Windows\System\BXsjtSG.exe
  2⤵
  PID:16272
- C:\Windows\System\mbpdzCX.exe
  C:\Windows\System\mbpdzCX.exe
  2⤵
  PID:16300
- C:\Windows\System\CrRWRex.exe
  C:\Windows\System\CrRWRex.exe
  2⤵
  PID:16344
- C:\Windows\System\dLakllh.exe
  C:\Windows\System\dLakllh.exe
  2⤵
  PID:16360
- C:\Windows\System\dIEqqfO.exe
  C:\Windows\System\dIEqqfO.exe
  2⤵
  PID:15272
- C:\Windows\System\wycBuMV.exe
  C:\Windows\System\wycBuMV.exe
  2⤵
  PID:15364
- C:\Windows\System\GZMHlyB.exe
  C:\Windows\System\GZMHlyB.exe
  2⤵
  PID:15420
- C:\Windows\System\auZibyP.exe
  C:\Windows\System\auZibyP.exe
  2⤵
  PID:15508
- C:\Windows\System\arEfCkM.exe
  C:\Windows\System\arEfCkM.exe
  2⤵
  PID:15536
- C:\Windows\System\VNCNDss.exe
  C:\Windows\System\VNCNDss.exe
  2⤵
  PID:15612
- C:\Windows\System\nbaCgOS.exe
  C:\Windows\System\nbaCgOS.exe
  2⤵
  PID:15676
- C:\Windows\System\pxwsfpE.exe
  C:\Windows\System\pxwsfpE.exe
  2⤵
  PID:15732
- C:\Windows\System\nLJCIEZ.exe
  C:\Windows\System\nLJCIEZ.exe
  2⤵
  PID:15812
- C:\Windows\System\dYbCiuv.exe
  C:\Windows\System\dYbCiuv.exe
  2⤵
  PID:15868
- C:\Windows\System\mTzynAR.exe
  C:\Windows\System\mTzynAR.exe
  2⤵
  PID:15908
- C:\Windows\System\UNdwCdp.exe
  C:\Windows\System\UNdwCdp.exe
  2⤵
  PID:15988
- C:\Windows\System\Wutrinq.exe
  C:\Windows\System\Wutrinq.exe
  2⤵
  PID:16100
- C:\Windows\System\YOXkaHw.exe
  C:\Windows\System\YOXkaHw.exe
  2⤵
  PID:16172
- C:\Windows\System\eobmtRr.exe
  C:\Windows\System\eobmtRr.exe
  2⤵
  PID:16240
- C:\Windows\System\HDxNkQr.exe
  C:\Windows\System\HDxNkQr.exe
  2⤵
  PID:16292
- C:\Windows\System\hNMYQlT.exe
  C:\Windows\System\hNMYQlT.exe
  2⤵
  PID:16356
- C:\Windows\System\crZxNyt.exe
  C:\Windows\System\crZxNyt.exe
  2⤵
  PID:15400
- C:\Windows\System\QLdCmKh.exe
  C:\Windows\System\QLdCmKh.exe
  2⤵
  PID:15504
- C:\Windows\System\OfUfyuk.exe
  C:\Windows\System\OfUfyuk.exe
  2⤵
  PID:15604
- C:\Windows\System\BgHdYKV.exe
  C:\Windows\System\BgHdYKV.exe
  2⤵
  PID:15932
- C:\Windows\System\BUsbzsE.exe
  C:\Windows\System\BUsbzsE.exe
  2⤵
  PID:16064
- C:\Windows\System\buEJyig.exe
  C:\Windows\System\buEJyig.exe
  2⤵
  PID:16268
- C:\Windows\System\xRIIycF.exe
  C:\Windows\System\xRIIycF.exe
  2⤵
  PID:14604
- C:\Windows\System\upRBMcv.exe
  C:\Windows\System\upRBMcv.exe
  2⤵
  PID:15404
- C:\Windows\System\AgzzkLz.exe
  C:\Windows\System\AgzzkLz.exe
  2⤵
  PID:15860
- C:\Windows\System\DSUVriw.exe
  C:\Windows\System\DSUVriw.exe
  2⤵
  PID:16128
- C:\Windows\System\qdzPHYF.exe
  C:\Windows\System\qdzPHYF.exe
  2⤵
  PID:16284
- C:\Windows\System\yXKkeib.exe
  C:\Windows\System\yXKkeib.exe
  2⤵
  PID:15696
- C:\Windows\System\SBBPesp.exe
  C:\Windows\System\SBBPesp.exe
  2⤵
  PID:16408
- C:\Windows\System\hFYqmzJ.exe
  C:\Windows\System\hFYqmzJ.exe
  2⤵
  PID:16440
- C:\Windows\System\PFSTaYr.exe
  C:\Windows\System\PFSTaYr.exe
  2⤵
  PID:16492
- C:\Windows\System\vwrHAWS.exe
  C:\Windows\System\vwrHAWS.exe
  2⤵
  PID:16520
- C:\Windows\System\exstYqu.exe
  C:\Windows\System\exstYqu.exe
  2⤵
  PID:16536
- C:\Windows\System\MvjClmz.exe
  C:\Windows\System\MvjClmz.exe
  2⤵
  PID:16568
- C:\Windows\System\iqFOnZq.exe
  C:\Windows\System\iqFOnZq.exe
  2⤵
  PID:16604
- C:\Windows\System\iyLsgRh.exe
  C:\Windows\System\iyLsgRh.exe
  2⤵
  PID:16620
- C:\Windows\System\zstryhh.exe
  C:\Windows\System\zstryhh.exe
  2⤵
  PID:16652
- C:\Windows\System\RAVbkeE.exe
  C:\Windows\System\RAVbkeE.exe
  2⤵
  PID:16680
- C:\Windows\System\FqNuswD.exe
  C:\Windows\System\FqNuswD.exe
  2⤵
  PID:16708
- C:\Windows\System\pPSAziu.exe
  C:\Windows\System\pPSAziu.exe
  2⤵
  PID:16728
- C:\Windows\System\voOuAkQ.exe
  C:\Windows\System\voOuAkQ.exe
  2⤵
  PID:16756
- C:\Windows\System\xkuKTwN.exe
  C:\Windows\System\xkuKTwN.exe
  2⤵
  PID:16796
- C:\Windows\System\dcoySeB.exe
  C:\Windows\System\dcoySeB.exe
  2⤵
  PID:16820
- C:\Windows\System\JRwOxDi.exe
  C:\Windows\System\JRwOxDi.exe
  2⤵
  PID:16844
- C:\Windows\System\iVTOfiI.exe
  C:\Windows\System\iVTOfiI.exe
  2⤵
  PID:16868
- C:\Windows\System\lqhEqiR.exe
  C:\Windows\System\lqhEqiR.exe
  2⤵
  PID:16888
- C:\Windows\System\SCHvVbW.exe
  C:\Windows\System\SCHvVbW.exe
  2⤵
  PID:16924
- C:\Windows\System\wZoZtSt.exe
  C:\Windows\System\wZoZtSt.exe
  2⤵
  PID:16952
- C:\Windows\System\pznfulu.exe
  C:\Windows\System\pznfulu.exe
  2⤵
  PID:17000
- C:\Windows\System\onAuoKx.exe
  C:\Windows\System\onAuoKx.exe
  2⤵
  PID:17024
- C:\Windows\System\uqvbtns.exe
  C:\Windows\System\uqvbtns.exe
  2⤵
  PID:17052
- C:\Windows\System\uTFhjaY.exe
  C:\Windows\System\uTFhjaY.exe
  2⤵
  PID:17072
- C:\Windows\System\nQpEmJW.exe
  C:\Windows\System\nQpEmJW.exe
  2⤵
  PID:17100
- C:\Windows\System\rOkrQsJ.exe
  C:\Windows\System\rOkrQsJ.exe
  2⤵
  PID:17120
- C:\Windows\System\nMZDAhN.exe
  C:\Windows\System\nMZDAhN.exe
  2⤵
  PID:17148
- C:\Windows\System\XajOZPE.exe
  C:\Windows\System\XajOZPE.exe
  2⤵
  PID:17176
- C:\Windows\System\QqYyJPg.exe
  C:\Windows\System\QqYyJPg.exe
  2⤵
  PID:17208
- C:\Windows\System\dhOkVxG.exe
  C:\Windows\System\dhOkVxG.exe
  2⤵
  PID:17256
- C:\Windows\System\ssriMAA.exe
  C:\Windows\System\ssriMAA.exe
  2⤵
  PID:17288
- C:\Windows\System\pUyDFav.exe
  C:\Windows\System\pUyDFav.exe
  2⤵
  PID:17304
- C:\Windows\System\KErcZXr.exe
  C:\Windows\System\KErcZXr.exe
  2⤵
  PID:17344
- C:\Windows\System\nCepWiw.exe
  C:\Windows\System\nCepWiw.exe
  2⤵
  PID:17360
- C:\Windows\System\oysuiQM.exe
  C:\Windows\System\oysuiQM.exe
  2⤵
  PID:17376
- C:\Windows\System\pAaiPzQ.exe
  C:\Windows\System\pAaiPzQ.exe
  2⤵
  PID:17400
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 17400 -s 260
    3⤵
    PID:624
- C:\Windows\System\EsbMLUP.exe
  C:\Windows\System\EsbMLUP.exe
  2⤵
  PID:15528

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AxvdwQq.exe

Path C:\Windows\System\AxvdwQq.exe
Size 1.3MB
SHA256 3d4d04e0efa9400414a4c7581d22d9787a8233e0c13976bb710be01de11d1b69
MD5 ad1b416ec1c4dfe5363152c84b359c2c
SHA1 be6c389f46997c9207bfd11f737c4cbcaedcb451
SHA512 ddb3ffd4fe7f04cb8d8977571b38a49d98963c54c8b6d36b0d738ab8e691a096db6e2cc22f2a16df1a6c9617d58247df39e0be5273941e996f7c76400fca7a18
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUq:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVa
MD5 SHA1 SHA512 SSDEEP

Submit Download

BQYZCcs.exe

Path C:\Windows\System\BQYZCcs.exe
Size 1.3MB
SHA256 a9b327b2d424b29c3ba6a9ffd1be955580cdb0e06091deb11c99f850300921cd
MD5 c1a5a8def2bc0dc08e4d078874e2a84f
SHA1 ca1815802a47e4a2903825c646bb3d78c1d987cb
SHA512 f6029718b4b587245bb7d82bfa7daa7c458e94f3b39232e206bc7c618ba756b0a6a0e6163e02ef25ae5938df7d0b0812f0e99b9d8eee0761aad16e905c77b1db
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcU4:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVI
MD5 SHA1 SHA512 SSDEEP

Submit Download

BiJeNGo.exe

Path C:\Windows\System\BiJeNGo.exe
Size 1.3MB
SHA256 502ccba8ad9db8efeb1ce6b7b520e54014e038524b2674369ec7f13ccd99a3cc
MD5 a505a3c8843a109f96bd9f98ea160719
SHA1 bde9403790d02caed473c7ebc72b36e83e171908
SHA512 ff79aec42c6f486dd407003434b9b1796c0440b6325d7a37a0c0a5d12baf1a8533fa5f90928082e9d7abf1d2170424d1519661b0edb425643e7a317086ca730f
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUK:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVa
MD5 SHA1 SHA512 SSDEEP

Submit Download

BqFeItx.exe

Path C:\Windows\System\BqFeItx.exe
Size 1.3MB
SHA256 d61b0ca1ca995fc7bba2b022ab55bee9aadf0f994f2bbe6244d1afa7587bd9ce
MD5 fff4ec1295cd4d891a80c55c5c6645dc
SHA1 70d5d9d4a07283231ed851a09e35477a3bac76e7
SHA512 b3cd526bef6d1ecc67f264427c6bf1310896af80c10395b37a954b685250971b76c2c39d48c405ac77e6c6d1e74fb07ca391d6122b6b15b6bbaf1a82c24a772d
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcU2:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVG
MD5 SHA1 SHA512 SSDEEP

Submit Download

CVCwjWQ.exe

Path C:\Windows\System\CVCwjWQ.exe
Size 1.3MB
SHA256 5338916a74cd17eae5555d6c56a73d2b9382f095a6c5a4d0ca0d16a3006334f0
MD5 a728301836d274b411a7107d20622f1d
SHA1 b1f54cfac026e75c29ac71ca84cb2eb63e01128b
SHA512 8706f39e208e414f73340e5eeee5cc2af70208fb2ddf239b512229abc14dfb5f3de85f200ed7bdb35f275b2447a132d70004d52294aeffc4ecb9b2876a8292df
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUb:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVL
MD5 SHA1 SHA512 SSDEEP

Submit Download

DVRSmUh.exe

Path C:\Windows\System\DVRSmUh.exe
Size 1.3MB
SHA256 a28b559e7b9f8d019a759a7384945ecac8c7545096cf2f946aebbf9cf9487669
MD5 40c57b0265e35b105fbde2c740dcf158
SHA1 34d528a7cd503b9f136a57e874e6f3a0f35f3f46
SHA512 d440b85bb525d70f00e9920b095431d4d0f8988bba27889f42cae6cd8f9cbe9154e40cae94769804f88d485242c003c3be43b59eeb4b0b80a58a75a390e4a543
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUB:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

DceTsBt.exe

Path C:\Windows\System\DceTsBt.exe
Size 1.3MB
SHA256 97cfb3946f0bc7daf7d45622778dc28adb5bd4e39dd95bc954666b30e5d251d2
MD5 5fd5fc685b14f241b1b2a9912e94925e
SHA1 97837d820962daee7afede6025b5db9f1cdb6a8c
SHA512 245b644bcbd7de802b2b3db3d56aad0c81f29277022000f0427c7cf8a15ab108e5e0e50fea71ef54e365e3151cf354a28d97c948a7319ceff525a19ffc411c44
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUn:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVX
MD5 SHA1 SHA512 SSDEEP

Submit Download

EvIzIMA.exe

Path C:\Windows\System\EvIzIMA.exe
Size 1.3MB
SHA256 780405da65cd3d46abea8c1e66141d465f9b86e185229ebdb55307785b55f28c
MD5 ea5143055d45374b54b3afa2f6128900
SHA1 9afbc1c87ac0d4dd9473b2ab7dd3b9a317f30200
SHA512 b5553a70239825ab79e58b195f8325e1947cc15550c7badfb01d115b5e71fd413babceeaf47438cf4f90a74f7a0e46765a87aa17177e02b1c750808580a13a8c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUk:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVU
MD5 SHA1 SHA512 SSDEEP

Submit Download

FbeqQJZ.exe

Path C:\Windows\System\FbeqQJZ.exe
Size 1.3MB
SHA256 331aa435c6e2460e2fc4a359e4fd52a4970f7a7a84524d64fb08f8479aab02a8
MD5 1550980e9fccdd2f6fd7fb1acbededea
SHA1 1633f5bad0e7601975b3228193b71920bff16c18
SHA512 5218bdad06d895db6f2544e5637d0380f173f3eceefe7125bd0ddb95f87240b55446c7f7ce1231a00002e668243caf8691c4f9fd3ba943d30350fa03409c49fb
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUA:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OkLWggR.exe

Path C:\Windows\System\OkLWggR.exe
Size 1.3MB
SHA256 2e18ca28930b7244a3c48d78d0287572130774ce2db39989f0de091ab371ec48
MD5 bcf2ce390cbe21481b6e60d181dbb011
SHA1 64a89cb9eac86369edac8434e5eea2a99a26a754
SHA512 90135d7f1beaf1043dd5176bba4e6f85939f69d2a1c759fc2e00077c53aab3a6cd64a18f53258a5d86c1bb7e82f01ec5cce03180db4bf216deabaf1d8f2a228e
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUV:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmakqpp.exe

Path C:\Windows\System\Pmakqpp.exe
Size 1.3MB
SHA256 6b9a525e02d06259f8cfeaec2f8d3521cd8d78227661bf50cd8c3f666e01eb71
MD5 53843a57e75eec519b3a5c6ef69afc71
SHA1 4f68a0848eecc3189dc0507802e0e5b65223d724
SHA512 222d867667e6868297ba4f46a0313514c3d6c61a5f4a9ba5fea546afeefa0c0a0a4ac6f3eeb9c28ea3c651bebc5088f2b8e06145773b8453ca42b349349cdeab
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUT:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVD
MD5 SHA1 SHA512 SSDEEP

Submit Download

QFPCcDi.exe

Path C:\Windows\System\QFPCcDi.exe
Size 1.3MB
SHA256 951456854a95ff3ddbebe0b5e6e17f0d2a0d3278721f25472261178cbdc891fb
MD5 c6753d03257edac8e6fe2d46819795a2
SHA1 7fd297acb40981cfd7497247ea80d76de96d8f12
SHA512 d0a35a868e4c649f799abcf55f10372d179648448c74b0ece369eae747eec343d83a7c4e7ca35c64c01b723db76eef8830ba72c303d8de02fd46c0d45a52a671
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUm:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV2
MD5 SHA1 SHA512 SSDEEP

Submit Download

RSxRmrf.exe

Path C:\Windows\System\RSxRmrf.exe
Size 1.3MB
SHA256 dcb42235ef5fa4ee95d7cb24682ad99e4960795c1662d483cfd8aa32852771fd
MD5 ff319e6a494ed8fe6c44011fd5b89fb3
SHA1 e0ff74f5ff064ab99dfa10f6cee6303d771d2e89
SHA512 46d027b1a8e50c9d0c16e88b98e379403739896ff2a859ea112d74548675604ee4fa6b865913b64f46145274285469b82c198024cb3256314cec7f7f80881f9d
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUB:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

WFyMbqe.exe

Path C:\Windows\System\WFyMbqe.exe
Size 1.3MB
SHA256 34c7fe505740f33ab030357c0729a5bafbe4919a981a0988157dcd12c7b57403
MD5 3d980ae70f6485758cfcbd1b3b5ae1c1
SHA1 62a03c072e9818f7e32928851cbf5e2da73f5956
SHA512 1251d0e272118bfd0bee12a1ab9380ceacf45ca857b23c1173ff788eb9d997c9aa8645b113eef0512c18372068a463e13c74e044a88598aec491fce4ae6b2463
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUm:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV2
MD5 SHA1 SHA512 SSDEEP

Submit Download

YDuEETq.exe

Path C:\Windows\System\YDuEETq.exe
Size 1.3MB
SHA256 1c98f98f043b647229aa80bbf9444246e86f2302f77e9a6b95e9a1bbd14cc9a5
MD5 1bf2241469ce27322a39a6d8b06255b2
SHA1 9088dd51083fc9d709bd3f6b50548fbdb1773ff1
SHA512 689da897060823f693083229b2a655d72f8e57eed9d9229f03d5a4537f4b5d2cc114816592108d5457d75186aafd19cd75f857b705a30758bc4a07ab7a1f547a
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUZ:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVp
MD5 SHA1 SHA512 SSDEEP

Submit Download

YdWJqOn.exe

Path C:\Windows\System\YdWJqOn.exe
Size 1.3MB
SHA256 c38f59cbda6853b1311a2f6595d33c14f37e952ab73d329a6828d6e832e8e64a
MD5 94b440abb84f0e6520cb0d8538368c8a
SHA1 42aabc76a54dffc7d5ce399db18b37359b1774fb
SHA512 0d2268461d3d3992edfa264e18edd6b168e27d77f45512cb99c76e17efbaafd0f38282dc9f3105624224782e88cb290695206dac8355db7d5eaa6edaca510c35
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUH:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZwvHyhU.exe

Path C:\Windows\System\ZwvHyhU.exe
Size 1.3MB
SHA256 cce02bb95513aeecd256f56634a5d8865b4be021ea2b5884fbe24cee97e47220
MD5 a0d91ce045297cf3bb2b63a0b1382563
SHA1 55a662344e8ccba6b7b2a44579a5c131b2c25051
SHA512 7763cb84a792ca522381eb55d3fef25ba2a15255afd3d98b81ff02d3b3cf48ef1ce8550bdd8b6588b19fa3bad80420014b2ac93c786cb4c405ca86e8334735ca
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUY:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVI
MD5 SHA1 SHA512 SSDEEP

Submit Download

cwMKDhr.exe

Path C:\Windows\System\cwMKDhr.exe
Size 1.3MB
SHA256 62c38bcfe1e324ff1fe3388a1584812700800e69f1c4157cf4f3f455205afced
MD5 6fe1a40b45e93df6ffe0d7b576ddfac9
SHA1 a5c4b6b5a405e855156c663f9ed05ff87061b7d1
SHA512 33535f67251e5bcaa60a06d5bd0acf1c95b2cebfc0777020190de5f5297afb7c4e10670e0f317c71f4da9596ed3ec90cf6da78c83e972260b983f0801c744b9d
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUw:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVg
MD5 SHA1 SHA512 SSDEEP

Submit Download

hUnsNsc.exe

Path C:\Windows\System\hUnsNsc.exe
Size 1.3MB
SHA256 eb6f9d497f4ac69a53b963b6948dbaa64a91902483078653b03ad8b72be85574
MD5 b2e5d4354e955497263aa4a2d95a9016
SHA1 220288a9a2b93ebedfd29a55883e5f560f7be97a
SHA512 6adfdaafa9fa349f48010ec0bbc3700a8ecab1ed5f062e689b5b082e222c172c471b57b4368e0052c2cfaaaf2c5b79a8aa3ee24db48f80433f68f25b65489eeb
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUN:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV9
MD5 SHA1 SHA512 SSDEEP

Submit Download

htNFBeg.exe

Path C:\Windows\System\htNFBeg.exe
Size 1.3MB
SHA256 0a567c565f035ea3b216edf89844d046ef07351a472e4bb3b9d35d5697a56789
MD5 885b80e1181631ccf04733c1188e2054
SHA1 bcb0743b135042359459d5a6d4889444be679a39
SHA512 b2b5cee7cb30b8a41e4f6a42ac6e0d241b3bc22accb1c761a48aa62690bbbf08c0426bb98d4800ba22f090a94a0fe62cb7265b48bd6c60029aec1fbfcd80ef5d
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUp:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

oDTHgLk.exe

Path C:\Windows\System\oDTHgLk.exe
Size 1.3MB
SHA256 a0c39cc2b3fd643ed8c1b6dba6afc16ac2863b093054ed7f2bcece8c1450e5c5
MD5 bf0025d1fe5fb71187db388894d8ca2e
SHA1 14c0ff7ceec73f148fd1a745f502113ccf1ff7c1
SHA512 3fd1495833104a0751135023808850864d94193a7081ae9a9b2b67182e140c9f998977145edbc1158a5d9fa81bd5dd620df159309969887d1c89224f4101a786
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcU0:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVE
MD5 SHA1 SHA512 SSDEEP

Submit Download

pFpQvbZ.exe

Path C:\Windows\System\pFpQvbZ.exe
Size 1.3MB
SHA256 a6e3277eb39d9fb0af2ca84a233aad9951ab1d93ea93a34c16bbbe3e7bfe8bba
MD5 bb93e5faad7261f13bf856f0e43f80aa
SHA1 4e8ef24e9bca517fcf6f2db5edf5f72c7473ee62
SHA512 297b993d961875e0cb6b5bc46deb1e5bacb0815c37b720b7a8ab9bb937e4854fb8c7b18d0d8e92f128e59f04c7b5d2cd82922f0c7f2a0cd5165f98e831803bc2
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUF:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVV
MD5 SHA1 SHA512 SSDEEP

Submit Download

pptaofn.exe

Path C:\Windows\System\pptaofn.exe
Size 1.3MB
SHA256 f37e21860945b6b23d80d469512cba5add858146566faa9fc3ac4af461236739
MD5 9a083ce031f2dc8e863eec23ed648711
SHA1 8f6edaee457f371aa183ac3cf6df1e017b6b5430
SHA512 3d57631e61f13853790771429df59d78ed8a3139a1f3c12bd91745af2fa861809629d69e5e9c527bfe5d880acb6596d351b8d865936ed9d4dd4013d5a8a07503
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUs:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVc
MD5 SHA1 SHA512 SSDEEP

Submit Download

qaQNGQa.exe

Path C:\Windows\System\qaQNGQa.exe
Size 1.3MB
SHA256 5bbda70d746aa12e33089010a6d967fd5c2da5c86bc488c1a4b13c7d414aa201
MD5 c04126e4e1d2fe5fc832a15ecb5915af
SHA1 2df834ba7eeb8e74416ddf441ae967eb2f6763ee
SHA512 be6e801d847a3b67e450f1a9cc6bba08b7139f2877731dbff0b1ef2987f0e286c1001666822ab2ded7d59bab472f61ca83e03d59b701f3d649eb3c332f3e22cc
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUh:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcnrPly.exe

Path C:\Windows\System\vcnrPly.exe
Size 1.3MB
SHA256 0af6b9721e194678d6ba2ee20494e578157a444c95ed6e9679a00b16bf9f3211
MD5 e4b45795b73c6fbf3d698d1ad3226d35
SHA1 d824a62d09c78ce0f85b4a48b673de8383203414
SHA512 5b805cf42cc597fae230dc63c47ee6b8e7959296a35f37bec9b935ac9295e63acdf7da6d77d765fee5f485c8a8891ece41890435fac16e4c07dd6598af3addb5
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcU5:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVp
MD5 SHA1 SHA512 SSDEEP

Submit Download

vkiOreb.exe

Path C:\Windows\System\vkiOreb.exe
Size 1.3MB
SHA256 5baa778254ffb405d5345c611bfae83305e8e55a5cf7c4481773d728de4272e0
MD5 d824d0f7e982daa49f6deb041fd06a1f
SHA1 b0c98caee225f0685af15684659334896b4aa1e6
SHA512 0284f4ec0c395ad1a83c6a1624980b6d1e3967faada8a0aa0f405f1f4addaa07b8cd708f65a2cb39e3ab17ef2db0c1e0b749e1ccb1f1c1f6e95d67bf0164499f
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUh:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

vlJNWNt.exe

Path C:\Windows\System\vlJNWNt.exe
Size 1.3MB
SHA256 0718225cb3215732dcb9005002f948e0009b14df4303e636e0170041bc28a742
MD5 3ca3f0c9db82a82049c5060f3ac0276b
SHA1 2df4ba95b8f0b1bc6e964869db284469d2160918
SHA512 8953e9f08fe1eee3c5abfe46d7f92bf44683a66d63413402a25ec08c7c626270bb09ca7dcc8d9171ea3ae802605bae7ddff7c51e087569807637f7547819a801
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUe:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVO
MD5 SHA1 SHA512 SSDEEP

Submit Download

wOGgvyB.exe

Path C:\Windows\System\wOGgvyB.exe
Size 1.3MB
SHA256 950e2a7ee956ebea196d6119cc5f7d637b2543a1a323565c40576c7c92fb4ada
MD5 16c42f143e6850e0400c54ed8b4f099f
SHA1 a99cc0ca7d8445319ed083197ed1586fa55901b4
SHA512 01bae88fbfdd76bff9b2ca11a80ef6a8f6c745675f05049622211437873df93f4ecf9d6942a2dd783fa628cd079a2eb2025eb96b12bc598929478c94c00dd193
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUW:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnNLpfw.exe

Path C:\Windows\System\wnNLpfw.exe
Size 1.3MB
SHA256 58cf1b89e99e98caea0aa244870b909aaf3f556d7a0ff058f6bdb4b542d7bdd3
MD5 89a8d9dfc5da6dfeb8e9ad2721d31895
SHA1 bd75b340f8ad6d24064e8790897385427bdeec0e
SHA512 aa43d9aae0e5d368eb3a49982b15b3d4190c2e51fb39ddcab505335a34fbbf8e704ba4796a8131c4c3ef0065678b3ee0970ada34bd331fb67749bc63246b1428
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUU:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVE
MD5 SHA1 SHA512 SSDEEP

Submit Download

xOjrQKI.exe

Path C:\Windows\System\xOjrQKI.exe
Size 1.3MB
SHA256 1398ef527b34a627b9ef514155f66efc66eda04c029fd46432c86998f5b41901
MD5 c736e5280cf6cf4607a9e19515451f6c
SHA1 0f4d85c5aee70383186d15afa074a35f25447953
SHA512 70583970df5c1085758f9ea68184af92328db53b44b78ff3f18c0c3b2d088321a289ed78e4c051918a37506a16fc746027d78b4ec9159ed7c683acb77879804d
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUR:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVB
MD5 SHA1 SHA512 SSDEEP

Submit Download

yYEfsaT.exe

Path C:\Windows\System\yYEfsaT.exe
Size 1.3MB
SHA256 092c4e891fc6fb347e3547d8d90a0ce52509331d89aceb254fc76787980dd3b6
MD5 4c3b75a519835df2a435929841a5a1f9
SHA1 cdda1326a1f92e2026996623601097da9f1f374a
SHA512 044774ee971bbee8de0e111269ab58bb0c3664cbf09283fb6d2f9c7d434a0b0978c152b1490d3d1d047afd275c5a13bca0014cc1d7ee4015d7192e332a3e56bc
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUR:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVh
MD5 SHA1 SHA512 SSDEEP

Submit Download

yjqoayN.exe

Path C:\Windows\System\yjqoayN.exe
Size 1.3MB
SHA256 5fc0cf4c35d119001d0b36893d77650d2d7d1d16ab9e091b7d453302c12fa1e1
MD5 120269667620268da6e0caa452991205
SHA1 7cec713080f02e721bc13f6337288f8e7b67880a
SHA512 ee2d3f9b9ba923075a562108d4931a62fd6a8484ca17427525d971742624b171454fb94a9c71ea884c22b9b181d5f036c41b95c4408ac168b0e702df9b9cb0c3
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUV:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

yobIPsE.exe

Path C:\Windows\System\yobIPsE.exe
Size 1.3MB
SHA256 791d3bb82dfb9fcc2cf7d82abe591ea26ea4e99f970df9dfaf1ca9e786658a30
MD5 d6a73f428b7dac366025e0112ef0bd18
SHA1 96472c0209281325ec3f50630da6e05813758063
SHA512 5d565e9235aabeb6119d18d5f6121da121e8490a0b47b768a82f040d3e86ac435829a1a51e75c694bfd4c7d874e78869da14dee3872f6de2515cbf22b5d3a3f3
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUl:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4832-0-0x0000020F4DB40000-0x0000020F4DB50000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads