xmrig | 69d778b77998594434c2d589546a8b004b1ace4f11f8f5ecb5c48f824dfd4f30

Analysis

max time kernel
97s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
Size 1.6MB
Sample240603-mf5dtsce26
SHA256 69d778b77998594434c2d589546a8b004b1ace4f11f8f5ecb5c48f824dfd4f30
MD5 a0081fa3257108cbed5d4080a37e5920
SHA1 f202a685aad630b7b747e4848e760d869e72890c
SHA512 aef770e2814a483b3b1c31aacf5d7a82a32bf2aa41ac086f8e1b4afa1c1c8da420f77f4ae6cd286ab96856cf31259c9734df46eccfa1be5db906d712eb537d79
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLti:GemTLkNdfE0pZaw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x00050000000232a4-4.dat	xmrig
behavioral2/files/0x0007000000023420-9.dat	xmrig
behavioral2/files/0x0007000000023421-7.dat	xmrig
behavioral2/files/0x0007000000023424-29.dat	xmrig
behavioral2/files/0x0007000000023427-48.dat	xmrig
behavioral2/files/0x0007000000023435-112.dat	xmrig
behavioral2/files/0x000700000002343f-162.dat	xmrig
behavioral2/files/0x000700000002343d-160.dat	xmrig
behavioral2/files/0x000700000002343e-157.dat	xmrig
behavioral2/files/0x000700000002343c-155.dat	xmrig
behavioral2/files/0x000700000002343b-150.dat	xmrig
behavioral2/files/0x000700000002343a-145.dat	xmrig
behavioral2/files/0x0007000000023439-140.dat	xmrig
behavioral2/files/0x0007000000023438-135.dat	xmrig
behavioral2/files/0x0007000000023437-130.dat	xmrig
behavioral2/files/0x0007000000023436-125.dat	xmrig
behavioral2/files/0x0007000000023434-113.dat	xmrig
behavioral2/files/0x0007000000023433-107.dat	xmrig
behavioral2/files/0x0007000000023432-103.dat	xmrig
behavioral2/files/0x0007000000023431-97.dat	xmrig
behavioral2/files/0x0007000000023430-93.dat	xmrig
behavioral2/files/0x000700000002342f-88.dat	xmrig
behavioral2/files/0x000700000002342e-82.dat	xmrig
behavioral2/files/0x000700000002342d-78.dat	xmrig
behavioral2/files/0x000700000002342c-73.dat	xmrig
behavioral2/files/0x000700000002342b-68.dat	xmrig
behavioral2/files/0x000700000002342a-62.dat	xmrig
behavioral2/files/0x0007000000023429-58.dat	xmrig
behavioral2/files/0x0007000000023428-52.dat	xmrig
behavioral2/files/0x0007000000023426-42.dat	xmrig
behavioral2/files/0x0007000000023425-38.dat	xmrig
behavioral2/files/0x0007000000023423-25.dat	xmrig
behavioral2/files/0x0007000000023422-20.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1944	eZtsxIX.exe
2748	hOXmsGG.exe
2548	kKVkCHF.exe
2328	uLujbmF.exe
1832	zxgaQTJ.exe
2964	ncqKqOO.exe
640	xHUsLsC.exe
4952	YRXztkM.exe
544	GZqwvKg.exe
1148	eaFJAKo.exe
4104	KXWqOgT.exe
1792	scYRNHT.exe
2864	PYtsJeM.exe
3632	zPUXxFM.exe
4920	eaNClEn.exe
3176	LTisvTI.exe
4008	WTIymPA.exe
5092	QUdqYcy.exe
5100	HGFAEyC.exe
216	siNzdEX.exe
4472	xCqBJwx.exe
2084	FHNLoJL.exe
2488	UTIukQH.exe
3776	CmdSIoJ.exe
1860	LJbYplu.exe
3236	mJARczO.exe
852	tOTAcGj.exe
4548	fbqHSJq.exe
5032	zQpqfyL.exe
4192	HEhhvAO.exe
1652	xNveERU.exe
4300	VThwOfk.exe
1520	jQcvXfx.exe
4080	TDUAzOK.exe
3968	dsuuYKO.exe
2316	BjSPRlN.exe
4068	Rhlhcdi.exe
3092	iIoniaU.exe
2356	yCLmTlu.exe
4044	pWpDuCW.exe
1012	cWCkuyu.exe
2728	uBdjpJg.exe
1476	ifpcSWL.exe
4216	EEjZRJF.exe
2632	jcOYTVq.exe
4876	DlTjwwG.exe
2344	RZArZUd.exe
4460	YAwpTKW.exe
4120	ptsAAYA.exe
3268	rPQzodN.exe
4420	CuRVQJT.exe
4812	emOKcXt.exe
4788	QOVsRgE.exe
4296	GKsbubn.exe
3452	OUYxJGZ.exe
460	clZQJtS.exe
2776	JuHDgLo.exe
4456	ViZzoiL.exe
408	hNLtbaV.exe
4260	LDceuyY.exe
2712	zGIRUdM.exe
2312	VxxaXnm.exe
2860	axpdMoz.exe
4892	ewQOibt.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uLujbmF.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\AqghnPx.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\UpEHCTm.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\OkMysFe.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\zGIRUdM.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\FYLNGMA.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\IucPlpT.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\GELFDZH.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\mQpgKvV.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\ryAhkwv.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\mMHRkeR.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\mPuzRfL.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\fJzaNzv.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\PYJAPvY.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\rdHovda.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\pDNjGeR.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\aJdRwjh.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\ARUzJOL.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\InzxvTc.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\YcgSUzD.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\EfJbSxG.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\EhDViUE.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\ISeyCPv.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\QOVsRgE.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\AxirZNq.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\KAPncYs.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\YAwpTKW.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\cpggmZL.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\OAWHdWz.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\yvrrQCC.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\PRQfFGI.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\acYeqil.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\MSyaARQ.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\PUMNXmx.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\YRXztkM.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\HULoGkW.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\csCVJvs.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\FIFBjpb.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\CuRVQJT.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\reWZPwE.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\XkItrCb.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\hnhDWhX.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\uqVMLkW.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\eoRHsWO.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\ViZzoiL.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\rryGFaL.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\TvMIzDF.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\MFsLSKB.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\nWyyFHX.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\qWvYRDD.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\QchQrVo.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\wleHJrB.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\NZohuRs.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\MQbQvSR.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\JgmjHtK.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\EvNhgNT.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\JKlZJEF.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\kdMdDKi.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\nQultcG.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\MPDoLGH.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\mIUrulu.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\rjVJCHN.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\AmJuCqZ.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
File created	C:\Windows\System\xBPTdxX.exe	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17388	dwm.exe
Token: SeChangeNotifyPrivilege	17388	dwm.exe
Token: 33	17388	dwm.exe
Token: SeIncBasePriorityPrivilege	17388	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1944	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	86
PID 1880 wrote to memory of 1944	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	86
PID 1880 wrote to memory of 2748	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	87
PID 1880 wrote to memory of 2748	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	87
PID 1880 wrote to memory of 2548	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	88
PID 1880 wrote to memory of 2548	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	88
PID 1880 wrote to memory of 2328	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	89
PID 1880 wrote to memory of 2328	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	89
PID 1880 wrote to memory of 1832	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	90
PID 1880 wrote to memory of 1832	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	90
PID 1880 wrote to memory of 2964	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	91
PID 1880 wrote to memory of 2964	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	91
PID 1880 wrote to memory of 640	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	92
PID 1880 wrote to memory of 640	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	92
PID 1880 wrote to memory of 4952	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	93
PID 1880 wrote to memory of 4952	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	93
PID 1880 wrote to memory of 544	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	94
PID 1880 wrote to memory of 544	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	94
PID 1880 wrote to memory of 1148	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	95
PID 1880 wrote to memory of 1148	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	95
PID 1880 wrote to memory of 4104	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	96
PID 1880 wrote to memory of 4104	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	96
PID 1880 wrote to memory of 1792	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	97
PID 1880 wrote to memory of 1792	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	97
PID 1880 wrote to memory of 2864	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	98
PID 1880 wrote to memory of 2864	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	98
PID 1880 wrote to memory of 3632	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	99
PID 1880 wrote to memory of 3632	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	99
PID 1880 wrote to memory of 4920	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	100
PID 1880 wrote to memory of 4920	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	100
PID 1880 wrote to memory of 3176	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	101
PID 1880 wrote to memory of 3176	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	101
PID 1880 wrote to memory of 4008	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	102
PID 1880 wrote to memory of 4008	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	102
PID 1880 wrote to memory of 5092	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	103
PID 1880 wrote to memory of 5092	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	103
PID 1880 wrote to memory of 5100	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	104
PID 1880 wrote to memory of 5100	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	104
PID 1880 wrote to memory of 216	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	105
PID 1880 wrote to memory of 216	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	105
PID 1880 wrote to memory of 4472	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	106
PID 1880 wrote to memory of 4472	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	106
PID 1880 wrote to memory of 2084	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	107
PID 1880 wrote to memory of 2084	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	107
PID 1880 wrote to memory of 2488	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	108
PID 1880 wrote to memory of 2488	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	108
PID 1880 wrote to memory of 3776	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	109
PID 1880 wrote to memory of 3776	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	109
PID 1880 wrote to memory of 1860	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	110
PID 1880 wrote to memory of 1860	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	110
PID 1880 wrote to memory of 3236	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	111
PID 1880 wrote to memory of 3236	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	111
PID 1880 wrote to memory of 852	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	112
PID 1880 wrote to memory of 852	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	112
PID 1880 wrote to memory of 4548	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	113
PID 1880 wrote to memory of 4548	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	113
PID 1880 wrote to memory of 5032	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	114
PID 1880 wrote to memory of 5032	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	114
PID 1880 wrote to memory of 4192	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	115
PID 1880 wrote to memory of 4192	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	115
PID 1880 wrote to memory of 1652	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	116
PID 1880 wrote to memory of 1652	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	116
PID 1880 wrote to memory of 4300	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	117
PID 1880 wrote to memory of 4300	1880	a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a0081fa3257108cbed5d4080a37e5920_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\System\eZtsxIX.exe
  C:\Windows\System\eZtsxIX.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\hOXmsGG.exe
  C:\Windows\System\hOXmsGG.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\kKVkCHF.exe
  C:\Windows\System\kKVkCHF.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\uLujbmF.exe
  C:\Windows\System\uLujbmF.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\zxgaQTJ.exe
  C:\Windows\System\zxgaQTJ.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\ncqKqOO.exe
  C:\Windows\System\ncqKqOO.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\xHUsLsC.exe
  C:\Windows\System\xHUsLsC.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\YRXztkM.exe
  C:\Windows\System\YRXztkM.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\GZqwvKg.exe
  C:\Windows\System\GZqwvKg.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\eaFJAKo.exe
  C:\Windows\System\eaFJAKo.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\KXWqOgT.exe
  C:\Windows\System\KXWqOgT.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\scYRNHT.exe
  C:\Windows\System\scYRNHT.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\PYtsJeM.exe
  C:\Windows\System\PYtsJeM.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\zPUXxFM.exe
  C:\Windows\System\zPUXxFM.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\eaNClEn.exe
  C:\Windows\System\eaNClEn.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\LTisvTI.exe
  C:\Windows\System\LTisvTI.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\WTIymPA.exe
  C:\Windows\System\WTIymPA.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\QUdqYcy.exe
  C:\Windows\System\QUdqYcy.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\HGFAEyC.exe
  C:\Windows\System\HGFAEyC.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\siNzdEX.exe
  C:\Windows\System\siNzdEX.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\xCqBJwx.exe
  C:\Windows\System\xCqBJwx.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\FHNLoJL.exe
  C:\Windows\System\FHNLoJL.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\UTIukQH.exe
  C:\Windows\System\UTIukQH.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\CmdSIoJ.exe
  C:\Windows\System\CmdSIoJ.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\LJbYplu.exe
  C:\Windows\System\LJbYplu.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\mJARczO.exe
  C:\Windows\System\mJARczO.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\tOTAcGj.exe
  C:\Windows\System\tOTAcGj.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\fbqHSJq.exe
  C:\Windows\System\fbqHSJq.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\zQpqfyL.exe
  C:\Windows\System\zQpqfyL.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\HEhhvAO.exe
  C:\Windows\System\HEhhvAO.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\xNveERU.exe
  C:\Windows\System\xNveERU.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\VThwOfk.exe
  C:\Windows\System\VThwOfk.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\jQcvXfx.exe
  C:\Windows\System\jQcvXfx.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\TDUAzOK.exe
  C:\Windows\System\TDUAzOK.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\dsuuYKO.exe
  C:\Windows\System\dsuuYKO.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\BjSPRlN.exe
  C:\Windows\System\BjSPRlN.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\Rhlhcdi.exe
  C:\Windows\System\Rhlhcdi.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\iIoniaU.exe
  C:\Windows\System\iIoniaU.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\yCLmTlu.exe
  C:\Windows\System\yCLmTlu.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\pWpDuCW.exe
  C:\Windows\System\pWpDuCW.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\cWCkuyu.exe
  C:\Windows\System\cWCkuyu.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\uBdjpJg.exe
  C:\Windows\System\uBdjpJg.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\ifpcSWL.exe
  C:\Windows\System\ifpcSWL.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\EEjZRJF.exe
  C:\Windows\System\EEjZRJF.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\jcOYTVq.exe
  C:\Windows\System\jcOYTVq.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\DlTjwwG.exe
  C:\Windows\System\DlTjwwG.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\RZArZUd.exe
  C:\Windows\System\RZArZUd.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\YAwpTKW.exe
  C:\Windows\System\YAwpTKW.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\ptsAAYA.exe
  C:\Windows\System\ptsAAYA.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\rPQzodN.exe
  C:\Windows\System\rPQzodN.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\CuRVQJT.exe
  C:\Windows\System\CuRVQJT.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\emOKcXt.exe
  C:\Windows\System\emOKcXt.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\QOVsRgE.exe
  C:\Windows\System\QOVsRgE.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\GKsbubn.exe
  C:\Windows\System\GKsbubn.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\OUYxJGZ.exe
  C:\Windows\System\OUYxJGZ.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\clZQJtS.exe
  C:\Windows\System\clZQJtS.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\JuHDgLo.exe
  C:\Windows\System\JuHDgLo.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\ViZzoiL.exe
  C:\Windows\System\ViZzoiL.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\hNLtbaV.exe
  C:\Windows\System\hNLtbaV.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\LDceuyY.exe
  C:\Windows\System\LDceuyY.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\zGIRUdM.exe
  C:\Windows\System\zGIRUdM.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\VxxaXnm.exe
  C:\Windows\System\VxxaXnm.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\axpdMoz.exe
  C:\Windows\System\axpdMoz.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\ewQOibt.exe
  C:\Windows\System\ewQOibt.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\lPdhPKM.exe
  C:\Windows\System\lPdhPKM.exe
  2⤵
  PID:1356
- C:\Windows\System\zJJpPMA.exe
  C:\Windows\System\zJJpPMA.exe
  2⤵
  PID:3424
- C:\Windows\System\ZyvtbWC.exe
  C:\Windows\System\ZyvtbWC.exe
  2⤵
  PID:5040
- C:\Windows\System\IfEgxal.exe
  C:\Windows\System\IfEgxal.exe
  2⤵
  PID:2756
- C:\Windows\System\keZhpsR.exe
  C:\Windows\System\keZhpsR.exe
  2⤵
  PID:4648
- C:\Windows\System\KrsrFET.exe
  C:\Windows\System\KrsrFET.exe
  2⤵
  PID:1616
- C:\Windows\System\lcTdhra.exe
  C:\Windows\System\lcTdhra.exe
  2⤵
  PID:3288
- C:\Windows\System\nKSPCvR.exe
  C:\Windows\System\nKSPCvR.exe
  2⤵
  PID:4000
- C:\Windows\System\jkpTxMC.exe
  C:\Windows\System\jkpTxMC.exe
  2⤵
  PID:396
- C:\Windows\System\txIqYuw.exe
  C:\Windows\System\txIqYuw.exe
  2⤵
  PID:4408
- C:\Windows\System\wEQzfad.exe
  C:\Windows\System\wEQzfad.exe
  2⤵
  PID:5096
- C:\Windows\System\bbUuTcO.exe
  C:\Windows\System\bbUuTcO.exe
  2⤵
  PID:8
- C:\Windows\System\tBFWttQ.exe
  C:\Windows\System\tBFWttQ.exe
  2⤵
  PID:4464
- C:\Windows\System\AmJuCqZ.exe
  C:\Windows\System\AmJuCqZ.exe
  2⤵
  PID:4108
- C:\Windows\System\qPWgyYZ.exe
  C:\Windows\System\qPWgyYZ.exe
  2⤵
  PID:2600
- C:\Windows\System\cMQFmPM.exe
  C:\Windows\System\cMQFmPM.exe
  2⤵
  PID:4700
- C:\Windows\System\auUKXwu.exe
  C:\Windows\System\auUKXwu.exe
  2⤵
  PID:1480
- C:\Windows\System\tipIWRw.exe
  C:\Windows\System\tipIWRw.exe
  2⤵
  PID:2012
- C:\Windows\System\FFjrhBx.exe
  C:\Windows\System\FFjrhBx.exe
  2⤵
  PID:4604
- C:\Windows\System\JFfpMYK.exe
  C:\Windows\System\JFfpMYK.exe
  2⤵
  PID:5124
- C:\Windows\System\FgoaeeT.exe
  C:\Windows\System\FgoaeeT.exe
  2⤵
  PID:5148
- C:\Windows\System\pYnTolS.exe
  C:\Windows\System\pYnTolS.exe
  2⤵
  PID:5180
- C:\Windows\System\CvArJWZ.exe
  C:\Windows\System\CvArJWZ.exe
  2⤵
  PID:5208
- C:\Windows\System\wlORmlu.exe
  C:\Windows\System\wlORmlu.exe
  2⤵
  PID:5236
- C:\Windows\System\yvrrQCC.exe
  C:\Windows\System\yvrrQCC.exe
  2⤵
  PID:5264
- C:\Windows\System\SjaCLKu.exe
  C:\Windows\System\SjaCLKu.exe
  2⤵
  PID:5292
- C:\Windows\System\XeYxgwO.exe
  C:\Windows\System\XeYxgwO.exe
  2⤵
  PID:5320
- C:\Windows\System\gEOrNxA.exe
  C:\Windows\System\gEOrNxA.exe
  2⤵
  PID:5348
- C:\Windows\System\IfePQbX.exe
  C:\Windows\System\IfePQbX.exe
  2⤵
  PID:5376
- C:\Windows\System\uaqTAoO.exe
  C:\Windows\System\uaqTAoO.exe
  2⤵
  PID:5404
- C:\Windows\System\iAWyPsz.exe
  C:\Windows\System\iAWyPsz.exe
  2⤵
  PID:5432
- C:\Windows\System\AJToaMb.exe
  C:\Windows\System\AJToaMb.exe
  2⤵
  PID:5460
- C:\Windows\System\yugEtnz.exe
  C:\Windows\System\yugEtnz.exe
  2⤵
  PID:5488
- C:\Windows\System\qQXAoTd.exe
  C:\Windows\System\qQXAoTd.exe
  2⤵
  PID:5516
- C:\Windows\System\GJUnrEx.exe
  C:\Windows\System\GJUnrEx.exe
  2⤵
  PID:5540
- C:\Windows\System\XnUDUMN.exe
  C:\Windows\System\XnUDUMN.exe
  2⤵
  PID:5568
- C:\Windows\System\JflaBDt.exe
  C:\Windows\System\JflaBDt.exe
  2⤵
  PID:5596
- C:\Windows\System\KEPAjfL.exe
  C:\Windows\System\KEPAjfL.exe
  2⤵
  PID:5624
- C:\Windows\System\AXwdrAF.exe
  C:\Windows\System\AXwdrAF.exe
  2⤵
  PID:5652
- C:\Windows\System\YeqDsDZ.exe
  C:\Windows\System\YeqDsDZ.exe
  2⤵
  PID:5680
- C:\Windows\System\XkEZENz.exe
  C:\Windows\System\XkEZENz.exe
  2⤵
  PID:5712
- C:\Windows\System\sUnfVeD.exe
  C:\Windows\System\sUnfVeD.exe
  2⤵
  PID:5740
- C:\Windows\System\fIqEHut.exe
  C:\Windows\System\fIqEHut.exe
  2⤵
  PID:5768
- C:\Windows\System\xBenrTD.exe
  C:\Windows\System\xBenrTD.exe
  2⤵
  PID:5796
- C:\Windows\System\hEMyMrI.exe
  C:\Windows\System\hEMyMrI.exe
  2⤵
  PID:5824
- C:\Windows\System\JgmjHtK.exe
  C:\Windows\System\JgmjHtK.exe
  2⤵
  PID:5852
- C:\Windows\System\loUIXnc.exe
  C:\Windows\System\loUIXnc.exe
  2⤵
  PID:5880
- C:\Windows\System\EFxpqHW.exe
  C:\Windows\System\EFxpqHW.exe
  2⤵
  PID:5904
- C:\Windows\System\NGkztHb.exe
  C:\Windows\System\NGkztHb.exe
  2⤵
  PID:5936
- C:\Windows\System\RftmrRE.exe
  C:\Windows\System\RftmrRE.exe
  2⤵
  PID:5964
- C:\Windows\System\FYLNGMA.exe
  C:\Windows\System\FYLNGMA.exe
  2⤵
  PID:5992
- C:\Windows\System\WfJHAhp.exe
  C:\Windows\System\WfJHAhp.exe
  2⤵
  PID:6020
- C:\Windows\System\GVWHGrW.exe
  C:\Windows\System\GVWHGrW.exe
  2⤵
  PID:6044
- C:\Windows\System\ywyjCGT.exe
  C:\Windows\System\ywyjCGT.exe
  2⤵
  PID:6076
- C:\Windows\System\KYqIRBC.exe
  C:\Windows\System\KYqIRBC.exe
  2⤵
  PID:6100
- C:\Windows\System\qPDQtKx.exe
  C:\Windows\System\qPDQtKx.exe
  2⤵
  PID:6128
- C:\Windows\System\iPtwRpf.exe
  C:\Windows\System\iPtwRpf.exe
  2⤵
  PID:4032
- C:\Windows\System\kkOXLLP.exe
  C:\Windows\System\kkOXLLP.exe
  2⤵
  PID:3560
- C:\Windows\System\VlKVrZg.exe
  C:\Windows\System\VlKVrZg.exe
  2⤵
  PID:428
- C:\Windows\System\SLXInXx.exe
  C:\Windows\System\SLXInXx.exe
  2⤵
  PID:1284
- C:\Windows\System\hQjXPZq.exe
  C:\Windows\System\hQjXPZq.exe
  2⤵
  PID:2476
- C:\Windows\System\ROEaysx.exe
  C:\Windows\System\ROEaysx.exe
  2⤵
  PID:2672
- C:\Windows\System\TppVRdQ.exe
  C:\Windows\System\TppVRdQ.exe
  2⤵
  PID:1872
- C:\Windows\System\QPlEBuU.exe
  C:\Windows\System\QPlEBuU.exe
  2⤵
  PID:5140
- C:\Windows\System\rryGFaL.exe
  C:\Windows\System\rryGFaL.exe
  2⤵
  PID:5196
- C:\Windows\System\boiBOoB.exe
  C:\Windows\System\boiBOoB.exe
  2⤵
  PID:5276
- C:\Windows\System\HOnUPvv.exe
  C:\Windows\System\HOnUPvv.exe
  2⤵
  PID:5336
- C:\Windows\System\iBCYkXi.exe
  C:\Windows\System\iBCYkXi.exe
  2⤵
  PID:5416
- C:\Windows\System\vfMNgXg.exe
  C:\Windows\System\vfMNgXg.exe
  2⤵
  PID:5472
- C:\Windows\System\FlHYCnb.exe
  C:\Windows\System\FlHYCnb.exe
  2⤵
  PID:5532
- C:\Windows\System\RdWGPGf.exe
  C:\Windows\System\RdWGPGf.exe
  2⤵
  PID:5592
- C:\Windows\System\CwAYCsG.exe
  C:\Windows\System\CwAYCsG.exe
  2⤵
  PID:5668
- C:\Windows\System\zaROVXV.exe
  C:\Windows\System\zaROVXV.exe
  2⤵
  PID:5728
- C:\Windows\System\OBRksFz.exe
  C:\Windows\System\OBRksFz.exe
  2⤵
  PID:5788
- C:\Windows\System\PRwGErv.exe
  C:\Windows\System\PRwGErv.exe
  2⤵
  PID:5864
- C:\Windows\System\iYVyTKE.exe
  C:\Windows\System\iYVyTKE.exe
  2⤵
  PID:5916
- C:\Windows\System\ATLlEDX.exe
  C:\Windows\System\ATLlEDX.exe
  2⤵
  PID:5984
- C:\Windows\System\UwCQfHR.exe
  C:\Windows\System\UwCQfHR.exe
  2⤵
  PID:6040
- C:\Windows\System\GzKwUyl.exe
  C:\Windows\System\GzKwUyl.exe
  2⤵
  PID:6116
- C:\Windows\System\bxvVMSs.exe
  C:\Windows\System\bxvVMSs.exe
  2⤵
  PID:3584
- C:\Windows\System\psLBEJr.exe
  C:\Windows\System\psLBEJr.exe
  2⤵
  PID:3220
- C:\Windows\System\svXAvsl.exe
  C:\Windows\System\svXAvsl.exe
  2⤵
  PID:2004
- C:\Windows\System\IGaPSDo.exe
  C:\Windows\System\IGaPSDo.exe
  2⤵
  PID:5172
- C:\Windows\System\JryGgBH.exe
  C:\Windows\System\JryGgBH.exe
  2⤵
  PID:5312
- C:\Windows\System\TvMIzDF.exe
  C:\Windows\System\TvMIzDF.exe
  2⤵
  PID:5500
- C:\Windows\System\RfJTcaT.exe
  C:\Windows\System\RfJTcaT.exe
  2⤵
  PID:5640
- C:\Windows\System\jSLQABp.exe
  C:\Windows\System\jSLQABp.exe
  2⤵
  PID:4432
- C:\Windows\System\zOlhUQW.exe
  C:\Windows\System\zOlhUQW.exe
  2⤵
  PID:6148
- C:\Windows\System\ATXicBg.exe
  C:\Windows\System\ATXicBg.exe
  2⤵
  PID:6176
- C:\Windows\System\bxhdeZj.exe
  C:\Windows\System\bxhdeZj.exe
  2⤵
  PID:6204
- C:\Windows\System\jWOgIdh.exe
  C:\Windows\System\jWOgIdh.exe
  2⤵
  PID:6232
- C:\Windows\System\RELLRun.exe
  C:\Windows\System\RELLRun.exe
  2⤵
  PID:6260
- C:\Windows\System\mzWyBrW.exe
  C:\Windows\System\mzWyBrW.exe
  2⤵
  PID:6288
- C:\Windows\System\PqDBBQw.exe
  C:\Windows\System\PqDBBQw.exe
  2⤵
  PID:6316
- C:\Windows\System\TqeOwQR.exe
  C:\Windows\System\TqeOwQR.exe
  2⤵
  PID:6332
- C:\Windows\System\pgvqpRS.exe
  C:\Windows\System\pgvqpRS.exe
  2⤵
  PID:6360
- C:\Windows\System\EvNhgNT.exe
  C:\Windows\System\EvNhgNT.exe
  2⤵
  PID:6396
- C:\Windows\System\COlBpPN.exe
  C:\Windows\System\COlBpPN.exe
  2⤵
  PID:6428
- C:\Windows\System\tYNvxsb.exe
  C:\Windows\System\tYNvxsb.exe
  2⤵
  PID:6456
- C:\Windows\System\sXOzXPU.exe
  C:\Windows\System\sXOzXPU.exe
  2⤵
  PID:6480
- C:\Windows\System\ztzZMfh.exe
  C:\Windows\System\ztzZMfh.exe
  2⤵
  PID:6512
- C:\Windows\System\wXGpgsn.exe
  C:\Windows\System\wXGpgsn.exe
  2⤵
  PID:6540
- C:\Windows\System\NjNEIQW.exe
  C:\Windows\System\NjNEIQW.exe
  2⤵
  PID:6568
- C:\Windows\System\pyEdOfg.exe
  C:\Windows\System\pyEdOfg.exe
  2⤵
  PID:6596
- C:\Windows\System\JNKKSkh.exe
  C:\Windows\System\JNKKSkh.exe
  2⤵
  PID:6620
- C:\Windows\System\vofJBmr.exe
  C:\Windows\System\vofJBmr.exe
  2⤵
  PID:6648
- C:\Windows\System\EaJasMj.exe
  C:\Windows\System\EaJasMj.exe
  2⤵
  PID:6680
- C:\Windows\System\OutRlhk.exe
  C:\Windows\System\OutRlhk.exe
  2⤵
  PID:6708
- C:\Windows\System\tcLCJIS.exe
  C:\Windows\System\tcLCJIS.exe
  2⤵
  PID:6736
- C:\Windows\System\LuWvbnc.exe
  C:\Windows\System\LuWvbnc.exe
  2⤵
  PID:6764
- C:\Windows\System\IJNRtzx.exe
  C:\Windows\System\IJNRtzx.exe
  2⤵
  PID:6792
- C:\Windows\System\VHDfsjO.exe
  C:\Windows\System\VHDfsjO.exe
  2⤵
  PID:6820
- C:\Windows\System\jUfrkHp.exe
  C:\Windows\System\jUfrkHp.exe
  2⤵
  PID:6848
- C:\Windows\System\UTsqFfU.exe
  C:\Windows\System\UTsqFfU.exe
  2⤵
  PID:6876
- C:\Windows\System\ALEOkhF.exe
  C:\Windows\System\ALEOkhF.exe
  2⤵
  PID:6904
- C:\Windows\System\CVoYFkn.exe
  C:\Windows\System\CVoYFkn.exe
  2⤵
  PID:6932
- C:\Windows\System\iEldalZ.exe
  C:\Windows\System\iEldalZ.exe
  2⤵
  PID:6960
- C:\Windows\System\xsEbKNF.exe
  C:\Windows\System\xsEbKNF.exe
  2⤵
  PID:6988
- C:\Windows\System\cKPamUi.exe
  C:\Windows\System\cKPamUi.exe
  2⤵
  PID:7016
- C:\Windows\System\yFndFxb.exe
  C:\Windows\System\yFndFxb.exe
  2⤵
  PID:7044
- C:\Windows\System\JDOFwQE.exe
  C:\Windows\System\JDOFwQE.exe
  2⤵
  PID:7072
- C:\Windows\System\fLcVZHc.exe
  C:\Windows\System\fLcVZHc.exe
  2⤵
  PID:7100
- C:\Windows\System\zSAvWHn.exe
  C:\Windows\System\zSAvWHn.exe
  2⤵
  PID:7128
- C:\Windows\System\ASqpGkM.exe
  C:\Windows\System\ASqpGkM.exe
  2⤵
  PID:7152
- C:\Windows\System\PScWths.exe
  C:\Windows\System\PScWths.exe
  2⤵
  PID:5980
- C:\Windows\System\MqnGWZO.exe
  C:\Windows\System\MqnGWZO.exe
  2⤵
  PID:2556
- C:\Windows\System\fQVVCDz.exe
  C:\Windows\System\fQVVCDz.exe
  2⤵
  PID:4252
- C:\Windows\System\ENQIYYL.exe
  C:\Windows\System\ENQIYYL.exe
  2⤵
  PID:5248
- C:\Windows\System\sJrGRVI.exe
  C:\Windows\System\sJrGRVI.exe
  2⤵
  PID:5564
- C:\Windows\System\PJsfsHj.exe
  C:\Windows\System\PJsfsHj.exe
  2⤵
  PID:5840
- C:\Windows\System\mzRsHXn.exe
  C:\Windows\System\mzRsHXn.exe
  2⤵
  PID:6216
- C:\Windows\System\qpQAEMy.exe
  C:\Windows\System\qpQAEMy.exe
  2⤵
  PID:6276
- C:\Windows\System\zeinXEj.exe
  C:\Windows\System\zeinXEj.exe
  2⤵
  PID:6328
- C:\Windows\System\rNOMAqw.exe
  C:\Windows\System\rNOMAqw.exe
  2⤵
  PID:6384
- C:\Windows\System\vUiHKqj.exe
  C:\Windows\System\vUiHKqj.exe
  2⤵
  PID:6444
- C:\Windows\System\TznaVPT.exe
  C:\Windows\System\TznaVPT.exe
  2⤵
  PID:6500
- C:\Windows\System\rSFxyXf.exe
  C:\Windows\System\rSFxyXf.exe
  2⤵
  PID:6560
- C:\Windows\System\kdMdDKi.exe
  C:\Windows\System\kdMdDKi.exe
  2⤵
  PID:7004
- C:\Windows\System\HrGCfiN.exe
  C:\Windows\System\HrGCfiN.exe
  2⤵
  PID:7056
- C:\Windows\System\wbZVApj.exe
  C:\Windows\System\wbZVApj.exe
  2⤵
  PID:2836
- C:\Windows\System\gWEyWfH.exe
  C:\Windows\System\gWEyWfH.exe
  2⤵
  PID:7092
- C:\Windows\System\uZENWFW.exe
  C:\Windows\System\uZENWFW.exe
  2⤵
  PID:7120
- C:\Windows\System\wurJWow.exe
  C:\Windows\System\wurJWow.exe
  2⤵
  PID:5892
- C:\Windows\System\rjVJCHN.exe
  C:\Windows\System\rjVJCHN.exe
  2⤵
  PID:6088
- C:\Windows\System\PMLAbnd.exe
  C:\Windows\System\PMLAbnd.exe
  2⤵
  PID:4416
- C:\Windows\System\wOLtvKX.exe
  C:\Windows\System\wOLtvKX.exe
  2⤵
  PID:5424
- C:\Windows\System\NnQBZDf.exe
  C:\Windows\System\NnQBZDf.exe
  2⤵
  PID:5816
- C:\Windows\System\gztDlXi.exe
  C:\Windows\System\gztDlXi.exe
  2⤵
  PID:6300
- C:\Windows\System\ZTapLmU.exe
  C:\Windows\System\ZTapLmU.exe
  2⤵
  PID:996
- C:\Windows\System\TJTetzy.exe
  C:\Windows\System\TJTetzy.exe
  2⤵
  PID:3784
- C:\Windows\System\voGMjAI.exe
  C:\Windows\System\voGMjAI.exe
  2⤵
  PID:6416
- C:\Windows\System\fqSUVmL.exe
  C:\Windows\System\fqSUVmL.exe
  2⤵
  PID:856
- C:\Windows\System\JibNRvY.exe
  C:\Windows\System\JibNRvY.exe
  2⤵
  PID:1208
- C:\Windows\System\dlneHWX.exe
  C:\Windows\System\dlneHWX.exe
  2⤵
  PID:6696
- C:\Windows\System\fYjdGQJ.exe
  C:\Windows\System\fYjdGQJ.exe
  2⤵
  PID:4688
- C:\Windows\System\JyLKisu.exe
  C:\Windows\System\JyLKisu.exe
  2⤵
  PID:6668
- C:\Windows\System\lslqFSW.exe
  C:\Windows\System\lslqFSW.exe
  2⤵
  PID:6724
- C:\Windows\System\oWJXwRb.exe
  C:\Windows\System\oWJXwRb.exe
  2⤵
  PID:7140
- C:\Windows\System\SihdaAB.exe
  C:\Windows\System\SihdaAB.exe
  2⤵
  PID:4712
- C:\Windows\System\ontRzXJ.exe
  C:\Windows\System\ontRzXJ.exe
  2⤵
  PID:5704
- C:\Windows\System\driBgfx.exe
  C:\Windows\System\driBgfx.exe
  2⤵
  PID:6248
- C:\Windows\System\PRQfFGI.exe
  C:\Windows\System\PRQfFGI.exe
  2⤵
  PID:6836
- C:\Windows\System\pzBQeHi.exe
  C:\Windows\System\pzBQeHi.exe
  2⤵
  PID:3712
- C:\Windows\System\YgQPIuA.exe
  C:\Windows\System\YgQPIuA.exe
  2⤵
  PID:548
- C:\Windows\System\lvYGCGg.exe
  C:\Windows\System\lvYGCGg.exe
  2⤵
  PID:4888
- C:\Windows\System\xwpNvZy.exe
  C:\Windows\System\xwpNvZy.exe
  2⤵
  PID:6728
- C:\Windows\System\lJHWOBp.exe
  C:\Windows\System\lJHWOBp.exe
  2⤵
  PID:3708
- C:\Windows\System\yXxEfeH.exe
  C:\Windows\System\yXxEfeH.exe
  2⤵
  PID:6252
- C:\Windows\System\aBYyaIq.exe
  C:\Windows\System\aBYyaIq.exe
  2⤵
  PID:2104
- C:\Windows\System\UoSMXtC.exe
  C:\Windows\System\UoSMXtC.exe
  2⤵
  PID:3300
- C:\Windows\System\rJWhHVR.exe
  C:\Windows\System\rJWhHVR.exe
  2⤵
  PID:3264
- C:\Windows\System\tpDOsMi.exe
  C:\Windows\System\tpDOsMi.exe
  2⤵
  PID:5700
- C:\Windows\System\hlRIMgz.exe
  C:\Windows\System\hlRIMgz.exe
  2⤵
  PID:7196
- C:\Windows\System\viRrwKZ.exe
  C:\Windows\System\viRrwKZ.exe
  2⤵
  PID:7212
- C:\Windows\System\aJdRwjh.exe
  C:\Windows\System\aJdRwjh.exe
  2⤵
  PID:7240
- C:\Windows\System\ElErRpz.exe
  C:\Windows\System\ElErRpz.exe
  2⤵
  PID:7260
- C:\Windows\System\tOnijfo.exe
  C:\Windows\System\tOnijfo.exe
  2⤵
  PID:7304
- C:\Windows\System\QchQrVo.exe
  C:\Windows\System\QchQrVo.exe
  2⤵
  PID:7328
- C:\Windows\System\iCCYtlG.exe
  C:\Windows\System\iCCYtlG.exe
  2⤵
  PID:7344
- C:\Windows\System\wfvBzgb.exe
  C:\Windows\System\wfvBzgb.exe
  2⤵
  PID:7372
- C:\Windows\System\nsOANSb.exe
  C:\Windows\System\nsOANSb.exe
  2⤵
  PID:7424
- C:\Windows\System\PEqWwMS.exe
  C:\Windows\System\PEqWwMS.exe
  2⤵
  PID:7448
- C:\Windows\System\aDxAYPP.exe
  C:\Windows\System\aDxAYPP.exe
  2⤵
  PID:7480
- C:\Windows\System\ngxEDSK.exe
  C:\Windows\System\ngxEDSK.exe
  2⤵
  PID:7512
- C:\Windows\System\YlhVInk.exe
  C:\Windows\System\YlhVInk.exe
  2⤵
  PID:7540
- C:\Windows\System\IylcCBg.exe
  C:\Windows\System\IylcCBg.exe
  2⤵
  PID:7580
- C:\Windows\System\GcIvgXK.exe
  C:\Windows\System\GcIvgXK.exe
  2⤵
  PID:7596
- C:\Windows\System\acYeqil.exe
  C:\Windows\System\acYeqil.exe
  2⤵
  PID:7612
- C:\Windows\System\jZvrjDW.exe
  C:\Windows\System\jZvrjDW.exe
  2⤵
  PID:7640
- C:\Windows\System\qJXpzyx.exe
  C:\Windows\System\qJXpzyx.exe
  2⤵
  PID:7668
- C:\Windows\System\CacgNGI.exe
  C:\Windows\System\CacgNGI.exe
  2⤵
  PID:7700
- C:\Windows\System\BdmqSkW.exe
  C:\Windows\System\BdmqSkW.exe
  2⤵
  PID:7724
- C:\Windows\System\lurWdSP.exe
  C:\Windows\System\lurWdSP.exe
  2⤵
  PID:7756
- C:\Windows\System\gmNeGhN.exe
  C:\Windows\System\gmNeGhN.exe
  2⤵
  PID:7784
- C:\Windows\System\uctaaVt.exe
  C:\Windows\System\uctaaVt.exe
  2⤵
  PID:7820
- C:\Windows\System\VEqvtSr.exe
  C:\Windows\System\VEqvtSr.exe
  2⤵
  PID:7836
- C:\Windows\System\VdiaJNr.exe
  C:\Windows\System\VdiaJNr.exe
  2⤵
  PID:7852
- C:\Windows\System\jYNIAeU.exe
  C:\Windows\System\jYNIAeU.exe
  2⤵
  PID:7868
- C:\Windows\System\JmZTDbF.exe
  C:\Windows\System\JmZTDbF.exe
  2⤵
  PID:7892
- C:\Windows\System\RCtvEpE.exe
  C:\Windows\System\RCtvEpE.exe
  2⤵
  PID:7924
- C:\Windows\System\dhdzYHq.exe
  C:\Windows\System\dhdzYHq.exe
  2⤵
  PID:7956
- C:\Windows\System\HeByFWm.exe
  C:\Windows\System\HeByFWm.exe
  2⤵
  PID:8028
- C:\Windows\System\kSqwigf.exe
  C:\Windows\System\kSqwigf.exe
  2⤵
  PID:8044
- C:\Windows\System\RuCQuQV.exe
  C:\Windows\System\RuCQuQV.exe
  2⤵
  PID:8060
- C:\Windows\System\dxHkzSz.exe
  C:\Windows\System\dxHkzSz.exe
  2⤵
  PID:8100
- C:\Windows\System\NUJfdYt.exe
  C:\Windows\System\NUJfdYt.exe
  2⤵
  PID:8140
- C:\Windows\System\aDEBmCo.exe
  C:\Windows\System\aDEBmCo.exe
  2⤵
  PID:8184
- C:\Windows\System\MFsLSKB.exe
  C:\Windows\System\MFsLSKB.exe
  2⤵
  PID:7184
- C:\Windows\System\sjbLjqi.exe
  C:\Windows\System\sjbLjqi.exe
  2⤵
  PID:7268
- C:\Windows\System\AJxESHx.exe
  C:\Windows\System\AJxESHx.exe
  2⤵
  PID:7320
- C:\Windows\System\ygEkXOq.exe
  C:\Windows\System\ygEkXOq.exe
  2⤵
  PID:7364
- C:\Windows\System\iuobcdn.exe
  C:\Windows\System\iuobcdn.exe
  2⤵
  PID:7444
- C:\Windows\System\ojnmOkf.exe
  C:\Windows\System\ojnmOkf.exe
  2⤵
  PID:7476
- C:\Windows\System\FRFtYBo.exe
  C:\Windows\System\FRFtYBo.exe
  2⤵
  PID:7536
- C:\Windows\System\KQeUUUk.exe
  C:\Windows\System\KQeUUUk.exe
  2⤵
  PID:7652
- C:\Windows\System\oUJLSzk.exe
  C:\Windows\System\oUJLSzk.exe
  2⤵
  PID:7764
- C:\Windows\System\mfzHUHS.exe
  C:\Windows\System\mfzHUHS.exe
  2⤵
  PID:7804
- C:\Windows\System\coOwIpE.exe
  C:\Windows\System\coOwIpE.exe
  2⤵
  PID:7828
- C:\Windows\System\kGengZM.exe
  C:\Windows\System\kGengZM.exe
  2⤵
  PID:7864
- C:\Windows\System\YrMVlyC.exe
  C:\Windows\System\YrMVlyC.exe
  2⤵
  PID:8000
- C:\Windows\System\JGJoUga.exe
  C:\Windows\System\JGJoUga.exe
  2⤵
  PID:8008
- C:\Windows\System\gIGAgfN.exe
  C:\Windows\System\gIGAgfN.exe
  2⤵
  PID:8072
- C:\Windows\System\JRJMSZL.exe
  C:\Windows\System\JRJMSZL.exe
  2⤵
  PID:1536
- C:\Windows\System\LLChkZB.exe
  C:\Windows\System\LLChkZB.exe
  2⤵
  PID:384
- C:\Windows\System\dGjphai.exe
  C:\Windows\System\dGjphai.exe
  2⤵
  PID:7248
- C:\Windows\System\pUmUzXY.exe
  C:\Windows\System\pUmUzXY.exe
  2⤵
  PID:7500
- C:\Windows\System\yvSfGVa.exe
  C:\Windows\System\yvSfGVa.exe
  2⤵
  PID:7456
- C:\Windows\System\rBuWxbn.exe
  C:\Windows\System\rBuWxbn.exe
  2⤵
  PID:7780
- C:\Windows\System\JmvwEwM.exe
  C:\Windows\System\JmvwEwM.exe
  2⤵
  PID:8024
- C:\Windows\System\SsodjDP.exe
  C:\Windows\System\SsodjDP.exe
  2⤵
  PID:8040
- C:\Windows\System\cKkANua.exe
  C:\Windows\System\cKkANua.exe
  2⤵
  PID:7204
- C:\Windows\System\RVLCnoa.exe
  C:\Windows\System\RVLCnoa.exe
  2⤵
  PID:7532
- C:\Windows\System\STuiygA.exe
  C:\Windows\System\STuiygA.exe
  2⤵
  PID:7608
- C:\Windows\System\NZiAYKa.exe
  C:\Windows\System\NZiAYKa.exe
  2⤵
  PID:7948
- C:\Windows\System\fcydFsI.exe
  C:\Windows\System\fcydFsI.exe
  2⤵
  PID:7904
- C:\Windows\System\YaabxEf.exe
  C:\Windows\System\YaabxEf.exe
  2⤵
  PID:8212
- C:\Windows\System\LvxvHid.exe
  C:\Windows\System\LvxvHid.exe
  2⤵
  PID:8240
- C:\Windows\System\XAwKSdr.exe
  C:\Windows\System\XAwKSdr.exe
  2⤵
  PID:8268
- C:\Windows\System\nQultcG.exe
  C:\Windows\System\nQultcG.exe
  2⤵
  PID:8284
- C:\Windows\System\HYDURuT.exe
  C:\Windows\System\HYDURuT.exe
  2⤵
  PID:8320
- C:\Windows\System\uOvtEkW.exe
  C:\Windows\System\uOvtEkW.exe
  2⤵
  PID:8364
- C:\Windows\System\xdkovUz.exe
  C:\Windows\System\xdkovUz.exe
  2⤵
  PID:8396
- C:\Windows\System\MWPoBLb.exe
  C:\Windows\System\MWPoBLb.exe
  2⤵
  PID:8424
- C:\Windows\System\araZaNq.exe
  C:\Windows\System\araZaNq.exe
  2⤵
  PID:8440
- C:\Windows\System\lAdBMZC.exe
  C:\Windows\System\lAdBMZC.exe
  2⤵
  PID:8468
- C:\Windows\System\EtMFfRc.exe
  C:\Windows\System\EtMFfRc.exe
  2⤵
  PID:8508
- C:\Windows\System\HnGCfUD.exe
  C:\Windows\System\HnGCfUD.exe
  2⤵
  PID:8536
- C:\Windows\System\dclpRme.exe
  C:\Windows\System\dclpRme.exe
  2⤵
  PID:8552
- C:\Windows\System\mqLphPh.exe
  C:\Windows\System\mqLphPh.exe
  2⤵
  PID:8580
- C:\Windows\System\OngqWat.exe
  C:\Windows\System\OngqWat.exe
  2⤵
  PID:8608
- C:\Windows\System\GqJQleq.exe
  C:\Windows\System\GqJQleq.exe
  2⤵
  PID:8636
- C:\Windows\System\ycvTDdc.exe
  C:\Windows\System\ycvTDdc.exe
  2⤵
  PID:8652
- C:\Windows\System\ERFSHMY.exe
  C:\Windows\System\ERFSHMY.exe
  2⤵
  PID:8680
- C:\Windows\System\MmqYyMl.exe
  C:\Windows\System\MmqYyMl.exe
  2⤵
  PID:8712
- C:\Windows\System\IucPlpT.exe
  C:\Windows\System\IucPlpT.exe
  2⤵
  PID:8748
- C:\Windows\System\CNVqjOh.exe
  C:\Windows\System\CNVqjOh.exe
  2⤵
  PID:8788
- C:\Windows\System\AqghnPx.exe
  C:\Windows\System\AqghnPx.exe
  2⤵
  PID:8804
- C:\Windows\System\DbYzuqr.exe
  C:\Windows\System\DbYzuqr.exe
  2⤵
  PID:8824
- C:\Windows\System\oyjifLC.exe
  C:\Windows\System\oyjifLC.exe
  2⤵
  PID:8848
- C:\Windows\System\oyEOccz.exe
  C:\Windows\System\oyEOccz.exe
  2⤵
  PID:8888
- C:\Windows\System\LAjkHML.exe
  C:\Windows\System\LAjkHML.exe
  2⤵
  PID:8904
- C:\Windows\System\rVZUAee.exe
  C:\Windows\System\rVZUAee.exe
  2⤵
  PID:8944
- C:\Windows\System\eShWRlG.exe
  C:\Windows\System\eShWRlG.exe
  2⤵
  PID:8972
- C:\Windows\System\huFlVul.exe
  C:\Windows\System\huFlVul.exe
  2⤵
  PID:9000
- C:\Windows\System\reWZPwE.exe
  C:\Windows\System\reWZPwE.exe
  2⤵
  PID:9028
- C:\Windows\System\zngSyty.exe
  C:\Windows\System\zngSyty.exe
  2⤵
  PID:9056
- C:\Windows\System\WtYgMBG.exe
  C:\Windows\System\WtYgMBG.exe
  2⤵
  PID:9096
- C:\Windows\System\uWXHZEt.exe
  C:\Windows\System\uWXHZEt.exe
  2⤵
  PID:9124
- C:\Windows\System\nxLwMbX.exe
  C:\Windows\System\nxLwMbX.exe
  2⤵
  PID:9152
- C:\Windows\System\yGbkOTP.exe
  C:\Windows\System\yGbkOTP.exe
  2⤵
  PID:9168
- C:\Windows\System\vjxJDmL.exe
  C:\Windows\System\vjxJDmL.exe
  2⤵
  PID:9192
- C:\Windows\System\eRSvahN.exe
  C:\Windows\System\eRSvahN.exe
  2⤵
  PID:7396
- C:\Windows\System\JEbaoxl.exe
  C:\Windows\System\JEbaoxl.exe
  2⤵
  PID:8228
- C:\Windows\System\eVxskOv.exe
  C:\Windows\System\eVxskOv.exe
  2⤵
  PID:8280
- C:\Windows\System\JKlZJEF.exe
  C:\Windows\System\JKlZJEF.exe
  2⤵
  PID:8312
- C:\Windows\System\ofvTDkz.exe
  C:\Windows\System\ofvTDkz.exe
  2⤵
  PID:8380
- C:\Windows\System\JcVWbMF.exe
  C:\Windows\System\JcVWbMF.exe
  2⤵
  PID:8484
- C:\Windows\System\qMUYzEL.exe
  C:\Windows\System\qMUYzEL.exe
  2⤵
  PID:8544
- C:\Windows\System\hnhDWhX.exe
  C:\Windows\System\hnhDWhX.exe
  2⤵
  PID:8664
- C:\Windows\System\HaKtZri.exe
  C:\Windows\System\HaKtZri.exe
  2⤵
  PID:8728
- C:\Windows\System\tTTwLDH.exe
  C:\Windows\System\tTTwLDH.exe
  2⤵
  PID:8772
- C:\Windows\System\dBIIEwI.exe
  C:\Windows\System\dBIIEwI.exe
  2⤵
  PID:8840
- C:\Windows\System\zcvPVyz.exe
  C:\Windows\System\zcvPVyz.exe
  2⤵
  PID:8928
- C:\Windows\System\indkEWs.exe
  C:\Windows\System\indkEWs.exe
  2⤵
  PID:8996
- C:\Windows\System\HULoGkW.exe
  C:\Windows\System\HULoGkW.exe
  2⤵
  PID:9072
- C:\Windows\System\HoYVZiR.exe
  C:\Windows\System\HoYVZiR.exe
  2⤵
  PID:9092
- C:\Windows\System\ujFTKmz.exe
  C:\Windows\System\ujFTKmz.exe
  2⤵
  PID:9184
- C:\Windows\System\jjckZxk.exe
  C:\Windows\System\jjckZxk.exe
  2⤵
  PID:7908
- C:\Windows\System\orcIQps.exe
  C:\Windows\System\orcIQps.exe
  2⤵
  PID:8452
- C:\Windows\System\csCVJvs.exe
  C:\Windows\System\csCVJvs.exe
  2⤵
  PID:8532
- C:\Windows\System\QvdPFyN.exe
  C:\Windows\System\QvdPFyN.exe
  2⤵
  PID:8692
- C:\Windows\System\ZokFQLs.exe
  C:\Windows\System\ZokFQLs.exe
  2⤵
  PID:8876
- C:\Windows\System\KGgMlUU.exe
  C:\Windows\System\KGgMlUU.exe
  2⤵
  PID:8964
- C:\Windows\System\pvLNMqG.exe
  C:\Windows\System\pvLNMqG.exe
  2⤵
  PID:7688
- C:\Windows\System\aCKZZYF.exe
  C:\Windows\System\aCKZZYF.exe
  2⤵
  PID:8376
- C:\Windows\System\FXEUmIl.exe
  C:\Windows\System\FXEUmIl.exe
  2⤵
  PID:8768
- C:\Windows\System\prcaUuV.exe
  C:\Windows\System\prcaUuV.exe
  2⤵
  PID:8900
- C:\Windows\System\YLcLdiy.exe
  C:\Windows\System\YLcLdiy.exe
  2⤵
  PID:8648
- C:\Windows\System\czvIbKe.exe
  C:\Windows\System\czvIbKe.exe
  2⤵
  PID:8520
- C:\Windows\System\uqVMLkW.exe
  C:\Windows\System\uqVMLkW.exe
  2⤵
  PID:9244
- C:\Windows\System\uprUpXD.exe
  C:\Windows\System\uprUpXD.exe
  2⤵
  PID:9268
- C:\Windows\System\RGEQVAA.exe
  C:\Windows\System\RGEQVAA.exe
  2⤵
  PID:9296
- C:\Windows\System\cJzJWuu.exe
  C:\Windows\System\cJzJWuu.exe
  2⤵
  PID:9328
- C:\Windows\System\gEEqUeX.exe
  C:\Windows\System\gEEqUeX.exe
  2⤵
  PID:9348
- C:\Windows\System\KlfbxSu.exe
  C:\Windows\System\KlfbxSu.exe
  2⤵
  PID:9388
- C:\Windows\System\ULBxLzH.exe
  C:\Windows\System\ULBxLzH.exe
  2⤵
  PID:9424
- C:\Windows\System\DieKgIc.exe
  C:\Windows\System\DieKgIc.exe
  2⤵
  PID:9444
- C:\Windows\System\HydZiKC.exe
  C:\Windows\System\HydZiKC.exe
  2⤵
  PID:9468
- C:\Windows\System\wleHJrB.exe
  C:\Windows\System\wleHJrB.exe
  2⤵
  PID:9484
- C:\Windows\System\JKXnUKt.exe
  C:\Windows\System\JKXnUKt.exe
  2⤵
  PID:9508
- C:\Windows\System\bVwHkcV.exe
  C:\Windows\System\bVwHkcV.exe
  2⤵
  PID:9528
- C:\Windows\System\shsfqFF.exe
  C:\Windows\System\shsfqFF.exe
  2⤵
  PID:9548
- C:\Windows\System\TxVsrjE.exe
  C:\Windows\System\TxVsrjE.exe
  2⤵
  PID:9588
- C:\Windows\System\VINkBKm.exe
  C:\Windows\System\VINkBKm.exe
  2⤵
  PID:9620
- C:\Windows\System\LddSycd.exe
  C:\Windows\System\LddSycd.exe
  2⤵
  PID:9672
- C:\Windows\System\uDaAlEa.exe
  C:\Windows\System\uDaAlEa.exe
  2⤵
  PID:9696
- C:\Windows\System\CBwWrcm.exe
  C:\Windows\System\CBwWrcm.exe
  2⤵
  PID:9724
- C:\Windows\System\MiGPpPh.exe
  C:\Windows\System\MiGPpPh.exe
  2⤵
  PID:9752
- C:\Windows\System\NZohuRs.exe
  C:\Windows\System\NZohuRs.exe
  2⤵
  PID:9768
- C:\Windows\System\BxivTIp.exe
  C:\Windows\System\BxivTIp.exe
  2⤵
  PID:9796
- C:\Windows\System\bFNZKdI.exe
  C:\Windows\System\bFNZKdI.exe
  2⤵
  PID:9848
- C:\Windows\System\bZVelBZ.exe
  C:\Windows\System\bZVelBZ.exe
  2⤵
  PID:9868
- C:\Windows\System\WxwDUSP.exe
  C:\Windows\System\WxwDUSP.exe
  2⤵
  PID:9892
- C:\Windows\System\KSWtTwJ.exe
  C:\Windows\System\KSWtTwJ.exe
  2⤵
  PID:9908
- C:\Windows\System\epjenxP.exe
  C:\Windows\System\epjenxP.exe
  2⤵
  PID:9940
- C:\Windows\System\DhkXhzC.exe
  C:\Windows\System\DhkXhzC.exe
  2⤵
  PID:9964
- C:\Windows\System\CpghXjs.exe
  C:\Windows\System\CpghXjs.exe
  2⤵
  PID:10004
- C:\Windows\System\BzrkKJW.exe
  C:\Windows\System\BzrkKJW.exe
  2⤵
  PID:10028
- C:\Windows\System\MSyaARQ.exe
  C:\Windows\System\MSyaARQ.exe
  2⤵
  PID:10048
- C:\Windows\System\sZOzWWV.exe
  C:\Windows\System\sZOzWWV.exe
  2⤵
  PID:10072
- C:\Windows\System\StZFFYA.exe
  C:\Windows\System\StZFFYA.exe
  2⤵
  PID:10104
- C:\Windows\System\pGgtWAD.exe
  C:\Windows\System\pGgtWAD.exe
  2⤵
  PID:10124
- C:\Windows\System\PiSqTnb.exe
  C:\Windows\System\PiSqTnb.exe
  2⤵
  PID:10144
- C:\Windows\System\aDgMUXa.exe
  C:\Windows\System\aDgMUXa.exe
  2⤵
  PID:10176
- C:\Windows\System\zRGAGqk.exe
  C:\Windows\System\zRGAGqk.exe
  2⤵
  PID:9180
- C:\Windows\System\Rhihtum.exe
  C:\Windows\System\Rhihtum.exe
  2⤵
  PID:9260
- C:\Windows\System\okTADFy.exe
  C:\Windows\System\okTADFy.exe
  2⤵
  PID:9312
- C:\Windows\System\pNsCpMx.exe
  C:\Windows\System\pNsCpMx.exe
  2⤵
  PID:9412
- C:\Windows\System\xxloqBp.exe
  C:\Windows\System\xxloqBp.exe
  2⤵
  PID:9492
- C:\Windows\System\ULfHAXs.exe
  C:\Windows\System\ULfHAXs.exe
  2⤵
  PID:9568
- C:\Windows\System\LNJrRgs.exe
  C:\Windows\System\LNJrRgs.exe
  2⤵
  PID:9600
- C:\Windows\System\WmumorB.exe
  C:\Windows\System\WmumorB.exe
  2⤵
  PID:9692
- C:\Windows\System\fNxmteg.exe
  C:\Windows\System\fNxmteg.exe
  2⤵
  PID:9748
- C:\Windows\System\rYWgEBj.exe
  C:\Windows\System\rYWgEBj.exe
  2⤵
  PID:9784
- C:\Windows\System\AOYyELN.exe
  C:\Windows\System\AOYyELN.exe
  2⤵
  PID:9888
- C:\Windows\System\eywGvVZ.exe
  C:\Windows\System\eywGvVZ.exe
  2⤵
  PID:9920
- C:\Windows\System\jLmRYdn.exe
  C:\Windows\System\jLmRYdn.exe
  2⤵
  PID:9956
- C:\Windows\System\fdyyxNt.exe
  C:\Windows\System\fdyyxNt.exe
  2⤵
  PID:10020
- C:\Windows\System\KCYJHvy.exe
  C:\Windows\System\KCYJHvy.exe
  2⤵
  PID:10040
- C:\Windows\System\FIFBjpb.exe
  C:\Windows\System\FIFBjpb.exe
  2⤵
  PID:10156
- C:\Windows\System\bztKsIW.exe
  C:\Windows\System\bztKsIW.exe
  2⤵
  PID:9292
- C:\Windows\System\JUscwfw.exe
  C:\Windows\System\JUscwfw.exe
  2⤵
  PID:9404
- C:\Windows\System\WTxfDNQ.exe
  C:\Windows\System\WTxfDNQ.exe
  2⤵
  PID:9560
- C:\Windows\System\cQQRCFw.exe
  C:\Windows\System\cQQRCFw.exe
  2⤵
  PID:9760
- C:\Windows\System\rArBAFA.exe
  C:\Windows\System\rArBAFA.exe
  2⤵
  PID:9884
- C:\Windows\System\SCqjUNX.exe
  C:\Windows\System\SCqjUNX.exe
  2⤵
  PID:9992
- C:\Windows\System\orbiNnY.exe
  C:\Windows\System\orbiNnY.exe
  2⤵
  PID:9288
- C:\Windows\System\sobQaGb.exe
  C:\Windows\System\sobQaGb.exe
  2⤵
  PID:9504
- C:\Windows\System\cgsyPmi.exe
  C:\Windows\System\cgsyPmi.exe
  2⤵
  PID:10112
- C:\Windows\System\Gebpgzw.exe
  C:\Windows\System\Gebpgzw.exe
  2⤵
  PID:9228
- C:\Windows\System\InzxvTc.exe
  C:\Windows\System\InzxvTc.exe
  2⤵
  PID:10268
- C:\Windows\System\XlhvMIx.exe
  C:\Windows\System\XlhvMIx.exe
  2⤵
  PID:10300
- C:\Windows\System\SomIDfl.exe
  C:\Windows\System\SomIDfl.exe
  2⤵
  PID:10324
- C:\Windows\System\bxwECNf.exe
  C:\Windows\System\bxwECNf.exe
  2⤵
  PID:10348
- C:\Windows\System\WYnyeuG.exe
  C:\Windows\System\WYnyeuG.exe
  2⤵
  PID:10380
- C:\Windows\System\LuIjSoW.exe
  C:\Windows\System\LuIjSoW.exe
  2⤵
  PID:10408
- C:\Windows\System\ntAEZwE.exe
  C:\Windows\System\ntAEZwE.exe
  2⤵
  PID:10432
- C:\Windows\System\eQfrHIg.exe
  C:\Windows\System\eQfrHIg.exe
  2⤵
  PID:10468
- C:\Windows\System\FmXFUYo.exe
  C:\Windows\System\FmXFUYo.exe
  2⤵
  PID:10492
- C:\Windows\System\LitMeAw.exe
  C:\Windows\System\LitMeAw.exe
  2⤵
  PID:10524
- C:\Windows\System\HLzJaAW.exe
  C:\Windows\System\HLzJaAW.exe
  2⤵
  PID:10548
- C:\Windows\System\vnUAHTp.exe
  C:\Windows\System\vnUAHTp.exe
  2⤵
  PID:10564
- C:\Windows\System\lLSjivg.exe
  C:\Windows\System\lLSjivg.exe
  2⤵
  PID:10588
- C:\Windows\System\UBthVvc.exe
  C:\Windows\System\UBthVvc.exe
  2⤵
  PID:10620
- C:\Windows\System\KWakuyI.exe
  C:\Windows\System\KWakuyI.exe
  2⤵
  PID:10644
- C:\Windows\System\kaULKSc.exe
  C:\Windows\System\kaULKSc.exe
  2⤵
  PID:10676
- C:\Windows\System\fnwYuky.exe
  C:\Windows\System\fnwYuky.exe
  2⤵
  PID:10700
- C:\Windows\System\VhMlYUX.exe
  C:\Windows\System\VhMlYUX.exe
  2⤵
  PID:10724
- C:\Windows\System\icnrFAF.exe
  C:\Windows\System\icnrFAF.exe
  2⤵
  PID:10752
- C:\Windows\System\EEtMsMl.exe
  C:\Windows\System\EEtMsMl.exe
  2⤵
  PID:10780
- C:\Windows\System\VyyMCak.exe
  C:\Windows\System\VyyMCak.exe
  2⤵
  PID:10824
- C:\Windows\System\gJyleLu.exe
  C:\Windows\System\gJyleLu.exe
  2⤵
  PID:10860
- C:\Windows\System\dKgYAhv.exe
  C:\Windows\System\dKgYAhv.exe
  2⤵
  PID:10900
- C:\Windows\System\driiOwg.exe
  C:\Windows\System\driiOwg.exe
  2⤵
  PID:10924
- C:\Windows\System\dKTPinG.exe
  C:\Windows\System\dKTPinG.exe
  2⤵
  PID:10944
- C:\Windows\System\YcgSUzD.exe
  C:\Windows\System\YcgSUzD.exe
  2⤵
  PID:10976
- C:\Windows\System\qQSmIxM.exe
  C:\Windows\System\qQSmIxM.exe
  2⤵
  PID:11012
- C:\Windows\System\ixcbcrN.exe
  C:\Windows\System\ixcbcrN.exe
  2⤵
  PID:11032
- C:\Windows\System\PFhzKBn.exe
  C:\Windows\System\PFhzKBn.exe
  2⤵
  PID:11056
- C:\Windows\System\VwECABV.exe
  C:\Windows\System\VwECABV.exe
  2⤵
  PID:11088
- C:\Windows\System\pqgYrCI.exe
  C:\Windows\System\pqgYrCI.exe
  2⤵
  PID:11112
- C:\Windows\System\esbeSbw.exe
  C:\Windows\System\esbeSbw.exe
  2⤵
  PID:11140
- C:\Windows\System\UFXLpkC.exe
  C:\Windows\System\UFXLpkC.exe
  2⤵
  PID:11156
- C:\Windows\System\KghGFmp.exe
  C:\Windows\System\KghGFmp.exe
  2⤵
  PID:11208
- C:\Windows\System\jScgRGD.exe
  C:\Windows\System\jScgRGD.exe
  2⤵
  PID:11236
- C:\Windows\System\vQNnzBP.exe
  C:\Windows\System\vQNnzBP.exe
  2⤵
  PID:11252
- C:\Windows\System\vHLxGub.exe
  C:\Windows\System\vHLxGub.exe
  2⤵
  PID:9368
- C:\Windows\System\JqWQvMo.exe
  C:\Windows\System\JqWQvMo.exe
  2⤵
  PID:10316
- C:\Windows\System\uvLEdum.exe
  C:\Windows\System\uvLEdum.exe
  2⤵
  PID:10396
- C:\Windows\System\ltUkPpu.exe
  C:\Windows\System\ltUkPpu.exe
  2⤵
  PID:10456
- C:\Windows\System\DLsSGSd.exe
  C:\Windows\System\DLsSGSd.exe
  2⤵
  PID:10484
- C:\Windows\System\eClmlQj.exe
  C:\Windows\System\eClmlQj.exe
  2⤵
  PID:10544
- C:\Windows\System\uBnkKAY.exe
  C:\Windows\System\uBnkKAY.exe
  2⤵
  PID:10608
- C:\Windows\System\cemeCDg.exe
  C:\Windows\System\cemeCDg.exe
  2⤵
  PID:10716
- C:\Windows\System\izEONJD.exe
  C:\Windows\System\izEONJD.exe
  2⤵
  PID:10796
- C:\Windows\System\JylgOXF.exe
  C:\Windows\System\JylgOXF.exe
  2⤵
  PID:10820
- C:\Windows\System\nNRlhcj.exe
  C:\Windows\System\nNRlhcj.exe
  2⤵
  PID:11040
- C:\Windows\System\PokMxNM.exe
  C:\Windows\System\PokMxNM.exe
  2⤵
  PID:11076
- C:\Windows\System\KTguRFG.exe
  C:\Windows\System\KTguRFG.exe
  2⤵
  PID:11104
- C:\Windows\System\JAyldcy.exe
  C:\Windows\System\JAyldcy.exe
  2⤵
  PID:11168
- C:\Windows\System\MPDoLGH.exe
  C:\Windows\System\MPDoLGH.exe
  2⤵
  PID:11220
- C:\Windows\System\PWXInlL.exe
  C:\Windows\System\PWXInlL.exe
  2⤵
  PID:10256
- C:\Windows\System\JaijDUf.exe
  C:\Windows\System\JaijDUf.exe
  2⤵
  PID:10372
- C:\Windows\System\emTFSds.exe
  C:\Windows\System\emTFSds.exe
  2⤵
  PID:10512
- C:\Windows\System\DqBXaPa.exe
  C:\Windows\System\DqBXaPa.exe
  2⤵
  PID:10736
- C:\Windows\System\vGrtzhD.exe
  C:\Windows\System\vGrtzhD.exe
  2⤵
  PID:10852
- C:\Windows\System\DdiGUiX.exe
  C:\Windows\System\DdiGUiX.exe
  2⤵
  PID:11044
- C:\Windows\System\mlMKCSh.exe
  C:\Windows\System\mlMKCSh.exe
  2⤵
  PID:11244
- C:\Windows\System\DuSJyyY.exe
  C:\Windows\System\DuSJyyY.exe
  2⤵
  PID:10420
- C:\Windows\System\jeFpRPg.exe
  C:\Windows\System\jeFpRPg.exe
  2⤵
  PID:11000
- C:\Windows\System\nkgFEIE.exe
  C:\Windows\System\nkgFEIE.exe
  2⤵
  PID:11276
- C:\Windows\System\OAWHdWz.exe
  C:\Windows\System\OAWHdWz.exe
  2⤵
  PID:11300
- C:\Windows\System\AxirZNq.exe
  C:\Windows\System\AxirZNq.exe
  2⤵
  PID:11332
- C:\Windows\System\IZFjGAA.exe
  C:\Windows\System\IZFjGAA.exe
  2⤵
  PID:11360
- C:\Windows\System\JNNAHqV.exe
  C:\Windows\System\JNNAHqV.exe
  2⤵
  PID:11376
- C:\Windows\System\MQbQvSR.exe
  C:\Windows\System\MQbQvSR.exe
  2⤵
  PID:11412
- C:\Windows\System\xxMxzSo.exe
  C:\Windows\System\xxMxzSo.exe
  2⤵
  PID:11432
- C:\Windows\System\DfPsyuC.exe
  C:\Windows\System\DfPsyuC.exe
  2⤵
  PID:11448
- C:\Windows\System\jLpryoU.exe
  C:\Windows\System\jLpryoU.exe
  2⤵
  PID:11500
- C:\Windows\System\kIXdDtz.exe
  C:\Windows\System\kIXdDtz.exe
  2⤵
  PID:11516
- C:\Windows\System\ijZrtHM.exe
  C:\Windows\System\ijZrtHM.exe
  2⤵
  PID:11544
- C:\Windows\System\twUdUtd.exe
  C:\Windows\System\twUdUtd.exe
  2⤵
  PID:11576
- C:\Windows\System\TfAOQXg.exe
  C:\Windows\System\TfAOQXg.exe
  2⤵
  PID:11604
- C:\Windows\System\YJPFYcI.exe
  C:\Windows\System\YJPFYcI.exe
  2⤵
  PID:11652
- C:\Windows\System\tNKXMnz.exe
  C:\Windows\System\tNKXMnz.exe
  2⤵
  PID:11680
- C:\Windows\System\CzkXZuJ.exe
  C:\Windows\System\CzkXZuJ.exe
  2⤵
  PID:11696
- C:\Windows\System\yNjEySr.exe
  C:\Windows\System\yNjEySr.exe
  2⤵
  PID:11712
- C:\Windows\System\LOwjfSQ.exe
  C:\Windows\System\LOwjfSQ.exe
  2⤵
  PID:11732
- C:\Windows\System\JFMxQcm.exe
  C:\Windows\System\JFMxQcm.exe
  2⤵
  PID:11784
- C:\Windows\System\NrzQpGE.exe
  C:\Windows\System\NrzQpGE.exe
  2⤵
  PID:11800
- C:\Windows\System\DIyyOuF.exe
  C:\Windows\System\DIyyOuF.exe
  2⤵
  PID:11848
- C:\Windows\System\ajJLVNE.exe
  C:\Windows\System\ajJLVNE.exe
  2⤵
  PID:11880
- C:\Windows\System\lIbpArZ.exe
  C:\Windows\System\lIbpArZ.exe
  2⤵
  PID:11908
- C:\Windows\System\egNEkhz.exe
  C:\Windows\System\egNEkhz.exe
  2⤵
  PID:11932
- C:\Windows\System\eoRHsWO.exe
  C:\Windows\System\eoRHsWO.exe
  2⤵
  PID:11952
- C:\Windows\System\nWSvAbV.exe
  C:\Windows\System\nWSvAbV.exe
  2⤵
  PID:11968
- C:\Windows\System\ZCMZfqV.exe
  C:\Windows\System\ZCMZfqV.exe
  2⤵
  PID:12020
- C:\Windows\System\TpcuQOQ.exe
  C:\Windows\System\TpcuQOQ.exe
  2⤵
  PID:12048
- C:\Windows\System\eBsePqN.exe
  C:\Windows\System\eBsePqN.exe
  2⤵
  PID:12064
- C:\Windows\System\mQpgKvV.exe
  C:\Windows\System\mQpgKvV.exe
  2⤵
  PID:12108
- C:\Windows\System\DovWfua.exe
  C:\Windows\System\DovWfua.exe
  2⤵
  PID:12132
- C:\Windows\System\SXXZBIb.exe
  C:\Windows\System\SXXZBIb.exe
  2⤵
  PID:12160
- C:\Windows\System\JfKxFwf.exe
  C:\Windows\System\JfKxFwf.exe
  2⤵
  PID:12188
- C:\Windows\System\ehztQbp.exe
  C:\Windows\System\ehztQbp.exe
  2⤵
  PID:12208
- C:\Windows\System\DToDsRH.exe
  C:\Windows\System\DToDsRH.exe
  2⤵
  PID:12232
- C:\Windows\System\xtFYZQJ.exe
  C:\Windows\System\xtFYZQJ.exe
  2⤵
  PID:12272
- C:\Windows\System\DWHQEWC.exe
  C:\Windows\System\DWHQEWC.exe
  2⤵
  PID:9400
- C:\Windows\System\WDfubkx.exe
  C:\Windows\System\WDfubkx.exe
  2⤵
  PID:10636
- C:\Windows\System\AXgAZHq.exe
  C:\Windows\System\AXgAZHq.exe
  2⤵
  PID:11148
- C:\Windows\System\RJbNKjN.exe
  C:\Windows\System\RJbNKjN.exe
  2⤵
  PID:11372
- C:\Windows\System\tFbejQY.exe
  C:\Windows\System\tFbejQY.exe
  2⤵
  PID:11508
- C:\Windows\System\EgEAfJk.exe
  C:\Windows\System\EgEAfJk.exe
  2⤵
  PID:11532
- C:\Windows\System\EqcmNjv.exe
  C:\Windows\System\EqcmNjv.exe
  2⤵
  PID:11640
- C:\Windows\System\TGJFAYD.exe
  C:\Windows\System\TGJFAYD.exe
  2⤵
  PID:11664
- C:\Windows\System\UpEHCTm.exe
  C:\Windows\System\UpEHCTm.exe
  2⤵
  PID:11724
- C:\Windows\System\jEnvFrS.exe
  C:\Windows\System\jEnvFrS.exe
  2⤵
  PID:11796
- C:\Windows\System\IlMCxNE.exe
  C:\Windows\System\IlMCxNE.exe
  2⤵
  PID:11904
- C:\Windows\System\Cjallnp.exe
  C:\Windows\System\Cjallnp.exe
  2⤵
  PID:11944
- C:\Windows\System\CFpagOS.exe
  C:\Windows\System\CFpagOS.exe
  2⤵
  PID:12008
- C:\Windows\System\fJzaNzv.exe
  C:\Windows\System\fJzaNzv.exe
  2⤵
  PID:12060
- C:\Windows\System\PYJAPvY.exe
  C:\Windows\System\PYJAPvY.exe
  2⤵
  PID:12148
- C:\Windows\System\xgbjSxq.exe
  C:\Windows\System\xgbjSxq.exe
  2⤵
  PID:12216
- C:\Windows\System\CfJTEPJ.exe
  C:\Windows\System\CfJTEPJ.exe
  2⤵
  PID:10712
- C:\Windows\System\MSfqySX.exe
  C:\Windows\System\MSfqySX.exe
  2⤵
  PID:11196
- C:\Windows\System\qXmJeKb.exe
  C:\Windows\System\qXmJeKb.exe
  2⤵
  PID:11444
- C:\Windows\System\mhRGhSY.exe
  C:\Windows\System\mhRGhSY.exe
  2⤵
  PID:11624
- C:\Windows\System\OCfYXwn.exe
  C:\Windows\System\OCfYXwn.exe
  2⤵
  PID:11816
- C:\Windows\System\yCplzxy.exe
  C:\Windows\System\yCplzxy.exe
  2⤵
  PID:11992
- C:\Windows\System\WfqxSSZ.exe
  C:\Windows\System\WfqxSSZ.exe
  2⤵
  PID:12032
- C:\Windows\System\vsodxdj.exe
  C:\Windows\System\vsodxdj.exe
  2⤵
  PID:11288
- C:\Windows\System\EWUwdLc.exe
  C:\Windows\System\EWUwdLc.exe
  2⤵
  PID:11460
- C:\Windows\System\criBuyB.exe
  C:\Windows\System\criBuyB.exe
  2⤵
  PID:11892
- C:\Windows\System\ZMEmuff.exe
  C:\Windows\System\ZMEmuff.exe
  2⤵
  PID:10488
- C:\Windows\System\ahHfIKb.exe
  C:\Windows\System\ahHfIKb.exe
  2⤵
  PID:12084
- C:\Windows\System\HyTiCQY.exe
  C:\Windows\System\HyTiCQY.exe
  2⤵
  PID:12124
- C:\Windows\System\bHOVxWQ.exe
  C:\Windows\System\bHOVxWQ.exe
  2⤵
  PID:12328
- C:\Windows\System\YoQPttv.exe
  C:\Windows\System\YoQPttv.exe
  2⤵
  PID:12356
- C:\Windows\System\LhYGqEf.exe
  C:\Windows\System\LhYGqEf.exe
  2⤵
  PID:12372
- C:\Windows\System\CNoColN.exe
  C:\Windows\System\CNoColN.exe
  2⤵
  PID:12412
- C:\Windows\System\uQQUlxG.exe
  C:\Windows\System\uQQUlxG.exe
  2⤵
  PID:12432
- C:\Windows\System\pOgACYe.exe
  C:\Windows\System\pOgACYe.exe
  2⤵
  PID:12464
- C:\Windows\System\mvTrnMo.exe
  C:\Windows\System\mvTrnMo.exe
  2⤵
  PID:12488
- C:\Windows\System\dDFoRNC.exe
  C:\Windows\System\dDFoRNC.exe
  2⤵
  PID:12512
- C:\Windows\System\AlPqeLC.exe
  C:\Windows\System\AlPqeLC.exe
  2⤵
  PID:12540
- C:\Windows\System\wUTpCXG.exe
  C:\Windows\System\wUTpCXG.exe
  2⤵
  PID:12584
- C:\Windows\System\NqvgJxa.exe
  C:\Windows\System\NqvgJxa.exe
  2⤵
  PID:12616
- C:\Windows\System\ARUzJOL.exe
  C:\Windows\System\ARUzJOL.exe
  2⤵
  PID:12636
- C:\Windows\System\KFqnhyQ.exe
  C:\Windows\System\KFqnhyQ.exe
  2⤵
  PID:12664
- C:\Windows\System\kgwNELN.exe
  C:\Windows\System\kgwNELN.exe
  2⤵
  PID:12704
- C:\Windows\System\RmnuFcY.exe
  C:\Windows\System\RmnuFcY.exe
  2⤵
  PID:12732
- C:\Windows\System\sAHQhIK.exe
  C:\Windows\System\sAHQhIK.exe
  2⤵
  PID:12764
- C:\Windows\System\dTbELwT.exe
  C:\Windows\System\dTbELwT.exe
  2⤵
  PID:12792
- C:\Windows\System\mLSpwHf.exe
  C:\Windows\System\mLSpwHf.exe
  2⤵
  PID:12820
- C:\Windows\System\XlMLHVH.exe
  C:\Windows\System\XlMLHVH.exe
  2⤵
  PID:12836
- C:\Windows\System\pbNBAoX.exe
  C:\Windows\System\pbNBAoX.exe
  2⤵
  PID:12876
- C:\Windows\System\QWoSWoZ.exe
  C:\Windows\System\QWoSWoZ.exe
  2⤵
  PID:12892
- C:\Windows\System\GJGcZVx.exe
  C:\Windows\System\GJGcZVx.exe
  2⤵
  PID:12928
- C:\Windows\System\DXYbSmr.exe
  C:\Windows\System\DXYbSmr.exe
  2⤵
  PID:12952
- C:\Windows\System\TeHMNCZ.exe
  C:\Windows\System\TeHMNCZ.exe
  2⤵
  PID:12976
- C:\Windows\System\RKSAXzT.exe
  C:\Windows\System\RKSAXzT.exe
  2⤵
  PID:13000
- C:\Windows\System\bhZjjQd.exe
  C:\Windows\System\bhZjjQd.exe
  2⤵
  PID:13024
- C:\Windows\System\lnQYufQ.exe
  C:\Windows\System\lnQYufQ.exe
  2⤵
  PID:13048
- C:\Windows\System\eQuIOVn.exe
  C:\Windows\System\eQuIOVn.exe
  2⤵
  PID:13076
- C:\Windows\System\VcMwqCA.exe
  C:\Windows\System\VcMwqCA.exe
  2⤵
  PID:13100
- C:\Windows\System\ltOAiNY.exe
  C:\Windows\System\ltOAiNY.exe
  2⤵
  PID:13140
- C:\Windows\System\FXKbsBU.exe
  C:\Windows\System\FXKbsBU.exe
  2⤵
  PID:13160
- C:\Windows\System\HxQArdj.exe
  C:\Windows\System\HxQArdj.exe
  2⤵
  PID:13188
- C:\Windows\System\XNLPVOY.exe
  C:\Windows\System\XNLPVOY.exe
  2⤵
  PID:13228
- C:\Windows\System\IBYVLJL.exe
  C:\Windows\System\IBYVLJL.exe
  2⤵
  PID:13252
- C:\Windows\System\BcBVTXv.exe
  C:\Windows\System\BcBVTXv.exe
  2⤵
  PID:13280
- C:\Windows\System\FOscgKt.exe
  C:\Windows\System\FOscgKt.exe
  2⤵
  PID:13296
- C:\Windows\System\eTXMxpK.exe
  C:\Windows\System\eTXMxpK.exe
  2⤵
  PID:12348
- C:\Windows\System\TBDSDqV.exe
  C:\Windows\System\TBDSDqV.exe
  2⤵
  PID:12420
- C:\Windows\System\mkESBpF.exe
  C:\Windows\System\mkESBpF.exe
  2⤵
  PID:12508
- C:\Windows\System\HLwFowI.exe
  C:\Windows\System\HLwFowI.exe
  2⤵
  PID:12576
- C:\Windows\System\WQWkMjO.exe
  C:\Windows\System\WQWkMjO.exe
  2⤵
  PID:12608
- C:\Windows\System\KhpFzhT.exe
  C:\Windows\System\KhpFzhT.exe
  2⤵
  PID:12680
- C:\Windows\System\KAPncYs.exe
  C:\Windows\System\KAPncYs.exe
  2⤵
  PID:12716
- C:\Windows\System\BtkMQQK.exe
  C:\Windows\System\BtkMQQK.exe
  2⤵
  PID:12788
- C:\Windows\System\FaAuvFQ.exe
  C:\Windows\System\FaAuvFQ.exe
  2⤵
  PID:12872
- C:\Windows\System\smWFrVr.exe
  C:\Windows\System\smWFrVr.exe
  2⤵
  PID:12940
- C:\Windows\System\wjhDVVt.exe
  C:\Windows\System\wjhDVVt.exe
  2⤵
  PID:12960
- C:\Windows\System\rdHovda.exe
  C:\Windows\System\rdHovda.exe
  2⤵
  PID:13040
- C:\Windows\System\kjWrVpP.exe
  C:\Windows\System\kjWrVpP.exe
  2⤵
  PID:13072
- C:\Windows\System\yJxupGb.exe
  C:\Windows\System\yJxupGb.exe
  2⤵
  PID:13184
- C:\Windows\System\UwhOqbM.exe
  C:\Windows\System\UwhOqbM.exe
  2⤵
  PID:13272
- C:\Windows\System\iqazUVZ.exe
  C:\Windows\System\iqazUVZ.exe
  2⤵
  PID:13288
- C:\Windows\System\xNFIyrh.exe
  C:\Windows\System\xNFIyrh.exe
  2⤵
  PID:12484
- C:\Windows\System\xlbHjZP.exe
  C:\Windows\System\xlbHjZP.exe
  2⤵
  PID:12648
- C:\Windows\System\ZHeLhAP.exe
  C:\Windows\System\ZHeLhAP.exe
  2⤵
  PID:12776
- C:\Windows\System\ISeyCPv.exe
  C:\Windows\System\ISeyCPv.exe
  2⤵
  PID:13016
- C:\Windows\System\eNPxgCb.exe
  C:\Windows\System\eNPxgCb.exe
  2⤵
  PID:13196
- C:\Windows\System\EPaGDud.exe
  C:\Windows\System\EPaGDud.exe
  2⤵
  PID:13212
- C:\Windows\System\MrbBuHz.exe
  C:\Windows\System\MrbBuHz.exe
  2⤵
  PID:12760
- C:\Windows\System\beNagZr.exe
  C:\Windows\System\beNagZr.exe
  2⤵
  PID:12888
- C:\Windows\System\sGvlMEq.exe
  C:\Windows\System\sGvlMEq.exe
  2⤵
  PID:13240
- C:\Windows\System\bPAFCiD.exe
  C:\Windows\System\bPAFCiD.exe
  2⤵
  PID:12984
- C:\Windows\System\ZXaIjVp.exe
  C:\Windows\System\ZXaIjVp.exe
  2⤵
  PID:13320
- C:\Windows\System\JEgQTfw.exe
  C:\Windows\System\JEgQTfw.exe
  2⤵
  PID:13348
- C:\Windows\System\bMWbaIY.exe
  C:\Windows\System\bMWbaIY.exe
  2⤵
  PID:13364
- C:\Windows\System\TiuPaZb.exe
  C:\Windows\System\TiuPaZb.exe
  2⤵
  PID:13404
- C:\Windows\System\nSJAOvf.exe
  C:\Windows\System\nSJAOvf.exe
  2⤵
  PID:13444
- C:\Windows\System\JBrdGFe.exe
  C:\Windows\System\JBrdGFe.exe
  2⤵
  PID:13472
- C:\Windows\System\JsjIiYu.exe
  C:\Windows\System\JsjIiYu.exe
  2⤵
  PID:13512
- C:\Windows\System\XkWtEEJ.exe
  C:\Windows\System\XkWtEEJ.exe
  2⤵
  PID:13540
- C:\Windows\System\gJemZbb.exe
  C:\Windows\System\gJemZbb.exe
  2⤵
  PID:13556
- C:\Windows\System\YwXoAcx.exe
  C:\Windows\System\YwXoAcx.exe
  2⤵
  PID:13584
- C:\Windows\System\cpggmZL.exe
  C:\Windows\System\cpggmZL.exe
  2⤵
  PID:13604
- C:\Windows\System\lIEEQjC.exe
  C:\Windows\System\lIEEQjC.exe
  2⤵
  PID:13636
- C:\Windows\System\OAYytLr.exe
  C:\Windows\System\OAYytLr.exe
  2⤵
  PID:13656
- C:\Windows\System\IbtsnGn.exe
  C:\Windows\System\IbtsnGn.exe
  2⤵
  PID:13704
- C:\Windows\System\JGYTRLt.exe
  C:\Windows\System\JGYTRLt.exe
  2⤵
  PID:13724
- C:\Windows\System\gXPJcXj.exe
  C:\Windows\System\gXPJcXj.exe
  2⤵
  PID:13744
- C:\Windows\System\ajzQSEh.exe
  C:\Windows\System\ajzQSEh.exe
  2⤵
  PID:13772
- C:\Windows\System\IsVcjtd.exe
  C:\Windows\System\IsVcjtd.exe
  2⤵
  PID:13808
- C:\Windows\System\RCVZXMN.exe
  C:\Windows\System\RCVZXMN.exe
  2⤵
  PID:13836
- C:\Windows\System\jgIRpSl.exe
  C:\Windows\System\jgIRpSl.exe
  2⤵
  PID:13852
- C:\Windows\System\PgfUNWn.exe
  C:\Windows\System\PgfUNWn.exe
  2⤵
  PID:13880
- C:\Windows\System\nlUXurb.exe
  C:\Windows\System\nlUXurb.exe
  2⤵
  PID:13908
- C:\Windows\System\jJNTGGi.exe
  C:\Windows\System\jJNTGGi.exe
  2⤵
  PID:13948
- C:\Windows\System\naSuSNJ.exe
  C:\Windows\System\naSuSNJ.exe
  2⤵
  PID:13968
- C:\Windows\System\Tgvakwt.exe
  C:\Windows\System\Tgvakwt.exe
  2⤵
  PID:13996
- C:\Windows\System\mFLLRsv.exe
  C:\Windows\System\mFLLRsv.exe
  2⤵
  PID:14012
- C:\Windows\System\aImmTBO.exe
  C:\Windows\System\aImmTBO.exe
  2⤵
  PID:14048
- C:\Windows\System\JiVQVKq.exe
  C:\Windows\System\JiVQVKq.exe
  2⤵
  PID:14072
- C:\Windows\System\AmiIWTw.exe
  C:\Windows\System\AmiIWTw.exe
  2⤵
  PID:14104
- C:\Windows\System\BNLedGD.exe
  C:\Windows\System\BNLedGD.exe
  2⤵
  PID:14152
- C:\Windows\System\pkedKYm.exe
  C:\Windows\System\pkedKYm.exe
  2⤵
  PID:14176
- C:\Windows\System\Uyzovrq.exe
  C:\Windows\System\Uyzovrq.exe
  2⤵
  PID:14204
- C:\Windows\System\wewgsDG.exe
  C:\Windows\System\wewgsDG.exe
  2⤵
  PID:14244
- C:\Windows\System\XkItrCb.exe
  C:\Windows\System\XkItrCb.exe
  2⤵
  PID:14260
- C:\Windows\System\zALdXGQ.exe
  C:\Windows\System\zALdXGQ.exe
  2⤵
  PID:14280
- C:\Windows\System\EfJbSxG.exe
  C:\Windows\System\EfJbSxG.exe
  2⤵
  PID:14312
- C:\Windows\System\GbgPIxp.exe
  C:\Windows\System\GbgPIxp.exe
  2⤵
  PID:12536
- C:\Windows\System\GBVcQSZ.exe
  C:\Windows\System\GBVcQSZ.exe
  2⤵
  PID:13336
- C:\Windows\System\sXFspZO.exe
  C:\Windows\System\sXFspZO.exe
  2⤵
  PID:13356
- C:\Windows\System\PoYatkA.exe
  C:\Windows\System\PoYatkA.exe
  2⤵
  PID:13468
- C:\Windows\System\laqfisU.exe
  C:\Windows\System\laqfisU.exe
  2⤵
  PID:13536
- C:\Windows\System\zWbBsWR.exe
  C:\Windows\System\zWbBsWR.exe
  2⤵
  PID:13568
- C:\Windows\System\mIUrulu.exe
  C:\Windows\System\mIUrulu.exe
  2⤵
  PID:13648
- C:\Windows\System\mivCazM.exe
  C:\Windows\System\mivCazM.exe
  2⤵
  PID:13764
- C:\Windows\System\JSDvjsN.exe
  C:\Windows\System\JSDvjsN.exe
  2⤵
  PID:13828
- C:\Windows\System\BvNdjTH.exe
  C:\Windows\System\BvNdjTH.exe
  2⤵
  PID:13892
- C:\Windows\System\xBPTdxX.exe
  C:\Windows\System\xBPTdxX.exe
  2⤵
  PID:13956
- C:\Windows\System\sDaKUUf.exe
  C:\Windows\System\sDaKUUf.exe
  2⤵
  PID:13976
- C:\Windows\System\BiltaPj.exe
  C:\Windows\System\BiltaPj.exe
  2⤵
  PID:14036
- C:\Windows\System\FRcQgHN.exe
  C:\Windows\System\FRcQgHN.exe
  2⤵
  PID:14056
- C:\Windows\System\pDNjGeR.exe
  C:\Windows\System\pDNjGeR.exe
  2⤵
  PID:14132
- C:\Windows\System\MpqDhxY.exe
  C:\Windows\System\MpqDhxY.exe
  2⤵
  PID:14216
- C:\Windows\System\ktFEFrp.exe
  C:\Windows\System\ktFEFrp.exe
  2⤵
  PID:14304
- C:\Windows\System\irfXJAM.exe
  C:\Windows\System\irfXJAM.exe
  2⤵
  PID:12300
- C:\Windows\System\HxVIFGq.exe
  C:\Windows\System\HxVIFGq.exe
  2⤵
  PID:13504
- C:\Windows\System\FuvLvDH.exe
  C:\Windows\System\FuvLvDH.exe
  2⤵
  PID:13716
- C:\Windows\System\SAMwXOw.exe
  C:\Windows\System\SAMwXOw.exe
  2⤵
  PID:13796
- C:\Windows\System\zzLNvYM.exe
  C:\Windows\System\zzLNvYM.exe
  2⤵
  PID:13920
- C:\Windows\System\MvZbjsh.exe
  C:\Windows\System\MvZbjsh.exe
  2⤵
  PID:14288
- C:\Windows\System\mCHnNbo.exe
  C:\Windows\System\mCHnNbo.exe
  2⤵
  PID:14300
- C:\Windows\System\OygwqsL.exe
  C:\Windows\System\OygwqsL.exe
  2⤵
  PID:13456
- C:\Windows\System\iorrcgI.exe
  C:\Windows\System\iorrcgI.exe
  2⤵
  PID:13940
- C:\Windows\System\lBBzWlq.exe
  C:\Windows\System\lBBzWlq.exe
  2⤵
  PID:13964
- C:\Windows\System\nWyyFHX.exe
  C:\Windows\System\nWyyFHX.exe
  2⤵
  PID:13768
- C:\Windows\System\aHZdgtE.exe
  C:\Windows\System\aHZdgtE.exe
  2⤵
  PID:14348
- C:\Windows\System\jTkwfJN.exe
  C:\Windows\System\jTkwfJN.exe
  2⤵
  PID:14372
- C:\Windows\System\yAqddyB.exe
  C:\Windows\System\yAqddyB.exe
  2⤵
  PID:14428
- C:\Windows\System\tLcfnGx.exe
  C:\Windows\System\tLcfnGx.exe
  2⤵
  PID:14448
- C:\Windows\System\IzhrpMb.exe
  C:\Windows\System\IzhrpMb.exe
  2⤵
  PID:14476
- C:\Windows\System\oCGiuNi.exe
  C:\Windows\System\oCGiuNi.exe
  2⤵
  PID:14492
- C:\Windows\System\GxgHqJW.exe
  C:\Windows\System\GxgHqJW.exe
  2⤵
  PID:14544
- C:\Windows\System\FzichwB.exe
  C:\Windows\System\FzichwB.exe
  2⤵
  PID:14572
- C:\Windows\System\yDyhFOA.exe
  C:\Windows\System\yDyhFOA.exe
  2⤵
  PID:14588
- C:\Windows\System\AlAdleg.exe
  C:\Windows\System\AlAdleg.exe
  2⤵
  PID:14612
- C:\Windows\System\GAYpGYj.exe
  C:\Windows\System\GAYpGYj.exe
  2⤵
  PID:14636
- C:\Windows\System\JeCVLfU.exe
  C:\Windows\System\JeCVLfU.exe
  2⤵
  PID:14688
- C:\Windows\System\UHMpgcg.exe
  C:\Windows\System\UHMpgcg.exe
  2⤵
  PID:14704
- C:\Windows\System\sGVdaXe.exe
  C:\Windows\System\sGVdaXe.exe
  2⤵
  PID:14724
- C:\Windows\System\dTcsgbt.exe
  C:\Windows\System\dTcsgbt.exe
  2⤵
  PID:14760
- C:\Windows\System\RWETjFZ.exe
  C:\Windows\System\RWETjFZ.exe
  2⤵
  PID:14776
- C:\Windows\System\ajTefEg.exe
  C:\Windows\System\ajTefEg.exe
  2⤵
  PID:14796
- C:\Windows\System\VkBbIMZ.exe
  C:\Windows\System\VkBbIMZ.exe
  2⤵
  PID:14820
- C:\Windows\System\NbAqRkc.exe
  C:\Windows\System\NbAqRkc.exe
  2⤵
  PID:14884
- C:\Windows\System\DMSQPeh.exe
  C:\Windows\System\DMSQPeh.exe
  2⤵
  PID:14912
- C:\Windows\System\EkcuRqv.exe
  C:\Windows\System\EkcuRqv.exe
  2⤵
  PID:14928
- C:\Windows\System\LtvoyKx.exe
  C:\Windows\System\LtvoyKx.exe
  2⤵
  PID:14948
- C:\Windows\System\IhpOZzU.exe
  C:\Windows\System\IhpOZzU.exe
  2⤵
  PID:14968
- C:\Windows\System\OYFEenJ.exe
  C:\Windows\System\OYFEenJ.exe
  2⤵
  PID:15012
- C:\Windows\System\mMHRkeR.exe
  C:\Windows\System\mMHRkeR.exe
  2⤵
  PID:15040
- C:\Windows\System\JFhMwQW.exe
  C:\Windows\System\JFhMwQW.exe
  2⤵
  PID:15060
- C:\Windows\System\eFqKMDE.exe
  C:\Windows\System\eFqKMDE.exe
  2⤵
  PID:15080
- C:\Windows\System\emiIbhC.exe
  C:\Windows\System\emiIbhC.exe
  2⤵
  PID:15128
- C:\Windows\System\VGOtamQ.exe
  C:\Windows\System\VGOtamQ.exe
  2⤵
  PID:15152
- C:\Windows\System\fQtHSTd.exe
  C:\Windows\System\fQtHSTd.exe
  2⤵
  PID:15180
- C:\Windows\System\DGVoZEV.exe
  C:\Windows\System\DGVoZEV.exe
  2⤵
  PID:15200
- C:\Windows\System\cQSFwMU.exe
  C:\Windows\System\cQSFwMU.exe
  2⤵
  PID:15220
- C:\Windows\System\BoXZdRr.exe
  C:\Windows\System\BoXZdRr.exe
  2⤵
  PID:15260
- C:\Windows\System\kXfIbYk.exe
  C:\Windows\System\kXfIbYk.exe
  2⤵
  PID:15288
- C:\Windows\System\FBTveir.exe
  C:\Windows\System\FBTveir.exe
  2⤵
  PID:15320
- C:\Windows\System\gLJwWzL.exe
  C:\Windows\System\gLJwWzL.exe
  2⤵
  PID:15348
- C:\Windows\System\sDYDgaK.exe
  C:\Windows\System\sDYDgaK.exe
  2⤵
  PID:14340
- C:\Windows\System\zaurOeY.exe
  C:\Windows\System\zaurOeY.exe
  2⤵
  PID:14392
- C:\Windows\System\vNZhNDO.exe
  C:\Windows\System\vNZhNDO.exe
  2⤵
  PID:14436
- C:\Windows\System\cTLvlgD.exe
  C:\Windows\System\cTLvlgD.exe
  2⤵
  PID:14504
- C:\Windows\System\kjLYgQE.exe
  C:\Windows\System\kjLYgQE.exe
  2⤵
  PID:14652
- C:\Windows\System\Uutrfja.exe
  C:\Windows\System\Uutrfja.exe
  2⤵
  PID:14672
- C:\Windows\System\SxWhWkQ.exe
  C:\Windows\System\SxWhWkQ.exe
  2⤵
  PID:14748
- C:\Windows\System\OFRkJSf.exe
  C:\Windows\System\OFRkJSf.exe
  2⤵
  PID:14816
- C:\Windows\System\WdqhGqe.exe
  C:\Windows\System\WdqhGqe.exe
  2⤵
  PID:14876
- C:\Windows\System\IYStHWz.exe
  C:\Windows\System\IYStHWz.exe
  2⤵
  PID:14964
- C:\Windows\System\OgcxacB.exe
  C:\Windows\System\OgcxacB.exe
  2⤵
  PID:15024
- C:\Windows\System\BVVJkiT.exe
  C:\Windows\System\BVVJkiT.exe
  2⤵
  PID:15072
- C:\Windows\System\lbZHxlL.exe
  C:\Windows\System\lbZHxlL.exe
  2⤵
  PID:15168
- C:\Windows\System\QxTxdfx.exe
  C:\Windows\System\QxTxdfx.exe
  2⤵
  PID:15236
- C:\Windows\System\oaokVNp.exe
  C:\Windows\System\oaokVNp.exe
  2⤵
  PID:15280
- C:\Windows\System\qYGVFeY.exe
  C:\Windows\System\qYGVFeY.exe
  2⤵
  PID:15344
- C:\Windows\System\JzfvvfL.exe
  C:\Windows\System\JzfvvfL.exe
  2⤵
  PID:14416
- C:\Windows\System\YHUiMoJ.exe
  C:\Windows\System\YHUiMoJ.exe
  2⤵
  PID:14484
- C:\Windows\System\mJgOson.exe
  C:\Windows\System\mJgOson.exe
  2⤵
  PID:14712
- C:\Windows\System\fUUtTPb.exe
  C:\Windows\System\fUUtTPb.exe
  2⤵
  PID:14924
- C:\Windows\System\fnxcBhL.exe
  C:\Windows\System\fnxcBhL.exe
  2⤵
  PID:15004
- C:\Windows\System\zNaWUct.exe
  C:\Windows\System\zNaWUct.exe
  2⤵
  PID:15216
- C:\Windows\System\mswWrGK.exe
  C:\Windows\System\mswWrGK.exe
  2⤵
  PID:15308
- C:\Windows\System\CvnAsgp.exe
  C:\Windows\System\CvnAsgp.exe
  2⤵
  PID:14656
- C:\Windows\System\xGDQJMP.exe
  C:\Windows\System\xGDQJMP.exe
  2⤵
  PID:15052
- C:\Windows\System\wVNgRnn.exe
  C:\Windows\System\wVNgRnn.exe
  2⤵
  PID:14408
- C:\Windows\System\vkyXetb.exe
  C:\Windows\System\vkyXetb.exe
  2⤵
  PID:15008
- C:\Windows\System\EvOMfPz.exe
  C:\Windows\System\EvOMfPz.exe
  2⤵
  PID:15368
- C:\Windows\System\DugipaC.exe
  C:\Windows\System\DugipaC.exe
  2⤵
  PID:15392
- C:\Windows\System\nvNyrBt.exe
  C:\Windows\System\nvNyrBt.exe
  2⤵
  PID:15416
- C:\Windows\System\kmmmtst.exe
  C:\Windows\System\kmmmtst.exe
  2⤵
  PID:15440
- C:\Windows\System\CyPySbJ.exe
  C:\Windows\System\CyPySbJ.exe
  2⤵
  PID:15472
- C:\Windows\System\DpCDnUf.exe
  C:\Windows\System\DpCDnUf.exe
  2⤵
  PID:15500
- C:\Windows\System\iLRouOr.exe
  C:\Windows\System\iLRouOr.exe
  2⤵
  PID:15528
- C:\Windows\System\veHLyUz.exe
  C:\Windows\System\veHLyUz.exe
  2⤵
  PID:15568
- C:\Windows\System\VfYMZpA.exe
  C:\Windows\System\VfYMZpA.exe
  2⤵
  PID:15584
- C:\Windows\System\aDyrJus.exe
  C:\Windows\System\aDyrJus.exe
  2⤵
  PID:15612
- C:\Windows\System\WzKjqTf.exe
  C:\Windows\System\WzKjqTf.exe
  2⤵
  PID:15636
- C:\Windows\System\DlsBkjo.exe
  C:\Windows\System\DlsBkjo.exe
  2⤵
  PID:15660
- C:\Windows\System\MTYnsFN.exe
  C:\Windows\System\MTYnsFN.exe
  2⤵
  PID:15680
- C:\Windows\System\rKipazx.exe
  C:\Windows\System\rKipazx.exe
  2⤵
  PID:15708
- C:\Windows\System\DZyhnQm.exe
  C:\Windows\System\DZyhnQm.exe
  2⤵
  PID:15740
- C:\Windows\System\WdjDzhu.exe
  C:\Windows\System\WdjDzhu.exe
  2⤵
  PID:15772
- C:\Windows\System\PXEfcef.exe
  C:\Windows\System\PXEfcef.exe
  2⤵
  PID:15820
- C:\Windows\System\iKHYqBV.exe
  C:\Windows\System\iKHYqBV.exe
  2⤵
  PID:15844
- C:\Windows\System\bkDLEdQ.exe
  C:\Windows\System\bkDLEdQ.exe
  2⤵
  PID:15864
- C:\Windows\System\JHkSIdl.exe
  C:\Windows\System\JHkSIdl.exe
  2⤵
  PID:15888
- C:\Windows\System\VetkXfI.exe
  C:\Windows\System\VetkXfI.exe
  2⤵
  PID:15920
- C:\Windows\System\hsDGVlf.exe
  C:\Windows\System\hsDGVlf.exe
  2⤵
  PID:15960
- C:\Windows\System\rgOpvGx.exe
  C:\Windows\System\rgOpvGx.exe
  2⤵
  PID:15976
- C:\Windows\System\KyrjvCF.exe
  C:\Windows\System\KyrjvCF.exe
  2⤵
  PID:16000
- C:\Windows\System\SzxpBBV.exe
  C:\Windows\System\SzxpBBV.exe
  2⤵
  PID:16032
- C:\Windows\System\BXDrxmj.exe
  C:\Windows\System\BXDrxmj.exe
  2⤵
  PID:16052
- C:\Windows\System\StheTYR.exe
  C:\Windows\System\StheTYR.exe
  2⤵
  PID:16076
- C:\Windows\System\hdizyJw.exe
  C:\Windows\System\hdizyJw.exe
  2⤵
  PID:16104
- C:\Windows\System\qFDNHUo.exe
  C:\Windows\System\qFDNHUo.exe
  2⤵
  PID:16140
- C:\Windows\System\zjscFnR.exe
  C:\Windows\System\zjscFnR.exe
  2⤵
  PID:16160
- C:\Windows\System\JrHQPYl.exe
  C:\Windows\System\JrHQPYl.exe
  2⤵
  PID:16200
- C:\Windows\System\VwXskjs.exe
  C:\Windows\System\VwXskjs.exe
  2⤵
  PID:16228
- C:\Windows\System\myHgvwa.exe
  C:\Windows\System\myHgvwa.exe
  2⤵
  PID:16252
- C:\Windows\System\NUOdbwh.exe
  C:\Windows\System\NUOdbwh.exe
  2⤵
  PID:16280
- C:\Windows\System\PTYBmNd.exe
  C:\Windows\System\PTYBmNd.exe
  2⤵
  PID:16312
- C:\Windows\System\fNnUuPE.exe
  C:\Windows\System\fNnUuPE.exe
  2⤵
  PID:16340
- C:\Windows\System\qpmpsIG.exe
  C:\Windows\System\qpmpsIG.exe
  2⤵
  PID:16360
- C:\Windows\System\TnXEYlc.exe
  C:\Windows\System\TnXEYlc.exe
  2⤵
  PID:15364
- C:\Windows\System\imjjxoo.exe
  C:\Windows\System\imjjxoo.exe
  2⤵
  PID:15428
- C:\Windows\System\qqPAMkf.exe
  C:\Windows\System\qqPAMkf.exe
  2⤵
  PID:15492
- C:\Windows\System\XTkGJfz.exe
  C:\Windows\System\XTkGJfz.exe
  2⤵
  PID:15556
- C:\Windows\System\XWtUnEH.exe
  C:\Windows\System\XWtUnEH.exe
  2⤵
  PID:15600
- C:\Windows\System\qGBqRHb.exe
  C:\Windows\System\qGBqRHb.exe
  2⤵
  PID:15696
- C:\Windows\System\dSNYyYd.exe
  C:\Windows\System\dSNYyYd.exe
  2⤵
  PID:15756
- C:\Windows\System\YImpeaN.exe
  C:\Windows\System\YImpeaN.exe
  2⤵
  PID:15852
- C:\Windows\System\gFTMHzU.exe
  C:\Windows\System\gFTMHzU.exe
  2⤵
  PID:8392
- C:\Windows\System\boLtXdQ.exe
  C:\Windows\System\boLtXdQ.exe
  2⤵
  PID:220
- C:\Windows\System\vALtCek.exe
  C:\Windows\System\vALtCek.exe
  2⤵
  PID:15912
- C:\Windows\System\MXKhUGf.exe
  C:\Windows\System\MXKhUGf.exe
  2⤵
  PID:15984
- C:\Windows\System\lzJUoou.exe
  C:\Windows\System\lzJUoou.exe
  2⤵
  PID:16044
- C:\Windows\System\VatAFqA.exe
  C:\Windows\System\VatAFqA.exe
  2⤵
  PID:16092
- C:\Windows\System\XXrQAcU.exe
  C:\Windows\System\XXrQAcU.exe
  2⤵
  PID:16212
- C:\Windows\System\CVrdfnd.exe
  C:\Windows\System\CVrdfnd.exe
  2⤵
  PID:16244
- C:\Windows\System\wKEUUMh.exe
  C:\Windows\System\wKEUUMh.exe
  2⤵
  PID:16300
- C:\Windows\System\lJtNzlZ.exe
  C:\Windows\System\lJtNzlZ.exe
  2⤵
  PID:15400
- C:\Windows\System\CmNtRhd.exe
  C:\Windows\System\CmNtRhd.exe
  2⤵
  PID:15580
- C:\Windows\System\pncQJeD.exe
  C:\Windows\System\pncQJeD.exe
  2⤵
  PID:15704
- C:\Windows\System\ndnYwQo.exe
  C:\Windows\System\ndnYwQo.exe
  2⤵
  PID:8168
- C:\Windows\System\BInBkPi.exe
  C:\Windows\System\BInBkPi.exe
  2⤵
  PID:2388
- C:\Windows\System\HHiMLVF.exe
  C:\Windows\System\HHiMLVF.exe
  2⤵
  PID:15948
- C:\Windows\System\lXAQwic.exe
  C:\Windows\System\lXAQwic.exe
  2⤵
  PID:16088
- C:\Windows\System\hzEeAaY.exe
  C:\Windows\System\hzEeAaY.exe
  2⤵
  PID:16276
- C:\Windows\System\dJfJkiI.exe
  C:\Windows\System\dJfJkiI.exe
  2⤵
  PID:16380
- C:\Windows\System\GQFwODc.exe
  C:\Windows\System\GQFwODc.exe
  2⤵
  PID:15808
- C:\Windows\System\inknYyD.exe
  C:\Windows\System\inknYyD.exe
  2⤵
  PID:16116
- C:\Windows\System\XPnGYrC.exe
  C:\Windows\System\XPnGYrC.exe
  2⤵
  PID:15484
- C:\Windows\System\EnBRWTG.exe
  C:\Windows\System\EnBRWTG.exe
  2⤵
  PID:16404
- C:\Windows\System\mPuzRfL.exe
  C:\Windows\System\mPuzRfL.exe
  2⤵
  PID:16420
- C:\Windows\System\yEJJfyX.exe
  C:\Windows\System\yEJJfyX.exe
  2⤵
  PID:16436
- C:\Windows\System\boaJQeD.exe
  C:\Windows\System\boaJQeD.exe
  2⤵
  PID:16488
- C:\Windows\System\ryAhkwv.exe
  C:\Windows\System\ryAhkwv.exe
  2⤵
  PID:16504
- C:\Windows\System\RYIlwHL.exe
  C:\Windows\System\RYIlwHL.exe
  2⤵
  PID:16544
- C:\Windows\System\urgqhOT.exe
  C:\Windows\System\urgqhOT.exe
  2⤵
  PID:16572
- C:\Windows\System\SNpRbzW.exe
  C:\Windows\System\SNpRbzW.exe
  2⤵
  PID:16600
- C:\Windows\System\JOvjued.exe
  C:\Windows\System\JOvjued.exe
  2⤵
  PID:16632
- C:\Windows\System\sEJtUXX.exe
  C:\Windows\System\sEJtUXX.exe
  2⤵
  PID:16652
- C:\Windows\System\GHpAJnv.exe
  C:\Windows\System\GHpAJnv.exe
  2⤵
  PID:16692
- C:\Windows\System\EeNHLlm.exe
  C:\Windows\System\EeNHLlm.exe
  2⤵
  PID:16708
- C:\Windows\System\QibMgyV.exe
  C:\Windows\System\QibMgyV.exe
  2⤵
  PID:16736
- C:\Windows\System\BTDoMKf.exe
  C:\Windows\System\BTDoMKf.exe
  2⤵
  PID:16764
- C:\Windows\System\ykqIKdt.exe
  C:\Windows\System\ykqIKdt.exe
  2⤵
  PID:16784
- C:\Windows\System\djrVuOR.exe
  C:\Windows\System\djrVuOR.exe
  2⤵
  PID:16832
- C:\Windows\System\mewxTNY.exe
  C:\Windows\System\mewxTNY.exe
  2⤵
  PID:16872
- C:\Windows\System\LOnmUyR.exe
  C:\Windows\System\LOnmUyR.exe
  2⤵
  PID:16888
- C:\Windows\System\POPmTQE.exe
  C:\Windows\System\POPmTQE.exe
  2⤵
  PID:16912
- C:\Windows\System\gtYYUaT.exe
  C:\Windows\System\gtYYUaT.exe
  2⤵
  PID:16932
- C:\Windows\System\umlaFbk.exe
  C:\Windows\System\umlaFbk.exe
  2⤵
  PID:16948
- C:\Windows\System\EjylQIT.exe
  C:\Windows\System\EjylQIT.exe
  2⤵
  PID:16984
- C:\Windows\System\LScjXFi.exe
  C:\Windows\System\LScjXFi.exe
  2⤵
  PID:17004
- C:\Windows\System\GELFDZH.exe
  C:\Windows\System\GELFDZH.exe
  2⤵
  PID:17040
- C:\Windows\System\gFPRgpQ.exe
  C:\Windows\System\gFPRgpQ.exe
  2⤵
  PID:17060
- C:\Windows\System\fkLXqka.exe
  C:\Windows\System\fkLXqka.exe
  2⤵
  PID:17092
- C:\Windows\System\xuABQIg.exe
  C:\Windows\System\xuABQIg.exe
  2⤵
  PID:17116
- C:\Windows\System\dswJXTx.exe
  C:\Windows\System\dswJXTx.exe
  2⤵
  PID:17140
- C:\Windows\System\lTtQOSv.exe
  C:\Windows\System\lTtQOSv.exe
  2⤵
  PID:17176
- C:\Windows\System\RODWlBv.exe
  C:\Windows\System\RODWlBv.exe
  2⤵
  PID:17216
- C:\Windows\System\AJyFaaw.exe
  C:\Windows\System\AJyFaaw.exe
  2⤵
  PID:17240
- C:\Windows\System\tXRJXrS.exe
  C:\Windows\System\tXRJXrS.exe
  2⤵
  PID:17260
- C:\Windows\System\KjOrtZZ.exe
  C:\Windows\System\KjOrtZZ.exe
  2⤵
  PID:17308
- C:\Windows\System\sjrofRf.exe
  C:\Windows\System\sjrofRf.exe
  2⤵
  PID:17328
- C:\Windows\System\MDmJjrr.exe
  C:\Windows\System\MDmJjrr.exe
  2⤵
  PID:17352

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CmdSIoJ.exe

Path C:\Windows\System\CmdSIoJ.exe
Size 1.6MB
SHA256 f9f1f3c792423a5e6b7b45f06b1338da3cd5707bbf6f82cefc4b44419421a5af
MD5 c9ecc58a8632c348bc5010edfa29ec59
SHA1 cef11ff6ca826975c51e7ab5f32ed134d077c11a
SHA512 f3b42e4e7a849fa13372babe9de579b2033c391ad6750c935cd7809ff0c0e4389e4981cedc1e792022026155ae36802f09a349b025022829936a3fab9f4f4284
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtA:GemTLkNdfE0pZau
MD5 SHA1 SHA512 SSDEEP

Submit Download

FHNLoJL.exe

Path C:\Windows\System\FHNLoJL.exe
Size 1.6MB
SHA256 f8813b7dc6232a57a7dce5d737b1d268dca00799650a73c5087916e13880b814
MD5 212b7e2beeb848dea2d8d0b325259d27
SHA1 df6ea042f9238f1d654cc264ffd313118cd1a13b
SHA512 2134a832579c259d5edb242d2fe41aa23da633a5d03cde8c3e0fa9016ccf5d72efd04813634a62fc8068a555244ae1317e37a8e257dd1d17acda901e77500df5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtx:GemTLkNdfE0pZaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

GZqwvKg.exe

Path C:\Windows\System\GZqwvKg.exe
Size 1.6MB
SHA256 fe2f941765e0bb589313112dec60a65b1786bd3e8f2a137b19fe2d9826f28109
MD5 b4945052bb721e8de2b6ea8beaaa385a
SHA1 a83633e33375fb59efbb54680125a0492db263b7
SHA512 a193913f2ba94b3b670582a8f4bc952fa19f255f8ad6ec649a077a1097042414ee7ce1e8b6e7f73cae361493aee03c29be0de8666b674f5064cc4bc6061ea2ae
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLti:GemTLkNdfE0pZag
MD5 SHA1 SHA512 SSDEEP

Submit Download

HEhhvAO.exe

Path C:\Windows\System\HEhhvAO.exe
Size 1.6MB
SHA256 19dacccac1c57380cd9493676035155fb3bd07aba3afcb46f8e639a918f07768
MD5 f6977cf7b217a9d42576c69f7c12cc85
SHA1 ce3fd54824c3b7cc48450b854706dff3fca02037
SHA512 55d01469e35de440cc1c16bb2152cc407c675432b376a08676a4975f9013e5d6cf5a65f608f39eeb026e5cd6fb5d80cb58e7a3f8b026bd9e3bb1981a1d9bb81c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtv:GemTLkNdfE0pZaR
MD5 SHA1 SHA512 SSDEEP

Submit Download

HGFAEyC.exe

Path C:\Windows\System\HGFAEyC.exe
Size 1.6MB
SHA256 e752b4cda6e4088f219b019d226b02900d2cea1bb8c664c76187e633c37ee87b
MD5 6a9b352f71d59d7bfae9fc9ce00942cb
SHA1 e28f69c4a319e3d46b6b8d98bb2815bd91de80bb
SHA512 0eb4a49917cbb69f6f8c1610308547a24791f2a60f3866362b113a502cc891e2ab33b36ba32b0431f4862cb848292da65feaf357700f455e053fc599adb5226f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtR:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

KXWqOgT.exe

Path C:\Windows\System\KXWqOgT.exe
Size 1.6MB
SHA256 c35e903a8f167f3af9602029a7d50d6874600553a6a671f6a4bca90ba977c515
MD5 72ef9c172f7d3f2d24c03c3d5e696614
SHA1 d449ef23d907f23fb6bdd4542510991f75b5ad73
SHA512 3ad948b3bce847e595d13430653a01697c3978ae31cd48c7d5c798620d174ddc9ca9cb7485e8c16e48a248b64177e8edd1ab56103941769fc45796d17cdb4efc
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtz:GemTLkNdfE0pZah
MD5 SHA1 SHA512 SSDEEP

Submit Download

LJbYplu.exe

Path C:\Windows\System\LJbYplu.exe
Size 1.6MB
SHA256 7e0694c08b24bbd95bc66ca358f156e779d01cf7353330621557341df161215f
MD5 bec0f09b858f1ee0c4195fc9b281daf9
SHA1 403001e58d839cca9fc4bdc70a867555b04ca998
SHA512 3c6c72239c53a909f3e92db19e051c264740052ee2e084469bad927e391afff3fcbc5737ca504491d94dd503d7886d5321ccc1f6e89731c3e0fd0efb66d59029
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtQ:GemTLkNdfE0pZaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

LTisvTI.exe

Path C:\Windows\System\LTisvTI.exe
Size 1.6MB
SHA256 2da811134513c24313c9d9f3bd20561ef4512000daf224045fb6e8d072426f15
MD5 8a5840f3fc5f4cd449519ccf2a818a2c
SHA1 fe06b1f69bd2d5902eacee0794ab0fd0e5525c4b
SHA512 cd633e34306d88e39c0b888dabdd9eac711cba50c9576da5ee51c76911ba06513f65d1ba612097f7e94b2e1d3afdb845ddffac9afb6a06ed0980c941335d8d4b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtz:GemTLkNdfE0pZap
MD5 SHA1 SHA512 SSDEEP

Submit Download

PYtsJeM.exe

Path C:\Windows\System\PYtsJeM.exe
Size 1.6MB
SHA256 c450bbdc324131cb3d76c1e41d30b60fd3c6853a1e8a9bcae60b78cbc0e4a97a
MD5 6d02d9648ee3222d3dcdf0e724b000eb
SHA1 a878e784e984c25074f8dce95b40e8c94516b4e6
SHA512 e94f308f78da949bb94e66abc9c6a90daffe780f88d2bbfabbb2ee7a818a70f61e248cbdf82c4ada8e53db1e4ff41ea29edbab4cf026ef70b9504825bda09023
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtW:GemTLkNdfE0pZaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

QUdqYcy.exe

Path C:\Windows\System\QUdqYcy.exe
Size 1.6MB
SHA256 75c7d7cf658cdd821056a9abd6d7a31cd2dbe4ea0b911747b8b7edbbc11e8abf
MD5 9074cfd2430956f6f29cd5f4e524a808
SHA1 a3c7a661355b29500555d346ea9e67cc3ffc62fc
SHA512 4536e908c618679593ee3cce94a727bd207609def58a0a1ad0b78641efd89d8e50c543fd587200087bc4c85d25da999b89d1f66987629d31ae617830f96c4e11
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtl:GemTLkNdfE0pZab
MD5 SHA1 SHA512 SSDEEP

Submit Download

UTIukQH.exe

Path C:\Windows\System\UTIukQH.exe
Size 1.6MB
SHA256 88cc7f7b34d2cfe616a6c6b6aed0606a7588e5a79a3e267ff251956b532921fe
MD5 62b95ae42ef3b72661a5972d78001804
SHA1 07cbfb43b7753a8a6b03d10a2fecbcfd4513f65f
SHA512 a2bb12ae43a9fc076cbbeecb072faf37c4e54ee5c45736a5d141e4ce7104375f5f4a874033b62b3ed537e07441336c7b4f8777189f6fa98d84e4f8457de4727d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtL:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Submit Download

VThwOfk.exe

Path C:\Windows\System\VThwOfk.exe
Size 1.6MB
SHA256 160e4eac59b6742b3e49bdfe4fc9d9ee132b82cfcf278fb96f55fdebabcbed4f
MD5 7fc02ddd800a432b62373b844d32c279
SHA1 f3d07ee65642807c2f364bad353dab0a03cbda7d
SHA512 075c0dedb6a804ac9c9bd843625cbeacda5a040986ec3fcaf428a8dd5a7491fddde00d777fe873b028883e77847dddeb95ae1a3b4b5f30d777bfc5d30616e1a9
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtb:GemTLkNdfE0pZaZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WTIymPA.exe

Path C:\Windows\System\WTIymPA.exe
Size 1.6MB
SHA256 cac50bbe152a57e2476c4d9defca21420fa9d154fc5c7a998d05c30e757b2438
MD5 31cc81ccb77507e455f77d6dc66abdba
SHA1 19f68ae91d841a3679362244f6f869aaa9513610
SHA512 8e9498eba8a0f470cf2f3b3d5524c1bc0232e57f2378b9755237651cef0a5c9f17d5587f0fa76e7de032472007e0a809636dfbebb38cb7cd3b9d1f4670d84bff
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtQ:GemTLkNdfE0pZaW
MD5 SHA1 SHA512 SSDEEP

Submit Download

YRXztkM.exe

Path C:\Windows\System\YRXztkM.exe
Size 1.6MB
SHA256 e7fe0ba55d701eb7d07519c778ba3f867af1a2169fcc5ee1891146a59066f52f
MD5 b0aba05f935c398e6d48922920d2fe90
SHA1 04de6e4016eebae83fe1650a8f6a2eb5e07a3e39
SHA512 49ac144c68de80be8846079a0d1eb325ecf2ea648ca9479851ad44db8d5d22868c3509ea9cf16b30477d9b8a75c90d654603c9166c141ba17cc2b5ebd12fe3d8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLt3:GemTLkNdfE0pZah
MD5 SHA1 SHA512 SSDEEP

Submit Download

eZtsxIX.exe

Path C:\Windows\System\eZtsxIX.exe
Size 1.6MB
SHA256 8c2ad597a10f75d3754089823395fea647aff66b777cebdeeaf77012ef2b8015
MD5 6f573fd9b4f2ad6ea997ceec4f3d31f8
SHA1 05bd79a5cfe3684acf1338aa6dd99dd5802991e1
SHA512 755d7ea2f9a89bc3448d8f2da5a0056e4763e695780596fcace0710b1cb5c71637e169b7dfba418e97a914a60d149e828ef13e526c55e7a261769c6080da81fb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtm:GemTLkNdfE0pZag
MD5 SHA1 SHA512 SSDEEP

Submit Download

eaFJAKo.exe

Path C:\Windows\System\eaFJAKo.exe
Size 1.6MB
SHA256 0a59178cf86d9d8ead6fbf0e4a29c1c1596e57036a9744d7500747679e088f61
MD5 f0d2e6db349adf00e6ae302f3fa5cf3b
SHA1 9414ed1a2e4f515081762fcf8a33c29236699a65
SHA512 92502ad9e90549ba4d1a519373fe1b96e7f31772f51df06577fc0cdc812445021c5f55a2daa3976294ed0eba122b96e675c6f25eb212d5f0d2b4d5a28e4e6cb0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtO:GemTLkNdfE0pZac
MD5 SHA1 SHA512 SSDEEP

Submit Download

eaNClEn.exe

Path C:\Windows\System\eaNClEn.exe
Size 1.6MB
SHA256 4f3b3239eb6d88fd3a5e47fde86935e1328b189e0651636f396ed3434a580d54
MD5 267b13b152e0bd46fd8ec5a7ad954942
SHA1 f0952054ca46eb1ba3801dc64756a81cbabd4481
SHA512 9d97d623827785ff0e9925bb0ce351cf710d39c012f3bb811bb89e781adab9b294babfda924d86fb0bc9c4b9561a4a01c53371472ef14c546ecec072eb03b5ac
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtY:GemTLkNdfE0pZaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

fbqHSJq.exe

Path C:\Windows\System\fbqHSJq.exe
Size 1.6MB
SHA256 2d072777dc408a94b9952bdc5efef648bcab328c3c133814372c36eb936ab176
MD5 edc0a96bb78dd726cdc4e2d9a394d317
SHA1 1b8fe472e1121f91102b5ddfb9399b652a5b6ab3
SHA512 8a9e5c5c8c91ed8e91011b68062adfc7202ebaab003fed1956f804a7d87668e04b7b4f524277fe34a2a4a6705cd0585b7323f743bf1dd68d4f18cedaf95d425c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtb:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Submit Download

hOXmsGG.exe

Path C:\Windows\System\hOXmsGG.exe
Size 1.6MB
SHA256 bf83b479de3dd74938fdd9e21ace3db18389eae53e3e6e8df4e178174180846d
MD5 2f45b536cce5337f0e2bbb6570f800f9
SHA1 655d5c97a0c3529eac804615c276fb59ca404879
SHA512 49dc6173902d41821a36fda9e69cd6e7910df4d86d0ba783ee42bcad43ee0f5352fb3950cb350874f2aaa4f3525577e739db892c85a02a4d81591634a2e3d81d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtr:GemTLkNdfE0pZaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jQcvXfx.exe

Path C:\Windows\System\jQcvXfx.exe
Size 1.6MB
SHA256 470ac24ca111aaaa0413c407d1ad10e4a3a58dbd01ee1c4ca4b8aabe40cca676
MD5 55ddd65fa2e7ba9a2fd30d9c6fe105ff
SHA1 2e760afd96beb7e83da7d64f8090e78b2a7794cd
SHA512 e608a517abda6632f10a6dce92cea1992f80de8847d1aadf92828917abeae6451f7ff5de3542d72de3b142dae28e57d9a8252c2346fd69ee02db53e241b17ca8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLt5:GemTLkNdfE0pZaL
MD5 SHA1 SHA512 SSDEEP

Submit Download

kKVkCHF.exe

Path C:\Windows\System\kKVkCHF.exe
Size 1.6MB
SHA256 10ff535dfe315e595c9c1a21f94c06d9bb67403436193ec19d21451c038acad1
MD5 bd4ed4fa87ad97c38ae9840dcf0ea37c
SHA1 dfee177db1ab5d5823ad9744657acda0d97fd3da
SHA512 f4ee90f840b9d760fdc544c9ffb3c7f26e59e850ae6d299f804a6cc624772e348c88f8d5f466c71bb9aa651559f8ada4b3232213eacd09028b162be0f5be1695
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLt+:GemTLkNdfE0pZaQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mJARczO.exe

Path C:\Windows\System\mJARczO.exe
Size 1.6MB
SHA256 0387e65b66cfb47fff1bd07ab3165064fcf58b6d80615ace4ede2458c849e017
MD5 c117385b5b37b01b8d9623c702053aa2
SHA1 08e4ad43972cce9755ba00db1a7f518a0ebafe3d
SHA512 9cf1829f62594b4b619e105474d2d187e6ff767164a44bd73dd905658e0218c0eebe720486580d40f9f41812fd7d9d8e77366b19e09c9dc8a3474fe6d8b411a7
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtW:GemTLkNdfE0pZaI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ncqKqOO.exe

Path C:\Windows\System\ncqKqOO.exe
Size 1.6MB
SHA256 0eb6b62f4eaa8a06094b67cc2e1752a4a07a5501a36baa2831f3afc1ccc69151
MD5 dcae91dd23a37ce5e9f2114872294921
SHA1 693e2daf3f2e7531e03b01bcd79eeeb9bab573ed
SHA512 17eced78a830c6fee4458028b32aee25666a9955d3d499f914a103620426f17a2163a5a92546ffb4ddcff56e7b8fd38e306a3643bfc0be023302faaa541c2f47
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtl:GemTLkNdfE0pZaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

scYRNHT.exe

Path C:\Windows\System\scYRNHT.exe
Size 1.6MB
SHA256 0552c3d9d401b3a92c8827df7f55a0c3680fdcbc8a10e943238f644a8b66c3a6
MD5 49ec2f566b5e8ae4292d05cbfb9f163d
SHA1 1dc62e1a8f217bbd5dd7f001e4868ae2d7d53beb
SHA512 0e47e3f9755e3cec7a83d89478a43be0cb23280451d0670ee8a407bedacfb01e95160b97fab31869b58fb32493baaa9f6ef859d92e5a68d7fd891f78407b2a86
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtn:GemTLkNdfE0pZaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

siNzdEX.exe

Path C:\Windows\System\siNzdEX.exe
Size 1.6MB
SHA256 2e8ad1acb7f5a5dd356f2399b8ef1d12fd321b32683b90f9cee3ec394563b788
MD5 0a05d9f1a2a9ec51ab548572d0feedb4
SHA1 69e9697a1e58e383579ce39ea8b187f867bc8d9a
SHA512 fc3be2ec43a7944ff768cc1eb60af23c3548bbb5986a3d44223ea1899336e7c23519f3c32d74b41266d05ae9f959c80755764212b5f14c4d4e1964e1a5fe2792
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLt9:GemTLkNdfE0pZaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

tOTAcGj.exe

Path C:\Windows\System\tOTAcGj.exe
Size 1.6MB
SHA256 e75de1e90b1d0d642901d392c0e29f9ca2fa1502d45669041563443abc206e63
MD5 3245a68f868f6917b5eec017e9a866d9
SHA1 3b8acba7416d47a8b0f9fa82a7a6e83a8f98e798
SHA512 7f8ceee8584b9ef4e8a7d6ccdbccf9f81a9907f14c167d8cb88d4c6af91e37d0e3a7db9e0b73d55a1b7dc52fb3bde9751d15a485a841361f86e7daa0f7036a37
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtw:GemTLkNdfE0pZaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

uLujbmF.exe

Path C:\Windows\System\uLujbmF.exe
Size 1.6MB
SHA256 70f95c5639a8c3827d74cd163ad29b6101f47b259cda40b6568139930f685de8
MD5 0afb0ad27dab4d20cb404880f401128d
SHA1 eda84376cfdaa02e115eee545ced8f65d408f4ed
SHA512 d599b066f44465b550dd5d22c3e3ce1f4f6a29c2687dfb0409fbe4b77a58f70ad781f10a1f16f35410cf22f9918f5c3fd5f95f1bf14334193fa7c0ef3d5674a0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtr:GemTLkNdfE0pZaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

xCqBJwx.exe

Path C:\Windows\System\xCqBJwx.exe
Size 1.6MB
SHA256 3a11694692bc777cd08a74e2077bed1ca665a3c7f10e4357646120dd459d9d72
MD5 7c63dbeb587b98369ffcb2eff0362673
SHA1 d96fec08abae3a41eaf7fa5dc9ed44d5be26f93f
SHA512 59cec284faa5892d97424c15b663211931d9c7789799a742fdc041e4a9c0529a255e5b3213eb4a2050168de1673d93ab74335eeadf13dc72ab8d19890cbce0e0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtN:GemTLkNdfE0pZab
MD5 SHA1 SHA512 SSDEEP

Submit Download

xHUsLsC.exe

Path C:\Windows\System\xHUsLsC.exe
Size 1.6MB
SHA256 39a71fb47a41c4d2888c9fd3ece8ac231227bd9581271dfecd1b231cc018e030
MD5 d2a93f2ee061569f4ea30764f31e77ba
SHA1 1f8642229626c06d501169244fd28969de6adca6
SHA512 0f5b8bd6893a36622e278436572935e71a4ebe8f3cafd8269050173c912c2c2d70103a828b4b461be123f74ea3649ed78f7d764e85ec15909c3cebf8c3403108
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLts:GemTLkNdfE0pZaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

xNveERU.exe

Path C:\Windows\System\xNveERU.exe
Size 1.6MB
SHA256 3507fcacafb6ba476bdf566182e33f0e32a06bc5793aa6bb98237418623747be
MD5 e769b37371329b9246f2a5424feb0ab3
SHA1 4cddda02f93461395c1aa0b7f08f0834a01d59d3
SHA512 3efd11e1e3f073edc764b575f3ffef2d0f4479d7c2b2b7e605015b7ba568b1e2cb1bb288f192eb27d53fcd8d11298ef0fcb1e0d3a068e0ef28ef01c4e9a4c740
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtS:GemTLkNdfE0pZas
MD5 SHA1 SHA512 SSDEEP

Submit Download

zPUXxFM.exe

Path C:\Windows\System\zPUXxFM.exe
Size 1.6MB
SHA256 381a5c70fe8a26acacaaee74dd949f17b4ebfe28c7be00ae8860f281990b166c
MD5 8dd8038a8ce5b7aec952ed4d1ad64ec5
SHA1 5b3773b72e5b258d69018daf74bcb2be6f9b90c0
SHA512 5ea256c8a5a9d3fa396e0c64b072a7612715ea9b71a12e9b7859baa3d39c71135d22dd03a6d808d7dc9a72157846b897ddf91f2881a37fbc0c04e7e5e628cc54
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLt0:GemTLkNdfE0pZaq
MD5 SHA1 SHA512 SSDEEP

Submit Download

zQpqfyL.exe

Path C:\Windows\System\zQpqfyL.exe
Size 1.6MB
SHA256 7b0c33064803d5a1b84dc77c42131145360f8c02cbbdfdc0647d3bca252108d8
MD5 02e4702c7dc769d7c65ac7c2dc36cefb
SHA1 89d3762bdfb31c207d9f1357cb5db4b10c6787ca
SHA512 19f8e266760cccef6cdc19960e7ab82e19695b40d3379967595c5a5142b1147858bc8bbb4be2f7bf0a7833a53750ac76e57edb4176f5a2af8b3103f2040f5c10
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtR:GemTLkNdfE0pZa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

zxgaQTJ.exe

Path C:\Windows\System\zxgaQTJ.exe
Size 1.6MB
SHA256 8046b76404749831246308dcef664ec77e6dd2890916fc15d807ed82a5551c4f
MD5 98d7dac7a9d60533b542acdd65b1f1a3
SHA1 18561df555ad537a982e65066b4d27340fc49b23
SHA512 054a3b6244b4c8bd933d6aec5c2ff1a19542a50689b9580c44605c3c97c89cef2890e235cdb255dfff4427c114f7e046fb8bac8e31d44a7794d6dad8c3d3bdb2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cxmtyvZNomLtj:GemTLkNdfE0pZal
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1880-0-0x000001936EFB0000-0x000001936EFC0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads