xmrig | 45d754fae57280fc7734294535fdd1fb9a12371d6031cf7e82298bfe17b1bf1b

Analysis

max time kernel
137s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
Size

1.2MB
MD5

3df8b51f12e62080a564e6a4a8a42f80
SHA1

3dced8ed13042e22b8457676943a7ce33d1af5da
SHA256

45d754fae57280fc7734294535fdd1fb9a12371d6031cf7e82298bfe17b1bf1b
SHA512

ecbf7f8e9794cca33b5e263d3742f1183134ea4c95433d0dba533373d03ddcf175901c0adfdfa094931c443cafb2ea6e6a4e165e1c32136f6ce4aa9351c87f33
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKensziRPVnrU292fFdUXM3:GezaTF8FcNkNdfE0pZ9oztFwIRmVIrf3

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/files/0x000600000002328f-4.dat	xmrig
behavioral2/files/0x0008000000023412-13.dat	xmrig
behavioral2/files/0x0007000000023414-29.dat	xmrig
behavioral2/files/0x000700000002341b-49.dat	xmrig
behavioral2/files/0x000700000002341e-66.dat	xmrig
behavioral2/files/0x0007000000023427-131.dat	xmrig
behavioral2/files/0x0007000000023433-171.dat	xmrig
behavioral2/files/0x000700000002342b-165.dat	xmrig
behavioral2/files/0x0007000000023436-185.dat	xmrig
behavioral2/files/0x0007000000023435-184.dat	xmrig
behavioral2/files/0x0007000000023434-180.dat	xmrig
behavioral2/files/0x000700000002342c-172.dat	xmrig
behavioral2/files/0x0007000000023432-170.dat	xmrig
behavioral2/files/0x000700000002342a-163.dat	xmrig
behavioral2/files/0x0007000000023431-160.dat	xmrig
behavioral2/files/0x0007000000023430-159.dat	xmrig
behavioral2/files/0x000700000002342f-154.dat	xmrig
behavioral2/files/0x0007000000023429-150.dat	xmrig
behavioral2/files/0x0007000000023428-142.dat	xmrig
behavioral2/files/0x000700000002342e-141.dat	xmrig
behavioral2/files/0x000700000002342d-128.dat	xmrig
behavioral2/files/0x0007000000023426-111.dat	xmrig
behavioral2/files/0x0007000000023425-104.dat	xmrig
behavioral2/files/0x0007000000023423-100.dat	xmrig
behavioral2/files/0x0007000000023422-89.dat	xmrig
behavioral2/files/0x0007000000023421-87.dat	xmrig
behavioral2/files/0x0007000000023420-85.dat	xmrig
behavioral2/files/0x000700000002341f-83.dat	xmrig
behavioral2/files/0x000700000002341d-79.dat	xmrig
behavioral2/files/0x0007000000023419-77.dat	xmrig
behavioral2/files/0x000700000002341c-75.dat	xmrig
behavioral2/files/0x000700000002341a-73.dat	xmrig
behavioral2/files/0x0007000000023418-54.dat	xmrig
behavioral2/files/0x0007000000023417-47.dat	xmrig
behavioral2/files/0x0007000000023416-42.dat	xmrig
behavioral2/files/0x0007000000023415-35.dat	xmrig
behavioral2/files/0x0007000000023413-19.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1144	eeLukPx.exe
4140	tXOLBiu.exe
4288	JBYKEjD.exe
3848	SlXkKBd.exe
668	SanNaIw.exe
4716	RrIErQo.exe
4004	NudstKE.exe
1420	bvQjhhf.exe
3076	NXXMdnS.exe
2076	sEaXPuu.exe
808	IXkrzaz.exe
3356	zJBnPRT.exe
3212	PUUmsfr.exe
4740	QhDVQNr.exe
1844	FMqtfVG.exe
4552	qaBDOeS.exe
1292	NgNpWqM.exe
1948	GzIhQsM.exe
2020	AwdIuYq.exe
4016	IwzjAOx.exe
4744	aGTORXO.exe
1164	itWaCyI.exe
3960	mLAfoew.exe
1392	nWnxECp.exe
4544	IKLluuV.exe
5096	kitQKAN.exe
1620	swKOfqi.exe
2376	tfQjCmu.exe
2724	pIIceEp.exe
3828	uQbYIju.exe
632	rauOhuM.exe
2092	DqTvbto.exe
1736	XjkDTxs.exe
5020	GGMlhJy.exe
1372	kZkFHwY.exe
1012	TveYPmF.exe
32	tCAvopu.exe
3492	BarrbPB.exe
3276	JwNtiLX.exe
64	SeIrQpt.exe
5056	VzRVRwd.exe
2988	OISerwy.exe
3404	QdMkexp.exe
2812	AAkmlCe.exe
3052	LFLcxqP.exe
4148	XtjykME.exe
3024	mbJgySL.exe
5000	THUUiNs.exe
4400	IXzGqpN.exe
1160	VpOBNsb.exe
836	wMePexo.exe
4940	MSxUYMd.exe
2104	GdSmzhX.exe
5024	YyGijyA.exe
5092	cdxoOxN.exe
3100	zitqjkz.exe
2244	ApUPZsc.exe
3796	WTuJlNf.exe
3008	jwblyNu.exe
3920	WJMjoMK.exe
4568	NouOZwP.exe
3140	VxkTgAh.exe
436	ElLeBGI.exe
3388	uFRUQGo.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hqwKpFd.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\ZkNDZvP.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\zsjDYcH.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\jwblyNu.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\BxMoJla.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\wSUffYy.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\khuwDhY.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\sVDKhuj.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\HPoXfgH.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\OJfKBZf.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\eKClRzX.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\lARRyKn.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\tfQjCmu.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\wMePexo.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\jcKVivS.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\WyVmidk.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\mxCgxFo.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\qgeCSTn.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\snhgylb.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\wtsjCdy.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\KgeZtvd.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\qKjmzuQ.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\npAmUGS.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\KDHHlAZ.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\nWnxECp.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\SlXkKBd.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\zKyDbMr.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\gDnhqAC.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\rOysNsC.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\VzjDVPQ.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\QsDbvaS.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\JBYKEjD.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\UcAaEyL.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\cIEyvqL.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\azdNxTo.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\Bcrhxhg.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\TxYZDih.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\SeIrQpt.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\mBJIqxs.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\qgcdIIs.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\gHauhfF.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\yHUDCuq.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\JmpkORz.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\lafUytV.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\JrLYMiZ.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\wHyavGr.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\rkMzAHL.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\NJQhQZG.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\ttVqzcD.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\WZmSTJa.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\CFTXlgz.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\FTxpFhU.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\iEgEdUW.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\zvKKdsV.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\cJTViGG.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\hzdzTNd.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\FRlgAah.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\gNKwVXi.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\KKXhHmE.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\voDKQFQ.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\YCBnZQU.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\ygSQxtY.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\msdSLrO.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
File created	C:\Windows\System\zkCPihr.exe	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17112	dwm.exe
Token: SeChangeNotifyPrivilege	17112	dwm.exe
Token: 33	17112	dwm.exe
Token: SeIncBasePriorityPrivilege	17112	dwm.exe
Token: SeCreateGlobalPrivilege	17504	dwm.exe
Token: SeChangeNotifyPrivilege	17504	dwm.exe
Token: 33	17504	dwm.exe
Token: SeIncBasePriorityPrivilege	17504	dwm.exe
Token: SeShutdownPrivilege	17504	dwm.exe
Token: SeCreatePagefilePrivilege	17504	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1144	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	85
PID 2228 wrote to memory of 1144	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	85
PID 2228 wrote to memory of 4288	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	86
PID 2228 wrote to memory of 4288	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	86
PID 2228 wrote to memory of 4140	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	87
PID 2228 wrote to memory of 4140	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	87
PID 2228 wrote to memory of 3848	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	88
PID 2228 wrote to memory of 3848	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	88
PID 2228 wrote to memory of 668	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	89
PID 2228 wrote to memory of 668	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	89
PID 2228 wrote to memory of 4716	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	90
PID 2228 wrote to memory of 4716	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	90
PID 2228 wrote to memory of 4004	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	91
PID 2228 wrote to memory of 4004	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	91
PID 2228 wrote to memory of 1420	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	92
PID 2228 wrote to memory of 1420	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	92
PID 2228 wrote to memory of 3076	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	93
PID 2228 wrote to memory of 3076	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	93
PID 2228 wrote to memory of 2076	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	94
PID 2228 wrote to memory of 2076	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	94
PID 2228 wrote to memory of 808	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	95
PID 2228 wrote to memory of 808	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	95
PID 2228 wrote to memory of 3356	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	96
PID 2228 wrote to memory of 3356	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	96
PID 2228 wrote to memory of 3212	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	97
PID 2228 wrote to memory of 3212	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	97
PID 2228 wrote to memory of 4740	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	98
PID 2228 wrote to memory of 4740	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	98
PID 2228 wrote to memory of 1844	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	99
PID 2228 wrote to memory of 1844	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	99
PID 2228 wrote to memory of 4552	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	100
PID 2228 wrote to memory of 4552	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	100
PID 2228 wrote to memory of 1292	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	101
PID 2228 wrote to memory of 1292	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	101
PID 2228 wrote to memory of 1948	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	102
PID 2228 wrote to memory of 1948	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	102
PID 2228 wrote to memory of 2020	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	103
PID 2228 wrote to memory of 2020	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	103
PID 2228 wrote to memory of 4016	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	104
PID 2228 wrote to memory of 4016	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	104
PID 2228 wrote to memory of 4744	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	105
PID 2228 wrote to memory of 4744	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	105
PID 2228 wrote to memory of 1164	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	106
PID 2228 wrote to memory of 1164	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	106
PID 2228 wrote to memory of 3960	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	107
PID 2228 wrote to memory of 3960	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	107
PID 2228 wrote to memory of 1392	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	108
PID 2228 wrote to memory of 1392	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	108
PID 2228 wrote to memory of 4544	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	109
PID 2228 wrote to memory of 4544	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	109
PID 2228 wrote to memory of 5096	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	110
PID 2228 wrote to memory of 5096	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	110
PID 2228 wrote to memory of 1620	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	111
PID 2228 wrote to memory of 1620	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	111
PID 2228 wrote to memory of 2376	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	112
PID 2228 wrote to memory of 2376	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	112
PID 2228 wrote to memory of 2724	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	113
PID 2228 wrote to memory of 2724	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	113
PID 2228 wrote to memory of 3828	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	114
PID 2228 wrote to memory of 3828	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	114
PID 2228 wrote to memory of 632	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	115
PID 2228 wrote to memory of 632	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	115
PID 2228 wrote to memory of 2092	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	116
PID 2228 wrote to memory of 2092	2228	3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3df8b51f12e62080a564e6a4a8a42f80_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\System\eeLukPx.exe
  C:\Windows\System\eeLukPx.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\JBYKEjD.exe
  C:\Windows\System\JBYKEjD.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\tXOLBiu.exe
  C:\Windows\System\tXOLBiu.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\SlXkKBd.exe
  C:\Windows\System\SlXkKBd.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\SanNaIw.exe
  C:\Windows\System\SanNaIw.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\RrIErQo.exe
  C:\Windows\System\RrIErQo.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\NudstKE.exe
  C:\Windows\System\NudstKE.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\bvQjhhf.exe
  C:\Windows\System\bvQjhhf.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\NXXMdnS.exe
  C:\Windows\System\NXXMdnS.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\sEaXPuu.exe
  C:\Windows\System\sEaXPuu.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\IXkrzaz.exe
  C:\Windows\System\IXkrzaz.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\zJBnPRT.exe
  C:\Windows\System\zJBnPRT.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\PUUmsfr.exe
  C:\Windows\System\PUUmsfr.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\QhDVQNr.exe
  C:\Windows\System\QhDVQNr.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\FMqtfVG.exe
  C:\Windows\System\FMqtfVG.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\qaBDOeS.exe
  C:\Windows\System\qaBDOeS.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\NgNpWqM.exe
  C:\Windows\System\NgNpWqM.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\GzIhQsM.exe
  C:\Windows\System\GzIhQsM.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\AwdIuYq.exe
  C:\Windows\System\AwdIuYq.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\IwzjAOx.exe
  C:\Windows\System\IwzjAOx.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\aGTORXO.exe
  C:\Windows\System\aGTORXO.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\itWaCyI.exe
  C:\Windows\System\itWaCyI.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\mLAfoew.exe
  C:\Windows\System\mLAfoew.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\nWnxECp.exe
  C:\Windows\System\nWnxECp.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\IKLluuV.exe
  C:\Windows\System\IKLluuV.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\kitQKAN.exe
  C:\Windows\System\kitQKAN.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\swKOfqi.exe
  C:\Windows\System\swKOfqi.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\tfQjCmu.exe
  C:\Windows\System\tfQjCmu.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\pIIceEp.exe
  C:\Windows\System\pIIceEp.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\uQbYIju.exe
  C:\Windows\System\uQbYIju.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\rauOhuM.exe
  C:\Windows\System\rauOhuM.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\DqTvbto.exe
  C:\Windows\System\DqTvbto.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\XjkDTxs.exe
  C:\Windows\System\XjkDTxs.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\GGMlhJy.exe
  C:\Windows\System\GGMlhJy.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\kZkFHwY.exe
  C:\Windows\System\kZkFHwY.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\TveYPmF.exe
  C:\Windows\System\TveYPmF.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\tCAvopu.exe
  C:\Windows\System\tCAvopu.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\BarrbPB.exe
  C:\Windows\System\BarrbPB.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\JwNtiLX.exe
  C:\Windows\System\JwNtiLX.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\SeIrQpt.exe
  C:\Windows\System\SeIrQpt.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\VzRVRwd.exe
  C:\Windows\System\VzRVRwd.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\OISerwy.exe
  C:\Windows\System\OISerwy.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\QdMkexp.exe
  C:\Windows\System\QdMkexp.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\AAkmlCe.exe
  C:\Windows\System\AAkmlCe.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\LFLcxqP.exe
  C:\Windows\System\LFLcxqP.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\XtjykME.exe
  C:\Windows\System\XtjykME.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\mbJgySL.exe
  C:\Windows\System\mbJgySL.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\THUUiNs.exe
  C:\Windows\System\THUUiNs.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\IXzGqpN.exe
  C:\Windows\System\IXzGqpN.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\VpOBNsb.exe
  C:\Windows\System\VpOBNsb.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\wMePexo.exe
  C:\Windows\System\wMePexo.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\MSxUYMd.exe
  C:\Windows\System\MSxUYMd.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\GdSmzhX.exe
  C:\Windows\System\GdSmzhX.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\YyGijyA.exe
  C:\Windows\System\YyGijyA.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\cdxoOxN.exe
  C:\Windows\System\cdxoOxN.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\zitqjkz.exe
  C:\Windows\System\zitqjkz.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\ApUPZsc.exe
  C:\Windows\System\ApUPZsc.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\WTuJlNf.exe
  C:\Windows\System\WTuJlNf.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\jwblyNu.exe
  C:\Windows\System\jwblyNu.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\WJMjoMK.exe
  C:\Windows\System\WJMjoMK.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\uFRUQGo.exe
  C:\Windows\System\uFRUQGo.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\Htsohey.exe
  C:\Windows\System\Htsohey.exe
  2⤵
  PID:2172
- C:\Windows\System\NouOZwP.exe
  C:\Windows\System\NouOZwP.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\VxkTgAh.exe
  C:\Windows\System\VxkTgAh.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\ElLeBGI.exe
  C:\Windows\System\ElLeBGI.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\khuwDhY.exe
  C:\Windows\System\khuwDhY.exe
  2⤵
  PID:4464
- C:\Windows\System\hpgNPpu.exe
  C:\Windows\System\hpgNPpu.exe
  2⤵
  PID:3036
- C:\Windows\System\BaJeoZL.exe
  C:\Windows\System\BaJeoZL.exe
  2⤵
  PID:1092
- C:\Windows\System\HYhUvcj.exe
  C:\Windows\System\HYhUvcj.exe
  2⤵
  PID:4480
- C:\Windows\System\JSKBaZg.exe
  C:\Windows\System\JSKBaZg.exe
  2⤵
  PID:2088
- C:\Windows\System\gKifgNq.exe
  C:\Windows\System\gKifgNq.exe
  2⤵
  PID:2460
- C:\Windows\System\bmflXOp.exe
  C:\Windows\System\bmflXOp.exe
  2⤵
  PID:2912
- C:\Windows\System\GyOZoUm.exe
  C:\Windows\System\GyOZoUm.exe
  2⤵
  PID:4492
- C:\Windows\System\tOtanla.exe
  C:\Windows\System\tOtanla.exe
  2⤵
  PID:2888
- C:\Windows\System\eRCzaPm.exe
  C:\Windows\System\eRCzaPm.exe
  2⤵
  PID:2464
- C:\Windows\System\AIifeId.exe
  C:\Windows\System\AIifeId.exe
  2⤵
  PID:4960
- C:\Windows\System\RBSaJhv.exe
  C:\Windows\System\RBSaJhv.exe
  2⤵
  PID:5064
- C:\Windows\System\rkMzAHL.exe
  C:\Windows\System\rkMzAHL.exe
  2⤵
  PID:4472
- C:\Windows\System\NlxveQr.exe
  C:\Windows\System\NlxveQr.exe
  2⤵
  PID:3456
- C:\Windows\System\FPSdObw.exe
  C:\Windows\System\FPSdObw.exe
  2⤵
  PID:4968
- C:\Windows\System\NapdIoR.exe
  C:\Windows\System\NapdIoR.exe
  2⤵
  PID:4912
- C:\Windows\System\eLBnqVr.exe
  C:\Windows\System\eLBnqVr.exe
  2⤵
  PID:2708
- C:\Windows\System\OorYSUV.exe
  C:\Windows\System\OorYSUV.exe
  2⤵
  PID:3680
- C:\Windows\System\yzgbguE.exe
  C:\Windows\System\yzgbguE.exe
  2⤵
  PID:2336
- C:\Windows\System\frXcHfs.exe
  C:\Windows\System\frXcHfs.exe
  2⤵
  PID:3124
- C:\Windows\System\MzoMNqP.exe
  C:\Windows\System\MzoMNqP.exe
  2⤵
  PID:4596
- C:\Windows\System\wOKspwx.exe
  C:\Windows\System\wOKspwx.exe
  2⤵
  PID:1568
- C:\Windows\System\zcEHIWU.exe
  C:\Windows\System\zcEHIWU.exe
  2⤵
  PID:384
- C:\Windows\System\kpvGHET.exe
  C:\Windows\System\kpvGHET.exe
  2⤵
  PID:512
- C:\Windows\System\yRcEpjb.exe
  C:\Windows\System\yRcEpjb.exe
  2⤵
  PID:2688
- C:\Windows\System\rCbEnoX.exe
  C:\Windows\System\rCbEnoX.exe
  2⤵
  PID:1720
- C:\Windows\System\NWzgbpU.exe
  C:\Windows\System\NWzgbpU.exe
  2⤵
  PID:1648
- C:\Windows\System\ssJVNNG.exe
  C:\Windows\System\ssJVNNG.exe
  2⤵
  PID:4144
- C:\Windows\System\AKsiwmK.exe
  C:\Windows\System\AKsiwmK.exe
  2⤵
  PID:4736
- C:\Windows\System\NDpAcIw.exe
  C:\Windows\System\NDpAcIw.exe
  2⤵
  PID:212
- C:\Windows\System\VpZtNxN.exe
  C:\Windows\System\VpZtNxN.exe
  2⤵
  PID:3620
- C:\Windows\System\jJxsPdN.exe
  C:\Windows\System\jJxsPdN.exe
  2⤵
  PID:5132
- C:\Windows\System\ofiGrEP.exe
  C:\Windows\System\ofiGrEP.exe
  2⤵
  PID:5168
- C:\Windows\System\OopRxYJ.exe
  C:\Windows\System\OopRxYJ.exe
  2⤵
  PID:5192
- C:\Windows\System\fgjngla.exe
  C:\Windows\System\fgjngla.exe
  2⤵
  PID:5228
- C:\Windows\System\HOvzvpv.exe
  C:\Windows\System\HOvzvpv.exe
  2⤵
  PID:5256
- C:\Windows\System\voDKQFQ.exe
  C:\Windows\System\voDKQFQ.exe
  2⤵
  PID:5276
- C:\Windows\System\gNKwVXi.exe
  C:\Windows\System\gNKwVXi.exe
  2⤵
  PID:5328
- C:\Windows\System\ouRsFXS.exe
  C:\Windows\System\ouRsFXS.exe
  2⤵
  PID:5348
- C:\Windows\System\dssFQIR.exe
  C:\Windows\System\dssFQIR.exe
  2⤵
  PID:5380
- C:\Windows\System\sVDKhuj.exe
  C:\Windows\System\sVDKhuj.exe
  2⤵
  PID:5412
- C:\Windows\System\CijtnVl.exe
  C:\Windows\System\CijtnVl.exe
  2⤵
  PID:5452
- C:\Windows\System\wdSmdcx.exe
  C:\Windows\System\wdSmdcx.exe
  2⤵
  PID:5492
- C:\Windows\System\jKsfttD.exe
  C:\Windows\System\jKsfttD.exe
  2⤵
  PID:5520
- C:\Windows\System\xJEjMFB.exe
  C:\Windows\System\xJEjMFB.exe
  2⤵
  PID:5544
- C:\Windows\System\ogWULxP.exe
  C:\Windows\System\ogWULxP.exe
  2⤵
  PID:5568
- C:\Windows\System\rCanodc.exe
  C:\Windows\System\rCanodc.exe
  2⤵
  PID:5596
- C:\Windows\System\aosMisw.exe
  C:\Windows\System\aosMisw.exe
  2⤵
  PID:5620
- C:\Windows\System\rNHGiXx.exe
  C:\Windows\System\rNHGiXx.exe
  2⤵
  PID:5648
- C:\Windows\System\lsUyNzs.exe
  C:\Windows\System\lsUyNzs.exe
  2⤵
  PID:5664
- C:\Windows\System\kfniusa.exe
  C:\Windows\System\kfniusa.exe
  2⤵
  PID:5684
- C:\Windows\System\UPnFbUD.exe
  C:\Windows\System\UPnFbUD.exe
  2⤵
  PID:5712
- C:\Windows\System\UDyatWR.exe
  C:\Windows\System\UDyatWR.exe
  2⤵
  PID:5736
- C:\Windows\System\ymrDjak.exe
  C:\Windows\System\ymrDjak.exe
  2⤵
  PID:5772
- C:\Windows\System\ehdYPCZ.exe
  C:\Windows\System\ehdYPCZ.exe
  2⤵
  PID:5804
- C:\Windows\System\vFRgOcz.exe
  C:\Windows\System\vFRgOcz.exe
  2⤵
  PID:5824
- C:\Windows\System\hUaFqbj.exe
  C:\Windows\System\hUaFqbj.exe
  2⤵
  PID:5848
- C:\Windows\System\bsuUSWV.exe
  C:\Windows\System\bsuUSWV.exe
  2⤵
  PID:5876
- C:\Windows\System\lafUytV.exe
  C:\Windows\System\lafUytV.exe
  2⤵
  PID:5896
- C:\Windows\System\XuFrPxV.exe
  C:\Windows\System\XuFrPxV.exe
  2⤵
  PID:5928
- C:\Windows\System\EtZGmvS.exe
  C:\Windows\System\EtZGmvS.exe
  2⤵
  PID:5948
- C:\Windows\System\VsvJLKm.exe
  C:\Windows\System\VsvJLKm.exe
  2⤵
  PID:5976
- C:\Windows\System\AmXWonJ.exe
  C:\Windows\System\AmXWonJ.exe
  2⤵
  PID:6004
- C:\Windows\System\KKXhHmE.exe
  C:\Windows\System\KKXhHmE.exe
  2⤵
  PID:6032
- C:\Windows\System\AmjDcam.exe
  C:\Windows\System\AmjDcam.exe
  2⤵
  PID:6060
- C:\Windows\System\aofNZKv.exe
  C:\Windows\System\aofNZKv.exe
  2⤵
  PID:6092
- C:\Windows\System\HPoXfgH.exe
  C:\Windows\System\HPoXfgH.exe
  2⤵
  PID:6124
- C:\Windows\System\iCGAzLq.exe
  C:\Windows\System\iCGAzLq.exe
  2⤵
  PID:4416
- C:\Windows\System\RULuuvJ.exe
  C:\Windows\System\RULuuvJ.exe
  2⤵
  PID:2756
- C:\Windows\System\LJfacTW.exe
  C:\Windows\System\LJfacTW.exe
  2⤵
  PID:3972
- C:\Windows\System\ThwxzZW.exe
  C:\Windows\System\ThwxzZW.exe
  2⤵
  PID:5180
- C:\Windows\System\CQmpoTP.exe
  C:\Windows\System\CQmpoTP.exe
  2⤵
  PID:5264
- C:\Windows\System\DeXehCC.exe
  C:\Windows\System\DeXehCC.exe
  2⤵
  PID:5368
- C:\Windows\System\YcOlgOY.exe
  C:\Windows\System\YcOlgOY.exe
  2⤵
  PID:5424
- C:\Windows\System\wSUffYy.exe
  C:\Windows\System\wSUffYy.exe
  2⤵
  PID:5504
- C:\Windows\System\wKHcspb.exe
  C:\Windows\System\wKHcspb.exe
  2⤵
  PID:5576
- C:\Windows\System\QZUYVaZ.exe
  C:\Windows\System\QZUYVaZ.exe
  2⤵
  PID:5588
- C:\Windows\System\xCwJxTS.exe
  C:\Windows\System\xCwJxTS.exe
  2⤵
  PID:5676
- C:\Windows\System\dBFJxuV.exe
  C:\Windows\System\dBFJxuV.exe
  2⤵
  PID:5700
- C:\Windows\System\lSRMmPc.exe
  C:\Windows\System\lSRMmPc.exe
  2⤵
  PID:5812
- C:\Windows\System\yHUDCuq.exe
  C:\Windows\System\yHUDCuq.exe
  2⤵
  PID:5844
- C:\Windows\System\OwbWUrR.exe
  C:\Windows\System\OwbWUrR.exe
  2⤵
  PID:5884
- C:\Windows\System\wMYyefh.exe
  C:\Windows\System\wMYyefh.exe
  2⤵
  PID:5936
- C:\Windows\System\BPavJMj.exe
  C:\Windows\System\BPavJMj.exe
  2⤵
  PID:6000
- C:\Windows\System\mgplCPD.exe
  C:\Windows\System\mgplCPD.exe
  2⤵
  PID:6100
- C:\Windows\System\VEgjCnZ.exe
  C:\Windows\System\VEgjCnZ.exe
  2⤵
  PID:6140
- C:\Windows\System\ojrDslb.exe
  C:\Windows\System\ojrDslb.exe
  2⤵
  PID:4672
- C:\Windows\System\LaAzsic.exe
  C:\Windows\System\LaAzsic.exe
  2⤵
  PID:5396
- C:\Windows\System\WQRlAFh.exe
  C:\Windows\System\WQRlAFh.exe
  2⤵
  PID:5448
- C:\Windows\System\zlHHFkU.exe
  C:\Windows\System\zlHHFkU.exe
  2⤵
  PID:5660
- C:\Windows\System\vQOQptw.exe
  C:\Windows\System\vQOQptw.exe
  2⤵
  PID:5984
- C:\Windows\System\PMIPkFm.exe
  C:\Windows\System\PMIPkFm.exe
  2⤵
  PID:5720
- C:\Windows\System\snhgylb.exe
  C:\Windows\System\snhgylb.exe
  2⤵
  PID:6116
- C:\Windows\System\eKUCgqN.exe
  C:\Windows\System\eKUCgqN.exe
  2⤵
  PID:5156
- C:\Windows\System\RJiBznz.exe
  C:\Windows\System\RJiBznz.exe
  2⤵
  PID:5252
- C:\Windows\System\qKjmzuQ.exe
  C:\Windows\System\qKjmzuQ.exe
  2⤵
  PID:6168
- C:\Windows\System\fgmwkCd.exe
  C:\Windows\System\fgmwkCd.exe
  2⤵
  PID:6224
- C:\Windows\System\GbXwWfm.exe
  C:\Windows\System\GbXwWfm.exe
  2⤵
  PID:6256
- C:\Windows\System\TPcTyCy.exe
  C:\Windows\System\TPcTyCy.exe
  2⤵
  PID:6292
- C:\Windows\System\fLZoQjw.exe
  C:\Windows\System\fLZoQjw.exe
  2⤵
  PID:6320
- C:\Windows\System\EaqtXLR.exe
  C:\Windows\System\EaqtXLR.exe
  2⤵
  PID:6348
- C:\Windows\System\OJfKBZf.exe
  C:\Windows\System\OJfKBZf.exe
  2⤵
  PID:6372
- C:\Windows\System\YCBnZQU.exe
  C:\Windows\System\YCBnZQU.exe
  2⤵
  PID:6396
- C:\Windows\System\JXoFpJz.exe
  C:\Windows\System\JXoFpJz.exe
  2⤵
  PID:6420
- C:\Windows\System\OWiLhWl.exe
  C:\Windows\System\OWiLhWl.exe
  2⤵
  PID:6444
- C:\Windows\System\pbZcjAq.exe
  C:\Windows\System\pbZcjAq.exe
  2⤵
  PID:6468
- C:\Windows\System\nowKXaH.exe
  C:\Windows\System\nowKXaH.exe
  2⤵
  PID:6492
- C:\Windows\System\FEzAwTK.exe
  C:\Windows\System\FEzAwTK.exe
  2⤵
  PID:6520
- C:\Windows\System\qgUwOvg.exe
  C:\Windows\System\qgUwOvg.exe
  2⤵
  PID:6548
- C:\Windows\System\JAbntpp.exe
  C:\Windows\System\JAbntpp.exe
  2⤵
  PID:6576
- C:\Windows\System\gGzklcj.exe
  C:\Windows\System\gGzklcj.exe
  2⤵
  PID:6592
- C:\Windows\System\DUWBfTe.exe
  C:\Windows\System\DUWBfTe.exe
  2⤵
  PID:6612
- C:\Windows\System\GBlVSNY.exe
  C:\Windows\System\GBlVSNY.exe
  2⤵
  PID:6636
- C:\Windows\System\boLjHvI.exe
  C:\Windows\System\boLjHvI.exe
  2⤵
  PID:6660
- C:\Windows\System\TomrLuW.exe
  C:\Windows\System\TomrLuW.exe
  2⤵
  PID:6680
- C:\Windows\System\OSHqaVE.exe
  C:\Windows\System\OSHqaVE.exe
  2⤵
  PID:6708
- C:\Windows\System\HbBJAQF.exe
  C:\Windows\System\HbBJAQF.exe
  2⤵
  PID:6736
- C:\Windows\System\PZJvBDw.exe
  C:\Windows\System\PZJvBDw.exe
  2⤵
  PID:6764
- C:\Windows\System\lsrCKmo.exe
  C:\Windows\System\lsrCKmo.exe
  2⤵
  PID:6792
- C:\Windows\System\eoZFwFt.exe
  C:\Windows\System\eoZFwFt.exe
  2⤵
  PID:6820
- C:\Windows\System\RWVIWkz.exe
  C:\Windows\System\RWVIWkz.exe
  2⤵
  PID:6848
- C:\Windows\System\jRWMeNL.exe
  C:\Windows\System\jRWMeNL.exe
  2⤵
  PID:6876
- C:\Windows\System\rgSwEbO.exe
  C:\Windows\System\rgSwEbO.exe
  2⤵
  PID:6908
- C:\Windows\System\NnLEQmS.exe
  C:\Windows\System\NnLEQmS.exe
  2⤵
  PID:6940
- C:\Windows\System\YzPIlot.exe
  C:\Windows\System\YzPIlot.exe
  2⤵
  PID:6968
- C:\Windows\System\DCsplty.exe
  C:\Windows\System\DCsplty.exe
  2⤵
  PID:6992
- C:\Windows\System\swhaSYs.exe
  C:\Windows\System\swhaSYs.exe
  2⤵
  PID:7008
- C:\Windows\System\HritTry.exe
  C:\Windows\System\HritTry.exe
  2⤵
  PID:7028
- C:\Windows\System\VQWoxpU.exe
  C:\Windows\System\VQWoxpU.exe
  2⤵
  PID:7052
- C:\Windows\System\REdiKCQ.exe
  C:\Windows\System\REdiKCQ.exe
  2⤵
  PID:7080
- C:\Windows\System\HiLtElm.exe
  C:\Windows\System\HiLtElm.exe
  2⤵
  PID:7108
- C:\Windows\System\KJVqCVJ.exe
  C:\Windows\System\KJVqCVJ.exe
  2⤵
  PID:7136
- C:\Windows\System\MVJPTFe.exe
  C:\Windows\System\MVJPTFe.exe
  2⤵
  PID:5872
- C:\Windows\System\ZSlFdTM.exe
  C:\Windows\System\ZSlFdTM.exe
  2⤵
  PID:5996
- C:\Windows\System\leeOjzY.exe
  C:\Windows\System\leeOjzY.exe
  2⤵
  PID:5672
- C:\Windows\System\qQBNKyS.exe
  C:\Windows\System\qQBNKyS.exe
  2⤵
  PID:6148
- C:\Windows\System\iiLofKW.exe
  C:\Windows\System\iiLofKW.exe
  2⤵
  PID:6344
- C:\Windows\System\kLIxqUX.exe
  C:\Windows\System\kLIxqUX.exe
  2⤵
  PID:6272
- C:\Windows\System\zvKKdsV.exe
  C:\Windows\System\zvKKdsV.exe
  2⤵
  PID:6384
- C:\Windows\System\hgtvmwS.exe
  C:\Windows\System\hgtvmwS.exe
  2⤵
  PID:6480
- C:\Windows\System\hlMcbmV.exe
  C:\Windows\System\hlMcbmV.exe
  2⤵
  PID:6508
- C:\Windows\System\LJviGvL.exe
  C:\Windows\System\LJviGvL.exe
  2⤵
  PID:6484
- C:\Windows\System\abrrAoP.exe
  C:\Windows\System\abrrAoP.exe
  2⤵
  PID:6628
- C:\Windows\System\bZILmfJ.exe
  C:\Windows\System\bZILmfJ.exe
  2⤵
  PID:6588
- C:\Windows\System\YDhsiZQ.exe
  C:\Windows\System\YDhsiZQ.exe
  2⤵
  PID:6648
- C:\Windows\System\CwqWyAJ.exe
  C:\Windows\System\CwqWyAJ.exe
  2⤵
  PID:6788
- C:\Windows\System\kDZNtdP.exe
  C:\Windows\System\kDZNtdP.exe
  2⤵
  PID:6872
- C:\Windows\System\cBasuBP.exe
  C:\Windows\System\cBasuBP.exe
  2⤵
  PID:6860
- C:\Windows\System\jjXRbdC.exe
  C:\Windows\System\jjXRbdC.exe
  2⤵
  PID:6832
- C:\Windows\System\SFnncPT.exe
  C:\Windows\System\SFnncPT.exe
  2⤵
  PID:6924
- C:\Windows\System\CHoZaah.exe
  C:\Windows\System\CHoZaah.exe
  2⤵
  PID:7076
- C:\Windows\System\JmpkORz.exe
  C:\Windows\System\JmpkORz.exe
  2⤵
  PID:6332
- C:\Windows\System\WcFFFRX.exe
  C:\Windows\System\WcFFFRX.exe
  2⤵
  PID:6504
- C:\Windows\System\glBhGyo.exe
  C:\Windows\System\glBhGyo.exe
  2⤵
  PID:6020
- C:\Windows\System\poFUkhH.exe
  C:\Windows\System\poFUkhH.exe
  2⤵
  PID:6416
- C:\Windows\System\bBVOVcX.exe
  C:\Windows\System\bBVOVcX.exe
  2⤵
  PID:6532
- C:\Windows\System\rvCNaxL.exe
  C:\Windows\System\rvCNaxL.exe
  2⤵
  PID:6952
- C:\Windows\System\asbHetR.exe
  C:\Windows\System\asbHetR.exe
  2⤵
  PID:6844
- C:\Windows\System\lFtWbXU.exe
  C:\Windows\System\lFtWbXU.exe
  2⤵
  PID:6960
- C:\Windows\System\ANpCpXS.exe
  C:\Windows\System\ANpCpXS.exe
  2⤵
  PID:7184
- C:\Windows\System\buMAgDj.exe
  C:\Windows\System\buMAgDj.exe
  2⤵
  PID:7204
- C:\Windows\System\rfgkLUX.exe
  C:\Windows\System\rfgkLUX.exe
  2⤵
  PID:7232
- C:\Windows\System\BqpFlSj.exe
  C:\Windows\System\BqpFlSj.exe
  2⤵
  PID:7252
- C:\Windows\System\HtxeAdt.exe
  C:\Windows\System\HtxeAdt.exe
  2⤵
  PID:7276
- C:\Windows\System\NuOoeWk.exe
  C:\Windows\System\NuOoeWk.exe
  2⤵
  PID:7308
- C:\Windows\System\wPQJraK.exe
  C:\Windows\System\wPQJraK.exe
  2⤵
  PID:7336
- C:\Windows\System\UiXTpzG.exe
  C:\Windows\System\UiXTpzG.exe
  2⤵
  PID:7364
- C:\Windows\System\sgbBHaI.exe
  C:\Windows\System\sgbBHaI.exe
  2⤵
  PID:7388
- C:\Windows\System\SsjJotf.exe
  C:\Windows\System\SsjJotf.exe
  2⤵
  PID:7412
- C:\Windows\System\NYwEWhf.exe
  C:\Windows\System\NYwEWhf.exe
  2⤵
  PID:7440
- C:\Windows\System\uGaFRov.exe
  C:\Windows\System\uGaFRov.exe
  2⤵
  PID:7456
- C:\Windows\System\MqJamvG.exe
  C:\Windows\System\MqJamvG.exe
  2⤵
  PID:7484
- C:\Windows\System\eVcgkNF.exe
  C:\Windows\System\eVcgkNF.exe
  2⤵
  PID:7516
- C:\Windows\System\hqwKpFd.exe
  C:\Windows\System\hqwKpFd.exe
  2⤵
  PID:7540
- C:\Windows\System\JPJGdxr.exe
  C:\Windows\System\JPJGdxr.exe
  2⤵
  PID:7564
- C:\Windows\System\rGAaJvm.exe
  C:\Windows\System\rGAaJvm.exe
  2⤵
  PID:7592
- C:\Windows\System\mONNplH.exe
  C:\Windows\System\mONNplH.exe
  2⤵
  PID:7620
- C:\Windows\System\CdUasCM.exe
  C:\Windows\System\CdUasCM.exe
  2⤵
  PID:7648
- C:\Windows\System\lCxEwEM.exe
  C:\Windows\System\lCxEwEM.exe
  2⤵
  PID:7672
- C:\Windows\System\KGQYoJG.exe
  C:\Windows\System\KGQYoJG.exe
  2⤵
  PID:7696
- C:\Windows\System\ZClDjyy.exe
  C:\Windows\System\ZClDjyy.exe
  2⤵
  PID:7728
- C:\Windows\System\brQqkZf.exe
  C:\Windows\System\brQqkZf.exe
  2⤵
  PID:7760
- C:\Windows\System\msDXoZj.exe
  C:\Windows\System\msDXoZj.exe
  2⤵
  PID:7788
- C:\Windows\System\IJWxnfJ.exe
  C:\Windows\System\IJWxnfJ.exe
  2⤵
  PID:7808
- C:\Windows\System\uQBghUj.exe
  C:\Windows\System\uQBghUj.exe
  2⤵
  PID:7824
- C:\Windows\System\hvFmVzS.exe
  C:\Windows\System\hvFmVzS.exe
  2⤵
  PID:7848
- C:\Windows\System\dOhQEOu.exe
  C:\Windows\System\dOhQEOu.exe
  2⤵
  PID:7872
- C:\Windows\System\UgneNKL.exe
  C:\Windows\System\UgneNKL.exe
  2⤵
  PID:7896
- C:\Windows\System\jjgVRzd.exe
  C:\Windows\System\jjgVRzd.exe
  2⤵
  PID:7920
- C:\Windows\System\BPJsRoh.exe
  C:\Windows\System\BPJsRoh.exe
  2⤵
  PID:7952
- C:\Windows\System\RHdQoAU.exe
  C:\Windows\System\RHdQoAU.exe
  2⤵
  PID:7984
- C:\Windows\System\zKyDbMr.exe
  C:\Windows\System\zKyDbMr.exe
  2⤵
  PID:8004
- C:\Windows\System\IuDHRfu.exe
  C:\Windows\System\IuDHRfu.exe
  2⤵
  PID:8024
- C:\Windows\System\YUVleQZ.exe
  C:\Windows\System\YUVleQZ.exe
  2⤵
  PID:8052
- C:\Windows\System\bbullCe.exe
  C:\Windows\System\bbullCe.exe
  2⤵
  PID:8084
- C:\Windows\System\qJeNImo.exe
  C:\Windows\System\qJeNImo.exe
  2⤵
  PID:8108
- C:\Windows\System\ygSQxtY.exe
  C:\Windows\System\ygSQxtY.exe
  2⤵
  PID:8128
- C:\Windows\System\udKvbfg.exe
  C:\Windows\System\udKvbfg.exe
  2⤵
  PID:8152
- C:\Windows\System\gDnhqAC.exe
  C:\Windows\System\gDnhqAC.exe
  2⤵
  PID:8180
- C:\Windows\System\AztYYVY.exe
  C:\Windows\System\AztYYVY.exe
  2⤵
  PID:5580
- C:\Windows\System\OaFDgIS.exe
  C:\Windows\System\OaFDgIS.exe
  2⤵
  PID:6600
- C:\Windows\System\pfwqvcq.exe
  C:\Windows\System\pfwqvcq.exe
  2⤵
  PID:7024
- C:\Windows\System\NOtFLNy.exe
  C:\Windows\System\NOtFLNy.exe
  2⤵
  PID:7248
- C:\Windows\System\WrmQwti.exe
  C:\Windows\System\WrmQwti.exe
  2⤵
  PID:7356
- C:\Windows\System\IjMUivz.exe
  C:\Windows\System\IjMUivz.exe
  2⤵
  PID:7216
- C:\Windows\System\lvGbojq.exe
  C:\Windows\System\lvGbojq.exe
  2⤵
  PID:7472
- C:\Windows\System\kZKeJxQ.exe
  C:\Windows\System\kZKeJxQ.exe
  2⤵
  PID:7176
- C:\Windows\System\FzElSMg.exe
  C:\Windows\System\FzElSMg.exe
  2⤵
  PID:7400
- C:\Windows\System\GBJTweb.exe
  C:\Windows\System\GBJTweb.exe
  2⤵
  PID:7660
- C:\Windows\System\weGLbIN.exe
  C:\Windows\System\weGLbIN.exe
  2⤵
  PID:7552
- C:\Windows\System\cpSzADc.exe
  C:\Windows\System\cpSzADc.exe
  2⤵
  PID:7632
- C:\Windows\System\QPBPawq.exe
  C:\Windows\System\QPBPawq.exe
  2⤵
  PID:7932
- C:\Windows\System\KJICJbu.exe
  C:\Windows\System\KJICJbu.exe
  2⤵
  PID:7556
- C:\Windows\System\msdSLrO.exe
  C:\Windows\System\msdSLrO.exe
  2⤵
  PID:7856
- C:\Windows\System\RjooAGQ.exe
  C:\Windows\System\RjooAGQ.exe
  2⤵
  PID:8140
- C:\Windows\System\mBJIqxs.exe
  C:\Windows\System\mBJIqxs.exe
  2⤵
  PID:7860
- C:\Windows\System\cpCqytF.exe
  C:\Windows\System\cpCqytF.exe
  2⤵
  PID:7104
- C:\Windows\System\mRhHCrp.exe
  C:\Windows\System\mRhHCrp.exe
  2⤵
  PID:8120
- C:\Windows\System\azhsUOb.exe
  C:\Windows\System\azhsUOb.exe
  2⤵
  PID:8048
- C:\Windows\System\BTwUBBA.exe
  C:\Windows\System\BTwUBBA.exe
  2⤵
  PID:7272
- C:\Windows\System\KJkauqV.exe
  C:\Windows\System\KJkauqV.exe
  2⤵
  PID:5628
- C:\Windows\System\JcODkdf.exe
  C:\Windows\System\JcODkdf.exe
  2⤵
  PID:7604
- C:\Windows\System\yiOwiLy.exe
  C:\Windows\System\yiOwiLy.exe
  2⤵
  PID:7688
- C:\Windows\System\ObHXccB.exe
  C:\Windows\System\ObHXccB.exe
  2⤵
  PID:7972
- C:\Windows\System\cwMpEmA.exe
  C:\Windows\System\cwMpEmA.exe
  2⤵
  PID:8012
- C:\Windows\System\tTTViEU.exe
  C:\Windows\System\tTTViEU.exe
  2⤵
  PID:8220
- C:\Windows\System\rOysNsC.exe
  C:\Windows\System\rOysNsC.exe
  2⤵
  PID:8244
- C:\Windows\System\QrbfQki.exe
  C:\Windows\System\QrbfQki.exe
  2⤵
  PID:8268
- C:\Windows\System\cIKKfJp.exe
  C:\Windows\System\cIKKfJp.exe
  2⤵
  PID:8288
- C:\Windows\System\AIeXeNv.exe
  C:\Windows\System\AIeXeNv.exe
  2⤵
  PID:8308
- C:\Windows\System\JHrQPJI.exe
  C:\Windows\System\JHrQPJI.exe
  2⤵
  PID:8336
- C:\Windows\System\alTQdYi.exe
  C:\Windows\System\alTQdYi.exe
  2⤵
  PID:8356
- C:\Windows\System\rXqmHLC.exe
  C:\Windows\System\rXqmHLC.exe
  2⤵
  PID:8380
- C:\Windows\System\bXZOQxM.exe
  C:\Windows\System\bXZOQxM.exe
  2⤵
  PID:8408
- C:\Windows\System\UudzMjZ.exe
  C:\Windows\System\UudzMjZ.exe
  2⤵
  PID:8432
- C:\Windows\System\npAmUGS.exe
  C:\Windows\System\npAmUGS.exe
  2⤵
  PID:8460
- C:\Windows\System\VMJkUoU.exe
  C:\Windows\System\VMJkUoU.exe
  2⤵
  PID:8484
- C:\Windows\System\YnqVZJb.exe
  C:\Windows\System\YnqVZJb.exe
  2⤵
  PID:8516
- C:\Windows\System\gkxWAxT.exe
  C:\Windows\System\gkxWAxT.exe
  2⤵
  PID:8540
- C:\Windows\System\qzGKhQY.exe
  C:\Windows\System\qzGKhQY.exe
  2⤵
  PID:8568
- C:\Windows\System\sQgnjAi.exe
  C:\Windows\System\sQgnjAi.exe
  2⤵
  PID:8592
- C:\Windows\System\LPUWdLE.exe
  C:\Windows\System\LPUWdLE.exe
  2⤵
  PID:8608
- C:\Windows\System\CckoKeE.exe
  C:\Windows\System\CckoKeE.exe
  2⤵
  PID:8636
- C:\Windows\System\mSsPOTL.exe
  C:\Windows\System\mSsPOTL.exe
  2⤵
  PID:8668
- C:\Windows\System\rfFFEkK.exe
  C:\Windows\System\rfFFEkK.exe
  2⤵
  PID:8688
- C:\Windows\System\ykmZkMI.exe
  C:\Windows\System\ykmZkMI.exe
  2⤵
  PID:8716
- C:\Windows\System\jcKVivS.exe
  C:\Windows\System\jcKVivS.exe
  2⤵
  PID:8748
- C:\Windows\System\pJfxLpD.exe
  C:\Windows\System\pJfxLpD.exe
  2⤵
  PID:8772
- C:\Windows\System\MnQmwDD.exe
  C:\Windows\System\MnQmwDD.exe
  2⤵
  PID:8800
- C:\Windows\System\fWexHsl.exe
  C:\Windows\System\fWexHsl.exe
  2⤵
  PID:8832
- C:\Windows\System\JmQcASL.exe
  C:\Windows\System\JmQcASL.exe
  2⤵
  PID:8864
- C:\Windows\System\cyxfJNM.exe
  C:\Windows\System\cyxfJNM.exe
  2⤵
  PID:8884
- C:\Windows\System\FDGuuSM.exe
  C:\Windows\System\FDGuuSM.exe
  2⤵
  PID:8912
- C:\Windows\System\qneqScK.exe
  C:\Windows\System\qneqScK.exe
  2⤵
  PID:8936
- C:\Windows\System\PCLrJTs.exe
  C:\Windows\System\PCLrJTs.exe
  2⤵
  PID:8952
- C:\Windows\System\ariyYWl.exe
  C:\Windows\System\ariyYWl.exe
  2⤵
  PID:8976
- C:\Windows\System\HJGzkzr.exe
  C:\Windows\System\HJGzkzr.exe
  2⤵
  PID:9004
- C:\Windows\System\tdbllRm.exe
  C:\Windows\System\tdbllRm.exe
  2⤵
  PID:9024
- C:\Windows\System\PPZJggg.exe
  C:\Windows\System\PPZJggg.exe
  2⤵
  PID:9052
- C:\Windows\System\seBGRRH.exe
  C:\Windows\System\seBGRRH.exe
  2⤵
  PID:9080
- C:\Windows\System\nCwMYcU.exe
  C:\Windows\System\nCwMYcU.exe
  2⤵
  PID:9108
- C:\Windows\System\SwIRGMr.exe
  C:\Windows\System\SwIRGMr.exe
  2⤵
  PID:9132
- C:\Windows\System\UgmBQzY.exe
  C:\Windows\System\UgmBQzY.exe
  2⤵
  PID:9164
- C:\Windows\System\OptXnqX.exe
  C:\Windows\System\OptXnqX.exe
  2⤵
  PID:9192
- C:\Windows\System\MbBUwxy.exe
  C:\Windows\System\MbBUwxy.exe
  2⤵
  PID:9212
- C:\Windows\System\rMfNywl.exe
  C:\Windows\System\rMfNywl.exe
  2⤵
  PID:7656
- C:\Windows\System\qDLMbTJ.exe
  C:\Windows\System\qDLMbTJ.exe
  2⤵
  PID:8072
- C:\Windows\System\cWkDxNq.exe
  C:\Windows\System\cWkDxNq.exe
  2⤵
  PID:7424
- C:\Windows\System\bodceMn.exe
  C:\Windows\System\bodceMn.exe
  2⤵
  PID:8200
- C:\Windows\System\GLKnDko.exe
  C:\Windows\System\GLKnDko.exe
  2⤵
  PID:8276
- C:\Windows\System\ktoHewa.exe
  C:\Windows\System\ktoHewa.exe
  2⤵
  PID:7376
- C:\Windows\System\uLVgQBl.exe
  C:\Windows\System\uLVgQBl.exe
  2⤵
  PID:8148
- C:\Windows\System\eHPweOC.exe
  C:\Windows\System\eHPweOC.exe
  2⤵
  PID:8204
- C:\Windows\System\PUVKnDF.exe
  C:\Windows\System\PUVKnDF.exe
  2⤵
  PID:8256
- C:\Windows\System\bmbatKv.exe
  C:\Windows\System\bmbatKv.exe
  2⤵
  PID:8624
- C:\Windows\System\FRlgAah.exe
  C:\Windows\System\FRlgAah.exe
  2⤵
  PID:8392
- C:\Windows\System\ZBSCZuN.exe
  C:\Windows\System\ZBSCZuN.exe
  2⤵
  PID:8732
- C:\Windows\System\JSAwkYI.exe
  C:\Windows\System\JSAwkYI.exe
  2⤵
  PID:8476
- C:\Windows\System\FTxpFhU.exe
  C:\Windows\System\FTxpFhU.exe
  2⤵
  PID:8508
- C:\Windows\System\naSkrGv.exe
  C:\Windows\System\naSkrGv.exe
  2⤵
  PID:8856
- C:\Windows\System\niqUaGc.exe
  C:\Windows\System\niqUaGc.exe
  2⤵
  PID:8876
- C:\Windows\System\dCnUOLa.exe
  C:\Windows\System\dCnUOLa.exe
  2⤵
  PID:8964
- C:\Windows\System\iEgEdUW.exe
  C:\Windows\System\iEgEdUW.exe
  2⤵
  PID:9020
- C:\Windows\System\QmlvxNh.exe
  C:\Windows\System\QmlvxNh.exe
  2⤵
  PID:9096
- C:\Windows\System\DRRrHfI.exe
  C:\Windows\System\DRRrHfI.exe
  2⤵
  PID:7916
- C:\Windows\System\MnNAftD.exe
  C:\Windows\System\MnNAftD.exe
  2⤵
  PID:7096
- C:\Windows\System\lntlpxA.exe
  C:\Windows\System\lntlpxA.exe
  2⤵
  PID:8416
- C:\Windows\System\WgJDwij.exe
  C:\Windows\System\WgJDwij.exe
  2⤵
  PID:7892
- C:\Windows\System\SXWkCgX.exe
  C:\Windows\System\SXWkCgX.exe
  2⤵
  PID:9236
- C:\Windows\System\YlwhBWp.exe
  C:\Windows\System\YlwhBWp.exe
  2⤵
  PID:9256
- C:\Windows\System\zKbKiqA.exe
  C:\Windows\System\zKbKiqA.exe
  2⤵
  PID:9280
- C:\Windows\System\vePBnzn.exe
  C:\Windows\System\vePBnzn.exe
  2⤵
  PID:9308
- C:\Windows\System\XGSExVA.exe
  C:\Windows\System\XGSExVA.exe
  2⤵
  PID:9336
- C:\Windows\System\wUIIKYe.exe
  C:\Windows\System\wUIIKYe.exe
  2⤵
  PID:9364
- C:\Windows\System\clFUlNq.exe
  C:\Windows\System\clFUlNq.exe
  2⤵
  PID:9396
- C:\Windows\System\PPPTRTP.exe
  C:\Windows\System\PPPTRTP.exe
  2⤵
  PID:9416
- C:\Windows\System\VzjDVPQ.exe
  C:\Windows\System\VzjDVPQ.exe
  2⤵
  PID:9432
- C:\Windows\System\RWxSZcB.exe
  C:\Windows\System\RWxSZcB.exe
  2⤵
  PID:9456
- C:\Windows\System\JJzStjl.exe
  C:\Windows\System\JJzStjl.exe
  2⤵
  PID:9476
- C:\Windows\System\QJmTILH.exe
  C:\Windows\System\QJmTILH.exe
  2⤵
  PID:9492
- C:\Windows\System\nnpgQnZ.exe
  C:\Windows\System\nnpgQnZ.exe
  2⤵
  PID:9520
- C:\Windows\System\GrbbfXk.exe
  C:\Windows\System\GrbbfXk.exe
  2⤵
  PID:9544
- C:\Windows\System\EdcQHDr.exe
  C:\Windows\System\EdcQHDr.exe
  2⤵
  PID:9568
- C:\Windows\System\AeUCZeJ.exe
  C:\Windows\System\AeUCZeJ.exe
  2⤵
  PID:9592
- C:\Windows\System\iiFOdFt.exe
  C:\Windows\System\iiFOdFt.exe
  2⤵
  PID:9620
- C:\Windows\System\QBVLQQs.exe
  C:\Windows\System\QBVLQQs.exe
  2⤵
  PID:9648
- C:\Windows\System\LwDkWxe.exe
  C:\Windows\System\LwDkWxe.exe
  2⤵
  PID:9676
- C:\Windows\System\ALVdiMc.exe
  C:\Windows\System\ALVdiMc.exe
  2⤵
  PID:9708
- C:\Windows\System\bnRjWvE.exe
  C:\Windows\System\bnRjWvE.exe
  2⤵
  PID:9732
- C:\Windows\System\VnNABzH.exe
  C:\Windows\System\VnNABzH.exe
  2⤵
  PID:9772
- C:\Windows\System\OVWluHJ.exe
  C:\Windows\System\OVWluHJ.exe
  2⤵
  PID:9808
- C:\Windows\System\ZwchQjo.exe
  C:\Windows\System\ZwchQjo.exe
  2⤵
  PID:9824
- C:\Windows\System\LPgRVIv.exe
  C:\Windows\System\LPgRVIv.exe
  2⤵
  PID:9844
- C:\Windows\System\bxlCYnM.exe
  C:\Windows\System\bxlCYnM.exe
  2⤵
  PID:9868
- C:\Windows\System\hZUTiWT.exe
  C:\Windows\System\hZUTiWT.exe
  2⤵
  PID:9892
- C:\Windows\System\hRdQoil.exe
  C:\Windows\System\hRdQoil.exe
  2⤵
  PID:9920
- C:\Windows\System\uxDGghd.exe
  C:\Windows\System\uxDGghd.exe
  2⤵
  PID:9948
- C:\Windows\System\GRgIscJ.exe
  C:\Windows\System\GRgIscJ.exe
  2⤵
  PID:9984
- C:\Windows\System\iSXMZAw.exe
  C:\Windows\System\iSXMZAw.exe
  2⤵
  PID:10012
- C:\Windows\System\gHrsDBK.exe
  C:\Windows\System\gHrsDBK.exe
  2⤵
  PID:10028
- C:\Windows\System\cUHEuSC.exe
  C:\Windows\System\cUHEuSC.exe
  2⤵
  PID:10052
- C:\Windows\System\aiPfbZT.exe
  C:\Windows\System\aiPfbZT.exe
  2⤵
  PID:10072
- C:\Windows\System\lqwxzCt.exe
  C:\Windows\System\lqwxzCt.exe
  2⤵
  PID:10096
- C:\Windows\System\UPaJZur.exe
  C:\Windows\System\UPaJZur.exe
  2⤵
  PID:10120
- C:\Windows\System\QfqrdpG.exe
  C:\Windows\System\QfqrdpG.exe
  2⤵
  PID:10144
- C:\Windows\System\VdtebpP.exe
  C:\Windows\System\VdtebpP.exe
  2⤵
  PID:10168
- C:\Windows\System\NmTHZFm.exe
  C:\Windows\System\NmTHZFm.exe
  2⤵
  PID:10192
- C:\Windows\System\vZlOErd.exe
  C:\Windows\System\vZlOErd.exe
  2⤵
  PID:10216
- C:\Windows\System\uNbXQln.exe
  C:\Windows\System\uNbXQln.exe
  2⤵
  PID:8372
- C:\Windows\System\iZsOZVY.exe
  C:\Windows\System\iZsOZVY.exe
  2⤵
  PID:8992
- C:\Windows\System\vcVCNta.exe
  C:\Windows\System\vcVCNta.exe
  2⤵
  PID:8264
- C:\Windows\System\AWhfVcL.exe
  C:\Windows\System\AWhfVcL.exe
  2⤵
  PID:7384
- C:\Windows\System\JAmbrRS.exe
  C:\Windows\System\JAmbrRS.exe
  2⤵
  PID:8324
- C:\Windows\System\FeNTQen.exe
  C:\Windows\System\FeNTQen.exe
  2⤵
  PID:8768
- C:\Windows\System\MZvJaOg.exe
  C:\Windows\System\MZvJaOg.exe
  2⤵
  PID:7712
- C:\Windows\System\qtdmbfk.exe
  C:\Windows\System\qtdmbfk.exe
  2⤵
  PID:9352
- C:\Windows\System\HFqWjZF.exe
  C:\Windows\System\HFqWjZF.exe
  2⤵
  PID:7244
- C:\Windows\System\Lqtamhy.exe
  C:\Windows\System\Lqtamhy.exe
  2⤵
  PID:9484
- C:\Windows\System\lqsHHJU.exe
  C:\Windows\System\lqsHHJU.exe
  2⤵
  PID:8960
- C:\Windows\System\gNAKqaZ.exe
  C:\Windows\System\gNAKqaZ.exe
  2⤵
  PID:9584
- C:\Windows\System\YhMVpFO.exe
  C:\Windows\System\YhMVpFO.exe
  2⤵
  PID:9232
- C:\Windows\System\fHqriBI.exe
  C:\Windows\System\fHqriBI.exe
  2⤵
  PID:9328
- C:\Windows\System\fxZbpHb.exe
  C:\Windows\System\fxZbpHb.exe
  2⤵
  PID:8908
- C:\Windows\System\KanAMPs.exe
  C:\Windows\System\KanAMPs.exe
  2⤵
  PID:9792
- C:\Windows\System\LgcghXS.exe
  C:\Windows\System\LgcghXS.exe
  2⤵
  PID:9876
- C:\Windows\System\dPXyxCr.exe
  C:\Windows\System\dPXyxCr.exe
  2⤵
  PID:9636
- C:\Windows\System\dAwzEuK.exe
  C:\Windows\System\dAwzEuK.exe
  2⤵
  PID:9268
- C:\Windows\System\TJYHYPa.exe
  C:\Windows\System\TJYHYPa.exe
  2⤵
  PID:10092
- C:\Windows\System\QZjzeVO.exe
  C:\Windows\System\QZjzeVO.exe
  2⤵
  PID:10140
- C:\Windows\System\VtJUcux.exe
  C:\Windows\System\VtJUcux.exe
  2⤵
  PID:9452
- C:\Windows\System\BNSLbVy.exe
  C:\Windows\System\BNSLbVy.exe
  2⤵
  PID:10360
- C:\Windows\System\SIfHptb.exe
  C:\Windows\System\SIfHptb.exe
  2⤵
  PID:10412
- C:\Windows\System\djikwIF.exe
  C:\Windows\System\djikwIF.exe
  2⤵
  PID:10432
- C:\Windows\System\cqPyXLK.exe
  C:\Windows\System\cqPyXLK.exe
  2⤵
  PID:10456
- C:\Windows\System\PgcosQw.exe
  C:\Windows\System\PgcosQw.exe
  2⤵
  PID:10488
- C:\Windows\System\zpCwggp.exe
  C:\Windows\System\zpCwggp.exe
  2⤵
  PID:10520
- C:\Windows\System\tFOmUqa.exe
  C:\Windows\System\tFOmUqa.exe
  2⤵
  PID:10544
- C:\Windows\System\KKdZSAA.exe
  C:\Windows\System\KKdZSAA.exe
  2⤵
  PID:10564
- C:\Windows\System\MUJgaso.exe
  C:\Windows\System\MUJgaso.exe
  2⤵
  PID:10592
- C:\Windows\System\cJTViGG.exe
  C:\Windows\System\cJTViGG.exe
  2⤵
  PID:10620
- C:\Windows\System\InWLGGm.exe
  C:\Windows\System\InWLGGm.exe
  2⤵
  PID:10648
- C:\Windows\System\dtbomdu.exe
  C:\Windows\System\dtbomdu.exe
  2⤵
  PID:10672
- C:\Windows\System\RbiQDAj.exe
  C:\Windows\System\RbiQDAj.exe
  2⤵
  PID:10708
- C:\Windows\System\GxyizQb.exe
  C:\Windows\System\GxyizQb.exe
  2⤵
  PID:10740
- C:\Windows\System\Noqzqzp.exe
  C:\Windows\System\Noqzqzp.exe
  2⤵
  PID:10764
- C:\Windows\System\jFcNWtm.exe
  C:\Windows\System\jFcNWtm.exe
  2⤵
  PID:10788
- C:\Windows\System\pHRvYVH.exe
  C:\Windows\System\pHRvYVH.exe
  2⤵
  PID:10812
- C:\Windows\System\qAmSqQP.exe
  C:\Windows\System\qAmSqQP.exe
  2⤵
  PID:10832
- C:\Windows\System\qhsXJuo.exe
  C:\Windows\System\qhsXJuo.exe
  2⤵
  PID:10868
- C:\Windows\System\DUBnDOh.exe
  C:\Windows\System\DUBnDOh.exe
  2⤵
  PID:10904
- C:\Windows\System\aTDAONm.exe
  C:\Windows\System\aTDAONm.exe
  2⤵
  PID:10920
- C:\Windows\System\HVFUGEC.exe
  C:\Windows\System\HVFUGEC.exe
  2⤵
  PID:10956
- C:\Windows\System\nSFNqXQ.exe
  C:\Windows\System\nSFNqXQ.exe
  2⤵
  PID:10988
- C:\Windows\System\CRIePnQ.exe
  C:\Windows\System\CRIePnQ.exe
  2⤵
  PID:11020
- C:\Windows\System\WyVmidk.exe
  C:\Windows\System\WyVmidk.exe
  2⤵
  PID:11040
- C:\Windows\System\oJNsDru.exe
  C:\Windows\System\oJNsDru.exe
  2⤵
  PID:11056
- C:\Windows\System\cXjiuzQ.exe
  C:\Windows\System\cXjiuzQ.exe
  2⤵
  PID:11092
- C:\Windows\System\kdHFggH.exe
  C:\Windows\System\kdHFggH.exe
  2⤵
  PID:11124
- C:\Windows\System\weLeZqc.exe
  C:\Windows\System\weLeZqc.exe
  2⤵
  PID:11152
- C:\Windows\System\LwLgHpe.exe
  C:\Windows\System\LwLgHpe.exe
  2⤵
  PID:11176
- C:\Windows\System\aNlaLNM.exe
  C:\Windows\System\aNlaLNM.exe
  2⤵
  PID:11196
- C:\Windows\System\pmdCvGa.exe
  C:\Windows\System\pmdCvGa.exe
  2⤵
  PID:11212
- C:\Windows\System\GqxPlUc.exe
  C:\Windows\System\GqxPlUc.exe
  2⤵
  PID:11232
- C:\Windows\System\pWPJrMB.exe
  C:\Windows\System\pWPJrMB.exe
  2⤵
  PID:11260
- C:\Windows\System\uEXIzIA.exe
  C:\Windows\System\uEXIzIA.exe
  2⤵
  PID:9644
- C:\Windows\System\NUBbBwJ.exe
  C:\Windows\System\NUBbBwJ.exe
  2⤵
  PID:9068
- C:\Windows\System\iLnxodc.exe
  C:\Windows\System\iLnxodc.exe
  2⤵
  PID:9788
- C:\Windows\System\ExGxBDa.exe
  C:\Windows\System\ExGxBDa.exe
  2⤵
  PID:9692
- C:\Windows\System\fGYPGqr.exe
  C:\Windows\System\fGYPGqr.exe
  2⤵
  PID:8892
- C:\Windows\System\gEnvgHm.exe
  C:\Windows\System\gEnvgHm.exe
  2⤵
  PID:8604
- C:\Windows\System\LdbfGVR.exe
  C:\Windows\System\LdbfGVR.exe
  2⤵
  PID:9092
- C:\Windows\System\LQlkdQh.exe
  C:\Windows\System\LQlkdQh.exe
  2⤵
  PID:9996
- C:\Windows\System\CTIrmrH.exe
  C:\Windows\System\CTIrmrH.exe
  2⤵
  PID:10024
- C:\Windows\System\GXWYXCP.exe
  C:\Windows\System\GXWYXCP.exe
  2⤵
  PID:3220
- C:\Windows\System\yLITrDZ.exe
  C:\Windows\System\yLITrDZ.exe
  2⤵
  PID:10180
- C:\Windows\System\cLElkWf.exe
  C:\Windows\System\cLElkWf.exe
  2⤵
  PID:9764
- C:\Windows\System\KebKiQC.exe
  C:\Windows\System\KebKiQC.exe
  2⤵
  PID:8000
- C:\Windows\System\sklvNkZ.exe
  C:\Windows\System\sklvNkZ.exe
  2⤵
  PID:10116
- C:\Windows\System\mRtKBPS.exe
  C:\Windows\System\mRtKBPS.exe
  2⤵
  PID:10428
- C:\Windows\System\hzdzTNd.exe
  C:\Windows\System\hzdzTNd.exe
  2⤵
  PID:9728
- C:\Windows\System\twsebzx.exe
  C:\Windows\System\twsebzx.exe
  2⤵
  PID:9220
- C:\Windows\System\QyEkghy.exe
  C:\Windows\System\QyEkghy.exe
  2⤵
  PID:2444
- C:\Windows\System\KMSlKdc.exe
  C:\Windows\System\KMSlKdc.exe
  2⤵
  PID:9472
- C:\Windows\System\XINKoFk.exe
  C:\Windows\System\XINKoFk.exe
  2⤵
  PID:9724
- C:\Windows\System\RmGpTBR.exe
  C:\Windows\System\RmGpTBR.exe
  2⤵
  PID:10916
- C:\Windows\System\UuBBoQq.exe
  C:\Windows\System\UuBBoQq.exe
  2⤵
  PID:10952
- C:\Windows\System\FvLYUXO.exe
  C:\Windows\System\FvLYUXO.exe
  2⤵
  PID:10512
- C:\Windows\System\hwMrHsY.exe
  C:\Windows\System\hwMrHsY.exe
  2⤵
  PID:10556
- C:\Windows\System\AzIeDyF.exe
  C:\Windows\System\AzIeDyF.exe
  2⤵
  PID:11072
- C:\Windows\System\fFNNeLY.exe
  C:\Windows\System\fFNNeLY.exe
  2⤵
  PID:11112
- C:\Windows\System\crHlPJB.exe
  C:\Windows\System\crHlPJB.exe
  2⤵
  PID:11188
- C:\Windows\System\QoCKioc.exe
  C:\Windows\System\QoCKioc.exe
  2⤵
  PID:9556
- C:\Windows\System\cCpXqTm.exe
  C:\Windows\System\cCpXqTm.exe
  2⤵
  PID:9320
- C:\Windows\System\yJVTmHJ.exe
  C:\Windows\System\yJVTmHJ.exe
  2⤵
  PID:10400
- C:\Windows\System\KkdSLYk.exe
  C:\Windows\System\KkdSLYk.exe
  2⤵
  PID:10876
- C:\Windows\System\VKmmcVd.exe
  C:\Windows\System\VKmmcVd.exe
  2⤵
  PID:8328
- C:\Windows\System\ZkNDZvP.exe
  C:\Windows\System\ZkNDZvP.exe
  2⤵
  PID:10616
- C:\Windows\System\OFhwETY.exe
  C:\Windows\System\OFhwETY.exe
  2⤵
  PID:11048
- C:\Windows\System\ypBFEPF.exe
  C:\Windows\System\ypBFEPF.exe
  2⤵
  PID:11120
- C:\Windows\System\HdittDD.exe
  C:\Windows\System\HdittDD.exe
  2⤵
  PID:10752
- C:\Windows\System\uIaPsHW.exe
  C:\Windows\System\uIaPsHW.exe
  2⤵
  PID:10588
- C:\Windows\System\kDTepIw.exe
  C:\Windows\System\kDTepIw.exe
  2⤵
  PID:11384
- C:\Windows\System\QzIfCyT.exe
  C:\Windows\System\QzIfCyT.exe
  2⤵
  PID:11408
- C:\Windows\System\jBXfJyn.exe
  C:\Windows\System\jBXfJyn.exe
  2⤵
  PID:11428
- C:\Windows\System\kLQcCMd.exe
  C:\Windows\System\kLQcCMd.exe
  2⤵
  PID:11460
- C:\Windows\System\WpvOphn.exe
  C:\Windows\System\WpvOphn.exe
  2⤵
  PID:11492
- C:\Windows\System\YPgdBlc.exe
  C:\Windows\System\YPgdBlc.exe
  2⤵
  PID:11512
- C:\Windows\System\auYDmiX.exe
  C:\Windows\System\auYDmiX.exe
  2⤵
  PID:11536
- C:\Windows\System\GnjOpIb.exe
  C:\Windows\System\GnjOpIb.exe
  2⤵
  PID:11568
- C:\Windows\System\cmKOCjv.exe
  C:\Windows\System\cmKOCjv.exe
  2⤵
  PID:11592
- C:\Windows\System\feUkhEj.exe
  C:\Windows\System\feUkhEj.exe
  2⤵
  PID:11620
- C:\Windows\System\uRZhdGL.exe
  C:\Windows\System\uRZhdGL.exe
  2⤵
  PID:11648
- C:\Windows\System\egFKVIP.exe
  C:\Windows\System\egFKVIP.exe
  2⤵
  PID:11668
- C:\Windows\System\iHfgxcB.exe
  C:\Windows\System\iHfgxcB.exe
  2⤵
  PID:11720
- C:\Windows\System\hAWLIRB.exe
  C:\Windows\System\hAWLIRB.exe
  2⤵
  PID:11740
- C:\Windows\System\LjXgQCk.exe
  C:\Windows\System\LjXgQCk.exe
  2⤵
  PID:11764
- C:\Windows\System\qfhuucG.exe
  C:\Windows\System\qfhuucG.exe
  2⤵
  PID:11788
- C:\Windows\System\POPHWDz.exe
  C:\Windows\System\POPHWDz.exe
  2⤵
  PID:11812
- C:\Windows\System\jRSBIHg.exe
  C:\Windows\System\jRSBIHg.exe
  2⤵
  PID:11836
- C:\Windows\System\alqvWrC.exe
  C:\Windows\System\alqvWrC.exe
  2⤵
  PID:11864
- C:\Windows\System\FgYNVmE.exe
  C:\Windows\System\FgYNVmE.exe
  2⤵
  PID:11892
- C:\Windows\System\qpOxgFO.exe
  C:\Windows\System\qpOxgFO.exe
  2⤵
  PID:11912
- C:\Windows\System\ROrtFzs.exe
  C:\Windows\System\ROrtFzs.exe
  2⤵
  PID:11936
- C:\Windows\System\nEkZgEA.exe
  C:\Windows\System\nEkZgEA.exe
  2⤵
  PID:11960
- C:\Windows\System\ekPeLql.exe
  C:\Windows\System\ekPeLql.exe
  2⤵
  PID:11984
- C:\Windows\System\QufYDXp.exe
  C:\Windows\System\QufYDXp.exe
  2⤵
  PID:12028
- C:\Windows\System\gPeMfKo.exe
  C:\Windows\System\gPeMfKo.exe
  2⤵
  PID:12044
- C:\Windows\System\pjHSQgu.exe
  C:\Windows\System\pjHSQgu.exe
  2⤵
  PID:12068
- C:\Windows\System\NJQhQZG.exe
  C:\Windows\System\NJQhQZG.exe
  2⤵
  PID:12100
- C:\Windows\System\tjuUdBS.exe
  C:\Windows\System\tjuUdBS.exe
  2⤵
  PID:12132
- C:\Windows\System\zrfguMR.exe
  C:\Windows\System\zrfguMR.exe
  2⤵
  PID:12164
- C:\Windows\System\lLPPryO.exe
  C:\Windows\System\lLPPryO.exe
  2⤵
  PID:12188
- C:\Windows\System\GUCudnu.exe
  C:\Windows\System\GUCudnu.exe
  2⤵
  PID:12216
- C:\Windows\System\NKtETKK.exe
  C:\Windows\System\NKtETKK.exe
  2⤵
  PID:12244
- C:\Windows\System\vgAAtsn.exe
  C:\Windows\System\vgAAtsn.exe
  2⤵
  PID:12268
- C:\Windows\System\SpVuECX.exe
  C:\Windows\System\SpVuECX.exe
  2⤵
  PID:11012
- C:\Windows\System\HySNwIU.exe
  C:\Windows\System\HySNwIU.exe
  2⤵
  PID:11252
- C:\Windows\System\QJrUENW.exe
  C:\Windows\System\QJrUENW.exe
  2⤵
  PID:10164
- C:\Windows\System\xEfZuPX.exe
  C:\Windows\System\xEfZuPX.exe
  2⤵
  PID:9392
- C:\Windows\System\uktYOiD.exe
  C:\Windows\System\uktYOiD.exe
  2⤵
  PID:10396
- C:\Windows\System\jbEZBXV.exe
  C:\Windows\System\jbEZBXV.exe
  2⤵
  PID:10580
- C:\Windows\System\qkRCQjV.exe
  C:\Windows\System\qkRCQjV.exe
  2⤵
  PID:10064
- C:\Windows\System\hDlnXOA.exe
  C:\Windows\System\hDlnXOA.exe
  2⤵
  PID:9688
- C:\Windows\System\jHecgcp.exe
  C:\Windows\System\jHecgcp.exe
  2⤵
  PID:11000
- C:\Windows\System\tQYPqrc.exe
  C:\Windows\System\tQYPqrc.exe
  2⤵
  PID:8712
- C:\Windows\System\GVBYdbH.exe
  C:\Windows\System\GVBYdbH.exe
  2⤵
  PID:10804
- C:\Windows\System\fcjiPSB.exe
  C:\Windows\System\fcjiPSB.exe
  2⤵
  PID:11416
- C:\Windows\System\IhcDYzk.exe
  C:\Windows\System\IhcDYzk.exe
  2⤵
  PID:11004
- C:\Windows\System\ZnkESiT.exe
  C:\Windows\System\ZnkESiT.exe
  2⤵
  PID:11084
- C:\Windows\System\UcAaEyL.exe
  C:\Windows\System\UcAaEyL.exe
  2⤵
  PID:11636
- C:\Windows\System\dBbZeVu.exe
  C:\Windows\System\dBbZeVu.exe
  2⤵
  PID:10784
- C:\Windows\System\nlNqPLF.exe
  C:\Windows\System\nlNqPLF.exe
  2⤵
  PID:11348
- C:\Windows\System\eKClRzX.exe
  C:\Windows\System\eKClRzX.exe
  2⤵
  PID:11756
- C:\Windows\System\KgKenbW.exe
  C:\Windows\System\KgKenbW.exe
  2⤵
  PID:11828
- C:\Windows\System\tEbcghq.exe
  C:\Windows\System\tEbcghq.exe
  2⤵
  PID:11204
- C:\Windows\System\OVpNqUt.exe
  C:\Windows\System\OVpNqUt.exe
  2⤵
  PID:11488
- C:\Windows\System\zHXTCGF.exe
  C:\Windows\System\zHXTCGF.exe
  2⤵
  PID:12112
- C:\Windows\System\eokHIVX.exe
  C:\Windows\System\eokHIVX.exe
  2⤵
  PID:12196
- C:\Windows\System\QsDbvaS.exe
  C:\Windows\System\QsDbvaS.exe
  2⤵
  PID:11716
- C:\Windows\System\PmwBrpB.exe
  C:\Windows\System\PmwBrpB.exe
  2⤵
  PID:11736
- C:\Windows\System\ztxntlN.exe
  C:\Windows\System\ztxntlN.exe
  2⤵
  PID:9148
- C:\Windows\System\YYckkJB.exe
  C:\Windows\System\YYckkJB.exe
  2⤵
  PID:11148
- C:\Windows\System\gMLOEfp.exe
  C:\Windows\System\gMLOEfp.exe
  2⤵
  PID:11880
- C:\Windows\System\ZSxAqKA.exe
  C:\Windows\System\ZSxAqKA.exe
  2⤵
  PID:10280
- C:\Windows\System\ShaMtFj.exe
  C:\Windows\System\ShaMtFj.exe
  2⤵
  PID:12292
- C:\Windows\System\tuRXoRt.exe
  C:\Windows\System\tuRXoRt.exe
  2⤵
  PID:12312
- C:\Windows\System\WmYPZzV.exe
  C:\Windows\System\WmYPZzV.exe
  2⤵
  PID:12340
- C:\Windows\System\mUPhoWW.exe
  C:\Windows\System\mUPhoWW.exe
  2⤵
  PID:12360
- C:\Windows\System\uVbvJQz.exe
  C:\Windows\System\uVbvJQz.exe
  2⤵
  PID:12384
- C:\Windows\System\cSFTknQ.exe
  C:\Windows\System\cSFTknQ.exe
  2⤵
  PID:12408
- C:\Windows\System\KqfmZye.exe
  C:\Windows\System\KqfmZye.exe
  2⤵
  PID:12424
- C:\Windows\System\qgcdIIs.exe
  C:\Windows\System\qgcdIIs.exe
  2⤵
  PID:12444
- C:\Windows\System\BxMoJla.exe
  C:\Windows\System\BxMoJla.exe
  2⤵
  PID:12460
- C:\Windows\System\MSAHzXS.exe
  C:\Windows\System\MSAHzXS.exe
  2⤵
  PID:12480
- C:\Windows\System\HexXArL.exe
  C:\Windows\System\HexXArL.exe
  2⤵
  PID:12516
- C:\Windows\System\qUjIhmG.exe
  C:\Windows\System\qUjIhmG.exe
  2⤵
  PID:12556
- C:\Windows\System\cIEyvqL.exe
  C:\Windows\System\cIEyvqL.exe
  2⤵
  PID:12576
- C:\Windows\System\PMnSZou.exe
  C:\Windows\System\PMnSZou.exe
  2⤵
  PID:12604
- C:\Windows\System\PglOHap.exe
  C:\Windows\System\PglOHap.exe
  2⤵
  PID:12632
- C:\Windows\System\NaTDWTx.exe
  C:\Windows\System\NaTDWTx.exe
  2⤵
  PID:12652
- C:\Windows\System\PLVKAdO.exe
  C:\Windows\System\PLVKAdO.exe
  2⤵
  PID:12680
- C:\Windows\System\zdWhjwA.exe
  C:\Windows\System\zdWhjwA.exe
  2⤵
  PID:12700
- C:\Windows\System\hwVlWzz.exe
  C:\Windows\System\hwVlWzz.exe
  2⤵
  PID:12724
- C:\Windows\System\TvbyPId.exe
  C:\Windows\System\TvbyPId.exe
  2⤵
  PID:12752
- C:\Windows\System\MlflcTp.exe
  C:\Windows\System\MlflcTp.exe
  2⤵
  PID:12784
- C:\Windows\System\pOUTewq.exe
  C:\Windows\System\pOUTewq.exe
  2⤵
  PID:12812
- C:\Windows\System\KMzPyda.exe
  C:\Windows\System\KMzPyda.exe
  2⤵
  PID:12840
- C:\Windows\System\vpWbtFd.exe
  C:\Windows\System\vpWbtFd.exe
  2⤵
  PID:12860
- C:\Windows\System\QmpmEbJ.exe
  C:\Windows\System\QmpmEbJ.exe
  2⤵
  PID:12884
- C:\Windows\System\lIplRmW.exe
  C:\Windows\System\lIplRmW.exe
  2⤵
  PID:12908
- C:\Windows\System\KRcOsTc.exe
  C:\Windows\System\KRcOsTc.exe
  2⤵
  PID:12932
- C:\Windows\System\xzwPusF.exe
  C:\Windows\System\xzwPusF.exe
  2⤵
  PID:12948
- C:\Windows\System\huswbwt.exe
  C:\Windows\System\huswbwt.exe
  2⤵
  PID:12964
- C:\Windows\System\afofFYQ.exe
  C:\Windows\System\afofFYQ.exe
  2⤵
  PID:12984
- C:\Windows\System\SeqjFMA.exe
  C:\Windows\System\SeqjFMA.exe
  2⤵
  PID:13008
- C:\Windows\System\ACrbRXa.exe
  C:\Windows\System\ACrbRXa.exe
  2⤵
  PID:13036
- C:\Windows\System\nopoUdK.exe
  C:\Windows\System\nopoUdK.exe
  2⤵
  PID:13064
- C:\Windows\System\iTrIzpR.exe
  C:\Windows\System\iTrIzpR.exe
  2⤵
  PID:13084
- C:\Windows\System\XcbXcWu.exe
  C:\Windows\System\XcbXcWu.exe
  2⤵
  PID:13100
- C:\Windows\System\YxhEQhj.exe
  C:\Windows\System\YxhEQhj.exe
  2⤵
  PID:13120
- C:\Windows\System\lGXBQEI.exe
  C:\Windows\System\lGXBQEI.exe
  2⤵
  PID:13144
- C:\Windows\System\KgeZtvd.exe
  C:\Windows\System\KgeZtvd.exe
  2⤵
  PID:13172
- C:\Windows\System\PIyivnW.exe
  C:\Windows\System\PIyivnW.exe
  2⤵
  PID:13200
- C:\Windows\System\pCMlLkU.exe
  C:\Windows\System\pCMlLkU.exe
  2⤵
  PID:13232
- C:\Windows\System\mONneiK.exe
  C:\Windows\System\mONneiK.exe
  2⤵
  PID:12456
- C:\Windows\System\EHMJrmi.exe
  C:\Windows\System\EHMJrmi.exe
  2⤵
  PID:11920
- C:\Windows\System\JMTrMPX.exe
  C:\Windows\System\JMTrMPX.exe
  2⤵
  PID:12716
- C:\Windows\System\UOWNLcT.exe
  C:\Windows\System\UOWNLcT.exe
  2⤵
  PID:12748
- C:\Windows\System\xZuOoJw.exe
  C:\Windows\System\xZuOoJw.exe
  2⤵
  PID:11376
- C:\Windows\System\BqICZgL.exe
  C:\Windows\System\BqICZgL.exe
  2⤵
  PID:12468
- C:\Windows\System\qglLorF.exe
  C:\Windows\System\qglLorF.exe
  2⤵
  PID:12500
- C:\Windows\System\umFevvc.exe
  C:\Windows\System\umFevvc.exe
  2⤵
  PID:11800
- C:\Windows\System\pqLmuki.exe
  C:\Windows\System\pqLmuki.exe
  2⤵
  PID:12856
- C:\Windows\System\PETzBap.exe
  C:\Windows\System\PETzBap.exe
  2⤵
  PID:12956
- C:\Windows\System\FYVlkrd.exe
  C:\Windows\System\FYVlkrd.exe
  2⤵
  PID:13072
- C:\Windows\System\MdTgRCN.exe
  C:\Windows\System\MdTgRCN.exe
  2⤵
  PID:13328
- C:\Windows\System\NOmylTe.exe
  C:\Windows\System\NOmylTe.exe
  2⤵
  PID:13364
- C:\Windows\System\xbcBfVr.exe
  C:\Windows\System\xbcBfVr.exe
  2⤵
  PID:13392
- C:\Windows\System\WgrhlVd.exe
  C:\Windows\System\WgrhlVd.exe
  2⤵
  PID:13420
- C:\Windows\System\uePLfaz.exe
  C:\Windows\System\uePLfaz.exe
  2⤵
  PID:13460
- C:\Windows\System\luRucap.exe
  C:\Windows\System\luRucap.exe
  2⤵
  PID:13492
- C:\Windows\System\NiohkEX.exe
  C:\Windows\System\NiohkEX.exe
  2⤵
  PID:13516
- C:\Windows\System\LsKGyGp.exe
  C:\Windows\System\LsKGyGp.exe
  2⤵
  PID:13540
- C:\Windows\System\ESLUwKf.exe
  C:\Windows\System\ESLUwKf.exe
  2⤵
  PID:13564
- C:\Windows\System\qGkcQxE.exe
  C:\Windows\System\qGkcQxE.exe
  2⤵
  PID:13584
- C:\Windows\System\wHyavGr.exe
  C:\Windows\System\wHyavGr.exe
  2⤵
  PID:13612
- C:\Windows\System\tOpfSEX.exe
  C:\Windows\System\tOpfSEX.exe
  2⤵
  PID:13644
- C:\Windows\System\ArJYJaa.exe
  C:\Windows\System\ArJYJaa.exe
  2⤵
  PID:13668
- C:\Windows\System\NVOUPID.exe
  C:\Windows\System\NVOUPID.exe
  2⤵
  PID:13692
- C:\Windows\System\JcPnoqV.exe
  C:\Windows\System\JcPnoqV.exe
  2⤵
  PID:13724
- C:\Windows\System\ZHnJvZY.exe
  C:\Windows\System\ZHnJvZY.exe
  2⤵
  PID:13744
- C:\Windows\System\cdguNbH.exe
  C:\Windows\System\cdguNbH.exe
  2⤵
  PID:13768
- C:\Windows\System\MfxDTnm.exe
  C:\Windows\System\MfxDTnm.exe
  2⤵
  PID:13796
- C:\Windows\System\DUVhqwW.exe
  C:\Windows\System\DUVhqwW.exe
  2⤵
  PID:13820
- C:\Windows\System\zkCPihr.exe
  C:\Windows\System\zkCPihr.exe
  2⤵
  PID:13848
- C:\Windows\System\DGqNxkg.exe
  C:\Windows\System\DGqNxkg.exe
  2⤵
  PID:13868
- C:\Windows\System\sitabLg.exe
  C:\Windows\System\sitabLg.exe
  2⤵
  PID:13900
- C:\Windows\System\uomMxCD.exe
  C:\Windows\System\uomMxCD.exe
  2⤵
  PID:13932
- C:\Windows\System\LCobDkb.exe
  C:\Windows\System\LCobDkb.exe
  2⤵
  PID:13960
- C:\Windows\System\hCuLGSD.exe
  C:\Windows\System\hCuLGSD.exe
  2⤵
  PID:13976
- C:\Windows\System\HxRsJCu.exe
  C:\Windows\System\HxRsJCu.exe
  2⤵
  PID:14000
- C:\Windows\System\FohWRSn.exe
  C:\Windows\System\FohWRSn.exe
  2⤵
  PID:14028
- C:\Windows\System\QftYfMk.exe
  C:\Windows\System\QftYfMk.exe
  2⤵
  PID:14048
- C:\Windows\System\zNyeTSj.exe
  C:\Windows\System\zNyeTSj.exe
  2⤵
  PID:14064
- C:\Windows\System\ZpFjWfR.exe
  C:\Windows\System\ZpFjWfR.exe
  2⤵
  PID:14088
- C:\Windows\System\eXJqkOY.exe
  C:\Windows\System\eXJqkOY.exe
  2⤵
  PID:14112
- C:\Windows\System\lfaHvpL.exe
  C:\Windows\System\lfaHvpL.exe
  2⤵
  PID:14132
- C:\Windows\System\YgtcBBu.exe
  C:\Windows\System\YgtcBBu.exe
  2⤵
  PID:14164
- C:\Windows\System\QzlvGmC.exe
  C:\Windows\System\QzlvGmC.exe
  2⤵
  PID:14180
- C:\Windows\System\GwrngmB.exe
  C:\Windows\System\GwrngmB.exe
  2⤵
  PID:14196
- C:\Windows\System\LirgNwi.exe
  C:\Windows\System\LirgNwi.exe
  2⤵
  PID:14224
- C:\Windows\System\lGvcwkX.exe
  C:\Windows\System\lGvcwkX.exe
  2⤵
  PID:14248
- C:\Windows\System\ODnlPdy.exe
  C:\Windows\System\ODnlPdy.exe
  2⤵
  PID:14272
- C:\Windows\System\yJDhzti.exe
  C:\Windows\System\yJDhzti.exe
  2⤵
  PID:14300
- C:\Windows\System\azdNxTo.exe
  C:\Windows\System\azdNxTo.exe
  2⤵
  PID:14324
- C:\Windows\System\cWNIxVC.exe
  C:\Windows\System\cWNIxVC.exe
  2⤵
  PID:12356
- C:\Windows\System\KAGYKpb.exe
  C:\Windows\System\KAGYKpb.exe
  2⤵
  PID:12396
- C:\Windows\System\ISpEvSK.exe
  C:\Windows\System\ISpEvSK.exe
  2⤵
  PID:13248
- C:\Windows\System\RjmJuVx.exe
  C:\Windows\System\RjmJuVx.exe
  2⤵
  PID:12624
- C:\Windows\System\TJIwiXO.exe
  C:\Windows\System\TJIwiXO.exe
  2⤵
  PID:11980
- C:\Windows\System\gvHzpUN.exe
  C:\Windows\System\gvHzpUN.exe
  2⤵
  PID:11528
- C:\Windows\System\lGKwQlG.exe
  C:\Windows\System\lGKwQlG.exe
  2⤵
  PID:12696
- C:\Windows\System\BZZgaSc.exe
  C:\Windows\System\BZZgaSc.exe
  2⤵
  PID:12796
- C:\Windows\System\FwqJxBx.exe
  C:\Windows\System\FwqJxBx.exe
  2⤵
  PID:12904
- C:\Windows\System\kCRScyB.exe
  C:\Windows\System\kCRScyB.exe
  2⤵
  PID:11328
- C:\Windows\System\qsvAwPB.exe
  C:\Windows\System\qsvAwPB.exe
  2⤵
  PID:12992
- C:\Windows\System\fbECsbg.exe
  C:\Windows\System\fbECsbg.exe
  2⤵
  PID:13164
- C:\Windows\System\holYkdR.exe
  C:\Windows\System\holYkdR.exe
  2⤵
  PID:12572
- C:\Windows\System\EAiNgyB.exe
  C:\Windows\System\EAiNgyB.exe
  2⤵
  PID:10684
- C:\Windows\System\kBAssDq.exe
  C:\Windows\System\kBAssDq.exe
  2⤵
  PID:13608
- C:\Windows\System\KXnwdQR.exe
  C:\Windows\System\KXnwdQR.exe
  2⤵
  PID:11184
- C:\Windows\System\EXHJmMe.exe
  C:\Windows\System\EXHJmMe.exe
  2⤵
  PID:9968
- C:\Windows\System\yyHruzj.exe
  C:\Windows\System\yyHruzj.exe
  2⤵
  PID:13780
- C:\Windows\System\SXxxBkI.exe
  C:\Windows\System\SXxxBkI.exe
  2⤵
  PID:13316
- C:\Windows\System\IBTfnpO.exe
  C:\Windows\System\IBTfnpO.exe
  2⤵
  PID:13416
- C:\Windows\System\IosrWaI.exe
  C:\Windows\System\IosrWaI.exe
  2⤵
  PID:13436
- C:\Windows\System\jQFMfqn.exe
  C:\Windows\System\jQFMfqn.exe
  2⤵
  PID:13952
- C:\Windows\System\CsHQcWV.exe
  C:\Windows\System\CsHQcWV.exe
  2⤵
  PID:13556
- C:\Windows\System\TYFiwzl.exe
  C:\Windows\System\TYFiwzl.exe
  2⤵
  PID:12900
- C:\Windows\System\IXkazxH.exe
  C:\Windows\System\IXkazxH.exe
  2⤵
  PID:13716
- C:\Windows\System\xKURkGp.exe
  C:\Windows\System\xKURkGp.exe
  2⤵
  PID:13004
- C:\Windows\System\urpmHKZ.exe
  C:\Windows\System\urpmHKZ.exe
  2⤵
  PID:13816
- C:\Windows\System\JezDUyu.exe
  C:\Windows\System\JezDUyu.exe
  2⤵
  PID:13832
- C:\Windows\System\qTvCyft.exe
  C:\Windows\System\qTvCyft.exe
  2⤵
  PID:14296
- C:\Windows\System\eEzRzGQ.exe
  C:\Windows\System\eEzRzGQ.exe
  2⤵
  PID:13604
- C:\Windows\System\PeYgFoy.exe
  C:\Windows\System\PeYgFoy.exe
  2⤵
  PID:14060
- C:\Windows\System\zUcPMhj.exe
  C:\Windows\System\zUcPMhj.exe
  2⤵
  PID:13656
- C:\Windows\System\IghmtDD.exe
  C:\Windows\System\IghmtDD.exe
  2⤵
  PID:14356
- C:\Windows\System\VEJHmQX.exe
  C:\Windows\System\VEJHmQX.exe
  2⤵
  PID:14380
- C:\Windows\System\MwNRlih.exe
  C:\Windows\System\MwNRlih.exe
  2⤵
  PID:14408
- C:\Windows\System\SCaLhtk.exe
  C:\Windows\System\SCaLhtk.exe
  2⤵
  PID:14428
- C:\Windows\System\pNsTjSs.exe
  C:\Windows\System\pNsTjSs.exe
  2⤵
  PID:14448
- C:\Windows\System\oTDgPbN.exe
  C:\Windows\System\oTDgPbN.exe
  2⤵
  PID:14472
- C:\Windows\System\lNyKmsz.exe
  C:\Windows\System\lNyKmsz.exe
  2⤵
  PID:14492
- C:\Windows\System\qrXkQzL.exe
  C:\Windows\System\qrXkQzL.exe
  2⤵
  PID:14520
- C:\Windows\System\wtsjCdy.exe
  C:\Windows\System\wtsjCdy.exe
  2⤵
  PID:14544
- C:\Windows\System\MpduEpp.exe
  C:\Windows\System\MpduEpp.exe
  2⤵
  PID:14572
- C:\Windows\System\TWfxfAT.exe
  C:\Windows\System\TWfxfAT.exe
  2⤵
  PID:14588
- C:\Windows\System\YUZgpHd.exe
  C:\Windows\System\YUZgpHd.exe
  2⤵
  PID:14612
- C:\Windows\System\ugWKdmF.exe
  C:\Windows\System\ugWKdmF.exe
  2⤵
  PID:14644
- C:\Windows\System\mxCgxFo.exe
  C:\Windows\System\mxCgxFo.exe
  2⤵
  PID:14664
- C:\Windows\System\QhcxwLy.exe
  C:\Windows\System\QhcxwLy.exe
  2⤵
  PID:14696
- C:\Windows\System\RfhZtHc.exe
  C:\Windows\System\RfhZtHc.exe
  2⤵
  PID:14720
- C:\Windows\System\vvBZQOC.exe
  C:\Windows\System\vvBZQOC.exe
  2⤵
  PID:14744
- C:\Windows\System\zLsrqUK.exe
  C:\Windows\System\zLsrqUK.exe
  2⤵
  PID:14764
- C:\Windows\System\QOZowbv.exe
  C:\Windows\System\QOZowbv.exe
  2⤵
  PID:14792
- C:\Windows\System\wIFbgWo.exe
  C:\Windows\System\wIFbgWo.exe
  2⤵
  PID:14816
- C:\Windows\System\yJOgXZJ.exe
  C:\Windows\System\yJOgXZJ.exe
  2⤵
  PID:14840
- C:\Windows\System\dKyfqBp.exe
  C:\Windows\System\dKyfqBp.exe
  2⤵
  PID:14864
- C:\Windows\System\kLEWrEh.exe
  C:\Windows\System\kLEWrEh.exe
  2⤵
  PID:14888
- C:\Windows\System\BfxDfbL.exe
  C:\Windows\System\BfxDfbL.exe
  2⤵
  PID:14908
- C:\Windows\System\PsiWPjB.exe
  C:\Windows\System\PsiWPjB.exe
  2⤵
  PID:14928
- C:\Windows\System\lKIyXkP.exe
  C:\Windows\System\lKIyXkP.exe
  2⤵
  PID:14956
- C:\Windows\System\XSRsIaJ.exe
  C:\Windows\System\XSRsIaJ.exe
  2⤵
  PID:14976
- C:\Windows\System\SpjuEft.exe
  C:\Windows\System\SpjuEft.exe
  2⤵
  PID:14996
- C:\Windows\System\MkGCXPh.exe
  C:\Windows\System\MkGCXPh.exe
  2⤵
  PID:15020
- C:\Windows\System\PqWnuAK.exe
  C:\Windows\System\PqWnuAK.exe
  2⤵
  PID:15036
- C:\Windows\System\ttVqzcD.exe
  C:\Windows\System\ttVqzcD.exe
  2⤵
  PID:15060
- C:\Windows\System\nWkSNBx.exe
  C:\Windows\System\nWkSNBx.exe
  2⤵
  PID:15084
- C:\Windows\System\lTZYVfm.exe
  C:\Windows\System\lTZYVfm.exe
  2⤵
  PID:15100
- C:\Windows\System\kXhKYeu.exe
  C:\Windows\System\kXhKYeu.exe
  2⤵
  PID:15120
- C:\Windows\System\ofYKVDI.exe
  C:\Windows\System\ofYKVDI.exe
  2⤵
  PID:15144
- C:\Windows\System\fjWnrTo.exe
  C:\Windows\System\fjWnrTo.exe
  2⤵
  PID:15168
- C:\Windows\System\MSgfRGS.exe
  C:\Windows\System\MSgfRGS.exe
  2⤵
  PID:15200
- C:\Windows\System\MBWIvkW.exe
  C:\Windows\System\MBWIvkW.exe
  2⤵
  PID:15224
- C:\Windows\System\spAjaZp.exe
  C:\Windows\System\spAjaZp.exe
  2⤵
  PID:15244
- C:\Windows\System\YGNCTtz.exe
  C:\Windows\System\YGNCTtz.exe
  2⤵
  PID:15264
- C:\Windows\System\WZmSTJa.exe
  C:\Windows\System\WZmSTJa.exe
  2⤵
  PID:15296
- C:\Windows\System\cbWVrLe.exe
  C:\Windows\System\cbWVrLe.exe
  2⤵
  PID:15316
- C:\Windows\System\KJzVryx.exe
  C:\Windows\System\KJzVryx.exe
  2⤵
  PID:15344
- C:\Windows\System\DpMDvRv.exe
  C:\Windows\System\DpMDvRv.exe
  2⤵
  PID:12776
- C:\Windows\System\urVsfJS.exe
  C:\Windows\System\urVsfJS.exe
  2⤵
  PID:13108
- C:\Windows\System\atvnazW.exe
  C:\Windows\System\atvnazW.exe
  2⤵
  PID:11452
- C:\Windows\System\bVcGirZ.exe
  C:\Windows\System\bVcGirZ.exe
  2⤵
  PID:14236
- C:\Windows\System\wmhukXU.exe
  C:\Windows\System\wmhukXU.exe
  2⤵
  PID:14316
- C:\Windows\System\wTwpzhs.exe
  C:\Windows\System\wTwpzhs.exe
  2⤵
  PID:13924
- C:\Windows\System\lARRyKn.exe
  C:\Windows\System\lARRyKn.exe
  2⤵
  PID:13600
- C:\Windows\System\DhpFQfZ.exe
  C:\Windows\System\DhpFQfZ.exe
  2⤵
  PID:12600
- C:\Windows\System\OOwHGQa.exe
  C:\Windows\System\OOwHGQa.exe
  2⤵
  PID:12648
- C:\Windows\System\lWeJUzo.exe
  C:\Windows\System\lWeJUzo.exe
  2⤵
  PID:13840
- C:\Windows\System\xwUCWUX.exe
  C:\Windows\System\xwUCWUX.exe
  2⤵
  PID:13140
- C:\Windows\System\DZyArus.exe
  C:\Windows\System\DZyArus.exe
  2⤵
  PID:12692
- C:\Windows\System\KMHYQlF.exe
  C:\Windows\System\KMHYQlF.exe
  2⤵
  PID:12588
- C:\Windows\System\DUaoeNn.exe
  C:\Windows\System\DUaoeNn.exe
  2⤵
  PID:13020
- C:\Windows\System\nrIlTgI.exe
  C:\Windows\System\nrIlTgI.exe
  2⤵
  PID:14512
- C:\Windows\System\cEAoVZW.exe
  C:\Windows\System\cEAoVZW.exe
  2⤵
  PID:13632
- C:\Windows\System\snPgAvh.exe
  C:\Windows\System\snPgAvh.exe
  2⤵
  PID:14600
- C:\Windows\System\rFlDcrj.exe
  C:\Windows\System\rFlDcrj.exe
  2⤵
  PID:14740
- C:\Windows\System\XUCbsbA.exe
  C:\Windows\System\XUCbsbA.exe
  2⤵
  PID:12508
- C:\Windows\System\YVEeIjz.exe
  C:\Windows\System\YVEeIjz.exe
  2⤵
  PID:14852
- C:\Windows\System\BNAZaXm.exe
  C:\Windows\System\BNAZaXm.exe
  2⤵
  PID:13856
- C:\Windows\System\nAEkwJG.exe
  C:\Windows\System\nAEkwJG.exe
  2⤵
  PID:12872
- C:\Windows\System\aroQfuZ.exe
  C:\Windows\System\aroQfuZ.exe
  2⤵
  PID:14948
- C:\Windows\System\qdzybgH.exe
  C:\Windows\System\qdzybgH.exe
  2⤵
  PID:13284
- C:\Windows\System\RiEDFva.exe
  C:\Windows\System\RiEDFva.exe
  2⤵
  PID:15364
- C:\Windows\System\iLdWNIm.exe
  C:\Windows\System\iLdWNIm.exe
  2⤵
  PID:15396
- C:\Windows\System\pUnEfjp.exe
  C:\Windows\System\pUnEfjp.exe
  2⤵
  PID:15416
- C:\Windows\System\zVwSIPg.exe
  C:\Windows\System\zVwSIPg.exe
  2⤵
  PID:15436
- C:\Windows\System\HNmxZjC.exe
  C:\Windows\System\HNmxZjC.exe
  2⤵
  PID:15456
- C:\Windows\System\gMdshPo.exe
  C:\Windows\System\gMdshPo.exe
  2⤵
  PID:15480
- C:\Windows\System\Bcrhxhg.exe
  C:\Windows\System\Bcrhxhg.exe
  2⤵
  PID:15504
- C:\Windows\System\MZnvLyp.exe
  C:\Windows\System\MZnvLyp.exe
  2⤵
  PID:15540
- C:\Windows\System\nXMwgfK.exe
  C:\Windows\System\nXMwgfK.exe
  2⤵
  PID:15560
- C:\Windows\System\WYlyUPC.exe
  C:\Windows\System\WYlyUPC.exe
  2⤵
  PID:15588
- C:\Windows\System\fzwxYYW.exe
  C:\Windows\System\fzwxYYW.exe
  2⤵
  PID:15604
- C:\Windows\System\pQOJdMj.exe
  C:\Windows\System\pQOJdMj.exe
  2⤵
  PID:15632
- C:\Windows\System\zgQQeCl.exe
  C:\Windows\System\zgQQeCl.exe
  2⤵
  PID:15656
- C:\Windows\System\UmoLrrz.exe
  C:\Windows\System\UmoLrrz.exe
  2⤵
  PID:15680
- C:\Windows\System\YJGUCNO.exe
  C:\Windows\System\YJGUCNO.exe
  2⤵
  PID:15696
- C:\Windows\System\MATsrTA.exe
  C:\Windows\System\MATsrTA.exe
  2⤵
  PID:15720
- C:\Windows\System\jYlIqZD.exe
  C:\Windows\System\jYlIqZD.exe
  2⤵
  PID:15740
- C:\Windows\System\reojXhP.exe
  C:\Windows\System\reojXhP.exe
  2⤵
  PID:15764
- C:\Windows\System\klfWjQQ.exe
  C:\Windows\System\klfWjQQ.exe
  2⤵
  PID:15780
- C:\Windows\System\NikzDzN.exe
  C:\Windows\System\NikzDzN.exe
  2⤵
  PID:15796
- C:\Windows\System\rcDdqWv.exe
  C:\Windows\System\rcDdqWv.exe
  2⤵
  PID:15820
- C:\Windows\System\GCkwbNW.exe
  C:\Windows\System\GCkwbNW.exe
  2⤵
  PID:15836
- C:\Windows\System\fVRXAxg.exe
  C:\Windows\System\fVRXAxg.exe
  2⤵
  PID:15860
- C:\Windows\System\uZZvEtB.exe
  C:\Windows\System\uZZvEtB.exe
  2⤵
  PID:15876
- C:\Windows\System\QYTHZeF.exe
  C:\Windows\System\QYTHZeF.exe
  2⤵
  PID:15896
- C:\Windows\System\obbNJPP.exe
  C:\Windows\System\obbNJPP.exe
  2⤵
  PID:15928
- C:\Windows\System\bLEpPjr.exe
  C:\Windows\System\bLEpPjr.exe
  2⤵
  PID:15948
- C:\Windows\System\ArLtMtT.exe
  C:\Windows\System\ArLtMtT.exe
  2⤵
  PID:15980
- C:\Windows\System\xCIZEOq.exe
  C:\Windows\System\xCIZEOq.exe
  2⤵
  PID:16000
- C:\Windows\System\irGXTZb.exe
  C:\Windows\System\irGXTZb.exe
  2⤵
  PID:16020
- C:\Windows\System\gqnNQcJ.exe
  C:\Windows\System\gqnNQcJ.exe
  2⤵
  PID:16048
- C:\Windows\System\gEhOiry.exe
  C:\Windows\System\gEhOiry.exe
  2⤵
  PID:16072
- C:\Windows\System\MmCNVBl.exe
  C:\Windows\System\MmCNVBl.exe
  2⤵
  PID:16088
- C:\Windows\System\uuioMQi.exe
  C:\Windows\System\uuioMQi.exe
  2⤵
  PID:16112
- C:\Windows\System\fNsSqYq.exe
  C:\Windows\System\fNsSqYq.exe
  2⤵
  PID:16132
- C:\Windows\System\WVuSJmq.exe
  C:\Windows\System\WVuSJmq.exe
  2⤵
  PID:16156
- C:\Windows\System\oMDSDqu.exe
  C:\Windows\System\oMDSDqu.exe
  2⤵
  PID:16188
- C:\Windows\System\xlTyzZo.exe
  C:\Windows\System\xlTyzZo.exe
  2⤵
  PID:16212
- C:\Windows\System\qZVGNnP.exe
  C:\Windows\System\qZVGNnP.exe
  2⤵
  PID:16228
- C:\Windows\System\sSEfAoM.exe
  C:\Windows\System\sSEfAoM.exe
  2⤵
  PID:16256
- C:\Windows\System\rhnzDXJ.exe
  C:\Windows\System\rhnzDXJ.exe
  2⤵
  PID:16284
- C:\Windows\System\hTSiqIv.exe
  C:\Windows\System\hTSiqIv.exe
  2⤵
  PID:16312
- C:\Windows\System\fUdIiVZ.exe
  C:\Windows\System\fUdIiVZ.exe
  2⤵
  PID:16332
- C:\Windows\System\eHREBxx.exe
  C:\Windows\System\eHREBxx.exe
  2⤵
  PID:16356
- C:\Windows\System\LmivTEz.exe
  C:\Windows\System\LmivTEz.exe
  2⤵
  PID:16380
- C:\Windows\System\fBxFMig.exe
  C:\Windows\System\fBxFMig.exe
  2⤵
  PID:15192
- C:\Windows\System\hiGNWJb.exe
  C:\Windows\System\hiGNWJb.exe
  2⤵
  PID:14708
- C:\Windows\System\ejCDNYu.exe
  C:\Windows\System\ejCDNYu.exe
  2⤵
  PID:15288
- C:\Windows\System\PVmbjDA.exe
  C:\Windows\System\PVmbjDA.exe
  2⤵
  PID:14096
- C:\Windows\System\uptxUvs.exe
  C:\Windows\System\uptxUvs.exe
  2⤵
  PID:14264
- C:\Windows\System\KDHHlAZ.exe
  C:\Windows\System\KDHHlAZ.exe
  2⤵
  PID:13152
- C:\Windows\System\oSZgfQt.exe
  C:\Windows\System\oSZgfQt.exe
  2⤵
  PID:14244
- C:\Windows\System\TxYZDih.exe
  C:\Windows\System\TxYZDih.exe
  2⤵
  PID:14968
- C:\Windows\System\lQwdfKZ.exe
  C:\Windows\System\lQwdfKZ.exe
  2⤵
  PID:13916
- C:\Windows\System\ZBzrhkf.exe
  C:\Windows\System\ZBzrhkf.exe
  2⤵
  PID:12896
- C:\Windows\System\jpljKIE.exe
  C:\Windows\System\jpljKIE.exe
  2⤵
  PID:15960
- C:\Windows\System\OLjFahP.exe
  C:\Windows\System\OLjFahP.exe
  2⤵
  PID:15988
- C:\Windows\System\KIpRldN.exe
  C:\Windows\System\KIpRldN.exe
  2⤵
  PID:16096
- C:\Windows\System\CfYRVBr.exe
  C:\Windows\System\CfYRVBr.exe
  2⤵
  PID:16120
- C:\Windows\System\BuFcDsJ.exe
  C:\Windows\System\BuFcDsJ.exe
  2⤵
  PID:13384
- C:\Windows\System\DvyQeHJ.exe
  C:\Windows\System\DvyQeHJ.exe
  2⤵
  PID:16208
- C:\Windows\System\ivXisgK.exe
  C:\Windows\System\ivXisgK.exe
  2⤵
  PID:16224
- C:\Windows\System\YjxWICM.exe
  C:\Windows\System\YjxWICM.exe
  2⤵
  PID:14344
- C:\Windows\System\JiPVgYB.exe
  C:\Windows\System\JiPVgYB.exe
  2⤵
  PID:16272
- C:\Windows\System\QIqmSNq.exe
  C:\Windows\System\QIqmSNq.exe
  2⤵
  PID:14716
- C:\Windows\System\EnAUFtB.exe
  C:\Windows\System\EnAUFtB.exe
  2⤵
  PID:15280
- C:\Windows\System\WwcHBTX.exe
  C:\Windows\System\WwcHBTX.exe
  2⤵
  PID:16396
- C:\Windows\System\lnblgDa.exe
  C:\Windows\System\lnblgDa.exe
  2⤵
  PID:16424
- C:\Windows\System\JrLYMiZ.exe
  C:\Windows\System\JrLYMiZ.exe
  2⤵
  PID:16440
- C:\Windows\System\XtegRqz.exe
  C:\Windows\System\XtegRqz.exe
  2⤵
  PID:16468
- C:\Windows\System\zsjDYcH.exe
  C:\Windows\System\zsjDYcH.exe
  2⤵
  PID:16492
- C:\Windows\System\qgeCSTn.exe
  C:\Windows\System\qgeCSTn.exe
  2⤵
  PID:16544
- C:\Windows\System\uMbTULt.exe
  C:\Windows\System\uMbTULt.exe
  2⤵
  PID:16592
- C:\Windows\System\HwZSuXf.exe
  C:\Windows\System\HwZSuXf.exe
  2⤵
  PID:16644
- C:\Windows\System\MUBSlQP.exe
  C:\Windows\System\MUBSlQP.exe
  2⤵
  PID:16680
- C:\Windows\System\BGkQeiK.exe
  C:\Windows\System\BGkQeiK.exe
  2⤵
  PID:16716
- C:\Windows\System\LiWKyXZ.exe
  C:\Windows\System\LiWKyXZ.exe
  2⤵
  PID:16776
- C:\Windows\System\IgfAPpW.exe
  C:\Windows\System\IgfAPpW.exe
  2⤵
  PID:16796
- C:\Windows\System\jntbytW.exe
  C:\Windows\System\jntbytW.exe
  2⤵
  PID:16812
- C:\Windows\System\BzIdwyy.exe
  C:\Windows\System\BzIdwyy.exe
  2⤵
  PID:16836
- C:\Windows\System\pixKFxo.exe
  C:\Windows\System\pixKFxo.exe
  2⤵
  PID:16856
- C:\Windows\System\pPVEBxW.exe
  C:\Windows\System\pPVEBxW.exe
  2⤵
  PID:17120
- C:\Windows\System\uwzBNrt.exe
  C:\Windows\System\uwzBNrt.exe
  2⤵
  PID:17136
- C:\Windows\System\pgPmYjr.exe
  C:\Windows\System\pgPmYjr.exe
  2⤵
  PID:17168
- C:\Windows\System\GFqQNVL.exe
  C:\Windows\System\GFqQNVL.exe
  2⤵
  PID:17200
- C:\Windows\System\sHSVxgZ.exe
  C:\Windows\System\sHSVxgZ.exe
  2⤵
  PID:17244
- C:\Windows\System\qFNKzAd.exe
  C:\Windows\System\qFNKzAd.exe
  2⤵
  PID:17288
- C:\Windows\System\BYXEvqd.exe
  C:\Windows\System\BYXEvqd.exe
  2⤵
  PID:17332
- C:\Windows\System\qBLPPLP.exe
  C:\Windows\System\qBLPPLP.exe
  2⤵
  PID:17368
- C:\Windows\System\xyqaODx.exe
  C:\Windows\System\xyqaODx.exe
  2⤵
  PID:17404
- C:\Windows\System\mYWXJbf.exe
  C:\Windows\System\mYWXJbf.exe
  2⤵
  PID:15644
- C:\Windows\System\yrddNCx.exe
  C:\Windows\System\yrddNCx.exe
  2⤵
  PID:15692
- C:\Windows\System\QKvGquj.exe
  C:\Windows\System\QKvGquj.exe
  2⤵
  PID:13912
- C:\Windows\System\CFTXlgz.exe
  C:\Windows\System\CFTXlgz.exe
  2⤵
  PID:14104
- C:\Windows\System\oeYfIuE.exe
  C:\Windows\System\oeYfIuE.exe
  2⤵
  PID:16104
- C:\Windows\System\eOYUyVU.exe
  C:\Windows\System\eOYUyVU.exe
  2⤵
  PID:16352
- C:\Windows\System\gHauhfF.exe
  C:\Windows\System\gHauhfF.exe
  2⤵
  PID:14468
- C:\Windows\System\NYyGXMy.exe
  C:\Windows\System\NYyGXMy.exe
  2⤵
  PID:15444
- C:\Windows\System\JsTvXBr.exe
  C:\Windows\System\JsTvXBr.exe
  2⤵
  PID:14284
- C:\Windows\System\fBlxFUa.exe
  C:\Windows\System\fBlxFUa.exe
  2⤵
  PID:15572
- C:\Windows\System\hHHrCCR.exe
  C:\Windows\System\hHHrCCR.exe
  2⤵
  PID:15032
- C:\Windows\System\EIEOznt.exe
  C:\Windows\System\EIEOznt.exe
  2⤵
  PID:16576

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17112

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AwdIuYq.exe

Filesize
1.2MB

MD5
7c576843cabe82727b4e8ea78db65c7d

SHA1
5b55160ae48245b641c37b257a9816fd029aee21

SHA256
91c780b902763e659d5d115cdf5460f4b377aae46bb17832b48139f9318579df

SHA512
606790a4b7a052b8b70984b451669420db6e7862787394b88f4f2dcd31b816ca0255b6751ef6071ab09c639d9fea112f5a50e0aeac50e66c41c9c1adbb66bdca

Download Submit
C:\Windows\System\DqTvbto.exe

Filesize
1.2MB

MD5
284a7f888b2825e6b86c9bd5b9dd7ff8

SHA1
d0fd1cdf4ed92e371cf7a439a58f438434f67c89

SHA256
24a043f14e4aa0b8bebbfaa859f27ae1a831c19549657f6e609bb3f297d431dc

SHA512
379d0aeb9d2bb39cf367b9e123e785a0973cd27021f418c0fee99a48e0d84d71a084e39c3740bea9f4570f24eb054900c502702a9e76a8525941904eced38c22

Download Submit
C:\Windows\System\FMqtfVG.exe

Filesize
1.2MB

MD5
1f24e2df022b9dc5a3426f499bc29251

SHA1
d6bc15d49384ef4ecc01205723b04adbd0c36ce9

SHA256
f522ae12e1ce825088171cdd9badfa5046ce7b901208d424c140644a3b3959a7

SHA512
ec0f4987d01ada71e56d10536dbd1b91abc6dd3d8118d431691db02a39d3427320b1c6c24935e6c84e31cba00c84e21df2aa7e71ea15a1ab0a79a56ced3d8345

Download Submit
C:\Windows\System\GGMlhJy.exe

Filesize
1.2MB

MD5
afef8123fad78cc1c6142d5fb19f1387

SHA1
b4f8df0f887025612daf42962b05a0d245768474

SHA256
3036d77f0b54675db35880ff4b646e58c680dbfb674c5151827108d97e4e5f8f

SHA512
a7230cd28c11cea27c987afc50722a6cc33e756be1da6231d7d75728e519450ce80f723a6b70c60317f85bb737b3b442f1c18fb16abe67028ff0f96e8558e5d9

Download Submit
C:\Windows\System\GzIhQsM.exe

Filesize
1.2MB

MD5
405ad3ce3ad9a2131b579735c7089ee3

SHA1
a2a25b77f27e6514dc214c08650f4d0bd2293121

SHA256
8f06c0487aeea677f9952ccd432822e760d077fe3d59f9292a345b6d035f82eb

SHA512
b992471da83e8ee36bb6911739bb682bfd4efdcd24118508d03c59e6ccbef958a78d77cb318c2a4fe30a9fad2c46423978407a76b96b1400dec363035a4b8efd

Download Submit
C:\Windows\System\IKLluuV.exe

Filesize
1.2MB

MD5
91eb968d8270be8b0bf92463182a9bcd

SHA1
0b068435e7d049a7e079b75b5397888a5f0034bb

SHA256
edc02d66f50d27dc2d837798c2cf7fd4a503d6f3acbc7d3b447feba2a45e3628

SHA512
4689ff7dd66aa280c43c97d8fa3551e8cc9d1c9e546ebf8423c45b27c9225030f84895dfdcd22ce59eaad55c7697c7fee2eeff1349c16a3a1e30812a8093bb45

Download Submit
C:\Windows\System\IXkrzaz.exe

Filesize
1.2MB

MD5
468cf679493fa64a683330e7387c99d9

SHA1
1e20e3e54a877831db4ca5e6742e55036353b939

SHA256
4137bc5b81f604be8b65dd547ceec6217c7efb8592e5245b9f4843f004ff6214

SHA512
6f51ecfa905489fbc468ab248f61c9ba7be4d44f83d5996bffebedefc52209f731e46f7436b12dfc1b60e06f6fcaca82989c1f2b383692dd94e93d7ea93c9601

Download Submit
C:\Windows\System\IwzjAOx.exe

Filesize
1.2MB

MD5
735232316308f583a62428c2e6991776

SHA1
e2bd93f6d6bd26e71128763d80092880bbfd182f

SHA256
3fb237e75755d56dde2d88ee3632b20d348edd985936c5452bd6cabaaad73082

SHA512
da4db6a006894625c30752edad1474d84219ada8d32b4729b072e9148afa7c92f54f374e654e85728fd6c85a6dcbd4ca32b24a36650ca16ebbe7f08caab5795a

Download Submit
C:\Windows\System\JBYKEjD.exe

Filesize
1.2MB

MD5
f3101cfed4be45a4506c339912783067

SHA1
44ec13d9e2bf286ed0ad3f2743e46a22a7962a5f

SHA256
ceed88308919998aa270aa5935e4a354bdcf2065ff14117eae6917e3189a981d

SHA512
c3a598c11fe27d14a0d426c1a2ac1f32e954db8a1b41bae5560b5be13901c4a28391d60d0c14b3a6952b4a693b711ed522f6080632ca4eb9fe6b9fc4e9532832

Download Submit
C:\Windows\System\NXXMdnS.exe

Filesize
1.2MB

MD5
faba33f456259c14cd5c3dca10ce1098

SHA1
190a942057a2985dd026dff29e4799007ad7dd5e

SHA256
427176e90e731d34f3fe4eb5bc5805a9a5845cfc74f9b4ac6734162042ede4ad

SHA512
792d687c5d68a4f533a523db2ce8e58377fbbb2c0b6d80d9ed6509600914b7ab8c13abb1e6da70509abed88f8ef57878101d77bd91c225d0e7dcabbf8c5e21a5

Download Submit
C:\Windows\System\NgNpWqM.exe

Filesize
1.2MB

MD5
1242640d2724721cf76c4096d6ef0768

SHA1
cbb2156a0bf1578638e3478fe288c7da1d05902a

SHA256
284b1a7e54aca85a1ef2db80de638f5bb0310942891d9a6553e03944c17fa6df

SHA512
74a9e6cb35799c393e3cca1d9d94d4b65e2d43d4fff6a24eec52ee0bbb6ef8a29facddf00233b18bd075736ea3d3653c89ab6798bb2377eb710e8de364a16310

Download Submit
C:\Windows\System\NudstKE.exe

Filesize
1.2MB

MD5
40b2564b1192650a6749fb12dcc04726

SHA1
e71477c3085f40df21aab01ecb9a5c2d3f6ad44d

SHA256
1215aa6753a1b2e5fb23bd61b3f0d6faaf2dd8908b9f35104786582557d2b1f5

SHA512
6c2638d850545a5c75a6f186fff779a7de4709cdf82409e6e380a719b02859536006a22f660a3360c8c833b69f77a39e16e40255ff8d9ae86912f54a01b83e8b

Download Submit
C:\Windows\System\PUUmsfr.exe

Filesize
1.2MB

MD5
fc5de60122ae0843d1244af3f02e3c30

SHA1
4facd2ce53f8a19af5b08a0ea14fbba2f988d0b1

SHA256
fb635a69259af143695cac9e9d9a31e3c206a3652751d6f901e880af187b4799

SHA512
c64151b630bbc227b27a977a3ed0f0519b5705567603073dd2a4e88d32b6f09cba85932aea80899b56b610beb90053e1821b3da74caa43ab9d161b37ebb44683

Download Submit
C:\Windows\System\QhDVQNr.exe

Filesize
1.2MB

MD5
79735db3a4494b191a9d6bd84018b631

SHA1
13ed5a8a75fdb8c552446a672bc867454f1fc681

SHA256
87848f483eecb320f0ad359b75da7931e96eddb3047ab4db945dc09557a86a42

SHA512
5f96540fd337f3cf4a8d34a8d95b75fab09aabe5be84f21640b4ce04a54cde250117728a092691221fc5c5979c4bfc80a0da0fd9b75fcf264681a6c59f11cebf

Download Submit
C:\Windows\System\RrIErQo.exe

Filesize
1.2MB

MD5
afa6018a777f21b7cfb426cd39975f96

SHA1
9d922ff7fad2b783d37c4d433c9682e60cb35aab

SHA256
9acbf41944ca0914d9fbc52444dd959c661ae384addb83c8c40630af9f3b248a

SHA512
3a2d2233994ebaed7178af1f11ed2f2d44b4caffdc60bd3831d238bf42d2ccfebe73c5a80758be561c7535f9fcd222cb4be22cc6d30a0beac159722afee35cde

Download Submit
C:\Windows\System\SanNaIw.exe

Filesize
1.2MB

MD5
9cf3b80241d880d350587091c75fbd33

SHA1
8d327aaf23f9658c1cc457fc9c7e59e8ca7840fc

SHA256
f01a3ba1b245eff2c9892687ddbb84b8dbcb90ece425f5fe43b6572165e263d9

SHA512
bcdfc39136a860ea317eb9b138ae5d9d5d338413513c35274a110f5e03cfd365943b47bf884a4abc3b7545307549c570dea06891e296a2233212686c35660624

Download Submit
C:\Windows\System\SlXkKBd.exe

Filesize
1.2MB

MD5
1fc9d239fcc86bcfc739ed7722d6d4a2

SHA1
cc73d738f0fa143b0d9c754f43015ac2d0c1e06b

SHA256
aaf5d725636dcc5a1af568145c7056035ac721a35dcd36be6711b285b5005433

SHA512
41ac296408d48fb472bfdba17b4c97beaf22efe14921f5e5b684ffa9d50a8424124dc5023dfc2ed60d9a7d6cafbbd92aa62bf9ebee80870e7faf7e897791af06

Download Submit
C:\Windows\System\TveYPmF.exe

Filesize
1.2MB

MD5
b4f6843730bd8281dc4cf7cd73dd1180

SHA1
71fd0899b07064f8243dab4e7d72f4204662b771

SHA256
13ef0267f8b87e748a7116e97f08a8433e12b0340aebdf190e31a63984f25927

SHA512
16fd879bc52f3b4fbf1e817caf6acb4e6ddb89438021a5bb44e7d01d1dc6a5f2dcd4acacae6559b421f739f44689a6ce7a7d0b4c92c71844d979ed4d29bd88cc

Download Submit
C:\Windows\System\XjkDTxs.exe

Filesize
1.2MB

MD5
995e8c0748967250ffb37369d2f4c54d

SHA1
12684fb0ef127d0554701eec3f9f72c2bb62d430

SHA256
771ffe171b97be46d989e94e6906345d92f2cb933c1890a0ac91f89e2999acd3

SHA512
ee8ffae9ae22ea58a907aeff61c824868c726105cdc38e54d2f62a492079765696dd9a6bfc1a9b6455ccdf5b11ce5e98b800de5887240fe8cb7e403f7b6b46b8

Download Submit
C:\Windows\System\aGTORXO.exe

Filesize
1.2MB

MD5
281bb44c5868f079320f770a5690164d

SHA1
e90c8221887d06dd0a447f1cbdceaf6bfbf7ab5c

SHA256
64b28f60e000fbed81a2fa4530a9af325d7dc4e58f01aa2bf75c79e4093f8f9b

SHA512
6b8e92eb45e49b1b15849dccbd6cf0fdbd0611c2bc1120ea8513f08b3fd4d381bb0c0d4df38bf63886c0d2ebd3e5dd0f694ede50a65825e546d2ca82ea8f030c

Download Submit
C:\Windows\System\bvQjhhf.exe

Filesize
1.2MB

MD5
217ecaae6c8cf624503899ab82671eed

SHA1
584b3c671b88a3472dfe23e48a6196ffe600615f

SHA256
696307705080ad011b052bd522d78fde80f0533380ff148c80d5826e86f816bd

SHA512
abb3d885f9ba725adacbd9c113707e9d4a5b6cd6e5d7ccbdcaacfef7303c35ec0564ddbab60306d14cb10980e73a7d1e388ca39f02c520a430f101780b30cb61

Download Submit
C:\Windows\System\eeLukPx.exe

Filesize
1.2MB

MD5
0454b6e1592183e106e3449432d9fc9b

SHA1
6718c0fa499b30c210d079f3cfbf360e850ceccc

SHA256
e8ac5f9c349a5d903c8cd46f4c5d90a8bc0cbfa55ff4d70704f3dd4535af0037

SHA512
da5949f9cc4072748c78b4a73d79186549f1f96885b2bfc884e5598a6b3bcf8e9cc25f3ba48da370dda87053d1951160a366e57d43ee6823dda1fef4f88b8064

Download Submit
C:\Windows\System\itWaCyI.exe

Filesize
1.2MB

MD5
adbb53915762a1ac42ad004ede0cdb46

SHA1
47e7485afdd789eae47a821776bcf0a7d5c9bd72

SHA256
159800714fe195db8f4a2d8185f594d00d4a195840522b59ebc12007291452eb

SHA512
4678afc30deb0b257d44101fec3cc29fc77076b3725267bf7f555e3753641c6315882fe43db30fd317d9e4b1761b8b3fa8936122a5f3a16248ae8b7d9bf873fb

Download Submit
C:\Windows\System\kZkFHwY.exe

Filesize
1.2MB

MD5
e5632be29200a362d2bbd4c7d08801d6

SHA1
e176e05dac359860c78f3a363987138203a830c8

SHA256
2d31547ad74b02e20c36be7fc0c6ac361ff53c3cac9d406e2c0da2a1b02cae7a

SHA512
bd997f6a6b4953be5e412ded7cc175bcd76a61163227e58ea8490112da342cd8c24e3769c8eb269bb2f3b35331a85f7aa1a07e503de43feac507cca427b842bc

Download Submit
C:\Windows\System\kitQKAN.exe

Filesize
1.2MB

MD5
b1410abcff1194fc0f66b5d76be3da78

SHA1
9d8271dfb25d32483a810978239f48698fbc6363

SHA256
cf45af2d3a474437409d7802aa3b023bf1a45c6974f5068a7fd9cb38520a52ee

SHA512
0f744493d7a1d37a2bd6a51bc7adbe41563be1a7932f3479e07d651b1e6b91f07308f486e58488ffb1a8cacd5e8fe8db287edc61ae3424183b2a5c82df0a5198

Download Submit
C:\Windows\System\mLAfoew.exe

Filesize
1.2MB

MD5
545c419c14dc6d27a5292f702c116aec

SHA1
ad95a9ddd73df8b511d2f8df802fbaf60991d8f0

SHA256
57dbdebb981b0e746b6e7090cfc30033fd32708b48281b75845399a763ce5a1a

SHA512
3ebb0f80e701eff4b744e43848ea854db1912d2172ed81d809fb6824fa9579a5a53bf1e70b5ca1da3368573fd14edcf995ed2b0c7ec5fef2fcebc93ac72fffec

Download Submit
C:\Windows\System\nWnxECp.exe

Filesize
1.2MB

MD5
5a27c56685c467cf72bd75f625cfdf08

SHA1
336bcd74d9cd9e6aaf82f41b9394b2a22f92c648

SHA256
18a69acf92e94c55f72dbcbbce4efed0082cb3e114a8258da4c066381c9691bb

SHA512
71556c2caa0a1a0ffda4e22234249d3cc4308b26e62911a7bc894552225f9a9ce7280c0f2a6facb4dc2391d3f4a2f5884c12eaeff46072b93387387441bca9b5

Download Submit
C:\Windows\System\pIIceEp.exe

Filesize
1.2MB

MD5
1ca4e07ac1756da8ca75d7f6fc702064

SHA1
413cffa7dd678a2de02e249d306fed27aab0fca6

SHA256
47f813deef589c05288a8d35992df635a216472b71818ecf438607bc311d360c

SHA512
f5a34acaf00f641c7b66f11adc460434b61866cf83265b3b7ef9b4c3f72c16f77bc94a50bd481a673a752f6b27f355f9b9ddc9c3dc4b71ffea140be3be6b54b3

Download Submit
C:\Windows\System\qaBDOeS.exe

Filesize
1.2MB

MD5
63959d688c86a4542117e1b7e2f1bffa

SHA1
ff540f054fe56229884f14981a39bc3f59b4d9b8

SHA256
b8133b7709fcb0f8af9d7f86e41056d7f70d7581b68e9f6c3d5ebd6ef07fbece

SHA512
dc9741c0a1441a1e96b0c8e2b10bb9dcca35a4bee7ab3f10b896d9ce4d8874752e070a78ce87e80406263f85f268f67a0390c884fcf51c8b28841afb0e506242

Download Submit
C:\Windows\System\rauOhuM.exe

Filesize
1.2MB

MD5
4f76fe5c1d98e537704376cf94b99453

SHA1
61625dfd1b47020baf206faf063c812d897bac71

SHA256
f629e95aabfa41f0cbf6a9b0faa5d87c5085f3ec5c7bb87a6d51a49a72dbb51c

SHA512
50875e77fc4f9399e9d2177ab313f0f8365b94fbb0ab65a1f3ce41c83927ed6d68409d6fc762898dd61c5a7ce7d34a88230b1987e6d578ea311426b35d9dcfac

Download Submit
C:\Windows\System\sEaXPuu.exe

Filesize
1.2MB

MD5
ea706fe8428fe2203929d7088414ec4d

SHA1
701bbc3ce7b01126834445edc6111df68b1f25c6

SHA256
f7becd269df9497b23b7fa34f4be717e1f6e47d7fb344b1b811ae11091bd272c

SHA512
9a889f98776a990856b2d757994b7d75c2475b48a37ed54e8bcf0cd857bb547a095d709011d6622a8a704f786b2db5c590a8b376111ca1d6a4567b00deb5acef

Download Submit
C:\Windows\System\swKOfqi.exe

Filesize
1.2MB

MD5
8e7799fb1d5b28cdbdc8a3950f698cf2

SHA1
f09faaac8b0fad69ef2ee226724d760081a9478a

SHA256
fe414a2f79347ff381011d587274482d5f698beafc844381f56ad026e647117b

SHA512
27561634572b73577a39b73f35b40919dacfd79e0d43114b78a4bf27fc8e47b1fa8b4c3486814a8b41e72ad6431a7af5f7e12c394d432964f8a7738457061a3f

Download Submit
C:\Windows\System\tCAvopu.exe

Filesize
1.2MB

MD5
99712530e8ec27bd956e9b426dd37f4f

SHA1
ecf61d33075b18a9693e3e6f902342ccfe8d5333

SHA256
5aae3db12b8046c53cf8b2d05c7c345e380f3f77b2c2d7cce3d2b457c28fedcd

SHA512
41898fa9e01bb4fd808ef611054078297980f9bb58eb95dc40e22df70cc0f077c630253b417f57877af1f2f2ca802a2bdd5cc68b8d3635a57c3cf89799624d2f

Download Submit
C:\Windows\System\tXOLBiu.exe

Filesize
1.2MB

MD5
acd3cdd0a71a6247f3f162fc5c0b3471

SHA1
716bfd7b60cc9560265ca6416b962d376e76dd1b

SHA256
7d9a035ea271bb8fdf0bdf234dfaf40ed5002c8890fd6a9376a35b9ddf95cd55

SHA512
2d31f841db0304ee43fefa87f8e9c504aba76c5382a4b1732d06e43c07be92565673ef252d8ae40ef3bc279c33e9a882f40d0a9f72928bb5beb722db93d62717

Download Submit
C:\Windows\System\tfQjCmu.exe

Filesize
1.2MB

MD5
0b73fdb55b236a306b3483287d2bf2c9

SHA1
a936934e4be51228e64780acabefcfa19864bba9

SHA256
021de5d71e84bcf754658ae35c8058e676fcaecfd93d6379caeca96d0157da21

SHA512
635d91ddec8e35842f7aab83845b0cc87a954942507e8bc8947eed98264973a1e4b0e0e1269228a14585199301d3dcba15a8f89131cf3db375284b3a781c151b

Download Submit
C:\Windows\System\uQbYIju.exe

Filesize
1.2MB

MD5
af29d9881e8c081d46496fd9e108d72d

SHA1
4e075403846d4385744621c9b20cfd72401ddc0c

SHA256
f49512e3736ca851180829a7b36693e5e177ff994f924f29568e44da23318e68

SHA512
990b32edcb1535c5118d330603ad411889f97ffba7927e339cbb55e6aba7bf6650118e68450309bf372aa633f1cf840c550e5da35ddedc42ff0747590c78087f

Download Submit
C:\Windows\System\zJBnPRT.exe

Filesize
1.2MB

MD5
c12dec4258eb42b72b5346b484d84d10

SHA1
40de9540665107178713d2adc0f556548ef008ff

SHA256
ba9052754cbd631d08cddc545210b84aa244d908a257a145d91c8c3912196bf2

SHA512
803d0a523e3b20d43c707f46167c738e9c4083693e27911918139d059e6a127fb4e4f42a9dd9b0c143c6b6c729c4a8a9731f62384ced74b31a61717dab0c4940

Download Submit
memory/2228-0-0x000001C77C0B0000-0x000001C77C0C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads