xmrig | 58eff37e5d00404bb47c5ea827724f236d33bf5d438089f3291c38a454152c5b

Analysis

max time kernel
125s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
Size 1.7MB
Sample240603-qdnvvafe2s
SHA256 58eff37e5d00404bb47c5ea827724f236d33bf5d438089f3291c38a454152c5b
MD5 a472a2796d0b6aecd10a21506c98eb60
SHA1 282ca5437d79ad373c5e2ad99cdee148ff77fee4
SHA512 a03fdb5787a45ba5103709e8446401744e1db2a01d88787f4cf8900d51423728c76d12b5167820a66976f605bf10046b7aeceb04ce07e6298026305e60e0f766
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUw:GemTLkNdfE0pZaU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x0006000000023288-4.dat	xmrig
behavioral2/files/0x00080000000233eb-7.dat	xmrig
behavioral2/files/0x00070000000233ef-6.dat	xmrig
behavioral2/files/0x00070000000233f2-28.dat	xmrig
behavioral2/files/0x00070000000233f3-31.dat	xmrig
behavioral2/files/0x00070000000233f5-41.dat	xmrig
behavioral2/files/0x00070000000233f6-50.dat	xmrig
behavioral2/files/0x00070000000233f4-44.dat	xmrig
behavioral2/files/0x00070000000233f1-24.dat	xmrig
behavioral2/files/0x00070000000233f0-21.dat	xmrig
behavioral2/files/0x00070000000233f7-54.dat	xmrig
behavioral2/files/0x00070000000233f8-57.dat	xmrig
behavioral2/files/0x00080000000233ec-65.dat	xmrig
behavioral2/files/0x00070000000233f9-69.dat	xmrig
behavioral2/files/0x00070000000233fa-73.dat	xmrig
behavioral2/files/0x00070000000233fb-79.dat	xmrig
behavioral2/files/0x00070000000233fd-90.dat	xmrig
behavioral2/files/0x00070000000233fe-94.dat	xmrig
behavioral2/files/0x00070000000233ff-95.dat	xmrig
behavioral2/files/0x00070000000233fc-83.dat	xmrig
behavioral2/files/0x0007000000023400-104.dat	xmrig
behavioral2/files/0x000c000000023351-114.dat	xmrig
behavioral2/files/0x0007000000023403-111.dat	xmrig
behavioral2/files/0x000e000000023354-117.dat	xmrig
behavioral2/files/0x000d000000023355-124.dat	xmrig
behavioral2/files/0x0007000000023404-129.dat	xmrig
behavioral2/files/0x0007000000023405-134.dat	xmrig
behavioral2/files/0x0007000000023406-139.dat	xmrig
behavioral2/files/0x000b000000022960-145.dat	xmrig
behavioral2/files/0x0007000000023407-149.dat	xmrig
behavioral2/files/0x0007000000023408-154.dat	xmrig
behavioral2/files/0x0007000000023409-160.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5016	PjOOFca.exe
2908	qAefqvr.exe
1088	gvCnMKn.exe
1900	CEYKBMk.exe
4200	TWzYxsk.exe
708	wrVOpsN.exe
3492	ILAIHIO.exe
4676	DrXefxj.exe
4844	hyezqxy.exe
3060	uzpCyZi.exe
4760	MeuOkpL.exe
4316	ECsGGfy.exe
4508	VHJkCEN.exe
1908	imKbJzo.exe
4988	kKXMtwQ.exe
4476	Uzgzlpb.exe
3704	rSqqIzc.exe
3672	tDsxLxg.exe
4296	jQGwZMK.exe
4632	hqXZAIa.exe
4444	wGVkFVx.exe
4504	ubFfrhO.exe
728	rQhCLuQ.exe
372	iltbHcQ.exe
4736	wtZPpqE.exe
1296	ZwTZNkI.exe
3892	zmMBlhg.exe
3336	gAFEcQQ.exe
1960	ucGWBVE.exe
3652	goftjhT.exe
3992	QMxHraV.exe
4896	YQggWhC.exe
3916	hKFBNiR.exe
2732	deAqLGO.exe
1996	drIZSKh.exe
4556	zUhERTa.exe
3544	ENnypQw.exe
4416	yRjeKEt.exe
2392	eqbwrIE.exe
3436	ufZcAgB.exe
1328	PNHCwrp.exe
804	HmzzAbw.exe
4052	uliMvxH.exe
4396	BpJznDx.exe
1348	GFbMkLp.exe
3200	WPXCtXZ.exe
4196	YSMsAeo.exe
2748	zzWVpHp.exe
3232	FLFleYg.exe
772	iMKjEcA.exe
4876	JMZbqXh.exe
1116	RBrWJAX.exe
5032	dFxaiLH.exe
2744	vCbnSgC.exe
4044	DwCBMBe.exe
5080	zUHMEnu.exe
5024	iQegVJQ.exe
2788	AcdvXcg.exe
3804	LrlkgzN.exe
540	RfavXlU.exe
4272	tsVdIUA.exe
4612	pjjFsMD.exe
4880	LurToDW.exe
2352	jicLzdK.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VHJkCEN.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\eqhpWtH.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\LVONttz.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\yIcCINt.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\moVFjQJ.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\NeUZQeL.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\RvRXyBw.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\PyUAXhg.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\uYzwNjS.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\gVuFCek.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\vHfHSIf.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\pljmJwG.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\ImCoiSa.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\sbxehxv.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\yNmvsYj.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\iRJXzwE.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\KBNskNY.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\VvyZMJb.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\VaIIXyl.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\bembotX.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\deAqLGO.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\EMcurut.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\wGcqtJw.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\YBVoPVl.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\GhNOMPK.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\aARVkfP.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\UuGiwcO.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\eeaaIBC.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\uEJzCFT.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\ROxYRWU.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\rkJFnuQ.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\Qnigxcx.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\KRiwHhG.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\CEYKBMk.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\djZjMii.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\iGctsQk.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\uiUFHfl.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\mnUlqkg.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\bNZRNdJ.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\SDCrfnZ.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\qcaucuY.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\ksaxQQD.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\LucCxSL.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\CMafeZj.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\jcmBFZl.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\gbmYUvN.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\XeNruOp.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\hGLwJwK.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\SyCXkPR.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\zyTlddb.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\EtyNJXQ.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\fNsQuUq.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\LkwGkyO.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\qxdpmcf.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\RhloXhe.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\evAGMXB.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\TEMRvRw.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\zfZKmrm.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\JMmDjSA.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\FRJydQc.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\OyAivbt.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\tFybBYR.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\PcnOFaC.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
File created	C:\Windows\System\yEObeFw.exe	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5008	dwm.exe
Token: SeChangeNotifyPrivilege	5008	dwm.exe
Token: 33	5008	dwm.exe
Token: SeIncBasePriorityPrivilege	5008	dwm.exe
Token: SeShutdownPrivilege	5008	dwm.exe
Token: SeCreatePagefilePrivilege	5008	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 5016	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	82
PID 316 wrote to memory of 5016	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	82
PID 316 wrote to memory of 2908	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	83
PID 316 wrote to memory of 2908	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	83
PID 316 wrote to memory of 4200	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	84
PID 316 wrote to memory of 4200	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	84
PID 316 wrote to memory of 1088	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	85
PID 316 wrote to memory of 1088	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	85
PID 316 wrote to memory of 1900	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	86
PID 316 wrote to memory of 1900	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	86
PID 316 wrote to memory of 708	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	87
PID 316 wrote to memory of 708	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	87
PID 316 wrote to memory of 3492	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	88
PID 316 wrote to memory of 3492	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	88
PID 316 wrote to memory of 4676	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	89
PID 316 wrote to memory of 4676	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	89
PID 316 wrote to memory of 4844	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	90
PID 316 wrote to memory of 4844	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	90
PID 316 wrote to memory of 3060	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	91
PID 316 wrote to memory of 3060	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	91
PID 316 wrote to memory of 4760	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	92
PID 316 wrote to memory of 4760	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	92
PID 316 wrote to memory of 4316	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	93
PID 316 wrote to memory of 4316	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	93
PID 316 wrote to memory of 4508	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	95
PID 316 wrote to memory of 4508	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	95
PID 316 wrote to memory of 1908	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	96
PID 316 wrote to memory of 1908	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	96
PID 316 wrote to memory of 4988	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	98
PID 316 wrote to memory of 4988	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	98
PID 316 wrote to memory of 4476	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	99
PID 316 wrote to memory of 4476	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	99
PID 316 wrote to memory of 3704	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	101
PID 316 wrote to memory of 3704	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	101
PID 316 wrote to memory of 3672	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	102
PID 316 wrote to memory of 3672	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	102
PID 316 wrote to memory of 4296	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	103
PID 316 wrote to memory of 4296	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	103
PID 316 wrote to memory of 4632	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	104
PID 316 wrote to memory of 4632	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	104
PID 316 wrote to memory of 4444	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	105
PID 316 wrote to memory of 4444	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	105
PID 316 wrote to memory of 4504	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	106
PID 316 wrote to memory of 4504	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	106
PID 316 wrote to memory of 728	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	107
PID 316 wrote to memory of 728	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	107
PID 316 wrote to memory of 372	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	108
PID 316 wrote to memory of 372	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	108
PID 316 wrote to memory of 4736	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	109
PID 316 wrote to memory of 4736	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	109
PID 316 wrote to memory of 1296	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	110
PID 316 wrote to memory of 1296	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	110
PID 316 wrote to memory of 3892	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	111
PID 316 wrote to memory of 3892	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	111
PID 316 wrote to memory of 3336	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	112
PID 316 wrote to memory of 3336	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	112
PID 316 wrote to memory of 1960	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	113
PID 316 wrote to memory of 1960	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	113
PID 316 wrote to memory of 3652	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	114
PID 316 wrote to memory of 3652	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	114
PID 316 wrote to memory of 3992	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	115
PID 316 wrote to memory of 3992	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	115
PID 316 wrote to memory of 4896	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	116
PID 316 wrote to memory of 4896	316	a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a472a2796d0b6aecd10a21506c98eb60_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\System\PjOOFca.exe
  C:\Windows\System\PjOOFca.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\qAefqvr.exe
  C:\Windows\System\qAefqvr.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\TWzYxsk.exe
  C:\Windows\System\TWzYxsk.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\gvCnMKn.exe
  C:\Windows\System\gvCnMKn.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\CEYKBMk.exe
  C:\Windows\System\CEYKBMk.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\wrVOpsN.exe
  C:\Windows\System\wrVOpsN.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\ILAIHIO.exe
  C:\Windows\System\ILAIHIO.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\DrXefxj.exe
  C:\Windows\System\DrXefxj.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\hyezqxy.exe
  C:\Windows\System\hyezqxy.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\uzpCyZi.exe
  C:\Windows\System\uzpCyZi.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\MeuOkpL.exe
  C:\Windows\System\MeuOkpL.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\ECsGGfy.exe
  C:\Windows\System\ECsGGfy.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\VHJkCEN.exe
  C:\Windows\System\VHJkCEN.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\imKbJzo.exe
  C:\Windows\System\imKbJzo.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\kKXMtwQ.exe
  C:\Windows\System\kKXMtwQ.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\Uzgzlpb.exe
  C:\Windows\System\Uzgzlpb.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\rSqqIzc.exe
  C:\Windows\System\rSqqIzc.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\tDsxLxg.exe
  C:\Windows\System\tDsxLxg.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\jQGwZMK.exe
  C:\Windows\System\jQGwZMK.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\hqXZAIa.exe
  C:\Windows\System\hqXZAIa.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\wGVkFVx.exe
  C:\Windows\System\wGVkFVx.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\ubFfrhO.exe
  C:\Windows\System\ubFfrhO.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\rQhCLuQ.exe
  C:\Windows\System\rQhCLuQ.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\iltbHcQ.exe
  C:\Windows\System\iltbHcQ.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\wtZPpqE.exe
  C:\Windows\System\wtZPpqE.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\ZwTZNkI.exe
  C:\Windows\System\ZwTZNkI.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\zmMBlhg.exe
  C:\Windows\System\zmMBlhg.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\gAFEcQQ.exe
  C:\Windows\System\gAFEcQQ.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\ucGWBVE.exe
  C:\Windows\System\ucGWBVE.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\goftjhT.exe
  C:\Windows\System\goftjhT.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\QMxHraV.exe
  C:\Windows\System\QMxHraV.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\YQggWhC.exe
  C:\Windows\System\YQggWhC.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\hKFBNiR.exe
  C:\Windows\System\hKFBNiR.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\deAqLGO.exe
  C:\Windows\System\deAqLGO.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\drIZSKh.exe
  C:\Windows\System\drIZSKh.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\zUhERTa.exe
  C:\Windows\System\zUhERTa.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\ENnypQw.exe
  C:\Windows\System\ENnypQw.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\yRjeKEt.exe
  C:\Windows\System\yRjeKEt.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\eqbwrIE.exe
  C:\Windows\System\eqbwrIE.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\ufZcAgB.exe
  C:\Windows\System\ufZcAgB.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\PNHCwrp.exe
  C:\Windows\System\PNHCwrp.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\HmzzAbw.exe
  C:\Windows\System\HmzzAbw.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\uliMvxH.exe
  C:\Windows\System\uliMvxH.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\BpJznDx.exe
  C:\Windows\System\BpJznDx.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\GFbMkLp.exe
  C:\Windows\System\GFbMkLp.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\WPXCtXZ.exe
  C:\Windows\System\WPXCtXZ.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\YSMsAeo.exe
  C:\Windows\System\YSMsAeo.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\zzWVpHp.exe
  C:\Windows\System\zzWVpHp.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\FLFleYg.exe
  C:\Windows\System\FLFleYg.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\iMKjEcA.exe
  C:\Windows\System\iMKjEcA.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\JMZbqXh.exe
  C:\Windows\System\JMZbqXh.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\RBrWJAX.exe
  C:\Windows\System\RBrWJAX.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\dFxaiLH.exe
  C:\Windows\System\dFxaiLH.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\vCbnSgC.exe
  C:\Windows\System\vCbnSgC.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\DwCBMBe.exe
  C:\Windows\System\DwCBMBe.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\zUHMEnu.exe
  C:\Windows\System\zUHMEnu.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\iQegVJQ.exe
  C:\Windows\System\iQegVJQ.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\AcdvXcg.exe
  C:\Windows\System\AcdvXcg.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\LrlkgzN.exe
  C:\Windows\System\LrlkgzN.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\RfavXlU.exe
  C:\Windows\System\RfavXlU.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\tsVdIUA.exe
  C:\Windows\System\tsVdIUA.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\pjjFsMD.exe
  C:\Windows\System\pjjFsMD.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\LurToDW.exe
  C:\Windows\System\LurToDW.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\jicLzdK.exe
  C:\Windows\System\jicLzdK.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\UJpNVWq.exe
  C:\Windows\System\UJpNVWq.exe
  2⤵
  PID:2088
- C:\Windows\System\dapfmSX.exe
  C:\Windows\System\dapfmSX.exe
  2⤵
  PID:4912
- C:\Windows\System\kOyDkpE.exe
  C:\Windows\System\kOyDkpE.exe
  2⤵
  PID:2272
- C:\Windows\System\mICRUCA.exe
  C:\Windows\System\mICRUCA.exe
  2⤵
  PID:1484
- C:\Windows\System\GbrLBuR.exe
  C:\Windows\System\GbrLBuR.exe
  2⤵
  PID:3936
- C:\Windows\System\QXyWIKu.exe
  C:\Windows\System\QXyWIKu.exe
  2⤵
  PID:4156
- C:\Windows\System\DElVCJI.exe
  C:\Windows\System\DElVCJI.exe
  2⤵
  PID:1288
- C:\Windows\System\cwnbsmL.exe
  C:\Windows\System\cwnbsmL.exe
  2⤵
  PID:1508
- C:\Windows\System\bpNiXIm.exe
  C:\Windows\System\bpNiXIm.exe
  2⤵
  PID:4276
- C:\Windows\System\JTEmEfG.exe
  C:\Windows\System\JTEmEfG.exe
  2⤵
  PID:220
- C:\Windows\System\HCrrWUN.exe
  C:\Windows\System\HCrrWUN.exe
  2⤵
  PID:4360
- C:\Windows\System\xrGXjkJ.exe
  C:\Windows\System\xrGXjkJ.exe
  2⤵
  PID:1504
- C:\Windows\System\UNkjAjb.exe
  C:\Windows\System\UNkjAjb.exe
  2⤵
  PID:3132
- C:\Windows\System\ytqfbKN.exe
  C:\Windows\System\ytqfbKN.exe
  2⤵
  PID:1016
- C:\Windows\System\yEObeFw.exe
  C:\Windows\System\yEObeFw.exe
  2⤵
  PID:1136
- C:\Windows\System\gavaHqy.exe
  C:\Windows\System\gavaHqy.exe
  2⤵
  PID:2984
- C:\Windows\System\RRYKmUb.exe
  C:\Windows\System\RRYKmUb.exe
  2⤵
  PID:2132
- C:\Windows\System\htRdlWk.exe
  C:\Windows\System\htRdlWk.exe
  2⤵
  PID:3308
- C:\Windows\System\JQjTXMX.exe
  C:\Windows\System\JQjTXMX.exe
  2⤵
  PID:4956
- C:\Windows\System\qWcBIJk.exe
  C:\Windows\System\qWcBIJk.exe
  2⤵
  PID:3024
- C:\Windows\System\AqBMJXc.exe
  C:\Windows\System\AqBMJXc.exe
  2⤵
  PID:2556
- C:\Windows\System\jHUMEbO.exe
  C:\Windows\System\jHUMEbO.exe
  2⤵
  PID:5020
- C:\Windows\System\wKhBqnz.exe
  C:\Windows\System\wKhBqnz.exe
  2⤵
  PID:5072
- C:\Windows\System\JJjfayL.exe
  C:\Windows\System\JJjfayL.exe
  2⤵
  PID:516
- C:\Windows\System\ohDckds.exe
  C:\Windows\System\ohDckds.exe
  2⤵
  PID:992
- C:\Windows\System\esRJOIZ.exe
  C:\Windows\System\esRJOIZ.exe
  2⤵
  PID:4356
- C:\Windows\System\IzBKiPO.exe
  C:\Windows\System\IzBKiPO.exe
  2⤵
  PID:3620
- C:\Windows\System\bembotX.exe
  C:\Windows\System\bembotX.exe
  2⤵
  PID:2032
- C:\Windows\System\PZAYBip.exe
  C:\Windows\System\PZAYBip.exe
  2⤵
  PID:3496
- C:\Windows\System\KVCLgUf.exe
  C:\Windows\System\KVCLgUf.exe
  2⤵
  PID:1120
- C:\Windows\System\DXDHuSl.exe
  C:\Windows\System\DXDHuSl.exe
  2⤵
  PID:116
- C:\Windows\System\ROxYRWU.exe
  C:\Windows\System\ROxYRWU.exe
  2⤵
  PID:2504
- C:\Windows\System\OkbEDQR.exe
  C:\Windows\System\OkbEDQR.exe
  2⤵
  PID:1620
- C:\Windows\System\eBXDxLL.exe
  C:\Windows\System\eBXDxLL.exe
  2⤵
  PID:3660
- C:\Windows\System\YnXMjgp.exe
  C:\Windows\System\YnXMjgp.exe
  2⤵
  PID:4804
- C:\Windows\System\uBhaTTA.exe
  C:\Windows\System\uBhaTTA.exe
  2⤵
  PID:2776
- C:\Windows\System\nqIKBpH.exe
  C:\Windows\System\nqIKBpH.exe
  2⤵
  PID:5156
- C:\Windows\System\yVSnKrG.exe
  C:\Windows\System\yVSnKrG.exe
  2⤵
  PID:5184
- C:\Windows\System\jAdquDp.exe
  C:\Windows\System\jAdquDp.exe
  2⤵
  PID:5204
- C:\Windows\System\EMcurut.exe
  C:\Windows\System\EMcurut.exe
  2⤵
  PID:5232
- C:\Windows\System\MVunrVn.exe
  C:\Windows\System\MVunrVn.exe
  2⤵
  PID:5248
- C:\Windows\System\hPnxaII.exe
  C:\Windows\System\hPnxaII.exe
  2⤵
  PID:5288
- C:\Windows\System\gUtwdPz.exe
  C:\Windows\System\gUtwdPz.exe
  2⤵
  PID:5308
- C:\Windows\System\MckyjWS.exe
  C:\Windows\System\MckyjWS.exe
  2⤵
  PID:5328
- C:\Windows\System\HTigAHP.exe
  C:\Windows\System\HTigAHP.exe
  2⤵
  PID:5380
- C:\Windows\System\MwEUiAr.exe
  C:\Windows\System\MwEUiAr.exe
  2⤵
  PID:5404
- C:\Windows\System\yoqDLnV.exe
  C:\Windows\System\yoqDLnV.exe
  2⤵
  PID:5428
- C:\Windows\System\yxaOUbD.exe
  C:\Windows\System\yxaOUbD.exe
  2⤵
  PID:5456
- C:\Windows\System\HBeFipL.exe
  C:\Windows\System\HBeFipL.exe
  2⤵
  PID:5484
- C:\Windows\System\kiYTpSU.exe
  C:\Windows\System\kiYTpSU.exe
  2⤵
  PID:5528
- C:\Windows\System\jFlsLMi.exe
  C:\Windows\System\jFlsLMi.exe
  2⤵
  PID:5552
- C:\Windows\System\aIruKZJ.exe
  C:\Windows\System\aIruKZJ.exe
  2⤵
  PID:5568
- C:\Windows\System\EPPEPRt.exe
  C:\Windows\System\EPPEPRt.exe
  2⤵
  PID:5596
- C:\Windows\System\RKdYEZj.exe
  C:\Windows\System\RKdYEZj.exe
  2⤵
  PID:5640
- C:\Windows\System\aDvWFkW.exe
  C:\Windows\System\aDvWFkW.exe
  2⤵
  PID:5660
- C:\Windows\System\fPFNBau.exe
  C:\Windows\System\fPFNBau.exe
  2⤵
  PID:5696
- C:\Windows\System\FFxHznu.exe
  C:\Windows\System\FFxHznu.exe
  2⤵
  PID:5720
- C:\Windows\System\EtyNJXQ.exe
  C:\Windows\System\EtyNJXQ.exe
  2⤵
  PID:5740
- C:\Windows\System\fNsQuUq.exe
  C:\Windows\System\fNsQuUq.exe
  2⤵
  PID:5760
- C:\Windows\System\CuooSoh.exe
  C:\Windows\System\CuooSoh.exe
  2⤵
  PID:5808
- C:\Windows\System\QWHMeuS.exe
  C:\Windows\System\QWHMeuS.exe
  2⤵
  PID:5828
- C:\Windows\System\aZnQLdZ.exe
  C:\Windows\System\aZnQLdZ.exe
  2⤵
  PID:5856
- C:\Windows\System\LkwGkyO.exe
  C:\Windows\System\LkwGkyO.exe
  2⤵
  PID:5880
- C:\Windows\System\fSnHXOH.exe
  C:\Windows\System\fSnHXOH.exe
  2⤵
  PID:5908
- C:\Windows\System\NaOnhEq.exe
  C:\Windows\System\NaOnhEq.exe
  2⤵
  PID:5948
- C:\Windows\System\rxDdyjd.exe
  C:\Windows\System\rxDdyjd.exe
  2⤵
  PID:5976
- C:\Windows\System\IqFjHgx.exe
  C:\Windows\System\IqFjHgx.exe
  2⤵
  PID:6004
- C:\Windows\System\NUESOqC.exe
  C:\Windows\System\NUESOqC.exe
  2⤵
  PID:6032
- C:\Windows\System\cepFJCb.exe
  C:\Windows\System\cepFJCb.exe
  2⤵
  PID:6060
- C:\Windows\System\wGcqtJw.exe
  C:\Windows\System\wGcqtJw.exe
  2⤵
  PID:6076
- C:\Windows\System\imUFljS.exe
  C:\Windows\System\imUFljS.exe
  2⤵
  PID:6112
- C:\Windows\System\PAWuehM.exe
  C:\Windows\System\PAWuehM.exe
  2⤵
  PID:2444
- C:\Windows\System\qJypSAC.exe
  C:\Windows\System\qJypSAC.exe
  2⤵
  PID:5180
- C:\Windows\System\mzKPfeU.exe
  C:\Windows\System\mzKPfeU.exe
  2⤵
  PID:5244
- C:\Windows\System\cbnecJY.exe
  C:\Windows\System\cbnecJY.exe
  2⤵
  PID:5300
- C:\Windows\System\GOaYPZo.exe
  C:\Windows\System\GOaYPZo.exe
  2⤵
  PID:5348
- C:\Windows\System\akvPWcy.exe
  C:\Windows\System\akvPWcy.exe
  2⤵
  PID:5388
- C:\Windows\System\PXEmrlt.exe
  C:\Windows\System\PXEmrlt.exe
  2⤵
  PID:5520
- C:\Windows\System\gVXVKVp.exe
  C:\Windows\System\gVXVKVp.exe
  2⤵
  PID:5544
- C:\Windows\System\eqhpWtH.exe
  C:\Windows\System\eqhpWtH.exe
  2⤵
  PID:5632
- C:\Windows\System\TKnxjOi.exe
  C:\Windows\System\TKnxjOi.exe
  2⤵
  PID:5708
- C:\Windows\System\NmyWQgZ.exe
  C:\Windows\System\NmyWQgZ.exe
  2⤵
  PID:5712
- C:\Windows\System\RpWpjPq.exe
  C:\Windows\System\RpWpjPq.exe
  2⤵
  PID:5820
- C:\Windows\System\EoyNqqK.exe
  C:\Windows\System\EoyNqqK.exe
  2⤵
  PID:5876
- C:\Windows\System\qTFozYF.exe
  C:\Windows\System\qTFozYF.exe
  2⤵
  PID:5932
- C:\Windows\System\dqNtzsb.exe
  C:\Windows\System\dqNtzsb.exe
  2⤵
  PID:6000
- C:\Windows\System\VinfPoZ.exe
  C:\Windows\System\VinfPoZ.exe
  2⤵
  PID:6068
- C:\Windows\System\ywVdJLf.exe
  C:\Windows\System\ywVdJLf.exe
  2⤵
  PID:5176
- C:\Windows\System\ZPvluNQ.exe
  C:\Windows\System\ZPvluNQ.exe
  2⤵
  PID:5316
- C:\Windows\System\GoLDXCc.exe
  C:\Windows\System\GoLDXCc.exe
  2⤵
  PID:5424
- C:\Windows\System\oDBVPqi.exe
  C:\Windows\System\oDBVPqi.exe
  2⤵
  PID:5548
- C:\Windows\System\GXNFqOi.exe
  C:\Windows\System\GXNFqOi.exe
  2⤵
  PID:5680
- C:\Windows\System\fDKAaFX.exe
  C:\Windows\System\fDKAaFX.exe
  2⤵
  PID:5840
- C:\Windows\System\lLLEiTc.exe
  C:\Windows\System\lLLEiTc.exe
  2⤵
  PID:5984
- C:\Windows\System\vYqOXRM.exe
  C:\Windows\System\vYqOXRM.exe
  2⤵
  PID:5260
- C:\Windows\System\sbxehxv.exe
  C:\Windows\System\sbxehxv.exe
  2⤵
  PID:5648
- C:\Windows\System\wvnCkKB.exe
  C:\Windows\System\wvnCkKB.exe
  2⤵
  PID:5836
- C:\Windows\System\YjwFcVi.exe
  C:\Windows\System\YjwFcVi.exe
  2⤵
  PID:6104
- C:\Windows\System\VzOoIRL.exe
  C:\Windows\System\VzOoIRL.exe
  2⤵
  PID:5276
- C:\Windows\System\RLmGODB.exe
  C:\Windows\System\RLmGODB.exe
  2⤵
  PID:6160
- C:\Windows\System\QPQCBMI.exe
  C:\Windows\System\QPQCBMI.exe
  2⤵
  PID:6184
- C:\Windows\System\LucCxSL.exe
  C:\Windows\System\LucCxSL.exe
  2⤵
  PID:6216
- C:\Windows\System\AvAYHHF.exe
  C:\Windows\System\AvAYHHF.exe
  2⤵
  PID:6244
- C:\Windows\System\tdzKviX.exe
  C:\Windows\System\tdzKviX.exe
  2⤵
  PID:6292
- C:\Windows\System\xOUXKip.exe
  C:\Windows\System\xOUXKip.exe
  2⤵
  PID:6320
- C:\Windows\System\ZZPVxfp.exe
  C:\Windows\System\ZZPVxfp.exe
  2⤵
  PID:6344
- C:\Windows\System\cXrxYDd.exe
  C:\Windows\System\cXrxYDd.exe
  2⤵
  PID:6364
- C:\Windows\System\wAYAWxD.exe
  C:\Windows\System\wAYAWxD.exe
  2⤵
  PID:6396
- C:\Windows\System\iGtMVib.exe
  C:\Windows\System\iGtMVib.exe
  2⤵
  PID:6424
- C:\Windows\System\TmGcaVO.exe
  C:\Windows\System\TmGcaVO.exe
  2⤵
  PID:6448
- C:\Windows\System\pvOBkAl.exe
  C:\Windows\System\pvOBkAl.exe
  2⤵
  PID:6480
- C:\Windows\System\EeDQLkL.exe
  C:\Windows\System\EeDQLkL.exe
  2⤵
  PID:6512
- C:\Windows\System\CpUHwjB.exe
  C:\Windows\System\CpUHwjB.exe
  2⤵
  PID:6536
- C:\Windows\System\QPEAWCi.exe
  C:\Windows\System\QPEAWCi.exe
  2⤵
  PID:6560
- C:\Windows\System\omkRNQK.exe
  C:\Windows\System\omkRNQK.exe
  2⤵
  PID:6580
- C:\Windows\System\sKoORjD.exe
  C:\Windows\System\sKoORjD.exe
  2⤵
  PID:6624
- C:\Windows\System\yGlfYVE.exe
  C:\Windows\System\yGlfYVE.exe
  2⤵
  PID:6648
- C:\Windows\System\PoJwdzz.exe
  C:\Windows\System\PoJwdzz.exe
  2⤵
  PID:6672
- C:\Windows\System\ixuRCQK.exe
  C:\Windows\System\ixuRCQK.exe
  2⤵
  PID:6708
- C:\Windows\System\tfHgbIX.exe
  C:\Windows\System\tfHgbIX.exe
  2⤵
  PID:6740
- C:\Windows\System\ksaxQQD.exe
  C:\Windows\System\ksaxQQD.exe
  2⤵
  PID:6756
- C:\Windows\System\bjVhvAJ.exe
  C:\Windows\System\bjVhvAJ.exe
  2⤵
  PID:6772
- C:\Windows\System\zkqqPbE.exe
  C:\Windows\System\zkqqPbE.exe
  2⤵
  PID:6792
- C:\Windows\System\kQIIgrm.exe
  C:\Windows\System\kQIIgrm.exe
  2⤵
  PID:6848
- C:\Windows\System\NklUJut.exe
  C:\Windows\System\NklUJut.exe
  2⤵
  PID:6884
- C:\Windows\System\vpIeRek.exe
  C:\Windows\System\vpIeRek.exe
  2⤵
  PID:6912
- C:\Windows\System\HomVvqp.exe
  C:\Windows\System\HomVvqp.exe
  2⤵
  PID:6928
- C:\Windows\System\ZuNzPAt.exe
  C:\Windows\System\ZuNzPAt.exe
  2⤵
  PID:6956
- C:\Windows\System\bIANrTR.exe
  C:\Windows\System\bIANrTR.exe
  2⤵
  PID:6984
- C:\Windows\System\DfAoUPx.exe
  C:\Windows\System\DfAoUPx.exe
  2⤵
  PID:7012
- C:\Windows\System\PyUAXhg.exe
  C:\Windows\System\PyUAXhg.exe
  2⤵
  PID:7040
- C:\Windows\System\QacCfXi.exe
  C:\Windows\System\QacCfXi.exe
  2⤵
  PID:7080
- C:\Windows\System\EBPlVpn.exe
  C:\Windows\System\EBPlVpn.exe
  2⤵
  PID:7108
- C:\Windows\System\JipGGUB.exe
  C:\Windows\System\JipGGUB.exe
  2⤵
  PID:7144
- C:\Windows\System\yTdhacU.exe
  C:\Windows\System\yTdhacU.exe
  2⤵
  PID:6024
- C:\Windows\System\eVcisBT.exe
  C:\Windows\System\eVcisBT.exe
  2⤵
  PID:6196
- C:\Windows\System\pIsafki.exe
  C:\Windows\System\pIsafki.exe
  2⤵
  PID:6240
- C:\Windows\System\mnUlqkg.exe
  C:\Windows\System\mnUlqkg.exe
  2⤵
  PID:6312
- C:\Windows\System\wAAqkME.exe
  C:\Windows\System\wAAqkME.exe
  2⤵
  PID:6376
- C:\Windows\System\UsLERez.exe
  C:\Windows\System\UsLERez.exe
  2⤵
  PID:6444
- C:\Windows\System\LOdwhzC.exe
  C:\Windows\System\LOdwhzC.exe
  2⤵
  PID:6508
- C:\Windows\System\wKTYyct.exe
  C:\Windows\System\wKTYyct.exe
  2⤵
  PID:6632
- C:\Windows\System\YnpahqR.exe
  C:\Windows\System\YnpahqR.exe
  2⤵
  PID:6724
- C:\Windows\System\kOTmSmO.exe
  C:\Windows\System\kOTmSmO.exe
  2⤵
  PID:6732
- C:\Windows\System\OuozXTg.exe
  C:\Windows\System\OuozXTg.exe
  2⤵
  PID:6872
- C:\Windows\System\PISgMtc.exe
  C:\Windows\System\PISgMtc.exe
  2⤵
  PID:6924
- C:\Windows\System\HGSrmse.exe
  C:\Windows\System\HGSrmse.exe
  2⤵
  PID:6968
- C:\Windows\System\ipiMzTE.exe
  C:\Windows\System\ipiMzTE.exe
  2⤵
  PID:7028
- C:\Windows\System\bcdeQTv.exe
  C:\Windows\System\bcdeQTv.exe
  2⤵
  PID:7120
- C:\Windows\System\DXQplSn.exe
  C:\Windows\System\DXQplSn.exe
  2⤵
  PID:7156
- C:\Windows\System\UcrgiGa.exe
  C:\Windows\System\UcrgiGa.exe
  2⤵
  PID:6332
- C:\Windows\System\KsbIWFa.exe
  C:\Windows\System\KsbIWFa.exe
  2⤵
  PID:6464
- C:\Windows\System\mPdceVD.exe
  C:\Windows\System\mPdceVD.exe
  2⤵
  PID:6600
- C:\Windows\System\AUVZiuk.exe
  C:\Windows\System\AUVZiuk.exe
  2⤵
  PID:6836
- C:\Windows\System\vIRhGQz.exe
  C:\Windows\System\vIRhGQz.exe
  2⤵
  PID:6948
- C:\Windows\System\GieLjXk.exe
  C:\Windows\System\GieLjXk.exe
  2⤵
  PID:6212
- C:\Windows\System\hYzQbNX.exe
  C:\Windows\System\hYzQbNX.exe
  2⤵
  PID:6568
- C:\Windows\System\MAyQAaw.exe
  C:\Windows\System\MAyQAaw.exe
  2⤵
  PID:6904
- C:\Windows\System\vPLkYZz.exe
  C:\Windows\System\vPLkYZz.exe
  2⤵
  PID:6492
- C:\Windows\System\ipaJCrl.exe
  C:\Windows\System\ipaJCrl.exe
  2⤵
  PID:7096
- C:\Windows\System\SFwHPZc.exe
  C:\Windows\System\SFwHPZc.exe
  2⤵
  PID:7176
- C:\Windows\System\iWOBUFe.exe
  C:\Windows\System\iWOBUFe.exe
  2⤵
  PID:7204
- C:\Windows\System\ebEmynX.exe
  C:\Windows\System\ebEmynX.exe
  2⤵
  PID:7228
- C:\Windows\System\YQYWtca.exe
  C:\Windows\System\YQYWtca.exe
  2⤵
  PID:7256
- C:\Windows\System\UUDcilf.exe
  C:\Windows\System\UUDcilf.exe
  2⤵
  PID:7276
- C:\Windows\System\YKLlLIU.exe
  C:\Windows\System\YKLlLIU.exe
  2⤵
  PID:7308
- C:\Windows\System\nJxMcrw.exe
  C:\Windows\System\nJxMcrw.exe
  2⤵
  PID:7340
- C:\Windows\System\NulakwX.exe
  C:\Windows\System\NulakwX.exe
  2⤵
  PID:7368
- C:\Windows\System\WibeCUS.exe
  C:\Windows\System\WibeCUS.exe
  2⤵
  PID:7392
- C:\Windows\System\JbDtNIz.exe
  C:\Windows\System\JbDtNIz.exe
  2⤵
  PID:7424
- C:\Windows\System\YBVoPVl.exe
  C:\Windows\System\YBVoPVl.exe
  2⤵
  PID:7440
- C:\Windows\System\oyCmkwf.exe
  C:\Windows\System\oyCmkwf.exe
  2⤵
  PID:7468
- C:\Windows\System\MlDCLWs.exe
  C:\Windows\System\MlDCLWs.exe
  2⤵
  PID:7496
- C:\Windows\System\PPywwCg.exe
  C:\Windows\System\PPywwCg.exe
  2⤵
  PID:7512
- C:\Windows\System\FNbOkBA.exe
  C:\Windows\System\FNbOkBA.exe
  2⤵
  PID:7544
- C:\Windows\System\NcjTrYh.exe
  C:\Windows\System\NcjTrYh.exe
  2⤵
  PID:7580
- C:\Windows\System\dIHtFYj.exe
  C:\Windows\System\dIHtFYj.exe
  2⤵
  PID:7612
- C:\Windows\System\UdlfgjW.exe
  C:\Windows\System\UdlfgjW.exe
  2⤵
  PID:7632
- C:\Windows\System\ULTgLOD.exe
  C:\Windows\System\ULTgLOD.exe
  2⤵
  PID:7664
- C:\Windows\System\fdIArQp.exe
  C:\Windows\System\fdIArQp.exe
  2⤵
  PID:7692
- C:\Windows\System\KNLvTCN.exe
  C:\Windows\System\KNLvTCN.exe
  2⤵
  PID:7716
- C:\Windows\System\lACcEVe.exe
  C:\Windows\System\lACcEVe.exe
  2⤵
  PID:7748
- C:\Windows\System\uYzwNjS.exe
  C:\Windows\System\uYzwNjS.exe
  2⤵
  PID:7800
- C:\Windows\System\erkfavq.exe
  C:\Windows\System\erkfavq.exe
  2⤵
  PID:7828
- C:\Windows\System\kplyLKs.exe
  C:\Windows\System\kplyLKs.exe
  2⤵
  PID:7844
- C:\Windows\System\FRJydQc.exe
  C:\Windows\System\FRJydQc.exe
  2⤵
  PID:7876
- C:\Windows\System\VfwcOTg.exe
  C:\Windows\System\VfwcOTg.exe
  2⤵
  PID:7904
- C:\Windows\System\ucKHkSi.exe
  C:\Windows\System\ucKHkSi.exe
  2⤵
  PID:7932
- C:\Windows\System\ItmdUIS.exe
  C:\Windows\System\ItmdUIS.exe
  2⤵
  PID:7956
- C:\Windows\System\ljgwCLq.exe
  C:\Windows\System\ljgwCLq.exe
  2⤵
  PID:7988
- C:\Windows\System\kyRehaI.exe
  C:\Windows\System\kyRehaI.exe
  2⤵
  PID:8016
- C:\Windows\System\HtrJINJ.exe
  C:\Windows\System\HtrJINJ.exe
  2⤵
  PID:8056
- C:\Windows\System\ONQlsZo.exe
  C:\Windows\System\ONQlsZo.exe
  2⤵
  PID:8084
- C:\Windows\System\WeRgKcq.exe
  C:\Windows\System\WeRgKcq.exe
  2⤵
  PID:8108
- C:\Windows\System\BiumXts.exe
  C:\Windows\System\BiumXts.exe
  2⤵
  PID:8156
- C:\Windows\System\sCSqbPf.exe
  C:\Windows\System\sCSqbPf.exe
  2⤵
  PID:8176
- C:\Windows\System\TEMRvRw.exe
  C:\Windows\System\TEMRvRw.exe
  2⤵
  PID:7192
- C:\Windows\System\TtOoMHW.exe
  C:\Windows\System\TtOoMHW.exe
  2⤵
  PID:7248
- C:\Windows\System\eSfrRGp.exe
  C:\Windows\System\eSfrRGp.exe
  2⤵
  PID:7304
- C:\Windows\System\iWuyzcH.exe
  C:\Windows\System\iWuyzcH.exe
  2⤵
  PID:7352
- C:\Windows\System\BZAHfvB.exe
  C:\Windows\System\BZAHfvB.exe
  2⤵
  PID:7436
- C:\Windows\System\hvFNuoe.exe
  C:\Windows\System\hvFNuoe.exe
  2⤵
  PID:7480
- C:\Windows\System\LgDjjif.exe
  C:\Windows\System\LgDjjif.exe
  2⤵
  PID:7536
- C:\Windows\System\bPmeGzd.exe
  C:\Windows\System\bPmeGzd.exe
  2⤵
  PID:7592
- C:\Windows\System\idDWphd.exe
  C:\Windows\System\idDWphd.exe
  2⤵
  PID:7704
- C:\Windows\System\OQMRzXt.exe
  C:\Windows\System\OQMRzXt.exe
  2⤵
  PID:7708
- C:\Windows\System\kQBXevQ.exe
  C:\Windows\System\kQBXevQ.exe
  2⤵
  PID:7816
- C:\Windows\System\sWpfiJK.exe
  C:\Windows\System\sWpfiJK.exe
  2⤵
  PID:7900
- C:\Windows\System\aTylpFi.exe
  C:\Windows\System\aTylpFi.exe
  2⤵
  PID:7952
- C:\Windows\System\vCXXMkY.exe
  C:\Windows\System\vCXXMkY.exe
  2⤵
  PID:8048
- C:\Windows\System\wwFuzrQ.exe
  C:\Windows\System\wwFuzrQ.exe
  2⤵
  PID:8100
- C:\Windows\System\hXwSGNp.exe
  C:\Windows\System\hXwSGNp.exe
  2⤵
  PID:8164
- C:\Windows\System\HdgwPgP.exe
  C:\Windows\System\HdgwPgP.exe
  2⤵
  PID:7244
- C:\Windows\System\qqIIJEu.exe
  C:\Windows\System\qqIIJEu.exe
  2⤵
  PID:7268
- C:\Windows\System\CUBklYI.exe
  C:\Windows\System\CUBklYI.exe
  2⤵
  PID:7532
- C:\Windows\System\EhgFziB.exe
  C:\Windows\System\EhgFziB.exe
  2⤵
  PID:7740
- C:\Windows\System\caMzFsa.exe
  C:\Windows\System\caMzFsa.exe
  2⤵
  PID:8032
- C:\Windows\System\mUaxRVe.exe
  C:\Windows\System\mUaxRVe.exe
  2⤵
  PID:8152
- C:\Windows\System\gRBPNsF.exe
  C:\Windows\System\gRBPNsF.exe
  2⤵
  PID:7572
- C:\Windows\System\bDAwOUC.exe
  C:\Windows\System\bDAwOUC.exe
  2⤵
  PID:7868
- C:\Windows\System\CqYpNMZ.exe
  C:\Windows\System\CqYpNMZ.exe
  2⤵
  PID:8200
- C:\Windows\System\ogObAFs.exe
  C:\Windows\System\ogObAFs.exe
  2⤵
  PID:8236
- C:\Windows\System\QZxZGRO.exe
  C:\Windows\System\QZxZGRO.exe
  2⤵
  PID:8252
- C:\Windows\System\TPNdnKr.exe
  C:\Windows\System\TPNdnKr.exe
  2⤵
  PID:8292
- C:\Windows\System\xVmfxrK.exe
  C:\Windows\System\xVmfxrK.exe
  2⤵
  PID:8324
- C:\Windows\System\iFXpAsg.exe
  C:\Windows\System\iFXpAsg.exe
  2⤵
  PID:8344
- C:\Windows\System\EjOExLE.exe
  C:\Windows\System\EjOExLE.exe
  2⤵
  PID:8392
- C:\Windows\System\kMIlawW.exe
  C:\Windows\System\kMIlawW.exe
  2⤵
  PID:8424
- C:\Windows\System\yNmvsYj.exe
  C:\Windows\System\yNmvsYj.exe
  2⤵
  PID:8448
- C:\Windows\System\GTXHrDt.exe
  C:\Windows\System\GTXHrDt.exe
  2⤵
  PID:8484
- C:\Windows\System\FNEIKqQ.exe
  C:\Windows\System\FNEIKqQ.exe
  2⤵
  PID:8504
- C:\Windows\System\XbzzRkY.exe
  C:\Windows\System\XbzzRkY.exe
  2⤵
  PID:8524
- C:\Windows\System\soIByif.exe
  C:\Windows\System\soIByif.exe
  2⤵
  PID:8548
- C:\Windows\System\ahCXhvI.exe
  C:\Windows\System\ahCXhvI.exe
  2⤵
  PID:8572
- C:\Windows\System\qYbnziC.exe
  C:\Windows\System\qYbnziC.exe
  2⤵
  PID:8620
- C:\Windows\System\pziuofP.exe
  C:\Windows\System\pziuofP.exe
  2⤵
  PID:8644
- C:\Windows\System\hkFNFkY.exe
  C:\Windows\System\hkFNFkY.exe
  2⤵
  PID:8672
- C:\Windows\System\rJAbMcu.exe
  C:\Windows\System\rJAbMcu.exe
  2⤵
  PID:8692
- C:\Windows\System\RhSaauw.exe
  C:\Windows\System\RhSaauw.exe
  2⤵
  PID:8720
- C:\Windows\System\MyHbPuI.exe
  C:\Windows\System\MyHbPuI.exe
  2⤵
  PID:8756
- C:\Windows\System\ZYkWJKA.exe
  C:\Windows\System\ZYkWJKA.exe
  2⤵
  PID:8796
- C:\Windows\System\ynAvXUH.exe
  C:\Windows\System\ynAvXUH.exe
  2⤵
  PID:8824
- C:\Windows\System\XwmUWSt.exe
  C:\Windows\System\XwmUWSt.exe
  2⤵
  PID:8848
- C:\Windows\System\GboGMFe.exe
  C:\Windows\System\GboGMFe.exe
  2⤵
  PID:8868
- C:\Windows\System\ZsUoFes.exe
  C:\Windows\System\ZsUoFes.exe
  2⤵
  PID:8900
- C:\Windows\System\oedaSfW.exe
  C:\Windows\System\oedaSfW.exe
  2⤵
  PID:8932
- C:\Windows\System\DZBpCvJ.exe
  C:\Windows\System\DZBpCvJ.exe
  2⤵
  PID:8964
- C:\Windows\System\eAlYNdj.exe
  C:\Windows\System\eAlYNdj.exe
  2⤵
  PID:9036
- C:\Windows\System\IxdauMh.exe
  C:\Windows\System\IxdauMh.exe
  2⤵
  PID:9092
- C:\Windows\System\WzMcVyR.exe
  C:\Windows\System\WzMcVyR.exe
  2⤵
  PID:9112
- C:\Windows\System\xCpYlWu.exe
  C:\Windows\System\xCpYlWu.exe
  2⤵
  PID:9132
- C:\Windows\System\teFhTtm.exe
  C:\Windows\System\teFhTtm.exe
  2⤵
  PID:9164
- C:\Windows\System\evfjNkB.exe
  C:\Windows\System\evfjNkB.exe
  2⤵
  PID:9188
- C:\Windows\System\bDxpxJT.exe
  C:\Windows\System\bDxpxJT.exe
  2⤵
  PID:9208
- C:\Windows\System\NTTztmS.exe
  C:\Windows\System\NTTztmS.exe
  2⤵
  PID:8208
- C:\Windows\System\TZlnKHf.exe
  C:\Windows\System\TZlnKHf.exe
  2⤵
  PID:8332
- C:\Windows\System\BsOBrsn.exe
  C:\Windows\System\BsOBrsn.exe
  2⤵
  PID:8376
- C:\Windows\System\TpStEgQ.exe
  C:\Windows\System\TpStEgQ.exe
  2⤵
  PID:8496
- C:\Windows\System\xWIZACq.exe
  C:\Windows\System\xWIZACq.exe
  2⤵
  PID:8568
- C:\Windows\System\ogpkhbn.exe
  C:\Windows\System\ogpkhbn.exe
  2⤵
  PID:8608
- C:\Windows\System\pbJbZQX.exe
  C:\Windows\System\pbJbZQX.exe
  2⤵
  PID:8640
- C:\Windows\System\lhaNOGK.exe
  C:\Windows\System\lhaNOGK.exe
  2⤵
  PID:8784
- C:\Windows\System\cfmAXoj.exe
  C:\Windows\System\cfmAXoj.exe
  2⤵
  PID:8816
- C:\Windows\System\mMQUqGp.exe
  C:\Windows\System\mMQUqGp.exe
  2⤵
  PID:8856
- C:\Windows\System\VIKjKfs.exe
  C:\Windows\System\VIKjKfs.exe
  2⤵
  PID:8944
- C:\Windows\System\WHGhaqp.exe
  C:\Windows\System\WHGhaqp.exe
  2⤵
  PID:9048
- C:\Windows\System\ctzVAFD.exe
  C:\Windows\System\ctzVAFD.exe
  2⤵
  PID:9160
- C:\Windows\System\uFugFIH.exe
  C:\Windows\System\uFugFIH.exe
  2⤵
  PID:8272
- C:\Windows\System\UoFmpgd.exe
  C:\Windows\System\UoFmpgd.exe
  2⤵
  PID:8300
- C:\Windows\System\hXCSnvx.exe
  C:\Windows\System\hXCSnvx.exe
  2⤵
  PID:8664
- C:\Windows\System\QfrOycw.exe
  C:\Windows\System\QfrOycw.exe
  2⤵
  PID:8748
- C:\Windows\System\SSDqnqg.exe
  C:\Windows\System\SSDqnqg.exe
  2⤵
  PID:8888
- C:\Windows\System\OemtyLT.exe
  C:\Windows\System\OemtyLT.exe
  2⤵
  PID:9032
- C:\Windows\System\WoafNZq.exe
  C:\Windows\System\WoafNZq.exe
  2⤵
  PID:7860
- C:\Windows\System\MRsXcgz.exe
  C:\Windows\System\MRsXcgz.exe
  2⤵
  PID:8716
- C:\Windows\System\tkIjcWC.exe
  C:\Windows\System\tkIjcWC.exe
  2⤵
  PID:9148
- C:\Windows\System\WujwSbI.exe
  C:\Windows\System\WujwSbI.exe
  2⤵
  PID:8372
- C:\Windows\System\JXyeUKV.exe
  C:\Windows\System\JXyeUKV.exe
  2⤵
  PID:9232
- C:\Windows\System\KrAXxeF.exe
  C:\Windows\System\KrAXxeF.exe
  2⤵
  PID:9260
- C:\Windows\System\VFoGscH.exe
  C:\Windows\System\VFoGscH.exe
  2⤵
  PID:9288
- C:\Windows\System\bCVIWkt.exe
  C:\Windows\System\bCVIWkt.exe
  2⤵
  PID:9316
- C:\Windows\System\BwvlQut.exe
  C:\Windows\System\BwvlQut.exe
  2⤵
  PID:9344
- C:\Windows\System\siBpkWG.exe
  C:\Windows\System\siBpkWG.exe
  2⤵
  PID:9372
- C:\Windows\System\pWMHlJw.exe
  C:\Windows\System\pWMHlJw.exe
  2⤵
  PID:9400
- C:\Windows\System\VAtgDdJ.exe
  C:\Windows\System\VAtgDdJ.exe
  2⤵
  PID:9428
- C:\Windows\System\NdsBjBv.exe
  C:\Windows\System\NdsBjBv.exe
  2⤵
  PID:9456
- C:\Windows\System\eYdlMJg.exe
  C:\Windows\System\eYdlMJg.exe
  2⤵
  PID:9484
- C:\Windows\System\KNdqdUs.exe
  C:\Windows\System\KNdqdUs.exe
  2⤵
  PID:9512
- C:\Windows\System\VvPDBON.exe
  C:\Windows\System\VvPDBON.exe
  2⤵
  PID:9540
- C:\Windows\System\VILyhxf.exe
  C:\Windows\System\VILyhxf.exe
  2⤵
  PID:9564
- C:\Windows\System\anzUgqL.exe
  C:\Windows\System\anzUgqL.exe
  2⤵
  PID:9584
- C:\Windows\System\FNGrCli.exe
  C:\Windows\System\FNGrCli.exe
  2⤵
  PID:9616
- C:\Windows\System\XeNruOp.exe
  C:\Windows\System\XeNruOp.exe
  2⤵
  PID:9640
- C:\Windows\System\MXxHWTt.exe
  C:\Windows\System\MXxHWTt.exe
  2⤵
  PID:9668
- C:\Windows\System\djZjMii.exe
  C:\Windows\System\djZjMii.exe
  2⤵
  PID:9708
- C:\Windows\System\EQhOTaH.exe
  C:\Windows\System\EQhOTaH.exe
  2⤵
  PID:9736
- C:\Windows\System\jwiuoov.exe
  C:\Windows\System\jwiuoov.exe
  2⤵
  PID:9764
- C:\Windows\System\zjdWuMV.exe
  C:\Windows\System\zjdWuMV.exe
  2⤵
  PID:9792
- C:\Windows\System\KjsAocN.exe
  C:\Windows\System\KjsAocN.exe
  2⤵
  PID:9808
- C:\Windows\System\mavyeqH.exe
  C:\Windows\System\mavyeqH.exe
  2⤵
  PID:9836
- C:\Windows\System\QXbRrlY.exe
  C:\Windows\System\QXbRrlY.exe
  2⤵
  PID:9852
- C:\Windows\System\oufZABn.exe
  C:\Windows\System\oufZABn.exe
  2⤵
  PID:9884
- C:\Windows\System\SHTBbTn.exe
  C:\Windows\System\SHTBbTn.exe
  2⤵
  PID:9908
- C:\Windows\System\CAOpMXp.exe
  C:\Windows\System\CAOpMXp.exe
  2⤵
  PID:9932
- C:\Windows\System\KfnaXfO.exe
  C:\Windows\System\KfnaXfO.exe
  2⤵
  PID:9956
- C:\Windows\System\ORgUayW.exe
  C:\Windows\System\ORgUayW.exe
  2⤵
  PID:9980
- C:\Windows\System\keBBJEK.exe
  C:\Windows\System\keBBJEK.exe
  2⤵
  PID:10020
- C:\Windows\System\OaKmTbv.exe
  C:\Windows\System\OaKmTbv.exe
  2⤵
  PID:10044
- C:\Windows\System\HgtnpYE.exe
  C:\Windows\System\HgtnpYE.exe
  2⤵
  PID:10084
- C:\Windows\System\MaGAShF.exe
  C:\Windows\System\MaGAShF.exe
  2⤵
  PID:10108
- C:\Windows\System\xlduinz.exe
  C:\Windows\System\xlduinz.exe
  2⤵
  PID:10140
- C:\Windows\System\dQmSpcV.exe
  C:\Windows\System\dQmSpcV.exe
  2⤵
  PID:10164
- C:\Windows\System\FKGRumB.exe
  C:\Windows\System\FKGRumB.exe
  2⤵
  PID:10192
- C:\Windows\System\FyLDIhL.exe
  C:\Windows\System\FyLDIhL.exe
  2⤵
  PID:10216
- C:\Windows\System\UVntBgN.exe
  C:\Windows\System\UVntBgN.exe
  2⤵
  PID:9220
- C:\Windows\System\JrJfAUJ.exe
  C:\Windows\System\JrJfAUJ.exe
  2⤵
  PID:9328
- C:\Windows\System\fdjGpqx.exe
  C:\Windows\System\fdjGpqx.exe
  2⤵
  PID:9420
- C:\Windows\System\WxzEnGM.exe
  C:\Windows\System\WxzEnGM.exe
  2⤵
  PID:9476
- C:\Windows\System\TVGnUCM.exe
  C:\Windows\System\TVGnUCM.exe
  2⤵
  PID:9556
- C:\Windows\System\VlGHYky.exe
  C:\Windows\System\VlGHYky.exe
  2⤵
  PID:9600
- C:\Windows\System\ZlhIFTN.exe
  C:\Windows\System\ZlhIFTN.exe
  2⤵
  PID:9656
- C:\Windows\System\EEPHIak.exe
  C:\Windows\System\EEPHIak.exe
  2⤵
  PID:9700
- C:\Windows\System\zzpVaWG.exe
  C:\Windows\System\zzpVaWG.exe
  2⤵
  PID:9776
- C:\Windows\System\qxdpmcf.exe
  C:\Windows\System\qxdpmcf.exe
  2⤵
  PID:9824
- C:\Windows\System\tyGlLgk.exe
  C:\Windows\System\tyGlLgk.exe
  2⤵
  PID:9868
- C:\Windows\System\EkviOFW.exe
  C:\Windows\System\EkviOFW.exe
  2⤵
  PID:9940
- C:\Windows\System\NeUZQeL.exe
  C:\Windows\System\NeUZQeL.exe
  2⤵
  PID:10040
- C:\Windows\System\AxaMOZZ.exe
  C:\Windows\System\AxaMOZZ.exe
  2⤵
  PID:10128
- C:\Windows\System\GhNOMPK.exe
  C:\Windows\System\GhNOMPK.exe
  2⤵
  PID:10172
- C:\Windows\System\GXfCrXB.exe
  C:\Windows\System\GXfCrXB.exe
  2⤵
  PID:10204
- C:\Windows\System\cryghXY.exe
  C:\Windows\System\cryghXY.exe
  2⤵
  PID:9332
- C:\Windows\System\KBoqDaw.exe
  C:\Windows\System\KBoqDaw.exe
  2⤵
  PID:9472
- C:\Windows\System\YfqqeGe.exe
  C:\Windows\System\YfqqeGe.exe
  2⤵
  PID:9572
- C:\Windows\System\gVuFCek.exe
  C:\Windows\System\gVuFCek.exe
  2⤵
  PID:9704
- C:\Windows\System\dMedIqm.exe
  C:\Windows\System\dMedIqm.exe
  2⤵
  PID:9864
- C:\Windows\System\vWwqIVA.exe
  C:\Windows\System\vWwqIVA.exe
  2⤵
  PID:10032
- C:\Windows\System\zwYNaoY.exe
  C:\Windows\System\zwYNaoY.exe
  2⤵
  PID:10160
- C:\Windows\System\ACSICNm.exe
  C:\Windows\System\ACSICNm.exe
  2⤵
  PID:9248
- C:\Windows\System\uOGYmvc.exe
  C:\Windows\System\uOGYmvc.exe
  2⤵
  PID:9992
- C:\Windows\System\ZvlPRkD.exe
  C:\Windows\System\ZvlPRkD.exe
  2⤵
  PID:10068
- C:\Windows\System\rYBlaMf.exe
  C:\Windows\System\rYBlaMf.exe
  2⤵
  PID:9876
- C:\Windows\System\RvRXyBw.exe
  C:\Windows\System\RvRXyBw.exe
  2⤵
  PID:9924
- C:\Windows\System\mHJyBwF.exe
  C:\Windows\System\mHJyBwF.exe
  2⤵
  PID:10280
- C:\Windows\System\RhloXhe.exe
  C:\Windows\System\RhloXhe.exe
  2⤵
  PID:10304
- C:\Windows\System\Wpotawf.exe
  C:\Windows\System\Wpotawf.exe
  2⤵
  PID:10328
- C:\Windows\System\MogvRof.exe
  C:\Windows\System\MogvRof.exe
  2⤵
  PID:10352
- C:\Windows\System\ajUQouU.exe
  C:\Windows\System\ajUQouU.exe
  2⤵
  PID:10388
- C:\Windows\System\bYJqJCd.exe
  C:\Windows\System\bYJqJCd.exe
  2⤵
  PID:10408
- C:\Windows\System\YqtcLQq.exe
  C:\Windows\System\YqtcLQq.exe
  2⤵
  PID:10436
- C:\Windows\System\TgbDwYm.exe
  C:\Windows\System\TgbDwYm.exe
  2⤵
  PID:10464
- C:\Windows\System\EmXxsSC.exe
  C:\Windows\System\EmXxsSC.exe
  2⤵
  PID:10492
- C:\Windows\System\MnQFQEm.exe
  C:\Windows\System\MnQFQEm.exe
  2⤵
  PID:10512
- C:\Windows\System\tPtVxBf.exe
  C:\Windows\System\tPtVxBf.exe
  2⤵
  PID:10540
- C:\Windows\System\PTYhbjA.exe
  C:\Windows\System\PTYhbjA.exe
  2⤵
  PID:10576
- C:\Windows\System\aARVkfP.exe
  C:\Windows\System\aARVkfP.exe
  2⤵
  PID:10600
- C:\Windows\System\aAOoYlF.exe
  C:\Windows\System\aAOoYlF.exe
  2⤵
  PID:10624
- C:\Windows\System\fDUMZmg.exe
  C:\Windows\System\fDUMZmg.exe
  2⤵
  PID:10644
- C:\Windows\System\wxxvLuR.exe
  C:\Windows\System\wxxvLuR.exe
  2⤵
  PID:10700
- C:\Windows\System\lTLdAqJ.exe
  C:\Windows\System\lTLdAqJ.exe
  2⤵
  PID:10728
- C:\Windows\System\zeqSNKj.exe
  C:\Windows\System\zeqSNKj.exe
  2⤵
  PID:10752
- C:\Windows\System\zCaLxqL.exe
  C:\Windows\System\zCaLxqL.exe
  2⤵
  PID:10772
- C:\Windows\System\OyAivbt.exe
  C:\Windows\System\OyAivbt.exe
  2⤵
  PID:10800
- C:\Windows\System\hftyVRp.exe
  C:\Windows\System\hftyVRp.exe
  2⤵
  PID:10828
- C:\Windows\System\NvSwoiS.exe
  C:\Windows\System\NvSwoiS.exe
  2⤵
  PID:10868
- C:\Windows\System\aKoincr.exe
  C:\Windows\System\aKoincr.exe
  2⤵
  PID:10896
- C:\Windows\System\KxrWCCg.exe
  C:\Windows\System\KxrWCCg.exe
  2⤵
  PID:10920
- C:\Windows\System\fLlfXAi.exe
  C:\Windows\System\fLlfXAi.exe
  2⤵
  PID:10952
- C:\Windows\System\eyRfSVX.exe
  C:\Windows\System\eyRfSVX.exe
  2⤵
  PID:10968
- C:\Windows\System\LvoFslv.exe
  C:\Windows\System\LvoFslv.exe
  2⤵
  PID:10996
- C:\Windows\System\VDvtlWy.exe
  C:\Windows\System\VDvtlWy.exe
  2⤵
  PID:11032
- C:\Windows\System\vHfHSIf.exe
  C:\Windows\System\vHfHSIf.exe
  2⤵
  PID:11064
- C:\Windows\System\jYCmFwX.exe
  C:\Windows\System\jYCmFwX.exe
  2⤵
  PID:11080
- C:\Windows\System\gvtOBtC.exe
  C:\Windows\System\gvtOBtC.exe
  2⤵
  PID:11096
- C:\Windows\System\gNEJhIv.exe
  C:\Windows\System\gNEJhIv.exe
  2⤵
  PID:11136
- C:\Windows\System\TmHeFLq.exe
  C:\Windows\System\TmHeFLq.exe
  2⤵
  PID:11180
- C:\Windows\System\OYOBBih.exe
  C:\Windows\System\OYOBBih.exe
  2⤵
  PID:11208
- C:\Windows\System\CeCoCwS.exe
  C:\Windows\System\CeCoCwS.exe
  2⤵
  PID:11232
- C:\Windows\System\WIhYZvP.exe
  C:\Windows\System\WIhYZvP.exe
  2⤵
  PID:11260
- C:\Windows\System\iUTfpPe.exe
  C:\Windows\System\iUTfpPe.exe
  2⤵
  PID:10296
- C:\Windows\System\xVAvAIY.exe
  C:\Windows\System\xVAvAIY.exe
  2⤵
  PID:10344
- C:\Windows\System\jnrSjaP.exe
  C:\Windows\System\jnrSjaP.exe
  2⤵
  PID:10424
- C:\Windows\System\euHnorF.exe
  C:\Windows\System\euHnorF.exe
  2⤵
  PID:10500
- C:\Windows\System\yySitLS.exe
  C:\Windows\System\yySitLS.exe
  2⤵
  PID:10616
- C:\Windows\System\uCvonvH.exe
  C:\Windows\System\uCvonvH.exe
  2⤵
  PID:10640
- C:\Windows\System\NFeidey.exe
  C:\Windows\System\NFeidey.exe
  2⤵
  PID:10764
- C:\Windows\System\aPPiQOi.exe
  C:\Windows\System\aPPiQOi.exe
  2⤵
  PID:10816
- C:\Windows\System\hfavoUX.exe
  C:\Windows\System\hfavoUX.exe
  2⤵
  PID:10884
- C:\Windows\System\nzgCSZa.exe
  C:\Windows\System\nzgCSZa.exe
  2⤵
  PID:10916
- C:\Windows\System\gCStXDq.exe
  C:\Windows\System\gCStXDq.exe
  2⤵
  PID:10984
- C:\Windows\System\bNZRNdJ.exe
  C:\Windows\System\bNZRNdJ.exe
  2⤵
  PID:11072
- C:\Windows\System\QrPJIsj.exe
  C:\Windows\System\QrPJIsj.exe
  2⤵
  PID:11132
- C:\Windows\System\NPvszGa.exe
  C:\Windows\System\NPvszGa.exe
  2⤵
  PID:11200
- C:\Windows\System\IomYYYc.exe
  C:\Windows\System\IomYYYc.exe
  2⤵
  PID:11248
- C:\Windows\System\kHXlVNs.exe
  C:\Windows\System\kHXlVNs.exe
  2⤵
  PID:10312
- C:\Windows\System\KsBYOPf.exe
  C:\Windows\System\KsBYOPf.exe
  2⤵
  PID:10532
- C:\Windows\System\evAGMXB.exe
  C:\Windows\System\evAGMXB.exe
  2⤵
  PID:10712
- C:\Windows\System\vqjAsOi.exe
  C:\Windows\System\vqjAsOi.exe
  2⤵
  PID:10908
- C:\Windows\System\UZzMTuf.exe
  C:\Windows\System\UZzMTuf.exe
  2⤵
  PID:11028
- C:\Windows\System\Pczzpfh.exe
  C:\Windows\System\Pczzpfh.exe
  2⤵
  PID:11168
- C:\Windows\System\HWRsCPF.exe
  C:\Windows\System\HWRsCPF.exe
  2⤵
  PID:10472
- C:\Windows\System\hAHgEOR.exe
  C:\Windows\System\hAHgEOR.exe
  2⤵
  PID:10768
- C:\Windows\System\hspnwyX.exe
  C:\Windows\System\hspnwyX.exe
  2⤵
  PID:11092
- C:\Windows\System\XQEbMcr.exe
  C:\Windows\System\XQEbMcr.exe
  2⤵
  PID:11020
- C:\Windows\System\qsfzIBP.exe
  C:\Windows\System\qsfzIBP.exe
  2⤵
  PID:11272
- C:\Windows\System\SlzDyDY.exe
  C:\Windows\System\SlzDyDY.exe
  2⤵
  PID:11312
- C:\Windows\System\agWsXPv.exe
  C:\Windows\System\agWsXPv.exe
  2⤵
  PID:11352
- C:\Windows\System\ymLvfCN.exe
  C:\Windows\System\ymLvfCN.exe
  2⤵
  PID:11368
- C:\Windows\System\biFUhQn.exe
  C:\Windows\System\biFUhQn.exe
  2⤵
  PID:11392
- C:\Windows\System\aesVNBd.exe
  C:\Windows\System\aesVNBd.exe
  2⤵
  PID:11436
- C:\Windows\System\xtkeBJx.exe
  C:\Windows\System\xtkeBJx.exe
  2⤵
  PID:11452
- C:\Windows\System\LVONttz.exe
  C:\Windows\System\LVONttz.exe
  2⤵
  PID:11468
- C:\Windows\System\FfYkdwO.exe
  C:\Windows\System\FfYkdwO.exe
  2⤵
  PID:11484
- C:\Windows\System\UtZtqWg.exe
  C:\Windows\System\UtZtqWg.exe
  2⤵
  PID:11516
- C:\Windows\System\dqcrgoF.exe
  C:\Windows\System\dqcrgoF.exe
  2⤵
  PID:11576
- C:\Windows\System\rqGHPSD.exe
  C:\Windows\System\rqGHPSD.exe
  2⤵
  PID:11592
- C:\Windows\System\wBPITep.exe
  C:\Windows\System\wBPITep.exe
  2⤵
  PID:11612
- C:\Windows\System\iRJXzwE.exe
  C:\Windows\System\iRJXzwE.exe
  2⤵
  PID:11644
- C:\Windows\System\vygFdIL.exe
  C:\Windows\System\vygFdIL.exe
  2⤵
  PID:11676
- C:\Windows\System\ogFXdVN.exe
  C:\Windows\System\ogFXdVN.exe
  2⤵
  PID:11704
- C:\Windows\System\wajcVeN.exe
  C:\Windows\System\wajcVeN.exe
  2⤵
  PID:11740
- C:\Windows\System\tFybBYR.exe
  C:\Windows\System\tFybBYR.exe
  2⤵
  PID:11772
- C:\Windows\System\nxbLjVI.exe
  C:\Windows\System\nxbLjVI.exe
  2⤵
  PID:11800
- C:\Windows\System\mpLvfOj.exe
  C:\Windows\System\mpLvfOj.exe
  2⤵
  PID:11828
- C:\Windows\System\lrraYRS.exe
  C:\Windows\System\lrraYRS.exe
  2⤵
  PID:11852
- C:\Windows\System\HPAiEob.exe
  C:\Windows\System\HPAiEob.exe
  2⤵
  PID:11884
- C:\Windows\System\EEqLJFK.exe
  C:\Windows\System\EEqLJFK.exe
  2⤵
  PID:11912
- C:\Windows\System\PmxIjcD.exe
  C:\Windows\System\PmxIjcD.exe
  2⤵
  PID:11948
- C:\Windows\System\jijOIpt.exe
  C:\Windows\System\jijOIpt.exe
  2⤵
  PID:11976
- C:\Windows\System\WBZEaEX.exe
  C:\Windows\System\WBZEaEX.exe
  2⤵
  PID:11992
- C:\Windows\System\kOiPeUQ.exe
  C:\Windows\System\kOiPeUQ.exe
  2⤵
  PID:12020
- C:\Windows\System\RtAQSaw.exe
  C:\Windows\System\RtAQSaw.exe
  2⤵
  PID:12056
- C:\Windows\System\FdwrsOf.exe
  C:\Windows\System\FdwrsOf.exe
  2⤵
  PID:12080
- C:\Windows\System\lWCoHHv.exe
  C:\Windows\System\lWCoHHv.exe
  2⤵
  PID:12108
- C:\Windows\System\HJKgWVc.exe
  C:\Windows\System\HJKgWVc.exe
  2⤵
  PID:12132
- C:\Windows\System\WFVnCnT.exe
  C:\Windows\System\WFVnCnT.exe
  2⤵
  PID:12160
- C:\Windows\System\gUQxaif.exe
  C:\Windows\System\gUQxaif.exe
  2⤵
  PID:12204
- C:\Windows\System\PPFnqvu.exe
  C:\Windows\System\PPFnqvu.exe
  2⤵
  PID:12232
- C:\Windows\System\ldUgnqK.exe
  C:\Windows\System\ldUgnqK.exe
  2⤵
  PID:12260
- C:\Windows\System\yuOVHTg.exe
  C:\Windows\System\yuOVHTg.exe
  2⤵
  PID:10792
- C:\Windows\System\ttKhXaj.exe
  C:\Windows\System\ttKhXaj.exe
  2⤵
  PID:11284
- C:\Windows\System\xcHxkGx.exe
  C:\Windows\System\xcHxkGx.exe
  2⤵
  PID:11340
- C:\Windows\System\niPZOvp.exe
  C:\Windows\System\niPZOvp.exe
  2⤵
  PID:11428
- C:\Windows\System\KIMeyAM.exe
  C:\Windows\System\KIMeyAM.exe
  2⤵
  PID:11480
- C:\Windows\System\aOoLjHf.exe
  C:\Windows\System\aOoLjHf.exe
  2⤵
  PID:11568
- C:\Windows\System\hGLwJwK.exe
  C:\Windows\System\hGLwJwK.exe
  2⤵
  PID:11640
- C:\Windows\System\CgNqLRK.exe
  C:\Windows\System\CgNqLRK.exe
  2⤵
  PID:11696
- C:\Windows\System\dVEwFTT.exe
  C:\Windows\System\dVEwFTT.exe
  2⤵
  PID:11768
- C:\Windows\System\yGjuLgB.exe
  C:\Windows\System\yGjuLgB.exe
  2⤵
  PID:11824
- C:\Windows\System\aGYTQhc.exe
  C:\Windows\System\aGYTQhc.exe
  2⤵
  PID:11876
- C:\Windows\System\UuGiwcO.exe
  C:\Windows\System\UuGiwcO.exe
  2⤵
  PID:11960
- C:\Windows\System\hYXtvoW.exe
  C:\Windows\System\hYXtvoW.exe
  2⤵
  PID:12052
- C:\Windows\System\yIcCINt.exe
  C:\Windows\System\yIcCINt.exe
  2⤵
  PID:12116
- C:\Windows\System\KJSGzEO.exe
  C:\Windows\System\KJSGzEO.exe
  2⤵
  PID:12148
- C:\Windows\System\oweAqIE.exe
  C:\Windows\System\oweAqIE.exe
  2⤵
  PID:12224
- C:\Windows\System\jWTfyGz.exe
  C:\Windows\System\jWTfyGz.exe
  2⤵
  PID:12276
- C:\Windows\System\YMHxoiR.exe
  C:\Windows\System\YMHxoiR.exe
  2⤵
  PID:11432
- C:\Windows\System\yeUNbYt.exe
  C:\Windows\System\yeUNbYt.exe
  2⤵
  PID:11512
- C:\Windows\System\lILdnqM.exe
  C:\Windows\System\lILdnqM.exe
  2⤵
  PID:11636
- C:\Windows\System\rZDKoFg.exe
  C:\Windows\System\rZDKoFg.exe
  2⤵
  PID:11732
- C:\Windows\System\UTllPNu.exe
  C:\Windows\System\UTllPNu.exe
  2⤵
  PID:11984
- C:\Windows\System\dqQHGoC.exe
  C:\Windows\System\dqQHGoC.exe
  2⤵
  PID:12016
- C:\Windows\System\lbHyTFx.exe
  C:\Windows\System\lbHyTFx.exe
  2⤵
  PID:12272
- C:\Windows\System\NJxANov.exe
  C:\Windows\System\NJxANov.exe
  2⤵
  PID:11668
- C:\Windows\System\pWRedeA.exe
  C:\Windows\System\pWRedeA.exe
  2⤵
  PID:12244
- C:\Windows\System\LKEeRod.exe
  C:\Windows\System\LKEeRod.exe
  2⤵
  PID:11384
- C:\Windows\System\AinCjey.exe
  C:\Windows\System\AinCjey.exe
  2⤵
  PID:11792
- C:\Windows\System\XhpDLIf.exe
  C:\Windows\System\XhpDLIf.exe
  2⤵
  PID:12312
- C:\Windows\System\EvsZWDn.exe
  C:\Windows\System\EvsZWDn.exe
  2⤵
  PID:12352
- C:\Windows\System\NzJqbAW.exe
  C:\Windows\System\NzJqbAW.exe
  2⤵
  PID:12380
- C:\Windows\System\bYFvWxZ.exe
  C:\Windows\System\bYFvWxZ.exe
  2⤵
  PID:12396
- C:\Windows\System\zTbAssp.exe
  C:\Windows\System\zTbAssp.exe
  2⤵
  PID:12424
- C:\Windows\System\wKERhFh.exe
  C:\Windows\System\wKERhFh.exe
  2⤵
  PID:12448
- C:\Windows\System\foygThy.exe
  C:\Windows\System\foygThy.exe
  2⤵
  PID:12480
- C:\Windows\System\QVQmzQG.exe
  C:\Windows\System\QVQmzQG.exe
  2⤵
  PID:12508
- C:\Windows\System\XGFLyFB.exe
  C:\Windows\System\XGFLyFB.exe
  2⤵
  PID:12536
- C:\Windows\System\xNpOPCf.exe
  C:\Windows\System\xNpOPCf.exe
  2⤵
  PID:12564
- C:\Windows\System\UfAvfhs.exe
  C:\Windows\System\UfAvfhs.exe
  2⤵
  PID:12604
- C:\Windows\System\jpfLboz.exe
  C:\Windows\System\jpfLboz.exe
  2⤵
  PID:12632
- C:\Windows\System\DfrhYqM.exe
  C:\Windows\System\DfrhYqM.exe
  2⤵
  PID:12660
- C:\Windows\System\rctljOj.exe
  C:\Windows\System\rctljOj.exe
  2⤵
  PID:12688
- C:\Windows\System\bmeXHnd.exe
  C:\Windows\System\bmeXHnd.exe
  2⤵
  PID:12716
- C:\Windows\System\RRDCAXT.exe
  C:\Windows\System\RRDCAXT.exe
  2⤵
  PID:12744
- C:\Windows\System\mZOmmGN.exe
  C:\Windows\System\mZOmmGN.exe
  2⤵
  PID:12764
- C:\Windows\System\jJKrgbf.exe
  C:\Windows\System\jJKrgbf.exe
  2⤵
  PID:12800
- C:\Windows\System\SKbOpDk.exe
  C:\Windows\System\SKbOpDk.exe
  2⤵
  PID:12828
- C:\Windows\System\AnmhulH.exe
  C:\Windows\System\AnmhulH.exe
  2⤵
  PID:12856
- C:\Windows\System\LSUDUXB.exe
  C:\Windows\System\LSUDUXB.exe
  2⤵
  PID:12884
- C:\Windows\System\KxggUxV.exe
  C:\Windows\System\KxggUxV.exe
  2⤵
  PID:12912
- C:\Windows\System\jVbxWPT.exe
  C:\Windows\System\jVbxWPT.exe
  2⤵
  PID:12932
- C:\Windows\System\UrDdQMR.exe
  C:\Windows\System\UrDdQMR.exe
  2⤵
  PID:12964
- C:\Windows\System\XFesaBD.exe
  C:\Windows\System\XFesaBD.exe
  2⤵
  PID:12988
- C:\Windows\System\nbJzGtU.exe
  C:\Windows\System\nbJzGtU.exe
  2⤵
  PID:13012
- C:\Windows\System\NIljTPB.exe
  C:\Windows\System\NIljTPB.exe
  2⤵
  PID:13052
- C:\Windows\System\bZyeaSx.exe
  C:\Windows\System\bZyeaSx.exe
  2⤵
  PID:13080
- C:\Windows\System\sSWdDPW.exe
  C:\Windows\System\sSWdDPW.exe
  2⤵
  PID:13108
- C:\Windows\System\HvKoTYp.exe
  C:\Windows\System\HvKoTYp.exe
  2⤵
  PID:13124
- C:\Windows\System\snFtJVj.exe
  C:\Windows\System\snFtJVj.exe
  2⤵
  PID:13164
- C:\Windows\System\bcdFvhk.exe
  C:\Windows\System\bcdFvhk.exe
  2⤵
  PID:13180
- C:\Windows\System\rKyTAnY.exe
  C:\Windows\System\rKyTAnY.exe
  2⤵
  PID:13196
- C:\Windows\System\ZKbLJoz.exe
  C:\Windows\System\ZKbLJoz.exe
  2⤵
  PID:13232
- C:\Windows\System\EONRTXX.exe
  C:\Windows\System\EONRTXX.exe
  2⤵
  PID:13276
- C:\Windows\System\nsNgDBU.exe
  C:\Windows\System\nsNgDBU.exe
  2⤵
  PID:13292
- C:\Windows\System\GcKjXQF.exe
  C:\Windows\System\GcKjXQF.exe
  2⤵
  PID:12144
- C:\Windows\System\MOVaIMm.exe
  C:\Windows\System\MOVaIMm.exe
  2⤵
  PID:12344
- C:\Windows\System\UohKdFw.exe
  C:\Windows\System\UohKdFw.exe
  2⤵
  PID:12392
- C:\Windows\System\KBNskNY.exe
  C:\Windows\System\KBNskNY.exe
  2⤵
  PID:12496
- C:\Windows\System\ZHwPQwE.exe
  C:\Windows\System\ZHwPQwE.exe
  2⤵
  PID:12504
- C:\Windows\System\YMFxIPG.exe
  C:\Windows\System\YMFxIPG.exe
  2⤵
  PID:12644
- C:\Windows\System\doWqUhz.exe
  C:\Windows\System\doWqUhz.exe
  2⤵
  PID:12708
- C:\Windows\System\rRVnNXu.exe
  C:\Windows\System\rRVnNXu.exe
  2⤵
  PID:12772
- C:\Windows\System\ZKgxgEk.exe
  C:\Windows\System\ZKgxgEk.exe
  2⤵
  PID:12824
- C:\Windows\System\sifpDjF.exe
  C:\Windows\System\sifpDjF.exe
  2⤵
  PID:12904
- C:\Windows\System\YlNjCwN.exe
  C:\Windows\System\YlNjCwN.exe
  2⤵
  PID:12944
- C:\Windows\System\kSyYZAT.exe
  C:\Windows\System\kSyYZAT.exe
  2⤵
  PID:13004
- C:\Windows\System\HwzhWeO.exe
  C:\Windows\System\HwzhWeO.exe
  2⤵
  PID:13044
- C:\Windows\System\BWtdtms.exe
  C:\Windows\System\BWtdtms.exe
  2⤵
  PID:13096
- C:\Windows\System\qlJcDHb.exe
  C:\Windows\System\qlJcDHb.exe
  2⤵
  PID:13212
- C:\Windows\System\cBrqaIv.exe
  C:\Windows\System\cBrqaIv.exe
  2⤵
  PID:13288
- C:\Windows\System\vkdJzon.exe
  C:\Windows\System\vkdJzon.exe
  2⤵
  PID:11844
- C:\Windows\System\KSAomDK.exe
  C:\Windows\System\KSAomDK.exe
  2⤵
  PID:12444
- C:\Windows\System\hdMKwgP.exe
  C:\Windows\System\hdMKwgP.exe
  2⤵
  PID:12520
- C:\Windows\System\tVrdeYl.exe
  C:\Windows\System\tVrdeYl.exe
  2⤵
  PID:12792
- C:\Windows\System\PDpkrNj.exe
  C:\Windows\System\PDpkrNj.exe
  2⤵
  PID:12868
- C:\Windows\System\RFAoFuK.exe
  C:\Windows\System\RFAoFuK.exe
  2⤵
  PID:12960
- C:\Windows\System\RREaJgN.exe
  C:\Windows\System\RREaJgN.exe
  2⤵
  PID:13188
- C:\Windows\System\OXDrONL.exe
  C:\Windows\System\OXDrONL.exe
  2⤵
  PID:12408
- C:\Windows\System\QwtEbeV.exe
  C:\Windows\System\QwtEbeV.exe
  2⤵
  PID:12752
- C:\Windows\System\eLxNooN.exe
  C:\Windows\System\eLxNooN.exe
  2⤵
  PID:12976
- C:\Windows\System\SyCXkPR.exe
  C:\Windows\System\SyCXkPR.exe
  2⤵
  PID:12492
- C:\Windows\System\FNqPWra.exe
  C:\Windows\System\FNqPWra.exe
  2⤵
  PID:13332
- C:\Windows\System\xfXELRl.exe
  C:\Windows\System\xfXELRl.exe
  2⤵
  PID:13348
- C:\Windows\System\CMafeZj.exe
  C:\Windows\System\CMafeZj.exe
  2⤵
  PID:13388
- C:\Windows\System\pljmJwG.exe
  C:\Windows\System\pljmJwG.exe
  2⤵
  PID:13404
- C:\Windows\System\ZGRqHkq.exe
  C:\Windows\System\ZGRqHkq.exe
  2⤵
  PID:13444
- C:\Windows\System\haQjryJ.exe
  C:\Windows\System\haQjryJ.exe
  2⤵
  PID:13472
- C:\Windows\System\kjgeFEV.exe
  C:\Windows\System\kjgeFEV.exe
  2⤵
  PID:13500
- C:\Windows\System\UVNybOP.exe
  C:\Windows\System\UVNybOP.exe
  2⤵
  PID:13516
- C:\Windows\System\LWDntus.exe
  C:\Windows\System\LWDntus.exe
  2⤵
  PID:13556
- C:\Windows\System\pPSSgAD.exe
  C:\Windows\System\pPSSgAD.exe
  2⤵
  PID:13592
- C:\Windows\System\BsMGjrf.exe
  C:\Windows\System\BsMGjrf.exe
  2⤵
  PID:13628
- C:\Windows\System\ehTioDS.exe
  C:\Windows\System\ehTioDS.exe
  2⤵
  PID:13688
- C:\Windows\System\mbvJQrB.exe
  C:\Windows\System\mbvJQrB.exe
  2⤵
  PID:13720
- C:\Windows\System\PHaCcDx.exe
  C:\Windows\System\PHaCcDx.exe
  2⤵
  PID:13744
- C:\Windows\System\JSLaDAe.exe
  C:\Windows\System\JSLaDAe.exe
  2⤵
  PID:13772
- C:\Windows\System\lwdDaSa.exe
  C:\Windows\System\lwdDaSa.exe
  2⤵
  PID:13824
- C:\Windows\System\TROUPNB.exe
  C:\Windows\System\TROUPNB.exe
  2⤵
  PID:13864
- C:\Windows\System\eeaaIBC.exe
  C:\Windows\System\eeaaIBC.exe
  2⤵
  PID:13888
- C:\Windows\System\yfaCSse.exe
  C:\Windows\System\yfaCSse.exe
  2⤵
  PID:13916
- C:\Windows\System\OYVDitY.exe
  C:\Windows\System\OYVDitY.exe
  2⤵
  PID:13940
- C:\Windows\System\ZDTezQl.exe
  C:\Windows\System\ZDTezQl.exe
  2⤵
  PID:13956
- C:\Windows\System\tcbCkLC.exe
  C:\Windows\System\tcbCkLC.exe
  2⤵
  PID:14032
- C:\Windows\System\FfUjwgn.exe
  C:\Windows\System\FfUjwgn.exe
  2⤵
  PID:14056
- C:\Windows\System\xGAXDJq.exe
  C:\Windows\System\xGAXDJq.exe
  2⤵
  PID:14088
- C:\Windows\System\nmxlnep.exe
  C:\Windows\System\nmxlnep.exe
  2⤵
  PID:14104
- C:\Windows\System\qBpaRUs.exe
  C:\Windows\System\qBpaRUs.exe
  2⤵
  PID:14136
- C:\Windows\System\PqIDIdW.exe
  C:\Windows\System\PqIDIdW.exe
  2⤵
  PID:14164
- C:\Windows\System\rEdQYwE.exe
  C:\Windows\System\rEdQYwE.exe
  2⤵
  PID:14196
- C:\Windows\System\iGctsQk.exe
  C:\Windows\System\iGctsQk.exe
  2⤵
  PID:14220
- C:\Windows\System\LUptCdz.exe
  C:\Windows\System\LUptCdz.exe
  2⤵
  PID:14256
- C:\Windows\System\TWUqvlk.exe
  C:\Windows\System\TWUqvlk.exe
  2⤵
  PID:14280
- C:\Windows\System\bmfqaAz.exe
  C:\Windows\System\bmfqaAz.exe
  2⤵
  PID:14296
- C:\Windows\System\uyzGgMd.exe
  C:\Windows\System\uyzGgMd.exe
  2⤵
  PID:14332
- C:\Windows\System\GkfgmyP.exe
  C:\Windows\System\GkfgmyP.exe
  2⤵
  PID:13360
- C:\Windows\System\cfYxbOO.exe
  C:\Windows\System\cfYxbOO.exe
  2⤵
  PID:13416
- C:\Windows\System\IGoDhSZ.exe
  C:\Windows\System\IGoDhSZ.exe
  2⤵
  PID:13488
- C:\Windows\System\RBIKGTJ.exe
  C:\Windows\System\RBIKGTJ.exe
  2⤵
  PID:13544
- C:\Windows\System\OoJkxsH.exe
  C:\Windows\System\OoJkxsH.exe
  2⤵
  PID:13636
- C:\Windows\System\EKMhPJu.exe
  C:\Windows\System\EKMhPJu.exe
  2⤵
  PID:13788
- C:\Windows\System\feSJQzX.exe
  C:\Windows\System\feSJQzX.exe
  2⤵
  PID:13860
- C:\Windows\System\vEGnSmd.exe
  C:\Windows\System\vEGnSmd.exe
  2⤵
  PID:13952
- C:\Windows\System\HPscyJu.exe
  C:\Windows\System\HPscyJu.exe
  2⤵
  PID:14000
- C:\Windows\System\uxkfUHo.exe
  C:\Windows\System\uxkfUHo.exe
  2⤵
  PID:14096
- C:\Windows\System\FTdGLXu.exe
  C:\Windows\System\FTdGLXu.exe
  2⤵
  PID:14120
- C:\Windows\System\tkqTyxV.exe
  C:\Windows\System\tkqTyxV.exe
  2⤵
  PID:14240
- C:\Windows\System\FZpmdEk.exe
  C:\Windows\System\FZpmdEk.exe
  2⤵
  PID:14316
- C:\Windows\System\RbvdLQv.exe
  C:\Windows\System\RbvdLQv.exe
  2⤵
  PID:13340
- C:\Windows\System\SDCrfnZ.exe
  C:\Windows\System\SDCrfnZ.exe
  2⤵
  PID:13512
- C:\Windows\System\GtVmvSG.exe
  C:\Windows\System\GtVmvSG.exe
  2⤵
  PID:13588
- C:\Windows\System\QFPmWmg.exe
  C:\Windows\System\QFPmWmg.exe
  2⤵
  PID:13948
- C:\Windows\System\svADMce.exe
  C:\Windows\System\svADMce.exe
  2⤵
  PID:14052
- C:\Windows\System\xpVrYUr.exe
  C:\Windows\System\xpVrYUr.exe
  2⤵
  PID:14160
- C:\Windows\System\WZPLFzG.exe
  C:\Windows\System\WZPLFzG.exe
  2⤵
  PID:14328
- C:\Windows\System\zfZKmrm.exe
  C:\Windows\System\zfZKmrm.exe
  2⤵
  PID:13812
- C:\Windows\System\KIIrhzY.exe
  C:\Windows\System\KIIrhzY.exe
  2⤵
  PID:14208
- C:\Windows\System\VvyZMJb.exe
  C:\Windows\System\VvyZMJb.exe
  2⤵
  PID:13884
- C:\Windows\System\rVSfyNJ.exe
  C:\Windows\System\rVSfyNJ.exe
  2⤵
  PID:14344
- C:\Windows\System\VkjIjHf.exe
  C:\Windows\System\VkjIjHf.exe
  2⤵
  PID:14396
- C:\Windows\System\sVhFGQC.exe
  C:\Windows\System\sVhFGQC.exe
  2⤵
  PID:14412
- C:\Windows\System\kRUbASh.exe
  C:\Windows\System\kRUbASh.exe
  2⤵
  PID:14440
- C:\Windows\System\Tmmrbdl.exe
  C:\Windows\System\Tmmrbdl.exe
  2⤵
  PID:14460
- C:\Windows\System\oOjHAoq.exe
  C:\Windows\System\oOjHAoq.exe
  2⤵
  PID:14492
- C:\Windows\System\WMBWgcb.exe
  C:\Windows\System\WMBWgcb.exe
  2⤵
  PID:14536
- C:\Windows\System\GEyjWdB.exe
  C:\Windows\System\GEyjWdB.exe
  2⤵
  PID:14568
- C:\Windows\System\SrLFSXZ.exe
  C:\Windows\System\SrLFSXZ.exe
  2⤵
  PID:14596
- C:\Windows\System\aRfWvZZ.exe
  C:\Windows\System\aRfWvZZ.exe
  2⤵
  PID:14624
- C:\Windows\System\kDBYxfi.exe
  C:\Windows\System\kDBYxfi.exe
  2⤵
  PID:14652
- C:\Windows\System\BCIMPas.exe
  C:\Windows\System\BCIMPas.exe
  2⤵
  PID:14672
- C:\Windows\System\DCHAwvw.exe
  C:\Windows\System\DCHAwvw.exe
  2⤵
  PID:14692
- C:\Windows\System\srcWtFI.exe
  C:\Windows\System\srcWtFI.exe
  2⤵
  PID:14720
- C:\Windows\System\aAWFqiK.exe
  C:\Windows\System\aAWFqiK.exe
  2⤵
  PID:14752
- C:\Windows\System\ZNyzBWc.exe
  C:\Windows\System\ZNyzBWc.exe
  2⤵
  PID:14780
- C:\Windows\System\ofytgBH.exe
  C:\Windows\System\ofytgBH.exe
  2⤵
  PID:14804
- C:\Windows\System\eRISToM.exe
  C:\Windows\System\eRISToM.exe
  2⤵
  PID:14844
- C:\Windows\System\hScViND.exe
  C:\Windows\System\hScViND.exe
  2⤵
  PID:14864
- C:\Windows\System\KAqWhyG.exe
  C:\Windows\System\KAqWhyG.exe
  2⤵
  PID:14904
- C:\Windows\System\GHdbIfD.exe
  C:\Windows\System\GHdbIfD.exe
  2⤵
  PID:14920
- C:\Windows\System\odKeHoV.exe
  C:\Windows\System\odKeHoV.exe
  2⤵
  PID:14964
- C:\Windows\System\VxAFMQu.exe
  C:\Windows\System\VxAFMQu.exe
  2⤵
  PID:14980
- C:\Windows\System\fRxWISb.exe
  C:\Windows\System\fRxWISb.exe
  2⤵
  PID:15012
- C:\Windows\System\HcJnLcl.exe
  C:\Windows\System\HcJnLcl.exe
  2⤵
  PID:15040
- C:\Windows\System\cbOECDR.exe
  C:\Windows\System\cbOECDR.exe
  2⤵
  PID:15064
- C:\Windows\System\eLUjHxY.exe
  C:\Windows\System\eLUjHxY.exe
  2⤵
  PID:15092
- C:\Windows\System\wOKszCu.exe
  C:\Windows\System\wOKszCu.exe
  2⤵
  PID:15120
- C:\Windows\System\XqRvDYc.exe
  C:\Windows\System\XqRvDYc.exe
  2⤵
  PID:15148
- C:\Windows\System\QdEtvXX.exe
  C:\Windows\System\QdEtvXX.exe
  2⤵
  PID:15180
- C:\Windows\System\XJkMVNG.exe
  C:\Windows\System\XJkMVNG.exe
  2⤵
  PID:15200
- C:\Windows\System\LAWkGEA.exe
  C:\Windows\System\LAWkGEA.exe
  2⤵
  PID:15220
- C:\Windows\System\MIKdraL.exe
  C:\Windows\System\MIKdraL.exe
  2⤵
  PID:15248
- C:\Windows\System\UFhwhxn.exe
  C:\Windows\System\UFhwhxn.exe
  2⤵
  PID:15288
- C:\Windows\System\oHuKjBw.exe
  C:\Windows\System\oHuKjBw.exe
  2⤵
  PID:15316
- C:\Windows\System\DzJtiYF.exe
  C:\Windows\System\DzJtiYF.exe
  2⤵
  PID:15344
- C:\Windows\System\COHOsSs.exe
  C:\Windows\System\COHOsSs.exe
  2⤵
  PID:13464
- C:\Windows\System\flVjAjR.exe
  C:\Windows\System\flVjAjR.exe
  2⤵
  PID:14388
- C:\Windows\System\moVFjQJ.exe
  C:\Windows\System\moVFjQJ.exe
  2⤵
  PID:14452
- C:\Windows\System\qzxxdGq.exe
  C:\Windows\System\qzxxdGq.exe
  2⤵
  PID:14520
- C:\Windows\System\ApUEetk.exe
  C:\Windows\System\ApUEetk.exe
  2⤵
  PID:14608
- C:\Windows\System\gOcrEeb.exe
  C:\Windows\System\gOcrEeb.exe
  2⤵
  PID:14636
- C:\Windows\System\XROZTwJ.exe
  C:\Windows\System\XROZTwJ.exe
  2⤵
  PID:14744
- C:\Windows\System\TmPzgXi.exe
  C:\Windows\System\TmPzgXi.exe
  2⤵
  PID:14820
- C:\Windows\System\UsRbkuu.exe
  C:\Windows\System\UsRbkuu.exe
  2⤵
  PID:14900
- C:\Windows\System\juVNvcU.exe
  C:\Windows\System\juVNvcU.exe
  2⤵
  PID:14952
- C:\Windows\System\oXDIWPB.exe
  C:\Windows\System\oXDIWPB.exe
  2⤵
  PID:15004
- C:\Windows\System\zaEEueC.exe
  C:\Windows\System\zaEEueC.exe
  2⤵
  PID:15048
- C:\Windows\System\gXjkVkT.exe
  C:\Windows\System\gXjkVkT.exe
  2⤵
  PID:15104
- C:\Windows\System\PjPeltR.exe
  C:\Windows\System\PjPeltR.exe
  2⤵
  PID:15236
- C:\Windows\System\ZExYWfd.exe
  C:\Windows\System\ZExYWfd.exe
  2⤵
  PID:15260
- C:\Windows\System\LtrzzoG.exe
  C:\Windows\System\LtrzzoG.exe
  2⤵
  PID:15340
- C:\Windows\System\bpkqBPt.exe
  C:\Windows\System\bpkqBPt.exe
  2⤵
  PID:15356
- C:\Windows\System\uSwdZlg.exe
  C:\Windows\System\uSwdZlg.exe
  2⤵
  PID:14488
- C:\Windows\System\tMrDtMz.exe
  C:\Windows\System\tMrDtMz.exe
  2⤵
  PID:14644
- C:\Windows\System\JveJWuK.exe
  C:\Windows\System\JveJWuK.exe
  2⤵
  PID:14764
- C:\Windows\System\wtHupuS.exe
  C:\Windows\System\wtHupuS.exe
  2⤵
  PID:14976
- C:\Windows\System\YiOMrkM.exe
  C:\Windows\System\YiOMrkM.exe
  2⤵
  PID:15160
- C:\Windows\System\AOVIvZs.exe
  C:\Windows\System\AOVIvZs.exe
  2⤵
  PID:15324
- C:\Windows\System\fcjnmHj.exe
  C:\Windows\System\fcjnmHj.exe
  2⤵
  PID:14532
- C:\Windows\System\kagHqTQ.exe
  C:\Windows\System\kagHqTQ.exe
  2⤵
  PID:14936
- C:\Windows\System\kFXzQVd.exe
  C:\Windows\System\kFXzQVd.exe
  2⤵
  PID:15196
- C:\Windows\System\iCPEYxA.exe
  C:\Windows\System\iCPEYxA.exe
  2⤵
  PID:14740
- C:\Windows\System\haRkOxY.exe
  C:\Windows\System\haRkOxY.exe
  2⤵
  PID:15364
- C:\Windows\System\kCdXOYh.exe
  C:\Windows\System\kCdXOYh.exe
  2⤵
  PID:15392
- C:\Windows\System\uiUFHfl.exe
  C:\Windows\System\uiUFHfl.exe
  2⤵
  PID:15420
- C:\Windows\System\PcnOFaC.exe
  C:\Windows\System\PcnOFaC.exe
  2⤵
  PID:15436
- C:\Windows\System\SUTKRaP.exe
  C:\Windows\System\SUTKRaP.exe
  2⤵
  PID:15464
- C:\Windows\System\mSeGvhG.exe
  C:\Windows\System\mSeGvhG.exe
  2⤵
  PID:15480
- C:\Windows\System\YuHdUhr.exe
  C:\Windows\System\YuHdUhr.exe
  2⤵
  PID:15528
- C:\Windows\System\wEIzoJH.exe
  C:\Windows\System\wEIzoJH.exe
  2⤵
  PID:15548
- C:\Windows\System\eAcOnPM.exe
  C:\Windows\System\eAcOnPM.exe
  2⤵
  PID:15576
- C:\Windows\System\NqVgexo.exe
  C:\Windows\System\NqVgexo.exe
  2⤵
  PID:15604
- C:\Windows\System\tvIdszO.exe
  C:\Windows\System\tvIdszO.exe
  2⤵
  PID:15636
- C:\Windows\System\wVOsXil.exe
  C:\Windows\System\wVOsXil.exe
  2⤵
  PID:15672
- C:\Windows\System\XAQeiVH.exe
  C:\Windows\System\XAQeiVH.exe
  2⤵
  PID:15700
- C:\Windows\System\vUvcqSx.exe
  C:\Windows\System\vUvcqSx.exe
  2⤵
  PID:15724
- C:\Windows\System\HyVYmPK.exe
  C:\Windows\System\HyVYmPK.exe
  2⤵
  PID:15744
- C:\Windows\System\XxFJLdO.exe
  C:\Windows\System\XxFJLdO.exe
  2⤵
  PID:15776
- C:\Windows\System\cGBsaHF.exe
  C:\Windows\System\cGBsaHF.exe
  2⤵
  PID:15800
- C:\Windows\System\rkJFnuQ.exe
  C:\Windows\System\rkJFnuQ.exe
  2⤵
  PID:15828
- C:\Windows\System\qXRreni.exe
  C:\Windows\System\qXRreni.exe
  2⤵
  PID:15868
- C:\Windows\System\Oudgofb.exe
  C:\Windows\System\Oudgofb.exe
  2⤵
  PID:15888
- C:\Windows\System\mHdgLAv.exe
  C:\Windows\System\mHdgLAv.exe
  2⤵
  PID:15912
- C:\Windows\System\zRgAeEU.exe
  C:\Windows\System\zRgAeEU.exe
  2⤵
  PID:15940
- C:\Windows\System\lakZwll.exe
  C:\Windows\System\lakZwll.exe
  2⤵
  PID:15968
- C:\Windows\System\MoKhyXQ.exe
  C:\Windows\System\MoKhyXQ.exe
  2⤵
  PID:15996
- C:\Windows\System\TMHkgxz.exe
  C:\Windows\System\TMHkgxz.exe
  2⤵
  PID:16028
- C:\Windows\System\dIEzUhq.exe
  C:\Windows\System\dIEzUhq.exe
  2⤵
  PID:16064
- C:\Windows\System\dwNqRWe.exe
  C:\Windows\System\dwNqRWe.exe
  2⤵
  PID:16088
- C:\Windows\System\TFsQPaO.exe
  C:\Windows\System\TFsQPaO.exe
  2⤵
  PID:16108
- C:\Windows\System\lUivVkq.exe
  C:\Windows\System\lUivVkq.exe
  2⤵
  PID:16128
- C:\Windows\System\dmNeiou.exe
  C:\Windows\System\dmNeiou.exe
  2⤵
  PID:16164
- C:\Windows\System\fUaXQsg.exe
  C:\Windows\System\fUaXQsg.exe
  2⤵
  PID:16204
- C:\Windows\System\jDTNiEe.exe
  C:\Windows\System\jDTNiEe.exe
  2⤵
  PID:16224
- C:\Windows\System\VhawYKi.exe
  C:\Windows\System\VhawYKi.exe
  2⤵
  PID:16260
- C:\Windows\System\dXiDbcz.exe
  C:\Windows\System\dXiDbcz.exe
  2⤵
  PID:16288
- C:\Windows\System\cVATdFM.exe
  C:\Windows\System\cVATdFM.exe
  2⤵
  PID:16320
- C:\Windows\System\xbFNapB.exe
  C:\Windows\System\xbFNapB.exe
  2⤵
  PID:16336
- C:\Windows\System\mDUoQRj.exe
  C:\Windows\System\mDUoQRj.exe
  2⤵
  PID:16360
- C:\Windows\System\bjwPXoP.exe
  C:\Windows\System\bjwPXoP.exe
  2⤵
  PID:14684
- C:\Windows\System\gAjZNUF.exe
  C:\Windows\System\gAjZNUF.exe
  2⤵
  PID:15492
- C:\Windows\System\EbytYFr.exe
  C:\Windows\System\EbytYFr.exe
  2⤵
  PID:15512
- C:\Windows\System\PvmcrFl.exe
  C:\Windows\System\PvmcrFl.exe
  2⤵
  PID:15588
- C:\Windows\System\Qnigxcx.exe
  C:\Windows\System\Qnigxcx.exe
  2⤵
  PID:15656
- C:\Windows\System\ZoETHhF.exe
  C:\Windows\System\ZoETHhF.exe
  2⤵
  PID:15716
- C:\Windows\System\jaaMmvI.exe
  C:\Windows\System\jaaMmvI.exe
  2⤵
  PID:15812
- C:\Windows\System\RCBAjxY.exe
  C:\Windows\System\RCBAjxY.exe
  2⤵
  PID:15784
- C:\Windows\System\DtvXIFL.exe
  C:\Windows\System\DtvXIFL.exe
  2⤵
  PID:15884
- C:\Windows\System\QfbkvJE.exe
  C:\Windows\System\QfbkvJE.exe
  2⤵
  PID:15964
- C:\Windows\System\OgdZenF.exe
  C:\Windows\System\OgdZenF.exe
  2⤵
  PID:16012
- C:\Windows\System\kkjWfVo.exe
  C:\Windows\System\kkjWfVo.exe
  2⤵
  PID:16080
- C:\Windows\System\OWMqBkr.exe
  C:\Windows\System\OWMqBkr.exe
  2⤵
  PID:16140
- C:\Windows\System\yGSClvu.exe
  C:\Windows\System\yGSClvu.exe
  2⤵
  PID:16196
- C:\Windows\System\pxQkkvD.exe
  C:\Windows\System\pxQkkvD.exe
  2⤵
  PID:16212
- C:\Windows\System\zgyBvPM.exe
  C:\Windows\System\zgyBvPM.exe
  2⤵
  PID:16312
- C:\Windows\System\egthbtA.exe
  C:\Windows\System\egthbtA.exe
  2⤵
  PID:15428
- C:\Windows\System\gtVwDqc.exe
  C:\Windows\System\gtVwDqc.exe
  2⤵
  PID:15564
- C:\Windows\System\jJCJbhI.exe
  C:\Windows\System\jJCJbhI.exe
  2⤵
  PID:15732
- C:\Windows\System\ppnjHSy.exe
  C:\Windows\System\ppnjHSy.exe
  2⤵
  PID:15860
- C:\Windows\System\gRiDgFU.exe
  C:\Windows\System\gRiDgFU.exe
  2⤵
  PID:16076
- C:\Windows\System\XfqXcQW.exe
  C:\Windows\System\XfqXcQW.exe
  2⤵
  PID:968
- C:\Windows\System\JHnsDud.exe
  C:\Windows\System\JHnsDud.exe
  2⤵
  PID:16256
- C:\Windows\System\HAKlUcy.exe
  C:\Windows\System\HAKlUcy.exe
  2⤵
  PID:16372
- C:\Windows\System\eybqqjh.exe
  C:\Windows\System\eybqqjh.exe
  2⤵
  PID:15768
- C:\Windows\System\BpKWwgj.exe
  C:\Windows\System\BpKWwgj.exe
  2⤵
  PID:16280
- C:\Windows\System\LUfmgVx.exe
  C:\Windows\System\LUfmgVx.exe
  2⤵
  PID:15460
- C:\Windows\System\qcaucuY.exe
  C:\Windows\System\qcaucuY.exe
  2⤵
  PID:16160
- C:\Windows\System\rnTLfBA.exe
  C:\Windows\System\rnTLfBA.exe
  2⤵
  PID:16416
- C:\Windows\System\OsNPzpM.exe
  C:\Windows\System\OsNPzpM.exe
  2⤵
  PID:16444
- C:\Windows\System\ionOzEt.exe
  C:\Windows\System\ionOzEt.exe
  2⤵
  PID:16472
- C:\Windows\System\aAKdlgC.exe
  C:\Windows\System\aAKdlgC.exe
  2⤵
  PID:16524
- C:\Windows\System\RFwZliX.exe
  C:\Windows\System\RFwZliX.exe
  2⤵
  PID:16540
- C:\Windows\System\NjIDeXA.exe
  C:\Windows\System\NjIDeXA.exe
  2⤵
  PID:16556
- C:\Windows\System\pNHKyNs.exe
  C:\Windows\System\pNHKyNs.exe
  2⤵
  PID:16596
- C:\Windows\System\mKzcaWG.exe
  C:\Windows\System\mKzcaWG.exe
  2⤵
  PID:16624
- C:\Windows\System\KRiwHhG.exe
  C:\Windows\System\KRiwHhG.exe
  2⤵
  PID:16640
- C:\Windows\System\INkxOqN.exe
  C:\Windows\System\INkxOqN.exe
  2⤵
  PID:16680
- C:\Windows\System\AYZfYEb.exe
  C:\Windows\System\AYZfYEb.exe
  2⤵
  PID:16696
- C:\Windows\System\cWZSWTE.exe
  C:\Windows\System\cWZSWTE.exe
  2⤵
  PID:16736
- C:\Windows\System\ScQssIN.exe
  C:\Windows\System\ScQssIN.exe
  2⤵
  PID:16752
- C:\Windows\System\zkrBNSh.exe
  C:\Windows\System\zkrBNSh.exe
  2⤵
  PID:16780
- C:\Windows\System\qWHGtDq.exe
  C:\Windows\System\qWHGtDq.exe
  2⤵
  PID:16808
- C:\Windows\System\nZVvmYd.exe
  C:\Windows\System\nZVvmYd.exe
  2⤵
  PID:16828
- C:\Windows\System\FhbFLmT.exe
  C:\Windows\System\FhbFLmT.exe
  2⤵
  PID:16856
- C:\Windows\System\oZKVKEW.exe
  C:\Windows\System\oZKVKEW.exe
  2⤵
  PID:16880
- C:\Windows\System\IUVeVpK.exe
  C:\Windows\System\IUVeVpK.exe
  2⤵
  PID:16896
- C:\Windows\System\QmvieYS.exe
  C:\Windows\System\QmvieYS.exe
  2⤵
  PID:16920
- C:\Windows\System\UBtlnYd.exe
  C:\Windows\System\UBtlnYd.exe
  2⤵
  PID:16984
- C:\Windows\System\vkvncKx.exe
  C:\Windows\System\vkvncKx.exe
  2⤵
  PID:17008
- C:\Windows\System\uWaScnQ.exe
  C:\Windows\System\uWaScnQ.exe
  2⤵
  PID:17048
- C:\Windows\System\HdfBfpy.exe
  C:\Windows\System\HdfBfpy.exe
  2⤵
  PID:17068
- C:\Windows\System\jcmBFZl.exe
  C:\Windows\System\jcmBFZl.exe
  2⤵
  PID:17088
- C:\Windows\System\lJYGxTg.exe
  C:\Windows\System\lJYGxTg.exe
  2⤵
  PID:17116
- C:\Windows\System\IltApoD.exe
  C:\Windows\System\IltApoD.exe
  2⤵
  PID:17136
- C:\Windows\System\tmaLosL.exe
  C:\Windows\System\tmaLosL.exe
  2⤵
  PID:17168
- C:\Windows\System\gVexjwv.exe
  C:\Windows\System\gVexjwv.exe
  2⤵
  PID:17212
- C:\Windows\System\TMOckJw.exe
  C:\Windows\System\TMOckJw.exe
  2⤵
  PID:17228
- C:\Windows\System\WRCjZlU.exe
  C:\Windows\System\WRCjZlU.exe
  2⤵
  PID:17256
- C:\Windows\System\oQIMBJs.exe
  C:\Windows\System\oQIMBJs.exe
  2⤵
  PID:17280
- C:\Windows\System\fuHCtcM.exe
  C:\Windows\System\fuHCtcM.exe
  2⤵
  PID:17316
- C:\Windows\System\zInQeCG.exe
  C:\Windows\System\zInQeCG.exe
  2⤵
  PID:17340
- C:\Windows\System\vUqmztO.exe
  C:\Windows\System\vUqmztO.exe
  2⤵
  PID:17376
- C:\Windows\System\LLrYnIg.exe
  C:\Windows\System\LLrYnIg.exe
  2⤵
  PID:16404
- C:\Windows\System\svizBWq.exe
  C:\Windows\System\svizBWq.exe
  2⤵
  PID:16460
- C:\Windows\System\NtnKJuu.exe
  C:\Windows\System\NtnKJuu.exe
  2⤵
  PID:16536
- C:\Windows\System\MCLzVgY.exe
  C:\Windows\System\MCLzVgY.exe
  2⤵
  PID:16568
- C:\Windows\System\woAKUrY.exe
  C:\Windows\System\woAKUrY.exe
  2⤵
  PID:16656
- C:\Windows\System\zyTlddb.exe
  C:\Windows\System\zyTlddb.exe
  2⤵
  PID:16676
- C:\Windows\System\VaIIXyl.exe
  C:\Windows\System\VaIIXyl.exe
  2⤵
  PID:16768
- C:\Windows\System\bsMXwRa.exe
  C:\Windows\System\bsMXwRa.exe
  2⤵
  PID:16800
- C:\Windows\System\pODrvmP.exe
  C:\Windows\System\pODrvmP.exe
  2⤵
  PID:16868
- C:\Windows\System\QYrfzgr.exe
  C:\Windows\System\QYrfzgr.exe
  2⤵
  PID:16908
- C:\Windows\System\GxWfBKo.exe
  C:\Windows\System\GxWfBKo.exe
  2⤵
  PID:17028
- C:\Windows\System\biXmOGm.exe
  C:\Windows\System\biXmOGm.exe
  2⤵
  PID:17036
- C:\Windows\System\BFYvyEO.exe
  C:\Windows\System\BFYvyEO.exe
  2⤵
  PID:17180
- C:\Windows\System\QFcJJnF.exe
  C:\Windows\System\QFcJJnF.exe
  2⤵
  PID:17196
- C:\Windows\System\QiJnNzx.exe
  C:\Windows\System\QiJnNzx.exe
  2⤵
  PID:17300
- C:\Windows\System\NEoQHbQ.exe
  C:\Windows\System\NEoQHbQ.exe
  2⤵
  PID:17336
- C:\Windows\System\SXLwxMc.exe
  C:\Windows\System\SXLwxMc.exe
  2⤵
  PID:17404
- C:\Windows\System\VJTLzDu.exe
  C:\Windows\System\VJTLzDu.exe
  2⤵
  PID:6432
- C:\Windows\System\OnLmlHL.exe
  C:\Windows\System\OnLmlHL.exe
  2⤵
  PID:6148
- C:\Windows\System\kdshFxK.exe
  C:\Windows\System\kdshFxK.exe
  2⤵
  PID:1972
- C:\Windows\System\hRtcsCJ.exe
  C:\Windows\System\hRtcsCJ.exe
  2⤵
  PID:16672

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CEYKBMk.exe

Path C:\Windows\System\CEYKBMk.exe
Size 1.7MB
SHA256 9050661cea7b67942ccf7f5e096a361522370d5b43804445c0a13727670973e4
MD5 dfb8b30713b4b58f23e091742671f3ea
SHA1 cacee561d148dd040442942bbc0f0ef8da2dd80c
SHA512 e09e1d7168213ace587497c967b7737a468c14aeecfe053a54db3f3934e044f0dc6ab39e4be8bc29760c36d1b671c35b247aaba411191cae909e8e45ba0f535b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUn:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

DrXefxj.exe

Path C:\Windows\System\DrXefxj.exe
Size 1.7MB
SHA256 ae897e216e041c8a58ee3cf95ebe95ae7f9cd4e5806f9de6f95ed34769c1c7a7
MD5 1d3977f1036b81d346ae0d9da7fb044e
SHA1 bc96665eb53358827ea40f2c9959af8b0b1a60c6
SHA512 569de145020a12190e6315448637ad846620c04cd2ac9c8685acc328489d9dc5310f12047c792fd523e340244d95c0338660256c2fef0aa701c50d82a5894ff9
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUH:GemTLkNdfE0pZa7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECsGGfy.exe

Path C:\Windows\System\ECsGGfy.exe
Size 1.7MB
SHA256 478e26d7e4eafbddef2191dadd34a9824d52bc91d3b656c4a220c9e122ac946b
MD5 fab42415a2641058ebd7c02eee39f0c2
SHA1 b7659317be5dda3ed20ae2ef5a4edab53817c26e
SHA512 5dcb7236704c6a8ff02cccf3eab05f7f91dd34b9d805917245e0662f9b633c2f10ec32b8e8cbbe49303558612dad06ad2c0e078240e20b988464e2b94f87104e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUh:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Submit Download

ILAIHIO.exe

Path C:\Windows\System\ILAIHIO.exe
Size 1.7MB
SHA256 790d9f3d0654b087b6192ac29e1349bc476546255f88256a4f02b137aaa67bf6
MD5 7fb797c99bf3e069e4630d26a1d88158
SHA1 e1df40ffe406c2776a7897c3f1af64991bcc62ba
SHA512 830422c67f5c35f035d1e0b61e442e76dc9ce98d8bc453df945f63f4fc7ea6b7f13cad777967c92198afa221dacab51b495e3745aec71486638e3f74a2485ff2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUQ:GemTLkNdfE0pZaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

MeuOkpL.exe

Path C:\Windows\System\MeuOkpL.exe
Size 1.7MB
SHA256 781f6b83baba08f5a94557032c259ef40b41c2cda86e39866dbbe526604b87cf
MD5 1ddd4620b62fee89ac45b0d36cd3e97e
SHA1 ff9eeab9d3523f68f476af7695693b1b0e775188
SHA512 3317940202e820f6d98acd76cbb5bbb5c8e34267fdf5ab939dd1ec44d96b63904fab5b1a313bc1d25732e8572b104e2ff66af26a5256675d36737b4a95c934bf
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dU0:GemTLkNdfE0pZaQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

PjOOFca.exe

Path C:\Windows\System\PjOOFca.exe
Size 1.7MB
SHA256 845b1f3ec79315e70b84a28ffc1f44e2108833f333e6ca8f99ddca119db163f5
MD5 179d3bbd4e6c6d788fa6c0cb3d2f9781
SHA1 9387da1b532d68391ae0bf846c55d894e723307a
SHA512 6759d270095c4f47954b3b76968f7fdac5dcc9f2b0861a987ef962cfd1059da747c4f8c3f81418fcde2a8348631f089589888972674ff7c3d8b914d10d3c1736
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUk:GemTLkNdfE0pZaI
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMxHraV.exe

Path C:\Windows\System\QMxHraV.exe
Size 1.7MB
SHA256 ce28d53a31d6967f8a4b97110120a840a86254be4e40a4648c51341e85490198
MD5 108eb9c8f49d2142b1fd90136e604e9b
SHA1 8a8a2b34c82f5689f0ec890d9a1612095f0b7886
SHA512 44508c382d778577a577c6dfe2141833cce22b27aefac42887208dc6b315e3d38b567f9c8a3c640ad6e48410e3a96a655f7398fb13ac024e4fcfd9681e6fe805
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUn:GemTLkNdfE0pZa7
MD5 SHA1 SHA512 SSDEEP

Submit Download

TWzYxsk.exe

Path C:\Windows\System\TWzYxsk.exe
Size 1.7MB
SHA256 51267bc51366919b2967c2cd40562df7f855ec4ab5c3d13b795fc90ae3547adf
MD5 cddff919283e092538f7c551b4d2aa6e
SHA1 857540afecb4c57f967924a1fc2db61fc6bba6fd
SHA512 8b13501d2fe7e91099ccecbb505bad41fbc10d595642860d07eebab1953e7f02a83ceaed4485d0506204e6fb1358cfc9959187b1cf47cbc2e248c44626729f79
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUq:GemTLkNdfE0pZa2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uzgzlpb.exe

Path C:\Windows\System\Uzgzlpb.exe
Size 1.7MB
SHA256 7f114dc2970596ec1ad1b98d7708d7030b0ec82e0de395987cf32e7cd6ee22ee
MD5 a7976b0d1b48e1aa7c03895dcd4b3d4d
SHA1 f11598d775ac58380a5c9eeb8fabbf1640516205
SHA512 4820efc444f8e0bf5ab17c8dadb10d088699c5ecfd2be00ec3913f5050e834e8e4a38c4b57914577358eb695cf8b3d31fe6f14ee4bcb48d19fcb43313b0a44cf
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUQ:GemTLkNdfE0pZa0
MD5 SHA1 SHA512 SSDEEP

Submit Download

VHJkCEN.exe

Path C:\Windows\System\VHJkCEN.exe
Size 1.7MB
SHA256 82be6381e1d3c886e6edb3ad6546c957240743eb984484c43e905f49c9cfcd36
MD5 194ee79a4dfa9b9f39839bafd32fc68d
SHA1 29061e824f9abdc4e515196acbfab8e94656584f
SHA512 ae3dc7efea32b5b5467b4d27a29569b02038b6bc1ab847fe1454055253409a445c7d6829109126f5b7b551fb525a6b0dca91ae1850f2ec605f2d695d16af13cf
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUi:GemTLkNdfE0pZaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

YQggWhC.exe

Path C:\Windows\System\YQggWhC.exe
Size 1.7MB
SHA256 e67dd0680df58d6bc4fdecedba80bbed357612825491fa9c687976ef188e3417
MD5 456295ae8760ee286bfc74c8c9077e24
SHA1 e45d1d9d1961f6ece463d774e71d0ec20869a9d9
SHA512 d0278620d865ec7270e7eb65ed2ea7c274ee4c285b53d809936847f535c6bd209fc981fd0cf2e34ec5f22fb98de00d08c29eaf67c5992804d7870ee7a85d074f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUu:GemTLkNdfE0pZaS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZwTZNkI.exe

Path C:\Windows\System\ZwTZNkI.exe
Size 1.7MB
SHA256 b25764743c261dc574fd91e2efba8e3da3abd1f4f041d4c594571102fb3a0d41
MD5 536f6346d698db147baf0a47796ce180
SHA1 806f09791a9f403969ffec8890ad26ebaff8ec52
SHA512 55770ab7e4c57a409b7ca7c0867f21d7157e860a6c20ef669673941785aa3ba3925500d2c85c607e435eb31cb96c7ea96e3b32edc28d93a7e6ea463158575fec
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUN:GemTLkNdfE0pZaR
MD5 SHA1 SHA512 SSDEEP

Submit Download

gAFEcQQ.exe

Path C:\Windows\System\gAFEcQQ.exe
Size 1.7MB
SHA256 0695679620e58dd979a567ff39cee09878acc14ab829257df1cdfdc357326676
MD5 9640a7401b9d721a10c41b726c81bcd9
SHA1 8b675494524fc0e3875d1a03b2a747403f5b57cd
SHA512 cf67959040689fadf1208583eb8c9a14570764d9bb2e5144f64fedf60ac202a41f9eae5a6297f0bd6283954fb8a762ed4a7b0dbbdef171956f91ca5efc1f99ba
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUU:GemTLkNdfE0pZaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

goftjhT.exe

Path C:\Windows\System\goftjhT.exe
Size 1.7MB
SHA256 0f30b0921eae19633fa7f59a84040bf09cd8dc2b5fa823341f8adb6a031e8d77
MD5 626aac5cb24682049863d1d68f2c78e9
SHA1 d323cad921a7b5e19645d1cb5cae06f039372698
SHA512 1ceee09a3d6b62919576fc5e45d13d159d7cc10f90d520e97cd2fc2bc7c92b90ef8affb797db754fedb3744c482228a3def6d522f88b6eccd3e7d9345e56dc4c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUt:GemTLkNdfE0pZah
MD5 SHA1 SHA512 SSDEEP

Submit Download

gvCnMKn.exe

Path C:\Windows\System\gvCnMKn.exe
Size 1.7MB
SHA256 f582d00f6598045ef0054255b7c3a0b20e1f25e66ca655f34bc42228fddc9c10
MD5 9134e1cb2830b4c98041a32c18d84e48
SHA1 c799689e8f6772066f93c58fcf346f34a93219a5
SHA512 fe4fcecef702a714e1cc7aba2da4e1a9df97b9b24f6d6234020225c35011418774de52da528e2af161d077695a7b3804df224a1a8b454c3e7aa412196737df1d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUF:GemTLkNdfE0pZaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

hqXZAIa.exe

Path C:\Windows\System\hqXZAIa.exe
Size 1.7MB
SHA256 e800f609f42314c2d0610ccb6c8b7550b5371bc688506258878a24415b8747eb
MD5 f9a830600cf7636975ea7a3d333d3460
SHA1 43bb6f9ee243891a92bf588d18c68e2130ad1c67
SHA512 2b945bbce48820300ca53109ee7478ff353a787d592fb835bfc9970a4b93d2578c42b0cae97f17aebd28e14f6bef4aed09518103ae5dde13990c2310195c5a61
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dU9:GemTLkNdfE0pZaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

hyezqxy.exe

Path C:\Windows\System\hyezqxy.exe
Size 1.7MB
SHA256 b9491fc14c01dda2330f4837c01c19d1465560de9c0a3e05c9cf084ac4235fe3
MD5 b75df554ce184b733d02d7d49ed2fb09
SHA1 c5c7a6c9e9afe72cbd7f09bf5d7060ab6d7e71aa
SHA512 5033dc5a4506d3764b0e4d4a8734652de49977543e8eeaad3707de7e43692426a4acb409dbb2a161ed6ac5b1b80dfbffd54e1c87011851207df3f21cfb86d364
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUh:GemTLkNdfE0pZaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

iltbHcQ.exe

Path C:\Windows\System\iltbHcQ.exe
Size 1.7MB
SHA256 185165f105c8e410406ea855defef7b0947e820d2aa756eba6cedf1cf3ca020e
MD5 f3342d342a933aeff738a223e2f75854
SHA1 df6a64029e3b43583578df94530c2920ae6a5458
SHA512 d7c5055f439614eaf891d429441c41f9a09453b79357b1e6c12d354e5f821e0cde7d8de3e6561bc33322e5b22c0a4f21726df5e820a0258efc2d0f3aa205dc13
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUF:GemTLkNdfE0pZah
MD5 SHA1 SHA512 SSDEEP

Submit Download

imKbJzo.exe

Path C:\Windows\System\imKbJzo.exe
Size 1.7MB
SHA256 af034feffa91d666c84001ef8fe04845eb7f1e44d4636373bc4de0d47ac8711b
MD5 b4da38974acef5a6cc421339772daef4
SHA1 6061407e53a94f806fc12b6bf58d280def59da26
SHA512 c5a52b1f2fa1110ad94c800024af50071fb886c631b18c6438bfa3b3ef1c7d5ff8743b70c3314561d183b3d34a560ad85e5da8c6bb0b2d36cc8347b827f08a95
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUM:GemTLkNdfE0pZaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jQGwZMK.exe

Path C:\Windows\System\jQGwZMK.exe
Size 1.7MB
SHA256 d82851985cd7da792e61468ff8b9913deccc44a71242af7d753c6d9a1550125e
MD5 2b0b87b9d8f3f19b3f1aca40bd09f032
SHA1 f5d8265b1eff951c1a812d672cd914bcba00ae15
SHA512 4b6e42c9b2714876a66abd80ed62ffbb373be7ecaa9a1772508353a53946cd3af44621c53321d3a302b1206658ed23b467d117019d3687b047674b233c5ca6b2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUl:GemTLkNdfE0pZaR
MD5 SHA1 SHA512 SSDEEP

Submit Download

kKXMtwQ.exe

Path C:\Windows\System\kKXMtwQ.exe
Size 1.7MB
SHA256 dd98a84044eb9d292823233ba761e520b2bbf4ba16aa107856f6f4cf578f2c36
MD5 7da787aee708c303f8093f0462db43b7
SHA1 a6cc29c0b26ca2cada3576dc3c1ea64a56c7f1bb
SHA512 b38662045520a116bc5d5926d9b9408dac277cf8b94a1a564e3727d068db23005bca0789193371e1cb8b3ffc70d1335089d0ef66c30f0316ee188b11618b39dc
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUG:GemTLkNdfE0pZa6
MD5 SHA1 SHA512 SSDEEP

Submit Download

qAefqvr.exe

Path C:\Windows\System\qAefqvr.exe
Size 1.7MB
SHA256 e5b2ffef790d97bde9da194e13e9c05fe5c26250728c35cb1f240b1d548096d0
MD5 23fcf6c803e5c490781e8cd8e3f9664d
SHA1 c03eb14c861fcde363de99463ce17912f742370d
SHA512 6d5708fc135852b4b9674490d16ae55702c9da78549f704625bb7c9b5ce287464ad030e1367f978192ad911a3829c643f8a73d98d8e127abe4b74f2c9064205d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUA:GemTLkNdfE0pZaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

rQhCLuQ.exe

Path C:\Windows\System\rQhCLuQ.exe
Size 1.7MB
SHA256 b9004200076ca3ebf630fd1863b3b49ce85915c7a95be9d211bcdfaa59f57839
MD5 10b877885c185c8b907ed62bb3c52f9f
SHA1 fc156fab84ad2d260700ce7c5e87b9fa2c879bde
SHA512 f122933a0c408215c587a6ba83e7dd598d592b335476d9a1bf5af9f0eceb464f3f7da0c248d200a63f30934352b82e54d45a36496bd39276e88ef38641153b16
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dU5:GemTLkNdfE0pZal
MD5 SHA1 SHA512 SSDEEP

Submit Download

rSqqIzc.exe

Path C:\Windows\System\rSqqIzc.exe
Size 1.7MB
SHA256 f678269cba2958e2cc4d47423c48f572ad21eb9c7e0d0af4f61994f2450ffac9
MD5 5ebce888659ea2e9027cdb54e3e413e2
SHA1 9646cfa3efea2c0bd247fcb9f9a3b4d2c894af25
SHA512 55dd5dba87196bf5afce2f9d3763019718bc79a8da1dab6e0ac0c9fc28c7a78e4db87565b8441002ddafddb487cf554fa7f664c74f4a7b8d594f34d41d9797a5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUJ:GemTLkNdfE0pZaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

tDsxLxg.exe

Path C:\Windows\System\tDsxLxg.exe
Size 1.7MB
SHA256 6b0a744ea735bba6564b9a146ea6599180224fa93834b972e887d3aeadc23314
MD5 17995fe28ac38866b1db0e38b6970315
SHA1 ab853808ba1a229d25eaa143c31167bbb077be97
SHA512 09524752553ff22dd8490e4a775d123048af92394637bc5069a0dab457b99a5cae0d3bc28a63c512d825badf731544954ed60c974ce98e3ae760110009bdd8eb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUh:GemTLkNdfE0pZa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ubFfrhO.exe

Path C:\Windows\System\ubFfrhO.exe
Size 1.7MB
SHA256 b5f4e1fa63903dcf56e83e835478a3c26d000d1841ef3cbd9e180d30e75ce15f
MD5 24d0389a40a60a3a6f80eccf63974afe
SHA1 165e794212553992e4ad449ffbceb5b015e9c32c
SHA512 9e1ec0743b754d407c7dce0136332daf0915234e187ded08970b79846d109445ce746cfd2043f052c2ed476137405ea4153014ea4f18ddcb10264a08f7077739
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUM:GemTLkNdfE0pZao
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucGWBVE.exe

Path C:\Windows\System\ucGWBVE.exe
Size 1.7MB
SHA256 065a102b0e2567af512a06c49ef4fbec1505e608bb76c38347de7c7f00fc0af4
MD5 beab684ce8151020ede21b8c96ecbdbf
SHA1 1ae48a574acd834a96f764a93990d7d5f7b72123
SHA512 26dd2843b82d991073641f0fa47af45457e171932e95bb7a6561716f61500668daeec3f78d637a5ca7100467ec398455e6e3530fa1cad641f493cfdc1ee19585
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUb:GemTLkNdfE0pZaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

uzpCyZi.exe

Path C:\Windows\System\uzpCyZi.exe
Size 1.7MB
SHA256 1a1a14e36f22f0f001170fc904eb2040a2fb3e32ef2a66f2c07ee10a384850c2
MD5 3c293df5b9a0519b5a78652d9629e245
SHA1 3ad30d17b13369c91f11d26e018bbdfa251186ba
SHA512 852f754da3e0f5591a9746b8cf2698e560a8cf3ac30b04258574a0f175a3664cc96dfb51d3661460760c20cce63165fae5f981280f5845ba85233f81a34b3aea
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUuw:GemTLkNdfE0pZaL
MD5 SHA1 SHA512 SSDEEP

Submit Download

wGVkFVx.exe

Path C:\Windows\System\wGVkFVx.exe
Size 1.7MB
SHA256 569e2fb6f2e992f01c78942b8389cc0c18533d2705df2ec87487452f2d97e107
MD5 c4baad3f5010748e00437bb15bcf7d2f
SHA1 8e7c79273cf26e01876c87fe730c4552d7c2cb94
SHA512 3bd6c2c9ae7d80a46eae7fb192f00bca653f5b18ffc8ddd90940e5df87d41adb23afb7777f74c8e68188f006cb15bf180fdd64f627b5f005241981236eb89212
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUG:GemTLkNdfE0pZaS
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrVOpsN.exe

Path C:\Windows\System\wrVOpsN.exe
Size 1.7MB
SHA256 f1baa548b623aad144334b2524a5dfb65a387fa9051a34e63a6c58153a82e198
MD5 ba079a38d446557991c3451efb42a5de
SHA1 a40a3616ecb09946ff73f125e59979a9b1348a6a
SHA512 561faa736c6cc3085acaf36414311f8da229cdaf97c3fc78e69382b9be15a88ef4c87e44e380c047f81f0464eb0a70f5d049780ff4b79ca13fec590e2bc098f2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUq:GemTLkNdfE0pZa2
MD5 SHA1 SHA512 SSDEEP

Submit Download

wtZPpqE.exe

Path C:\Windows\System\wtZPpqE.exe
Size 1.7MB
SHA256 a1966fbef69af0f734c94a09338f145e030393288d4bd3d0023ca22bd19e4cb1
MD5 0c18c7fffa7005080f03784f202a49c5
SHA1 5c5ac9672b5b1265c4b22b6037ea63a47b261b49
SHA512 a987d7ad926cb8a4569542021420ee43f741d3c44c6c84ab0148056eeb0718744cac8958f334b6a5294b168d60051376ee12d0af0757c12ad7ace8d82df95979
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUI:GemTLkNdfE0pZaM
MD5 SHA1 SHA512 SSDEEP

Submit Download

zmMBlhg.exe

Path C:\Windows\System\zmMBlhg.exe
Size 1.7MB
SHA256 c7a370615298db6d0dbe54c58ed92aa08f10595e84ee426e484eab92274c5dec
MD5 355744d7f6bd11dbc85ff35034918f14
SHA1 812a950fd64d8c993f946ab79faa8159f175cf90
SHA512 7c6d8750ebbba9eb96996b07c1abd77529a0edf68931be7616277889de3d0481ccc052b5832aad28ca04283dd091ae10b0f141aa4cb4fece3eb5750439e184f3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIcuZaoV76AkZc2dUv:GemTLkNdfE0pZaL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/316-0-0x0000027D7B970000-0x0000027D7B980000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads