xmrig | 149749e2c3ce32b5a35648075a4be79139a0e0295d17a6be505571057758d5ce

Analysis

max time kernel
120s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
Size 1.6MB
Sample240528-bfp4csaa27
SHA256 149749e2c3ce32b5a35648075a4be79139a0e0295d17a6be505571057758d5ce
MD5 2aa62efbf9e02813ea445888f01b6b90
SHA1 a48d9d015efccc81f77fd065ed47b73cad2823ee
SHA512 56fab6b2d1885975b796ff589a00fbdf85525649358befcec04ac5dadeb30a9746a46032fe2d8b2b7bf501f30dff9cbc2c62aa8145cfec32d39bbb98f2e65cb2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiS:GemTLkNdfE0pZax
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0005000000023276-4.dat	xmrig
behavioral2/files/0x00070000000233cb-8.dat	xmrig
behavioral2/files/0x00080000000233c7-10.dat	xmrig
behavioral2/files/0x00070000000233cd-23.dat	xmrig
behavioral2/files/0x00070000000233ce-28.dat	xmrig
behavioral2/files/0x00070000000233cf-33.dat	xmrig
behavioral2/files/0x00070000000233cc-20.dat	xmrig
behavioral2/files/0x00070000000233d0-38.dat	xmrig
behavioral2/files/0x00070000000233d2-47.dat	xmrig
behavioral2/files/0x00070000000233d3-50.dat	xmrig
behavioral2/files/0x00070000000233d4-54.dat	xmrig
behavioral2/files/0x00070000000233d5-63.dat	xmrig
behavioral2/files/0x00070000000233d7-69.dat	xmrig
behavioral2/files/0x00070000000233d9-83.dat	xmrig
behavioral2/files/0x00070000000233de-113.dat	xmrig
behavioral2/files/0x00070000000233e0-123.dat	xmrig
behavioral2/files/0x00070000000233e8-157.dat	xmrig
behavioral2/files/0x00070000000233e9-162.dat	xmrig
behavioral2/files/0x00070000000233e7-160.dat	xmrig
behavioral2/files/0x00070000000233e6-155.dat	xmrig
behavioral2/files/0x00070000000233e5-150.dat	xmrig
behavioral2/files/0x00070000000233e4-140.dat	xmrig
behavioral2/files/0x00070000000233e3-137.dat	xmrig
behavioral2/files/0x00070000000233e2-133.dat	xmrig
behavioral2/files/0x00070000000233e1-128.dat	xmrig
behavioral2/files/0x00070000000233df-118.dat	xmrig
behavioral2/files/0x00070000000233dd-108.dat	xmrig
behavioral2/files/0x00080000000233c8-103.dat	xmrig
behavioral2/files/0x00070000000233dc-98.dat	xmrig
behavioral2/files/0x00070000000233db-93.dat	xmrig
behavioral2/files/0x00070000000233da-88.dat	xmrig
behavioral2/files/0x00070000000233d8-77.dat	xmrig
behavioral2/files/0x00070000000233d6-67.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3532	vRSbRxj.exe
3544	YSGfdfy.exe
4356	isMPdgQ.exe
1224	RDApnID.exe
3520	BuTqHfO.exe
1452	GCtmVSk.exe
1620	ilntyil.exe
2540	NMEQZMF.exe
2872	eGmqUEE.exe
1860	oIsJaMG.exe
5112	dOFjheA.exe
3392	fUVzfeA.exe
1852	trXtBKh.exe
4792	fxlORoW.exe
1264	VuEVcjs.exe
3460	mqNUZCi.exe
4576	GdpRKjR.exe
4984	XHQgpZf.exe
568	rdzuLBt.exe
4480	ohonGfy.exe
2092	jmUutpe.exe
5084	qxQoduB.exe
2224	zroLcDx.exe
1160	JZGCXkx.exe
636	JXoniGC.exe
2868	IBqfHys.exe
632	UxZDOiW.exe
4868	MDsIwTc.exe
4484	eENnuLC.exe
2676	IXOoorr.exe
2060	GjDJcrS.exe
3080	ISALuOv.exe
4080	xpwagQn.exe
4880	IKCXLLs.exe
792	AnkXuEx.exe
64	mRLpqEr.exe
1248	MzOsuKc.exe
3792	BQaqvDR.exe
1732	YNQWrEh.exe
4012	AaMzkYW.exe
1320	bDsyoeE.exe
1084	xeoHUJX.exe
4640	eVcKndv.exe
2360	jlPwder.exe
4864	qlTqClD.exe
4732	ECqkoQo.exe
1960	fKvgQHP.exe
4460	wJxamSG.exe
2516	tvYvgPE.exe
4992	KTICDDN.exe
4336	KtbvFUv.exe
5024	CyufCsH.exe
2984	eFxtrkg.exe
4040	SpfuLry.exe
1188	KbntpFI.exe
4264	DkhEhjP.exe
4064	YYSaMVI.exe
3732	oYMVKyz.exe
4712	LRuRisH.exe
712	DjKoBPJ.exe
5064	rPojfcs.exe
2232	qoZTkXA.exe
1028	RVMPgyE.exe
3132	FfvyZXP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mqNUZCi.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\mRLpqEr.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\xtWfego.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\LMuXzJh.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\YjScyIB.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\AnkXuEx.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\mxLoZhe.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\dtvZtgk.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\IlyriKM.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\ZaffFct.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\thFqeIS.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\EBGmmfP.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\sGCPZNe.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\TJCgLrX.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\DRkvzuO.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\VuLZKxP.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\GnCHrWt.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\eNgZsbY.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\NCLcGlk.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\DNahYNg.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\VJpkkmG.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\yXafQpg.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\tmBOccZ.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\ePOmFfw.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\YElGOLm.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\bWVftOz.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\gYEhyqz.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\dtAQkcm.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\lVwClHi.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\nvNdosy.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\rhWbxfK.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\gRrzrpn.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\TcUXIdk.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\PaAWuLW.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\JmfhbtD.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\aUOPXXu.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\COQGKQa.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\UTFsFCS.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\OamCkTD.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\AaMzkYW.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\ozWyKjd.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\LYUigYe.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\goJsYPI.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\VNbthdp.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\zppLTrF.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\stcEeoT.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\qakYWvd.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\hMDIMGB.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\bkYPgSA.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\UqKqphs.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\qaYltXY.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\YlQHUgU.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\tJtReOD.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\xUXSRMv.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\xttCQxF.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\KzNnNRo.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\XDbRkgb.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\lLOEjyq.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\fLbwEUM.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\WRFsMAb.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\gUoxdbN.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\lhgjVXw.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\isMPdgQ.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
File created	C:\Windows\System\iycGbMI.exe	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17168	dwm.exe
Token: SeChangeNotifyPrivilege	17168	dwm.exe
Token: 33	17168	dwm.exe
Token: SeIncBasePriorityPrivilege	17168	dwm.exe
Token: SeShutdownPrivilege	17168	dwm.exe
Token: SeCreatePagefilePrivilege	17168	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3532	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	83
PID 2348 wrote to memory of 3532	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	83
PID 2348 wrote to memory of 3544	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	84
PID 2348 wrote to memory of 3544	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	84
PID 2348 wrote to memory of 4356	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	85
PID 2348 wrote to memory of 4356	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	85
PID 2348 wrote to memory of 1224	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	86
PID 2348 wrote to memory of 1224	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	86
PID 2348 wrote to memory of 3520	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	87
PID 2348 wrote to memory of 3520	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	87
PID 2348 wrote to memory of 1452	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	88
PID 2348 wrote to memory of 1452	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	88
PID 2348 wrote to memory of 1620	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	89
PID 2348 wrote to memory of 1620	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	89
PID 2348 wrote to memory of 2540	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	90
PID 2348 wrote to memory of 2540	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	90
PID 2348 wrote to memory of 2872	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	91
PID 2348 wrote to memory of 2872	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	91
PID 2348 wrote to memory of 1860	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	92
PID 2348 wrote to memory of 1860	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	92
PID 2348 wrote to memory of 5112	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	93
PID 2348 wrote to memory of 5112	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	93
PID 2348 wrote to memory of 3392	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	94
PID 2348 wrote to memory of 3392	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	94
PID 2348 wrote to memory of 1852	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	95
PID 2348 wrote to memory of 1852	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	95
PID 2348 wrote to memory of 4792	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	96
PID 2348 wrote to memory of 4792	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	96
PID 2348 wrote to memory of 1264	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	97
PID 2348 wrote to memory of 1264	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	97
PID 2348 wrote to memory of 3460	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	98
PID 2348 wrote to memory of 3460	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	98
PID 2348 wrote to memory of 4576	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	99
PID 2348 wrote to memory of 4576	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	99
PID 2348 wrote to memory of 4984	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	100
PID 2348 wrote to memory of 4984	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	100
PID 2348 wrote to memory of 568	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	101
PID 2348 wrote to memory of 568	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	101
PID 2348 wrote to memory of 4480	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	102
PID 2348 wrote to memory of 4480	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	102
PID 2348 wrote to memory of 2092	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	103
PID 2348 wrote to memory of 2092	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	103
PID 2348 wrote to memory of 5084	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	104
PID 2348 wrote to memory of 5084	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	104
PID 2348 wrote to memory of 2224	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	105
PID 2348 wrote to memory of 2224	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	105
PID 2348 wrote to memory of 1160	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	106
PID 2348 wrote to memory of 1160	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	106
PID 2348 wrote to memory of 636	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	107
PID 2348 wrote to memory of 636	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	107
PID 2348 wrote to memory of 2868	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	108
PID 2348 wrote to memory of 2868	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	108
PID 2348 wrote to memory of 632	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	109
PID 2348 wrote to memory of 632	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	109
PID 2348 wrote to memory of 4868	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	110
PID 2348 wrote to memory of 4868	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	110
PID 2348 wrote to memory of 4484	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	111
PID 2348 wrote to memory of 4484	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	111
PID 2348 wrote to memory of 2676	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	112
PID 2348 wrote to memory of 2676	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	112
PID 2348 wrote to memory of 2060	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	113
PID 2348 wrote to memory of 2060	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	113
PID 2348 wrote to memory of 3080	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	114
PID 2348 wrote to memory of 3080	2348	2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2aa62efbf9e02813ea445888f01b6b90_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\System\vRSbRxj.exe
  C:\Windows\System\vRSbRxj.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\YSGfdfy.exe
  C:\Windows\System\YSGfdfy.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\isMPdgQ.exe
  C:\Windows\System\isMPdgQ.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\RDApnID.exe
  C:\Windows\System\RDApnID.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\BuTqHfO.exe
  C:\Windows\System\BuTqHfO.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\GCtmVSk.exe
  C:\Windows\System\GCtmVSk.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\ilntyil.exe
  C:\Windows\System\ilntyil.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\NMEQZMF.exe
  C:\Windows\System\NMEQZMF.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\eGmqUEE.exe
  C:\Windows\System\eGmqUEE.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\oIsJaMG.exe
  C:\Windows\System\oIsJaMG.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\dOFjheA.exe
  C:\Windows\System\dOFjheA.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\fUVzfeA.exe
  C:\Windows\System\fUVzfeA.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\trXtBKh.exe
  C:\Windows\System\trXtBKh.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\fxlORoW.exe
  C:\Windows\System\fxlORoW.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\VuEVcjs.exe
  C:\Windows\System\VuEVcjs.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\mqNUZCi.exe
  C:\Windows\System\mqNUZCi.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\GdpRKjR.exe
  C:\Windows\System\GdpRKjR.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\XHQgpZf.exe
  C:\Windows\System\XHQgpZf.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\rdzuLBt.exe
  C:\Windows\System\rdzuLBt.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\ohonGfy.exe
  C:\Windows\System\ohonGfy.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\jmUutpe.exe
  C:\Windows\System\jmUutpe.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\qxQoduB.exe
  C:\Windows\System\qxQoduB.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\zroLcDx.exe
  C:\Windows\System\zroLcDx.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\JZGCXkx.exe
  C:\Windows\System\JZGCXkx.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\JXoniGC.exe
  C:\Windows\System\JXoniGC.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\IBqfHys.exe
  C:\Windows\System\IBqfHys.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\UxZDOiW.exe
  C:\Windows\System\UxZDOiW.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\MDsIwTc.exe
  C:\Windows\System\MDsIwTc.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\eENnuLC.exe
  C:\Windows\System\eENnuLC.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\IXOoorr.exe
  C:\Windows\System\IXOoorr.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\GjDJcrS.exe
  C:\Windows\System\GjDJcrS.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\ISALuOv.exe
  C:\Windows\System\ISALuOv.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\xpwagQn.exe
  C:\Windows\System\xpwagQn.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\IKCXLLs.exe
  C:\Windows\System\IKCXLLs.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\AnkXuEx.exe
  C:\Windows\System\AnkXuEx.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\mRLpqEr.exe
  C:\Windows\System\mRLpqEr.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\MzOsuKc.exe
  C:\Windows\System\MzOsuKc.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\BQaqvDR.exe
  C:\Windows\System\BQaqvDR.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\YNQWrEh.exe
  C:\Windows\System\YNQWrEh.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\AaMzkYW.exe
  C:\Windows\System\AaMzkYW.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\bDsyoeE.exe
  C:\Windows\System\bDsyoeE.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\xeoHUJX.exe
  C:\Windows\System\xeoHUJX.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\eVcKndv.exe
  C:\Windows\System\eVcKndv.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\jlPwder.exe
  C:\Windows\System\jlPwder.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\qlTqClD.exe
  C:\Windows\System\qlTqClD.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\ECqkoQo.exe
  C:\Windows\System\ECqkoQo.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\fKvgQHP.exe
  C:\Windows\System\fKvgQHP.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\wJxamSG.exe
  C:\Windows\System\wJxamSG.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\tvYvgPE.exe
  C:\Windows\System\tvYvgPE.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\KTICDDN.exe
  C:\Windows\System\KTICDDN.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\KtbvFUv.exe
  C:\Windows\System\KtbvFUv.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\CyufCsH.exe
  C:\Windows\System\CyufCsH.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\eFxtrkg.exe
  C:\Windows\System\eFxtrkg.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\SpfuLry.exe
  C:\Windows\System\SpfuLry.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\KbntpFI.exe
  C:\Windows\System\KbntpFI.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\DkhEhjP.exe
  C:\Windows\System\DkhEhjP.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\YYSaMVI.exe
  C:\Windows\System\YYSaMVI.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\oYMVKyz.exe
  C:\Windows\System\oYMVKyz.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\LRuRisH.exe
  C:\Windows\System\LRuRisH.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\DjKoBPJ.exe
  C:\Windows\System\DjKoBPJ.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\rPojfcs.exe
  C:\Windows\System\rPojfcs.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\qoZTkXA.exe
  C:\Windows\System\qoZTkXA.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\RVMPgyE.exe
  C:\Windows\System\RVMPgyE.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\FfvyZXP.exe
  C:\Windows\System\FfvyZXP.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\yGeYXxB.exe
  C:\Windows\System\yGeYXxB.exe
  2⤵
  PID:4816
- C:\Windows\System\QYWVpRf.exe
  C:\Windows\System\QYWVpRf.exe
  2⤵
  PID:3984
- C:\Windows\System\rDzeMmI.exe
  C:\Windows\System\rDzeMmI.exe
  2⤵
  PID:1604
- C:\Windows\System\VcvcuYL.exe
  C:\Windows\System\VcvcuYL.exe
  2⤵
  PID:1228
- C:\Windows\System\fFiEfyv.exe
  C:\Windows\System\fFiEfyv.exe
  2⤵
  PID:3180
- C:\Windows\System\OHUlFVW.exe
  C:\Windows\System\OHUlFVW.exe
  2⤵
  PID:2388
- C:\Windows\System\zNcIwAf.exe
  C:\Windows\System\zNcIwAf.exe
  2⤵
  PID:1496
- C:\Windows\System\ZbNfAAP.exe
  C:\Windows\System\ZbNfAAP.exe
  2⤵
  PID:2440
- C:\Windows\System\XHrRfrt.exe
  C:\Windows\System\XHrRfrt.exe
  2⤵
  PID:4424
- C:\Windows\System\prdyeKx.exe
  C:\Windows\System\prdyeKx.exe
  2⤵
  PID:4112
- C:\Windows\System\fRZKbVe.exe
  C:\Windows\System\fRZKbVe.exe
  2⤵
  PID:3380
- C:\Windows\System\wCJirOx.exe
  C:\Windows\System\wCJirOx.exe
  2⤵
  PID:4320
- C:\Windows\System\nVCxvev.exe
  C:\Windows\System\nVCxvev.exe
  2⤵
  PID:992
- C:\Windows\System\MSAORgx.exe
  C:\Windows\System\MSAORgx.exe
  2⤵
  PID:4496
- C:\Windows\System\RAQAcqG.exe
  C:\Windows\System\RAQAcqG.exe
  2⤵
  PID:4304
- C:\Windows\System\MfGpaah.exe
  C:\Windows\System\MfGpaah.exe
  2⤵
  PID:2172
- C:\Windows\System\NpzCGeo.exe
  C:\Windows\System\NpzCGeo.exe
  2⤵
  PID:4924
- C:\Windows\System\dnYyCdC.exe
  C:\Windows\System\dnYyCdC.exe
  2⤵
  PID:1436
- C:\Windows\System\MJEQxTp.exe
  C:\Windows\System\MJEQxTp.exe
  2⤵
  PID:4824
- C:\Windows\System\xiTfpQE.exe
  C:\Windows\System\xiTfpQE.exe
  2⤵
  PID:4968
- C:\Windows\System\fnuLRGM.exe
  C:\Windows\System\fnuLRGM.exe
  2⤵
  PID:4916
- C:\Windows\System\mpFVYYL.exe
  C:\Windows\System\mpFVYYL.exe
  2⤵
  PID:5140
- C:\Windows\System\oWMGYBg.exe
  C:\Windows\System\oWMGYBg.exe
  2⤵
  PID:5168
- C:\Windows\System\Sgvtmci.exe
  C:\Windows\System\Sgvtmci.exe
  2⤵
  PID:5192
- C:\Windows\System\tcUiDJv.exe
  C:\Windows\System\tcUiDJv.exe
  2⤵
  PID:5224
- C:\Windows\System\wUYhsDz.exe
  C:\Windows\System\wUYhsDz.exe
  2⤵
  PID:5252
- C:\Windows\System\QDWLqhn.exe
  C:\Windows\System\QDWLqhn.exe
  2⤵
  PID:5280
- C:\Windows\System\SBSjLqO.exe
  C:\Windows\System\SBSjLqO.exe
  2⤵
  PID:5308
- C:\Windows\System\iVsYpqr.exe
  C:\Windows\System\iVsYpqr.exe
  2⤵
  PID:5336
- C:\Windows\System\FuwUfjG.exe
  C:\Windows\System\FuwUfjG.exe
  2⤵
  PID:5364
- C:\Windows\System\OXRfhIU.exe
  C:\Windows\System\OXRfhIU.exe
  2⤵
  PID:5392
- C:\Windows\System\eRfPKMT.exe
  C:\Windows\System\eRfPKMT.exe
  2⤵
  PID:5420
- C:\Windows\System\FdRAkwH.exe
  C:\Windows\System\FdRAkwH.exe
  2⤵
  PID:5448
- C:\Windows\System\tjcjeMz.exe
  C:\Windows\System\tjcjeMz.exe
  2⤵
  PID:5472
- C:\Windows\System\rWhEgWw.exe
  C:\Windows\System\rWhEgWw.exe
  2⤵
  PID:5504
- C:\Windows\System\jVkxDft.exe
  C:\Windows\System\jVkxDft.exe
  2⤵
  PID:5532
- C:\Windows\System\aAlWGDa.exe
  C:\Windows\System\aAlWGDa.exe
  2⤵
  PID:5560
- C:\Windows\System\qLHltad.exe
  C:\Windows\System\qLHltad.exe
  2⤵
  PID:5588
- C:\Windows\System\YlQHUgU.exe
  C:\Windows\System\YlQHUgU.exe
  2⤵
  PID:5616
- C:\Windows\System\ZcfPRpY.exe
  C:\Windows\System\ZcfPRpY.exe
  2⤵
  PID:5644
- C:\Windows\System\Shcsuql.exe
  C:\Windows\System\Shcsuql.exe
  2⤵
  PID:5672
- C:\Windows\System\KHacdNb.exe
  C:\Windows\System\KHacdNb.exe
  2⤵
  PID:5688
- C:\Windows\System\XeQhKKK.exe
  C:\Windows\System\XeQhKKK.exe
  2⤵
  PID:5716
- C:\Windows\System\TAGBYrM.exe
  C:\Windows\System\TAGBYrM.exe
  2⤵
  PID:5752
- C:\Windows\System\VKwEzRZ.exe
  C:\Windows\System\VKwEzRZ.exe
  2⤵
  PID:5784
- C:\Windows\System\rzsPAKy.exe
  C:\Windows\System\rzsPAKy.exe
  2⤵
  PID:5812
- C:\Windows\System\stcEeoT.exe
  C:\Windows\System\stcEeoT.exe
  2⤵
  PID:5840
- C:\Windows\System\NQWjTZW.exe
  C:\Windows\System\NQWjTZW.exe
  2⤵
  PID:5868
- C:\Windows\System\YVXsuhA.exe
  C:\Windows\System\YVXsuhA.exe
  2⤵
  PID:5896
- C:\Windows\System\GKiHywD.exe
  C:\Windows\System\GKiHywD.exe
  2⤵
  PID:5924
- C:\Windows\System\QodVlrf.exe
  C:\Windows\System\QodVlrf.exe
  2⤵
  PID:5952
- C:\Windows\System\EOeILbO.exe
  C:\Windows\System\EOeILbO.exe
  2⤵
  PID:5980
- C:\Windows\System\JvHtrvL.exe
  C:\Windows\System\JvHtrvL.exe
  2⤵
  PID:6008
- C:\Windows\System\qLpdvom.exe
  C:\Windows\System\qLpdvom.exe
  2⤵
  PID:6036
- C:\Windows\System\ePOmFfw.exe
  C:\Windows\System\ePOmFfw.exe
  2⤵
  PID:6064
- C:\Windows\System\ytEBjrv.exe
  C:\Windows\System\ytEBjrv.exe
  2⤵
  PID:6092
- C:\Windows\System\QktwFdt.exe
  C:\Windows\System\QktwFdt.exe
  2⤵
  PID:6124
- C:\Windows\System\fwLXUGz.exe
  C:\Windows\System\fwLXUGz.exe
  2⤵
  PID:4016
- C:\Windows\System\jtTxWKO.exe
  C:\Windows\System\jtTxWKO.exe
  2⤵
  PID:4384
- C:\Windows\System\DlzGqAX.exe
  C:\Windows\System\DlzGqAX.exe
  2⤵
  PID:5080
- C:\Windows\System\YqBKwfk.exe
  C:\Windows\System\YqBKwfk.exe
  2⤵
  PID:4748
- C:\Windows\System\lECWGsH.exe
  C:\Windows\System\lECWGsH.exe
  2⤵
  PID:5048
- C:\Windows\System\JDqGYWg.exe
  C:\Windows\System\JDqGYWg.exe
  2⤵
  PID:5124
- C:\Windows\System\XPKNNfY.exe
  C:\Windows\System\XPKNNfY.exe
  2⤵
  PID:5184
- C:\Windows\System\qEBqEFc.exe
  C:\Windows\System\qEBqEFc.exe
  2⤵
  PID:5244
- C:\Windows\System\nAFzaih.exe
  C:\Windows\System\nAFzaih.exe
  2⤵
  PID:5320
- C:\Windows\System\bFehEkO.exe
  C:\Windows\System\bFehEkO.exe
  2⤵
  PID:5380
- C:\Windows\System\yiBAovL.exe
  C:\Windows\System\yiBAovL.exe
  2⤵
  PID:5440
- C:\Windows\System\JXZRIVq.exe
  C:\Windows\System\JXZRIVq.exe
  2⤵
  PID:5496
- C:\Windows\System\AROcZDY.exe
  C:\Windows\System\AROcZDY.exe
  2⤵
  PID:5572
- C:\Windows\System\dtAQkcm.exe
  C:\Windows\System\dtAQkcm.exe
  2⤵
  PID:5628
- C:\Windows\System\DNahYNg.exe
  C:\Windows\System\DNahYNg.exe
  2⤵
  PID:5680
- C:\Windows\System\kJDKQgF.exe
  C:\Windows\System\kJDKQgF.exe
  2⤵
  PID:5744
- C:\Windows\System\QdfzDMP.exe
  C:\Windows\System\QdfzDMP.exe
  2⤵
  PID:5804
- C:\Windows\System\LHdVPBn.exe
  C:\Windows\System\LHdVPBn.exe
  2⤵
  PID:5852
- C:\Windows\System\reqiRgO.exe
  C:\Windows\System\reqiRgO.exe
  2⤵
  PID:3084
- C:\Windows\System\glKyymv.exe
  C:\Windows\System\glKyymv.exe
  2⤵
  PID:5968
- C:\Windows\System\dGxLRnk.exe
  C:\Windows\System\dGxLRnk.exe
  2⤵
  PID:6028
- C:\Windows\System\POGojyZ.exe
  C:\Windows\System\POGojyZ.exe
  2⤵
  PID:6104
- C:\Windows\System\ojqZobi.exe
  C:\Windows\System\ojqZobi.exe
  2⤵
  PID:2028
- C:\Windows\System\EZTAIkS.exe
  C:\Windows\System\EZTAIkS.exe
  2⤵
  PID:1424
- C:\Windows\System\upkULur.exe
  C:\Windows\System\upkULur.exe
  2⤵
  PID:1296
- C:\Windows\System\rzkAjrc.exe
  C:\Windows\System\rzkAjrc.exe
  2⤵
  PID:5212
- C:\Windows\System\Acktvby.exe
  C:\Windows\System\Acktvby.exe
  2⤵
  PID:5348
- C:\Windows\System\ZCQblUc.exe
  C:\Windows\System\ZCQblUc.exe
  2⤵
  PID:5468
- C:\Windows\System\WNINugN.exe
  C:\Windows\System\WNINugN.exe
  2⤵
  PID:5600
- C:\Windows\System\bxOeYZg.exe
  C:\Windows\System\bxOeYZg.exe
  2⤵
  PID:5728
- C:\Windows\System\eYkIPQB.exe
  C:\Windows\System\eYkIPQB.exe
  2⤵
  PID:1056
- C:\Windows\System\fJCAwyB.exe
  C:\Windows\System\fJCAwyB.exe
  2⤵
  PID:5936
- C:\Windows\System\OdHCvpv.exe
  C:\Windows\System\OdHCvpv.exe
  2⤵
  PID:6056
- C:\Windows\System\zxbvPBQ.exe
  C:\Windows\System\zxbvPBQ.exe
  2⤵
  PID:3968
- C:\Windows\System\QbycwMo.exe
  C:\Windows\System\QbycwMo.exe
  2⤵
  PID:1616
- C:\Windows\System\cgEMVFN.exe
  C:\Windows\System\cgEMVFN.exe
  2⤵
  PID:4928
- C:\Windows\System\PSkuBKe.exe
  C:\Windows\System\PSkuBKe.exe
  2⤵
  PID:4976
- C:\Windows\System\HDIHDfb.exe
  C:\Windows\System\HDIHDfb.exe
  2⤵
  PID:4360
- C:\Windows\System\LWHOnba.exe
  C:\Windows\System\LWHOnba.exe
  2⤵
  PID:4588
- C:\Windows\System\atNvaXw.exe
  C:\Windows\System\atNvaXw.exe
  2⤵
  PID:3344
- C:\Windows\System\SmejuOI.exe
  C:\Windows\System\SmejuOI.exe
  2⤵
  PID:2772
- C:\Windows\System\IzNRfsF.exe
  C:\Windows\System\IzNRfsF.exe
  2⤵
  PID:5796
- C:\Windows\System\gJTGvpj.exe
  C:\Windows\System\gJTGvpj.exe
  2⤵
  PID:4456
- C:\Windows\System\fzkDoYW.exe
  C:\Windows\System\fzkDoYW.exe
  2⤵
  PID:2016
- C:\Windows\System\ozWyKjd.exe
  C:\Windows\System\ozWyKjd.exe
  2⤵
  PID:4256
- C:\Windows\System\cKHyIpO.exe
  C:\Windows\System\cKHyIpO.exe
  2⤵
  PID:1876
- C:\Windows\System\ZCqQsKk.exe
  C:\Windows\System\ZCqQsKk.exe
  2⤵
  PID:6132
- C:\Windows\System\urucUVp.exe
  C:\Windows\System\urucUVp.exe
  2⤵
  PID:6160
- C:\Windows\System\xOUFOpB.exe
  C:\Windows\System\xOUFOpB.exe
  2⤵
  PID:6180
- C:\Windows\System\LgAIuNg.exe
  C:\Windows\System\LgAIuNg.exe
  2⤵
  PID:6204
- C:\Windows\System\rkWBiaq.exe
  C:\Windows\System\rkWBiaq.exe
  2⤵
  PID:6244
- C:\Windows\System\XCOaxpQ.exe
  C:\Windows\System\XCOaxpQ.exe
  2⤵
  PID:6272
- C:\Windows\System\PEsHDmB.exe
  C:\Windows\System\PEsHDmB.exe
  2⤵
  PID:6300
- C:\Windows\System\auDRzko.exe
  C:\Windows\System\auDRzko.exe
  2⤵
  PID:6316
- C:\Windows\System\FdObVgp.exe
  C:\Windows\System\FdObVgp.exe
  2⤵
  PID:6344
- C:\Windows\System\wsRjOXh.exe
  C:\Windows\System\wsRjOXh.exe
  2⤵
  PID:6368
- C:\Windows\System\MkXCadW.exe
  C:\Windows\System\MkXCadW.exe
  2⤵
  PID:6400
- C:\Windows\System\qakYWvd.exe
  C:\Windows\System\qakYWvd.exe
  2⤵
  PID:6432
- C:\Windows\System\fiMCqGq.exe
  C:\Windows\System\fiMCqGq.exe
  2⤵
  PID:6452
- C:\Windows\System\jIFpwrM.exe
  C:\Windows\System\jIFpwrM.exe
  2⤵
  PID:6488
- C:\Windows\System\DROxfMS.exe
  C:\Windows\System\DROxfMS.exe
  2⤵
  PID:6524
- C:\Windows\System\bKPRYJc.exe
  C:\Windows\System\bKPRYJc.exe
  2⤵
  PID:6540
- C:\Windows\System\MNDtSrh.exe
  C:\Windows\System\MNDtSrh.exe
  2⤵
  PID:6572
- C:\Windows\System\wVyABDv.exe
  C:\Windows\System\wVyABDv.exe
  2⤵
  PID:6596
- C:\Windows\System\xrhATWt.exe
  C:\Windows\System\xrhATWt.exe
  2⤵
  PID:6612
- C:\Windows\System\FTLdfsH.exe
  C:\Windows\System\FTLdfsH.exe
  2⤵
  PID:6648
- C:\Windows\System\gQzWPvJ.exe
  C:\Windows\System\gQzWPvJ.exe
  2⤵
  PID:6668
- C:\Windows\System\EJLUmnG.exe
  C:\Windows\System\EJLUmnG.exe
  2⤵
  PID:6684
- C:\Windows\System\ZYhvQcT.exe
  C:\Windows\System\ZYhvQcT.exe
  2⤵
  PID:6704
- C:\Windows\System\adrWiBd.exe
  C:\Windows\System\adrWiBd.exe
  2⤵
  PID:6732
- C:\Windows\System\UWVJHkE.exe
  C:\Windows\System\UWVJHkE.exe
  2⤵
  PID:6768
- C:\Windows\System\QLuOZSj.exe
  C:\Windows\System\QLuOZSj.exe
  2⤵
  PID:6792
- C:\Windows\System\GuVZJVR.exe
  C:\Windows\System\GuVZJVR.exe
  2⤵
  PID:6820
- C:\Windows\System\nOIXhHy.exe
  C:\Windows\System\nOIXhHy.exe
  2⤵
  PID:6848
- C:\Windows\System\thFqeIS.exe
  C:\Windows\System\thFqeIS.exe
  2⤵
  PID:6872
- C:\Windows\System\ODdOatm.exe
  C:\Windows\System\ODdOatm.exe
  2⤵
  PID:6908
- C:\Windows\System\mDiSMoy.exe
  C:\Windows\System\mDiSMoy.exe
  2⤵
  PID:6928
- C:\Windows\System\smRZUvt.exe
  C:\Windows\System\smRZUvt.exe
  2⤵
  PID:6960
- C:\Windows\System\ZqTHNPX.exe
  C:\Windows\System\ZqTHNPX.exe
  2⤵
  PID:6988
- C:\Windows\System\HnglxMJ.exe
  C:\Windows\System\HnglxMJ.exe
  2⤵
  PID:7052
- C:\Windows\System\biAzyem.exe
  C:\Windows\System\biAzyem.exe
  2⤵
  PID:7068
- C:\Windows\System\eTpofCG.exe
  C:\Windows\System\eTpofCG.exe
  2⤵
  PID:7088
- C:\Windows\System\GmacTFr.exe
  C:\Windows\System\GmacTFr.exe
  2⤵
  PID:7116
- C:\Windows\System\QQdGjqa.exe
  C:\Windows\System\QQdGjqa.exe
  2⤵
  PID:7148
- C:\Windows\System\AUhivkH.exe
  C:\Windows\System\AUhivkH.exe
  2⤵
  PID:2584
- C:\Windows\System\ZtmSiub.exe
  C:\Windows\System\ZtmSiub.exe
  2⤵
  PID:6220
- C:\Windows\System\wVCKmwu.exe
  C:\Windows\System\wVCKmwu.exe
  2⤵
  PID:6308
- C:\Windows\System\FdZrmJl.exe
  C:\Windows\System\FdZrmJl.exe
  2⤵
  PID:6396
- C:\Windows\System\COQGKQa.exe
  C:\Windows\System\COQGKQa.exe
  2⤵
  PID:6424
- C:\Windows\System\vhBtDLp.exe
  C:\Windows\System\vhBtDLp.exe
  2⤵
  PID:6496
- C:\Windows\System\znvQclU.exe
  C:\Windows\System\znvQclU.exe
  2⤵
  PID:6564
- C:\Windows\System\qFyXbqf.exe
  C:\Windows\System\qFyXbqf.exe
  2⤵
  PID:6660
- C:\Windows\System\EBGmmfP.exe
  C:\Windows\System\EBGmmfP.exe
  2⤵
  PID:6664
- C:\Windows\System\iGKQWYA.exe
  C:\Windows\System\iGKQWYA.exe
  2⤵
  PID:6680
- C:\Windows\System\eoZBQcP.exe
  C:\Windows\System\eoZBQcP.exe
  2⤵
  PID:6836
- C:\Windows\System\OCZjThy.exe
  C:\Windows\System\OCZjThy.exe
  2⤵
  PID:6952
- C:\Windows\System\AymsygK.exe
  C:\Windows\System\AymsygK.exe
  2⤵
  PID:6916
- C:\Windows\System\RFgiQae.exe
  C:\Windows\System\RFgiQae.exe
  2⤵
  PID:7012
- C:\Windows\System\saBScxq.exe
  C:\Windows\System\saBScxq.exe
  2⤵
  PID:7080
- C:\Windows\System\mxLoZhe.exe
  C:\Windows\System\mxLoZhe.exe
  2⤵
  PID:7104
- C:\Windows\System\eXyRbXy.exe
  C:\Windows\System\eXyRbXy.exe
  2⤵
  PID:6200
- C:\Windows\System\YgyIDRB.exe
  C:\Windows\System\YgyIDRB.exe
  2⤵
  PID:6364
- C:\Windows\System\sKaVprT.exe
  C:\Windows\System\sKaVprT.exe
  2⤵
  PID:6536
- C:\Windows\System\ASfQcgJ.exe
  C:\Windows\System\ASfQcgJ.exe
  2⤵
  PID:6752
- C:\Windows\System\ucgabVQ.exe
  C:\Windows\System\ucgabVQ.exe
  2⤵
  PID:6860
- C:\Windows\System\lrihfPM.exe
  C:\Windows\System\lrihfPM.exe
  2⤵
  PID:6900
- C:\Windows\System\zuspWFt.exe
  C:\Windows\System\zuspWFt.exe
  2⤵
  PID:7112
- C:\Windows\System\YgrTjGE.exe
  C:\Windows\System\YgrTjGE.exe
  2⤵
  PID:6636
- C:\Windows\System\joDkraN.exe
  C:\Windows\System\joDkraN.exe
  2⤵
  PID:6832
- C:\Windows\System\eXfuUGx.exe
  C:\Windows\System\eXfuUGx.exe
  2⤵
  PID:7084
- C:\Windows\System\EOOksAG.exe
  C:\Windows\System\EOOksAG.exe
  2⤵
  PID:7064
- C:\Windows\System\jNXxAei.exe
  C:\Windows\System\jNXxAei.exe
  2⤵
  PID:7188
- C:\Windows\System\kYFFpyi.exe
  C:\Windows\System\kYFFpyi.exe
  2⤵
  PID:7216
- C:\Windows\System\iycGbMI.exe
  C:\Windows\System\iycGbMI.exe
  2⤵
  PID:7244
- C:\Windows\System\lodRTUH.exe
  C:\Windows\System\lodRTUH.exe
  2⤵
  PID:7272
- C:\Windows\System\hMDIMGB.exe
  C:\Windows\System\hMDIMGB.exe
  2⤵
  PID:7296
- C:\Windows\System\EJbxBBw.exe
  C:\Windows\System\EJbxBBw.exe
  2⤵
  PID:7316
- C:\Windows\System\NDMQzLk.exe
  C:\Windows\System\NDMQzLk.exe
  2⤵
  PID:7340
- C:\Windows\System\NlmYEEp.exe
  C:\Windows\System\NlmYEEp.exe
  2⤵
  PID:7368
- C:\Windows\System\tHYPGmK.exe
  C:\Windows\System\tHYPGmK.exe
  2⤵
  PID:7416
- C:\Windows\System\uhFqfLE.exe
  C:\Windows\System\uhFqfLE.exe
  2⤵
  PID:7448
- C:\Windows\System\efjSgXY.exe
  C:\Windows\System\efjSgXY.exe
  2⤵
  PID:7468
- C:\Windows\System\cflulPG.exe
  C:\Windows\System\cflulPG.exe
  2⤵
  PID:7500
- C:\Windows\System\wILguXY.exe
  C:\Windows\System\wILguXY.exe
  2⤵
  PID:7524
- C:\Windows\System\VMAXdmm.exe
  C:\Windows\System\VMAXdmm.exe
  2⤵
  PID:7540
- C:\Windows\System\dnfiapE.exe
  C:\Windows\System\dnfiapE.exe
  2⤵
  PID:7568
- C:\Windows\System\sIWFOoK.exe
  C:\Windows\System\sIWFOoK.exe
  2⤵
  PID:7596
- C:\Windows\System\urRehkw.exe
  C:\Windows\System\urRehkw.exe
  2⤵
  PID:7624
- C:\Windows\System\DBQhjzV.exe
  C:\Windows\System\DBQhjzV.exe
  2⤵
  PID:7652
- C:\Windows\System\LExgCrj.exe
  C:\Windows\System\LExgCrj.exe
  2⤵
  PID:7692
- C:\Windows\System\aXQvvZU.exe
  C:\Windows\System\aXQvvZU.exe
  2⤵
  PID:7708
- C:\Windows\System\PaAWuLW.exe
  C:\Windows\System\PaAWuLW.exe
  2⤵
  PID:7740
- C:\Windows\System\DRmBBHP.exe
  C:\Windows\System\DRmBBHP.exe
  2⤵
  PID:7764
- C:\Windows\System\VIadYiN.exe
  C:\Windows\System\VIadYiN.exe
  2⤵
  PID:7804
- C:\Windows\System\UTFsFCS.exe
  C:\Windows\System\UTFsFCS.exe
  2⤵
  PID:7836
- C:\Windows\System\eOpgAnO.exe
  C:\Windows\System\eOpgAnO.exe
  2⤵
  PID:7860
- C:\Windows\System\LLdfQoo.exe
  C:\Windows\System\LLdfQoo.exe
  2⤵
  PID:7888
- C:\Windows\System\VRDFXis.exe
  C:\Windows\System\VRDFXis.exe
  2⤵
  PID:7904
- C:\Windows\System\YkXqOgG.exe
  C:\Windows\System\YkXqOgG.exe
  2⤵
  PID:7932
- C:\Windows\System\BiEeOFB.exe
  C:\Windows\System\BiEeOFB.exe
  2⤵
  PID:7964
- C:\Windows\System\NCEhivg.exe
  C:\Windows\System\NCEhivg.exe
  2⤵
  PID:7988
- C:\Windows\System\FwRAbNQ.exe
  C:\Windows\System\FwRAbNQ.exe
  2⤵
  PID:8016
- C:\Windows\System\lOxNcpk.exe
  C:\Windows\System\lOxNcpk.exe
  2⤵
  PID:8044
- C:\Windows\System\TCbdFDG.exe
  C:\Windows\System\TCbdFDG.exe
  2⤵
  PID:8060
- C:\Windows\System\iNabBKE.exe
  C:\Windows\System\iNabBKE.exe
  2⤵
  PID:8076
- C:\Windows\System\xCduBnC.exe
  C:\Windows\System\xCduBnC.exe
  2⤵
  PID:8116
- C:\Windows\System\aWQUrEE.exe
  C:\Windows\System\aWQUrEE.exe
  2⤵
  PID:8140
- C:\Windows\System\HyVxtUm.exe
  C:\Windows\System\HyVxtUm.exe
  2⤵
  PID:8176
- C:\Windows\System\sGCPZNe.exe
  C:\Windows\System\sGCPZNe.exe
  2⤵
  PID:7176
- C:\Windows\System\ZAxWzYO.exe
  C:\Windows\System\ZAxWzYO.exe
  2⤵
  PID:7232
- C:\Windows\System\zWHBGOv.exe
  C:\Windows\System\zWHBGOv.exe
  2⤵
  PID:7364
- C:\Windows\System\mPqsEAE.exe
  C:\Windows\System\mPqsEAE.exe
  2⤵
  PID:7396
- C:\Windows\System\JmoPiCD.exe
  C:\Windows\System\JmoPiCD.exe
  2⤵
  PID:7484
- C:\Windows\System\dsaRvjs.exe
  C:\Windows\System\dsaRvjs.exe
  2⤵
  PID:7492
- C:\Windows\System\sCVNFhm.exe
  C:\Windows\System\sCVNFhm.exe
  2⤵
  PID:7584
- C:\Windows\System\zlImpkX.exe
  C:\Windows\System\zlImpkX.exe
  2⤵
  PID:7668
- C:\Windows\System\znxIONC.exe
  C:\Windows\System\znxIONC.exe
  2⤵
  PID:7788
- C:\Windows\System\PyFsIZU.exe
  C:\Windows\System\PyFsIZU.exe
  2⤵
  PID:7852
- C:\Windows\System\gyGrXSC.exe
  C:\Windows\System\gyGrXSC.exe
  2⤵
  PID:7900
- C:\Windows\System\SYXPKYA.exe
  C:\Windows\System\SYXPKYA.exe
  2⤵
  PID:8008
- C:\Windows\System\VcIxfcA.exe
  C:\Windows\System\VcIxfcA.exe
  2⤵
  PID:8028
- C:\Windows\System\jXZSIQm.exe
  C:\Windows\System\jXZSIQm.exe
  2⤵
  PID:8056
- C:\Windows\System\ompyckN.exe
  C:\Windows\System\ompyckN.exe
  2⤵
  PID:8112
- C:\Windows\System\PKzMnRJ.exe
  C:\Windows\System\PKzMnRJ.exe
  2⤵
  PID:7228
- C:\Windows\System\GsyyjPm.exe
  C:\Windows\System\GsyyjPm.exe
  2⤵
  PID:7380
- C:\Windows\System\bmqfWCw.exe
  C:\Windows\System\bmqfWCw.exe
  2⤵
  PID:7428
- C:\Windows\System\HtqgoDW.exe
  C:\Windows\System\HtqgoDW.exe
  2⤵
  PID:7748
- C:\Windows\System\XXDzxAu.exe
  C:\Windows\System\XXDzxAu.exe
  2⤵
  PID:7816
- C:\Windows\System\doOuZMF.exe
  C:\Windows\System\doOuZMF.exe
  2⤵
  PID:7916
- C:\Windows\System\xZTdHny.exe
  C:\Windows\System\xZTdHny.exe
  2⤵
  PID:8096
- C:\Windows\System\XDbRkgb.exe
  C:\Windows\System\XDbRkgb.exe
  2⤵
  PID:7236
- C:\Windows\System\fBPXDFo.exe
  C:\Windows\System\fBPXDFo.exe
  2⤵
  PID:7408
- C:\Windows\System\XiWEzty.exe
  C:\Windows\System\XiWEzty.exe
  2⤵
  PID:7736
- C:\Windows\System\BtqMmxM.exe
  C:\Windows\System\BtqMmxM.exe
  2⤵
  PID:7940
- C:\Windows\System\mhJftGe.exe
  C:\Windows\System\mhJftGe.exe
  2⤵
  PID:8196
- C:\Windows\System\VJpkkmG.exe
  C:\Windows\System\VJpkkmG.exe
  2⤵
  PID:8236
- C:\Windows\System\dtvZtgk.exe
  C:\Windows\System\dtvZtgk.exe
  2⤵
  PID:8256
- C:\Windows\System\wWAABDy.exe
  C:\Windows\System\wWAABDy.exe
  2⤵
  PID:8288
- C:\Windows\System\oNKcbJk.exe
  C:\Windows\System\oNKcbJk.exe
  2⤵
  PID:8320
- C:\Windows\System\BZltYUx.exe
  C:\Windows\System\BZltYUx.exe
  2⤵
  PID:8348
- C:\Windows\System\ngQMrbT.exe
  C:\Windows\System\ngQMrbT.exe
  2⤵
  PID:8368
- C:\Windows\System\ptjMyUx.exe
  C:\Windows\System\ptjMyUx.exe
  2⤵
  PID:8388
- C:\Windows\System\jLfTMAo.exe
  C:\Windows\System\jLfTMAo.exe
  2⤵
  PID:8416
- C:\Windows\System\QqmVcxL.exe
  C:\Windows\System\QqmVcxL.exe
  2⤵
  PID:8452
- C:\Windows\System\fwQteVJ.exe
  C:\Windows\System\fwQteVJ.exe
  2⤵
  PID:8480
- C:\Windows\System\ieaAvYy.exe
  C:\Windows\System\ieaAvYy.exe
  2⤵
  PID:8508
- C:\Windows\System\pZXkLDu.exe
  C:\Windows\System\pZXkLDu.exe
  2⤵
  PID:8548
- C:\Windows\System\seuDVkp.exe
  C:\Windows\System\seuDVkp.exe
  2⤵
  PID:8568
- C:\Windows\System\YElGOLm.exe
  C:\Windows\System\YElGOLm.exe
  2⤵
  PID:8592
- C:\Windows\System\AIQNXwk.exe
  C:\Windows\System\AIQNXwk.exe
  2⤵
  PID:8620
- C:\Windows\System\hFCQXek.exe
  C:\Windows\System\hFCQXek.exe
  2⤵
  PID:8648
- C:\Windows\System\AuGCDMm.exe
  C:\Windows\System\AuGCDMm.exe
  2⤵
  PID:8668
- C:\Windows\System\jJXadtr.exe
  C:\Windows\System\jJXadtr.exe
  2⤵
  PID:8696
- C:\Windows\System\wEWrpXE.exe
  C:\Windows\System\wEWrpXE.exe
  2⤵
  PID:8728
- C:\Windows\System\BfMCGZW.exe
  C:\Windows\System\BfMCGZW.exe
  2⤵
  PID:8756
- C:\Windows\System\xtWfego.exe
  C:\Windows\System\xtWfego.exe
  2⤵
  PID:8800
- C:\Windows\System\qqtllkD.exe
  C:\Windows\System\qqtllkD.exe
  2⤵
  PID:8816
- C:\Windows\System\MUXQJKS.exe
  C:\Windows\System\MUXQJKS.exe
  2⤵
  PID:8844
- C:\Windows\System\TvUuxZu.exe
  C:\Windows\System\TvUuxZu.exe
  2⤵
  PID:8876
- C:\Windows\System\CCqHemZ.exe
  C:\Windows\System\CCqHemZ.exe
  2⤵
  PID:8900
- C:\Windows\System\IXmfRTZ.exe
  C:\Windows\System\IXmfRTZ.exe
  2⤵
  PID:8928
- C:\Windows\System\GnCHrWt.exe
  C:\Windows\System\GnCHrWt.exe
  2⤵
  PID:8952
- C:\Windows\System\RcrbCeT.exe
  C:\Windows\System\RcrbCeT.exe
  2⤵
  PID:8980
- C:\Windows\System\MAQWayy.exe
  C:\Windows\System\MAQWayy.exe
  2⤵
  PID:9004
- C:\Windows\System\qOhaMFi.exe
  C:\Windows\System\qOhaMFi.exe
  2⤵
  PID:9040
- C:\Windows\System\SWrtZKf.exe
  C:\Windows\System\SWrtZKf.exe
  2⤵
  PID:9068
- C:\Windows\System\NomyTkH.exe
  C:\Windows\System\NomyTkH.exe
  2⤵
  PID:9092
- C:\Windows\System\IKtjsor.exe
  C:\Windows\System\IKtjsor.exe
  2⤵
  PID:9112
- C:\Windows\System\PbgDmGj.exe
  C:\Windows\System\PbgDmGj.exe
  2⤵
  PID:9128
- C:\Windows\System\TTxgARh.exe
  C:\Windows\System\TTxgARh.exe
  2⤵
  PID:9148
- C:\Windows\System\cDwZTGO.exe
  C:\Windows\System\cDwZTGO.exe
  2⤵
  PID:9176
- C:\Windows\System\RqVQcSt.exe
  C:\Windows\System\RqVQcSt.exe
  2⤵
  PID:9204
- C:\Windows\System\VMmpWvN.exe
  C:\Windows\System\VMmpWvN.exe
  2⤵
  PID:7352
- C:\Windows\System\OcdHAEF.exe
  C:\Windows\System\OcdHAEF.exe
  2⤵
  PID:8308
- C:\Windows\System\JmfhbtD.exe
  C:\Windows\System\JmfhbtD.exe
  2⤵
  PID:8384
- C:\Windows\System\tBAfcqf.exe
  C:\Windows\System\tBAfcqf.exe
  2⤵
  PID:8444
- C:\Windows\System\jJAsjRS.exe
  C:\Windows\System\jJAsjRS.exe
  2⤵
  PID:8544
- C:\Windows\System\GjvwxoJ.exe
  C:\Windows\System\GjvwxoJ.exe
  2⤵
  PID:8632
- C:\Windows\System\ayIcIcY.exe
  C:\Windows\System\ayIcIcY.exe
  2⤵
  PID:8680
- C:\Windows\System\PRTxlgu.exe
  C:\Windows\System\PRTxlgu.exe
  2⤵
  PID:8712
- C:\Windows\System\CMncBFM.exe
  C:\Windows\System\CMncBFM.exe
  2⤵
  PID:8772
- C:\Windows\System\xUJBtOo.exe
  C:\Windows\System\xUJBtOo.exe
  2⤵
  PID:8840
- C:\Windows\System\OTQofAU.exe
  C:\Windows\System\OTQofAU.exe
  2⤵
  PID:8892
- C:\Windows\System\QXzlcZW.exe
  C:\Windows\System\QXzlcZW.exe
  2⤵
  PID:8920
- C:\Windows\System\lmrJVMX.exe
  C:\Windows\System\lmrJVMX.exe
  2⤵
  PID:9060
- C:\Windows\System\jECAsid.exe
  C:\Windows\System\jECAsid.exe
  2⤵
  PID:9120
- C:\Windows\System\SCIYClj.exe
  C:\Windows\System\SCIYClj.exe
  2⤵
  PID:7644
- C:\Windows\System\KRTvraG.exe
  C:\Windows\System\KRTvraG.exe
  2⤵
  PID:8300
- C:\Windows\System\DJslfRe.exe
  C:\Windows\System\DJslfRe.exe
  2⤵
  PID:8340
- C:\Windows\System\rYQUklP.exe
  C:\Windows\System\rYQUklP.exe
  2⤵
  PID:8564
- C:\Windows\System\eWpmgkv.exe
  C:\Windows\System\eWpmgkv.exe
  2⤵
  PID:8744
- C:\Windows\System\bWVftOz.exe
  C:\Windows\System\bWVftOz.exe
  2⤵
  PID:8864
- C:\Windows\System\frgcgsF.exe
  C:\Windows\System\frgcgsF.exe
  2⤵
  PID:8940
- C:\Windows\System\QLUMijZ.exe
  C:\Windows\System\QLUMijZ.exe
  2⤵
  PID:9100
- C:\Windows\System\UVkzhWp.exe
  C:\Windows\System\UVkzhWp.exe
  2⤵
  PID:8364
- C:\Windows\System\SEKjgJy.exe
  C:\Windows\System\SEKjgJy.exe
  2⤵
  PID:8608
- C:\Windows\System\QAzWaia.exe
  C:\Windows\System\QAzWaia.exe
  2⤵
  PID:9028
- C:\Windows\System\BwjsEXj.exe
  C:\Windows\System\BwjsEXj.exe
  2⤵
  PID:8412
- C:\Windows\System\LSoibhE.exe
  C:\Windows\System\LSoibhE.exe
  2⤵
  PID:8812
- C:\Windows\System\hFKRKtT.exe
  C:\Windows\System\hFKRKtT.exe
  2⤵
  PID:9248
- C:\Windows\System\iIFcSmZ.exe
  C:\Windows\System\iIFcSmZ.exe
  2⤵
  PID:9280
- C:\Windows\System\lVwClHi.exe
  C:\Windows\System\lVwClHi.exe
  2⤵
  PID:9304
- C:\Windows\System\QmRkfMy.exe
  C:\Windows\System\QmRkfMy.exe
  2⤵
  PID:9332
- C:\Windows\System\RlfqiSC.exe
  C:\Windows\System\RlfqiSC.exe
  2⤵
  PID:9360
- C:\Windows\System\afiVXre.exe
  C:\Windows\System\afiVXre.exe
  2⤵
  PID:9388
- C:\Windows\System\PjpusMa.exe
  C:\Windows\System\PjpusMa.exe
  2⤵
  PID:9416
- C:\Windows\System\JwgHqZk.exe
  C:\Windows\System\JwgHqZk.exe
  2⤵
  PID:9440
- C:\Windows\System\bXJVuuQ.exe
  C:\Windows\System\bXJVuuQ.exe
  2⤵
  PID:9464
- C:\Windows\System\nBSgpUj.exe
  C:\Windows\System\nBSgpUj.exe
  2⤵
  PID:9488
- C:\Windows\System\dkBdYZq.exe
  C:\Windows\System\dkBdYZq.exe
  2⤵
  PID:9516
- C:\Windows\System\PjQsslC.exe
  C:\Windows\System\PjQsslC.exe
  2⤵
  PID:9544
- C:\Windows\System\zKQCpuJ.exe
  C:\Windows\System\zKQCpuJ.exe
  2⤵
  PID:9572
- C:\Windows\System\JwYDTDT.exe
  C:\Windows\System\JwYDTDT.exe
  2⤵
  PID:9604
- C:\Windows\System\YmrZkyw.exe
  C:\Windows\System\YmrZkyw.exe
  2⤵
  PID:9628
- C:\Windows\System\MdVfSMt.exe
  C:\Windows\System\MdVfSMt.exe
  2⤵
  PID:9652
- C:\Windows\System\UVNjYSA.exe
  C:\Windows\System\UVNjYSA.exe
  2⤵
  PID:9676
- C:\Windows\System\HcmyHkb.exe
  C:\Windows\System\HcmyHkb.exe
  2⤵
  PID:9712
- C:\Windows\System\kPvqirM.exe
  C:\Windows\System\kPvqirM.exe
  2⤵
  PID:9740
- C:\Windows\System\qEtyEYQ.exe
  C:\Windows\System\qEtyEYQ.exe
  2⤵
  PID:9756
- C:\Windows\System\CLYMIhY.exe
  C:\Windows\System\CLYMIhY.exe
  2⤵
  PID:9780
- C:\Windows\System\GkHuxcw.exe
  C:\Windows\System\GkHuxcw.exe
  2⤵
  PID:9804
- C:\Windows\System\ltyeNFb.exe
  C:\Windows\System\ltyeNFb.exe
  2⤵
  PID:9836
- C:\Windows\System\RuAxKEY.exe
  C:\Windows\System\RuAxKEY.exe
  2⤵
  PID:9888
- C:\Windows\System\KmFcgUA.exe
  C:\Windows\System\KmFcgUA.exe
  2⤵
  PID:9916
- C:\Windows\System\TJCgLrX.exe
  C:\Windows\System\TJCgLrX.exe
  2⤵
  PID:9956
- C:\Windows\System\ncBYvnb.exe
  C:\Windows\System\ncBYvnb.exe
  2⤵
  PID:9988
- C:\Windows\System\qQxelcb.exe
  C:\Windows\System\qQxelcb.exe
  2⤵
  PID:10004
- C:\Windows\System\KUPekcC.exe
  C:\Windows\System\KUPekcC.exe
  2⤵
  PID:10032
- C:\Windows\System\wWfAANN.exe
  C:\Windows\System\wWfAANN.exe
  2⤵
  PID:10056
- C:\Windows\System\ZRDEWly.exe
  C:\Windows\System\ZRDEWly.exe
  2⤵
  PID:10092
- C:\Windows\System\YAkLQXk.exe
  C:\Windows\System\YAkLQXk.exe
  2⤵
  PID:10116
- C:\Windows\System\qGRqacQ.exe
  C:\Windows\System\qGRqacQ.exe
  2⤵
  PID:10156
- C:\Windows\System\PQiOnGF.exe
  C:\Windows\System\PQiOnGF.exe
  2⤵
  PID:10172
- C:\Windows\System\zvqlUvv.exe
  C:\Windows\System\zvqlUvv.exe
  2⤵
  PID:10200
- C:\Windows\System\eRGkuDr.exe
  C:\Windows\System\eRGkuDr.exe
  2⤵
  PID:10228
- C:\Windows\System\CdgbEAG.exe
  C:\Windows\System\CdgbEAG.exe
  2⤵
  PID:9236
- C:\Windows\System\HPYVeJg.exe
  C:\Windows\System\HPYVeJg.exe
  2⤵
  PID:9316
- C:\Windows\System\YVHKADw.exe
  C:\Windows\System\YVHKADw.exe
  2⤵
  PID:9352
- C:\Windows\System\ysYwBkA.exe
  C:\Windows\System\ysYwBkA.exe
  2⤵
  PID:9348
- C:\Windows\System\pnVPniS.exe
  C:\Windows\System\pnVPniS.exe
  2⤵
  PID:9424
- C:\Windows\System\RqdoNMH.exe
  C:\Windows\System\RqdoNMH.exe
  2⤵
  PID:9480
- C:\Windows\System\bkYPgSA.exe
  C:\Windows\System\bkYPgSA.exe
  2⤵
  PID:9560
- C:\Windows\System\lLOEjyq.exe
  C:\Windows\System\lLOEjyq.exe
  2⤵
  PID:9600
- C:\Windows\System\qbWXSoa.exe
  C:\Windows\System\qbWXSoa.exe
  2⤵
  PID:9696
- C:\Windows\System\bjPCHkD.exe
  C:\Windows\System\bjPCHkD.exe
  2⤵
  PID:9796
- C:\Windows\System\XiPEdsc.exe
  C:\Windows\System\XiPEdsc.exe
  2⤵
  PID:9908
- C:\Windows\System\SKdFwKD.exe
  C:\Windows\System\SKdFwKD.exe
  2⤵
  PID:9932
- C:\Windows\System\uDSZVUA.exe
  C:\Windows\System\uDSZVUA.exe
  2⤵
  PID:9996
- C:\Windows\System\AuXJckg.exe
  C:\Windows\System\AuXJckg.exe
  2⤵
  PID:10076
- C:\Windows\System\PwsjlYx.exe
  C:\Windows\System\PwsjlYx.exe
  2⤵
  PID:10132
- C:\Windows\System\NzUfcWa.exe
  C:\Windows\System\NzUfcWa.exe
  2⤵
  PID:10212
- C:\Windows\System\NmDmLkh.exe
  C:\Windows\System\NmDmLkh.exe
  2⤵
  PID:8524
- C:\Windows\System\hsZZiXX.exe
  C:\Windows\System\hsZZiXX.exe
  2⤵
  PID:9460
- C:\Windows\System\VzsOWfC.exe
  C:\Windows\System\VzsOWfC.exe
  2⤵
  PID:9620
- C:\Windows\System\kCFhidq.exe
  C:\Windows\System\kCFhidq.exe
  2⤵
  PID:9748
- C:\Windows\System\goJsYPI.exe
  C:\Windows\System\goJsYPI.exe
  2⤵
  PID:9792
- C:\Windows\System\kdLLIlX.exe
  C:\Windows\System\kdLLIlX.exe
  2⤵
  PID:9972
- C:\Windows\System\TaBvlMT.exe
  C:\Windows\System\TaBvlMT.exe
  2⤵
  PID:10112
- C:\Windows\System\vUfLBTY.exe
  C:\Windows\System\vUfLBTY.exe
  2⤵
  PID:10192
- C:\Windows\System\LZunGRi.exe
  C:\Windows\System\LZunGRi.exe
  2⤵
  PID:9828
- C:\Windows\System\WuvVUVr.exe
  C:\Windows\System\WuvVUVr.exe
  2⤵
  PID:3384
- C:\Windows\System\aHutkjn.exe
  C:\Windows\System\aHutkjn.exe
  2⤵
  PID:10104
- C:\Windows\System\UeIhuVA.exe
  C:\Windows\System\UeIhuVA.exe
  2⤵
  PID:10256
- C:\Windows\System\etFvAGw.exe
  C:\Windows\System\etFvAGw.exe
  2⤵
  PID:10284
- C:\Windows\System\uaznwtw.exe
  C:\Windows\System\uaznwtw.exe
  2⤵
  PID:10300
- C:\Windows\System\qGZTFUI.exe
  C:\Windows\System\qGZTFUI.exe
  2⤵
  PID:10320
- C:\Windows\System\xALWZmn.exe
  C:\Windows\System\xALWZmn.exe
  2⤵
  PID:10340
- C:\Windows\System\AvpHUBS.exe
  C:\Windows\System\AvpHUBS.exe
  2⤵
  PID:10372
- C:\Windows\System\bOHAvxm.exe
  C:\Windows\System\bOHAvxm.exe
  2⤵
  PID:10420
- C:\Windows\System\RqxCiav.exe
  C:\Windows\System\RqxCiav.exe
  2⤵
  PID:10488
- C:\Windows\System\NvVlhPf.exe
  C:\Windows\System\NvVlhPf.exe
  2⤵
  PID:10516
- C:\Windows\System\UzbujmB.exe
  C:\Windows\System\UzbujmB.exe
  2⤵
  PID:10532
- C:\Windows\System\iWciawr.exe
  C:\Windows\System\iWciawr.exe
  2⤵
  PID:10560
- C:\Windows\System\TIsqhLE.exe
  C:\Windows\System\TIsqhLE.exe
  2⤵
  PID:10600
- C:\Windows\System\rCXFgKP.exe
  C:\Windows\System\rCXFgKP.exe
  2⤵
  PID:10628
- C:\Windows\System\yZPAnsD.exe
  C:\Windows\System\yZPAnsD.exe
  2⤵
  PID:10656
- C:\Windows\System\uhdKTVL.exe
  C:\Windows\System\uhdKTVL.exe
  2⤵
  PID:10672
- C:\Windows\System\CUNuTKA.exe
  C:\Windows\System\CUNuTKA.exe
  2⤵
  PID:10712
- C:\Windows\System\WsFahHU.exe
  C:\Windows\System\WsFahHU.exe
  2⤵
  PID:10728
- C:\Windows\System\lNCpBvK.exe
  C:\Windows\System\lNCpBvK.exe
  2⤵
  PID:10748
- C:\Windows\System\xZBCOLa.exe
  C:\Windows\System\xZBCOLa.exe
  2⤵
  PID:10772
- C:\Windows\System\DgggoAN.exe
  C:\Windows\System\DgggoAN.exe
  2⤵
  PID:10824
- C:\Windows\System\PNtgpGz.exe
  C:\Windows\System\PNtgpGz.exe
  2⤵
  PID:10852
- C:\Windows\System\HkasDzK.exe
  C:\Windows\System\HkasDzK.exe
  2⤵
  PID:10868
- C:\Windows\System\OzyZLmo.exe
  C:\Windows\System\OzyZLmo.exe
  2⤵
  PID:10884
- C:\Windows\System\HOHJQKY.exe
  C:\Windows\System\HOHJQKY.exe
  2⤵
  PID:10916
- C:\Windows\System\LHYCYQV.exe
  C:\Windows\System\LHYCYQV.exe
  2⤵
  PID:10936
- C:\Windows\System\oTevtor.exe
  C:\Windows\System\oTevtor.exe
  2⤵
  PID:10952
- C:\Windows\System\muGoNoQ.exe
  C:\Windows\System\muGoNoQ.exe
  2⤵
  PID:10976
- C:\Windows\System\jHchpoc.exe
  C:\Windows\System\jHchpoc.exe
  2⤵
  PID:11000
- C:\Windows\System\tRVzrLH.exe
  C:\Windows\System\tRVzrLH.exe
  2⤵
  PID:11052
- C:\Windows\System\UbPpufD.exe
  C:\Windows\System\UbPpufD.exe
  2⤵
  PID:11080
- C:\Windows\System\fLbwEUM.exe
  C:\Windows\System\fLbwEUM.exe
  2⤵
  PID:11108
- C:\Windows\System\gJFYGzd.exe
  C:\Windows\System\gJFYGzd.exe
  2⤵
  PID:11132
- C:\Windows\System\iwtEWvr.exe
  C:\Windows\System\iwtEWvr.exe
  2⤵
  PID:11152
- C:\Windows\System\hnibkiB.exe
  C:\Windows\System\hnibkiB.exe
  2⤵
  PID:11192
- C:\Windows\System\TXMRSjh.exe
  C:\Windows\System\TXMRSjh.exe
  2⤵
  PID:11216
- C:\Windows\System\LuOnlSy.exe
  C:\Windows\System\LuOnlSy.exe
  2⤵
  PID:11244
- C:\Windows\System\CbfEAKt.exe
  C:\Windows\System\CbfEAKt.exe
  2⤵
  PID:10292
- C:\Windows\System\SHIKhEU.exe
  C:\Windows\System\SHIKhEU.exe
  2⤵
  PID:10296
- C:\Windows\System\eDcaFNI.exe
  C:\Windows\System\eDcaFNI.exe
  2⤵
  PID:10352
- C:\Windows\System\bWgXKxv.exe
  C:\Windows\System\bWgXKxv.exe
  2⤵
  PID:10412
- C:\Windows\System\OVFzEIM.exe
  C:\Windows\System\OVFzEIM.exe
  2⤵
  PID:10468
- C:\Windows\System\SbEFyxR.exe
  C:\Windows\System\SbEFyxR.exe
  2⤵
  PID:10584
- C:\Windows\System\WRFsMAb.exe
  C:\Windows\System\WRFsMAb.exe
  2⤵
  PID:10644
- C:\Windows\System\aotiMwd.exe
  C:\Windows\System\aotiMwd.exe
  2⤵
  PID:10724
- C:\Windows\System\NYeSUCo.exe
  C:\Windows\System\NYeSUCo.exe
  2⤵
  PID:10764
- C:\Windows\System\UHQdMYF.exe
  C:\Windows\System\UHQdMYF.exe
  2⤵
  PID:10840
- C:\Windows\System\pedRFqR.exe
  C:\Windows\System\pedRFqR.exe
  2⤵
  PID:10896
- C:\Windows\System\jYQUwqQ.exe
  C:\Windows\System\jYQUwqQ.exe
  2⤵
  PID:10960
- C:\Windows\System\GcPaaKd.exe
  C:\Windows\System\GcPaaKd.exe
  2⤵
  PID:11008
- C:\Windows\System\xbyDpKm.exe
  C:\Windows\System\xbyDpKm.exe
  2⤵
  PID:11092
- C:\Windows\System\OVOZUKY.exe
  C:\Windows\System\OVOZUKY.exe
  2⤵
  PID:11140
- C:\Windows\System\FedFXbs.exe
  C:\Windows\System\FedFXbs.exe
  2⤵
  PID:11212
- C:\Windows\System\dtvUthI.exe
  C:\Windows\System\dtvUthI.exe
  2⤵
  PID:4936
- C:\Windows\System\HSnEEyb.exe
  C:\Windows\System\HSnEEyb.exe
  2⤵
  PID:10416
- C:\Windows\System\pHnvsCv.exe
  C:\Windows\System\pHnvsCv.exe
  2⤵
  PID:10544
- C:\Windows\System\bKiCfjt.exe
  C:\Windows\System\bKiCfjt.exe
  2⤵
  PID:10648
- C:\Windows\System\hhRmgvE.exe
  C:\Windows\System\hhRmgvE.exe
  2⤵
  PID:10756
- C:\Windows\System\GMkEOjJ.exe
  C:\Windows\System\GMkEOjJ.exe
  2⤵
  PID:10928
- C:\Windows\System\tJtReOD.exe
  C:\Windows\System\tJtReOD.exe
  2⤵
  PID:11040
- C:\Windows\System\ARuOJOn.exe
  C:\Windows\System\ARuOJOn.exe
  2⤵
  PID:11180
- C:\Windows\System\KYUdZWi.exe
  C:\Windows\System\KYUdZWi.exe
  2⤵
  PID:10796
- C:\Windows\System\UqKqphs.exe
  C:\Windows\System\UqKqphs.exe
  2⤵
  PID:10968
- C:\Windows\System\hmcKVoj.exe
  C:\Windows\System\hmcKVoj.exe
  2⤵
  PID:11096
- C:\Windows\System\AiQsUie.exe
  C:\Windows\System\AiQsUie.exe
  2⤵
  PID:11036
- C:\Windows\System\QBEvPFK.exe
  C:\Windows\System\QBEvPFK.exe
  2⤵
  PID:11272
- C:\Windows\System\fzeTdGZ.exe
  C:\Windows\System\fzeTdGZ.exe
  2⤵
  PID:11312
- C:\Windows\System\NeSGMlN.exe
  C:\Windows\System\NeSGMlN.exe
  2⤵
  PID:11352
- C:\Windows\System\RyxoPlA.exe
  C:\Windows\System\RyxoPlA.exe
  2⤵
  PID:11380
- C:\Windows\System\knGVbPl.exe
  C:\Windows\System\knGVbPl.exe
  2⤵
  PID:11408
- C:\Windows\System\eELDMYA.exe
  C:\Windows\System\eELDMYA.exe
  2⤵
  PID:11508
- C:\Windows\System\xmawZrh.exe
  C:\Windows\System\xmawZrh.exe
  2⤵
  PID:11528
- C:\Windows\System\BaOXSDw.exe
  C:\Windows\System\BaOXSDw.exe
  2⤵
  PID:11544
- C:\Windows\System\VaeoYVo.exe
  C:\Windows\System\VaeoYVo.exe
  2⤵
  PID:11596
- C:\Windows\System\lxTJDEj.exe
  C:\Windows\System\lxTJDEj.exe
  2⤵
  PID:11624
- C:\Windows\System\YdHwjMW.exe
  C:\Windows\System\YdHwjMW.exe
  2⤵
  PID:11644
- C:\Windows\System\ULXXMKZ.exe
  C:\Windows\System\ULXXMKZ.exe
  2⤵
  PID:11668
- C:\Windows\System\rlMgDeL.exe
  C:\Windows\System\rlMgDeL.exe
  2⤵
  PID:11696
- C:\Windows\System\PHCiNrL.exe
  C:\Windows\System\PHCiNrL.exe
  2⤵
  PID:11720
- C:\Windows\System\ZykOiio.exe
  C:\Windows\System\ZykOiio.exe
  2⤵
  PID:11776
- C:\Windows\System\EHlmasM.exe
  C:\Windows\System\EHlmasM.exe
  2⤵
  PID:11804
- C:\Windows\System\fZYAiKo.exe
  C:\Windows\System\fZYAiKo.exe
  2⤵
  PID:11832
- C:\Windows\System\DtWZduc.exe
  C:\Windows\System\DtWZduc.exe
  2⤵
  PID:11848
- C:\Windows\System\DdoqTCK.exe
  C:\Windows\System\DdoqTCK.exe
  2⤵
  PID:11876
- C:\Windows\System\ObumLiR.exe
  C:\Windows\System\ObumLiR.exe
  2⤵
  PID:11904
- C:\Windows\System\aTLwWOO.exe
  C:\Windows\System\aTLwWOO.exe
  2⤵
  PID:11944
- C:\Windows\System\TkMVXGH.exe
  C:\Windows\System\TkMVXGH.exe
  2⤵
  PID:11972
- C:\Windows\System\pOEGdPg.exe
  C:\Windows\System\pOEGdPg.exe
  2⤵
  PID:11988
- C:\Windows\System\yECamqZ.exe
  C:\Windows\System\yECamqZ.exe
  2⤵
  PID:12020
- C:\Windows\System\jHIwzIP.exe
  C:\Windows\System\jHIwzIP.exe
  2⤵
  PID:12044
- C:\Windows\System\rhWbxfK.exe
  C:\Windows\System\rhWbxfK.exe
  2⤵
  PID:12072
- C:\Windows\System\YuLANqT.exe
  C:\Windows\System\YuLANqT.exe
  2⤵
  PID:12112
- C:\Windows\System\ScoyMSD.exe
  C:\Windows\System\ScoyMSD.exe
  2⤵
  PID:12128
- C:\Windows\System\tjwVECU.exe
  C:\Windows\System\tjwVECU.exe
  2⤵
  PID:12164
- C:\Windows\System\YRDgGGS.exe
  C:\Windows\System\YRDgGGS.exe
  2⤵
  PID:12188
- C:\Windows\System\PliCOly.exe
  C:\Windows\System\PliCOly.exe
  2⤵
  PID:12216
- C:\Windows\System\FlhlKbN.exe
  C:\Windows\System\FlhlKbN.exe
  2⤵
  PID:12244
- C:\Windows\System\LxDwFIJ.exe
  C:\Windows\System\LxDwFIJ.exe
  2⤵
  PID:12272
- C:\Windows\System\pgeKADi.exe
  C:\Windows\System\pgeKADi.exe
  2⤵
  PID:11292
- C:\Windows\System\FYPXiVP.exe
  C:\Windows\System\FYPXiVP.exe
  2⤵
  PID:11368
- C:\Windows\System\GbHznaP.exe
  C:\Windows\System\GbHznaP.exe
  2⤵
  PID:11448
- C:\Windows\System\ryxHtIT.exe
  C:\Windows\System\ryxHtIT.exe
  2⤵
  PID:11560
- C:\Windows\System\yrNMHfZ.exe
  C:\Windows\System\yrNMHfZ.exe
  2⤵
  PID:11660
- C:\Windows\System\HwiBgXD.exe
  C:\Windows\System\HwiBgXD.exe
  2⤵
  PID:11704
- C:\Windows\System\jwrNkeW.exe
  C:\Windows\System\jwrNkeW.exe
  2⤵
  PID:11792
- C:\Windows\System\ytKZpBW.exe
  C:\Windows\System\ytKZpBW.exe
  2⤵
  PID:11824
- C:\Windows\System\MKJlnTJ.exe
  C:\Windows\System\MKJlnTJ.exe
  2⤵
  PID:11896
- C:\Windows\System\RsigcVk.exe
  C:\Windows\System\RsigcVk.exe
  2⤵
  PID:11984
- C:\Windows\System\FKrBRwU.exe
  C:\Windows\System\FKrBRwU.exe
  2⤵
  PID:12040
- C:\Windows\System\eikKppf.exe
  C:\Windows\System\eikKppf.exe
  2⤵
  PID:12104
- C:\Windows\System\NmLfXty.exe
  C:\Windows\System\NmLfXty.exe
  2⤵
  PID:12184
- C:\Windows\System\tGFOZWA.exe
  C:\Windows\System\tGFOZWA.exe
  2⤵
  PID:12232
- C:\Windows\System\czrDmCM.exe
  C:\Windows\System\czrDmCM.exe
  2⤵
  PID:11172
- C:\Windows\System\dctqBdR.exe
  C:\Windows\System\dctqBdR.exe
  2⤵
  PID:11348
- C:\Windows\System\yLVWkbc.exe
  C:\Windows\System\yLVWkbc.exe
  2⤵
  PID:11620
- C:\Windows\System\USxNtcR.exe
  C:\Windows\System\USxNtcR.exe
  2⤵
  PID:11772
- C:\Windows\System\jrLqHvF.exe
  C:\Windows\System\jrLqHvF.exe
  2⤵
  PID:11864
- C:\Windows\System\SXADBiD.exe
  C:\Windows\System\SXADBiD.exe
  2⤵
  PID:12012
- C:\Windows\System\hRjKjhi.exe
  C:\Windows\System\hRjKjhi.exe
  2⤵
  PID:12144
- C:\Windows\System\ROQeRdk.exe
  C:\Windows\System\ROQeRdk.exe
  2⤵
  PID:12268
- C:\Windows\System\HySQSuY.exe
  C:\Windows\System\HySQSuY.exe
  2⤵
  PID:11680
- C:\Windows\System\ZqpkcKr.exe
  C:\Windows\System\ZqpkcKr.exe
  2⤵
  PID:12100
- C:\Windows\System\OMYlIRX.exe
  C:\Windows\System\OMYlIRX.exe
  2⤵
  PID:12304
- C:\Windows\System\cwoOkAV.exe
  C:\Windows\System\cwoOkAV.exe
  2⤵
  PID:12324
- C:\Windows\System\dewdmwp.exe
  C:\Windows\System\dewdmwp.exe
  2⤵
  PID:12376
- C:\Windows\System\SssTfDB.exe
  C:\Windows\System\SssTfDB.exe
  2⤵
  PID:12404
- C:\Windows\System\oZyYevl.exe
  C:\Windows\System\oZyYevl.exe
  2⤵
  PID:12432
- C:\Windows\System\eqcIJpg.exe
  C:\Windows\System\eqcIJpg.exe
  2⤵
  PID:12456
- C:\Windows\System\vPTYvIl.exe
  C:\Windows\System\vPTYvIl.exe
  2⤵
  PID:12476
- C:\Windows\System\SmXBgaD.exe
  C:\Windows\System\SmXBgaD.exe
  2⤵
  PID:12508
- C:\Windows\System\ispERwX.exe
  C:\Windows\System\ispERwX.exe
  2⤵
  PID:12536
- C:\Windows\System\HFMNcpA.exe
  C:\Windows\System\HFMNcpA.exe
  2⤵
  PID:12560
- C:\Windows\System\AtyVmov.exe
  C:\Windows\System\AtyVmov.exe
  2⤵
  PID:12588
- C:\Windows\System\jSsmQqT.exe
  C:\Windows\System\jSsmQqT.exe
  2⤵
  PID:12604
- C:\Windows\System\LzFThpc.exe
  C:\Windows\System\LzFThpc.exe
  2⤵
  PID:12656
- C:\Windows\System\kjUezjV.exe
  C:\Windows\System\kjUezjV.exe
  2⤵
  PID:12680
- C:\Windows\System\WmyWWTB.exe
  C:\Windows\System\WmyWWTB.exe
  2⤵
  PID:12700
- C:\Windows\System\IqXClMf.exe
  C:\Windows\System\IqXClMf.exe
  2⤵
  PID:12732
- C:\Windows\System\ULNZmlY.exe
  C:\Windows\System\ULNZmlY.exe
  2⤵
  PID:12756
- C:\Windows\System\FeJlaFO.exe
  C:\Windows\System\FeJlaFO.exe
  2⤵
  PID:12784
- C:\Windows\System\IhDDkpj.exe
  C:\Windows\System\IhDDkpj.exe
  2⤵
  PID:12816
- C:\Windows\System\pirwmME.exe
  C:\Windows\System\pirwmME.exe
  2⤵
  PID:12844
- C:\Windows\System\IEBMlHh.exe
  C:\Windows\System\IEBMlHh.exe
  2⤵
  PID:12872
- C:\Windows\System\xhFEMqt.exe
  C:\Windows\System\xhFEMqt.exe
  2⤵
  PID:12900
- C:\Windows\System\ImnvsGh.exe
  C:\Windows\System\ImnvsGh.exe
  2⤵
  PID:12928
- C:\Windows\System\EVoGgXQ.exe
  C:\Windows\System\EVoGgXQ.exe
  2⤵
  PID:12952
- C:\Windows\System\SunrvMa.exe
  C:\Windows\System\SunrvMa.exe
  2⤵
  PID:12984
- C:\Windows\System\gUoxdbN.exe
  C:\Windows\System\gUoxdbN.exe
  2⤵
  PID:13004
- C:\Windows\System\nqsDvgj.exe
  C:\Windows\System\nqsDvgj.exe
  2⤵
  PID:13028
- C:\Windows\System\VNbthdp.exe
  C:\Windows\System\VNbthdp.exe
  2⤵
  PID:13076
- C:\Windows\System\qOCAgJx.exe
  C:\Windows\System\qOCAgJx.exe
  2⤵
  PID:13096
- C:\Windows\System\MWsUVHt.exe
  C:\Windows\System\MWsUVHt.exe
  2⤵
  PID:13124
- C:\Windows\System\GSjMwIC.exe
  C:\Windows\System\GSjMwIC.exe
  2⤵
  PID:13144
- C:\Windows\System\TJoVLlI.exe
  C:\Windows\System\TJoVLlI.exe
  2⤵
  PID:13168
- C:\Windows\System\nHvNnBq.exe
  C:\Windows\System\nHvNnBq.exe
  2⤵
  PID:13196
- C:\Windows\System\JYTAzwJ.exe
  C:\Windows\System\JYTAzwJ.exe
  2⤵
  PID:13228
- C:\Windows\System\EhTqMIc.exe
  C:\Windows\System\EhTqMIc.exe
  2⤵
  PID:13256
- C:\Windows\System\eNgZsbY.exe
  C:\Windows\System\eNgZsbY.exe
  2⤵
  PID:13292
- C:\Windows\System\DVTfPRY.exe
  C:\Windows\System\DVTfPRY.exe
  2⤵
  PID:11300
- C:\Windows\System\YvXNoyp.exe
  C:\Windows\System\YvXNoyp.exe
  2⤵
  PID:12320
- C:\Windows\System\jRcVsqE.exe
  C:\Windows\System\jRcVsqE.exe
  2⤵
  PID:12388
- C:\Windows\System\IqBgxxA.exe
  C:\Windows\System\IqBgxxA.exe
  2⤵
  PID:12472
- C:\Windows\System\XXcGYrj.exe
  C:\Windows\System\XXcGYrj.exe
  2⤵
  PID:12544
- C:\Windows\System\jNBazoP.exe
  C:\Windows\System\jNBazoP.exe
  2⤵
  PID:12640
- C:\Windows\System\JvrkTCz.exe
  C:\Windows\System\JvrkTCz.exe
  2⤵
  PID:12652
- C:\Windows\System\ReOqGBN.exe
  C:\Windows\System\ReOqGBN.exe
  2⤵
  PID:12712
- C:\Windows\System\oRZKWEQ.exe
  C:\Windows\System\oRZKWEQ.exe
  2⤵
  PID:12804
- C:\Windows\System\gBnCJdH.exe
  C:\Windows\System\gBnCJdH.exe
  2⤵
  PID:12864
- C:\Windows\System\YvQJSJl.exe
  C:\Windows\System\YvQJSJl.exe
  2⤵
  PID:12892
- C:\Windows\System\wfjXqOG.exe
  C:\Windows\System\wfjXqOG.exe
  2⤵
  PID:12976
- C:\Windows\System\Qnoaovs.exe
  C:\Windows\System\Qnoaovs.exe
  2⤵
  PID:12996
- C:\Windows\System\IlyriKM.exe
  C:\Windows\System\IlyriKM.exe
  2⤵
  PID:13156
- C:\Windows\System\jjgfjjy.exe
  C:\Windows\System\jjgfjjy.exe
  2⤵
  PID:13184
- C:\Windows\System\JMQrJPy.exe
  C:\Windows\System\JMQrJPy.exe
  2⤵
  PID:13224
- C:\Windows\System\pEaZTDV.exe
  C:\Windows\System\pEaZTDV.exe
  2⤵
  PID:12316
- C:\Windows\System\JKcVdtT.exe
  C:\Windows\System\JKcVdtT.exe
  2⤵
  PID:12368
- C:\Windows\System\rnYOnot.exe
  C:\Windows\System\rnYOnot.exe
  2⤵
  PID:12600
- C:\Windows\System\PwbpNCr.exe
  C:\Windows\System\PwbpNCr.exe
  2⤵
  PID:11732
- C:\Windows\System\oRhGiqy.exe
  C:\Windows\System\oRhGiqy.exe
  2⤵
  PID:12836
- C:\Windows\System\MiFAHyd.exe
  C:\Windows\System\MiFAHyd.exe
  2⤵
  PID:12944
- C:\Windows\System\UzVYMMs.exe
  C:\Windows\System\UzVYMMs.exe
  2⤵
  PID:13132
- C:\Windows\System\kSnTcGC.exe
  C:\Windows\System\kSnTcGC.exe
  2⤵
  PID:13308
- C:\Windows\System\NCLcGlk.exe
  C:\Windows\System\NCLcGlk.exe
  2⤵
  PID:12552
- C:\Windows\System\PPzzdNA.exe
  C:\Windows\System\PPzzdNA.exe
  2⤵
  PID:12828
- C:\Windows\System\zDhLpoX.exe
  C:\Windows\System\zDhLpoX.exe
  2⤵
  PID:13140
- C:\Windows\System\UexcAVN.exe
  C:\Windows\System\UexcAVN.exe
  2⤵
  PID:13012
- C:\Windows\System\XEbAoKc.exe
  C:\Windows\System\XEbAoKc.exe
  2⤵
  PID:13332
- C:\Windows\System\TKaMouB.exe
  C:\Windows\System\TKaMouB.exe
  2⤵
  PID:13360
- C:\Windows\System\sJpOBvN.exe
  C:\Windows\System\sJpOBvN.exe
  2⤵
  PID:13392
- C:\Windows\System\AwyIlED.exe
  C:\Windows\System\AwyIlED.exe
  2⤵
  PID:13428
- C:\Windows\System\jymbTNo.exe
  C:\Windows\System\jymbTNo.exe
  2⤵
  PID:13444
- C:\Windows\System\IaKIEEB.exe
  C:\Windows\System\IaKIEEB.exe
  2⤵
  PID:13472
- C:\Windows\System\MQUXxIp.exe
  C:\Windows\System\MQUXxIp.exe
  2⤵
  PID:13488
- C:\Windows\System\ASnHDoq.exe
  C:\Windows\System\ASnHDoq.exe
  2⤵
  PID:13520
- C:\Windows\System\yXafQpg.exe
  C:\Windows\System\yXafQpg.exe
  2⤵
  PID:13556
- C:\Windows\System\YPCTOSB.exe
  C:\Windows\System\YPCTOSB.exe
  2⤵
  PID:13580
- C:\Windows\System\tCftOOz.exe
  C:\Windows\System\tCftOOz.exe
  2⤵
  PID:13604
- C:\Windows\System\vGLQrMl.exe
  C:\Windows\System\vGLQrMl.exe
  2⤵
  PID:13632
- C:\Windows\System\XFMvrxq.exe
  C:\Windows\System\XFMvrxq.exe
  2⤵
  PID:13680
- C:\Windows\System\kIzdoVp.exe
  C:\Windows\System\kIzdoVp.exe
  2⤵
  PID:13696
- C:\Windows\System\TXwXgqm.exe
  C:\Windows\System\TXwXgqm.exe
  2⤵
  PID:13724
- C:\Windows\System\iyIgjbw.exe
  C:\Windows\System\iyIgjbw.exe
  2⤵
  PID:13764
- C:\Windows\System\wChgwBm.exe
  C:\Windows\System\wChgwBm.exe
  2⤵
  PID:13780
- C:\Windows\System\ajcrmHx.exe
  C:\Windows\System\ajcrmHx.exe
  2⤵
  PID:13820
- C:\Windows\System\oRKLcNQ.exe
  C:\Windows\System\oRKLcNQ.exe
  2⤵
  PID:13836
- C:\Windows\System\IWQqrRZ.exe
  C:\Windows\System\IWQqrRZ.exe
  2⤵
  PID:13876
- C:\Windows\System\wvQlyvx.exe
  C:\Windows\System\wvQlyvx.exe
  2⤵
  PID:13892
- C:\Windows\System\uvELdEO.exe
  C:\Windows\System\uvELdEO.exe
  2⤵
  PID:13920
- C:\Windows\System\dmXhYux.exe
  C:\Windows\System\dmXhYux.exe
  2⤵
  PID:13940
- C:\Windows\System\MEMorjZ.exe
  C:\Windows\System\MEMorjZ.exe
  2⤵
  PID:13968
- C:\Windows\System\rkzbhls.exe
  C:\Windows\System\rkzbhls.exe
  2⤵
  PID:13992
- C:\Windows\System\YJvEAvm.exe
  C:\Windows\System\YJvEAvm.exe
  2⤵
  PID:14016
- C:\Windows\System\bmNYAXL.exe
  C:\Windows\System\bmNYAXL.exe
  2⤵
  PID:14040
- C:\Windows\System\SwRsQuM.exe
  C:\Windows\System\SwRsQuM.exe
  2⤵
  PID:14064
- C:\Windows\System\PPBkWdK.exe
  C:\Windows\System\PPBkWdK.exe
  2⤵
  PID:14104
- C:\Windows\System\snWYdpe.exe
  C:\Windows\System\snWYdpe.exe
  2⤵
  PID:14128
- C:\Windows\System\zNfgAdM.exe
  C:\Windows\System\zNfgAdM.exe
  2⤵
  PID:14156
- C:\Windows\System\iyNyEfW.exe
  C:\Windows\System\iyNyEfW.exe
  2⤵
  PID:14180
- C:\Windows\System\YiDJqJl.exe
  C:\Windows\System\YiDJqJl.exe
  2⤵
  PID:14208
- C:\Windows\System\lhgjVXw.exe
  C:\Windows\System\lhgjVXw.exe
  2⤵
  PID:14252
- C:\Windows\System\xUXSRMv.exe
  C:\Windows\System\xUXSRMv.exe
  2⤵
  PID:14288
- C:\Windows\System\ooDibaV.exe
  C:\Windows\System\ooDibaV.exe
  2⤵
  PID:14304
- C:\Windows\System\eQrtFRM.exe
  C:\Windows\System\eQrtFRM.exe
  2⤵
  PID:13328
- C:\Windows\System\aWemlkk.exe
  C:\Windows\System\aWemlkk.exe
  2⤵
  PID:13404
- C:\Windows\System\mjMKywk.exe
  C:\Windows\System\mjMKywk.exe
  2⤵
  PID:13436
- C:\Windows\System\TdLXKri.exe
  C:\Windows\System\TdLXKri.exe
  2⤵
  PID:13508
- C:\Windows\System\VhpgSaR.exe
  C:\Windows\System\VhpgSaR.exe
  2⤵
  PID:13540
- C:\Windows\System\oIQjNDW.exe
  C:\Windows\System\oIQjNDW.exe
  2⤵
  PID:13668
- C:\Windows\System\miEQLTM.exe
  C:\Windows\System\miEQLTM.exe
  2⤵
  PID:13712
- C:\Windows\System\IeAUtIT.exe
  C:\Windows\System\IeAUtIT.exe
  2⤵
  PID:13756
- C:\Windows\System\anpfPBK.exe
  C:\Windows\System\anpfPBK.exe
  2⤵
  PID:13816
- C:\Windows\System\LuFgJtq.exe
  C:\Windows\System\LuFgJtq.exe
  2⤵
  PID:13912
- C:\Windows\System\nKHmqWp.exe
  C:\Windows\System\nKHmqWp.exe
  2⤵
  PID:13936
- C:\Windows\System\ubFRVPI.exe
  C:\Windows\System\ubFRVPI.exe
  2⤵
  PID:14084
- C:\Windows\System\ocdpYKc.exe
  C:\Windows\System\ocdpYKc.exe
  2⤵
  PID:14096
- C:\Windows\System\SsbmUse.exe
  C:\Windows\System\SsbmUse.exe
  2⤵
  PID:14140
- C:\Windows\System\sDSEnQV.exe
  C:\Windows\System\sDSEnQV.exe
  2⤵
  PID:14204
- C:\Windows\System\IXCmAPw.exe
  C:\Windows\System\IXCmAPw.exe
  2⤵
  PID:14300
- C:\Windows\System\oBBOYan.exe
  C:\Windows\System\oBBOYan.exe
  2⤵
  PID:12500
- C:\Windows\System\LrINzaO.exe
  C:\Windows\System\LrINzaO.exe
  2⤵
  PID:13412
- C:\Windows\System\mgfAEiq.exe
  C:\Windows\System\mgfAEiq.exe
  2⤵
  PID:13576
- C:\Windows\System\JNJxnzM.exe
  C:\Windows\System\JNJxnzM.exe
  2⤵
  PID:12728
- C:\Windows\System\LrwFchh.exe
  C:\Windows\System\LrwFchh.exe
  2⤵
  PID:13960
- C:\Windows\System\AVUunuz.exe
  C:\Windows\System\AVUunuz.exe
  2⤵
  PID:14012
- C:\Windows\System\chuNdpV.exe
  C:\Windows\System\chuNdpV.exe
  2⤵
  PID:14296
- C:\Windows\System\jNtZWFJ.exe
  C:\Windows\System\jNtZWFJ.exe
  2⤵
  PID:13500
- C:\Windows\System\JevxbFM.exe
  C:\Windows\System\JevxbFM.exe
  2⤵
  PID:13812
- C:\Windows\System\qDsegNZ.exe
  C:\Windows\System\qDsegNZ.exe
  2⤵
  PID:14072
- C:\Windows\System\pslErEz.exe
  C:\Windows\System\pslErEz.exe
  2⤵
  PID:14324
- C:\Windows\System\XAyBepY.exe
  C:\Windows\System\XAyBepY.exe
  2⤵
  PID:14344
- C:\Windows\System\MKEAcGW.exe
  C:\Windows\System\MKEAcGW.exe
  2⤵
  PID:14360
- C:\Windows\System\teBddNg.exe
  C:\Windows\System\teBddNg.exe
  2⤵
  PID:14404
- C:\Windows\System\rwDMBmD.exe
  C:\Windows\System\rwDMBmD.exe
  2⤵
  PID:14428
- C:\Windows\System\DNRmGiW.exe
  C:\Windows\System\DNRmGiW.exe
  2⤵
  PID:14456
- C:\Windows\System\laKRavs.exe
  C:\Windows\System\laKRavs.exe
  2⤵
  PID:14480
- C:\Windows\System\mzuejWa.exe
  C:\Windows\System\mzuejWa.exe
  2⤵
  PID:14504
- C:\Windows\System\eaoyKHF.exe
  C:\Windows\System\eaoyKHF.exe
  2⤵
  PID:14528
- C:\Windows\System\pUocDei.exe
  C:\Windows\System\pUocDei.exe
  2⤵
  PID:14556
- C:\Windows\System\Pelkqdh.exe
  C:\Windows\System\Pelkqdh.exe
  2⤵
  PID:14628
- C:\Windows\System\djxEZfF.exe
  C:\Windows\System\djxEZfF.exe
  2⤵
  PID:14644
- C:\Windows\System\OGUlztm.exe
  C:\Windows\System\OGUlztm.exe
  2⤵
  PID:14672
- C:\Windows\System\NLtsPMX.exe
  C:\Windows\System\NLtsPMX.exe
  2⤵
  PID:14688
- C:\Windows\System\yOCaybL.exe
  C:\Windows\System\yOCaybL.exe
  2⤵
  PID:14708
- C:\Windows\System\ZesyEHY.exe
  C:\Windows\System\ZesyEHY.exe
  2⤵
  PID:14756
- C:\Windows\System\mgopSzs.exe
  C:\Windows\System\mgopSzs.exe
  2⤵
  PID:14784
- C:\Windows\System\zcJKuXP.exe
  C:\Windows\System\zcJKuXP.exe
  2⤵
  PID:14812
- C:\Windows\System\lxnjarL.exe
  C:\Windows\System\lxnjarL.exe
  2⤵
  PID:14840
- C:\Windows\System\ZpDLzFC.exe
  C:\Windows\System\ZpDLzFC.exe
  2⤵
  PID:14856
- C:\Windows\System\qEmLeai.exe
  C:\Windows\System\qEmLeai.exe
  2⤵
  PID:14896
- C:\Windows\System\wgjeoBZ.exe
  C:\Windows\System\wgjeoBZ.exe
  2⤵
  PID:14912
- C:\Windows\System\PZLmvTz.exe
  C:\Windows\System\PZLmvTz.exe
  2⤵
  PID:14936
- C:\Windows\System\EbaAFBn.exe
  C:\Windows\System\EbaAFBn.exe
  2⤵
  PID:14952
- C:\Windows\System\nvNdosy.exe
  C:\Windows\System\nvNdosy.exe
  2⤵
  PID:14972
- C:\Windows\System\CtolDlU.exe
  C:\Windows\System\CtolDlU.exe
  2⤵
  PID:14996
- C:\Windows\System\EaZMelv.exe
  C:\Windows\System\EaZMelv.exe
  2⤵
  PID:15044
- C:\Windows\System\jtnDwlA.exe
  C:\Windows\System\jtnDwlA.exe
  2⤵
  PID:15080
- C:\Windows\System\bqvBDiZ.exe
  C:\Windows\System\bqvBDiZ.exe
  2⤵
  PID:15104
- C:\Windows\System\kIypGLv.exe
  C:\Windows\System\kIypGLv.exe
  2⤵
  PID:15132
- C:\Windows\System\hejDBSV.exe
  C:\Windows\System\hejDBSV.exe
  2⤵
  PID:15168
- C:\Windows\System\JoyqEuv.exe
  C:\Windows\System\JoyqEuv.exe
  2⤵
  PID:15192
- C:\Windows\System\xttCQxF.exe
  C:\Windows\System\xttCQxF.exe
  2⤵
  PID:15232
- C:\Windows\System\sWxufxr.exe
  C:\Windows\System\sWxufxr.exe
  2⤵
  PID:15256
- C:\Windows\System\DOBuTAh.exe
  C:\Windows\System\DOBuTAh.exe
  2⤵
  PID:15280
- C:\Windows\System\hVFNoSh.exe
  C:\Windows\System\hVFNoSh.exe
  2⤵
  PID:15308
- C:\Windows\System\BJmpPvU.exe
  C:\Windows\System\BJmpPvU.exe
  2⤵
  PID:15328
- C:\Windows\System\MMERagG.exe
  C:\Windows\System\MMERagG.exe
  2⤵
  PID:14340
- C:\Windows\System\IVDnIyR.exe
  C:\Windows\System\IVDnIyR.exe
  2⤵
  PID:14392
- C:\Windows\System\hyXwJiD.exe
  C:\Windows\System\hyXwJiD.exe
  2⤵
  PID:14448
- C:\Windows\System\ihTILkw.exe
  C:\Windows\System\ihTILkw.exe
  2⤵
  PID:14464
- C:\Windows\System\ezNuQaO.exe
  C:\Windows\System\ezNuQaO.exe
  2⤵
  PID:14588
- C:\Windows\System\VlfvkDm.exe
  C:\Windows\System\VlfvkDm.exe
  2⤵
  PID:14636
- C:\Windows\System\ANGdMOa.exe
  C:\Windows\System\ANGdMOa.exe
  2⤵
  PID:14752
- C:\Windows\System\KzNnNRo.exe
  C:\Windows\System\KzNnNRo.exe
  2⤵
  PID:14796
- C:\Windows\System\EjNfAWR.exe
  C:\Windows\System\EjNfAWR.exe
  2⤵
  PID:14852
- C:\Windows\System\XbioMzl.exe
  C:\Windows\System\XbioMzl.exe
  2⤵
  PID:3104
- C:\Windows\System\qVdMRri.exe
  C:\Windows\System\qVdMRri.exe
  2⤵
  PID:14960
- C:\Windows\System\qaYltXY.exe
  C:\Windows\System\qaYltXY.exe
  2⤵
  PID:15020
- C:\Windows\System\WHSuEKx.exe
  C:\Windows\System\WHSuEKx.exe
  2⤵
  PID:15064
- C:\Windows\System\SOIePAw.exe
  C:\Windows\System\SOIePAw.exe
  2⤵
  PID:15072
- C:\Windows\System\PCAZsOu.exe
  C:\Windows\System\PCAZsOu.exe
  2⤵
  PID:15244
- C:\Windows\System\otfeLsr.exe
  C:\Windows\System\otfeLsr.exe
  2⤵
  PID:15240
- C:\Windows\System\lrrufSn.exe
  C:\Windows\System\lrrufSn.exe
  2⤵
  PID:15344
- C:\Windows\System\nUBSHZy.exe
  C:\Windows\System\nUBSHZy.exe
  2⤵
  PID:14352
- C:\Windows\System\JxiLRjx.exe
  C:\Windows\System\JxiLRjx.exe
  2⤵
  PID:14444
- C:\Windows\System\yhgrTmj.exe
  C:\Windows\System\yhgrTmj.exe
  2⤵
  PID:14668
- C:\Windows\System\hSvoFti.exe
  C:\Windows\System\hSvoFti.exe
  2⤵
  PID:14824
- C:\Windows\System\PhFJdBv.exe
  C:\Windows\System\PhFJdBv.exe
  2⤵
  PID:14988
- C:\Windows\System\rSElnJT.exe
  C:\Windows\System\rSElnJT.exe
  2⤵
  PID:15112
- C:\Windows\System\QqwhMLU.exe
  C:\Windows\System\QqwhMLU.exe
  2⤵
  PID:15212
- C:\Windows\System\olcwLzY.exe
  C:\Windows\System\olcwLzY.exe
  2⤵
  PID:15324
- C:\Windows\System\fNcaVWm.exe
  C:\Windows\System\fNcaVWm.exe
  2⤵
  PID:14548
- C:\Windows\System\iZbbnjq.exe
  C:\Windows\System\iZbbnjq.exe
  2⤵
  PID:1720
- C:\Windows\System\UGUSJTe.exe
  C:\Windows\System\UGUSJTe.exe
  2⤵
  PID:15160
- C:\Windows\System\ItihdGa.exe
  C:\Windows\System\ItihdGa.exe
  2⤵
  PID:14684
- C:\Windows\System\vXqeiwc.exe
  C:\Windows\System\vXqeiwc.exe
  2⤵
  PID:15056
- C:\Windows\System\FRkxvxQ.exe
  C:\Windows\System\FRkxvxQ.exe
  2⤵
  PID:15376
- C:\Windows\System\NVBpNzv.exe
  C:\Windows\System\NVBpNzv.exe
  2⤵
  PID:15400
- C:\Windows\System\PHjayMR.exe
  C:\Windows\System\PHjayMR.exe
  2⤵
  PID:15424
- C:\Windows\System\eBuWBHb.exe
  C:\Windows\System\eBuWBHb.exe
  2⤵
  PID:15448
- C:\Windows\System\mRkhEHD.exe
  C:\Windows\System\mRkhEHD.exe
  2⤵
  PID:15488
- C:\Windows\System\cMeYzRI.exe
  C:\Windows\System\cMeYzRI.exe
  2⤵
  PID:15516
- C:\Windows\System\BNgBftl.exe
  C:\Windows\System\BNgBftl.exe
  2⤵
  PID:15560
- C:\Windows\System\OamCkTD.exe
  C:\Windows\System\OamCkTD.exe
  2⤵
  PID:15584
- C:\Windows\System\oiwZYhS.exe
  C:\Windows\System\oiwZYhS.exe
  2⤵
  PID:15604
- C:\Windows\System\CsJURdn.exe
  C:\Windows\System\CsJURdn.exe
  2⤵
  PID:15644
- C:\Windows\System\UcRuxzN.exe
  C:\Windows\System\UcRuxzN.exe
  2⤵
  PID:15672
- C:\Windows\System\AdRhGFN.exe
  C:\Windows\System\AdRhGFN.exe
  2⤵
  PID:15700
- C:\Windows\System\ndANMGs.exe
  C:\Windows\System\ndANMGs.exe
  2⤵
  PID:15724
- C:\Windows\System\Peihzyx.exe
  C:\Windows\System\Peihzyx.exe
  2⤵
  PID:15744
- C:\Windows\System\PkLnTcF.exe
  C:\Windows\System\PkLnTcF.exe
  2⤵
  PID:15780
- C:\Windows\System\Hxgdasp.exe
  C:\Windows\System\Hxgdasp.exe
  2⤵
  PID:15800
- C:\Windows\System\YjScyIB.exe
  C:\Windows\System\YjScyIB.exe
  2⤵
  PID:15828
- C:\Windows\System\sKyONnH.exe
  C:\Windows\System\sKyONnH.exe
  2⤵
  PID:15848
- C:\Windows\System\dCdngnG.exe
  C:\Windows\System\dCdngnG.exe
  2⤵
  PID:15884
- C:\Windows\System\hlCvfRD.exe
  C:\Windows\System\hlCvfRD.exe
  2⤵
  PID:15908
- C:\Windows\System\nPmfMUA.exe
  C:\Windows\System\nPmfMUA.exe
  2⤵
  PID:15952
- C:\Windows\System\aZtnPpj.exe
  C:\Windows\System\aZtnPpj.exe
  2⤵
  PID:15976
- C:\Windows\System\gtJSYrx.exe
  C:\Windows\System\gtJSYrx.exe
  2⤵
  PID:16008
- C:\Windows\System\DRkvzuO.exe
  C:\Windows\System\DRkvzuO.exe
  2⤵
  PID:16024
- C:\Windows\System\WwPBpfx.exe
  C:\Windows\System\WwPBpfx.exe
  2⤵
  PID:16052
- C:\Windows\System\aIZNqiq.exe
  C:\Windows\System\aIZNqiq.exe
  2⤵
  PID:16092
- C:\Windows\System\XlorPJK.exe
  C:\Windows\System\XlorPJK.exe
  2⤵
  PID:16108
- C:\Windows\System\hMquiTy.exe
  C:\Windows\System\hMquiTy.exe
  2⤵
  PID:16136
- C:\Windows\System\Eakdaxc.exe
  C:\Windows\System\Eakdaxc.exe
  2⤵
  PID:16164
- C:\Windows\System\RJoVOXz.exe
  C:\Windows\System\RJoVOXz.exe
  2⤵
  PID:16188
- C:\Windows\System\ZBheqAa.exe
  C:\Windows\System\ZBheqAa.exe
  2⤵
  PID:16212
- C:\Windows\System\GaZEveB.exe
  C:\Windows\System\GaZEveB.exe
  2⤵
  PID:16236
- C:\Windows\System\bXGcliZ.exe
  C:\Windows\System\bXGcliZ.exe
  2⤵
  PID:16260
- C:\Windows\System\JeisXoj.exe
  C:\Windows\System\JeisXoj.exe
  2⤵
  PID:16284
- C:\Windows\System\UwvebZX.exe
  C:\Windows\System\UwvebZX.exe
  2⤵
  PID:16348
- C:\Windows\System\JJTQBoB.exe
  C:\Windows\System\JJTQBoB.exe
  2⤵
  PID:16372
- C:\Windows\System\uqSRMGT.exe
  C:\Windows\System\uqSRMGT.exe
  2⤵
  PID:15388
- C:\Windows\System\ojIlLTz.exe
  C:\Windows\System\ojIlLTz.exe
  2⤵
  PID:15412
- C:\Windows\System\snXBMNk.exe
  C:\Windows\System\snXBMNk.exe
  2⤵
  PID:15508
- C:\Windows\System\OdLZRyQ.exe
  C:\Windows\System\OdLZRyQ.exe
  2⤵
  PID:15556
- C:\Windows\System\jypupnN.exe
  C:\Windows\System\jypupnN.exe
  2⤵
  PID:15624
- C:\Windows\System\uLSvPrm.exe
  C:\Windows\System\uLSvPrm.exe
  2⤵
  PID:5076
- C:\Windows\System\JtsPhqb.exe
  C:\Windows\System\JtsPhqb.exe
  2⤵
  PID:15684
- C:\Windows\System\HhiBnNK.exe
  C:\Windows\System\HhiBnNK.exe
  2⤵
  PID:15812
- C:\Windows\System\LYUigYe.exe
  C:\Windows\System\LYUigYe.exe
  2⤵
  PID:15840
- C:\Windows\System\HazaAek.exe
  C:\Windows\System\HazaAek.exe
  2⤵
  PID:15868
- C:\Windows\System\ypcDRxz.exe
  C:\Windows\System\ypcDRxz.exe
  2⤵
  PID:15936
- C:\Windows\System\NEWwVkQ.exe
  C:\Windows\System\NEWwVkQ.exe
  2⤵
  PID:15984
- C:\Windows\System\LThfZaw.exe
  C:\Windows\System\LThfZaw.exe
  2⤵
  PID:4896
- C:\Windows\System\zqNXtOP.exe
  C:\Windows\System\zqNXtOP.exe
  2⤵
  PID:16100
- C:\Windows\System\qUVkoYK.exe
  C:\Windows\System\qUVkoYK.exe
  2⤵
  PID:16156
- C:\Windows\System\AxIDawv.exe
  C:\Windows\System\AxIDawv.exe
  2⤵
  PID:16196
- C:\Windows\System\RLjbKdk.exe
  C:\Windows\System\RLjbKdk.exe
  2⤵
  PID:16228
- C:\Windows\System\kbrbiQj.exe
  C:\Windows\System\kbrbiQj.exe
  2⤵
  PID:16276
- C:\Windows\System\EtZaVzy.exe
  C:\Windows\System\EtZaVzy.exe
  2⤵
  PID:220
- C:\Windows\System\cswKUQG.exe
  C:\Windows\System\cswKUQG.exe
  2⤵
  PID:15408
- C:\Windows\System\YGYXZyh.exe
  C:\Windows\System\YGYXZyh.exe
  2⤵
  PID:15464
- C:\Windows\System\upLlshK.exe
  C:\Windows\System\upLlshK.exe
  2⤵
  PID:15568
- C:\Windows\System\muJZAXc.exe
  C:\Windows\System\muJZAXc.exe
  2⤵
  PID:4132
- C:\Windows\System\tmBOccZ.exe
  C:\Windows\System\tmBOccZ.exe
  2⤵
  PID:15972
- C:\Windows\System\DHIxgQb.exe
  C:\Windows\System\DHIxgQb.exe
  2⤵
  PID:16048
- C:\Windows\System\wxhuRxK.exe
  C:\Windows\System\wxhuRxK.exe
  2⤵
  PID:16172
- C:\Windows\System\JBLBhTC.exe
  C:\Windows\System\JBLBhTC.exe
  2⤵
  PID:16252
- C:\Windows\System\vCjlkxq.exe
  C:\Windows\System\vCjlkxq.exe
  2⤵
  PID:15596
- C:\Windows\System\VuLZKxP.exe
  C:\Windows\System\VuLZKxP.exe
  2⤵
  PID:15876
- C:\Windows\System\aEHWjzR.exe
  C:\Windows\System\aEHWjzR.exe
  2⤵
  PID:16016
- C:\Windows\System\sCHEVow.exe
  C:\Windows\System\sCHEVow.exe
  2⤵
  PID:16268
- C:\Windows\System\vqLzymI.exe
  C:\Windows\System\vqLzymI.exe
  2⤵
  PID:15716
- C:\Windows\System\XMgeZzF.exe
  C:\Windows\System\XMgeZzF.exe
  2⤵
  PID:16400
- C:\Windows\System\UXxzeZw.exe
  C:\Windows\System\UXxzeZw.exe
  2⤵
  PID:16420
- C:\Windows\System\pVwqJxu.exe
  C:\Windows\System\pVwqJxu.exe
  2⤵
  PID:16448
- C:\Windows\System\hqWKokh.exe
  C:\Windows\System\hqWKokh.exe
  2⤵
  PID:16476
- C:\Windows\System\TAnupca.exe
  C:\Windows\System\TAnupca.exe
  2⤵
  PID:16492
- C:\Windows\System\NtGXYyl.exe
  C:\Windows\System\NtGXYyl.exe
  2⤵
  PID:16544
- C:\Windows\System\ASDuSZT.exe
  C:\Windows\System\ASDuSZT.exe
  2⤵
  PID:16560
- C:\Windows\System\OXTnHPB.exe
  C:\Windows\System\OXTnHPB.exe
  2⤵
  PID:16576
- C:\Windows\System\rgeKChU.exe
  C:\Windows\System\rgeKChU.exe
  2⤵
  PID:16592
- C:\Windows\System\gRrzrpn.exe
  C:\Windows\System\gRrzrpn.exe
  2⤵
  PID:16620
- C:\Windows\System\TcUXIdk.exe
  C:\Windows\System\TcUXIdk.exe
  2⤵
  PID:16652
- C:\Windows\System\WKWzKkT.exe
  C:\Windows\System\WKWzKkT.exe
  2⤵
  PID:16688
- C:\Windows\System\KPJgJvy.exe
  C:\Windows\System\KPJgJvy.exe
  2⤵
  PID:16712
- C:\Windows\System\NWiUOpq.exe
  C:\Windows\System\NWiUOpq.exe
  2⤵
  PID:16732
- C:\Windows\System\gcgWPwP.exe
  C:\Windows\System\gcgWPwP.exe
  2⤵
  PID:16780
- C:\Windows\System\aUOPXXu.exe
  C:\Windows\System\aUOPXXu.exe
  2⤵
  PID:16816
- C:\Windows\System\nnTXLCG.exe
  C:\Windows\System\nnTXLCG.exe
  2⤵
  PID:16836
- C:\Windows\System\CnTbaVI.exe
  C:\Windows\System\CnTbaVI.exe
  2⤵
  PID:16864
- C:\Windows\System\pjRaatN.exe
  C:\Windows\System\pjRaatN.exe
  2⤵
  PID:16880
- C:\Windows\System\CYujKXg.exe
  C:\Windows\System\CYujKXg.exe
  2⤵
  PID:16916
- C:\Windows\System\rFbbvmt.exe
  C:\Windows\System\rFbbvmt.exe
  2⤵
  PID:16952
- C:\Windows\System\YhsxnTI.exe
  C:\Windows\System\YhsxnTI.exe
  2⤵
  PID:16976
- C:\Windows\System\zppLTrF.exe
  C:\Windows\System\zppLTrF.exe
  2⤵
  PID:17020
- C:\Windows\System\gcRcfhN.exe
  C:\Windows\System\gcRcfhN.exe
  2⤵
  PID:17044
- C:\Windows\System\AQMmjPN.exe
  C:\Windows\System\AQMmjPN.exe
  2⤵
  PID:17060
- C:\Windows\System\VqmiAkF.exe
  C:\Windows\System\VqmiAkF.exe
  2⤵
  PID:17096
- C:\Windows\System\NFGWPbH.exe
  C:\Windows\System\NFGWPbH.exe
  2⤵
  PID:17120
- C:\Windows\System\fTXZOWV.exe
  C:\Windows\System\fTXZOWV.exe
  2⤵
  PID:17152
- C:\Windows\System\dgneSDC.exe
  C:\Windows\System\dgneSDC.exe
  2⤵
  PID:17184
- C:\Windows\System\LMuXzJh.exe
  C:\Windows\System\LMuXzJh.exe
  2⤵
  PID:17200
- C:\Windows\System\mhUksJA.exe
  C:\Windows\System\mhUksJA.exe
  2⤵
  PID:17244
- C:\Windows\System\gYEhyqz.exe
  C:\Windows\System\gYEhyqz.exe
  2⤵
  PID:17272
- C:\Windows\System\TTfCWZu.exe
  C:\Windows\System\TTfCWZu.exe
  2⤵
  PID:17288
- C:\Windows\System\umrmeYT.exe
  C:\Windows\System\umrmeYT.exe
  2⤵
  PID:17308
- C:\Windows\System\UGyDwVE.exe
  C:\Windows\System\UGyDwVE.exe
  2⤵
  PID:17332
- C:\Windows\System\cdSfxkd.exe
  C:\Windows\System\cdSfxkd.exe
  2⤵
  PID:17384

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BuTqHfO.exe

Path C:\Windows\System\BuTqHfO.exe
Size 1.6MB
SHA256 cb3149699025f21e933ba26fee3a9e87020e73e3ba5296633b560848cc691075
MD5 3124f3879c2b21268bb63da38df675e3
SHA1 49ed77ea1743609b8797cb8600e616d5a9156cbd
SHA512 ef74d30513ec14dd888f476f984af551253373e8fa41d412ed6b12f1a7b18d27181a18575c1189f8bd04f834c906f71697aaaec07def2cf88d2ec2b0eb722635
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUi3:GemTLkNdfE0pZaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

GCtmVSk.exe

Path C:\Windows\System\GCtmVSk.exe
Size 1.6MB
SHA256 53e6b99ae0be6cd44f88d32941d121a184e378088a00e2fbddb465984c74995a
MD5 6c6a7eab698c44f04c24d396e218b889
SHA1 2a302df000cbb4e1a5328de8303db00dff8deb52
SHA512 b1353858de462b9dc86883bd0f7fce056594eb2017fd40199725eccb4807efa16bbc24888a0dc88c022b72cd7492a73c885b8059474963d2efeec62a3cbd2151
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUio:GemTLkNdfE0pZax
MD5 SHA1 SHA512 SSDEEP

Submit Download

GdpRKjR.exe

Path C:\Windows\System\GdpRKjR.exe
Size 1.6MB
SHA256 73196f28c18ef1a83124099b0830d681116c5f4ffaf962e68e57d7a9397ff86d
MD5 deeba1d138e9809078dfc1d3fb24a42e
SHA1 d0b802bade250f57c8f5dcf9fe27df81b2c84e8f
SHA512 6c0a9a490de72c2939aa22e7e67d26a53af6b80f1eef601ef539ee2c5671bab292ffa1ca6ae025181d8e7f5a9f4854b7f0923acbc42be1ad5f2d7bbdd9c7dc46
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUif:GemTLkNdfE0pZao
MD5 SHA1 SHA512 SSDEEP

Submit Download

GjDJcrS.exe

Path C:\Windows\System\GjDJcrS.exe
Size 1.7MB
SHA256 d99e639dbe136a323f035ab14962dd00372c50b9339ad78d8ed241b59b360fc6
MD5 792d4b18fdd96edbb02920fe856dc104
SHA1 b2504570b7fcd0e54c442c7a95536c0fe02bf7ca
SHA512 911e5984cc0f68708b23ff7f38e9300be1b67559b369bd3a433d3709d838d41a06efcdc03dcee2c2c3b96759865f4d1974399602405170b181e87e70bdcf5069
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUil:GemTLkNdfE0pZaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

IBqfHys.exe

Path C:\Windows\System\IBqfHys.exe
Size 1.7MB
SHA256 ec23cb64c0233097f5dbabbbe2c75efbeccc3e785261936beeabb125dd92476c
MD5 67579afd2d1ac14a2b65ea5b9ac61e4b
SHA1 1fefb88f2056c0cb79f8aef4f4164d64e4c5c342
SHA512 751a74e0d6a49b3971041553b3b1ca53fa20bcf6684ee791273c9a9aa76137713982c662e9e5b496f81e95c85451b218c4cb6562fdf43936972870c66b470a5b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiM:GemTLkNdfE0pZap
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISALuOv.exe

Path C:\Windows\System\ISALuOv.exe
Size 1.7MB
SHA256 aa664c74863da95c1adf8ad9ae5d1d98b7a17b760cbf9515677be7b590715f66
MD5 426251cbfd32b570e8fcb0d868f71816
SHA1 33c556d946ea83830202a34f35678b419b82a398
SHA512 49b6a71c6793f1f1df2fcc36dc21899b0af7f478b33179c0a4386e0592a9f2b67c8df20bd2a5fcf60f2eed74df2845ff5845d7ceee0024c3b26fc57878fded86
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiE:GemTLkNdfE0pZa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

IXOoorr.exe

Path C:\Windows\System\IXOoorr.exe
Size 1.7MB
SHA256 d04a576e43229c29a92967109a0307959935df2f2652b1606701028d29fd077b
MD5 b868fdd48dc5008ebda8d63f00f1fdd2
SHA1 e78c054d6a68623010dbb85812dbda075b978b7b
SHA512 8a6568cac79245be5d9465d3182cc5170d7ac24a340db3fb03f19169dace0baa53694cf4bb826d9812fd06c9579d11871cf0fb93e47f617a12fa10f8eaf15c03
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiH:GemTLkNdfE0pZa2
MD5 SHA1 SHA512 SSDEEP

Submit Download

JXoniGC.exe

Path C:\Windows\System\JXoniGC.exe
Size 1.7MB
SHA256 ffe1a3abf95f9e21d59e2db91fda8144f540b4c4e1e8d9144503cf1dfd4814af
MD5 d971403bc008bbf7adaf02215132b08e
SHA1 214a0e9fa1653d728466c4c93e90a54c3fb63c62
SHA512 a66bed90f2e5b1ca38a3ce166618a03d49bd32995bba667ab33d882f1c04695483e387310f63a9463037a0c7f2cfa4987716a74268ebe0244976abb66c9fe090
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiS:GemTLkNdfE0pZaR
MD5 SHA1 SHA512 SSDEEP

Submit Download

JZGCXkx.exe

Path C:\Windows\System\JZGCXkx.exe
Size 1.6MB
SHA256 9a4147854dddae524856e5ab2fd454e0226e466f4802b3e01e68186ba469757a
MD5 65774d1fd4336850fb1278bf2259d52a
SHA1 7fcb3d3099384357465e43071bc845e6d2cbb1fc
SHA512 ea728a2a8829346cac06e148c6d87244983b58309884c0bb8efdfdc7309379de9b44e0b78cc8938d1cea9f9c9f1505dd186c9d2827d5a9b926a03d6c3bf8450c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiK:GemTLkNdfE0pZa/
MD5 SHA1 SHA512 SSDEEP

Submit Download

MDsIwTc.exe

Path C:\Windows\System\MDsIwTc.exe
Size 1.7MB
SHA256 482eb0afb2ddef091dc0ec30f10523be42293098e26c5900fcf4aa88d56e8ebc
MD5 461f0096b12536295feb4efafd4a2d0f
SHA1 8f3b387e8ac56b95d9e3b2010d12ce3ce7c37b65
SHA512 65d34d380f2d6025fada467899838f40021bcf01a5a66657d2a133266fe73c32784159716b57a05aadafd26c48b672517b5f63fb5d3093289c39cd1d17cd76dc
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiN:GemTLkNdfE0pZaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

NMEQZMF.exe

Path C:\Windows\System\NMEQZMF.exe
Size 1.6MB
SHA256 e1c322b81ba6178e4af795c5a53ef24dfd96c6d91612e59198a7ed8dc6274b9d
MD5 b744c5133b252343fdc51f42e92e6f45
SHA1 a6c3ca830386920a2d575edae40b9df46af32cc3
SHA512 f575c08da7efceb3879691ad5cfe6e7c1b83eb2de9908707ca9a3b70446e60f5f943b2160ff8d22791f88c7dfb19a3ce79a0ef514bc87e891158d086508119ae
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUin:GemTLkNdfE0pZa6
MD5 SHA1 SHA512 SSDEEP

Submit Download

RDApnID.exe

Path C:\Windows\System\RDApnID.exe
Size 1.6MB
SHA256 ba0103cabbaede7db761013def50de0fcbf7476faf69d58ff90aaf47023b1c4d
MD5 fbb305ab823892b843a13dc61f71f9af
SHA1 7fdc71c4bfc4baf77c8496b026d140577beee2e7
SHA512 1582ca53367269bb198c16bd803cc9d9dd015461cae00f8a41f0ba58e3898d310fe5ac1a7952f6a721d7aac3d66383cb798dd14a27289f548ae54535e0e9c379
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiK:GemTLkNdfE0pZa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

UxZDOiW.exe

Path C:\Windows\System\UxZDOiW.exe
Size 1.7MB
SHA256 fde60e0b0db5e4ad19b56fe8c12d1a1aeb7c77c2ad59d79bb38fc332d49daaf6
MD5 295f9cfb869eb7d6da06e252add394f0
SHA1 0fd1a352ac6d84fc40bbe339cee24694734c184e
SHA512 cc2436a83f15770f99106c81d51c95649146461f30183f9f720003b0f8d80eec902a09654bb52376e0c9b84667e6cbc6b4f47ffab31bea0153bf05d1acf4503a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiy:GemTLkNdfE0pZah
MD5 SHA1 SHA512 SSDEEP

Submit Download

VuEVcjs.exe

Path C:\Windows\System\VuEVcjs.exe
Size 1.6MB
SHA256 e5cec10302360cc7e42f5b9da85ff80ce15d37c0776e85c0de21b55347b7cc8e
MD5 7c8d38ebaccb0e107289b7a601348983
SHA1 f65c8097e8a1f939afede4ea71de65ec04b214c4
SHA512 f77a523f5785cef46e7577f6e96ad6047f3604ef76416b640d350d6eacd756476a017ba51985f7edaca815595d932bbc5ba04366cda9c50d00d92d6e2ac54fe8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiS:GemTLkNdfE0pZaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

XHQgpZf.exe

Path C:\Windows\System\XHQgpZf.exe
Size 1.6MB
SHA256 e21be0d3da680d2fb7637943a9e31c5a8b5c8390ef0750b7c459af126c0fc3d2
MD5 c2959ea721b1bf7e0c14359a1fc78a34
SHA1 436efee05e6a8b1980c5458460b9fad8c2721e24
SHA512 fc3efbacdad215fa158dbe0b02a724ee34dc7b912431bf697baad001a67cc19f81ea14da008505ab190c84230b550464a7140cba056d770296e09e1a8d4e0750
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiX:GemTLkNdfE0pZaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

YSGfdfy.exe

Path C:\Windows\System\YSGfdfy.exe
Size 1.6MB
SHA256 f4e86ba6990d16fbcfc9f6ca0a55c763b13a671aca4eba0b596e20667b89d2c9
MD5 1a840fca5249f83f72288bf2176d5ba8
SHA1 1ca9b261be562541b0a8b3c81bcbdb1a5c3849f0
SHA512 d925597275bdd4d998bddfdabee1e3f08b45f39ee653f04efa7e0b130ba2c23ac5a7028171c20fcf15732ba78571f6277abd69d5d5a9bd54a33e204613c95640
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUid:GemTLkNdfE0pZas
MD5 SHA1 SHA512 SSDEEP

Submit Download

dOFjheA.exe

Path C:\Windows\System\dOFjheA.exe
Size 1.6MB
SHA256 78991c37a4d015a3382ee83a07f0ec5c6b2ba71364151c47ee200c1ac544253c
MD5 448227c68c0dc5ed40f52617b48563ea
SHA1 d7cee80532fce3d87703a063dd80007993cc0518
SHA512 07f8b887618ee0fb1413a62513b695ac68252d30db3d14187df229a6b5967a80d1b899e91aeaff4797b50b07b8527be898b2164070c3f4451a32fb59f05ee6d1
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUim:GemTLkNdfE0pZa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

eENnuLC.exe

Path C:\Windows\System\eENnuLC.exe
Size 1.7MB
SHA256 a2d67ef8375e8db45036c5c8eea9a84e292189c7b17e0601c17893590ee980a6
MD5 02ea9f4147f9aea69d7714dcd23fd389
SHA1 1638deea2ebac5ef66e988ea0ba78b3cf3a6bda4
SHA512 2077e3bffabddc81063af8bd7b7cc5adabc316361cc2727a4d79216ed8dacbb55aef8bf60f4ac83d1c0c8556d0afef23aed5bb075f0a4aaa66801eb6389e04f4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiR:GemTLkNdfE0pZaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

eGmqUEE.exe

Path C:\Windows\System\eGmqUEE.exe
Size 1.6MB
SHA256 3e590feecbe99b4be420ee112d75b01378095868b102846d7f1e0200a78b8b9c
MD5 0583b1ac59f38c554e0e77b9c7209f84
SHA1 d564c168f1168dbbfd6b03dd330f34efdd47e8fd
SHA512 f61790070ca20b17b99db08aadff5a09340cf5d8ef36492e3084fc80cfca07b655c8875bdc34d3a73cf9c6c4c321bf5cf1354417a39b27f2ce77b5abf1c6484e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUin:GemTLkNdfE0pZaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

fUVzfeA.exe

Path C:\Windows\System\fUVzfeA.exe
Size 1.6MB
SHA256 eb5529072c2f4e04fc518d3b011f563082254dcd4a1dc88cae853c0c9cd9a370
MD5 a223bc6b019d9cc9cc666b61763a544d
SHA1 a7800555ad94607e2e5613515f1a4cb4c704d443
SHA512 f07d4ef6e07b2af8c713d74e7d91a1b9c72a3d61f4ae27bbb330236dd8c33558f96fded2ae523447aac9687ade3dd2b3531e258f944fb8badb7603a488df2685
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiW:GemTLkNdfE0pZan
MD5 SHA1 SHA512 SSDEEP

Submit Download

fxlORoW.exe

Path C:\Windows\System\fxlORoW.exe
Size 1.6MB
SHA256 dc83d6f40c0710a79bef6120b31ddc1aecd4c59f5db8adf6260fb6b762b98dc7
MD5 1dd503c13ec8e0a478a01822808a093d
SHA1 a788ede0ba818a95502128eb5d90077937f48f9f
SHA512 a580c941f77fe3e16ea570b831a76d245e547ab9b82a51a65174e9a29b71f088242844941fa6be7c213da2e98c16cce90e0b555f98bbf497926b577b6623cc91
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUi+:GemTLkNdfE0pZaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ilntyil.exe

Path C:\Windows\System\ilntyil.exe
Size 1.6MB
SHA256 3090df011f64e2d1dd07df4341151a9dab30cd8b2bb9fc82d1e7813f3e2623cf
MD5 30a4dfba38c27ab7c2511806ec2c07c9
SHA1 fe494104ce5b6a44212682bc4929c0aec3e31438
SHA512 a1525d9713e270252e00d89bb7581f192f2800c3a93eb6a73169816bd693f7c2c760f2a5f88cd9271adb323f602797df319fc85991ac522485b22bafed938ae3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUie:GemTLkNdfE0pZa5
MD5 SHA1 SHA512 SSDEEP

Submit Download

isMPdgQ.exe

Path C:\Windows\System\isMPdgQ.exe
Size 1.6MB
SHA256 137f568b95ba6396c0b6bbddaab32f4414991a19f8c7f4168674f20bfb25eace
MD5 583b6e283b70020494f36863911508cc
SHA1 572fdcc33d1495975c3008445e93bb70469b9dab
SHA512 88c469a74c9cdf78a794d0c21e5652d0cf8b83b7ef36a2427f45e45042238d2d1459d3121e40ec7fcc32a1a842d4bd32e2bb308e5801bb8497dc0b93ce11686a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUif:GemTLkNdfE0pZac
MD5 SHA1 SHA512 SSDEEP

Submit Download

jmUutpe.exe

Path C:\Windows\System\jmUutpe.exe
Size 1.6MB
SHA256 e10f95906c1cb33217588a0a70680a82ca5ce476618686f3074143b197b13b43
MD5 c80c3c85ce9eff7f0ceec7502d4cadc9
SHA1 dd4e05d81f04af996e04209d1574c4bb0852187f
SHA512 c63a9e4a8cc76c1e271521e0e9eb1400a5613d85a8f7f8b2b42b66a99679ea03d27d4bf9ab9d45d64220acdca8c6427aae24107cdd7fdf9dd3ef58baadab4c65
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiF:GemTLkNdfE0pZaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

mqNUZCi.exe

Path C:\Windows\System\mqNUZCi.exe
Size 1.6MB
SHA256 1b4cc3a366b666e9f53a3f398e32834eb9c38071fafc537aca20db1e39cabdb9
MD5 0a37e2a82cc3d97f1b4cae9918d47379
SHA1 2e4330e110e8bb8d8ac77bfa3a9df59b6be3ca5b
SHA512 ab4d95776a05531e968a18f0a505783248ec98b05a58a78895a3764ea22499a90b90ff85f1125fa00e625589456033860f30fbe43aa3baad07ac997921cca33e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiJ:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

oIsJaMG.exe

Path C:\Windows\System\oIsJaMG.exe
Size 1.6MB
SHA256 47d9e9102ff76f4dab6e64790f1ddce22c7cb6d5bbb9399f1e0e427881e9acf1
MD5 be80d546058214fdf2c17e8a9c24ebca
SHA1 dd4593931cea0df23f91927609b2b128d3eca274
SHA512 9d8f343f36bbed9d32913e16c9545032e293d37eedd0a2e8f3f711f1b8e6d52922c112afda274e20f93e54dd5d8b116b51882ca7235b1fc9a5e921d006bcc2c6
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiF:GemTLkNdfE0pZaI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ohonGfy.exe

Path C:\Windows\System\ohonGfy.exe
Size 1.6MB
SHA256 216a559bb9bd037813036edb591bab80608470331cc8c9ccd17cae66d5d70579
MD5 09be0b1a87756730a88b6f3ee72b3588
SHA1 00e4638ef1abe8ccf2cd0992c37741f9d1cf39ae
SHA512 4dbc8bec95237f53f303ab2e6ffbfdf28e00d1c6a0c133ff2520534f39ba058c43790841a2b901ab60cd886edfc99f391951a38cebaae40991ac2d1b2dcdee43
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUix:GemTLkNdfE0pZaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

qxQoduB.exe

Path C:\Windows\System\qxQoduB.exe
Size 1.6MB
SHA256 ed0203bbaaa941c3a522ed9561d6f6c7f27acaa579960c23364346b8e46a5dcc
MD5 23c8febee423c3b098f3108c20986eec
SHA1 7206503046f7d9e7c41a085037e0faa49a2f3d17
SHA512 543197c0013d947be0faeafb24f647ec1d9a1324847239ca8003ae95fedee1d14a5f633ea2ea522620ec12ea51751adc57100c9ae39dd9426cce70629ec178f2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUie:GemTLkNdfE0pZan
MD5 SHA1 SHA512 SSDEEP

Submit Download

rdzuLBt.exe

Path C:\Windows\System\rdzuLBt.exe
Size 1.6MB
SHA256 6d5172a13474b5bd754616131325fc5ea953cfb49501055d82cd59c5f9496974
MD5 270b5144db5c60e8d0c579e484e23529
SHA1 039be0b850908008b59a63d6f620b94c85d3c156
SHA512 4a18916bf7daca35d9d75e0dd84b6f05d5380da45f32ca297ddb01d1fbe47fec3bb3fdf417eedd71b76eea6da5ee0766c42c9c2cd730edd5faaaa8edfa5f9c7a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUio:GemTLkNdfE0pZaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

trXtBKh.exe

Path C:\Windows\System\trXtBKh.exe
Size 1.6MB
SHA256 314f1b0ddcf390174371b5b626f4875308e4aea6d81db9f4c6dc82bae39774e8
MD5 0d375adbc6591247b0f502db3b86efda
SHA1 a8daf698ab1b28a6b56a259dcc7de017be3eb7e9
SHA512 ebe272511284cdfa60e8ceeacbdc1b8935e1da854e20d055469deb25dbf7ca48fcd4df2f1f4968adc33c95d85c8bbf02ad884384e1827906afc38bc1c60e30c3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUir:GemTLkNdfE0pZaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

vRSbRxj.exe

Path C:\Windows\System\vRSbRxj.exe
Size 1.6MB
SHA256 92d048df964ec6d4706b599e88055ebd11edcfc290eced2becd17fd5fad69011
MD5 401b6c2899eb0c5d6b06faa643b665bd
SHA1 c356c707a595b4c816101171948153a0479455af
SHA512 4dd1f3591de731c829e1d18f6f68250a3168113a142492adeb8d3108323e94ef00f6b18f65e32c8daf96859ecedb405366dce5041d86f18bf75aa5ae5b64aa45
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiR:GemTLkNdfE0pZaW
MD5 SHA1 SHA512 SSDEEP

Submit Download

xpwagQn.exe

Path C:\Windows\System\xpwagQn.exe
Size 1.7MB
SHA256 81c4e745c10e6f57275477ef6578095eb68c1ba76e72f07fd4f183d85fc7facd
MD5 072907ba6cca14a2e36f1d124c607ef0
SHA1 80a6aba1f918e0f45645ab3ad2c932b0a4c38a1f
SHA512 e34e53c00ae09e22b49ffcfab721e45e97a869a5448af32f5fdc66075aedb687c4b8446faa54308c84c169ac82cc9ccd7d57e035d01033aa7391e52057a461c5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiC8:GemTLkNdfE0pZaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

zroLcDx.exe

Path C:\Windows\System\zroLcDx.exe
Size 1.6MB
SHA256 d2ba3d9d55eafa4bb0d1b6fc7b5a7e7b6d7df2e8851316a69e261df3386ca5d3
MD5 538d981d399d96120aea4cf619c3613d
SHA1 38607229ddb3c62c1f00163d9b91d5197c4e962a
SHA512 5562966f202daa194e2f094e9f7804dfc450f43980b238209668a5048f20b478eff3e8e7a084c15d1a969f6b018e522789351644e1794d9ca605350ac742c471
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUiH:GemTLkNdfE0pZac
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2348-0-0x000001DBF30B0000-0x000001DBF30C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads