xmrig | c25a02e7f432d24b5c18ebdf013db60303e5acabf40bd4ae48636a187906b73a

Analysis

max time kernel
105s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
Size 1022KB
Sample240612-2ygstatgna
SHA256 c25a02e7f432d24b5c18ebdf013db60303e5acabf40bd4ae48636a187906b73a
MD5 4b141ab4518d549ad0f5c2c9fae9e870
SHA1 bc4d443f541275c26c1489510b3f15b510f73e0c
SHA512 29bcdd7615bc48d910c2b354c4626c25ec101cf31b2c37148814d5966e060fbc0470ef27f88b1b676388d81574f003d2a924990c939edde772567f5c4ff4c9b2
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFf+:GezaTF8FcNkNdfE0pZ9oztFwIRsqQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x0005000000022f1e-4.dat	xmrig
behavioral2/files/0x00070000000233eb-15.dat	xmrig
behavioral2/files/0x00080000000233ea-10.dat	xmrig
behavioral2/files/0x00070000000233ec-19.dat	xmrig
behavioral2/files/0x00070000000233ed-22.dat	xmrig
behavioral2/files/0x00070000000233ee-31.dat	xmrig
behavioral2/files/0x00070000000233f0-40.dat	xmrig
behavioral2/files/0x00070000000233f1-50.dat	xmrig
behavioral2/files/0x00070000000233f2-52.dat	xmrig
behavioral2/files/0x00070000000233f3-58.dat	xmrig
behavioral2/files/0x00070000000233f5-67.dat	xmrig
behavioral2/files/0x00070000000233f6-69.dat	xmrig
behavioral2/files/0x00070000000233f4-65.dat	xmrig
behavioral2/files/0x00070000000233ef-36.dat	xmrig
behavioral2/files/0x00070000000233f7-74.dat	xmrig
behavioral2/files/0x00070000000233f8-79.dat	xmrig
behavioral2/files/0x00080000000233e8-80.dat	xmrig
behavioral2/files/0x00070000000233f9-92.dat	xmrig
behavioral2/files/0x00070000000233fb-95.dat	xmrig
behavioral2/files/0x00070000000233fa-94.dat	xmrig
behavioral2/files/0x00070000000233fc-104.dat	xmrig
behavioral2/files/0x00070000000233fe-112.dat	xmrig
behavioral2/files/0x00070000000233fd-114.dat	xmrig
behavioral2/files/0x00070000000233ff-118.dat	xmrig
behavioral2/files/0x0007000000023400-123.dat	xmrig
behavioral2/files/0x0007000000023401-129.dat	xmrig
behavioral2/files/0x0007000000023402-134.dat	xmrig
behavioral2/files/0x0007000000023403-138.dat	xmrig
behavioral2/files/0x0007000000023404-148.dat	xmrig
behavioral2/files/0x0007000000023405-150.dat	xmrig
behavioral2/files/0x0007000000023406-154.dat	xmrig
behavioral2/files/0x0007000000023407-160.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
536	WByBENf.exe
1196	SSwUNvk.exe
1608	KIIIwXg.exe
1504	QqunsYp.exe
2784	fIdMUQh.exe
1036	TVWLHGV.exe
376	MccxNjM.exe
692	chhGqzm.exe
4016	VMRnyCN.exe
4124	hjqbGer.exe
8	GTzNohU.exe
4088	yBQQKOJ.exe
4916	arXvYMN.exe
3744	RVezCEA.exe
2880	JgxhOsk.exe
4140	qMkWavs.exe
1856	dYdJzOw.exe
3804	qXmWzxi.exe
4924	lTLKmro.exe
4208	LtUGcOI.exe
1296	jxvVinq.exe
1140	hVOOoGo.exe
3880	oWoUAIV.exe
4688	ZGMWsJf.exe
2812	OhYstyk.exe
2244	etttuop.exe
4492	VxeWJQY.exe
704	udbrhWU.exe
4756	AfMouQR.exe
3544	cYpWdQq.exe
3028	cjxYjNK.exe
4664	hgMAXcu.exe
1288	nesnNIz.exe
3520	SOueyJU.exe
4428	kLChBUj.exe
3444	zqPuIws.exe
652	CicpjsL.exe
3992	XkMmRHI.exe
4832	mpNdbhr.exe
2980	NXZKXos.exe
3892	qrcfgpc.exe
4456	RSqVWmC.exe
400	ykrfbeR.exe
740	DpAiIwC.exe
2836	AFNUgDe.exe
4900	OLWgWMn.exe
4376	NyUWGHs.exe
1436	eBETiVO.exe
4836	JEAqnnn.exe
4132	uIewiEZ.exe
4988	nrYFzCq.exe
1248	JVQfCLi.exe
4724	TnvfXco.exe
4932	rMPuCsC.exe
968	qiJCwLp.exe
1400	KZDenxc.exe
3148	EqJhPzJ.exe
4328	ivwbIPP.exe
4876	ZVFwaFt.exe
2992	lsuZYfR.exe
760	NeFukUg.exe
1016	ABeJXiy.exe
4908	FoSevko.exe
664	qpYeHNw.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JltpdGc.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\lmAdzkX.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\iEnbdZc.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\lHTAyDg.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\pgEDjcB.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\nIahZod.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\QrYczHR.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\pdBejMN.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\pDaGAUG.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\TGdvVwx.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\nUeVXvg.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\qKDPrap.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\gDolmoY.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\aLKfdQv.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\oFUQFEY.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\XoxspFH.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\rcILYkA.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\zCnkrJp.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\WYzOrjf.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\oSIDHGN.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\HHDkCpv.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\sxqvCrP.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\KZlPDHt.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\wlDdlWQ.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\sjsPmhN.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\MOFjUEU.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\UUCFHZD.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\sWVafHK.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\ivwbIPP.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\hnRDVUY.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\IQgsgGm.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\iGXtkrb.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\wDdztyV.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\ESwcbzd.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\TVWLHGV.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\FavqdmX.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\ImkfqvX.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\OoUUuwl.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\zJubHkL.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\TWtLaBC.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\OaepOgp.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\jpgumlP.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\WZauZfZ.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\wlahsBv.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\uhSBrGD.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\nAPwgTU.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\JKftPnX.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\qVZhWig.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\tFRUCyB.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\OJrBfNo.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\kJTwZvi.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\QDbjGdZ.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\nhmtAUg.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\LILUIsQ.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\IrcpBhj.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\IfBmzii.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\xTxluNi.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\bIoMtDk.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\NIZKPiy.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\UTdeWJK.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\udbrhWU.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\dSnKacB.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\NNCflhY.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
File created	C:\Windows\System\zaOWQDx.exe	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17120	dwm.exe
Token: SeChangeNotifyPrivilege	17120	dwm.exe
Token: 33	17120	dwm.exe
Token: SeIncBasePriorityPrivilege	17120	dwm.exe
Token: SeShutdownPrivilege	17120	dwm.exe
Token: SeCreatePagefilePrivilege	17120	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 536	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	82
PID 1900 wrote to memory of 536	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	82
PID 1900 wrote to memory of 1196	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	83
PID 1900 wrote to memory of 1196	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	83
PID 1900 wrote to memory of 1608	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	84
PID 1900 wrote to memory of 1608	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	84
PID 1900 wrote to memory of 1504	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	85
PID 1900 wrote to memory of 1504	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	85
PID 1900 wrote to memory of 2784	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	86
PID 1900 wrote to memory of 2784	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	86
PID 1900 wrote to memory of 1036	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	87
PID 1900 wrote to memory of 1036	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	87
PID 1900 wrote to memory of 376	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	88
PID 1900 wrote to memory of 376	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	88
PID 1900 wrote to memory of 692	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	89
PID 1900 wrote to memory of 692	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	89
PID 1900 wrote to memory of 4016	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	90
PID 1900 wrote to memory of 4016	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	90
PID 1900 wrote to memory of 4124	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	91
PID 1900 wrote to memory of 4124	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	91
PID 1900 wrote to memory of 8	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	93
PID 1900 wrote to memory of 8	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	93
PID 1900 wrote to memory of 4088	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	94
PID 1900 wrote to memory of 4088	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	94
PID 1900 wrote to memory of 4916	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	95
PID 1900 wrote to memory of 4916	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	95
PID 1900 wrote to memory of 3744	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	96
PID 1900 wrote to memory of 3744	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	96
PID 1900 wrote to memory of 2880	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	98
PID 1900 wrote to memory of 2880	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	98
PID 1900 wrote to memory of 1856	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	99
PID 1900 wrote to memory of 1856	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	99
PID 1900 wrote to memory of 4140	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	100
PID 1900 wrote to memory of 4140	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	100
PID 1900 wrote to memory of 3804	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	101
PID 1900 wrote to memory of 3804	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	101
PID 1900 wrote to memory of 4924	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	103
PID 1900 wrote to memory of 4924	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	103
PID 1900 wrote to memory of 4208	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	104
PID 1900 wrote to memory of 4208	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	104
PID 1900 wrote to memory of 1296	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	105
PID 1900 wrote to memory of 1296	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	105
PID 1900 wrote to memory of 1140	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	106
PID 1900 wrote to memory of 1140	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	106
PID 1900 wrote to memory of 3880	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	107
PID 1900 wrote to memory of 3880	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	107
PID 1900 wrote to memory of 4688	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	108
PID 1900 wrote to memory of 4688	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	108
PID 1900 wrote to memory of 2812	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	109
PID 1900 wrote to memory of 2812	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	109
PID 1900 wrote to memory of 2244	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	110
PID 1900 wrote to memory of 2244	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	110
PID 1900 wrote to memory of 4492	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	111
PID 1900 wrote to memory of 4492	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	111
PID 1900 wrote to memory of 704	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	112
PID 1900 wrote to memory of 704	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	112
PID 1900 wrote to memory of 4756	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	113
PID 1900 wrote to memory of 4756	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	113
PID 1900 wrote to memory of 3544	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	114
PID 1900 wrote to memory of 3544	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	114
PID 1900 wrote to memory of 3028	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	115
PID 1900 wrote to memory of 3028	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	115
PID 1900 wrote to memory of 4664	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	117
PID 1900 wrote to memory of 4664	1900	4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4b141ab4518d549ad0f5c2c9fae9e870_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\System\WByBENf.exe
  C:\Windows\System\WByBENf.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\SSwUNvk.exe
  C:\Windows\System\SSwUNvk.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\KIIIwXg.exe
  C:\Windows\System\KIIIwXg.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\QqunsYp.exe
  C:\Windows\System\QqunsYp.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\fIdMUQh.exe
  C:\Windows\System\fIdMUQh.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\TVWLHGV.exe
  C:\Windows\System\TVWLHGV.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\MccxNjM.exe
  C:\Windows\System\MccxNjM.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\chhGqzm.exe
  C:\Windows\System\chhGqzm.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\VMRnyCN.exe
  C:\Windows\System\VMRnyCN.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\hjqbGer.exe
  C:\Windows\System\hjqbGer.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\GTzNohU.exe
  C:\Windows\System\GTzNohU.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\yBQQKOJ.exe
  C:\Windows\System\yBQQKOJ.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\arXvYMN.exe
  C:\Windows\System\arXvYMN.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\RVezCEA.exe
  C:\Windows\System\RVezCEA.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\JgxhOsk.exe
  C:\Windows\System\JgxhOsk.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\dYdJzOw.exe
  C:\Windows\System\dYdJzOw.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\qMkWavs.exe
  C:\Windows\System\qMkWavs.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\qXmWzxi.exe
  C:\Windows\System\qXmWzxi.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\lTLKmro.exe
  C:\Windows\System\lTLKmro.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\LtUGcOI.exe
  C:\Windows\System\LtUGcOI.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\jxvVinq.exe
  C:\Windows\System\jxvVinq.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\hVOOoGo.exe
  C:\Windows\System\hVOOoGo.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\oWoUAIV.exe
  C:\Windows\System\oWoUAIV.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\ZGMWsJf.exe
  C:\Windows\System\ZGMWsJf.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\OhYstyk.exe
  C:\Windows\System\OhYstyk.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\etttuop.exe
  C:\Windows\System\etttuop.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\VxeWJQY.exe
  C:\Windows\System\VxeWJQY.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\udbrhWU.exe
  C:\Windows\System\udbrhWU.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\AfMouQR.exe
  C:\Windows\System\AfMouQR.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\cYpWdQq.exe
  C:\Windows\System\cYpWdQq.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\cjxYjNK.exe
  C:\Windows\System\cjxYjNK.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\hgMAXcu.exe
  C:\Windows\System\hgMAXcu.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\nesnNIz.exe
  C:\Windows\System\nesnNIz.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\SOueyJU.exe
  C:\Windows\System\SOueyJU.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\kLChBUj.exe
  C:\Windows\System\kLChBUj.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\zqPuIws.exe
  C:\Windows\System\zqPuIws.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\CicpjsL.exe
  C:\Windows\System\CicpjsL.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\XkMmRHI.exe
  C:\Windows\System\XkMmRHI.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\mpNdbhr.exe
  C:\Windows\System\mpNdbhr.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\NXZKXos.exe
  C:\Windows\System\NXZKXos.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\qrcfgpc.exe
  C:\Windows\System\qrcfgpc.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\RSqVWmC.exe
  C:\Windows\System\RSqVWmC.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\ykrfbeR.exe
  C:\Windows\System\ykrfbeR.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\DpAiIwC.exe
  C:\Windows\System\DpAiIwC.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\AFNUgDe.exe
  C:\Windows\System\AFNUgDe.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\OLWgWMn.exe
  C:\Windows\System\OLWgWMn.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\NyUWGHs.exe
  C:\Windows\System\NyUWGHs.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\eBETiVO.exe
  C:\Windows\System\eBETiVO.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\JEAqnnn.exe
  C:\Windows\System\JEAqnnn.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\uIewiEZ.exe
  C:\Windows\System\uIewiEZ.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\nrYFzCq.exe
  C:\Windows\System\nrYFzCq.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\JVQfCLi.exe
  C:\Windows\System\JVQfCLi.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\TnvfXco.exe
  C:\Windows\System\TnvfXco.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\rMPuCsC.exe
  C:\Windows\System\rMPuCsC.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\qiJCwLp.exe
  C:\Windows\System\qiJCwLp.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\KZDenxc.exe
  C:\Windows\System\KZDenxc.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\EqJhPzJ.exe
  C:\Windows\System\EqJhPzJ.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\ivwbIPP.exe
  C:\Windows\System\ivwbIPP.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\ZVFwaFt.exe
  C:\Windows\System\ZVFwaFt.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\lsuZYfR.exe
  C:\Windows\System\lsuZYfR.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\NeFukUg.exe
  C:\Windows\System\NeFukUg.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\ABeJXiy.exe
  C:\Windows\System\ABeJXiy.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\FoSevko.exe
  C:\Windows\System\FoSevko.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\qpYeHNw.exe
  C:\Windows\System\qpYeHNw.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\tXvoGph.exe
  C:\Windows\System\tXvoGph.exe
  2⤵
  PID:2252
- C:\Windows\System\jINmkrL.exe
  C:\Windows\System\jINmkrL.exe
  2⤵
  PID:2092
- C:\Windows\System\yIyBsoI.exe
  C:\Windows\System\yIyBsoI.exe
  2⤵
  PID:4768
- C:\Windows\System\fNsYCut.exe
  C:\Windows\System\fNsYCut.exe
  2⤵
  PID:3404
- C:\Windows\System\MNoAtrq.exe
  C:\Windows\System\MNoAtrq.exe
  2⤵
  PID:2388
- C:\Windows\System\QrYczHR.exe
  C:\Windows\System\QrYczHR.exe
  2⤵
  PID:3568
- C:\Windows\System\AMeYFfv.exe
  C:\Windows\System\AMeYFfv.exe
  2⤵
  PID:1376
- C:\Windows\System\xhpyssP.exe
  C:\Windows\System\xhpyssP.exe
  2⤵
  PID:1620
- C:\Windows\System\kHttjON.exe
  C:\Windows\System\kHttjON.exe
  2⤵
  PID:4364
- C:\Windows\System\XwZzYGl.exe
  C:\Windows\System\XwZzYGl.exe
  2⤵
  PID:872
- C:\Windows\System\uiEXxGo.exe
  C:\Windows\System\uiEXxGo.exe
  2⤵
  PID:4040
- C:\Windows\System\KZlPDHt.exe
  C:\Windows\System\KZlPDHt.exe
  2⤵
  PID:4860
- C:\Windows\System\SWhYpuB.exe
  C:\Windows\System\SWhYpuB.exe
  2⤵
  PID:3548
- C:\Windows\System\YlBObst.exe
  C:\Windows\System\YlBObst.exe
  2⤵
  PID:4912
- C:\Windows\System\XQDUKOb.exe
  C:\Windows\System\XQDUKOb.exe
  2⤵
  PID:1908
- C:\Windows\System\PZqEotL.exe
  C:\Windows\System\PZqEotL.exe
  2⤵
  PID:4600
- C:\Windows\System\OusLCzp.exe
  C:\Windows\System\OusLCzp.exe
  2⤵
  PID:4976
- C:\Windows\System\oIlTwOI.exe
  C:\Windows\System\oIlTwOI.exe
  2⤵
  PID:64
- C:\Windows\System\JcFAeXd.exe
  C:\Windows\System\JcFAeXd.exe
  2⤵
  PID:4284
- C:\Windows\System\dSnKacB.exe
  C:\Windows\System\dSnKacB.exe
  2⤵
  PID:5040
- C:\Windows\System\VkhQvPu.exe
  C:\Windows\System\VkhQvPu.exe
  2⤵
  PID:4440
- C:\Windows\System\TAbsezn.exe
  C:\Windows\System\TAbsezn.exe
  2⤵
  PID:460
- C:\Windows\System\ardkScU.exe
  C:\Windows\System\ardkScU.exe
  2⤵
  PID:3976
- C:\Windows\System\nOfVIYg.exe
  C:\Windows\System\nOfVIYg.exe
  2⤵
  PID:1324
- C:\Windows\System\revIclX.exe
  C:\Windows\System\revIclX.exe
  2⤵
  PID:3160
- C:\Windows\System\OWzJrmr.exe
  C:\Windows\System\OWzJrmr.exe
  2⤵
  PID:4228
- C:\Windows\System\WIPYhwN.exe
  C:\Windows\System\WIPYhwN.exe
  2⤵
  PID:2436
- C:\Windows\System\AnwUVLI.exe
  C:\Windows\System\AnwUVLI.exe
  2⤵
  PID:4164
- C:\Windows\System\xgCIhvs.exe
  C:\Windows\System\xgCIhvs.exe
  2⤵
  PID:444
- C:\Windows\System\otQvptX.exe
  C:\Windows\System\otQvptX.exe
  2⤵
  PID:5144
- C:\Windows\System\KgxjYts.exe
  C:\Windows\System\KgxjYts.exe
  2⤵
  PID:5164
- C:\Windows\System\gDolmoY.exe
  C:\Windows\System\gDolmoY.exe
  2⤵
  PID:5180
- C:\Windows\System\jTQSpgs.exe
  C:\Windows\System\jTQSpgs.exe
  2⤵
  PID:5208
- C:\Windows\System\owOcLRY.exe
  C:\Windows\System\owOcLRY.exe
  2⤵
  PID:5228
- C:\Windows\System\lzHHQJY.exe
  C:\Windows\System\lzHHQJY.exe
  2⤵
  PID:5252
- C:\Windows\System\nbELEGQ.exe
  C:\Windows\System\nbELEGQ.exe
  2⤵
  PID:5284
- C:\Windows\System\uhSBrGD.exe
  C:\Windows\System\uhSBrGD.exe
  2⤵
  PID:5312
- C:\Windows\System\weNPPVs.exe
  C:\Windows\System\weNPPVs.exe
  2⤵
  PID:5344
- C:\Windows\System\IaYNbvr.exe
  C:\Windows\System\IaYNbvr.exe
  2⤵
  PID:5372
- C:\Windows\System\ogRWQru.exe
  C:\Windows\System\ogRWQru.exe
  2⤵
  PID:5428
- C:\Windows\System\fIojXmt.exe
  C:\Windows\System\fIojXmt.exe
  2⤵
  PID:5456
- C:\Windows\System\XlazlhL.exe
  C:\Windows\System\XlazlhL.exe
  2⤵
  PID:5484
- C:\Windows\System\RteQQuV.exe
  C:\Windows\System\RteQQuV.exe
  2⤵
  PID:5508
- C:\Windows\System\VqnbtPs.exe
  C:\Windows\System\VqnbtPs.exe
  2⤵
  PID:5540
- C:\Windows\System\YsIFHKO.exe
  C:\Windows\System\YsIFHKO.exe
  2⤵
  PID:5588
- C:\Windows\System\zrycbSO.exe
  C:\Windows\System\zrycbSO.exe
  2⤵
  PID:5640
- C:\Windows\System\fxVTzgm.exe
  C:\Windows\System\fxVTzgm.exe
  2⤵
  PID:5656
- C:\Windows\System\nAPwgTU.exe
  C:\Windows\System\nAPwgTU.exe
  2⤵
  PID:5684
- C:\Windows\System\KGHugSP.exe
  C:\Windows\System\KGHugSP.exe
  2⤵
  PID:5712
- C:\Windows\System\ZIBKNOI.exe
  C:\Windows\System\ZIBKNOI.exe
  2⤵
  PID:5736
- C:\Windows\System\oJewNDx.exe
  C:\Windows\System\oJewNDx.exe
  2⤵
  PID:5768
- C:\Windows\System\slViVan.exe
  C:\Windows\System\slViVan.exe
  2⤵
  PID:5792
- C:\Windows\System\QjnkpnC.exe
  C:\Windows\System\QjnkpnC.exe
  2⤵
  PID:5824
- C:\Windows\System\VGikBFw.exe
  C:\Windows\System\VGikBFw.exe
  2⤵
  PID:5840
- C:\Windows\System\ftkzaNR.exe
  C:\Windows\System\ftkzaNR.exe
  2⤵
  PID:5868
- C:\Windows\System\OhVyWdO.exe
  C:\Windows\System\OhVyWdO.exe
  2⤵
  PID:5900
- C:\Windows\System\IZhqFBO.exe
  C:\Windows\System\IZhqFBO.exe
  2⤵
  PID:5928
- C:\Windows\System\eqIVqlk.exe
  C:\Windows\System\eqIVqlk.exe
  2⤵
  PID:5964
- C:\Windows\System\iijAbwh.exe
  C:\Windows\System\iijAbwh.exe
  2⤵
  PID:5988
- C:\Windows\System\FuEPXKC.exe
  C:\Windows\System\FuEPXKC.exe
  2⤵
  PID:6012
- C:\Windows\System\sHfuBFk.exe
  C:\Windows\System\sHfuBFk.exe
  2⤵
  PID:6036
- C:\Windows\System\ofhUSMl.exe
  C:\Windows\System\ofhUSMl.exe
  2⤵
  PID:6064
- C:\Windows\System\kQphGUl.exe
  C:\Windows\System\kQphGUl.exe
  2⤵
  PID:6084
- C:\Windows\System\FmRWBQo.exe
  C:\Windows\System\FmRWBQo.exe
  2⤵
  PID:6112
- C:\Windows\System\JLWAMFq.exe
  C:\Windows\System\JLWAMFq.exe
  2⤵
  PID:6140
- C:\Windows\System\KmZNbQM.exe
  C:\Windows\System\KmZNbQM.exe
  2⤵
  PID:3684
- C:\Windows\System\VVObEbW.exe
  C:\Windows\System\VVObEbW.exe
  2⤵
  PID:5248
- C:\Windows\System\eeAxiEN.exe
  C:\Windows\System\eeAxiEN.exe
  2⤵
  PID:5220
- C:\Windows\System\cisumEZ.exe
  C:\Windows\System\cisumEZ.exe
  2⤵
  PID:5268
- C:\Windows\System\VonJult.exe
  C:\Windows\System\VonJult.exe
  2⤵
  PID:5352
- C:\Windows\System\QemJsIx.exe
  C:\Windows\System\QemJsIx.exe
  2⤵
  PID:5440
- C:\Windows\System\ZKFDjgu.exe
  C:\Windows\System\ZKFDjgu.exe
  2⤵
  PID:5500
- C:\Windows\System\bZiyhas.exe
  C:\Windows\System\bZiyhas.exe
  2⤵
  PID:5576
- C:\Windows\System\QeHgzQQ.exe
  C:\Windows\System\QeHgzQQ.exe
  2⤵
  PID:5680
- C:\Windows\System\PyNCnZy.exe
  C:\Windows\System\PyNCnZy.exe
  2⤵
  PID:5672
- C:\Windows\System\rTYhCgE.exe
  C:\Windows\System\rTYhCgE.exe
  2⤵
  PID:5784
- C:\Windows\System\kYAdare.exe
  C:\Windows\System\kYAdare.exe
  2⤵
  PID:5836
- C:\Windows\System\HeWgvga.exe
  C:\Windows\System\HeWgvga.exe
  2⤵
  PID:5948
- C:\Windows\System\hvCZcrl.exe
  C:\Windows\System\hvCZcrl.exe
  2⤵
  PID:5972
- C:\Windows\System\kPwkCjM.exe
  C:\Windows\System\kPwkCjM.exe
  2⤵
  PID:6028
- C:\Windows\System\wDdztyV.exe
  C:\Windows\System\wDdztyV.exe
  2⤵
  PID:6080
- C:\Windows\System\lFwulFV.exe
  C:\Windows\System\lFwulFV.exe
  2⤵
  PID:5192
- C:\Windows\System\zCnkrJp.exe
  C:\Windows\System\zCnkrJp.exe
  2⤵
  PID:5244
- C:\Windows\System\IJbZGvC.exe
  C:\Windows\System\IJbZGvC.exe
  2⤵
  PID:5264
- C:\Windows\System\tfTUCAv.exe
  C:\Windows\System\tfTUCAv.exe
  2⤵
  PID:5444
- C:\Windows\System\pdBejMN.exe
  C:\Windows\System\pdBejMN.exe
  2⤵
  PID:5532
- C:\Windows\System\RPlzkFe.exe
  C:\Windows\System\RPlzkFe.exe
  2⤵
  PID:5560
- C:\Windows\System\BBeFdCy.exe
  C:\Windows\System\BBeFdCy.exe
  2⤵
  PID:5816
- C:\Windows\System\kGHTGdy.exe
  C:\Windows\System\kGHTGdy.exe
  2⤵
  PID:5960
- C:\Windows\System\OLmTeni.exe
  C:\Windows\System\OLmTeni.exe
  2⤵
  PID:6100
- C:\Windows\System\HHDkCpv.exe
  C:\Windows\System\HHDkCpv.exe
  2⤵
  PID:5404
- C:\Windows\System\fHinPsf.exe
  C:\Windows\System\fHinPsf.exe
  2⤵
  PID:5760
- C:\Windows\System\piTJJtp.exe
  C:\Windows\System\piTJJtp.exe
  2⤵
  PID:5856
- C:\Windows\System\ysYffJo.exe
  C:\Windows\System\ysYffJo.exe
  2⤵
  PID:6148
- C:\Windows\System\yTzWcWh.exe
  C:\Windows\System\yTzWcWh.exe
  2⤵
  PID:6176
- C:\Windows\System\ZLDLVjr.exe
  C:\Windows\System\ZLDLVjr.exe
  2⤵
  PID:6200
- C:\Windows\System\AyWVXJZ.exe
  C:\Windows\System\AyWVXJZ.exe
  2⤵
  PID:6224
- C:\Windows\System\xKSYVky.exe
  C:\Windows\System\xKSYVky.exe
  2⤵
  PID:6252
- C:\Windows\System\BgwdSFj.exe
  C:\Windows\System\BgwdSFj.exe
  2⤵
  PID:6280
- C:\Windows\System\aLKfdQv.exe
  C:\Windows\System\aLKfdQv.exe
  2⤵
  PID:6304
- C:\Windows\System\dkrRZCA.exe
  C:\Windows\System\dkrRZCA.exe
  2⤵
  PID:6328
- C:\Windows\System\BhjPnzz.exe
  C:\Windows\System\BhjPnzz.exe
  2⤵
  PID:6360
- C:\Windows\System\sVQIZFT.exe
  C:\Windows\System\sVQIZFT.exe
  2⤵
  PID:6384
- C:\Windows\System\BwUAtfG.exe
  C:\Windows\System\BwUAtfG.exe
  2⤵
  PID:6412
- C:\Windows\System\dHyGhca.exe
  C:\Windows\System\dHyGhca.exe
  2⤵
  PID:6440
- C:\Windows\System\DhOfoeV.exe
  C:\Windows\System\DhOfoeV.exe
  2⤵
  PID:6492
- C:\Windows\System\OjQJqUp.exe
  C:\Windows\System\OjQJqUp.exe
  2⤵
  PID:6516
- C:\Windows\System\vWjmcFN.exe
  C:\Windows\System\vWjmcFN.exe
  2⤵
  PID:6564
- C:\Windows\System\AHaAiPF.exe
  C:\Windows\System\AHaAiPF.exe
  2⤵
  PID:6580
- C:\Windows\System\wCkYOxw.exe
  C:\Windows\System\wCkYOxw.exe
  2⤵
  PID:6608
- C:\Windows\System\RyPQvSo.exe
  C:\Windows\System\RyPQvSo.exe
  2⤵
  PID:6636
- C:\Windows\System\LcaCGYc.exe
  C:\Windows\System\LcaCGYc.exe
  2⤵
  PID:6672
- C:\Windows\System\QVfmpyi.exe
  C:\Windows\System\QVfmpyi.exe
  2⤵
  PID:6696
- C:\Windows\System\YxsaMyZ.exe
  C:\Windows\System\YxsaMyZ.exe
  2⤵
  PID:6740
- C:\Windows\System\onfUIWp.exe
  C:\Windows\System\onfUIWp.exe
  2⤵
  PID:6768
- C:\Windows\System\TrYVCVo.exe
  C:\Windows\System\TrYVCVo.exe
  2⤵
  PID:6796
- C:\Windows\System\clmXAAa.exe
  C:\Windows\System\clmXAAa.exe
  2⤵
  PID:6832
- C:\Windows\System\nGzpzCK.exe
  C:\Windows\System\nGzpzCK.exe
  2⤵
  PID:6860
- C:\Windows\System\ESwcbzd.exe
  C:\Windows\System\ESwcbzd.exe
  2⤵
  PID:6876
- C:\Windows\System\AMwjtfZ.exe
  C:\Windows\System\AMwjtfZ.exe
  2⤵
  PID:6900
- C:\Windows\System\wdyzqjD.exe
  C:\Windows\System\wdyzqjD.exe
  2⤵
  PID:6924
- C:\Windows\System\pmgVZRi.exe
  C:\Windows\System\pmgVZRi.exe
  2⤵
  PID:6952
- C:\Windows\System\pDaGAUG.exe
  C:\Windows\System\pDaGAUG.exe
  2⤵
  PID:7000
- C:\Windows\System\iLrZtJD.exe
  C:\Windows\System\iLrZtJD.exe
  2⤵
  PID:7016
- C:\Windows\System\ZlMsbcS.exe
  C:\Windows\System\ZlMsbcS.exe
  2⤵
  PID:7040
- C:\Windows\System\DzeJQPH.exe
  C:\Windows\System\DzeJQPH.exe
  2⤵
  PID:7056
- C:\Windows\System\HqiKnhm.exe
  C:\Windows\System\HqiKnhm.exe
  2⤵
  PID:7084
- C:\Windows\System\FoCitJS.exe
  C:\Windows\System\FoCitJS.exe
  2⤵
  PID:7104
- C:\Windows\System\WxPSouH.exe
  C:\Windows\System\WxPSouH.exe
  2⤵
  PID:7128
- C:\Windows\System\kYlinAa.exe
  C:\Windows\System\kYlinAa.exe
  2⤵
  PID:7152
- C:\Windows\System\WFzWaIe.exe
  C:\Windows\System\WFzWaIe.exe
  2⤵
  PID:5304
- C:\Windows\System\nYdQNOE.exe
  C:\Windows\System\nYdQNOE.exe
  2⤵
  PID:6168
- C:\Windows\System\qvnBAoB.exe
  C:\Windows\System\qvnBAoB.exe
  2⤵
  PID:6248
- C:\Windows\System\GLQFUUY.exe
  C:\Windows\System\GLQFUUY.exe
  2⤵
  PID:6272
- C:\Windows\System\qzHZGor.exe
  C:\Windows\System\qzHZGor.exe
  2⤵
  PID:6240
- C:\Windows\System\zXohGtu.exe
  C:\Windows\System\zXohGtu.exe
  2⤵
  PID:6404
- C:\Windows\System\shtuPuX.exe
  C:\Windows\System\shtuPuX.exe
  2⤵
  PID:6484
- C:\Windows\System\rvZRHpp.exe
  C:\Windows\System\rvZRHpp.exe
  2⤵
  PID:6508
- C:\Windows\System\AthOKGK.exe
  C:\Windows\System\AthOKGK.exe
  2⤵
  PID:6572
- C:\Windows\System\sfJKtUn.exe
  C:\Windows\System\sfJKtUn.exe
  2⤵
  PID:6624
- C:\Windows\System\czyQQhp.exe
  C:\Windows\System\czyQQhp.exe
  2⤵
  PID:6820
- C:\Windows\System\DGcleNS.exe
  C:\Windows\System\DGcleNS.exe
  2⤵
  PID:6868
- C:\Windows\System\IrcpBhj.exe
  C:\Windows\System\IrcpBhj.exe
  2⤵
  PID:6892
- C:\Windows\System\DoAFxXq.exe
  C:\Windows\System\DoAFxXq.exe
  2⤵
  PID:6996
- C:\Windows\System\SJFKfuc.exe
  C:\Windows\System\SJFKfuc.exe
  2⤵
  PID:7080
- C:\Windows\System\lizyfWu.exe
  C:\Windows\System\lizyfWu.exe
  2⤵
  PID:7116
- C:\Windows\System\IQgsgGm.exe
  C:\Windows\System\IQgsgGm.exe
  2⤵
  PID:6192
- C:\Windows\System\oKYzVWy.exe
  C:\Windows\System\oKYzVWy.exe
  2⤵
  PID:6316
- C:\Windows\System\xCMJokV.exe
  C:\Windows\System\xCMJokV.exe
  2⤵
  PID:6212
- C:\Windows\System\jpgumlP.exe
  C:\Windows\System\jpgumlP.exe
  2⤵
  PID:6596
- C:\Windows\System\ohxpghP.exe
  C:\Windows\System\ohxpghP.exe
  2⤵
  PID:6532
- C:\Windows\System\kFEPCVy.exe
  C:\Windows\System\kFEPCVy.exe
  2⤵
  PID:6660
- C:\Windows\System\nDJhmFl.exe
  C:\Windows\System\nDJhmFl.exe
  2⤵
  PID:6916
- C:\Windows\System\wlDdlWQ.exe
  C:\Windows\System\wlDdlWQ.exe
  2⤵
  PID:7076
- C:\Windows\System\WPLcUEM.exe
  C:\Windows\System\WPLcUEM.exe
  2⤵
  PID:5600
- C:\Windows\System\KMSyIQS.exe
  C:\Windows\System\KMSyIQS.exe
  2⤵
  PID:6684
- C:\Windows\System\XwUXhtn.exe
  C:\Windows\System\XwUXhtn.exe
  2⤵
  PID:6920
- C:\Windows\System\MJpScRU.exe
  C:\Windows\System\MJpScRU.exe
  2⤵
  PID:7176
- C:\Windows\System\JYTjXmS.exe
  C:\Windows\System\JYTjXmS.exe
  2⤵
  PID:7204
- C:\Windows\System\pOmnFTb.exe
  C:\Windows\System\pOmnFTb.exe
  2⤵
  PID:7232
- C:\Windows\System\hraatRG.exe
  C:\Windows\System\hraatRG.exe
  2⤵
  PID:7256
- C:\Windows\System\cIpJbJJ.exe
  C:\Windows\System\cIpJbJJ.exe
  2⤵
  PID:7292
- C:\Windows\System\fBsRuvb.exe
  C:\Windows\System\fBsRuvb.exe
  2⤵
  PID:7320
- C:\Windows\System\XpeGyCX.exe
  C:\Windows\System\XpeGyCX.exe
  2⤵
  PID:7344
- C:\Windows\System\vjEDztD.exe
  C:\Windows\System\vjEDztD.exe
  2⤵
  PID:7376
- C:\Windows\System\ffXzWWC.exe
  C:\Windows\System\ffXzWWC.exe
  2⤵
  PID:7400
- C:\Windows\System\rHGyyUb.exe
  C:\Windows\System\rHGyyUb.exe
  2⤵
  PID:7428
- C:\Windows\System\oNbySOf.exe
  C:\Windows\System\oNbySOf.exe
  2⤵
  PID:7448
- C:\Windows\System\zQSYmeT.exe
  C:\Windows\System\zQSYmeT.exe
  2⤵
  PID:7472
- C:\Windows\System\aMCPAVl.exe
  C:\Windows\System\aMCPAVl.exe
  2⤵
  PID:7488
- C:\Windows\System\FIeIpsE.exe
  C:\Windows\System\FIeIpsE.exe
  2⤵
  PID:7516
- C:\Windows\System\zXIdlYS.exe
  C:\Windows\System\zXIdlYS.exe
  2⤵
  PID:7544
- C:\Windows\System\tifHXDZ.exe
  C:\Windows\System\tifHXDZ.exe
  2⤵
  PID:7592
- C:\Windows\System\PLiCnby.exe
  C:\Windows\System\PLiCnby.exe
  2⤵
  PID:7648
- C:\Windows\System\wagYRjK.exe
  C:\Windows\System\wagYRjK.exe
  2⤵
  PID:7668
- C:\Windows\System\GfdeRXB.exe
  C:\Windows\System\GfdeRXB.exe
  2⤵
  PID:7700
- C:\Windows\System\yrBAEmq.exe
  C:\Windows\System\yrBAEmq.exe
  2⤵
  PID:7724
- C:\Windows\System\QWGeBZs.exe
  C:\Windows\System\QWGeBZs.exe
  2⤵
  PID:7744
- C:\Windows\System\iEQVcAn.exe
  C:\Windows\System\iEQVcAn.exe
  2⤵
  PID:7776
- C:\Windows\System\HzgTCQE.exe
  C:\Windows\System\HzgTCQE.exe
  2⤵
  PID:7820
- C:\Windows\System\PyNbDDk.exe
  C:\Windows\System\PyNbDDk.exe
  2⤵
  PID:7840
- C:\Windows\System\CtBNoIQ.exe
  C:\Windows\System\CtBNoIQ.exe
  2⤵
  PID:7864
- C:\Windows\System\GdZrGxl.exe
  C:\Windows\System\GdZrGxl.exe
  2⤵
  PID:7892
- C:\Windows\System\ZAidhjZ.exe
  C:\Windows\System\ZAidhjZ.exe
  2⤵
  PID:7932
- C:\Windows\System\xUNyepk.exe
  C:\Windows\System\xUNyepk.exe
  2⤵
  PID:8156
- C:\Windows\System\idciUiy.exe
  C:\Windows\System\idciUiy.exe
  2⤵
  PID:8172
- C:\Windows\System\IRkleGd.exe
  C:\Windows\System\IRkleGd.exe
  2⤵
  PID:8188
- C:\Windows\System\HOUtBvU.exe
  C:\Windows\System\HOUtBvU.exe
  2⤵
  PID:6236
- C:\Windows\System\sjsPmhN.exe
  C:\Windows\System\sjsPmhN.exe
  2⤵
  PID:7248
- C:\Windows\System\cegBMdq.exe
  C:\Windows\System\cegBMdq.exe
  2⤵
  PID:7340
- C:\Windows\System\MGhzrmf.exe
  C:\Windows\System\MGhzrmf.exe
  2⤵
  PID:7440
- C:\Windows\System\EBGktAK.exe
  C:\Windows\System\EBGktAK.exe
  2⤵
  PID:7512
- C:\Windows\System\sxqvCrP.exe
  C:\Windows\System\sxqvCrP.exe
  2⤵
  PID:7504
- C:\Windows\System\oaYTMie.exe
  C:\Windows\System\oaYTMie.exe
  2⤵
  PID:7588
- C:\Windows\System\iybunnL.exe
  C:\Windows\System\iybunnL.exe
  2⤵
  PID:7660
- C:\Windows\System\cVIfjEX.exe
  C:\Windows\System\cVIfjEX.exe
  2⤵
  PID:7760
- C:\Windows\System\YEytKxv.exe
  C:\Windows\System\YEytKxv.exe
  2⤵
  PID:7796
- C:\Windows\System\IbzwNOC.exe
  C:\Windows\System\IbzwNOC.exe
  2⤵
  PID:7836
- C:\Windows\System\AFypyYs.exe
  C:\Windows\System\AFypyYs.exe
  2⤵
  PID:7876
- C:\Windows\System\kMqIyVQ.exe
  C:\Windows\System\kMqIyVQ.exe
  2⤵
  PID:7960
- C:\Windows\System\IfBmzii.exe
  C:\Windows\System\IfBmzii.exe
  2⤵
  PID:7996
- C:\Windows\System\hUywLPM.exe
  C:\Windows\System\hUywLPM.exe
  2⤵
  PID:8024
- C:\Windows\System\PRhndBX.exe
  C:\Windows\System\PRhndBX.exe
  2⤵
  PID:8048
- C:\Windows\System\BBQKSZq.exe
  C:\Windows\System\BBQKSZq.exe
  2⤵
  PID:8068
- C:\Windows\System\PqHQXWi.exe
  C:\Windows\System\PqHQXWi.exe
  2⤵
  PID:8108
- C:\Windows\System\roIVrxO.exe
  C:\Windows\System\roIVrxO.exe
  2⤵
  PID:8136
- C:\Windows\System\zyrFNyh.exe
  C:\Windows\System\zyrFNyh.exe
  2⤵
  PID:8180
- C:\Windows\System\FKtnMoW.exe
  C:\Windows\System\FKtnMoW.exe
  2⤵
  PID:7336
- C:\Windows\System\QStIPZn.exe
  C:\Windows\System\QStIPZn.exe
  2⤵
  PID:7436
- C:\Windows\System\LXFHqtu.exe
  C:\Windows\System\LXFHqtu.exe
  2⤵
  PID:7568
- C:\Windows\System\LFxRyoJ.exe
  C:\Windows\System\LFxRyoJ.exe
  2⤵
  PID:7816
- C:\Windows\System\YugcCyG.exe
  C:\Windows\System\YugcCyG.exe
  2⤵
  PID:7984
- C:\Windows\System\KFlggPG.exe
  C:\Windows\System\KFlggPG.exe
  2⤵
  PID:8012
- C:\Windows\System\DGCOgqB.exe
  C:\Windows\System\DGCOgqB.exe
  2⤵
  PID:8060
- C:\Windows\System\tFoOrVt.exe
  C:\Windows\System\tFoOrVt.exe
  2⤵
  PID:8132
- C:\Windows\System\HJxZIez.exe
  C:\Windows\System\HJxZIez.exe
  2⤵
  PID:7188
- C:\Windows\System\GTVqVlr.exe
  C:\Windows\System\GTVqVlr.exe
  2⤵
  PID:7508
- C:\Windows\System\tOZoUzb.exe
  C:\Windows\System\tOZoUzb.exe
  2⤵
  PID:7692
- C:\Windows\System\LyPRiiJ.exe
  C:\Windows\System\LyPRiiJ.exe
  2⤵
  PID:8036
- C:\Windows\System\KIQsYFd.exe
  C:\Windows\System\KIQsYFd.exe
  2⤵
  PID:7736
- C:\Windows\System\EiMieXA.exe
  C:\Windows\System\EiMieXA.exe
  2⤵
  PID:8220
- C:\Windows\System\zRMEMGY.exe
  C:\Windows\System\zRMEMGY.exe
  2⤵
  PID:8240
- C:\Windows\System\CPsDgfm.exe
  C:\Windows\System\CPsDgfm.exe
  2⤵
  PID:8272
- C:\Windows\System\YaMHhtu.exe
  C:\Windows\System\YaMHhtu.exe
  2⤵
  PID:8292
- C:\Windows\System\PSbjNem.exe
  C:\Windows\System\PSbjNem.exe
  2⤵
  PID:8320
- C:\Windows\System\OuYMykC.exe
  C:\Windows\System\OuYMykC.exe
  2⤵
  PID:8348
- C:\Windows\System\tysKWzh.exe
  C:\Windows\System\tysKWzh.exe
  2⤵
  PID:8372
- C:\Windows\System\YFkspMu.exe
  C:\Windows\System\YFkspMu.exe
  2⤵
  PID:8404
- C:\Windows\System\QChVBxc.exe
  C:\Windows\System\QChVBxc.exe
  2⤵
  PID:8432
- C:\Windows\System\ubhJcEp.exe
  C:\Windows\System\ubhJcEp.exe
  2⤵
  PID:8484
- C:\Windows\System\IamDJWa.exe
  C:\Windows\System\IamDJWa.exe
  2⤵
  PID:8512
- C:\Windows\System\umWusLO.exe
  C:\Windows\System\umWusLO.exe
  2⤵
  PID:8532
- C:\Windows\System\LHnxOov.exe
  C:\Windows\System\LHnxOov.exe
  2⤵
  PID:8556
- C:\Windows\System\TXpVZGK.exe
  C:\Windows\System\TXpVZGK.exe
  2⤵
  PID:8584
- C:\Windows\System\IGAbJak.exe
  C:\Windows\System\IGAbJak.exe
  2⤵
  PID:8628
- C:\Windows\System\XuzjdLH.exe
  C:\Windows\System\XuzjdLH.exe
  2⤵
  PID:8656
- C:\Windows\System\WNNwMBy.exe
  C:\Windows\System\WNNwMBy.exe
  2⤵
  PID:8684
- C:\Windows\System\FuLQUKg.exe
  C:\Windows\System\FuLQUKg.exe
  2⤵
  PID:8700
- C:\Windows\System\EvtkCdT.exe
  C:\Windows\System\EvtkCdT.exe
  2⤵
  PID:8720
- C:\Windows\System\rbrXFYH.exe
  C:\Windows\System\rbrXFYH.exe
  2⤵
  PID:8748
- C:\Windows\System\dytyhBd.exe
  C:\Windows\System\dytyhBd.exe
  2⤵
  PID:8772
- C:\Windows\System\orkfiFU.exe
  C:\Windows\System\orkfiFU.exe
  2⤵
  PID:8800
- C:\Windows\System\DSdDkPP.exe
  C:\Windows\System\DSdDkPP.exe
  2⤵
  PID:8820
- C:\Windows\System\DSnARbg.exe
  C:\Windows\System\DSnARbg.exe
  2⤵
  PID:8848
- C:\Windows\System\AnzADsf.exe
  C:\Windows\System\AnzADsf.exe
  2⤵
  PID:8876
- C:\Windows\System\qxVxzdy.exe
  C:\Windows\System\qxVxzdy.exe
  2⤵
  PID:8916
- C:\Windows\System\YaJCEEs.exe
  C:\Windows\System\YaJCEEs.exe
  2⤵
  PID:8952
- C:\Windows\System\xYfsxOz.exe
  C:\Windows\System\xYfsxOz.exe
  2⤵
  PID:8968
- C:\Windows\System\WYRxczk.exe
  C:\Windows\System\WYRxczk.exe
  2⤵
  PID:8988
- C:\Windows\System\rULcoSU.exe
  C:\Windows\System\rULcoSU.exe
  2⤵
  PID:9040
- C:\Windows\System\JHtJJrN.exe
  C:\Windows\System\JHtJJrN.exe
  2⤵
  PID:9068
- C:\Windows\System\izbRUWt.exe
  C:\Windows\System\izbRUWt.exe
  2⤵
  PID:9092
- C:\Windows\System\uNwetAu.exe
  C:\Windows\System\uNwetAu.exe
  2⤵
  PID:9124
- C:\Windows\System\lmAdzkX.exe
  C:\Windows\System\lmAdzkX.exe
  2⤵
  PID:9152
- C:\Windows\System\osxjyqD.exe
  C:\Windows\System\osxjyqD.exe
  2⤵
  PID:9184
- C:\Windows\System\qbHzyaf.exe
  C:\Windows\System\qbHzyaf.exe
  2⤵
  PID:9204
- C:\Windows\System\GraLLID.exe
  C:\Windows\System\GraLLID.exe
  2⤵
  PID:7956
- C:\Windows\System\oYjmZaE.exe
  C:\Windows\System\oYjmZaE.exe
  2⤵
  PID:8248
- C:\Windows\System\kXnYOAK.exe
  C:\Windows\System\kXnYOAK.exe
  2⤵
  PID:8268
- C:\Windows\System\lYxgUOW.exe
  C:\Windows\System\lYxgUOW.exe
  2⤵
  PID:8316
- C:\Windows\System\bOMWVtO.exe
  C:\Windows\System\bOMWVtO.exe
  2⤵
  PID:8424
- C:\Windows\System\rjYOsUp.exe
  C:\Windows\System\rjYOsUp.exe
  2⤵
  PID:8504
- C:\Windows\System\aeTDsRt.exe
  C:\Windows\System\aeTDsRt.exe
  2⤵
  PID:8552
- C:\Windows\System\bldcqrQ.exe
  C:\Windows\System\bldcqrQ.exe
  2⤵
  PID:8668
- C:\Windows\System\ufDAuiQ.exe
  C:\Windows\System\ufDAuiQ.exe
  2⤵
  PID:8716
- C:\Windows\System\CyzFkLg.exe
  C:\Windows\System\CyzFkLg.exe
  2⤵
  PID:4580
- C:\Windows\System\YcEhdia.exe
  C:\Windows\System\YcEhdia.exe
  2⤵
  PID:8756
- C:\Windows\System\gmMuZmM.exe
  C:\Windows\System\gmMuZmM.exe
  2⤵
  PID:8844
- C:\Windows\System\tZQZKQZ.exe
  C:\Windows\System\tZQZKQZ.exe
  2⤵
  PID:8896
- C:\Windows\System\tMdAuSd.exe
  C:\Windows\System\tMdAuSd.exe
  2⤵
  PID:8964
- C:\Windows\System\LabsfMy.exe
  C:\Windows\System\LabsfMy.exe
  2⤵
  PID:9064
- C:\Windows\System\moVukAs.exe
  C:\Windows\System\moVukAs.exe
  2⤵
  PID:9140
- C:\Windows\System\ccwBKpq.exe
  C:\Windows\System\ccwBKpq.exe
  2⤵
  PID:8204
- C:\Windows\System\kovhVvn.exe
  C:\Windows\System\kovhVvn.exe
  2⤵
  PID:8236
- C:\Windows\System\urCsJZF.exe
  C:\Windows\System\urCsJZF.exe
  2⤵
  PID:8336
- C:\Windows\System\wvJRidu.exe
  C:\Windows\System\wvJRidu.exe
  2⤵
  PID:8480
- C:\Windows\System\PsdfULz.exe
  C:\Windows\System\PsdfULz.exe
  2⤵
  PID:8612
- C:\Windows\System\TmwZlAW.exe
  C:\Windows\System\TmwZlAW.exe
  2⤵
  PID:8692
- C:\Windows\System\FzwDYKG.exe
  C:\Windows\System\FzwDYKG.exe
  2⤵
  PID:8908
- C:\Windows\System\sZnBjqG.exe
  C:\Windows\System\sZnBjqG.exe
  2⤵
  PID:9060
- C:\Windows\System\BsWnmVN.exe
  C:\Windows\System\BsWnmVN.exe
  2⤵
  PID:9196
- C:\Windows\System\IIqUwqH.exe
  C:\Windows\System\IIqUwqH.exe
  2⤵
  PID:8456
- C:\Windows\System\ACWItyN.exe
  C:\Windows\System\ACWItyN.exe
  2⤵
  PID:8696
- C:\Windows\System\CygxGuP.exe
  C:\Windows\System\CygxGuP.exe
  2⤵
  PID:8304
- C:\Windows\System\LMEPnPC.exe
  C:\Windows\System\LMEPnPC.exe
  2⤵
  PID:8476
- C:\Windows\System\KitVebj.exe
  C:\Windows\System\KitVebj.exe
  2⤵
  PID:9228
- C:\Windows\System\fQfjsge.exe
  C:\Windows\System\fQfjsge.exe
  2⤵
  PID:9268
- C:\Windows\System\xiqRWKm.exe
  C:\Windows\System\xiqRWKm.exe
  2⤵
  PID:9284
- C:\Windows\System\xrmTznK.exe
  C:\Windows\System\xrmTznK.exe
  2⤵
  PID:9320
- C:\Windows\System\iEnbdZc.exe
  C:\Windows\System\iEnbdZc.exe
  2⤵
  PID:9356
- C:\Windows\System\gjvYbCp.exe
  C:\Windows\System\gjvYbCp.exe
  2⤵
  PID:9392
- C:\Windows\System\avDdPOY.exe
  C:\Windows\System\avDdPOY.exe
  2⤵
  PID:9420
- C:\Windows\System\TahdpUu.exe
  C:\Windows\System\TahdpUu.exe
  2⤵
  PID:9448
- C:\Windows\System\VlkvoOT.exe
  C:\Windows\System\VlkvoOT.exe
  2⤵
  PID:9476
- C:\Windows\System\sEYnTJV.exe
  C:\Windows\System\sEYnTJV.exe
  2⤵
  PID:9504
- C:\Windows\System\DLsbTyi.exe
  C:\Windows\System\DLsbTyi.exe
  2⤵
  PID:9520
- C:\Windows\System\GYCFsSr.exe
  C:\Windows\System\GYCFsSr.exe
  2⤵
  PID:9548
- C:\Windows\System\HTYQWiR.exe
  C:\Windows\System\HTYQWiR.exe
  2⤵
  PID:9588
- C:\Windows\System\kUxAtCu.exe
  C:\Windows\System\kUxAtCu.exe
  2⤵
  PID:9608
- C:\Windows\System\gQYzUGX.exe
  C:\Windows\System\gQYzUGX.exe
  2⤵
  PID:9632
- C:\Windows\System\JoaNRkF.exe
  C:\Windows\System\JoaNRkF.exe
  2⤵
  PID:9672
- C:\Windows\System\xTxluNi.exe
  C:\Windows\System\xTxluNi.exe
  2⤵
  PID:9700
- C:\Windows\System\wzRquPM.exe
  C:\Windows\System\wzRquPM.exe
  2⤵
  PID:9720
- C:\Windows\System\rHZAxHQ.exe
  C:\Windows\System\rHZAxHQ.exe
  2⤵
  PID:9744
- C:\Windows\System\ZMiaNBg.exe
  C:\Windows\System\ZMiaNBg.exe
  2⤵
  PID:9764
- C:\Windows\System\CBSOMLa.exe
  C:\Windows\System\CBSOMLa.exe
  2⤵
  PID:9800
- C:\Windows\System\fIyKZhw.exe
  C:\Windows\System\fIyKZhw.exe
  2⤵
  PID:9836
- C:\Windows\System\AymceXb.exe
  C:\Windows\System\AymceXb.exe
  2⤵
  PID:9856
- C:\Windows\System\zxNCPrT.exe
  C:\Windows\System\zxNCPrT.exe
  2⤵
  PID:9884
- C:\Windows\System\mMvzJbH.exe
  C:\Windows\System\mMvzJbH.exe
  2⤵
  PID:9912
- C:\Windows\System\jFFwdju.exe
  C:\Windows\System\jFFwdju.exe
  2⤵
  PID:9952
- C:\Windows\System\UkgMWGD.exe
  C:\Windows\System\UkgMWGD.exe
  2⤵
  PID:9980
- C:\Windows\System\UjgXpFI.exe
  C:\Windows\System\UjgXpFI.exe
  2⤵
  PID:9996
- C:\Windows\System\JEeHtsT.exe
  C:\Windows\System\JEeHtsT.exe
  2⤵
  PID:10024
- C:\Windows\System\gYuusmP.exe
  C:\Windows\System\gYuusmP.exe
  2⤵
  PID:10064
- C:\Windows\System\USbTJyV.exe
  C:\Windows\System\USbTJyV.exe
  2⤵
  PID:10084
- C:\Windows\System\vjMXVpB.exe
  C:\Windows\System\vjMXVpB.exe
  2⤵
  PID:10100
- C:\Windows\System\aRajQCA.exe
  C:\Windows\System\aRajQCA.exe
  2⤵
  PID:10128
- C:\Windows\System\WYzOrjf.exe
  C:\Windows\System\WYzOrjf.exe
  2⤵
  PID:10152
- C:\Windows\System\PVqnzpC.exe
  C:\Windows\System\PVqnzpC.exe
  2⤵
  PID:10176
- C:\Windows\System\VPPDvtC.exe
  C:\Windows\System\VPPDvtC.exe
  2⤵
  PID:10204
- C:\Windows\System\VGlOvED.exe
  C:\Windows\System\VGlOvED.exe
  2⤵
  PID:10232
- C:\Windows\System\JsiCdXr.exe
  C:\Windows\System\JsiCdXr.exe
  2⤵
  PID:8208
- C:\Windows\System\jFHVztk.exe
  C:\Windows\System\jFHVztk.exe
  2⤵
  PID:9296
- C:\Windows\System\SbjJEnU.exe
  C:\Windows\System\SbjJEnU.exe
  2⤵
  PID:9352
- C:\Windows\System\ToWkJzz.exe
  C:\Windows\System\ToWkJzz.exe
  2⤵
  PID:9404
- C:\Windows\System\eFBhCVu.exe
  C:\Windows\System\eFBhCVu.exe
  2⤵
  PID:9440
- C:\Windows\System\RWfybXp.exe
  C:\Windows\System\RWfybXp.exe
  2⤵
  PID:9500
- C:\Windows\System\IZHyHGq.exe
  C:\Windows\System\IZHyHGq.exe
  2⤵
  PID:9580
- C:\Windows\System\RrkSWel.exe
  C:\Windows\System\RrkSWel.exe
  2⤵
  PID:9628
- C:\Windows\System\cUnQBhT.exe
  C:\Windows\System\cUnQBhT.exe
  2⤵
  PID:9692
- C:\Windows\System\rEBQDHG.exe
  C:\Windows\System\rEBQDHG.exe
  2⤵
  PID:9740
- C:\Windows\System\OlBzmpJ.exe
  C:\Windows\System\OlBzmpJ.exe
  2⤵
  PID:9872
- C:\Windows\System\OucOYex.exe
  C:\Windows\System\OucOYex.exe
  2⤵
  PID:9976
- C:\Windows\System\UxpecaX.exe
  C:\Windows\System\UxpecaX.exe
  2⤵
  PID:10052
- C:\Windows\System\NFtSIPH.exe
  C:\Windows\System\NFtSIPH.exe
  2⤵
  PID:10072
- C:\Windows\System\UtYyPFl.exe
  C:\Windows\System\UtYyPFl.exe
  2⤵
  PID:10144
- C:\Windows\System\XdgoZvO.exe
  C:\Windows\System\XdgoZvO.exe
  2⤵
  PID:10220
- C:\Windows\System\itykocH.exe
  C:\Windows\System\itykocH.exe
  2⤵
  PID:9220
- C:\Windows\System\mnDBtgR.exe
  C:\Windows\System\mnDBtgR.exe
  2⤵
  PID:9308
- C:\Windows\System\mMRoRxb.exe
  C:\Windows\System\mMRoRxb.exe
  2⤵
  PID:9512
- C:\Windows\System\HHtLslD.exe
  C:\Windows\System\HHtLslD.exe
  2⤵
  PID:9868
- C:\Windows\System\LIdCEyC.exe
  C:\Windows\System\LIdCEyC.exe
  2⤵
  PID:10008
- C:\Windows\System\gVoOuXT.exe
  C:\Windows\System\gVoOuXT.exe
  2⤵
  PID:10136
- C:\Windows\System\FAdyqOD.exe
  C:\Windows\System\FAdyqOD.exe
  2⤵
  PID:9260
- C:\Windows\System\WZauZfZ.exe
  C:\Windows\System\WZauZfZ.exe
  2⤵
  PID:9600
- C:\Windows\System\TGdvVwx.exe
  C:\Windows\System\TGdvVwx.exe
  2⤵
  PID:9948
- C:\Windows\System\UOJGDIZ.exe
  C:\Windows\System\UOJGDIZ.exe
  2⤵
  PID:9316
- C:\Windows\System\FXQMZil.exe
  C:\Windows\System\FXQMZil.exe
  2⤵
  PID:9828
- C:\Windows\System\yOgdLvK.exe
  C:\Windows\System\yOgdLvK.exe
  2⤵
  PID:10260
- C:\Windows\System\JbwefhS.exe
  C:\Windows\System\JbwefhS.exe
  2⤵
  PID:10296
- C:\Windows\System\xqkHUAH.exe
  C:\Windows\System\xqkHUAH.exe
  2⤵
  PID:10340
- C:\Windows\System\wLueEsN.exe
  C:\Windows\System\wLueEsN.exe
  2⤵
  PID:10368
- C:\Windows\System\hnRDVUY.exe
  C:\Windows\System\hnRDVUY.exe
  2⤵
  PID:10396
- C:\Windows\System\HIrjUuy.exe
  C:\Windows\System\HIrjUuy.exe
  2⤵
  PID:10416
- C:\Windows\System\xvwtPZG.exe
  C:\Windows\System\xvwtPZG.exe
  2⤵
  PID:10440
- C:\Windows\System\MRNWsFa.exe
  C:\Windows\System\MRNWsFa.exe
  2⤵
  PID:10468
- C:\Windows\System\NCFgnBF.exe
  C:\Windows\System\NCFgnBF.exe
  2⤵
  PID:10488
- C:\Windows\System\aYriYLr.exe
  C:\Windows\System\aYriYLr.exe
  2⤵
  PID:10512
- C:\Windows\System\nUeVXvg.exe
  C:\Windows\System\nUeVXvg.exe
  2⤵
  PID:10544
- C:\Windows\System\zXysZhv.exe
  C:\Windows\System\zXysZhv.exe
  2⤵
  PID:10572
- C:\Windows\System\iKXLEXZ.exe
  C:\Windows\System\iKXLEXZ.exe
  2⤵
  PID:10588
- C:\Windows\System\YieqhIF.exe
  C:\Windows\System\YieqhIF.exe
  2⤵
  PID:10636
- C:\Windows\System\NbXgGuT.exe
  C:\Windows\System\NbXgGuT.exe
  2⤵
  PID:10676
- C:\Windows\System\vPCUISm.exe
  C:\Windows\System\vPCUISm.exe
  2⤵
  PID:10704
- C:\Windows\System\taZJcTH.exe
  C:\Windows\System\taZJcTH.exe
  2⤵
  PID:10720
- C:\Windows\System\tBKPodt.exe
  C:\Windows\System\tBKPodt.exe
  2⤵
  PID:10736
- C:\Windows\System\FHPvCYO.exe
  C:\Windows\System\FHPvCYO.exe
  2⤵
  PID:10768
- C:\Windows\System\dERukpe.exe
  C:\Windows\System\dERukpe.exe
  2⤵
  PID:10792
- C:\Windows\System\jynqioC.exe
  C:\Windows\System\jynqioC.exe
  2⤵
  PID:10820
- C:\Windows\System\dzKCmhj.exe
  C:\Windows\System\dzKCmhj.exe
  2⤵
  PID:10872
- C:\Windows\System\FVMXqCi.exe
  C:\Windows\System\FVMXqCi.exe
  2⤵
  PID:10892
- C:\Windows\System\aaDxgRi.exe
  C:\Windows\System\aaDxgRi.exe
  2⤵
  PID:10920
- C:\Windows\System\DpGBiwT.exe
  C:\Windows\System\DpGBiwT.exe
  2⤵
  PID:10940
- C:\Windows\System\THoVQdx.exe
  C:\Windows\System\THoVQdx.exe
  2⤵
  PID:10956
- C:\Windows\System\ZNJZwVR.exe
  C:\Windows\System\ZNJZwVR.exe
  2⤵
  PID:10988
- C:\Windows\System\OUzIMfT.exe
  C:\Windows\System\OUzIMfT.exe
  2⤵
  PID:11016
- C:\Windows\System\SgYvWNs.exe
  C:\Windows\System\SgYvWNs.exe
  2⤵
  PID:11056
- C:\Windows\System\yGDAEPb.exe
  C:\Windows\System\yGDAEPb.exe
  2⤵
  PID:11076
- C:\Windows\System\EHhliBZ.exe
  C:\Windows\System\EHhliBZ.exe
  2⤵
  PID:11100
- C:\Windows\System\WmsZRhd.exe
  C:\Windows\System\WmsZRhd.exe
  2⤵
  PID:11124
- C:\Windows\System\BaJFFld.exe
  C:\Windows\System\BaJFFld.exe
  2⤵
  PID:11204
- C:\Windows\System\MSqNnwr.exe
  C:\Windows\System\MSqNnwr.exe
  2⤵
  PID:11220
- C:\Windows\System\mLSYhPW.exe
  C:\Windows\System\mLSYhPW.exe
  2⤵
  PID:11236
- C:\Windows\System\IyjiKei.exe
  C:\Windows\System\IyjiKei.exe
  2⤵
  PID:11260
- C:\Windows\System\ednftMA.exe
  C:\Windows\System\ednftMA.exe
  2⤵
  PID:10248
- C:\Windows\System\NFpqtVh.exe
  C:\Windows\System\NFpqtVh.exe
  2⤵
  PID:10328
- C:\Windows\System\yUjRUny.exe
  C:\Windows\System\yUjRUny.exe
  2⤵
  PID:10392
- C:\Windows\System\nZoYZLG.exe
  C:\Windows\System\nZoYZLG.exe
  2⤵
  PID:10452
- C:\Windows\System\DDGcaZw.exe
  C:\Windows\System\DDGcaZw.exe
  2⤵
  PID:10556
- C:\Windows\System\SZxGBWm.exe
  C:\Windows\System\SZxGBWm.exe
  2⤵
  PID:10608
- C:\Windows\System\iDAYZmk.exe
  C:\Windows\System\iDAYZmk.exe
  2⤵
  PID:10648
- C:\Windows\System\PCwbrWv.exe
  C:\Windows\System\PCwbrWv.exe
  2⤵
  PID:10688
- C:\Windows\System\bVZIULN.exe
  C:\Windows\System\bVZIULN.exe
  2⤵
  PID:10732
- C:\Windows\System\TAadaLR.exe
  C:\Windows\System\TAadaLR.exe
  2⤵
  PID:10908
- C:\Windows\System\ilBeshU.exe
  C:\Windows\System\ilBeshU.exe
  2⤵
  PID:10852
- C:\Windows\System\BshnyQq.exe
  C:\Windows\System\BshnyQq.exe
  2⤵
  PID:10936
- C:\Windows\System\JLNIhDT.exe
  C:\Windows\System\JLNIhDT.exe
  2⤵
  PID:11004
- C:\Windows\System\NWprHMH.exe
  C:\Windows\System\NWprHMH.exe
  2⤵
  PID:11092
- C:\Windows\System\bIoMtDk.exe
  C:\Windows\System\bIoMtDk.exe
  2⤵
  PID:11108
- C:\Windows\System\AsOpoFH.exe
  C:\Windows\System\AsOpoFH.exe
  2⤵
  PID:11200
- C:\Windows\System\pLFEiMi.exe
  C:\Windows\System\pLFEiMi.exe
  2⤵
  PID:10012
- C:\Windows\System\ikmJgdH.exe
  C:\Windows\System\ikmJgdH.exe
  2⤵
  PID:10292
- C:\Windows\System\YZQHuoY.exe
  C:\Windows\System\YZQHuoY.exe
  2⤵
  PID:10476
- C:\Windows\System\nzMKuGg.exe
  C:\Windows\System\nzMKuGg.exe
  2⤵
  PID:10616
- C:\Windows\System\lHTAyDg.exe
  C:\Windows\System\lHTAyDg.exe
  2⤵
  PID:10664
- C:\Windows\System\VGJRyzS.exe
  C:\Windows\System\VGJRyzS.exe
  2⤵
  PID:10880
- C:\Windows\System\CuoLKDt.exe
  C:\Windows\System\CuoLKDt.exe
  2⤵
  PID:10912
- C:\Windows\System\KaCJteE.exe
  C:\Windows\System\KaCJteE.exe
  2⤵
  PID:10288
- C:\Windows\System\XHjVmaF.exe
  C:\Windows\System\XHjVmaF.exe
  2⤵
  PID:10360
- C:\Windows\System\wisoFgg.exe
  C:\Windows\System\wisoFgg.exe
  2⤵
  PID:11228
- C:\Windows\System\pRPlGFz.exe
  C:\Windows\System\pRPlGFz.exe
  2⤵
  PID:11288
- C:\Windows\System\uRrrImK.exe
  C:\Windows\System\uRrrImK.exe
  2⤵
  PID:11332
- C:\Windows\System\OoUUuwl.exe
  C:\Windows\System\OoUUuwl.exe
  2⤵
  PID:11360
- C:\Windows\System\TJynguR.exe
  C:\Windows\System\TJynguR.exe
  2⤵
  PID:11388
- C:\Windows\System\TWtLaBC.exe
  C:\Windows\System\TWtLaBC.exe
  2⤵
  PID:11416
- C:\Windows\System\cgABsNU.exe
  C:\Windows\System\cgABsNU.exe
  2⤵
  PID:11432
- C:\Windows\System\vJHlKdS.exe
  C:\Windows\System\vJHlKdS.exe
  2⤵
  PID:11468
- C:\Windows\System\oVVfWsN.exe
  C:\Windows\System\oVVfWsN.exe
  2⤵
  PID:11488
- C:\Windows\System\odvdOTA.exe
  C:\Windows\System\odvdOTA.exe
  2⤵
  PID:11516
- C:\Windows\System\JxMAtso.exe
  C:\Windows\System\JxMAtso.exe
  2⤵
  PID:11536
- C:\Windows\System\xsHEJky.exe
  C:\Windows\System\xsHEJky.exe
  2⤵
  PID:11584
- C:\Windows\System\sirMjyl.exe
  C:\Windows\System\sirMjyl.exe
  2⤵
  PID:11608
- C:\Windows\System\NqrkHPY.exe
  C:\Windows\System\NqrkHPY.exe
  2⤵
  PID:11640
- C:\Windows\System\YRAOczm.exe
  C:\Windows\System\YRAOczm.exe
  2⤵
  PID:11668
- C:\Windows\System\LyZQLLs.exe
  C:\Windows\System\LyZQLLs.exe
  2⤵
  PID:11696
- C:\Windows\System\mUOVzRO.exe
  C:\Windows\System\mUOVzRO.exe
  2⤵
  PID:11712
- C:\Windows\System\zpjfqFS.exe
  C:\Windows\System\zpjfqFS.exe
  2⤵
  PID:11728
- C:\Windows\System\nbmwmSZ.exe
  C:\Windows\System\nbmwmSZ.exe
  2⤵
  PID:11752
- C:\Windows\System\Okjwwij.exe
  C:\Windows\System\Okjwwij.exe
  2⤵
  PID:11776
- C:\Windows\System\vlcwVPB.exe
  C:\Windows\System\vlcwVPB.exe
  2⤵
  PID:11804
- C:\Windows\System\SbsTjnB.exe
  C:\Windows\System\SbsTjnB.exe
  2⤵
  PID:11832
- C:\Windows\System\GeataSw.exe
  C:\Windows\System\GeataSw.exe
  2⤵
  PID:11864
- C:\Windows\System\eQUbdnn.exe
  C:\Windows\System\eQUbdnn.exe
  2⤵
  PID:11892
- C:\Windows\System\NRVkBTn.exe
  C:\Windows\System\NRVkBTn.exe
  2⤵
  PID:11912
- C:\Windows\System\kmvRReh.exe
  C:\Windows\System\kmvRReh.exe
  2⤵
  PID:11952
- C:\Windows\System\PAZVewa.exe
  C:\Windows\System\PAZVewa.exe
  2⤵
  PID:11980
- C:\Windows\System\YLDpxqc.exe
  C:\Windows\System\YLDpxqc.exe
  2⤵
  PID:12012
- C:\Windows\System\fOYKmsP.exe
  C:\Windows\System\fOYKmsP.exe
  2⤵
  PID:12048
- C:\Windows\System\JlJIiWQ.exe
  C:\Windows\System\JlJIiWQ.exe
  2⤵
  PID:12072
- C:\Windows\System\lXhYeCS.exe
  C:\Windows\System\lXhYeCS.exe
  2⤵
  PID:12092
- C:\Windows\System\qXiMbvb.exe
  C:\Windows\System\qXiMbvb.exe
  2⤵
  PID:12144
- C:\Windows\System\bcvjYac.exe
  C:\Windows\System\bcvjYac.exe
  2⤵
  PID:12160
- C:\Windows\System\sLomgcg.exe
  C:\Windows\System\sLomgcg.exe
  2⤵
  PID:12176
- C:\Windows\System\kQzNuav.exe
  C:\Windows\System\kQzNuav.exe
  2⤵
  PID:12204
- C:\Windows\System\rAaagYe.exe
  C:\Windows\System\rAaagYe.exe
  2⤵
  PID:12232
- C:\Windows\System\zfjiWVu.exe
  C:\Windows\System\zfjiWVu.exe
  2⤵
  PID:12276
- C:\Windows\System\EhpvTrA.exe
  C:\Windows\System\EhpvTrA.exe
  2⤵
  PID:11152
- C:\Windows\System\QKInnrw.exe
  C:\Windows\System\QKInnrw.exe
  2⤵
  PID:11308
- C:\Windows\System\lfRRoOr.exe
  C:\Windows\System\lfRRoOr.exe
  2⤵
  PID:11372
- C:\Windows\System\UfAOFYx.exe
  C:\Windows\System\UfAOFYx.exe
  2⤵
  PID:11408
- C:\Windows\System\dCdwJqA.exe
  C:\Windows\System\dCdwJqA.exe
  2⤵
  PID:11504
- C:\Windows\System\iuepFJT.exe
  C:\Windows\System\iuepFJT.exe
  2⤵
  PID:11528
- C:\Windows\System\rgDApEa.exe
  C:\Windows\System\rgDApEa.exe
  2⤵
  PID:11616
- C:\Windows\System\uMaeEDG.exe
  C:\Windows\System\uMaeEDG.exe
  2⤵
  PID:11664
- C:\Windows\System\WRKgzqU.exe
  C:\Windows\System\WRKgzqU.exe
  2⤵
  PID:11720
- C:\Windows\System\KwTvuTg.exe
  C:\Windows\System\KwTvuTg.exe
  2⤵
  PID:11764
- C:\Windows\System\gHtkXdq.exe
  C:\Windows\System\gHtkXdq.exe
  2⤵
  PID:11784
- C:\Windows\System\FkwbcuN.exe
  C:\Windows\System\FkwbcuN.exe
  2⤵
  PID:11848
- C:\Windows\System\GQumbaB.exe
  C:\Windows\System\GQumbaB.exe
  2⤵
  PID:11932
- C:\Windows\System\CIZXjlq.exe
  C:\Windows\System\CIZXjlq.exe
  2⤵
  PID:12000
- C:\Windows\System\sBzBFcW.exe
  C:\Windows\System\sBzBFcW.exe
  2⤵
  PID:12084
- C:\Windows\System\bBbXdGr.exe
  C:\Windows\System\bBbXdGr.exe
  2⤵
  PID:12156
- C:\Windows\System\nafKXRS.exe
  C:\Windows\System\nafKXRS.exe
  2⤵
  PID:12252
- C:\Windows\System\tFRUCyB.exe
  C:\Windows\System\tFRUCyB.exe
  2⤵
  PID:10764
- C:\Windows\System\uNWpjEU.exe
  C:\Windows\System\uNWpjEU.exe
  2⤵
  PID:11356
- C:\Windows\System\MOFjUEU.exe
  C:\Windows\System\MOFjUEU.exe
  2⤵
  PID:11660
- C:\Windows\System\OdWFOjG.exe
  C:\Windows\System\OdWFOjG.exe
  2⤵
  PID:11688
- C:\Windows\System\cvgkwsT.exe
  C:\Windows\System\cvgkwsT.exe
  2⤵
  PID:11884
- C:\Windows\System\OJrBfNo.exe
  C:\Windows\System\OJrBfNo.exe
  2⤵
  PID:12064
- C:\Windows\System\LLenwQu.exe
  C:\Windows\System\LLenwQu.exe
  2⤵
  PID:12192
- C:\Windows\System\bykyjlx.exe
  C:\Windows\System\bykyjlx.exe
  2⤵
  PID:11564
- C:\Windows\System\AawunrB.exe
  C:\Windows\System\AawunrB.exe
  2⤵
  PID:11740
- C:\Windows\System\SBfRdXO.exe
  C:\Windows\System\SBfRdXO.exe
  2⤵
  PID:12008
- C:\Windows\System\AmCGauY.exe
  C:\Windows\System\AmCGauY.exe
  2⤵
  PID:11928
- C:\Windows\System\kNUQIuY.exe
  C:\Windows\System\kNUQIuY.exe
  2⤵
  PID:11464
- C:\Windows\System\VbaPzhN.exe
  C:\Windows\System\VbaPzhN.exe
  2⤵
  PID:12312
- C:\Windows\System\Ykpnotn.exe
  C:\Windows\System\Ykpnotn.exe
  2⤵
  PID:12352
- C:\Windows\System\KseEozk.exe
  C:\Windows\System\KseEozk.exe
  2⤵
  PID:12376
- C:\Windows\System\sWSwJgz.exe
  C:\Windows\System\sWSwJgz.exe
  2⤵
  PID:12400
- C:\Windows\System\QAYiuzP.exe
  C:\Windows\System\QAYiuzP.exe
  2⤵
  PID:12424
- C:\Windows\System\LYlErQp.exe
  C:\Windows\System\LYlErQp.exe
  2⤵
  PID:12464
- C:\Windows\System\guAklBC.exe
  C:\Windows\System\guAklBC.exe
  2⤵
  PID:12480
- C:\Windows\System\HObvcqR.exe
  C:\Windows\System\HObvcqR.exe
  2⤵
  PID:12508
- C:\Windows\System\DBcvSdL.exe
  C:\Windows\System\DBcvSdL.exe
  2⤵
  PID:12532
- C:\Windows\System\igYTZvH.exe
  C:\Windows\System\igYTZvH.exe
  2⤵
  PID:12564
- C:\Windows\System\XSmKJxj.exe
  C:\Windows\System\XSmKJxj.exe
  2⤵
  PID:12592
- C:\Windows\System\xzAgXQp.exe
  C:\Windows\System\xzAgXQp.exe
  2⤵
  PID:12624
- C:\Windows\System\NEsQOOJ.exe
  C:\Windows\System\NEsQOOJ.exe
  2⤵
  PID:12644
- C:\Windows\System\jqrXWRP.exe
  C:\Windows\System\jqrXWRP.exe
  2⤵
  PID:12668
- C:\Windows\System\DCLZRHN.exe
  C:\Windows\System\DCLZRHN.exe
  2⤵
  PID:12692
- C:\Windows\System\hxhlAAx.exe
  C:\Windows\System\hxhlAAx.exe
  2⤵
  PID:12732
- C:\Windows\System\OaepOgp.exe
  C:\Windows\System\OaepOgp.exe
  2⤵
  PID:12752
- C:\Windows\System\XTyardv.exe
  C:\Windows\System\XTyardv.exe
  2⤵
  PID:12792
- C:\Windows\System\NHRwEFh.exe
  C:\Windows\System\NHRwEFh.exe
  2⤵
  PID:12820
- C:\Windows\System\SjdlFBf.exe
  C:\Windows\System\SjdlFBf.exe
  2⤵
  PID:12840
- C:\Windows\System\vCkMKOB.exe
  C:\Windows\System\vCkMKOB.exe
  2⤵
  PID:12864
- C:\Windows\System\AxgFcAa.exe
  C:\Windows\System\AxgFcAa.exe
  2⤵
  PID:12884
- C:\Windows\System\tfBGrLt.exe
  C:\Windows\System\tfBGrLt.exe
  2⤵
  PID:12932
- C:\Windows\System\bZAbmdD.exe
  C:\Windows\System\bZAbmdD.exe
  2⤵
  PID:12952
- C:\Windows\System\SGeDQiX.exe
  C:\Windows\System\SGeDQiX.exe
  2⤵
  PID:12972
- C:\Windows\System\nUSlDsk.exe
  C:\Windows\System\nUSlDsk.exe
  2⤵
  PID:13000
- C:\Windows\System\sECFfzs.exe
  C:\Windows\System\sECFfzs.exe
  2⤵
  PID:13040
- C:\Windows\System\vRdrNJc.exe
  C:\Windows\System\vRdrNJc.exe
  2⤵
  PID:13084
- C:\Windows\System\pgEDjcB.exe
  C:\Windows\System\pgEDjcB.exe
  2⤵
  PID:13100
- C:\Windows\System\BTAayTP.exe
  C:\Windows\System\BTAayTP.exe
  2⤵
  PID:13120
- C:\Windows\System\nPfsRPT.exe
  C:\Windows\System\nPfsRPT.exe
  2⤵
  PID:13168
- C:\Windows\System\BIOiGML.exe
  C:\Windows\System\BIOiGML.exe
  2⤵
  PID:13188
- C:\Windows\System\BLyRkeD.exe
  C:\Windows\System\BLyRkeD.exe
  2⤵
  PID:13212
- C:\Windows\System\vZNKVjq.exe
  C:\Windows\System\vZNKVjq.exe
  2⤵
  PID:13252
- C:\Windows\System\mZSmzjF.exe
  C:\Windows\System\mZSmzjF.exe
  2⤵
  PID:13268
- C:\Windows\System\YccKbhQ.exe
  C:\Windows\System\YccKbhQ.exe
  2⤵
  PID:13308
- C:\Windows\System\FRqAHUb.exe
  C:\Windows\System\FRqAHUb.exe
  2⤵
  PID:12300
- C:\Windows\System\iGXtkrb.exe
  C:\Windows\System\iGXtkrb.exe
  2⤵
  PID:12384
- C:\Windows\System\dAacimq.exe
  C:\Windows\System\dAacimq.exe
  2⤵
  PID:12408
- C:\Windows\System\FFguzZp.exe
  C:\Windows\System\FFguzZp.exe
  2⤵
  PID:12528
- C:\Windows\System\kUKCHVx.exe
  C:\Windows\System\kUKCHVx.exe
  2⤵
  PID:12560
- C:\Windows\System\toSSGHq.exe
  C:\Windows\System\toSSGHq.exe
  2⤵
  PID:12612
- C:\Windows\System\LiVdlEd.exe
  C:\Windows\System\LiVdlEd.exe
  2⤵
  PID:12656
- C:\Windows\System\gWrRSkm.exe
  C:\Windows\System\gWrRSkm.exe
  2⤵
  PID:12744
- C:\Windows\System\qpvmrXh.exe
  C:\Windows\System\qpvmrXh.exe
  2⤵
  PID:12784
- C:\Windows\System\nBEZXmw.exe
  C:\Windows\System\nBEZXmw.exe
  2⤵
  PID:12836
- C:\Windows\System\FUetScW.exe
  C:\Windows\System\FUetScW.exe
  2⤵
  PID:12940
- C:\Windows\System\ztcOZUm.exe
  C:\Windows\System\ztcOZUm.exe
  2⤵
  PID:12980
- C:\Windows\System\jrBttQX.exe
  C:\Windows\System\jrBttQX.exe
  2⤵
  PID:13032
- C:\Windows\System\vmfkXKg.exe
  C:\Windows\System\vmfkXKg.exe
  2⤵
  PID:13132
- C:\Windows\System\haqumEH.exe
  C:\Windows\System\haqumEH.exe
  2⤵
  PID:13180
- C:\Windows\System\GgauBqe.exe
  C:\Windows\System\GgauBqe.exe
  2⤵
  PID:13248
- C:\Windows\System\vYCVMKa.exe
  C:\Windows\System\vYCVMKa.exe
  2⤵
  PID:12140
- C:\Windows\System\lqeUBOk.exe
  C:\Windows\System\lqeUBOk.exe
  2⤵
  PID:12372
- C:\Windows\System\YUoGiRX.exe
  C:\Windows\System\YUoGiRX.exe
  2⤵
  PID:12556
- C:\Windows\System\dnRWtTU.exe
  C:\Windows\System\dnRWtTU.exe
  2⤵
  PID:12772
- C:\Windows\System\CXncrRX.exe
  C:\Windows\System\CXncrRX.exe
  2⤵
  PID:12968
- C:\Windows\System\JhIcazo.exe
  C:\Windows\System\JhIcazo.exe
  2⤵
  PID:13108
- C:\Windows\System\XdwQDxt.exe
  C:\Windows\System\XdwQDxt.exe
  2⤵
  PID:12340
- C:\Windows\System\HfwbgZi.exe
  C:\Windows\System\HfwbgZi.exe
  2⤵
  PID:12660
- C:\Windows\System\qUULWzS.exe
  C:\Windows\System\qUULWzS.exe
  2⤵
  PID:12812
- C:\Windows\System\ovSVnvO.exe
  C:\Windows\System\ovSVnvO.exe
  2⤵
  PID:12988
- C:\Windows\System\fmkBjWa.exe
  C:\Windows\System\fmkBjWa.exe
  2⤵
  PID:13260
- C:\Windows\System\nIahZod.exe
  C:\Windows\System\nIahZod.exe
  2⤵
  PID:13056
- C:\Windows\System\vqRHzep.exe
  C:\Windows\System\vqRHzep.exe
  2⤵
  PID:13336
- C:\Windows\System\hWREpGt.exe
  C:\Windows\System\hWREpGt.exe
  2⤵
  PID:13396
- C:\Windows\System\GmgAagv.exe
  C:\Windows\System\GmgAagv.exe
  2⤵
  PID:13424
- C:\Windows\System\MGmmYJi.exe
  C:\Windows\System\MGmmYJi.exe
  2⤵
  PID:13444
- C:\Windows\System\RBBDHEJ.exe
  C:\Windows\System\RBBDHEJ.exe
  2⤵
  PID:13472
- C:\Windows\System\iSqoNuS.exe
  C:\Windows\System\iSqoNuS.exe
  2⤵
  PID:13496
- C:\Windows\System\mUGbsQM.exe
  C:\Windows\System\mUGbsQM.exe
  2⤵
  PID:13536
- C:\Windows\System\kQJVQJS.exe
  C:\Windows\System\kQJVQJS.exe
  2⤵
  PID:13564
- C:\Windows\System\xNyzkkI.exe
  C:\Windows\System\xNyzkkI.exe
  2⤵
  PID:13584
- C:\Windows\System\ELtJohQ.exe
  C:\Windows\System\ELtJohQ.exe
  2⤵
  PID:13604
- C:\Windows\System\eIKnRQI.exe
  C:\Windows\System\eIKnRQI.exe
  2⤵
  PID:13624
- C:\Windows\System\pJViNnU.exe
  C:\Windows\System\pJViNnU.exe
  2⤵
  PID:13648
- C:\Windows\System\AqdsKcH.exe
  C:\Windows\System\AqdsKcH.exe
  2⤵
  PID:13676
- C:\Windows\System\tSEqixl.exe
  C:\Windows\System\tSEqixl.exe
  2⤵
  PID:13696
- C:\Windows\System\ykyXrsx.exe
  C:\Windows\System\ykyXrsx.exe
  2⤵
  PID:13716
- C:\Windows\System\gfIeewc.exe
  C:\Windows\System\gfIeewc.exe
  2⤵
  PID:13756
- C:\Windows\System\caaPeNv.exe
  C:\Windows\System\caaPeNv.exe
  2⤵
  PID:13792
- C:\Windows\System\FdKEkxP.exe
  C:\Windows\System\FdKEkxP.exe
  2⤵
  PID:13820
- C:\Windows\System\gnPiasI.exe
  C:\Windows\System\gnPiasI.exe
  2⤵
  PID:13876
- C:\Windows\System\EIFzwEO.exe
  C:\Windows\System\EIFzwEO.exe
  2⤵
  PID:13904
- C:\Windows\System\lEzlMWy.exe
  C:\Windows\System\lEzlMWy.exe
  2⤵
  PID:13932
- C:\Windows\System\szwwMHu.exe
  C:\Windows\System\szwwMHu.exe
  2⤵
  PID:13952
- C:\Windows\System\LqQmvmF.exe
  C:\Windows\System\LqQmvmF.exe
  2⤵
  PID:13976
- C:\Windows\System\qyyXOFZ.exe
  C:\Windows\System\qyyXOFZ.exe
  2⤵
  PID:14016
- C:\Windows\System\UUCFHZD.exe
  C:\Windows\System\UUCFHZD.exe
  2⤵
  PID:14044
- C:\Windows\System\NbqYwqb.exe
  C:\Windows\System\NbqYwqb.exe
  2⤵
  PID:14060
- C:\Windows\System\KHRHyqx.exe
  C:\Windows\System\KHRHyqx.exe
  2⤵
  PID:14092
- C:\Windows\System\UCJgsqL.exe
  C:\Windows\System\UCJgsqL.exe
  2⤵
  PID:14116
- C:\Windows\System\ufFmqLA.exe
  C:\Windows\System\ufFmqLA.exe
  2⤵
  PID:14160
- C:\Windows\System\WPhKJGl.exe
  C:\Windows\System\WPhKJGl.exe
  2⤵
  PID:14188
- C:\Windows\System\ZtLGzuY.exe
  C:\Windows\System\ZtLGzuY.exe
  2⤵
  PID:14216
- C:\Windows\System\qMolmTl.exe
  C:\Windows\System\qMolmTl.exe
  2⤵
  PID:14232
- C:\Windows\System\MtYymsI.exe
  C:\Windows\System\MtYymsI.exe
  2⤵
  PID:14260
- C:\Windows\System\Lpthhve.exe
  C:\Windows\System\Lpthhve.exe
  2⤵
  PID:14276
- C:\Windows\System\aueCSAX.exe
  C:\Windows\System\aueCSAX.exe
  2⤵
  PID:14316
- C:\Windows\System\XyWHmNh.exe
  C:\Windows\System\XyWHmNh.exe
  2⤵
  PID:12580
- C:\Windows\System\KeWIpiF.exe
  C:\Windows\System\KeWIpiF.exe
  2⤵
  PID:13380
- C:\Windows\System\WNINUFB.exe
  C:\Windows\System\WNINUFB.exe
  2⤵
  PID:13464
- C:\Windows\System\oSIDHGN.exe
  C:\Windows\System\oSIDHGN.exe
  2⤵
  PID:13516
- C:\Windows\System\KHQIRHK.exe
  C:\Windows\System\KHQIRHK.exe
  2⤵
  PID:13548
- C:\Windows\System\lOXddTI.exe
  C:\Windows\System\lOXddTI.exe
  2⤵
  PID:13640
- C:\Windows\System\fJKUCOn.exe
  C:\Windows\System\fJKUCOn.exe
  2⤵
  PID:13728
- C:\Windows\System\NNCflhY.exe
  C:\Windows\System\NNCflhY.exe
  2⤵
  PID:13708
- C:\Windows\System\wwLziVu.exe
  C:\Windows\System\wwLziVu.exe
  2⤵
  PID:13816
- C:\Windows\System\zkVgbIl.exe
  C:\Windows\System\zkVgbIl.exe
  2⤵
  PID:12620
- C:\Windows\System\RzjGnhp.exe
  C:\Windows\System\RzjGnhp.exe
  2⤵
  PID:13940
- C:\Windows\System\MJnVZIx.exe
  C:\Windows\System\MJnVZIx.exe
  2⤵
  PID:14036
- C:\Windows\System\BooxCxH.exe
  C:\Windows\System\BooxCxH.exe
  2⤵
  PID:14080
- C:\Windows\System\Wzscoyl.exe
  C:\Windows\System\Wzscoyl.exe
  2⤵
  PID:14112
- C:\Windows\System\MEMTETS.exe
  C:\Windows\System\MEMTETS.exe
  2⤵
  PID:14204
- C:\Windows\System\kJTwZvi.exe
  C:\Windows\System\kJTwZvi.exe
  2⤵
  PID:14272
- C:\Windows\System\wqUzsYk.exe
  C:\Windows\System\wqUzsYk.exe
  2⤵
  PID:14288
- C:\Windows\System\JyYWUjH.exe
  C:\Windows\System\JyYWUjH.exe
  2⤵
  PID:13324
- C:\Windows\System\zcKkXuV.exe
  C:\Windows\System\zcKkXuV.exe
  2⤵
  PID:13492
- C:\Windows\System\QXbaXQP.exe
  C:\Windows\System\QXbaXQP.exe
  2⤵
  PID:13636
- C:\Windows\System\VDSSyTe.exe
  C:\Windows\System\VDSSyTe.exe
  2⤵
  PID:13916
- C:\Windows\System\cvFFKUt.exe
  C:\Windows\System\cvFFKUt.exe
  2⤵
  PID:14032
- C:\Windows\System\YXXjMNr.exe
  C:\Windows\System\YXXjMNr.exe
  2⤵
  PID:14180
- C:\Windows\System\fmEQSWs.exe
  C:\Windows\System\fmEQSWs.exe
  2⤵
  PID:13408
- C:\Windows\System\RbzQuzO.exe
  C:\Windows\System\RbzQuzO.exe
  2⤵
  PID:13692
- C:\Windows\System\NRyTNci.exe
  C:\Windows\System\NRyTNci.exe
  2⤵
  PID:14132
- C:\Windows\System\kJxkucu.exe
  C:\Windows\System\kJxkucu.exe
  2⤵
  PID:12324
- C:\Windows\System\kjlhJkF.exe
  C:\Windows\System\kjlhJkF.exe
  2⤵
  PID:13332
- C:\Windows\System\GspOsWl.exe
  C:\Windows\System\GspOsWl.exe
  2⤵
  PID:14352
- C:\Windows\System\cpnRIQL.exe
  C:\Windows\System\cpnRIQL.exe
  2⤵
  PID:14372
- C:\Windows\System\sWNJRYX.exe
  C:\Windows\System\sWNJRYX.exe
  2⤵
  PID:14396
- C:\Windows\System\qKDPrap.exe
  C:\Windows\System\qKDPrap.exe
  2⤵
  PID:14424
- C:\Windows\System\mzqtdMK.exe
  C:\Windows\System\mzqtdMK.exe
  2⤵
  PID:14476
- C:\Windows\System\XJkmzGb.exe
  C:\Windows\System\XJkmzGb.exe
  2⤵
  PID:14492
- C:\Windows\System\AljJkCB.exe
  C:\Windows\System\AljJkCB.exe
  2⤵
  PID:14536
- C:\Windows\System\LNLOENE.exe
  C:\Windows\System\LNLOENE.exe
  2⤵
  PID:14556
- C:\Windows\System\RpZCzQD.exe
  C:\Windows\System\RpZCzQD.exe
  2⤵
  PID:14580
- C:\Windows\System\ZtxUKuK.exe
  C:\Windows\System\ZtxUKuK.exe
  2⤵
  PID:14596
- C:\Windows\System\SIdbhZY.exe
  C:\Windows\System\SIdbhZY.exe
  2⤵
  PID:14636
- C:\Windows\System\bcfKIDZ.exe
  C:\Windows\System\bcfKIDZ.exe
  2⤵
  PID:14652
- C:\Windows\System\CnBUftx.exe
  C:\Windows\System\CnBUftx.exe
  2⤵
  PID:14692
- C:\Windows\System\PaYMabd.exe
  C:\Windows\System\PaYMabd.exe
  2⤵
  PID:14720
- C:\Windows\System\aSBeSbA.exe
  C:\Windows\System\aSBeSbA.exe
  2⤵
  PID:14748
- C:\Windows\System\QuWlybL.exe
  C:\Windows\System\QuWlybL.exe
  2⤵
  PID:14776
- C:\Windows\System\MXRzyEe.exe
  C:\Windows\System\MXRzyEe.exe
  2⤵
  PID:14808
- C:\Windows\System\sWVafHK.exe
  C:\Windows\System\sWVafHK.exe
  2⤵
  PID:14828
- C:\Windows\System\MoVwIAH.exe
  C:\Windows\System\MoVwIAH.exe
  2⤵
  PID:14860
- C:\Windows\System\fxKQjWw.exe
  C:\Windows\System\fxKQjWw.exe
  2⤵
  PID:14876
- C:\Windows\System\NIZKPiy.exe
  C:\Windows\System\NIZKPiy.exe
  2⤵
  PID:14892
- C:\Windows\System\ElBZiPD.exe
  C:\Windows\System\ElBZiPD.exe
  2⤵
  PID:14912
- C:\Windows\System\oFUQFEY.exe
  C:\Windows\System\oFUQFEY.exe
  2⤵
  PID:14952
- C:\Windows\System\XUCnHCq.exe
  C:\Windows\System\XUCnHCq.exe
  2⤵
  PID:14976
- C:\Windows\System\ylyPRlz.exe
  C:\Windows\System\ylyPRlz.exe
  2⤵
  PID:15036
- C:\Windows\System\JKftPnX.exe
  C:\Windows\System\JKftPnX.exe
  2⤵
  PID:15060
- C:\Windows\System\pdYujsy.exe
  C:\Windows\System\pdYujsy.exe
  2⤵
  PID:15084
- C:\Windows\System\ghaxYVC.exe
  C:\Windows\System\ghaxYVC.exe
  2⤵
  PID:15112
- C:\Windows\System\jHkqctv.exe
  C:\Windows\System\jHkqctv.exe
  2⤵
  PID:15152
- C:\Windows\System\rBPzYSG.exe
  C:\Windows\System\rBPzYSG.exe
  2⤵
  PID:15168
- C:\Windows\System\uEGygXF.exe
  C:\Windows\System\uEGygXF.exe
  2⤵
  PID:15188
- C:\Windows\System\tPCgmsC.exe
  C:\Windows\System\tPCgmsC.exe
  2⤵
  PID:15220
- C:\Windows\System\ABFrMbI.exe
  C:\Windows\System\ABFrMbI.exe
  2⤵
  PID:15240
- C:\Windows\System\eweZVsj.exe
  C:\Windows\System\eweZVsj.exe
  2⤵
  PID:15268
- C:\Windows\System\AyjvcWJ.exe
  C:\Windows\System\AyjvcWJ.exe
  2⤵
  PID:15296
- C:\Windows\System\StIdldx.exe
  C:\Windows\System\StIdldx.exe
  2⤵
  PID:15320
- C:\Windows\System\pYYMrnA.exe
  C:\Windows\System\pYYMrnA.exe
  2⤵
  PID:15348
- C:\Windows\System\QwccKnv.exe
  C:\Windows\System\QwccKnv.exe
  2⤵
  PID:14452
- C:\Windows\System\lwIqxaA.exe
  C:\Windows\System\lwIqxaA.exe
  2⤵
  PID:14508
- C:\Windows\System\vvlTSoK.exe
  C:\Windows\System\vvlTSoK.exe
  2⤵
  PID:14528
- C:\Windows\System\vnXERWq.exe
  C:\Windows\System\vnXERWq.exe
  2⤵
  PID:14552
- C:\Windows\System\xILFYcx.exe
  C:\Windows\System\xILFYcx.exe
  2⤵
  PID:14608
- C:\Windows\System\lhVRJhj.exe
  C:\Windows\System\lhVRJhj.exe
  2⤵
  PID:14744
- C:\Windows\System\bypJXGD.exe
  C:\Windows\System\bypJXGD.exe
  2⤵
  PID:14788
- C:\Windows\System\PmjCqoX.exe
  C:\Windows\System\PmjCqoX.exe
  2⤵
  PID:14852
- C:\Windows\System\UNxZOdB.exe
  C:\Windows\System\UNxZOdB.exe
  2⤵
  PID:14884
- C:\Windows\System\BFOxEHf.exe
  C:\Windows\System\BFOxEHf.exe
  2⤵
  PID:15000
- C:\Windows\System\ttdOsiG.exe
  C:\Windows\System\ttdOsiG.exe
  2⤵
  PID:15048
- C:\Windows\System\XtOTZzj.exe
  C:\Windows\System\XtOTZzj.exe
  2⤵
  PID:15108
- C:\Windows\System\TjTvPRN.exe
  C:\Windows\System\TjTvPRN.exe
  2⤵
  PID:15160
- C:\Windows\System\dFghfIH.exe
  C:\Windows\System\dFghfIH.exe
  2⤵
  PID:15236
- C:\Windows\System\APJafNl.exe
  C:\Windows\System\APJafNl.exe
  2⤵
  PID:15264
- C:\Windows\System\wlahsBv.exe
  C:\Windows\System\wlahsBv.exe
  2⤵
  PID:15332
- C:\Windows\System\UNZyKXP.exe
  C:\Windows\System\UNZyKXP.exe
  2⤵
  PID:14412
- C:\Windows\System\buipycg.exe
  C:\Windows\System\buipycg.exe
  2⤵
  PID:14684
- C:\Windows\System\iqdkSSR.exe
  C:\Windows\System\iqdkSSR.exe
  2⤵
  PID:14732
- C:\Windows\System\pVtpCTb.exe
  C:\Windows\System\pVtpCTb.exe
  2⤵
  PID:14968
- C:\Windows\System\YvLYCJp.exe
  C:\Windows\System\YvLYCJp.exe
  2⤵
  PID:15024
- C:\Windows\System\kMoQwrS.exe
  C:\Windows\System\kMoQwrS.exe
  2⤵
  PID:15184
- C:\Windows\System\zJubHkL.exe
  C:\Windows\System\zJubHkL.exe
  2⤵
  PID:15336
- C:\Windows\System\yUSSMPW.exe
  C:\Windows\System\yUSSMPW.exe
  2⤵
  PID:14824
- C:\Windows\System\UTdeWJK.exe
  C:\Windows\System\UTdeWJK.exe
  2⤵
  PID:15068
- C:\Windows\System\XjQrKwM.exe
  C:\Windows\System\XjQrKwM.exe
  2⤵
  PID:14588
- C:\Windows\System\gbKboRi.exe
  C:\Windows\System\gbKboRi.exe
  2⤵
  PID:15384
- C:\Windows\System\HHyGKnR.exe
  C:\Windows\System\HHyGKnR.exe
  2⤵
  PID:15404
- C:\Windows\System\XgVcVZT.exe
  C:\Windows\System\XgVcVZT.exe
  2⤵
  PID:15452
- C:\Windows\System\nUMFPRs.exe
  C:\Windows\System\nUMFPRs.exe
  2⤵
  PID:15468
- C:\Windows\System\fAPSnvL.exe
  C:\Windows\System\fAPSnvL.exe
  2⤵
  PID:15488
- C:\Windows\System\rHGRFlU.exe
  C:\Windows\System\rHGRFlU.exe
  2⤵
  PID:15520
- C:\Windows\System\xHRNNHI.exe
  C:\Windows\System\xHRNNHI.exe
  2⤵
  PID:15540
- C:\Windows\System\sMwjvnJ.exe
  C:\Windows\System\sMwjvnJ.exe
  2⤵
  PID:15584
- C:\Windows\System\jDNPsku.exe
  C:\Windows\System\jDNPsku.exe
  2⤵
  PID:15608
- C:\Windows\System\OkWOwrH.exe
  C:\Windows\System\OkWOwrH.exe
  2⤵
  PID:15628
- C:\Windows\System\gNvjtNO.exe
  C:\Windows\System\gNvjtNO.exe
  2⤵
  PID:15652
- C:\Windows\System\VCSTlAA.exe
  C:\Windows\System\VCSTlAA.exe
  2⤵
  PID:15668
- C:\Windows\System\TvCleXG.exe
  C:\Windows\System\TvCleXG.exe
  2⤵
  PID:15700
- C:\Windows\System\XoxspFH.exe
  C:\Windows\System\XoxspFH.exe
  2⤵
  PID:15732
- C:\Windows\System\CgVTYGz.exe
  C:\Windows\System\CgVTYGz.exe
  2⤵
  PID:15756
- C:\Windows\System\GLywrkl.exe
  C:\Windows\System\GLywrkl.exe
  2⤵
  PID:15772
- C:\Windows\System\RRZZmQS.exe
  C:\Windows\System\RRZZmQS.exe
  2⤵
  PID:15808
- C:\Windows\System\pygLgYM.exe
  C:\Windows\System\pygLgYM.exe
  2⤵
  PID:15832
- C:\Windows\System\vCjHwnj.exe
  C:\Windows\System\vCjHwnj.exe
  2⤵
  PID:15876
- C:\Windows\System\viNcDTe.exe
  C:\Windows\System\viNcDTe.exe
  2⤵
  PID:15900
- C:\Windows\System\DOrByZi.exe
  C:\Windows\System\DOrByZi.exe
  2⤵
  PID:15920
- C:\Windows\System\hxtHnOo.exe
  C:\Windows\System\hxtHnOo.exe
  2⤵
  PID:15940
- C:\Windows\System\rjgRiMA.exe
  C:\Windows\System\rjgRiMA.exe
  2⤵
  PID:15988
- C:\Windows\System\ZPANPnc.exe
  C:\Windows\System\ZPANPnc.exe
  2⤵
  PID:16020
- C:\Windows\System\HjUJDgx.exe
  C:\Windows\System\HjUJDgx.exe
  2⤵
  PID:16040
- C:\Windows\System\HmDKetQ.exe
  C:\Windows\System\HmDKetQ.exe
  2⤵
  PID:16072
- C:\Windows\System\BgiObrW.exe
  C:\Windows\System\BgiObrW.exe
  2⤵
  PID:16088
- C:\Windows\System\NIXgxqV.exe
  C:\Windows\System\NIXgxqV.exe
  2⤵
  PID:16104
- C:\Windows\System\nxxeIdP.exe
  C:\Windows\System\nxxeIdP.exe
  2⤵
  PID:16140
- C:\Windows\System\GcfZVSM.exe
  C:\Windows\System\GcfZVSM.exe
  2⤵
  PID:16168
- C:\Windows\System\gMvYAdn.exe
  C:\Windows\System\gMvYAdn.exe
  2⤵
  PID:16188
- C:\Windows\System\ccvExFG.exe
  C:\Windows\System\ccvExFG.exe
  2⤵
  PID:16204
- C:\Windows\System\xClYVrm.exe
  C:\Windows\System\xClYVrm.exe
  2⤵
  PID:16272
- C:\Windows\System\eZjFBrW.exe
  C:\Windows\System\eZjFBrW.exe
  2⤵
  PID:16308
- C:\Windows\System\jbEogeb.exe
  C:\Windows\System\jbEogeb.exe
  2⤵
  PID:16324
- C:\Windows\System\xxqNxNo.exe
  C:\Windows\System\xxqNxNo.exe
  2⤵
  PID:16364
- C:\Windows\System\ImkfqvX.exe
  C:\Windows\System\ImkfqvX.exe
  2⤵
  PID:14888
- C:\Windows\System\pzFPMLR.exe
  C:\Windows\System\pzFPMLR.exe
  2⤵
  PID:14572
- C:\Windows\System\CJbeFpc.exe
  C:\Windows\System\CJbeFpc.exe
  2⤵
  PID:15432
- C:\Windows\System\LLVVztF.exe
  C:\Windows\System\LLVVztF.exe
  2⤵
  PID:15508
- C:\Windows\System\nhmtAUg.exe
  C:\Windows\System\nhmtAUg.exe
  2⤵
  PID:15560
- C:\Windows\System\pYLgMWO.exe
  C:\Windows\System\pYLgMWO.exe
  2⤵
  PID:15616
- C:\Windows\System\rDvaXKU.exe
  C:\Windows\System\rDvaXKU.exe
  2⤵
  PID:15696
- C:\Windows\System\AfAVCoX.exe
  C:\Windows\System\AfAVCoX.exe
  2⤵
  PID:15764
- C:\Windows\System\ayddEol.exe
  C:\Windows\System\ayddEol.exe
  2⤵
  PID:15868
- C:\Windows\System\JvPujRS.exe
  C:\Windows\System\JvPujRS.exe
  2⤵
  PID:15932
- C:\Windows\System\SkGajqM.exe
  C:\Windows\System\SkGajqM.exe
  2⤵
  PID:16016
- C:\Windows\System\cvdRhKa.exe
  C:\Windows\System\cvdRhKa.exe
  2⤵
  PID:16008
- C:\Windows\System\VSNYcyA.exe
  C:\Windows\System\VSNYcyA.exe
  2⤵
  PID:16096
- C:\Windows\System\OVNlvln.exe
  C:\Windows\System\OVNlvln.exe
  2⤵
  PID:16196
- C:\Windows\System\zbyEWHP.exe
  C:\Windows\System\zbyEWHP.exe
  2⤵
  PID:16176
- C:\Windows\System\OIUPxuo.exe
  C:\Windows\System\OIUPxuo.exe
  2⤵
  PID:16300
- C:\Windows\System\YmRHoUo.exe
  C:\Windows\System\YmRHoUo.exe
  2⤵
  PID:16336
- C:\Windows\System\LILUIsQ.exe
  C:\Windows\System\LILUIsQ.exe
  2⤵
  PID:15376
- C:\Windows\System\UDmNscI.exe
  C:\Windows\System\UDmNscI.exe
  2⤵
  PID:1572
- C:\Windows\System\uMleCxI.exe
  C:\Windows\System\uMleCxI.exe
  2⤵
  PID:4464
- C:\Windows\System\yRbeNCd.exe
  C:\Windows\System\yRbeNCd.exe
  2⤵
  PID:15636
- C:\Windows\System\eRFIQfQ.exe
  C:\Windows\System\eRFIQfQ.exe
  2⤵
  PID:15720
- C:\Windows\System\rPRrmUG.exe
  C:\Windows\System\rPRrmUG.exe
  2⤵
  PID:15916
- C:\Windows\System\oauRzJF.exe
  C:\Windows\System\oauRzJF.exe
  2⤵
  PID:16052
- C:\Windows\System\ICmBLtB.exe
  C:\Windows\System\ICmBLtB.exe
  2⤵
  PID:16376
- C:\Windows\System\GhRyPCJ.exe
  C:\Windows\System\GhRyPCJ.exe
  2⤵
  PID:4840
- C:\Windows\System\gMqZmuJ.exe
  C:\Windows\System\gMqZmuJ.exe
  2⤵
  PID:15536
- C:\Windows\System\tWynLKI.exe
  C:\Windows\System\tWynLKI.exe
  2⤵
  PID:15980
- C:\Windows\System\vwnljbN.exe
  C:\Windows\System\vwnljbN.exe
  2⤵
  PID:15592
- C:\Windows\System\TkFpCZR.exe
  C:\Windows\System\TkFpCZR.exe
  2⤵
  PID:16128
- C:\Windows\System\lviNLlM.exe
  C:\Windows\System\lviNLlM.exe
  2⤵
  PID:16392
- C:\Windows\System\btEUvPB.exe
  C:\Windows\System\btEUvPB.exe
  2⤵
  PID:16416
- C:\Windows\System\kQmbpRA.exe
  C:\Windows\System\kQmbpRA.exe
  2⤵
  PID:16444
- C:\Windows\System\bgCTvlz.exe
  C:\Windows\System\bgCTvlz.exe
  2⤵
  PID:16476
- C:\Windows\System\QDbjGdZ.exe
  C:\Windows\System\QDbjGdZ.exe
  2⤵
  PID:16500
- C:\Windows\System\zLQWLvj.exe
  C:\Windows\System\zLQWLvj.exe
  2⤵
  PID:16532
- C:\Windows\System\tpadqxJ.exe
  C:\Windows\System\tpadqxJ.exe
  2⤵
  PID:16548
- C:\Windows\System\UxNhoWb.exe
  C:\Windows\System\UxNhoWb.exe
  2⤵
  PID:16576
- C:\Windows\System\ZZYHpPg.exe
  C:\Windows\System\ZZYHpPg.exe
  2⤵
  PID:16592
- C:\Windows\System\cvErQbX.exe
  C:\Windows\System\cvErQbX.exe
  2⤵
  PID:16624
- C:\Windows\System\VPnDOKu.exe
  C:\Windows\System\VPnDOKu.exe
  2⤵
  PID:16648
- C:\Windows\System\uKxhcLz.exe
  C:\Windows\System\uKxhcLz.exe
  2⤵
  PID:16680
- C:\Windows\System\GsnNIlw.exe
  C:\Windows\System\GsnNIlw.exe
  2⤵
  PID:16712
- C:\Windows\System\EniCViP.exe
  C:\Windows\System\EniCViP.exe
  2⤵
  PID:16732
- C:\Windows\System\UzTFrLD.exe
  C:\Windows\System\UzTFrLD.exe
  2⤵
  PID:16756
- C:\Windows\System\aaAVhAW.exe
  C:\Windows\System\aaAVhAW.exe
  2⤵
  PID:16796
- C:\Windows\System\oWCwGuS.exe
  C:\Windows\System\oWCwGuS.exe
  2⤵
  PID:16820
- C:\Windows\System\zaOWQDx.exe
  C:\Windows\System\zaOWQDx.exe
  2⤵
  PID:16880
- C:\Windows\System\YIKOEHN.exe
  C:\Windows\System\YIKOEHN.exe
  2⤵
  PID:16908
- C:\Windows\System\rmQYDYE.exe
  C:\Windows\System\rmQYDYE.exe
  2⤵
  PID:16936
- C:\Windows\System\rcILYkA.exe
  C:\Windows\System\rcILYkA.exe
  2⤵
  PID:16964
- C:\Windows\System\iBbAxBZ.exe
  C:\Windows\System\iBbAxBZ.exe
  2⤵
  PID:16984
- C:\Windows\System\FKykZdd.exe
  C:\Windows\System\FKykZdd.exe
  2⤵
  PID:17008
- C:\Windows\System\gWLsZyB.exe
  C:\Windows\System\gWLsZyB.exe
  2⤵
  PID:17028
- C:\Windows\System\XmCYsme.exe
  C:\Windows\System\XmCYsme.exe
  2⤵
  PID:17052
- C:\Windows\System\GKIMdYY.exe
  C:\Windows\System\GKIMdYY.exe
  2⤵
  PID:17068
- C:\Windows\System\fjRNnMj.exe
  C:\Windows\System\fjRNnMj.exe
  2⤵
  PID:17128
- C:\Windows\System\qVZhWig.exe
  C:\Windows\System\qVZhWig.exe
  2⤵
  PID:17152
- C:\Windows\System\LeRUbsM.exe
  C:\Windows\System\LeRUbsM.exe
  2⤵
  PID:17168
- C:\Windows\System\VsnzNio.exe
  C:\Windows\System\VsnzNio.exe
  2⤵
  PID:17208
- C:\Windows\System\LkEVARQ.exe
  C:\Windows\System\LkEVARQ.exe
  2⤵
  PID:17228
- C:\Windows\System\OvSNZTX.exe
  C:\Windows\System\OvSNZTX.exe
  2⤵
  PID:17256
- C:\Windows\System\KyJtUWN.exe
  C:\Windows\System\KyJtUWN.exe
  2⤵
  PID:17276
- C:\Windows\System\bPfRFpb.exe
  C:\Windows\System\bPfRFpb.exe
  2⤵
  PID:17312
- C:\Windows\System\ZhRDhZg.exe
  C:\Windows\System\ZhRDhZg.exe
  2⤵
  PID:17340
- C:\Windows\System\QuPbaer.exe
  C:\Windows\System\QuPbaer.exe
  2⤵
  PID:17376
- C:\Windows\System\BZAfEvl.exe
  C:\Windows\System\BZAfEvl.exe
  2⤵
  PID:17400
- C:\Windows\System\XSVNNKk.exe
  C:\Windows\System\XSVNNKk.exe
  2⤵
  PID:16404
- C:\Windows\System\nnjromA.exe
  C:\Windows\System\nnjromA.exe
  2⤵
  PID:16468
- C:\Windows\System\sYsiFFG.exe
  C:\Windows\System\sYsiFFG.exe
  2⤵
  PID:16568
- C:\Windows\System\TFKcTTt.exe
  C:\Windows\System\TFKcTTt.exe
  2⤵
  PID:16620
- C:\Windows\System\kvagHYG.exe
  C:\Windows\System\kvagHYG.exe
  2⤵
  PID:16696
- C:\Windows\System\CDetIlT.exe
  C:\Windows\System\CDetIlT.exe
  2⤵
  PID:16724
- C:\Windows\System\yVObFoz.exe
  C:\Windows\System\yVObFoz.exe
  2⤵
  PID:16784
- C:\Windows\System\YlZNjzQ.exe
  C:\Windows\System\YlZNjzQ.exe
  2⤵
  PID:16860

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AfMouQR.exe

Path C:\Windows\System\AfMouQR.exe
Size 1.0MB
SHA256 7d7fa7d6536d8e4053003362529b97d4d7a53d0d7cd859dab3e55dbd327e17f0
MD5 33afbe21d50bb1ba677da2aedc1ef252
SHA1 2f7341a50f06bdb53e1ae067702742c3e6172b51
SHA512 93b86fa23691148c3c5bdb067fed7c43ce1c873417cf1e688ac9cc4a3ba72c2588b39956070253e91a197ca13ad39a63a2921a37a5d4bf4559bd5d40f2df8dcf
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfv:GezaTF8FcNkNdfE0pZ9oztFwIRsqF
MD5 SHA1 SHA512 SSDEEP

Submit Download

GTzNohU.exe

Path C:\Windows\System\GTzNohU.exe
Size 1.0MB
SHA256 3fdd98d3f7055e2ab072c8727987d2d50fbfe1633f2ecd047dc3e14a52b16c52
MD5 55feb5ddca1ba4fe1a0235b71c368fb8
SHA1 1a9fe1a53ced5630f9f7b8cf4c3ff128e4b02600
SHA512 434c0c54973831638d8babe84b7d81c431222b27cc84e5bf807e012e1cfce900b999bffdc26698730fd10027950ef9e5a6081a4ad8cd54a445383aaf73b34644
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfW:GezaTF8FcNkNdfE0pZ9oztFwIRsqI
MD5 SHA1 SHA512 SSDEEP

Submit Download

JgxhOsk.exe

Path C:\Windows\System\JgxhOsk.exe
Size 1.0MB
SHA256 3bef383ae9599203e402ba4ed2dae59de998a1b703415e78c8601e5c9cf447c4
MD5 b5fa28c7fe4628badc898a5ffee671c0
SHA1 d9b59bb46df00a7859131610313058a8f5044e43
SHA512 9c051bcf64ce0e59c20d0a2bc20c2a35332016a24faf4d225154dc4a63fa3f0f0ebe5773ea5782a5d24a8999d94e9a31fa266031b7c871d714685b39d209d459
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFf3:GezaTF8FcNkNdfE0pZ9oztFwIRsqB
MD5 SHA1 SHA512 SSDEEP

Submit Download

KIIIwXg.exe

Path C:\Windows\System\KIIIwXg.exe
Size 1023KB
SHA256 d06925f70fe3198ed32b4ec3876d70e4f44c6bed46139ea5436d75cff08f6f29
MD5 c6c5ad6177ca863742ffc4ce7e8fa412
SHA1 4dbf3e2be1313d5d02e4bf10f7bcfbfb5a4e8bc4
SHA512 a764940e9418bcd3642b9bec0734b5adbfb59e9fbd239a6e9824492a084a08177d8445e8ddea430ab2c55545339353497b183669b8400eadb1ce8f7353974b85
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfT:GezaTF8FcNkNdfE0pZ9oztFwIRsqV
MD5 SHA1 SHA512 SSDEEP

Submit Download

LtUGcOI.exe

Path C:\Windows\System\LtUGcOI.exe
Size 1.0MB
SHA256 049fa8db305cada2ad6b8e3200ceeacb8e14a6ba6166f01cfcb32b7287841ae6
MD5 a144eb5fe847cdf788397507aee6b04f
SHA1 ef3718c3b41b7162534ef2c526917387ca89eccb
SHA512 17fcea5b5513a2ba4434f2081f4dd74a9bc38c953ecbfdc18462acc1ffa7a83d94394b03c4663eca97ece0ff725e9da565c801b9b8f0140214ad9881375191d5
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfvM:GezaTF8FcNkNdfE0pZ9oztFwIRsqq
MD5 SHA1 SHA512 SSDEEP

Submit Download

MccxNjM.exe

Path C:\Windows\System\MccxNjM.exe
Size 1.0MB
SHA256 db006b35084b153d3d294470fd3be30ae768880834f142184d4100311a9bb0f8
MD5 72c7083646fd0c26e67917bdb9a0f9f5
SHA1 fd79d4f5ac363433e498be99a2b546e1bf56afba
SHA512 f1c6e83954efff6dbd0108568ecb187fe6e68accfc09e6997d18156fc0631e0c2480c3e77559c03027485987eeab52f6899783c870379867ef2acf671e340a90
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfI:GezaTF8FcNkNdfE0pZ9oztFwIRsqO
MD5 SHA1 SHA512 SSDEEP

Submit Download

OhYstyk.exe

Path C:\Windows\System\OhYstyk.exe
Size 1.0MB
SHA256 9369c0cc67fe26da774721872b887c46374065a0429a1af7019d3a356ce803bc
MD5 74b95742225ba702ad85a75a23f0fe4d
SHA1 759938d61cf4c6181abf427eb3a57e71d0900bce
SHA512 b43a76c5f6d95aa766cca6bac55f488719b8769508c5209f97abd32f511ea6dff215d825e4e7a96c9737fc5442bc8aafe1f26de6d907888301ba63d868d05470
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfS:GezaTF8FcNkNdfE0pZ9oztFwIRsq4
MD5 SHA1 SHA512 SSDEEP

Submit Download

QqunsYp.exe

Path C:\Windows\System\QqunsYp.exe
Size 1023KB
SHA256 e09c57830953de1433100a59b11f19e911b5278c034b8c748b7639f3572b7720
MD5 790ff3bc2d34740d2ec2260d52726878
SHA1 3dcbce7a50ec7938cef2d170a1a00d75db09f320
SHA512 44cc1f36d9c8260628f6cca0042361e026c508390fb6ece140a887b65f53616357b6c1ab4e6fdafbc8a3c7c87e172eebfa770c8dcf0dbc0fb16dd13b67168e58
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfk:GezaTF8FcNkNdfE0pZ9oztFwIRsqm
MD5 SHA1 SHA512 SSDEEP

Submit Download

RVezCEA.exe

Path C:\Windows\System\RVezCEA.exe
Size 1.0MB
SHA256 83ef8f21fd651ab231d8884e96e9022794338b0c25f38f0cd924d6f8c78fef26
MD5 911db577be35a734d2817d375dcc32dd
SHA1 e76564ab8db5f98d8b7e4cc1802a2dc14588865b
SHA512 f0f4c6f008f44af46c0836d20bb4e1031180ad0578455f43cbcfb6008834922ddc628da5171ad91ba3ebc895deda1990d2b4e38dad5d7d32c7a8112d3e06bfe9
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfl:GezaTF8FcNkNdfE0pZ9oztFwIRsqL
MD5 SHA1 SHA512 SSDEEP

Submit Download

SSwUNvk.exe

Path C:\Windows\System\SSwUNvk.exe
Size 1022KB
SHA256 fcadb38e3a1e631a284ca3557e79e5f36d1ead29ab8dfb82778c5664150e46a2
MD5 46522fcd566d463f3fd9d0483127fa2b
SHA1 92f7a27668d85073e9bb111aa4430f0c86311007
SHA512 1145901eac22cbcc15eec9bec72d287e670f1217a58d658d98ad832d466636fd0070273dfc3a0bec0597bbba2ddbd36bed1a7cd6cb35da209aec22bbd8f73106
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfV:GezaTF8FcNkNdfE0pZ9oztFwIRsq3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TVWLHGV.exe

Path C:\Windows\System\TVWLHGV.exe
Size 1023KB
SHA256 f79beb005b830609e3692a66676e3ed4854860be0d545c1822a9a4b9731d14e0
MD5 b237f77026a1a6bf5be01d56099f7585
SHA1 a6ba5886ef2820e46b75300cbe74b16bae16a24d
SHA512 aa1bee2f18113179b15acc2389350d846124b4d1ab5ac23315cb9fdd3bec31d3013af288e234938fa79664dc0f96247751537368eb6ffb0c122fa4ad12dd51c8
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFf+:GezaTF8FcNkNdfE0pZ9oztFwIRsqs
MD5 SHA1 SHA512 SSDEEP

Submit Download

VMRnyCN.exe

Path C:\Windows\System\VMRnyCN.exe
Size 1.0MB
SHA256 fe3d4ea5716d066fa746ae1781c81697d3540fed31b851d769f9829c75263a7e
MD5 a1026813a313cb9d3bcfceff7cc3d7fd
SHA1 678e9a40362d59c3ee80e7724ae36a65dd4693db
SHA512 756f1a6a628bedc11ef5c4c165cfca14849cd811ba000078621cf534b9483171a14355ebe1db6a5a8ef090bda2a266801d843694fcdd19fc0936cac1cec6e6c1
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfX:GezaTF8FcNkNdfE0pZ9oztFwIRsqx
MD5 SHA1 SHA512 SSDEEP

Submit Download

VxeWJQY.exe

Path C:\Windows\System\VxeWJQY.exe
Size 1.0MB
SHA256 869239977f5e6106e91cd077409ae3dbba91cc9dc9c2e8e4c8295a107e3c53d6
MD5 7bb6e68e688c5670cb64879a6ed7ac92
SHA1 791c19ceb1bf696b4f0cdbd61071c81fd4e41387
SHA512 2efbed30adaa621d33990b3763b22ee1d024168f4d549bf627ef73f706300ceb30d8a9a8594294e0694228a819c17f35ddc83e9319ecb1e0e9b0e63fe1cf39bc
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfw:GezaTF8FcNkNdfE0pZ9oztFwIRsqS
MD5 SHA1 SHA512 SSDEEP

Submit Download

WByBENf.exe

Path C:\Windows\System\WByBENf.exe
Size 1022KB
SHA256 c9cf5d12a78358b2af434dcfc0e6ea50f5443e87cd94fcbab8aaf7e8e4d60f38
MD5 f3aaf41e639f9bbf344bb0b8be67890a
SHA1 3ef3a5875d07f2d490ad9fc9c0559016fa26a61f
SHA512 eabbc91f538ce3a38ef10686d28bc64ade5f7be2a4342702e5a1bad88fa7dc1d4e7c52b4b9dde27f7dcf7dcd43ed3cf06d8a1807b34e0d5ca5991ae68ddadcec
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfR:GezaTF8FcNkNdfE0pZ9oztFwIRsq/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZGMWsJf.exe

Path C:\Windows\System\ZGMWsJf.exe
Size 1.0MB
SHA256 2f5fa24e7bae3f0871dab6d34ef8efcb65ccf3e691203cca3f1e3ed366355195
MD5 64306b2eacc6d13466a132272dd1628c
SHA1 4722d41cf6fdad88b27a9b5c9e5a6623ba064032
SHA512 9aca5fd424fe573f5bce5099fdd782638cb54e585e9575ce5cdab49fe3c93623cf9d0563bcb958f50a0ac1bc84c5f4deb10f1fdecb3f591b6fc1bf2061fbbd4e
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfk:GezaTF8FcNkNdfE0pZ9oztFwIRsqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

arXvYMN.exe

Path C:\Windows\System\arXvYMN.exe
Size 1.0MB
SHA256 50dcb68c76475d549905e71622b2d93e0f18477d2c53001919cd402babdde550
MD5 441c98a62be56cbe802d4aa8a029ba56
SHA1 cb21e770c6c32caf036a7b84096849d130e72976
SHA512 7af45a916bdcc94a12d95179e7aa54696ae5cfbae6ddd77745b908d6ffcb41fee3a6104675792342b606d11e4c001d55b6267d9d7da0f8da67ee21a282636619
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfK:GezaTF8FcNkNdfE0pZ9oztFwIRsqo
MD5 SHA1 SHA512 SSDEEP

Submit Download

cYpWdQq.exe

Path C:\Windows\System\cYpWdQq.exe
Size 1.0MB
SHA256 5adb61bf39deedc8b39a1bfb7393eaba992c8628a4d001fb6f8186c6195195ae
MD5 56b3b062dc3371fd3de4a4dd3a0e16d3
SHA1 66226f3f79250989e290bb738f33ee19547138f1
SHA512 236dfa493680fd4d41d6d398698fb2a9b7a87e8f371fd11423c257d9085ff8276cc29c22a323544ee6fe2308fe192f6f84a187a42b7f71f3e1701837d2daf84d
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFf/:GezaTF8FcNkNdfE0pZ9oztFwIRsqF
MD5 SHA1 SHA512 SSDEEP

Submit Download

chhGqzm.exe

Path C:\Windows\System\chhGqzm.exe
Size 1.0MB
SHA256 06f4649bce92cdf496e6e1f3db80d07b40b610410b42e21d3d75c4baa2123e8a
MD5 7fc58b6701e11c6f3a136ba83038e6e3
SHA1 3a1d15ba4b5f12e06094f0a478a0f055de82fe81
SHA512 728d01513931fbdb72fb018c2022d10a389ad6c81a7a62a8b5c35ecea5fb2f5cb29814edfa70925e093b88fbb23a3734ec37133cd6c95da0da8bf9a6c2c151c8
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfS:GezaTF8FcNkNdfE0pZ9oztFwIRsqI
MD5 SHA1 SHA512 SSDEEP

Submit Download

cjxYjNK.exe

Path C:\Windows\System\cjxYjNK.exe
Size 1.0MB
SHA256 e1083761c8debcf3fd59296192c6996cf90bbc732cced5c13becc3589a33d7e7
MD5 eba245a85aba9d85b2f60b1a88510918
SHA1 07d56ad39bfc2c8d1c0d3c5f6ce4cc8715bdcf2f
SHA512 c2d02bbde1790518ed3e92def561fb9aec25e830137360aac8d44bd368e2d82d631ed3e87ec1351085736a3d093745c9372124f1c507355592f798eb45fc74aa
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfd:GezaTF8FcNkNdfE0pZ9oztFwIRsq7
MD5 SHA1 SHA512 SSDEEP

Submit Download

dYdJzOw.exe

Path C:\Windows\System\dYdJzOw.exe
Size 1.0MB
SHA256 f5d459f2ad3b66bcee7e67c8ae0c35202cb60e6f2407b729196c7fe554eb9f1d
MD5 60806ff6fd5a0f11f2b7401390fd3f05
SHA1 c4e5a2ee39d8d6a5b13e0e065478bf5344f90c79
SHA512 dc2b75a4d6b8fee0af2644a737259c47a5990f4a148078616931bbf14915b47bd207350c5893b0c19af7e62e1c86f0b628b9b3e191bdfcfffd3c37543b634684
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfj:GezaTF8FcNkNdfE0pZ9oztFwIRsqZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

etttuop.exe

Path C:\Windows\System\etttuop.exe
Size 1.0MB
SHA256 918891cc21a311f79b61038b735e41fbcbbf56bf31beb0fc5b9f4d94000734d8
MD5 04c5940fe9d9a7f5a9b87a2c0060e8a0
SHA1 328a1bfbe35a4e78b6bf894b4193b9e694344765
SHA512 f79d2521f90a3a1470c1b4a5ce4723b52cafcac74603a97d9360306fb0ada1337299d368eaaef7a800c6a4a8dd1eca28c00543078565beca1672c82047f77a62
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfr:GezaTF8FcNkNdfE0pZ9oztFwIRsq5
MD5 SHA1 SHA512 SSDEEP

Submit Download

fIdMUQh.exe

Path C:\Windows\System\fIdMUQh.exe
Size 1023KB
SHA256 7357b1729d1f719a50b02314ac5d693ae41368e5d8c7b5979f55c69a80fbc548
MD5 c371692fa1c7afb5a17c29cfcb42508a
SHA1 672defc724c617461a8fde8ebc3d6f5a1034ec5e
SHA512 834dba266c23738f49752fecebbddb41b18393fb8793745282da4d9fa1118af8f90d1aa276277998a02aafd169219904e96117a53479abf8508a0a7488d2fcbd
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfC:GezaTF8FcNkNdfE0pZ9oztFwIRsqQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hVOOoGo.exe

Path C:\Windows\System\hVOOoGo.exe
Size 1.0MB
SHA256 0806209d9d6b4d352d7d498e4ca43b8814588be3f185ca1fc7c0b5cad90fa47a
MD5 23f7eaec816cdaeef6b4f79200a5367a
SHA1 af3716f28937fc0500ff503dab99d429dd4328a0
SHA512 9a19c2d7e55c07ece449d4eac5d91505b8fddb276a5786ed56a5201c14fc5ef3031ab4d56d4fb69d3b6f7fe0170ec3220e43c013640448735ae571c9367e3c86
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFf2:GezaTF8FcNkNdfE0pZ9oztFwIRsqY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hgMAXcu.exe

Path C:\Windows\System\hgMAXcu.exe
Size 1.0MB
SHA256 929172ba9ffffc4019da5b05b620b3694207c4eae3b770346a35649ba56e7a30
MD5 9ef3f393b99dafc89aee58f17e416156
SHA1 c7c305aacca35aaf6e7021b431b4543f1f0702a8
SHA512 f3297df2dde25a874c7f444c336b878d8f8775d4a90fc452c1d1f10a3876dead485b139528b4a009ccf8db01cac061463cff3d7315e5bed12e58717bec97934c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfX:GezaTF8FcNkNdfE0pZ9oztFwIRsq5
MD5 SHA1 SHA512 SSDEEP

Submit Download

hjqbGer.exe

Path C:\Windows\System\hjqbGer.exe
Size 1.0MB
SHA256 faf7b7bf58cee82cd1d42e36e9adb5fb383f1a66dd60f0d2de0a3c057f777887
MD5 69da236ee046367597dc77a35a519798
SHA1 35647524aed549da25e9ebf8c9e27d84f3e87e2c
SHA512 8bd2471bf9af52ed40eb50efa9be1a9a4fce2228349f2165f5d0489839d28e484ff3265e9720aa69c7685a98c68255bf055b5e0fb6ef6f3cbe20a0382050bf13
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFf3:GezaTF8FcNkNdfE0pZ9oztFwIRsqR
MD5 SHA1 SHA512 SSDEEP

Submit Download

jxvVinq.exe

Path C:\Windows\System\jxvVinq.exe
Size 1.0MB
SHA256 925e74113f6b09d38d5ea4db006ca735d0659011f471fb8bd2b87a5a955dbef4
MD5 4b0bd58de03b93388d8a9998848473d6
SHA1 b5b1263d0e2667094159e3cea9a80e7fced02c66
SHA512 c52a1b9c855f38e988bd313cbb486c90398e17ce28fb84f4c485bc2f83ba24b59ecda719b99bf2ff37c79944ad7a97d34e48338d5ce480d4b4d1d8357cb4497a
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfp:GezaTF8FcNkNdfE0pZ9oztFwIRsqH
MD5 SHA1 SHA512 SSDEEP

Submit Download

lTLKmro.exe

Path C:\Windows\System\lTLKmro.exe
Size 1.0MB
SHA256 7f575d6f82cb2e24d23334751f115200b6db4bee0807fc6a8a38a4db1ad1e42d
MD5 5c5fa7c4cc5dc0bfa6ea199ae283ea72
SHA1 74540b44d6a1d209a8932140984dc132542337d3
SHA512 44da688f0ba05678d0898302f85d299388cca5ec91b5b4bef86cfaa9660cbbda23d42648d377275b9104a9298a0b91c86a3c0b0986c08516e67c15f1ac65f65a
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFf4:GezaTF8FcNkNdfE0pZ9oztFwIRsq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

oWoUAIV.exe

Path C:\Windows\System\oWoUAIV.exe
Size 1.0MB
SHA256 4e95866f46a213800d9040e60c6cb2937a67d648476ba9740a80d100076c6b59
MD5 246346dcdf45019191026e3eae21faf6
SHA1 e87405b8cb04696c32304fd8953f70fdf854398e
SHA512 2cde6198e721f3ef448f0c6f528f0eb8b13a032523d46d8f7cb886c917eb55fc7866a32a4dd5ccced614d6d68f025e9898249eccb0a8a701e8eadff278a78596
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfK:GezaTF8FcNkNdfE0pZ9oztFwIRsqA
MD5 SHA1 SHA512 SSDEEP

Submit Download

qMkWavs.exe

Path C:\Windows\System\qMkWavs.exe
Size 1.0MB
SHA256 68aed36063b8b2eea93c4a5e29765c2ae1eb59dedc4f0a3e50c81054bebc8155
MD5 0452ae08b8351065d000811442600cf5
SHA1 a32ebb82aa706ad7b6be3c70a05d79eb860a1547
SHA512 f8e8baaba43e9638b986eef0c335179fa2a5fbbf295e2ae26cd1dbddfe38310631946d41a11ce6677cb2ed9d748654eecb810b1d127a9cc7761e3fbcfa1fe766
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfQ:GezaTF8FcNkNdfE0pZ9oztFwIRsqy
MD5 SHA1 SHA512 SSDEEP

Submit Download

qXmWzxi.exe

Path C:\Windows\System\qXmWzxi.exe
Size 1.0MB
SHA256 fdcf921fb38c24040c737edbbb3e260ed7c7f9eae25c396d858a718f27674e7b
MD5 50f71883975903df22bc435fbac0c1c6
SHA1 a7cd0e10be4ac59c4bb7b9bbec52ecaab0cb9d8e
SHA512 530d53a4a8af447382b828a5362372007a9bc9bb92d22d9c2450490688003cec7adf9a94734994cf6a1161b6ee9b272f376d8fdef3568712763c095fd2879e44
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFf9:GezaTF8FcNkNdfE0pZ9oztFwIRsqj
MD5 SHA1 SHA512 SSDEEP

Submit Download

udbrhWU.exe

Path C:\Windows\System\udbrhWU.exe
Size 1.0MB
SHA256 1f030b334cfa201ea49749765ffb3354bacf926fee2e231549d1a01c895793be
MD5 f3560d23fcc5a78b10d16a1988f97aa3
SHA1 fc955a1ffa4d7ac778dd506b5204ae0a472ced07
SHA512 0836c2c74330915765e0e8b147ddaf225b87e6b2736ecc518a4c284cb74d97dfb44b3e7c1003fd8126a7f90a952ebf084c6c757141d5141b3c6de5ddce084454
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFfr:GezaTF8FcNkNdfE0pZ9oztFwIRsql
MD5 SHA1 SHA512 SSDEEP

Submit Download

yBQQKOJ.exe

Path C:\Windows\System\yBQQKOJ.exe
Size 1.0MB
SHA256 612cb811d6f5c19a837ca5d24d3090dbafa06c7fe5d10a326a6eb9c485e13d49
MD5 4fa4fbf7e87bab37c20e243061766e49
SHA1 5b7e7dee9b872bf55c03601bc4b8f1e5499467b5
SHA512 f2053d6b346374292a99f76d0f606da3b369d11894c14df65bd59dfca624526868a59f7ed0e6ceee29b59d4c57ffcb231dd0200a339d99928855c3eee655d9aa
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszs8WifFft:GezaTF8FcNkNdfE0pZ9oztFwIRsqz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1900-0-0x0000012731DE0000-0x0000012731DF0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads