xmrig | 8aed1695d31565cf7619aeac89a27166cfac5468811d706c00b37d1b04873575

Analysis

max time kernel
102s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
Size

1.7MB
MD5

13a8482d72c6730c11faecc345448300
SHA1

e1fe8208a3f830925054d2a5452e4e60de0a2c9f
SHA256

8aed1695d31565cf7619aeac89a27166cfac5468811d706c00b37d1b04873575
SHA512

3953afb2df000b38b5f1425631f1453f34df2a3e0f6426961b093d9c62ec9a2dfe352ff51c7937515420b80802b715662939699188d7d65c78ce5770f7127117
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIR1zPg4g2Jfelu:GemTLkNdfE0pZaJ

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000022912-4.dat	xmrig
behavioral2/files/0x0007000000023431-7.dat	xmrig
behavioral2/files/0x0007000000023432-17.dat	xmrig
behavioral2/files/0x0007000000023434-28.dat	xmrig
behavioral2/files/0x0007000000023435-37.dat	xmrig
behavioral2/files/0x0007000000023436-40.dat	xmrig
behavioral2/files/0x0007000000023433-27.dat	xmrig
behavioral2/files/0x000800000002342d-15.dat	xmrig
behavioral2/files/0x000800000002342e-47.dat	xmrig
behavioral2/files/0x0007000000023437-43.dat	xmrig
behavioral2/files/0x0007000000023438-54.dat	xmrig
behavioral2/files/0x0007000000023439-60.dat	xmrig
behavioral2/files/0x000700000002343b-65.dat	xmrig
behavioral2/files/0x000700000002343c-69.dat	xmrig
behavioral2/files/0x000700000002343d-73.dat	xmrig
behavioral2/files/0x000700000002343e-80.dat	xmrig
behavioral2/files/0x000700000002343f-84.dat	xmrig
behavioral2/files/0x0007000000023440-90.dat	xmrig
behavioral2/files/0x0007000000023441-95.dat	xmrig
behavioral2/files/0x0007000000023442-99.dat	xmrig
behavioral2/files/0x0007000000023443-104.dat	xmrig
behavioral2/files/0x0007000000023444-110.dat	xmrig
behavioral2/files/0x0007000000023445-114.dat	xmrig
behavioral2/files/0x0007000000023446-117.dat	xmrig
behavioral2/files/0x0003000000022978-134.dat	xmrig
behavioral2/files/0x0007000000023449-137.dat	xmrig
behavioral2/files/0x000c000000023399-145.dat	xmrig
behavioral2/files/0x000700000002344a-148.dat	xmrig
behavioral2/files/0x0007000000023448-135.dat	xmrig
behavioral2/files/0x0007000000023447-127.dat	xmrig
behavioral2/files/0x000700000002344b-153.dat	xmrig
behavioral2/files/0x001900000002293b-160.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2788	XHjjErr.exe
1120	NepQVPh.exe
4140	dNDUYau.exe
4496	ImHDfux.exe
3124	hEiisir.exe
2824	GqnyitI.exe
1908	HOmwrXe.exe
1148	ZothFHh.exe
1292	Gojgzfc.exe
2152	MxTQyEm.exe
4584	xjKMgUW.exe
1872	prXLKYd.exe
980	wLtOdFE.exe
2080	AlSkScZ.exe
4492	ENLtOYA.exe
824	vgzWcaH.exe
2396	QyhpGKZ.exe
2196	OMqKHha.exe
1256	LnTTsNc.exe
3408	vqCRDTj.exe
2536	tJCfmMM.exe
4696	jjenanN.exe
4880	JqVfqKY.exe
3952	ZXplYKG.exe
2008	bHFTVtU.exe
1544	ZmiamCp.exe
3436	okzfJMJ.exe
3452	JWEmmvb.exe
2096	fIjFxiV.exe
1484	okexKDq.exe
780	YIspsem.exe
1452	dCFqReH.exe
4168	wTKmFqi.exe
2944	bIJkXMj.exe
4576	xJVpivR.exe
2844	zfgRMJg.exe
1116	NfyGxiH.exe
1864	FQbZTlU.exe
2704	DOgFPSh.exe
4424	ULmJKip.exe
1064	fZNSWsD.exe
2980	IRrhtcQ.exe
3396	iJmnufC.exe
4180	RIcskBe.exe
1488	TpVpkfM.exe
3464	PpEfAgF.exe
4972	bfriisu.exe
2900	rXzWOsw.exe
2004	hVmAZLT.exe
1724	aUPwtNx.exe
1288	qGhKTyZ.exe
3864	QhfLIJq.exe
4932	KncKfwx.exe
2532	qPpySVX.exe
4996	iabGsWe.exe
5020	iABrkwL.exe
4120	EGhIIgF.exe
4856	BpTBbFL.exe
3268	eDxIhRv.exe
1668	vUNiYaD.exe
4544	bTxEfrD.exe
4788	IUUaXYN.exe
3868	sUPOpEK.exe
4160	jcrJBEl.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LhRkzzk.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\VjuMIQt.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\jFRXBGx.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\RIcskBe.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\KXIZZFq.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\oqNvFDj.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\iCEaXff.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\vSlvmhZ.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\kanTpaI.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\SkjOQZH.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\NXyodvs.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\HHARLLl.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\bFOVwSw.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\PNlnhcF.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\awPuwil.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\JoCVKlJ.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\znoZxgk.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\mjaJWLb.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\ZTXPXHw.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\GcIDIXj.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\ERkgErg.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\ewCBobt.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\KWedBOI.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\YkkJsWn.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\DDqaJVu.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\IPJerKY.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\RuidSwT.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\CBuhMVa.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\clgQycB.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\dMoxzAD.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\iWCcuvE.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\ILkwxdz.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\SGjOwZd.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\IlVTszP.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\rRrSxVt.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\aohCudQ.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\VgQhEBj.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\KJJzUnk.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\koUihNm.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\FZpyMni.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\XldxALy.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\qXafoYz.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\bqFqakn.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\NwwYvxk.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\ntpslfy.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\tDXgxrU.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\xwRAQxB.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\vZXlMVc.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\SWsZgwO.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\AbMucfK.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\uEMpITA.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\nBFIfVc.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\vQjXVQO.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\wYNyuJE.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\eaqoFCM.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\qwnhlkO.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\ZMCUUCZ.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\aWoUNnK.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\hRsTxZg.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\rYIvzYB.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\xMLRRdH.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\dUEEyAD.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\OhItWfk.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
File created	C:\Windows\System\MyvZmny.exe	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16908	dwm.exe
Token: SeChangeNotifyPrivilege	16908	dwm.exe
Token: 33	16908	dwm.exe
Token: SeIncBasePriorityPrivilege	16908	dwm.exe
Token: SeShutdownPrivilege	16908	dwm.exe
Token: SeCreatePagefilePrivilege	16908	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2788	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	82
PID 2800 wrote to memory of 2788	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	82
PID 2800 wrote to memory of 1120	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	83
PID 2800 wrote to memory of 1120	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	83
PID 2800 wrote to memory of 4140	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	84
PID 2800 wrote to memory of 4140	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	84
PID 2800 wrote to memory of 4496	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	85
PID 2800 wrote to memory of 4496	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	85
PID 2800 wrote to memory of 3124	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	86
PID 2800 wrote to memory of 3124	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	86
PID 2800 wrote to memory of 2824	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	87
PID 2800 wrote to memory of 2824	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	87
PID 2800 wrote to memory of 1908	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	88
PID 2800 wrote to memory of 1908	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	88
PID 2800 wrote to memory of 1148	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	89
PID 2800 wrote to memory of 1148	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	89
PID 2800 wrote to memory of 1292	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	90
PID 2800 wrote to memory of 1292	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	90
PID 2800 wrote to memory of 2152	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	91
PID 2800 wrote to memory of 2152	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	91
PID 2800 wrote to memory of 4584	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	92
PID 2800 wrote to memory of 4584	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	92
PID 2800 wrote to memory of 1872	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	93
PID 2800 wrote to memory of 1872	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	93
PID 2800 wrote to memory of 980	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	94
PID 2800 wrote to memory of 980	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	94
PID 2800 wrote to memory of 2080	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	95
PID 2800 wrote to memory of 2080	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	95
PID 2800 wrote to memory of 4492	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	96
PID 2800 wrote to memory of 4492	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	96
PID 2800 wrote to memory of 824	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	100
PID 2800 wrote to memory of 824	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	100
PID 2800 wrote to memory of 2396	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	101
PID 2800 wrote to memory of 2396	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	101
PID 2800 wrote to memory of 2196	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	102
PID 2800 wrote to memory of 2196	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	102
PID 2800 wrote to memory of 1256	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	103
PID 2800 wrote to memory of 1256	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	103
PID 2800 wrote to memory of 3408	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	104
PID 2800 wrote to memory of 3408	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	104
PID 2800 wrote to memory of 2536	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	105
PID 2800 wrote to memory of 2536	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	105
PID 2800 wrote to memory of 4696	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	106
PID 2800 wrote to memory of 4696	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	106
PID 2800 wrote to memory of 4880	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	107
PID 2800 wrote to memory of 4880	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	107
PID 2800 wrote to memory of 3952	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	108
PID 2800 wrote to memory of 3952	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	108
PID 2800 wrote to memory of 2008	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	109
PID 2800 wrote to memory of 2008	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	109
PID 2800 wrote to memory of 1544	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	110
PID 2800 wrote to memory of 1544	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	110
PID 2800 wrote to memory of 3452	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	111
PID 2800 wrote to memory of 3452	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	111
PID 2800 wrote to memory of 3436	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	113
PID 2800 wrote to memory of 3436	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	113
PID 2800 wrote to memory of 2096	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	114
PID 2800 wrote to memory of 2096	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	114
PID 2800 wrote to memory of 1484	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	115
PID 2800 wrote to memory of 1484	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	115
PID 2800 wrote to memory of 780	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	116
PID 2800 wrote to memory of 780	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	116
PID 2800 wrote to memory of 1452	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	117
PID 2800 wrote to memory of 1452	2800	13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\13a8482d72c6730c11faecc345448300_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\System\XHjjErr.exe
  C:\Windows\System\XHjjErr.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\NepQVPh.exe
  C:\Windows\System\NepQVPh.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\dNDUYau.exe
  C:\Windows\System\dNDUYau.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\ImHDfux.exe
  C:\Windows\System\ImHDfux.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\hEiisir.exe
  C:\Windows\System\hEiisir.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\GqnyitI.exe
  C:\Windows\System\GqnyitI.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\HOmwrXe.exe
  C:\Windows\System\HOmwrXe.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\ZothFHh.exe
  C:\Windows\System\ZothFHh.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\Gojgzfc.exe
  C:\Windows\System\Gojgzfc.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\MxTQyEm.exe
  C:\Windows\System\MxTQyEm.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\xjKMgUW.exe
  C:\Windows\System\xjKMgUW.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\prXLKYd.exe
  C:\Windows\System\prXLKYd.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\wLtOdFE.exe
  C:\Windows\System\wLtOdFE.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\AlSkScZ.exe
  C:\Windows\System\AlSkScZ.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\ENLtOYA.exe
  C:\Windows\System\ENLtOYA.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\vgzWcaH.exe
  C:\Windows\System\vgzWcaH.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\QyhpGKZ.exe
  C:\Windows\System\QyhpGKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\OMqKHha.exe
  C:\Windows\System\OMqKHha.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\LnTTsNc.exe
  C:\Windows\System\LnTTsNc.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\vqCRDTj.exe
  C:\Windows\System\vqCRDTj.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\tJCfmMM.exe
  C:\Windows\System\tJCfmMM.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\jjenanN.exe
  C:\Windows\System\jjenanN.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\JqVfqKY.exe
  C:\Windows\System\JqVfqKY.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\ZXplYKG.exe
  C:\Windows\System\ZXplYKG.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\bHFTVtU.exe
  C:\Windows\System\bHFTVtU.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\ZmiamCp.exe
  C:\Windows\System\ZmiamCp.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\JWEmmvb.exe
  C:\Windows\System\JWEmmvb.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\okzfJMJ.exe
  C:\Windows\System\okzfJMJ.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\fIjFxiV.exe
  C:\Windows\System\fIjFxiV.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\okexKDq.exe
  C:\Windows\System\okexKDq.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\YIspsem.exe
  C:\Windows\System\YIspsem.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\dCFqReH.exe
  C:\Windows\System\dCFqReH.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\wTKmFqi.exe
  C:\Windows\System\wTKmFqi.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\bIJkXMj.exe
  C:\Windows\System\bIJkXMj.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\xJVpivR.exe
  C:\Windows\System\xJVpivR.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\zfgRMJg.exe
  C:\Windows\System\zfgRMJg.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\NfyGxiH.exe
  C:\Windows\System\NfyGxiH.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\FQbZTlU.exe
  C:\Windows\System\FQbZTlU.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\DOgFPSh.exe
  C:\Windows\System\DOgFPSh.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\ULmJKip.exe
  C:\Windows\System\ULmJKip.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\fZNSWsD.exe
  C:\Windows\System\fZNSWsD.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\IRrhtcQ.exe
  C:\Windows\System\IRrhtcQ.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\iJmnufC.exe
  C:\Windows\System\iJmnufC.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\RIcskBe.exe
  C:\Windows\System\RIcskBe.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\TpVpkfM.exe
  C:\Windows\System\TpVpkfM.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\PpEfAgF.exe
  C:\Windows\System\PpEfAgF.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\bfriisu.exe
  C:\Windows\System\bfriisu.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\rXzWOsw.exe
  C:\Windows\System\rXzWOsw.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\hVmAZLT.exe
  C:\Windows\System\hVmAZLT.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\aUPwtNx.exe
  C:\Windows\System\aUPwtNx.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\qGhKTyZ.exe
  C:\Windows\System\qGhKTyZ.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\QhfLIJq.exe
  C:\Windows\System\QhfLIJq.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\KncKfwx.exe
  C:\Windows\System\KncKfwx.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\qPpySVX.exe
  C:\Windows\System\qPpySVX.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\iabGsWe.exe
  C:\Windows\System\iabGsWe.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\iABrkwL.exe
  C:\Windows\System\iABrkwL.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\EGhIIgF.exe
  C:\Windows\System\EGhIIgF.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\BpTBbFL.exe
  C:\Windows\System\BpTBbFL.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\eDxIhRv.exe
  C:\Windows\System\eDxIhRv.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\bTxEfrD.exe
  C:\Windows\System\bTxEfrD.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\vUNiYaD.exe
  C:\Windows\System\vUNiYaD.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\IUUaXYN.exe
  C:\Windows\System\IUUaXYN.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\sUPOpEK.exe
  C:\Windows\System\sUPOpEK.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\jcrJBEl.exe
  C:\Windows\System\jcrJBEl.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\eUrxymD.exe
  C:\Windows\System\eUrxymD.exe
  2⤵
  PID:4800
- C:\Windows\System\OnWNdzM.exe
  C:\Windows\System\OnWNdzM.exe
  2⤵
  PID:2928
- C:\Windows\System\qWmWXOQ.exe
  C:\Windows\System\qWmWXOQ.exe
  2⤵
  PID:684
- C:\Windows\System\NsMmadR.exe
  C:\Windows\System\NsMmadR.exe
  2⤵
  PID:712
- C:\Windows\System\weaBaSe.exe
  C:\Windows\System\weaBaSe.exe
  2⤵
  PID:3480
- C:\Windows\System\NXyodvs.exe
  C:\Windows\System\NXyodvs.exe
  2⤵
  PID:3028
- C:\Windows\System\gCNtTSM.exe
  C:\Windows\System\gCNtTSM.exe
  2⤵
  PID:3996
- C:\Windows\System\hlTrZYV.exe
  C:\Windows\System\hlTrZYV.exe
  2⤵
  PID:4056
- C:\Windows\System\oLLnSEK.exe
  C:\Windows\System\oLLnSEK.exe
  2⤵
  PID:4400
- C:\Windows\System\CnWwNeD.exe
  C:\Windows\System\CnWwNeD.exe
  2⤵
  PID:3524
- C:\Windows\System\aqrGBDy.exe
  C:\Windows\System\aqrGBDy.exe
  2⤵
  PID:1572
- C:\Windows\System\VkzYuCz.exe
  C:\Windows\System\VkzYuCz.exe
  2⤵
  PID:2304
- C:\Windows\System\nzmNXvA.exe
  C:\Windows\System\nzmNXvA.exe
  2⤵
  PID:2708
- C:\Windows\System\WSPPtTz.exe
  C:\Windows\System\WSPPtTz.exe
  2⤵
  PID:4476
- C:\Windows\System\OnIZIfj.exe
  C:\Windows\System\OnIZIfj.exe
  2⤵
  PID:2068
- C:\Windows\System\qXafoYz.exe
  C:\Windows\System\qXafoYz.exe
  2⤵
  PID:4592
- C:\Windows\System\HddsKrv.exe
  C:\Windows\System\HddsKrv.exe
  2⤵
  PID:948
- C:\Windows\System\tnUsUUV.exe
  C:\Windows\System\tnUsUUV.exe
  2⤵
  PID:4908
- C:\Windows\System\QrSMfVc.exe
  C:\Windows\System\QrSMfVc.exe
  2⤵
  PID:4664
- C:\Windows\System\KTZvLms.exe
  C:\Windows\System\KTZvLms.exe
  2⤵
  PID:2148
- C:\Windows\System\dfvTwuD.exe
  C:\Windows\System\dfvTwuD.exe
  2⤵
  PID:3176
- C:\Windows\System\yJoKoHj.exe
  C:\Windows\System\yJoKoHj.exe
  2⤵
  PID:4388
- C:\Windows\System\jEpGtZy.exe
  C:\Windows\System\jEpGtZy.exe
  2⤵
  PID:2244
- C:\Windows\System\DSqxceX.exe
  C:\Windows\System\DSqxceX.exe
  2⤵
  PID:2324
- C:\Windows\System\WhmbYUu.exe
  C:\Windows\System\WhmbYUu.exe
  2⤵
  PID:1956
- C:\Windows\System\eYYYSnM.exe
  C:\Windows\System\eYYYSnM.exe
  2⤵
  PID:4528
- C:\Windows\System\hRsTxZg.exe
  C:\Windows\System\hRsTxZg.exe
  2⤵
  PID:632
- C:\Windows\System\xMMugQP.exe
  C:\Windows\System\xMMugQP.exe
  2⤵
  PID:1308
- C:\Windows\System\jWWJwvm.exe
  C:\Windows\System\jWWJwvm.exe
  2⤵
  PID:3420
- C:\Windows\System\uAMqIRL.exe
  C:\Windows\System\uAMqIRL.exe
  2⤵
  PID:4520
- C:\Windows\System\GcIDIXj.exe
  C:\Windows\System\GcIDIXj.exe
  2⤵
  PID:3304
- C:\Windows\System\hNVbYeK.exe
  C:\Windows\System\hNVbYeK.exe
  2⤵
  PID:4176
- C:\Windows\System\IuHnpzk.exe
  C:\Windows\System\IuHnpzk.exe
  2⤵
  PID:1648
- C:\Windows\System\HHARLLl.exe
  C:\Windows\System\HHARLLl.exe
  2⤵
  PID:4452
- C:\Windows\System\oTHvIui.exe
  C:\Windows\System\oTHvIui.exe
  2⤵
  PID:5140
- C:\Windows\System\dWaXuSi.exe
  C:\Windows\System\dWaXuSi.exe
  2⤵
  PID:5160
- C:\Windows\System\kEukMfM.exe
  C:\Windows\System\kEukMfM.exe
  2⤵
  PID:5192
- C:\Windows\System\FCfHxGy.exe
  C:\Windows\System\FCfHxGy.exe
  2⤵
  PID:5228
- C:\Windows\System\nkPAXOw.exe
  C:\Windows\System\nkPAXOw.exe
  2⤵
  PID:5256
- C:\Windows\System\ezXHVaE.exe
  C:\Windows\System\ezXHVaE.exe
  2⤵
  PID:5276
- C:\Windows\System\BqpqBNi.exe
  C:\Windows\System\BqpqBNi.exe
  2⤵
  PID:5304
- C:\Windows\System\qwnkJfL.exe
  C:\Windows\System\qwnkJfL.exe
  2⤵
  PID:5340
- C:\Windows\System\HcAMULY.exe
  C:\Windows\System\HcAMULY.exe
  2⤵
  PID:5356
- C:\Windows\System\sEYbAjJ.exe
  C:\Windows\System\sEYbAjJ.exe
  2⤵
  PID:5392
- C:\Windows\System\HeBFCBw.exe
  C:\Windows\System\HeBFCBw.exe
  2⤵
  PID:5424
- C:\Windows\System\IlVTszP.exe
  C:\Windows\System\IlVTszP.exe
  2⤵
  PID:5456
- C:\Windows\System\uyNGiRs.exe
  C:\Windows\System\uyNGiRs.exe
  2⤵
  PID:5472
- C:\Windows\System\iWDyebK.exe
  C:\Windows\System\iWDyebK.exe
  2⤵
  PID:5512
- C:\Windows\System\BQUqDZP.exe
  C:\Windows\System\BQUqDZP.exe
  2⤵
  PID:5548
- C:\Windows\System\TlETJiI.exe
  C:\Windows\System\TlETJiI.exe
  2⤵
  PID:5572
- C:\Windows\System\tovPgIi.exe
  C:\Windows\System\tovPgIi.exe
  2⤵
  PID:5592
- C:\Windows\System\ccocWxl.exe
  C:\Windows\System\ccocWxl.exe
  2⤵
  PID:5612
- C:\Windows\System\OZZUSCK.exe
  C:\Windows\System\OZZUSCK.exe
  2⤵
  PID:5648
- C:\Windows\System\GBYwSor.exe
  C:\Windows\System\GBYwSor.exe
  2⤵
  PID:5676
- C:\Windows\System\rPnPjcc.exe
  C:\Windows\System\rPnPjcc.exe
  2⤵
  PID:5708
- C:\Windows\System\emoLEuf.exe
  C:\Windows\System\emoLEuf.exe
  2⤵
  PID:5732
- C:\Windows\System\mOZmTEP.exe
  C:\Windows\System\mOZmTEP.exe
  2⤵
  PID:5772
- C:\Windows\System\HSyWUjg.exe
  C:\Windows\System\HSyWUjg.exe
  2⤵
  PID:5800
- C:\Windows\System\WBizNIO.exe
  C:\Windows\System\WBizNIO.exe
  2⤵
  PID:5828
- C:\Windows\System\GlWAibh.exe
  C:\Windows\System\GlWAibh.exe
  2⤵
  PID:5860
- C:\Windows\System\GTLTGDP.exe
  C:\Windows\System\GTLTGDP.exe
  2⤵
  PID:5884
- C:\Windows\System\RSJoiCa.exe
  C:\Windows\System\RSJoiCa.exe
  2⤵
  PID:5912
- C:\Windows\System\vNZzEre.exe
  C:\Windows\System\vNZzEre.exe
  2⤵
  PID:5940
- C:\Windows\System\KXIZZFq.exe
  C:\Windows\System\KXIZZFq.exe
  2⤵
  PID:5964
- C:\Windows\System\IrKdNFj.exe
  C:\Windows\System\IrKdNFj.exe
  2⤵
  PID:5984
- C:\Windows\System\sEnmAtW.exe
  C:\Windows\System\sEnmAtW.exe
  2⤵
  PID:6024
- C:\Windows\System\uqSIFvN.exe
  C:\Windows\System\uqSIFvN.exe
  2⤵
  PID:6040
- C:\Windows\System\IMoTqPq.exe
  C:\Windows\System\IMoTqPq.exe
  2⤵
  PID:6072
- C:\Windows\System\jfvBmod.exe
  C:\Windows\System\jfvBmod.exe
  2⤵
  PID:6108
- C:\Windows\System\rRrSxVt.exe
  C:\Windows\System\rRrSxVt.exe
  2⤵
  PID:6132
- C:\Windows\System\vObVzxs.exe
  C:\Windows\System\vObVzxs.exe
  2⤵
  PID:3816
- C:\Windows\System\JHbiHDl.exe
  C:\Windows\System\JHbiHDl.exe
  2⤵
  PID:5220
- C:\Windows\System\hnCdKEh.exe
  C:\Windows\System\hnCdKEh.exe
  2⤵
  PID:5240
- C:\Windows\System\UOGZNKU.exe
  C:\Windows\System\UOGZNKU.exe
  2⤵
  PID:5328
- C:\Windows\System\nWedNXk.exe
  C:\Windows\System\nWedNXk.exe
  2⤵
  PID:5380
- C:\Windows\System\YneQava.exe
  C:\Windows\System\YneQava.exe
  2⤵
  PID:5440
- C:\Windows\System\FichsIn.exe
  C:\Windows\System\FichsIn.exe
  2⤵
  PID:5508
- C:\Windows\System\lpXEJGu.exe
  C:\Windows\System\lpXEJGu.exe
  2⤵
  PID:5588
- C:\Windows\System\TAcIDtM.exe
  C:\Windows\System\TAcIDtM.exe
  2⤵
  PID:5668
- C:\Windows\System\syelxRJ.exe
  C:\Windows\System\syelxRJ.exe
  2⤵
  PID:5716
- C:\Windows\System\AmcFLrZ.exe
  C:\Windows\System\AmcFLrZ.exe
  2⤵
  PID:5752
- C:\Windows\System\FScTTAM.exe
  C:\Windows\System\FScTTAM.exe
  2⤵
  PID:5868
- C:\Windows\System\BzLpPfE.exe
  C:\Windows\System\BzLpPfE.exe
  2⤵
  PID:5896
- C:\Windows\System\ibXSnwB.exe
  C:\Windows\System\ibXSnwB.exe
  2⤵
  PID:5972
- C:\Windows\System\plFDcVa.exe
  C:\Windows\System\plFDcVa.exe
  2⤵
  PID:6052
- C:\Windows\System\eklcqTX.exe
  C:\Windows\System\eklcqTX.exe
  2⤵
  PID:6080
- C:\Windows\System\avAgcmh.exe
  C:\Windows\System\avAgcmh.exe
  2⤵
  PID:5216
- C:\Windows\System\xuwNjbb.exe
  C:\Windows\System\xuwNjbb.exe
  2⤵
  PID:5324
- C:\Windows\System\fIlPKIM.exe
  C:\Windows\System\fIlPKIM.exe
  2⤵
  PID:5436
- C:\Windows\System\nlMjlbi.exe
  C:\Windows\System\nlMjlbi.exe
  2⤵
  PID:5600
- C:\Windows\System\hvSQiFp.exe
  C:\Windows\System\hvSQiFp.exe
  2⤵
  PID:5744
- C:\Windows\System\ARQvrwF.exe
  C:\Windows\System\ARQvrwF.exe
  2⤵
  PID:5936
- C:\Windows\System\nTrLeKG.exe
  C:\Windows\System\nTrLeKG.exe
  2⤵
  PID:6064
- C:\Windows\System\CUMFPPZ.exe
  C:\Windows\System\CUMFPPZ.exe
  2⤵
  PID:5488
- C:\Windows\System\fSwnNcC.exe
  C:\Windows\System\fSwnNcC.exe
  2⤵
  PID:5556
- C:\Windows\System\IdGypwl.exe
  C:\Windows\System\IdGypwl.exe
  2⤵
  PID:6016
- C:\Windows\System\GWQDKfD.exe
  C:\Windows\System\GWQDKfD.exe
  2⤵
  PID:5468
- C:\Windows\System\qRbHsvj.exe
  C:\Windows\System\qRbHsvj.exe
  2⤵
  PID:6148
- C:\Windows\System\StitNmn.exe
  C:\Windows\System\StitNmn.exe
  2⤵
  PID:6172
- C:\Windows\System\WOwfYOy.exe
  C:\Windows\System\WOwfYOy.exe
  2⤵
  PID:6196
- C:\Windows\System\LFImSqs.exe
  C:\Windows\System\LFImSqs.exe
  2⤵
  PID:6216
- C:\Windows\System\zcyMjqm.exe
  C:\Windows\System\zcyMjqm.exe
  2⤵
  PID:6248
- C:\Windows\System\NEEuHQA.exe
  C:\Windows\System\NEEuHQA.exe
  2⤵
  PID:6280
- C:\Windows\System\EaNHKLv.exe
  C:\Windows\System\EaNHKLv.exe
  2⤵
  PID:6316
- C:\Windows\System\puDZQNC.exe
  C:\Windows\System\puDZQNC.exe
  2⤵
  PID:6340
- C:\Windows\System\saQnWTF.exe
  C:\Windows\System\saQnWTF.exe
  2⤵
  PID:6360
- C:\Windows\System\orzqcgo.exe
  C:\Windows\System\orzqcgo.exe
  2⤵
  PID:6408
- C:\Windows\System\lZGcMAx.exe
  C:\Windows\System\lZGcMAx.exe
  2⤵
  PID:6432
- C:\Windows\System\oDptGwe.exe
  C:\Windows\System\oDptGwe.exe
  2⤵
  PID:6468
- C:\Windows\System\jWBunWf.exe
  C:\Windows\System\jWBunWf.exe
  2⤵
  PID:6500
- C:\Windows\System\MTPNnNT.exe
  C:\Windows\System\MTPNnNT.exe
  2⤵
  PID:6516
- C:\Windows\System\EgHytQC.exe
  C:\Windows\System\EgHytQC.exe
  2⤵
  PID:6532
- C:\Windows\System\TiYOWAQ.exe
  C:\Windows\System\TiYOWAQ.exe
  2⤵
  PID:6568
- C:\Windows\System\NtmKbFX.exe
  C:\Windows\System\NtmKbFX.exe
  2⤵
  PID:6600
- C:\Windows\System\oKaRvRZ.exe
  C:\Windows\System\oKaRvRZ.exe
  2⤵
  PID:6628
- C:\Windows\System\VQnnbhZ.exe
  C:\Windows\System\VQnnbhZ.exe
  2⤵
  PID:6668
- C:\Windows\System\OzwvWLu.exe
  C:\Windows\System\OzwvWLu.exe
  2⤵
  PID:6696
- C:\Windows\System\jKbhFOV.exe
  C:\Windows\System\jKbhFOV.exe
  2⤵
  PID:6712
- C:\Windows\System\iVNGGCg.exe
  C:\Windows\System\iVNGGCg.exe
  2⤵
  PID:6740
- C:\Windows\System\OrpnGqK.exe
  C:\Windows\System\OrpnGqK.exe
  2⤵
  PID:6776
- C:\Windows\System\CEQapLq.exe
  C:\Windows\System\CEQapLq.exe
  2⤵
  PID:6808
- C:\Windows\System\EfCMfbE.exe
  C:\Windows\System\EfCMfbE.exe
  2⤵
  PID:6824
- C:\Windows\System\jfNvHlp.exe
  C:\Windows\System\jfNvHlp.exe
  2⤵
  PID:6860
- C:\Windows\System\wplHijw.exe
  C:\Windows\System\wplHijw.exe
  2⤵
  PID:6892
- C:\Windows\System\QHmgPQe.exe
  C:\Windows\System\QHmgPQe.exe
  2⤵
  PID:6932
- C:\Windows\System\ZWqIAkN.exe
  C:\Windows\System\ZWqIAkN.exe
  2⤵
  PID:6948
- C:\Windows\System\ZzyWDBw.exe
  C:\Windows\System\ZzyWDBw.exe
  2⤵
  PID:6964
- C:\Windows\System\eKFlzPe.exe
  C:\Windows\System\eKFlzPe.exe
  2⤵
  PID:6996
- C:\Windows\System\jsVlAXM.exe
  C:\Windows\System\jsVlAXM.exe
  2⤵
  PID:7032
- C:\Windows\System\SIZQoAQ.exe
  C:\Windows\System\SIZQoAQ.exe
  2⤵
  PID:7060
- C:\Windows\System\rujXdyx.exe
  C:\Windows\System\rujXdyx.exe
  2⤵
  PID:7088
- C:\Windows\System\GxbvKBc.exe
  C:\Windows\System\GxbvKBc.exe
  2⤵
  PID:7104
- C:\Windows\System\KkxigMG.exe
  C:\Windows\System\KkxigMG.exe
  2⤵
  PID:7140
- C:\Windows\System\eswKlnT.exe
  C:\Windows\System\eswKlnT.exe
  2⤵
  PID:7156
- C:\Windows\System\dpIIDbh.exe
  C:\Windows\System\dpIIDbh.exe
  2⤵
  PID:6180
- C:\Windows\System\pgnOvzv.exe
  C:\Windows\System\pgnOvzv.exe
  2⤵
  PID:6224
- C:\Windows\System\QJUxpkx.exe
  C:\Windows\System\QJUxpkx.exe
  2⤵
  PID:6308
- C:\Windows\System\vsAnMHv.exe
  C:\Windows\System\vsAnMHv.exe
  2⤵
  PID:6416
- C:\Windows\System\FdVByyi.exe
  C:\Windows\System\FdVByyi.exe
  2⤵
  PID:6452
- C:\Windows\System\kDsqicv.exe
  C:\Windows\System\kDsqicv.exe
  2⤵
  PID:6512
- C:\Windows\System\bdUlzWZ.exe
  C:\Windows\System\bdUlzWZ.exe
  2⤵
  PID:6584
- C:\Windows\System\LhKoMkK.exe
  C:\Windows\System\LhKoMkK.exe
  2⤵
  PID:6688
- C:\Windows\System\OFLKOIG.exe
  C:\Windows\System\OFLKOIG.exe
  2⤵
  PID:6724
- C:\Windows\System\WkXMxTD.exe
  C:\Windows\System\WkXMxTD.exe
  2⤵
  PID:6800
- C:\Windows\System\ewCBobt.exe
  C:\Windows\System\ewCBobt.exe
  2⤵
  PID:6884
- C:\Windows\System\MgYmpmP.exe
  C:\Windows\System\MgYmpmP.exe
  2⤵
  PID:6916
- C:\Windows\System\hTYXZez.exe
  C:\Windows\System\hTYXZez.exe
  2⤵
  PID:6976
- C:\Windows\System\pvEdzOj.exe
  C:\Windows\System\pvEdzOj.exe
  2⤵
  PID:7072
- C:\Windows\System\pPxAOOv.exe
  C:\Windows\System\pPxAOOv.exe
  2⤵
  PID:7148
- C:\Windows\System\hluVErP.exe
  C:\Windows\System\hluVErP.exe
  2⤵
  PID:6188
- C:\Windows\System\QgCcTMF.exe
  C:\Windows\System\QgCcTMF.exe
  2⤵
  PID:6164
- C:\Windows\System\QxDScWW.exe
  C:\Windows\System\QxDScWW.exe
  2⤵
  PID:6464
- C:\Windows\System\uEMpITA.exe
  C:\Windows\System\uEMpITA.exe
  2⤵
  PID:6660
- C:\Windows\System\lqxHdbs.exe
  C:\Windows\System\lqxHdbs.exe
  2⤵
  PID:6768
- C:\Windows\System\OpdeBfl.exe
  C:\Windows\System\OpdeBfl.exe
  2⤵
  PID:7024
- C:\Windows\System\crLXSAZ.exe
  C:\Windows\System\crLXSAZ.exe
  2⤵
  PID:7164
- C:\Windows\System\cgUIFmF.exe
  C:\Windows\System\cgUIFmF.exe
  2⤵
  PID:6492
- C:\Windows\System\ZLUCKMd.exe
  C:\Windows\System\ZLUCKMd.exe
  2⤵
  PID:6528
- C:\Windows\System\FZfpqAv.exe
  C:\Windows\System\FZfpqAv.exe
  2⤵
  PID:7100
- C:\Windows\System\XsFAgjW.exe
  C:\Windows\System\XsFAgjW.exe
  2⤵
  PID:6624
- C:\Windows\System\uvMCrAz.exe
  C:\Windows\System\uvMCrAz.exe
  2⤵
  PID:7176
- C:\Windows\System\ubEyQys.exe
  C:\Windows\System\ubEyQys.exe
  2⤵
  PID:7204
- C:\Windows\System\ZfJUcTT.exe
  C:\Windows\System\ZfJUcTT.exe
  2⤵
  PID:7232
- C:\Windows\System\koBqeZT.exe
  C:\Windows\System\koBqeZT.exe
  2⤵
  PID:7252
- C:\Windows\System\memBJmX.exe
  C:\Windows\System\memBJmX.exe
  2⤵
  PID:7288
- C:\Windows\System\LREfVlW.exe
  C:\Windows\System\LREfVlW.exe
  2⤵
  PID:7316
- C:\Windows\System\uRZSHfS.exe
  C:\Windows\System\uRZSHfS.exe
  2⤵
  PID:7344
- C:\Windows\System\eVIPCmF.exe
  C:\Windows\System\eVIPCmF.exe
  2⤵
  PID:7372
- C:\Windows\System\rTRzIhn.exe
  C:\Windows\System\rTRzIhn.exe
  2⤵
  PID:7412
- C:\Windows\System\fsmjeOa.exe
  C:\Windows\System\fsmjeOa.exe
  2⤵
  PID:7428
- C:\Windows\System\lODIPbD.exe
  C:\Windows\System\lODIPbD.exe
  2⤵
  PID:7456
- C:\Windows\System\REYfVBm.exe
  C:\Windows\System\REYfVBm.exe
  2⤵
  PID:7484
- C:\Windows\System\YUTWMJM.exe
  C:\Windows\System\YUTWMJM.exe
  2⤵
  PID:7524
- C:\Windows\System\DVXTXUL.exe
  C:\Windows\System\DVXTXUL.exe
  2⤵
  PID:7540
- C:\Windows\System\kCzycZw.exe
  C:\Windows\System\kCzycZw.exe
  2⤵
  PID:7580
- C:\Windows\System\Pixzqrp.exe
  C:\Windows\System\Pixzqrp.exe
  2⤵
  PID:7600
- C:\Windows\System\LdkGZGC.exe
  C:\Windows\System\LdkGZGC.exe
  2⤵
  PID:7640
- C:\Windows\System\bFOVwSw.exe
  C:\Windows\System\bFOVwSw.exe
  2⤵
  PID:7668
- C:\Windows\System\njmsNnw.exe
  C:\Windows\System\njmsNnw.exe
  2⤵
  PID:7696
- C:\Windows\System\RBiFdRe.exe
  C:\Windows\System\RBiFdRe.exe
  2⤵
  PID:7724
- C:\Windows\System\TxAiNhx.exe
  C:\Windows\System\TxAiNhx.exe
  2⤵
  PID:7752
- C:\Windows\System\XXZtRXE.exe
  C:\Windows\System\XXZtRXE.exe
  2⤵
  PID:7768
- C:\Windows\System\KQDYVDR.exe
  C:\Windows\System\KQDYVDR.exe
  2⤵
  PID:7796
- C:\Windows\System\CrKVOgl.exe
  C:\Windows\System\CrKVOgl.exe
  2⤵
  PID:7828
- C:\Windows\System\grmiUWe.exe
  C:\Windows\System\grmiUWe.exe
  2⤵
  PID:7852
- C:\Windows\System\ukXSRYO.exe
  C:\Windows\System\ukXSRYO.exe
  2⤵
  PID:7868
- C:\Windows\System\bpUbHnK.exe
  C:\Windows\System\bpUbHnK.exe
  2⤵
  PID:7888
- C:\Windows\System\ALQMRnt.exe
  C:\Windows\System\ALQMRnt.exe
  2⤵
  PID:7904
- C:\Windows\System\DtmiFYx.exe
  C:\Windows\System\DtmiFYx.exe
  2⤵
  PID:7976
- C:\Windows\System\eLJPjpp.exe
  C:\Windows\System\eLJPjpp.exe
  2⤵
  PID:7992
- C:\Windows\System\IHugpjO.exe
  C:\Windows\System\IHugpjO.exe
  2⤵
  PID:8032
- C:\Windows\System\JZAOkDB.exe
  C:\Windows\System\JZAOkDB.exe
  2⤵
  PID:8048
- C:\Windows\System\YvePuVH.exe
  C:\Windows\System\YvePuVH.exe
  2⤵
  PID:8076
- C:\Windows\System\XgFbzFA.exe
  C:\Windows\System\XgFbzFA.exe
  2⤵
  PID:8120
- C:\Windows\System\ottGXuB.exe
  C:\Windows\System\ottGXuB.exe
  2⤵
  PID:8136
- C:\Windows\System\xQdFWeT.exe
  C:\Windows\System\xQdFWeT.exe
  2⤵
  PID:8164
- C:\Windows\System\iswfVJz.exe
  C:\Windows\System\iswfVJz.exe
  2⤵
  PID:6348
- C:\Windows\System\beDoRtP.exe
  C:\Windows\System\beDoRtP.exe
  2⤵
  PID:7224
- C:\Windows\System\YxoGLGX.exe
  C:\Windows\System\YxoGLGX.exe
  2⤵
  PID:7304
- C:\Windows\System\aohCudQ.exe
  C:\Windows\System\aohCudQ.exe
  2⤵
  PID:7360
- C:\Windows\System\tpBkNMn.exe
  C:\Windows\System\tpBkNMn.exe
  2⤵
  PID:7396
- C:\Windows\System\lqWZZOq.exe
  C:\Windows\System\lqWZZOq.exe
  2⤵
  PID:7472
- C:\Windows\System\irOVulT.exe
  C:\Windows\System\irOVulT.exe
  2⤵
  PID:7536
- C:\Windows\System\XFubnhh.exe
  C:\Windows\System\XFubnhh.exe
  2⤵
  PID:7636
- C:\Windows\System\yQMLgyj.exe
  C:\Windows\System\yQMLgyj.exe
  2⤵
  PID:7692
- C:\Windows\System\XjEXEjD.exe
  C:\Windows\System\XjEXEjD.exe
  2⤵
  PID:7764
- C:\Windows\System\jFRXBGx.exe
  C:\Windows\System\jFRXBGx.exe
  2⤵
  PID:7824
- C:\Windows\System\pqpXXig.exe
  C:\Windows\System\pqpXXig.exe
  2⤵
  PID:7864
- C:\Windows\System\rIbcdny.exe
  C:\Windows\System\rIbcdny.exe
  2⤵
  PID:7964
- C:\Windows\System\EeyGglM.exe
  C:\Windows\System\EeyGglM.exe
  2⤵
  PID:7984
- C:\Windows\System\LKDmSDC.exe
  C:\Windows\System\LKDmSDC.exe
  2⤵
  PID:8040
- C:\Windows\System\iCEaXff.exe
  C:\Windows\System\iCEaXff.exe
  2⤵
  PID:8108
- C:\Windows\System\qEtVZJf.exe
  C:\Windows\System\qEtVZJf.exe
  2⤵
  PID:8160
- C:\Windows\System\ecRICKg.exe
  C:\Windows\System\ecRICKg.exe
  2⤵
  PID:7248
- C:\Windows\System\wGLkOJG.exe
  C:\Windows\System\wGLkOJG.exe
  2⤵
  PID:7384
- C:\Windows\System\OvvzTXQ.exe
  C:\Windows\System\OvvzTXQ.exe
  2⤵
  PID:7420
- C:\Windows\System\cqKZzxJ.exe
  C:\Windows\System\cqKZzxJ.exe
  2⤵
  PID:7736
- C:\Windows\System\efyLPuE.exe
  C:\Windows\System\efyLPuE.exe
  2⤵
  PID:7880
- C:\Windows\System\mTBdWKo.exe
  C:\Windows\System\mTBdWKo.exe
  2⤵
  PID:8060
- C:\Windows\System\PsdmGcq.exe
  C:\Windows\System\PsdmGcq.exe
  2⤵
  PID:7240
- C:\Windows\System\lVfrWQz.exe
  C:\Windows\System\lVfrWQz.exe
  2⤵
  PID:3940
- C:\Windows\System\xnEilZx.exe
  C:\Windows\System\xnEilZx.exe
  2⤵
  PID:7568
- C:\Windows\System\yCkqKIY.exe
  C:\Windows\System\yCkqKIY.exe
  2⤵
  PID:7660
- C:\Windows\System\rDwUWMT.exe
  C:\Windows\System\rDwUWMT.exe
  2⤵
  PID:8152
- C:\Windows\System\RSPjrjs.exe
  C:\Windows\System\RSPjrjs.exe
  2⤵
  PID:7680
- C:\Windows\System\GNLJGmM.exe
  C:\Windows\System\GNLJGmM.exe
  2⤵
  PID:4912
- C:\Windows\System\kMaARqG.exe
  C:\Windows\System\kMaARqG.exe
  2⤵
  PID:7968
- C:\Windows\System\xohMsYB.exe
  C:\Windows\System\xohMsYB.exe
  2⤵
  PID:8216
- C:\Windows\System\BOGJrZd.exe
  C:\Windows\System\BOGJrZd.exe
  2⤵
  PID:8236
- C:\Windows\System\qbBhDFs.exe
  C:\Windows\System\qbBhDFs.exe
  2⤵
  PID:8268
- C:\Windows\System\QkNQnJs.exe
  C:\Windows\System\QkNQnJs.exe
  2⤵
  PID:8308
- C:\Windows\System\wfxsvzl.exe
  C:\Windows\System\wfxsvzl.exe
  2⤵
  PID:8332
- C:\Windows\System\jJSbHdZ.exe
  C:\Windows\System\jJSbHdZ.exe
  2⤵
  PID:8368
- C:\Windows\System\ixpIkVi.exe
  C:\Windows\System\ixpIkVi.exe
  2⤵
  PID:8396
- C:\Windows\System\jUByjcK.exe
  C:\Windows\System\jUByjcK.exe
  2⤵
  PID:8412
- C:\Windows\System\yFVGNNw.exe
  C:\Windows\System\yFVGNNw.exe
  2⤵
  PID:8452
- C:\Windows\System\JhGrEEF.exe
  C:\Windows\System\JhGrEEF.exe
  2⤵
  PID:8480
- C:\Windows\System\qddHHmd.exe
  C:\Windows\System\qddHHmd.exe
  2⤵
  PID:8508
- C:\Windows\System\GeXWRtl.exe
  C:\Windows\System\GeXWRtl.exe
  2⤵
  PID:8536
- C:\Windows\System\tDXgxrU.exe
  C:\Windows\System\tDXgxrU.exe
  2⤵
  PID:8564
- C:\Windows\System\ddPXEId.exe
  C:\Windows\System\ddPXEId.exe
  2⤵
  PID:8592
- C:\Windows\System\RdKCKwt.exe
  C:\Windows\System\RdKCKwt.exe
  2⤵
  PID:8608
- C:\Windows\System\awPuwil.exe
  C:\Windows\System\awPuwil.exe
  2⤵
  PID:8624
- C:\Windows\System\ERLhMgQ.exe
  C:\Windows\System\ERLhMgQ.exe
  2⤵
  PID:8652
- C:\Windows\System\bqFqakn.exe
  C:\Windows\System\bqFqakn.exe
  2⤵
  PID:8688
- C:\Windows\System\tnaIisU.exe
  C:\Windows\System\tnaIisU.exe
  2⤵
  PID:8708
- C:\Windows\System\yqvoAoz.exe
  C:\Windows\System\yqvoAoz.exe
  2⤵
  PID:8728
- C:\Windows\System\DIVmkDf.exe
  C:\Windows\System\DIVmkDf.exe
  2⤵
  PID:8760
- C:\Windows\System\dUEEyAD.exe
  C:\Windows\System\dUEEyAD.exe
  2⤵
  PID:8824
- C:\Windows\System\jtNEcfA.exe
  C:\Windows\System\jtNEcfA.exe
  2⤵
  PID:8840
- C:\Windows\System\ziJYdTS.exe
  C:\Windows\System\ziJYdTS.exe
  2⤵
  PID:8868
- C:\Windows\System\KqKcIum.exe
  C:\Windows\System\KqKcIum.exe
  2⤵
  PID:8908
- C:\Windows\System\uAvVOoX.exe
  C:\Windows\System\uAvVOoX.exe
  2⤵
  PID:8936
- C:\Windows\System\CuklKWe.exe
  C:\Windows\System\CuklKWe.exe
  2⤵
  PID:8964
- C:\Windows\System\GBtAsFa.exe
  C:\Windows\System\GBtAsFa.exe
  2⤵
  PID:8992
- C:\Windows\System\NwwYvxk.exe
  C:\Windows\System\NwwYvxk.exe
  2⤵
  PID:9008
- C:\Windows\System\wyTTNfe.exe
  C:\Windows\System\wyTTNfe.exe
  2⤵
  PID:9032
- C:\Windows\System\BnunoEU.exe
  C:\Windows\System\BnunoEU.exe
  2⤵
  PID:9056
- C:\Windows\System\SMJCbMP.exe
  C:\Windows\System\SMJCbMP.exe
  2⤵
  PID:9092
- C:\Windows\System\XJzrmTQ.exe
  C:\Windows\System\XJzrmTQ.exe
  2⤵
  PID:9132
- C:\Windows\System\dMoxzAD.exe
  C:\Windows\System\dMoxzAD.exe
  2⤵
  PID:9160
- C:\Windows\System\bdWpZqT.exe
  C:\Windows\System\bdWpZqT.exe
  2⤵
  PID:9188
- C:\Windows\System\ybYufjO.exe
  C:\Windows\System\ybYufjO.exe
  2⤵
  PID:9204
- C:\Windows\System\iJgLehR.exe
  C:\Windows\System\iJgLehR.exe
  2⤵
  PID:8224
- C:\Windows\System\YPCCsbp.exe
  C:\Windows\System\YPCCsbp.exe
  2⤵
  PID:8300
- C:\Windows\System\ELdIQLn.exe
  C:\Windows\System\ELdIQLn.exe
  2⤵
  PID:8352
- C:\Windows\System\fKgKXjY.exe
  C:\Windows\System\fKgKXjY.exe
  2⤵
  PID:8432
- C:\Windows\System\zdGPDVQ.exe
  C:\Windows\System\zdGPDVQ.exe
  2⤵
  PID:8492
- C:\Windows\System\ZyKArHr.exe
  C:\Windows\System\ZyKArHr.exe
  2⤵
  PID:8588
- C:\Windows\System\pqWYIwd.exe
  C:\Windows\System\pqWYIwd.exe
  2⤵
  PID:8660
- C:\Windows\System\GiaCMXN.exe
  C:\Windows\System\GiaCMXN.exe
  2⤵
  PID:8700
- C:\Windows\System\QXkvHHI.exe
  C:\Windows\System\QXkvHHI.exe
  2⤵
  PID:8748
- C:\Windows\System\OhItWfk.exe
  C:\Windows\System\OhItWfk.exe
  2⤵
  PID:8852
- C:\Windows\System\cjlTRuI.exe
  C:\Windows\System\cjlTRuI.exe
  2⤵
  PID:8896
- C:\Windows\System\gJzlRZb.exe
  C:\Windows\System\gJzlRZb.exe
  2⤵
  PID:8948
- C:\Windows\System\xCXyPQo.exe
  C:\Windows\System\xCXyPQo.exe
  2⤵
  PID:8980
- C:\Windows\System\WxCUohb.exe
  C:\Windows\System\WxCUohb.exe
  2⤵
  PID:9064
- C:\Windows\System\VgQhEBj.exe
  C:\Windows\System\VgQhEBj.exe
  2⤵
  PID:9128
- C:\Windows\System\WmHBlSh.exe
  C:\Windows\System\WmHBlSh.exe
  2⤵
  PID:8212
- C:\Windows\System\IpEZMlN.exe
  C:\Windows\System\IpEZMlN.exe
  2⤵
  PID:8320
- C:\Windows\System\MyvZmny.exe
  C:\Windows\System\MyvZmny.exe
  2⤵
  PID:8524
- C:\Windows\System\sDVgAqn.exe
  C:\Windows\System\sDVgAqn.exe
  2⤵
  PID:8640
- C:\Windows\System\KEawFPe.exe
  C:\Windows\System\KEawFPe.exe
  2⤵
  PID:8780
- C:\Windows\System\dGSzZDg.exe
  C:\Windows\System\dGSzZDg.exe
  2⤵
  PID:8856
- C:\Windows\System\pVTqKoI.exe
  C:\Windows\System\pVTqKoI.exe
  2⤵
  PID:9024
- C:\Windows\System\IBylUCT.exe
  C:\Windows\System\IBylUCT.exe
  2⤵
  PID:9112
- C:\Windows\System\kppmDzm.exe
  C:\Windows\System\kppmDzm.exe
  2⤵
  PID:8716
- C:\Windows\System\ftRXKGH.exe
  C:\Windows\System\ftRXKGH.exe
  2⤵
  PID:9020
- C:\Windows\System\RfeXAXu.exe
  C:\Windows\System\RfeXAXu.exe
  2⤵
  PID:8792
- C:\Windows\System\mjaJWLb.exe
  C:\Windows\System\mjaJWLb.exe
  2⤵
  PID:9232
- C:\Windows\System\kdotIrM.exe
  C:\Windows\System\kdotIrM.exe
  2⤵
  PID:9256
- C:\Windows\System\PygpmTY.exe
  C:\Windows\System\PygpmTY.exe
  2⤵
  PID:9280
- C:\Windows\System\RuidSwT.exe
  C:\Windows\System\RuidSwT.exe
  2⤵
  PID:9312
- C:\Windows\System\qXKtFjL.exe
  C:\Windows\System\qXKtFjL.exe
  2⤵
  PID:9340
- C:\Windows\System\hFwyryg.exe
  C:\Windows\System\hFwyryg.exe
  2⤵
  PID:9368
- C:\Windows\System\bpeNPaZ.exe
  C:\Windows\System\bpeNPaZ.exe
  2⤵
  PID:9408
- C:\Windows\System\pxJarUw.exe
  C:\Windows\System\pxJarUw.exe
  2⤵
  PID:9436
- C:\Windows\System\MGhVgTd.exe
  C:\Windows\System\MGhVgTd.exe
  2⤵
  PID:9468
- C:\Windows\System\UjzhWKc.exe
  C:\Windows\System\UjzhWKc.exe
  2⤵
  PID:9500
- C:\Windows\System\uAdbhZv.exe
  C:\Windows\System\uAdbhZv.exe
  2⤵
  PID:9528
- C:\Windows\System\ylitSMJ.exe
  C:\Windows\System\ylitSMJ.exe
  2⤵
  PID:9560
- C:\Windows\System\fUyVnwY.exe
  C:\Windows\System\fUyVnwY.exe
  2⤵
  PID:9576
- C:\Windows\System\eohUSoA.exe
  C:\Windows\System\eohUSoA.exe
  2⤵
  PID:9596
- C:\Windows\System\kFTCGBy.exe
  C:\Windows\System\kFTCGBy.exe
  2⤵
  PID:9644
- C:\Windows\System\ZvRYzhS.exe
  C:\Windows\System\ZvRYzhS.exe
  2⤵
  PID:9672
- C:\Windows\System\rYIvzYB.exe
  C:\Windows\System\rYIvzYB.exe
  2⤵
  PID:9688
- C:\Windows\System\lFxmmvC.exe
  C:\Windows\System\lFxmmvC.exe
  2⤵
  PID:9716
- C:\Windows\System\ImEUWDP.exe
  C:\Windows\System\ImEUWDP.exe
  2⤵
  PID:9752
- C:\Windows\System\YLbudNE.exe
  C:\Windows\System\YLbudNE.exe
  2⤵
  PID:9784
- C:\Windows\System\JoCVKlJ.exe
  C:\Windows\System\JoCVKlJ.exe
  2⤵
  PID:9812
- C:\Windows\System\ftfHEBW.exe
  C:\Windows\System\ftfHEBW.exe
  2⤵
  PID:9828
- C:\Windows\System\PoMxkIT.exe
  C:\Windows\System\PoMxkIT.exe
  2⤵
  PID:9860
- C:\Windows\System\QHhkJqC.exe
  C:\Windows\System\QHhkJqC.exe
  2⤵
  PID:9888
- C:\Windows\System\VZxEKEd.exe
  C:\Windows\System\VZxEKEd.exe
  2⤵
  PID:9916
- C:\Windows\System\ovKRuBa.exe
  C:\Windows\System\ovKRuBa.exe
  2⤵
  PID:9956
- C:\Windows\System\ezjDwtt.exe
  C:\Windows\System\ezjDwtt.exe
  2⤵
  PID:9984
- C:\Windows\System\AKCkgDf.exe
  C:\Windows\System\AKCkgDf.exe
  2⤵
  PID:10012
- C:\Windows\System\PPilpis.exe
  C:\Windows\System\PPilpis.exe
  2⤵
  PID:10028
- C:\Windows\System\tBUIoGH.exe
  C:\Windows\System\tBUIoGH.exe
  2⤵
  PID:10068
- C:\Windows\System\tytmPwl.exe
  C:\Windows\System\tytmPwl.exe
  2⤵
  PID:10084
- C:\Windows\System\ZQnaxUr.exe
  C:\Windows\System\ZQnaxUr.exe
  2⤵
  PID:10124
- C:\Windows\System\UDbbzgS.exe
  C:\Windows\System\UDbbzgS.exe
  2⤵
  PID:10152
- C:\Windows\System\XfhnBAR.exe
  C:\Windows\System\XfhnBAR.exe
  2⤵
  PID:10180
- C:\Windows\System\yXDevAJ.exe
  C:\Windows\System\yXDevAJ.exe
  2⤵
  PID:10208
- C:\Windows\System\xwRAQxB.exe
  C:\Windows\System\xwRAQxB.exe
  2⤵
  PID:10232
- C:\Windows\System\YJYNxSA.exe
  C:\Windows\System\YJYNxSA.exe
  2⤵
  PID:9220
- C:\Windows\System\uemBQFO.exe
  C:\Windows\System\uemBQFO.exe
  2⤵
  PID:9300
- C:\Windows\System\jQohxGw.exe
  C:\Windows\System\jQohxGw.exe
  2⤵
  PID:9384
- C:\Windows\System\BuJqUqN.exe
  C:\Windows\System\BuJqUqN.exe
  2⤵
  PID:9448
- C:\Windows\System\LUWLZpA.exe
  C:\Windows\System\LUWLZpA.exe
  2⤵
  PID:9488
- C:\Windows\System\lnPAPyL.exe
  C:\Windows\System\lnPAPyL.exe
  2⤵
  PID:9568
- C:\Windows\System\SaSdkZM.exe
  C:\Windows\System\SaSdkZM.exe
  2⤵
  PID:9616
- C:\Windows\System\AwMnEqn.exe
  C:\Windows\System\AwMnEqn.exe
  2⤵
  PID:9684
- C:\Windows\System\lLaoMeR.exe
  C:\Windows\System\lLaoMeR.exe
  2⤵
  PID:9708
- C:\Windows\System\LhaUDcO.exe
  C:\Windows\System\LhaUDcO.exe
  2⤵
  PID:9764
- C:\Windows\System\mkkDWaE.exe
  C:\Windows\System\mkkDWaE.exe
  2⤵
  PID:9872
- C:\Windows\System\UADlDab.exe
  C:\Windows\System\UADlDab.exe
  2⤵
  PID:9928
- C:\Windows\System\YgdAVNM.exe
  C:\Windows\System\YgdAVNM.exe
  2⤵
  PID:10004
- C:\Windows\System\xMLRRdH.exe
  C:\Windows\System\xMLRRdH.exe
  2⤵
  PID:10060
- C:\Windows\System\vQuknsi.exe
  C:\Windows\System\vQuknsi.exe
  2⤵
  PID:10136
- C:\Windows\System\XOhuYji.exe
  C:\Windows\System\XOhuYji.exe
  2⤵
  PID:10192
- C:\Windows\System\aqSGykn.exe
  C:\Windows\System\aqSGykn.exe
  2⤵
  PID:8988
- C:\Windows\System\XoDSciI.exe
  C:\Windows\System\XoDSciI.exe
  2⤵
  PID:9332
- C:\Windows\System\bfGUcIF.exe
  C:\Windows\System\bfGUcIF.exe
  2⤵
  PID:9496
- C:\Windows\System\lLUydZN.exe
  C:\Windows\System\lLUydZN.exe
  2⤵
  PID:9660
- C:\Windows\System\evFeyny.exe
  C:\Windows\System\evFeyny.exe
  2⤵
  PID:9656
- C:\Windows\System\rJRDDyz.exe
  C:\Windows\System\rJRDDyz.exe
  2⤵
  PID:10168
- C:\Windows\System\kanTpaI.exe
  C:\Windows\System\kanTpaI.exe
  2⤵
  PID:10224
- C:\Windows\System\uhAhQxp.exe
  C:\Windows\System\uhAhQxp.exe
  2⤵
  PID:9240
- C:\Windows\System\oIDDjuF.exe
  C:\Windows\System\oIDDjuF.exe
  2⤵
  PID:8724
- C:\Windows\System\lRtdVau.exe
  C:\Windows\System\lRtdVau.exe
  2⤵
  PID:10140
- C:\Windows\System\fHWsnqO.exe
  C:\Windows\System\fHWsnqO.exe
  2⤵
  PID:10244
- C:\Windows\System\YVPpSmS.exe
  C:\Windows\System\YVPpSmS.exe
  2⤵
  PID:10264
- C:\Windows\System\WIWJUaB.exe
  C:\Windows\System\WIWJUaB.exe
  2⤵
  PID:10288
- C:\Windows\System\fxcCGqx.exe
  C:\Windows\System\fxcCGqx.exe
  2⤵
  PID:10324
- C:\Windows\System\kpaMkek.exe
  C:\Windows\System\kpaMkek.exe
  2⤵
  PID:10360
- C:\Windows\System\FWseUyv.exe
  C:\Windows\System\FWseUyv.exe
  2⤵
  PID:10376
- C:\Windows\System\tENMvOD.exe
  C:\Windows\System\tENMvOD.exe
  2⤵
  PID:10404
- C:\Windows\System\QHKSQvZ.exe
  C:\Windows\System\QHKSQvZ.exe
  2⤵
  PID:10456
- C:\Windows\System\mTlbJyl.exe
  C:\Windows\System\mTlbJyl.exe
  2⤵
  PID:10476
- C:\Windows\System\tLYnTCY.exe
  C:\Windows\System\tLYnTCY.exe
  2⤵
  PID:10520
- C:\Windows\System\DDGzKyU.exe
  C:\Windows\System\DDGzKyU.exe
  2⤵
  PID:10552
- C:\Windows\System\iwblDGJ.exe
  C:\Windows\System\iwblDGJ.exe
  2⤵
  PID:10568
- C:\Windows\System\wYNyuJE.exe
  C:\Windows\System\wYNyuJE.exe
  2⤵
  PID:10608
- C:\Windows\System\fhEsumU.exe
  C:\Windows\System\fhEsumU.exe
  2⤵
  PID:10632
- C:\Windows\System\rPyLzZU.exe
  C:\Windows\System\rPyLzZU.exe
  2⤵
  PID:10668
- C:\Windows\System\VcfVbnX.exe
  C:\Windows\System\VcfVbnX.exe
  2⤵
  PID:10696
- C:\Windows\System\DucpmpO.exe
  C:\Windows\System\DucpmpO.exe
  2⤵
  PID:10724
- C:\Windows\System\rXuLuGH.exe
  C:\Windows\System\rXuLuGH.exe
  2⤵
  PID:10740
- C:\Windows\System\prOkRBU.exe
  C:\Windows\System\prOkRBU.exe
  2⤵
  PID:10772
- C:\Windows\System\kdJGWWy.exe
  C:\Windows\System\kdJGWWy.exe
  2⤵
  PID:10800
- C:\Windows\System\eQISURU.exe
  C:\Windows\System\eQISURU.exe
  2⤵
  PID:10828
- C:\Windows\System\AvCkbYA.exe
  C:\Windows\System\AvCkbYA.exe
  2⤵
  PID:10860
- C:\Windows\System\oHuBqdY.exe
  C:\Windows\System\oHuBqdY.exe
  2⤵
  PID:10900
- C:\Windows\System\qFKBzRm.exe
  C:\Windows\System\qFKBzRm.exe
  2⤵
  PID:10920
- C:\Windows\System\gHhEOWL.exe
  C:\Windows\System\gHhEOWL.exe
  2⤵
  PID:10952
- C:\Windows\System\EjsDkwZ.exe
  C:\Windows\System\EjsDkwZ.exe
  2⤵
  PID:10972
- C:\Windows\System\PgZgJbi.exe
  C:\Windows\System\PgZgJbi.exe
  2⤵
  PID:11012
- C:\Windows\System\YIRPAgU.exe
  C:\Windows\System\YIRPAgU.exe
  2⤵
  PID:11028
- C:\Windows\System\tSngXgl.exe
  C:\Windows\System\tSngXgl.exe
  2⤵
  PID:11060
- C:\Windows\System\HfhEtbL.exe
  C:\Windows\System\HfhEtbL.exe
  2⤵
  PID:11084
- C:\Windows\System\bNuUgOr.exe
  C:\Windows\System\bNuUgOr.exe
  2⤵
  PID:11108
- C:\Windows\System\vqphHnx.exe
  C:\Windows\System\vqphHnx.exe
  2⤵
  PID:11128
- C:\Windows\System\xcvBKBC.exe
  C:\Windows\System\xcvBKBC.exe
  2⤵
  PID:11180
- C:\Windows\System\FjucEtp.exe
  C:\Windows\System\FjucEtp.exe
  2⤵
  PID:11208
- C:\Windows\System\eaqoFCM.exe
  C:\Windows\System\eaqoFCM.exe
  2⤵
  PID:11236
- C:\Windows\System\gNHgiVm.exe
  C:\Windows\System\gNHgiVm.exe
  2⤵
  PID:11256
- C:\Windows\System\YfvtzoU.exe
  C:\Windows\System\YfvtzoU.exe
  2⤵
  PID:9900
- C:\Windows\System\Ybcfyrc.exe
  C:\Windows\System\Ybcfyrc.exe
  2⤵
  PID:10340
- C:\Windows\System\cLNjSXL.exe
  C:\Windows\System\cLNjSXL.exe
  2⤵
  PID:10368
- C:\Windows\System\PfYyUKc.exe
  C:\Windows\System\PfYyUKc.exe
  2⤵
  PID:10436
- C:\Windows\System\DwVXCxT.exe
  C:\Windows\System\DwVXCxT.exe
  2⤵
  PID:10484
- C:\Windows\System\UuEBkdu.exe
  C:\Windows\System\UuEBkdu.exe
  2⤵
  PID:10584
- C:\Windows\System\iwMrURA.exe
  C:\Windows\System\iwMrURA.exe
  2⤵
  PID:10640
- C:\Windows\System\nRjqhTB.exe
  C:\Windows\System\nRjqhTB.exe
  2⤵
  PID:10688
- C:\Windows\System\jlBqoll.exe
  C:\Windows\System\jlBqoll.exe
  2⤵
  PID:10796
- C:\Windows\System\HusGzHZ.exe
  C:\Windows\System\HusGzHZ.exe
  2⤵
  PID:10816
- C:\Windows\System\wZWWsTJ.exe
  C:\Windows\System\wZWWsTJ.exe
  2⤵
  PID:10876
- C:\Windows\System\WVlouxA.exe
  C:\Windows\System\WVlouxA.exe
  2⤵
  PID:10964
- C:\Windows\System\ZRecqeq.exe
  C:\Windows\System\ZRecqeq.exe
  2⤵
  PID:11020
- C:\Windows\System\TFWvARv.exe
  C:\Windows\System\TFWvARv.exe
  2⤵
  PID:11124
- C:\Windows\System\VlyuvVW.exe
  C:\Windows\System\VlyuvVW.exe
  2⤵
  PID:11164
- C:\Windows\System\fudiYPr.exe
  C:\Windows\System\fudiYPr.exe
  2⤵
  PID:11228
- C:\Windows\System\unvNsNF.exe
  C:\Windows\System\unvNsNF.exe
  2⤵
  PID:9352
- C:\Windows\System\YSZqqfo.exe
  C:\Windows\System\YSZqqfo.exe
  2⤵
  PID:10276
- C:\Windows\System\KWedBOI.exe
  C:\Windows\System\KWedBOI.exe
  2⤵
  PID:10468
- C:\Windows\System\xTJRcud.exe
  C:\Windows\System\xTJRcud.exe
  2⤵
  PID:10628
- C:\Windows\System\iwJoBmh.exe
  C:\Windows\System\iwJoBmh.exe
  2⤵
  PID:10784
- C:\Windows\System\VHvbkDx.exe
  C:\Windows\System\VHvbkDx.exe
  2⤵
  PID:10896
- C:\Windows\System\AyCYLrs.exe
  C:\Windows\System\AyCYLrs.exe
  2⤵
  PID:11080
- C:\Windows\System\MxAMGWb.exe
  C:\Windows\System\MxAMGWb.exe
  2⤵
  PID:10284
- C:\Windows\System\BbfCUIg.exe
  C:\Windows\System\BbfCUIg.exe
  2⤵
  PID:11196
- C:\Windows\System\TVOdMIw.exe
  C:\Windows\System\TVOdMIw.exe
  2⤵
  PID:10848
- C:\Windows\System\HtAPemZ.exe
  C:\Windows\System\HtAPemZ.exe
  2⤵
  PID:11008
- C:\Windows\System\QHMSedK.exe
  C:\Windows\System\QHMSedK.exe
  2⤵
  PID:11272
- C:\Windows\System\rspdzYU.exe
  C:\Windows\System\rspdzYU.exe
  2⤵
  PID:11312
- C:\Windows\System\RVTynFq.exe
  C:\Windows\System\RVTynFq.exe
  2⤵
  PID:11328
- C:\Windows\System\KscOonD.exe
  C:\Windows\System\KscOonD.exe
  2⤵
  PID:11356
- C:\Windows\System\LlkDJim.exe
  C:\Windows\System\LlkDJim.exe
  2⤵
  PID:11384
- C:\Windows\System\HerNnIF.exe
  C:\Windows\System\HerNnIF.exe
  2⤵
  PID:11400
- C:\Windows\System\wBfUkdb.exe
  C:\Windows\System\wBfUkdb.exe
  2⤵
  PID:11416
- C:\Windows\System\GfUWCgU.exe
  C:\Windows\System\GfUWCgU.exe
  2⤵
  PID:11484
- C:\Windows\System\teoRgQz.exe
  C:\Windows\System\teoRgQz.exe
  2⤵
  PID:11500
- C:\Windows\System\wwsJVkv.exe
  C:\Windows\System\wwsJVkv.exe
  2⤵
  PID:11520
- C:\Windows\System\DLrnPlR.exe
  C:\Windows\System\DLrnPlR.exe
  2⤵
  PID:11552
- C:\Windows\System\iwsxnGJ.exe
  C:\Windows\System\iwsxnGJ.exe
  2⤵
  PID:11580
- C:\Windows\System\jJjOCLF.exe
  C:\Windows\System\jJjOCLF.exe
  2⤵
  PID:11612
- C:\Windows\System\QtDdjca.exe
  C:\Windows\System\QtDdjca.exe
  2⤵
  PID:11640
- C:\Windows\System\kwiIMxW.exe
  C:\Windows\System\kwiIMxW.exe
  2⤵
  PID:11668
- C:\Windows\System\gpqGTWp.exe
  C:\Windows\System\gpqGTWp.exe
  2⤵
  PID:11696
- C:\Windows\System\dBoVIuU.exe
  C:\Windows\System\dBoVIuU.exe
  2⤵
  PID:11736
- C:\Windows\System\aeKwrWm.exe
  C:\Windows\System\aeKwrWm.exe
  2⤵
  PID:11764
- C:\Windows\System\LICpFnG.exe
  C:\Windows\System\LICpFnG.exe
  2⤵
  PID:11792
- C:\Windows\System\HWqrKxa.exe
  C:\Windows\System\HWqrKxa.exe
  2⤵
  PID:11816
- C:\Windows\System\EZhPkDV.exe
  C:\Windows\System\EZhPkDV.exe
  2⤵
  PID:11840
- C:\Windows\System\ekfOvDd.exe
  C:\Windows\System\ekfOvDd.exe
  2⤵
  PID:11864
- C:\Windows\System\VPqheEA.exe
  C:\Windows\System\VPqheEA.exe
  2⤵
  PID:11900
- C:\Windows\System\gvUHHZz.exe
  C:\Windows\System\gvUHHZz.exe
  2⤵
  PID:11920
- C:\Windows\System\oTkRblj.exe
  C:\Windows\System\oTkRblj.exe
  2⤵
  PID:11948
- C:\Windows\System\BCXDPaS.exe
  C:\Windows\System\BCXDPaS.exe
  2⤵
  PID:11976
- C:\Windows\System\ftXBzFK.exe
  C:\Windows\System\ftXBzFK.exe
  2⤵
  PID:11996
- C:\Windows\System\VkPsDfB.exe
  C:\Windows\System\VkPsDfB.exe
  2⤵
  PID:12032
- C:\Windows\System\BMxqRRC.exe
  C:\Windows\System\BMxqRRC.exe
  2⤵
  PID:12052
- C:\Windows\System\puGsTqW.exe
  C:\Windows\System\puGsTqW.exe
  2⤵
  PID:12076
- C:\Windows\System\CBuhMVa.exe
  C:\Windows\System\CBuhMVa.exe
  2⤵
  PID:12128
- C:\Windows\System\xxStbCT.exe
  C:\Windows\System\xxStbCT.exe
  2⤵
  PID:12144
- C:\Windows\System\jwimyjU.exe
  C:\Windows\System\jwimyjU.exe
  2⤵
  PID:12172
- C:\Windows\System\dRXVzQh.exe
  C:\Windows\System\dRXVzQh.exe
  2⤵
  PID:12208
- C:\Windows\System\voYwvRM.exe
  C:\Windows\System\voYwvRM.exe
  2⤵
  PID:12228
- C:\Windows\System\cUSlIBB.exe
  C:\Windows\System\cUSlIBB.exe
  2⤵
  PID:12268
- C:\Windows\System\ezaucQa.exe
  C:\Windows\System\ezaucQa.exe
  2⤵
  PID:11268
- C:\Windows\System\AhaGPMg.exe
  C:\Windows\System\AhaGPMg.exe
  2⤵
  PID:11320
- C:\Windows\System\cunrnrF.exe
  C:\Windows\System\cunrnrF.exe
  2⤵
  PID:11372
- C:\Windows\System\evJwSaz.exe
  C:\Windows\System\evJwSaz.exe
  2⤵
  PID:11464
- C:\Windows\System\jJxqlaq.exe
  C:\Windows\System\jJxqlaq.exe
  2⤵
  PID:11540
- C:\Windows\System\EfXOhSZ.exe
  C:\Windows\System\EfXOhSZ.exe
  2⤵
  PID:11568
- C:\Windows\System\KJJzUnk.exe
  C:\Windows\System\KJJzUnk.exe
  2⤵
  PID:11624
- C:\Windows\System\llfQGaX.exe
  C:\Windows\System\llfQGaX.exe
  2⤵
  PID:11692
- C:\Windows\System\MCMFldj.exe
  C:\Windows\System\MCMFldj.exe
  2⤵
  PID:11760
- C:\Windows\System\ilPGFQn.exe
  C:\Windows\System\ilPGFQn.exe
  2⤵
  PID:11836
- C:\Windows\System\irtKRBT.exe
  C:\Windows\System\irtKRBT.exe
  2⤵
  PID:11888
- C:\Windows\System\oqNvFDj.exe
  C:\Windows\System\oqNvFDj.exe
  2⤵
  PID:11932
- C:\Windows\System\Abkrxdw.exe
  C:\Windows\System\Abkrxdw.exe
  2⤵
  PID:12004
- C:\Windows\System\AJleNkP.exe
  C:\Windows\System\AJleNkP.exe
  2⤵
  PID:12060
- C:\Windows\System\cXwwhHR.exe
  C:\Windows\System\cXwwhHR.exe
  2⤵
  PID:12124
- C:\Windows\System\pSNdbDs.exe
  C:\Windows\System\pSNdbDs.exe
  2⤵
  PID:12160
- C:\Windows\System\MohXVKK.exe
  C:\Windows\System\MohXVKK.exe
  2⤵
  PID:10252
- C:\Windows\System\sUoRQsN.exe
  C:\Windows\System\sUoRQsN.exe
  2⤵
  PID:11376
- C:\Windows\System\wyeCmQc.exe
  C:\Windows\System\wyeCmQc.exe
  2⤵
  PID:11528
- C:\Windows\System\vzafvAi.exe
  C:\Windows\System\vzafvAi.exe
  2⤵
  PID:11604
- C:\Windows\System\SkjOQZH.exe
  C:\Windows\System\SkjOQZH.exe
  2⤵
  PID:11728
- C:\Windows\System\ptaEoxL.exe
  C:\Windows\System\ptaEoxL.exe
  2⤵
  PID:11940
- C:\Windows\System\vHROrgf.exe
  C:\Windows\System\vHROrgf.exe
  2⤵
  PID:12140
- C:\Windows\System\qRALSHF.exe
  C:\Windows\System\qRALSHF.exe
  2⤵
  PID:12260
- C:\Windows\System\RJQhwPq.exe
  C:\Windows\System\RJQhwPq.exe
  2⤵
  PID:11496
- C:\Windows\System\hqlfQeF.exe
  C:\Windows\System\hqlfQeF.exe
  2⤵
  PID:11824
- C:\Windows\System\QQBSOBX.exe
  C:\Windows\System\QQBSOBX.exe
  2⤵
  PID:11308
- C:\Windows\System\kATGxOm.exe
  C:\Windows\System\kATGxOm.exe
  2⤵
  PID:11680
- C:\Windows\System\RirZTjo.exe
  C:\Windows\System\RirZTjo.exe
  2⤵
  PID:12296
- C:\Windows\System\HqdPdQt.exe
  C:\Windows\System\HqdPdQt.exe
  2⤵
  PID:12324
- C:\Windows\System\YzfSovU.exe
  C:\Windows\System\YzfSovU.exe
  2⤵
  PID:12352
- C:\Windows\System\DlucblH.exe
  C:\Windows\System\DlucblH.exe
  2⤵
  PID:12368
- C:\Windows\System\GVNKjfN.exe
  C:\Windows\System\GVNKjfN.exe
  2⤵
  PID:12400
- C:\Windows\System\csIWRxM.exe
  C:\Windows\System\csIWRxM.exe
  2⤵
  PID:12416
- C:\Windows\System\QQLymtx.exe
  C:\Windows\System\QQLymtx.exe
  2⤵
  PID:12456
- C:\Windows\System\xkCmgSb.exe
  C:\Windows\System\xkCmgSb.exe
  2⤵
  PID:12488
- C:\Windows\System\koUihNm.exe
  C:\Windows\System\koUihNm.exe
  2⤵
  PID:12512
- C:\Windows\System\LhRkzzk.exe
  C:\Windows\System\LhRkzzk.exe
  2⤵
  PID:12548
- C:\Windows\System\YUcqXvw.exe
  C:\Windows\System\YUcqXvw.exe
  2⤵
  PID:12568
- C:\Windows\System\aMIcJtO.exe
  C:\Windows\System\aMIcJtO.exe
  2⤵
  PID:12596
- C:\Windows\System\ByZbrrA.exe
  C:\Windows\System\ByZbrrA.exe
  2⤵
  PID:12620
- C:\Windows\System\elJKQrU.exe
  C:\Windows\System\elJKQrU.exe
  2⤵
  PID:12652
- C:\Windows\System\tDZkhmE.exe
  C:\Windows\System\tDZkhmE.exe
  2⤵
  PID:12680
- C:\Windows\System\YkkJsWn.exe
  C:\Windows\System\YkkJsWn.exe
  2⤵
  PID:12708
- C:\Windows\System\IswfqcG.exe
  C:\Windows\System\IswfqcG.exe
  2⤵
  PID:12736
- C:\Windows\System\JGJgrVV.exe
  C:\Windows\System\JGJgrVV.exe
  2⤵
  PID:12776
- C:\Windows\System\iHedJje.exe
  C:\Windows\System\iHedJje.exe
  2⤵
  PID:12804
- C:\Windows\System\OozFdNA.exe
  C:\Windows\System\OozFdNA.exe
  2⤵
  PID:12820
- C:\Windows\System\vZXlMVc.exe
  C:\Windows\System\vZXlMVc.exe
  2⤵
  PID:12848
- C:\Windows\System\RmBpJxs.exe
  C:\Windows\System\RmBpJxs.exe
  2⤵
  PID:12868
- C:\Windows\System\STfQruy.exe
  C:\Windows\System\STfQruy.exe
  2⤵
  PID:12912
- C:\Windows\System\nBFIfVc.exe
  C:\Windows\System\nBFIfVc.exe
  2⤵
  PID:12932
- C:\Windows\System\nrpwqcp.exe
  C:\Windows\System\nrpwqcp.exe
  2⤵
  PID:12960
- C:\Windows\System\mVGwVkw.exe
  C:\Windows\System\mVGwVkw.exe
  2⤵
  PID:12988
- C:\Windows\System\EFduWSs.exe
  C:\Windows\System\EFduWSs.exe
  2⤵
  PID:13016
- C:\Windows\System\vHipboP.exe
  C:\Windows\System\vHipboP.exe
  2⤵
  PID:13044
- C:\Windows\System\SYaljEr.exe
  C:\Windows\System\SYaljEr.exe
  2⤵
  PID:13084
- C:\Windows\System\oHYTLAs.exe
  C:\Windows\System\oHYTLAs.exe
  2⤵
  PID:13112
- C:\Windows\System\yCIKVtF.exe
  C:\Windows\System\yCIKVtF.exe
  2⤵
  PID:13132
- C:\Windows\System\hmyNXeR.exe
  C:\Windows\System\hmyNXeR.exe
  2⤵
  PID:13156
- C:\Windows\System\doydyfl.exe
  C:\Windows\System\doydyfl.exe
  2⤵
  PID:13176
- C:\Windows\System\JCTtakI.exe
  C:\Windows\System\JCTtakI.exe
  2⤵
  PID:13208
- C:\Windows\System\bORHXhM.exe
  C:\Windows\System\bORHXhM.exe
  2⤵
  PID:13232
- C:\Windows\System\zWbHNmp.exe
  C:\Windows\System\zWbHNmp.exe
  2⤵
  PID:13280
- C:\Windows\System\HQaxtYR.exe
  C:\Windows\System\HQaxtYR.exe
  2⤵
  PID:13308
- C:\Windows\System\uoYdoIF.exe
  C:\Windows\System\uoYdoIF.exe
  2⤵
  PID:12308
- C:\Windows\System\clgQycB.exe
  C:\Windows\System\clgQycB.exe
  2⤵
  PID:12384
- C:\Windows\System\ikhwTKw.exe
  C:\Windows\System\ikhwTKw.exe
  2⤵
  PID:12436
- C:\Windows\System\lyhAxfy.exe
  C:\Windows\System\lyhAxfy.exe
  2⤵
  PID:12524
- C:\Windows\System\hqeliQu.exe
  C:\Windows\System\hqeliQu.exe
  2⤵
  PID:12564
- C:\Windows\System\VwqnJhr.exe
  C:\Windows\System\VwqnJhr.exe
  2⤵
  PID:12632
- C:\Windows\System\kgjhFJe.exe
  C:\Windows\System\kgjhFJe.exe
  2⤵
  PID:12728
- C:\Windows\System\CLzkTJn.exe
  C:\Windows\System\CLzkTJn.exe
  2⤵
  PID:12796
- C:\Windows\System\PDYAaKS.exe
  C:\Windows\System\PDYAaKS.exe
  2⤵
  PID:12860
- C:\Windows\System\BcnuwFQ.exe
  C:\Windows\System\BcnuwFQ.exe
  2⤵
  PID:12900
- C:\Windows\System\vQjXVQO.exe
  C:\Windows\System\vQjXVQO.exe
  2⤵
  PID:12952
- C:\Windows\System\ATdtNpY.exe
  C:\Windows\System\ATdtNpY.exe
  2⤵
  PID:13036
- C:\Windows\System\MxcUFYc.exe
  C:\Windows\System\MxcUFYc.exe
  2⤵
  PID:13060
- C:\Windows\System\ArVUbln.exe
  C:\Windows\System\ArVUbln.exe
  2⤵
  PID:13140
- C:\Windows\System\GiwUxjp.exe
  C:\Windows\System\GiwUxjp.exe
  2⤵
  PID:13172
- C:\Windows\System\SVxQRzD.exe
  C:\Windows\System\SVxQRzD.exe
  2⤵
  PID:13276
- C:\Windows\System\zvzvJQy.exe
  C:\Windows\System\zvzvJQy.exe
  2⤵
  PID:4992
- C:\Windows\System\JmXmJnh.exe
  C:\Windows\System\JmXmJnh.exe
  2⤵
  PID:12380
- C:\Windows\System\vSlvmhZ.exe
  C:\Windows\System\vSlvmhZ.exe
  2⤵
  PID:12664
- C:\Windows\System\EXUfrES.exe
  C:\Windows\System\EXUfrES.exe
  2⤵
  PID:1640
- C:\Windows\System\oaMAGhh.exe
  C:\Windows\System\oaMAGhh.exe
  2⤵
  PID:12920
- C:\Windows\System\XejcuBN.exe
  C:\Windows\System\XejcuBN.exe
  2⤵
  PID:13028
- C:\Windows\System\sAIDfqx.exe
  C:\Windows\System\sAIDfqx.exe
  2⤵
  PID:13296
- C:\Windows\System\atmSbrB.exe
  C:\Windows\System\atmSbrB.exe
  2⤵
  PID:12412
- C:\Windows\System\SajHgsk.exe
  C:\Windows\System\SajHgsk.exe
  2⤵
  PID:12720
- C:\Windows\System\iWCcuvE.exe
  C:\Windows\System\iWCcuvE.exe
  2⤵
  PID:13004
- C:\Windows\System\jEejFRw.exe
  C:\Windows\System\jEejFRw.exe
  2⤵
  PID:13164
- C:\Windows\System\ILkwxdz.exe
  C:\Windows\System\ILkwxdz.exe
  2⤵
  PID:12896
- C:\Windows\System\DDqaJVu.exe
  C:\Windows\System\DDqaJVu.exe
  2⤵
  PID:13324
- C:\Windows\System\tSuouRa.exe
  C:\Windows\System\tSuouRa.exe
  2⤵
  PID:13340
- C:\Windows\System\DdyeHFD.exe
  C:\Windows\System\DdyeHFD.exe
  2⤵
  PID:13356
- C:\Windows\System\uswhvzg.exe
  C:\Windows\System\uswhvzg.exe
  2⤵
  PID:13408
- C:\Windows\System\fkbBAjH.exe
  C:\Windows\System\fkbBAjH.exe
  2⤵
  PID:13436
- C:\Windows\System\cSZVGrv.exe
  C:\Windows\System\cSZVGrv.exe
  2⤵
  PID:13464
- C:\Windows\System\yKGljnK.exe
  C:\Windows\System\yKGljnK.exe
  2⤵
  PID:13480
- C:\Windows\System\FXrmela.exe
  C:\Windows\System\FXrmela.exe
  2⤵
  PID:13524
- C:\Windows\System\aVbUPEt.exe
  C:\Windows\System\aVbUPEt.exe
  2⤵
  PID:13548
- C:\Windows\System\CeMIMsA.exe
  C:\Windows\System\CeMIMsA.exe
  2⤵
  PID:13572
- C:\Windows\System\BrskOpq.exe
  C:\Windows\System\BrskOpq.exe
  2⤵
  PID:13608
- C:\Windows\System\bPoVizq.exe
  C:\Windows\System\bPoVizq.exe
  2⤵
  PID:13624
- C:\Windows\System\ayltBac.exe
  C:\Windows\System\ayltBac.exe
  2⤵
  PID:13644
- C:\Windows\System\eqWgXFk.exe
  C:\Windows\System\eqWgXFk.exe
  2⤵
  PID:13672
- C:\Windows\System\FZpyMni.exe
  C:\Windows\System\FZpyMni.exe
  2⤵
  PID:13696
- C:\Windows\System\oIPQbql.exe
  C:\Windows\System\oIPQbql.exe
  2⤵
  PID:13724
- C:\Windows\System\QWOVgZL.exe
  C:\Windows\System\QWOVgZL.exe
  2⤵
  PID:13752
- C:\Windows\System\OkMkMHr.exe
  C:\Windows\System\OkMkMHr.exe
  2⤵
  PID:13776
- C:\Windows\System\QqhZWsI.exe
  C:\Windows\System\QqhZWsI.exe
  2⤵
  PID:13820
- C:\Windows\System\XsuzLtd.exe
  C:\Windows\System\XsuzLtd.exe
  2⤵
  PID:13860
- C:\Windows\System\mpfPUqE.exe
  C:\Windows\System\mpfPUqE.exe
  2⤵
  PID:13884
- C:\Windows\System\vyqnDOM.exe
  C:\Windows\System\vyqnDOM.exe
  2⤵
  PID:13904
- C:\Windows\System\DxuLEMZ.exe
  C:\Windows\System\DxuLEMZ.exe
  2⤵
  PID:13932
- C:\Windows\System\BIGCWLp.exe
  C:\Windows\System\BIGCWLp.exe
  2⤵
  PID:13964
- C:\Windows\System\XwStiEm.exe
  C:\Windows\System\XwStiEm.exe
  2⤵
  PID:13988
- C:\Windows\System\DGuFSnn.exe
  C:\Windows\System\DGuFSnn.exe
  2⤵
  PID:14016
- C:\Windows\System\yRuXtgB.exe
  C:\Windows\System\yRuXtgB.exe
  2⤵
  PID:14044
- C:\Windows\System\HLABEMb.exe
  C:\Windows\System\HLABEMb.exe
  2⤵
  PID:14068
- C:\Windows\System\NviUfhz.exe
  C:\Windows\System\NviUfhz.exe
  2⤵
  PID:14100
- C:\Windows\System\pCfgYCC.exe
  C:\Windows\System\pCfgYCC.exe
  2⤵
  PID:14128
- C:\Windows\System\XJwEOYX.exe
  C:\Windows\System\XJwEOYX.exe
  2⤵
  PID:14156
- C:\Windows\System\hWtKtDO.exe
  C:\Windows\System\hWtKtDO.exe
  2⤵
  PID:14184
- C:\Windows\System\drNpPme.exe
  C:\Windows\System\drNpPme.exe
  2⤵
  PID:14200
- C:\Windows\System\xzRFmtG.exe
  C:\Windows\System\xzRFmtG.exe
  2⤵
  PID:14236
- C:\Windows\System\dgWyxNA.exe
  C:\Windows\System\dgWyxNA.exe
  2⤵
  PID:14256
- C:\Windows\System\FuXsUuj.exe
  C:\Windows\System\FuXsUuj.exe
  2⤵
  PID:14284
- C:\Windows\System\TZxPVrL.exe
  C:\Windows\System\TZxPVrL.exe
  2⤵
  PID:14304
- C:\Windows\System\kHalMnc.exe
  C:\Windows\System\kHalMnc.exe
  2⤵
  PID:13352
- C:\Windows\System\ETvikhy.exe
  C:\Windows\System\ETvikhy.exe
  2⤵
  PID:13400
- C:\Windows\System\qLoaurr.exe
  C:\Windows\System\qLoaurr.exe
  2⤵
  PID:13448
- C:\Windows\System\qwnhlkO.exe
  C:\Windows\System\qwnhlkO.exe
  2⤵
  PID:13512
- C:\Windows\System\DqeVZyP.exe
  C:\Windows\System\DqeVZyP.exe
  2⤵
  PID:13564
- C:\Windows\System\cEcbLuz.exe
  C:\Windows\System\cEcbLuz.exe
  2⤵
  PID:13600
- C:\Windows\System\IbOooeb.exe
  C:\Windows\System\IbOooeb.exe
  2⤵
  PID:1208
- C:\Windows\System\qLcBnNT.exe
  C:\Windows\System\qLcBnNT.exe
  2⤵
  PID:13744
- C:\Windows\System\UomnemY.exe
  C:\Windows\System\UomnemY.exe
  2⤵
  PID:13852
- C:\Windows\System\PzctpbN.exe
  C:\Windows\System\PzctpbN.exe
  2⤵
  PID:13880
- C:\Windows\System\dAiZoVC.exe
  C:\Windows\System\dAiZoVC.exe
  2⤵
  PID:13948
- C:\Windows\System\nxBPQFY.exe
  C:\Windows\System\nxBPQFY.exe
  2⤵
  PID:14000
- C:\Windows\System\eMVSUvb.exe
  C:\Windows\System\eMVSUvb.exe
  2⤵
  PID:13980
- C:\Windows\System\WVxgRgV.exe
  C:\Windows\System\WVxgRgV.exe
  2⤵
  PID:14036
- C:\Windows\System\MquvSuc.exe
  C:\Windows\System\MquvSuc.exe
  2⤵
  PID:14116
- C:\Windows\System\pLiYmnw.exe
  C:\Windows\System\pLiYmnw.exe
  2⤵
  PID:14312
- C:\Windows\System\jBzoKnU.exe
  C:\Windows\System\jBzoKnU.exe
  2⤵
  PID:13336
- C:\Windows\System\wKYGpGt.exe
  C:\Windows\System\wKYGpGt.exe
  2⤵
  PID:13544
- C:\Windows\System\RnMtLrW.exe
  C:\Windows\System\RnMtLrW.exe
  2⤵
  PID:13616
- C:\Windows\System\zaOhGHy.exe
  C:\Windows\System\zaOhGHy.exe
  2⤵
  PID:13792
- C:\Windows\System\JZgMWBc.exe
  C:\Windows\System\JZgMWBc.exe
  2⤵
  PID:2372
- C:\Windows\System\neYnCik.exe
  C:\Windows\System\neYnCik.exe
  2⤵
  PID:13924
- C:\Windows\System\fwFIBQa.exe
  C:\Windows\System\fwFIBQa.exe
  2⤵
  PID:13976
- C:\Windows\System\GAItAVA.exe
  C:\Windows\System\GAItAVA.exe
  2⤵
  PID:14296
- C:\Windows\System\PZzaUvl.exe
  C:\Windows\System\PZzaUvl.exe
  2⤵
  PID:13520
- C:\Windows\System\AaITgAn.exe
  C:\Windows\System\AaITgAn.exe
  2⤵
  PID:13800
- C:\Windows\System\NGNBzeL.exe
  C:\Windows\System\NGNBzeL.exe
  2⤵
  PID:14060
- C:\Windows\System\XjchMPR.exe
  C:\Windows\System\XjchMPR.exe
  2⤵
  PID:14300
- C:\Windows\System\EzkVfKG.exe
  C:\Windows\System\EzkVfKG.exe
  2⤵
  PID:14224
- C:\Windows\System\IIPZSby.exe
  C:\Windows\System\IIPZSby.exe
  2⤵
  PID:14360
- C:\Windows\System\uHvYpsV.exe
  C:\Windows\System\uHvYpsV.exe
  2⤵
  PID:14376
- C:\Windows\System\oyKaDUM.exe
  C:\Windows\System\oyKaDUM.exe
  2⤵
  PID:14420
- C:\Windows\System\ocTQsbI.exe
  C:\Windows\System\ocTQsbI.exe
  2⤵
  PID:14436
- C:\Windows\System\ZaubeIa.exe
  C:\Windows\System\ZaubeIa.exe
  2⤵
  PID:14468
- C:\Windows\System\MXKQvIM.exe
  C:\Windows\System\MXKQvIM.exe
  2⤵
  PID:14516
- C:\Windows\System\BqmZRLs.exe
  C:\Windows\System\BqmZRLs.exe
  2⤵
  PID:14544
- C:\Windows\System\vToIIuY.exe
  C:\Windows\System\vToIIuY.exe
  2⤵
  PID:14560
- C:\Windows\System\YruIsWt.exe
  C:\Windows\System\YruIsWt.exe
  2⤵
  PID:14588
- C:\Windows\System\hDYroWj.exe
  C:\Windows\System\hDYroWj.exe
  2⤵
  PID:14628
- C:\Windows\System\oslPiwl.exe
  C:\Windows\System\oslPiwl.exe
  2⤵
  PID:14656
- C:\Windows\System\IEMawpo.exe
  C:\Windows\System\IEMawpo.exe
  2⤵
  PID:14684
- C:\Windows\System\prylVKT.exe
  C:\Windows\System\prylVKT.exe
  2⤵
  PID:14712
- C:\Windows\System\XOewhPO.exe
  C:\Windows\System\XOewhPO.exe
  2⤵
  PID:14732
- C:\Windows\System\oBHaIEx.exe
  C:\Windows\System\oBHaIEx.exe
  2⤵
  PID:14756
- C:\Windows\System\piSScmt.exe
  C:\Windows\System\piSScmt.exe
  2⤵
  PID:14792
- C:\Windows\System\znoZxgk.exe
  C:\Windows\System\znoZxgk.exe
  2⤵
  PID:14824
- C:\Windows\System\jvGdDum.exe
  C:\Windows\System\jvGdDum.exe
  2⤵
  PID:14844
- C:\Windows\System\ZTXPXHw.exe
  C:\Windows\System\ZTXPXHw.exe
  2⤵
  PID:14868
- C:\Windows\System\YlKWJvV.exe
  C:\Windows\System\YlKWJvV.exe
  2⤵
  PID:14896
- C:\Windows\System\COKGZvc.exe
  C:\Windows\System\COKGZvc.exe
  2⤵
  PID:14916
- C:\Windows\System\ZTVuWyx.exe
  C:\Windows\System\ZTVuWyx.exe
  2⤵
  PID:14944
- C:\Windows\System\kWgyFRe.exe
  C:\Windows\System\kWgyFRe.exe
  2⤵
  PID:14992
- C:\Windows\System\JFHmZLn.exe
  C:\Windows\System\JFHmZLn.exe
  2⤵
  PID:15020
- C:\Windows\System\IfTilVW.exe
  C:\Windows\System\IfTilVW.exe
  2⤵
  PID:15036
- C:\Windows\System\MaAlrmO.exe
  C:\Windows\System\MaAlrmO.exe
  2⤵
  PID:15052
- C:\Windows\System\XQCYfKb.exe
  C:\Windows\System\XQCYfKb.exe
  2⤵
  PID:15088
- C:\Windows\System\IuPiZci.exe
  C:\Windows\System\IuPiZci.exe
  2⤵
  PID:15112
- C:\Windows\System\DiNVWLT.exe
  C:\Windows\System\DiNVWLT.exe
  2⤵
  PID:15132
- C:\Windows\System\EGPjtWx.exe
  C:\Windows\System\EGPjtWx.exe
  2⤵
  PID:15168
- C:\Windows\System\RHDPnxD.exe
  C:\Windows\System\RHDPnxD.exe
  2⤵
  PID:15192
- C:\Windows\System\hstRaYg.exe
  C:\Windows\System\hstRaYg.exe
  2⤵
  PID:15220
- C:\Windows\System\oRphbdr.exe
  C:\Windows\System\oRphbdr.exe
  2⤵
  PID:15260
- C:\Windows\System\LKJcZCI.exe
  C:\Windows\System\LKJcZCI.exe
  2⤵
  PID:15284
- C:\Windows\System\VnxIypu.exe
  C:\Windows\System\VnxIypu.exe
  2⤵
  PID:15308
- C:\Windows\System\VxlOTsb.exe
  C:\Windows\System\VxlOTsb.exe
  2⤵
  PID:15336
- C:\Windows\System\tURfRYJ.exe
  C:\Windows\System\tURfRYJ.exe
  2⤵
  PID:13424
- C:\Windows\System\czWFzWV.exe
  C:\Windows\System\czWFzWV.exe
  2⤵
  PID:14368
- C:\Windows\System\bKYGHFF.exe
  C:\Windows\System\bKYGHFF.exe
  2⤵
  PID:14452
- C:\Windows\System\rhRTdnw.exe
  C:\Windows\System\rhRTdnw.exe
  2⤵
  PID:14552
- C:\Windows\System\PTGyKQj.exe
  C:\Windows\System\PTGyKQj.exe
  2⤵
  PID:14580
- C:\Windows\System\TXvBiGK.exe
  C:\Windows\System\TXvBiGK.exe
  2⤵
  PID:14652
- C:\Windows\System\ERkgErg.exe
  C:\Windows\System\ERkgErg.exe
  2⤵
  PID:14700
- C:\Windows\System\UoHIyxX.exe
  C:\Windows\System\UoHIyxX.exe
  2⤵
  PID:14776
- C:\Windows\System\KsYWKLu.exe
  C:\Windows\System\KsYWKLu.exe
  2⤵
  PID:14880
- C:\Windows\System\VjuMIQt.exe
  C:\Windows\System\VjuMIQt.exe
  2⤵
  PID:14928
- C:\Windows\System\mofyhkn.exe
  C:\Windows\System\mofyhkn.exe
  2⤵
  PID:15028
- C:\Windows\System\JLgjqEf.exe
  C:\Windows\System\JLgjqEf.exe
  2⤵
  PID:15100
- C:\Windows\System\HwfQXLo.exe
  C:\Windows\System\HwfQXLo.exe
  2⤵
  PID:15156
- C:\Windows\System\yTxaFeE.exe
  C:\Windows\System\yTxaFeE.exe
  2⤵
  PID:15176
- C:\Windows\System\Rhsojtk.exe
  C:\Windows\System\Rhsojtk.exe
  2⤵
  PID:15276
- C:\Windows\System\MkLSVtO.exe
  C:\Windows\System\MkLSVtO.exe
  2⤵
  PID:15324
- C:\Windows\System\QENfwLq.exe
  C:\Windows\System\QENfwLq.exe
  2⤵
  PID:14536
- C:\Windows\System\YBrvvKf.exe
  C:\Windows\System\YBrvvKf.exe
  2⤵
  PID:14616
- C:\Windows\System\iKiXwnq.exe
  C:\Windows\System\iKiXwnq.exe
  2⤵
  PID:14676
- C:\Windows\System\SzrPJFl.exe
  C:\Windows\System\SzrPJFl.exe
  2⤵
  PID:14888
- C:\Windows\System\NouDjYC.exe
  C:\Windows\System\NouDjYC.exe
  2⤵
  PID:15004
- C:\Windows\System\onJrFaL.exe
  C:\Windows\System\onJrFaL.exe
  2⤵
  PID:15128
- C:\Windows\System\gUcjUqx.exe
  C:\Windows\System\gUcjUqx.exe
  2⤵
  PID:15240
- C:\Windows\System\tPKBgth.exe
  C:\Windows\System\tPKBgth.exe
  2⤵
  PID:14504
- C:\Windows\System\sqFSoqT.exe
  C:\Windows\System\sqFSoqT.exe
  2⤵
  PID:14788
- C:\Windows\System\hCQMEHg.exe
  C:\Windows\System\hCQMEHg.exe
  2⤵
  PID:14964
- C:\Windows\System\UjTMwQU.exe
  C:\Windows\System\UjTMwQU.exe
  2⤵
  PID:15232
- C:\Windows\System\xmYBxnL.exe
  C:\Windows\System\xmYBxnL.exe
  2⤵
  PID:14980
- C:\Windows\System\lLFdXac.exe
  C:\Windows\System\lLFdXac.exe
  2⤵
  PID:15396
- C:\Windows\System\eOMQBSi.exe
  C:\Windows\System\eOMQBSi.exe
  2⤵
  PID:15428
- C:\Windows\System\YpUymMe.exe
  C:\Windows\System\YpUymMe.exe
  2⤵
  PID:15456
- C:\Windows\System\JmScMRE.exe
  C:\Windows\System\JmScMRE.exe
  2⤵
  PID:15476
- C:\Windows\System\DHBThts.exe
  C:\Windows\System\DHBThts.exe
  2⤵
  PID:15500
- C:\Windows\System\SWsZgwO.exe
  C:\Windows\System\SWsZgwO.exe
  2⤵
  PID:15536
- C:\Windows\System\NJuKKvX.exe
  C:\Windows\System\NJuKKvX.exe
  2⤵
  PID:15564
- C:\Windows\System\mBWSJbW.exe
  C:\Windows\System\mBWSJbW.exe
  2⤵
  PID:15592
- C:\Windows\System\MBttZNL.exe
  C:\Windows\System\MBttZNL.exe
  2⤵
  PID:15616
- C:\Windows\System\IPJerKY.exe
  C:\Windows\System\IPJerKY.exe
  2⤵
  PID:15668
- C:\Windows\System\lIAwfic.exe
  C:\Windows\System\lIAwfic.exe
  2⤵
  PID:15696
- C:\Windows\System\lWfTznb.exe
  C:\Windows\System\lWfTznb.exe
  2⤵
  PID:15712
- C:\Windows\System\DnqEGms.exe
  C:\Windows\System\DnqEGms.exe
  2⤵
  PID:15732
- C:\Windows\System\UunOzEX.exe
  C:\Windows\System\UunOzEX.exe
  2⤵
  PID:15756
- C:\Windows\System\vgNMKbR.exe
  C:\Windows\System\vgNMKbR.exe
  2⤵
  PID:15780
- C:\Windows\System\SGjOwZd.exe
  C:\Windows\System\SGjOwZd.exe
  2⤵
  PID:15804
- C:\Windows\System\KEAuCFS.exe
  C:\Windows\System\KEAuCFS.exe
  2⤵
  PID:15828
- C:\Windows\System\fhLFtlB.exe
  C:\Windows\System\fhLFtlB.exe
  2⤵
  PID:15860
- C:\Windows\System\SVeyiLj.exe
  C:\Windows\System\SVeyiLj.exe
  2⤵
  PID:15896
- C:\Windows\System\ycyKpyI.exe
  C:\Windows\System\ycyKpyI.exe
  2⤵
  PID:15924
- C:\Windows\System\rhhyOuk.exe
  C:\Windows\System\rhhyOuk.exe
  2⤵
  PID:15976
- C:\Windows\System\zsgNqAn.exe
  C:\Windows\System\zsgNqAn.exe
  2⤵
  PID:16004
- C:\Windows\System\VDqUezG.exe
  C:\Windows\System\VDqUezG.exe
  2⤵
  PID:16032
- C:\Windows\System\ENqvJfU.exe
  C:\Windows\System\ENqvJfU.exe
  2⤵
  PID:16048
- C:\Windows\System\XldxALy.exe
  C:\Windows\System\XldxALy.exe
  2⤵
  PID:16064
- C:\Windows\System\GlEaAFo.exe
  C:\Windows\System\GlEaAFo.exe
  2⤵
  PID:16080
- C:\Windows\System\cuumcnB.exe
  C:\Windows\System\cuumcnB.exe
  2⤵
  PID:16120
- C:\Windows\System\sOEpdZe.exe
  C:\Windows\System\sOEpdZe.exe
  2⤵
  PID:16148
- C:\Windows\System\WkyhepY.exe
  C:\Windows\System\WkyhepY.exe
  2⤵
  PID:16164
- C:\Windows\System\knAdZpA.exe
  C:\Windows\System\knAdZpA.exe
  2⤵
  PID:16212
- C:\Windows\System\ivbRwqH.exe
  C:\Windows\System\ivbRwqH.exe
  2⤵
  PID:16236
- C:\Windows\System\IYPkiPw.exe
  C:\Windows\System\IYPkiPw.exe
  2⤵
  PID:16276
- C:\Windows\System\DeCxyvI.exe
  C:\Windows\System\DeCxyvI.exe
  2⤵
  PID:16300
- C:\Windows\System\lXYhUXI.exe
  C:\Windows\System\lXYhUXI.exe
  2⤵
  PID:16320
- C:\Windows\System\pzZQzIK.exe
  C:\Windows\System\pzZQzIK.exe
  2⤵
  PID:16352
- C:\Windows\System\VmJxsiR.exe
  C:\Windows\System\VmJxsiR.exe
  2⤵
  PID:15120
- C:\Windows\System\DSpeaSV.exe
  C:\Windows\System\DSpeaSV.exe
  2⤵
  PID:15392
- C:\Windows\System\xkXoYZo.exe
  C:\Windows\System\xkXoYZo.exe
  2⤵
  PID:15412
- C:\Windows\System\VYLfaQD.exe
  C:\Windows\System\VYLfaQD.exe
  2⤵
  PID:15512
- C:\Windows\System\lqLneMX.exe
  C:\Windows\System\lqLneMX.exe
  2⤵
  PID:15576
- C:\Windows\System\buehQkv.exe
  C:\Windows\System\buehQkv.exe
  2⤵
  PID:15644
- C:\Windows\System\NLsOjGM.exe
  C:\Windows\System\NLsOjGM.exe
  2⤵
  PID:15684
- C:\Windows\System\HoWGGsb.exe
  C:\Windows\System\HoWGGsb.exe
  2⤵
  PID:15764
- C:\Windows\System\rMAvEeO.exe
  C:\Windows\System\rMAvEeO.exe
  2⤵
  PID:15800
- C:\Windows\System\jXviTKN.exe
  C:\Windows\System\jXviTKN.exe
  2⤵
  PID:15840
- C:\Windows\System\fIRuQPh.exe
  C:\Windows\System\fIRuQPh.exe
  2⤵
  PID:15936
- C:\Windows\System\qbCTAVJ.exe
  C:\Windows\System\qbCTAVJ.exe
  2⤵
  PID:15988
- C:\Windows\System\jkOmEBl.exe
  C:\Windows\System\jkOmEBl.exe
  2⤵
  PID:16040
- C:\Windows\System\ojVdDja.exe
  C:\Windows\System\ojVdDja.exe
  2⤵
  PID:16100
- C:\Windows\System\wvoezrs.exe
  C:\Windows\System\wvoezrs.exe
  2⤵
  PID:16188
- C:\Windows\System\DAhKYIg.exe
  C:\Windows\System\DAhKYIg.exe
  2⤵
  PID:16328
- C:\Windows\System\BmAoNlE.exe
  C:\Windows\System\BmAoNlE.exe
  2⤵
  PID:16340
- C:\Windows\System\WMxjDbh.exe
  C:\Windows\System\WMxjDbh.exe
  2⤵
  PID:16344
- C:\Windows\System\dwtrLAe.exe
  C:\Windows\System\dwtrLAe.exe
  2⤵
  PID:15440
- C:\Windows\System\BmjWAdx.exe
  C:\Windows\System\BmjWAdx.exe
  2⤵
  PID:15664
- C:\Windows\System\oCmVNwT.exe
  C:\Windows\System\oCmVNwT.exe
  2⤵
  PID:15788
- C:\Windows\System\YKAhbfU.exe
  C:\Windows\System\YKAhbfU.exe
  2⤵
  PID:15972
- C:\Windows\System\RxePvfX.exe
  C:\Windows\System\RxePvfX.exe
  2⤵
  PID:16016
- C:\Windows\System\YiwiRWr.exe
  C:\Windows\System\YiwiRWr.exe
  2⤵
  PID:16232
- C:\Windows\System\ystwXMU.exe
  C:\Windows\System\ystwXMU.exe
  2⤵
  PID:14912
- C:\Windows\System\BDdbgsF.exe
  C:\Windows\System\BDdbgsF.exe
  2⤵
  PID:15524
- C:\Windows\System\qQTieYi.exe
  C:\Windows\System\qQTieYi.exe
  2⤵
  PID:15880
- C:\Windows\System\MDAFjey.exe
  C:\Windows\System\MDAFjey.exe
  2⤵
  PID:16076
- C:\Windows\System\VqlTXYd.exe
  C:\Windows\System\VqlTXYd.exe
  2⤵
  PID:16308
- C:\Windows\System\uKAVuLd.exe
  C:\Windows\System\uKAVuLd.exe
  2⤵
  PID:16140
- C:\Windows\System\ysCNzWW.exe
  C:\Windows\System\ysCNzWW.exe
  2⤵
  PID:16420
- C:\Windows\System\NykhBww.exe
  C:\Windows\System\NykhBww.exe
  2⤵
  PID:16452
- C:\Windows\System\lDzhXMQ.exe
  C:\Windows\System\lDzhXMQ.exe
  2⤵
  PID:16476
- C:\Windows\System\WaUOstL.exe
  C:\Windows\System\WaUOstL.exe
  2⤵
  PID:16520
- C:\Windows\System\BBFlFri.exe
  C:\Windows\System\BBFlFri.exe
  2⤵
  PID:16536
- C:\Windows\System\EtrTMRZ.exe
  C:\Windows\System\EtrTMRZ.exe
  2⤵
  PID:16556
- C:\Windows\System\PcMEpzR.exe
  C:\Windows\System\PcMEpzR.exe
  2⤵
  PID:16604
- C:\Windows\System\rMRGgis.exe
  C:\Windows\System\rMRGgis.exe
  2⤵
  PID:16620
- C:\Windows\System\GWgOBjL.exe
  C:\Windows\System\GWgOBjL.exe
  2⤵
  PID:16644
- C:\Windows\System\jCWTUrn.exe
  C:\Windows\System\jCWTUrn.exe
  2⤵
  PID:16688
- C:\Windows\System\XjPmcDE.exe
  C:\Windows\System\XjPmcDE.exe
  2⤵
  PID:16728
- C:\Windows\System\noVNikn.exe
  C:\Windows\System\noVNikn.exe
  2⤵
  PID:16760
- C:\Windows\System\bHIfRpO.exe
  C:\Windows\System\bHIfRpO.exe
  2⤵
  PID:16780
- C:\Windows\System\rbBOiBt.exe
  C:\Windows\System\rbBOiBt.exe
  2⤵
  PID:16804
- C:\Windows\System\BsLVQwl.exe
  C:\Windows\System\BsLVQwl.exe
  2⤵
  PID:16824
- C:\Windows\System\tBqvqwY.exe
  C:\Windows\System\tBqvqwY.exe
  2⤵
  PID:16860
- C:\Windows\System\rEhduRQ.exe
  C:\Windows\System\rEhduRQ.exe
  2⤵
  PID:16884
- C:\Windows\System\lRlfZfy.exe
  C:\Windows\System\lRlfZfy.exe
  2⤵
  PID:16916
- C:\Windows\System\PagzLvX.exe
  C:\Windows\System\PagzLvX.exe
  2⤵
  PID:16932
- C:\Windows\System\SJXOPgV.exe
  C:\Windows\System\SJXOPgV.exe
  2⤵
  PID:16996
- C:\Windows\System\LOViXWG.exe
  C:\Windows\System\LOViXWG.exe
  2⤵
  PID:17020
- C:\Windows\System\yhWjBEI.exe
  C:\Windows\System\yhWjBEI.exe
  2⤵
  PID:17044
- C:\Windows\System\xrZmJei.exe
  C:\Windows\System\xrZmJei.exe
  2⤵
  PID:17068
- C:\Windows\System\RqEAwLY.exe
  C:\Windows\System\RqEAwLY.exe
  2⤵
  PID:17096
- C:\Windows\System\TjewrSq.exe
  C:\Windows\System\TjewrSq.exe
  2⤵
  PID:17120
- C:\Windows\System\nedTQLP.exe
  C:\Windows\System\nedTQLP.exe
  2⤵
  PID:17148
- C:\Windows\System\QxeleLE.exe
  C:\Windows\System\QxeleLE.exe
  2⤵
  PID:17180
- C:\Windows\System\iMhLCTO.exe
  C:\Windows\System\iMhLCTO.exe
  2⤵
  PID:17196
- C:\Windows\System\PNlnhcF.exe
  C:\Windows\System\PNlnhcF.exe
  2⤵
  PID:17228
- C:\Windows\System\riYoMxP.exe
  C:\Windows\System\riYoMxP.exe
  2⤵
  PID:17252
- C:\Windows\System\wtBCemQ.exe
  C:\Windows\System\wtBCemQ.exe
  2⤵
  PID:17268
- C:\Windows\System\aXjSUjx.exe
  C:\Windows\System\aXjSUjx.exe
  2⤵
  PID:17308
- C:\Windows\System\zzFKFOg.exe
  C:\Windows\System\zzFKFOg.exe
  2⤵
  PID:17360
- C:\Windows\System\UpbCMKE.exe
  C:\Windows\System\UpbCMKE.exe
  2⤵
  PID:17376
- C:\Windows\System\ZMCUUCZ.exe
  C:\Windows\System\ZMCUUCZ.exe
  2⤵
  PID:15580
- C:\Windows\System\QOVpzZi.exe
  C:\Windows\System\QOVpzZi.exe
  2⤵
  PID:16024
- C:\Windows\System\LvIBmEc.exe
  C:\Windows\System\LvIBmEc.exe
  2⤵
  PID:16492
- C:\Windows\System\uJTNAtJ.exe
  C:\Windows\System\uJTNAtJ.exe
  2⤵
  PID:16528
- C:\Windows\System\xEFlnYi.exe
  C:\Windows\System\xEFlnYi.exe
  2⤵
  PID:16552
- C:\Windows\System\KoOxoWe.exe
  C:\Windows\System\KoOxoWe.exe
  2⤵
  PID:16612
- C:\Windows\System\LGjoZZJ.exe
  C:\Windows\System\LGjoZZJ.exe
  2⤵
  PID:16720

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AlSkScZ.exe

Filesize
1.7MB

MD5
c33e334c08be1aaa75a3ae9ee0a8380d

SHA1
d243ec5d15e27304866f041b4bb5eb9900a35ec9

SHA256
f995de542b377a91976e9fe0dea0c1da842d9a02c906a985c52bf40bb2fe16f0

SHA512
5f53b60619954812c27c87654f71d8720624b57090db08894e1cd2649ec0d4ceee39ea3f0fe53603671352f8df6e3c1bd309a5b4a3a8d91b68634b5689cd3e61

Download Submit
C:\Windows\System\ENLtOYA.exe

Filesize
1.7MB

MD5
310f23287af5478a1527289f69be1d99

SHA1
22f64cb2c88cc7cc0f26624b54f7902967cd1c4f

SHA256
b3fea3e68bc5c0b7b28e38ad1073e954eeb5c772468543da45d1e35d536869e2

SHA512
2da1deafeacdd1e05e2a0b70c5aa6f75f03e25af09cf63860364c32979188f4e9888833bcae5384a713d6bdd7a12d348517662fa4cccd1fe3f3c74d8b9ab0372

Download Submit
C:\Windows\System\Gojgzfc.exe

Filesize
1.7MB

MD5
09c59c0a47b9d20628a016e978dc977a

SHA1
183be0906a2e599fc01aa9cb072f469282a1c7d0

SHA256
a95cd5a920766b2ef6bcb27a7fab5cf4e330e88885bc2a5ddf4f558fc6ef3ea8

SHA512
dcdfe53e07f88c62bebeb5d0e56885966c4cde2488495b567c171422db96f49a710bcb103ea0e719f6e482103a953b128664b2346f5bbad4a4c8d2ac90c945b8

Download Submit
C:\Windows\System\GqnyitI.exe

Filesize
1.7MB

MD5
92a1c1147c82bc71ccd0078cc23e93c9

SHA1
13003fbf1225439a074e97ff5a8b53fb02e65134

SHA256
09e52c60315bc992c25ee6672c941d8c2177be898e684e46bf8b4a9ac5caa791

SHA512
a5e08bf3df68089a98bb4e8b7b6c2af22a396b325ff57ed8bf0cb91671595c623f7789e2635af2fdbeeab408fd17f3c1b17d15b07dbe3a403cd6927325f63c07

Download Submit
C:\Windows\System\HOmwrXe.exe

Filesize
1.7MB

MD5
125f922a608462e0837c0b79f7774e0d

SHA1
be9ea18aa7ffc8850b3f9ce49ea08ba8d36ee436

SHA256
12fad3184e3e4f158d046bb4c5153d851b9e497ff3732b526a11b5d96d6327ae

SHA512
2eccec5839de4c8c2a4d888a033e1ea5c011648e7f2512c7d337b60d28ddd3eec3ad8cdb7f3aaf5642df91c0fb75686709bfe97d88ebd93fad31a6c443d09b1c

Download Submit
C:\Windows\System\ImHDfux.exe

Filesize
1.7MB

MD5
b7a06634f7c118f98698e7ffcde910a3

SHA1
826566b50e5ff1c965ffa3b798d717c6216dedfa

SHA256
42b35c0f973611e3acea2fcff4cbae37cceafe98ab51a99daae02d6fcc6fe472

SHA512
43ac16d6dd95e79cdcf08eddde977f69fecbeb555719fa8591dd5bb84ecff0098b4bc45c0e128d37d91115afd554eaa42a8084fd88a5718eb367dfa74d34712f

Download Submit
C:\Windows\System\JWEmmvb.exe

Filesize
1.7MB

MD5
a035d1577fe105e01663be28b15f47f6

SHA1
9ced16f68289cc406866a74997db270361e29e22

SHA256
1e55670db972e69e7b143547eef802d57c171d2fe65a1a5eb269898ec3edec68

SHA512
a2fc503f5cff8cf569e3f8673ed3122dc9564dca4eb0ea95903915510f3c958d2f323d8692e1da085b33365d7356ae18be62d9aff61c5cfb6a3be448fdfec5c3

Download Submit
C:\Windows\System\JqVfqKY.exe

Filesize
1.7MB

MD5
8c1f586425d9533a5279c81f409a536e

SHA1
c58666884322d87c3ce8a1a77797cbbcc672d30e

SHA256
8bdcb8d2839c15b72389d8e16e0e2595feb7811e1da469d8b9929847ea5e3cd2

SHA512
f0c157d6a65f25ac58fc09ef416f675f09ba058a3a448c5ce5964f2c112ced6b77d9a88297e190c15a7b2f2f49686e0cf02455f9abe723987de62e0cf7f20418

Download Submit
C:\Windows\System\LnTTsNc.exe

Filesize
1.7MB

MD5
5362c1555327b2f65b77fbc38628145f

SHA1
1c55b79fa4ce87399483b49b88c3e4e2180d7d9e

SHA256
505cdf0e10593b4f5802f52e6dc6d500f333caaf9c99e6990442aa20235640d2

SHA512
37f5cbabc1c77913b1e4b6c59b9791f4a955f30baabeb1466778888b82c619f115975f978ad2af95b3a01bd735cbb46cae8a69d96d7636467f89e4b1aaeaf5ca

Download Submit
C:\Windows\System\MxTQyEm.exe

Filesize
1.7MB

MD5
95dc1f8026bb55e63a0261b32eacf519

SHA1
516c5c76124587dff4db1964e9b101cd4c7708ca

SHA256
6846cee472f152e3ca6784505f8e93ae1c631712b401552065a13040e5baaf2e

SHA512
9afee50e1f1da249ced4afd4b2566eeab22824853fa93251aac1db2fca56d77e2ba29f412d1fa71f4df412cfc92c6868e14dd16fa88c94d1688dc858164c3778

Download Submit
C:\Windows\System\NepQVPh.exe

Filesize
1.7MB

MD5
4e445c9f7d804868df44ae406b68d582

SHA1
d7470524eb9af6718a6a57c15df6b3e30d73c65d

SHA256
90c2ce270019895f21d501b1f176ca0ce792eb21a93060caf1c5cfb492334603

SHA512
106d63b8778317b61f13f075bf72e2f01cd161a793dcb0e6767847151aaa16b717d8ec29c04dd0ad887e14bf451c9df0a0b9256bc588c2fb57d50b256541d34b

Download Submit
C:\Windows\System\OMqKHha.exe

Filesize
1.7MB

MD5
37f041008c59a64bd51080fab6e652ef

SHA1
9738687f6b61bc60ed7895987b2ebc88a0dc2545

SHA256
56cb4cf1017dda4da7bcd4f7b706faa90750233e9287b1ef52224e8807e31970

SHA512
f89c8963019ab8d725bb1246a6fb791322d2249fdfc567f454fcbcbc7c9e5786ee178fc1c6a61e3b1e1dae6e88b8700921f40940d8f6c58da4d2f2a5fab20ea4

Download Submit
C:\Windows\System\QyhpGKZ.exe

Filesize
1.7MB

MD5
41f8fa4307c540f307e7ed98c5014664

SHA1
de88622fbc5b47e9ab86e2bd1f9931f35f1935a2

SHA256
269c5e533c4cb3f2404faeaa73435a334ebee0aa8c631773ebaf50ebcf6519fb

SHA512
a6f683b7f88318be86ff45fe9e3a17c1c3696f02c05c55b2ea7e6289e4efeca88a32a1bc58c6e0ca0e62807203928a1ee164e15299f2c2ef640a036324f7f309

Download Submit
C:\Windows\System\XHjjErr.exe

Filesize
1.7MB

MD5
9dedb06945c4cc309a67b7eabed75bc3

SHA1
e5ccb83022e32bcf36c75c0b0b02b7e335537e05

SHA256
9585e8f2b20765185036dffd540a894d91955e40512d25fe2636547c94a07860

SHA512
3bf470eb26880920ae2ceb73182f816ba80a0295dd9d06616032004580180b78f9dd6ddfea90bd67cabadc690e11d80b52c8bb6d8c349dd8b323d7881fba38a9

Download Submit
C:\Windows\System\YIspsem.exe

Filesize
1.7MB

MD5
43c6836be79cf609d27f5826963470ba

SHA1
6671292e4f8439e7c2bebb9e31705153eed9e606

SHA256
4d8e90ebc8de09ee49ba028b81cc1460720fed88154f7fb06420b6035b1f1285

SHA512
efa9f994c89f60d83e770b2ac77618158306acb0eef5ae5f93bf148ea9f755a5d817f31847bac74d2fa44d094d1e5ee6efa578673402d4c8504350726b087627

Download Submit
C:\Windows\System\ZXplYKG.exe

Filesize
1.7MB

MD5
c0179e3b8d0e6971dc822e0d5fa73e37

SHA1
d124ed8e89d3d7b13eba534fe76af0fbfd7db953

SHA256
e8c09b7c6e9a81ec3242ccd252d1f0910033cd3c841d48c90b6646fa9fa80722

SHA512
ee74f95b5d3cc36a7db4b527c927836edbbb7a07921ee19528d5bcec055ae103d5d220d213c75a9e456a24ef407d5cc8283d4d8866ae98a62c5b9d5137775d8f

Download Submit
C:\Windows\System\ZmiamCp.exe

Filesize
1.7MB

MD5
6f99f1cbd56a3ba4d1d4f42a0a041f1c

SHA1
c8446bd6bd21a88d70805c2dccac4f5cce1cf69d

SHA256
4ca46e18143cc873edc7b85c4a8ffc6dadd78efc3ebf4234833d707d6dcf056b

SHA512
e464c139d7e7b84cdf3043f53c77342f68e69f1e45048ff838c39c4416ebdf8f1e4155e77f301738280162fb66e037ae8ab2850e8864f86e423219cf531da2fe

Download Submit
C:\Windows\System\ZothFHh.exe

Filesize
1.7MB

MD5
17bce368cb11ad39bc6b783fd9e8bc78

SHA1
b6203d3a39f3999d996cc618a25869fae5098fa3

SHA256
9cbb8cfa2c81a3cb9ff080b6426a8b7f21613021f2568ec5b535f9d01fcaffb4

SHA512
56c43efed319c6352dd5ff8b2e13563747a8afdcdde43ee56a9d85935b8ca116b4359ad880280c81bfa720c1c8884005a9c99c81c3278f2a3b773170a7b7edd1

Download Submit
C:\Windows\System\bHFTVtU.exe

Filesize
1.7MB

MD5
42a4146cc19839028ea1a97b970dd35d

SHA1
3c68eace4a17d8c74eeebc3582e82e21f976f7cd

SHA256
b9c1ae6d47939a417a79fa2d09bac2eb83656ba5d2d88c992089f953b753d2b2

SHA512
c92fcfc7dac46269770716f1abf9ad9bac80b2d8f68ed9ff9c89bfea0713f48e2999073ef778a873067c16b02304c4c9996067d4172659252c01725c176425f5

Download Submit
C:\Windows\System\dCFqReH.exe

Filesize
1.7MB

MD5
4f38500a6ff8002300ab725b51bc79e5

SHA1
555fdcf0df52be0f367380ac9aec5073c12a5afa

SHA256
16512fa027b16118cde1b76c9623ed8de10af1c645d7cab08891df2c7ae7083a

SHA512
7762e464bb2fb0e1eb3644a3dca563f667dc045605490f2776da234e12150e7cc306a1916843a991599699dd0ac29310843a1d237df1416feb6668ec46637cf2

Download Submit
C:\Windows\System\dNDUYau.exe

Filesize
1.7MB

MD5
31e53eddf51e143a56e27419fd5c72ca

SHA1
1953f251f943f49acb03260230d443e913e6640b

SHA256
1704ec43521d8958a676c1f23f15bcfe19edf3dd6d0cd0856821bc2878243d64

SHA512
56d571f23ece42e344d54c80c0f18201674b5502d1ba8ffb2732c83695118c4ac323228d8096faa9f94da7a2e9ac2edced737092c8bfb5e255deffe92e97fe5a

Download Submit
C:\Windows\System\fIjFxiV.exe

Filesize
1.7MB

MD5
5586096ffc7e6aed4a1c0eaa2eec87b4

SHA1
9c72c5c1e3fa7a1d6eac77124df8d2788cce25bd

SHA256
8db56331f7f1da5a5aab7eab1d35956d345c45bb497866373bf2b53d1cb23851

SHA512
3b71a3f1dedd16eb4177580f202977aa2ebe4acd1a40943397b95526d0f9311eb766484c2b12302dfd98da5476968f4823788a25ba623c76cdd52d6b7308815e

Download Submit
C:\Windows\System\hEiisir.exe

Filesize
1.7MB

MD5
5b873933741e0de3498f1bc359865b1c

SHA1
206ed00b9fb1870bb962faf6508050f7702b9b27

SHA256
da4beaf19d624dc96af991dc0086ac52e6ce14b175dc3d53895382212aed6f71

SHA512
b2aaf57c712ae84a24793ef0c1a88b9448b850eb8a2a1df32f8a344fde7f5f13a78c0183b850ffa257b46ef0e579a7a087150ae6fd1eb07a45755d1689a491d2

Download Submit
C:\Windows\System\jjenanN.exe

Filesize
1.7MB

MD5
911a73ece2b9a4e1e6bbb7ed5367b0e0

SHA1
f27e827b93fae1a732c7e3946d638cb31a8fe761

SHA256
1994c4125c8a19f16a91d506cffeb30703c4039b47b1ef59cadb979e3a96d6fe

SHA512
1e1925fc397229d0efc4d764fbc48aa03c96dfb2070942eeb99556e91cf7de7a6c3ffe65f2e17916b8831f04fc0f0d844ca84073acf0667894ef92550aba98fd

Download Submit
C:\Windows\System\okexKDq.exe

Filesize
1.7MB

MD5
4167897649e7cd0979913b40bdb8b654

SHA1
d421698745e5e4b828df2dae26fe2d4680384f67

SHA256
a677aa1aadec104e8a987349371b1952083248ab71d204f8e545c8caff3666bf

SHA512
9e9c9a511c27423d432b776b20e83be403fc61c9299dd88eaa0f9bbb15cd567aa9e56267a5c9b0c814ad40cbbcb27ee70a7c25dd8f12e471e1b52be973c18f20

Download Submit
C:\Windows\System\okzfJMJ.exe

Filesize
1.7MB

MD5
aec9b362a3a80a42fdaf889e8daa5141

SHA1
45a5fd4ee9a1e0b2e28e0b33cce0561a9729e4b4

SHA256
d3e4ecff9f51e4e777e3851b3d717a8038cdcec5ee5118c90a97a4741a56da7c

SHA512
caeda561e5797eeddb3652926bf339157f5d7d463d74cc0088a9432e007f8024dda958ec384b500814ee6cd11b26a8e52d21b934c4bc44844d6522344bdcc2e7

Download Submit
C:\Windows\System\prXLKYd.exe

Filesize
1.7MB

MD5
15747b7bdf6b21cebef39eefeb206843

SHA1
bdb2e5fb649b1f3cfa15a3b5a5d5f02ac584e939

SHA256
b7d5bf7b234a1103c24e75c02ce3d38138a5305bf1006edbb9caa24242cb96ae

SHA512
2d0adc7830c361012900b02dc2c3aaedfe8e6e6b703f95ad4e0a22ec56bf56bdf69b708fe4184f7c0e71ed09e5f240689f028e783b1d574ec5e275f946de8e45

Download Submit
C:\Windows\System\tJCfmMM.exe

Filesize
1.7MB

MD5
7d5d5380e005628afae0c93f9be2843b

SHA1
4a9e1f2ab59c5d789ec959a6a620e219844b887e

SHA256
bf7484438a4adfd18acd2412411cd330f0bd391357e6e1de5297d8edea05ef8a

SHA512
ca5382fe17533e6adbd26e74ea95ffa8039d7697fecba52dc32b50abf1d9ffb195c7232dd5bbbe76dfcf497d628c740b05f7feb3381acdb11609dfea7abd6350

Download Submit
C:\Windows\System\vgzWcaH.exe

Filesize
1.7MB

MD5
38e7959573e22c1e2584bcc2b759f972

SHA1
4fc02f8596940bc5a262c04eb70865c1a3549dbd

SHA256
9b0437f167c51da4ac7dc59451fa75a9973cc9e9187bacc4529773f6b55ad72f

SHA512
987aec5fa3548b01fda0a919f3cd0212478d9746ca2033f0a23f2a126bf78359e00f919b6910822e3320183c96f4048ecfa3410d3156fa40cf1bff14bba184bb

Download Submit
C:\Windows\System\vqCRDTj.exe

Filesize
1.7MB

MD5
410a31d880718310fde37a2164f5951b

SHA1
e0bce98d11d24751c533fb86379c56aff78f8a51

SHA256
5f3be5fa543731c693684365c6da2c7d4baadc17582ab2441c5d168a92f46f7e

SHA512
7ef9119fec6ba108bcededcda7bbfed999243fdf54276db0eac806f870b2fb665298dc549aab55b2e6272efd5e234bc5961484201a7e7db883c175816c3c76bb

Download Submit
C:\Windows\System\wLtOdFE.exe

Filesize
1.7MB

MD5
c7366e785919a845a31fc7ac318c1e7d

SHA1
b5d1e76ad17a1db44441991d944510cc4c715d01

SHA256
dc7ccf109251e1b211578d59a558b1ccb3c329b3e5ce5b956e1a6ccc7f824c62

SHA512
a79a9bdeeea4eae684b237daf11d5cab6f7795f2e3a4b280349b04f6be415f1d52abf37462612e88681fdb3fe7a36c3b68440638f3b1c4e9dcfc575ba8e072ad

Download Submit
C:\Windows\System\xjKMgUW.exe

Filesize
1.7MB

MD5
387b51ae6c6da0e76899b47558f86485

SHA1
6fae3ad0975f0b19c46db9a3320b3ce2f3c8b74e

SHA256
26a6469b4ff0bc55ab9dd689f1894172903146a047b5c62aff8c39d77d855b61

SHA512
924ceeb9035d928293d771032bbb9ceaaffd2105b7012f47fa4f636bb532c87e967a6c6017f2ede56267883808817ff3b0e1a66c7e50e22524d094af63743e96

Download Submit
memory/2800-0-0x000001F5EB600000-0x000001F5EB610000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads