xmrig | 27f9baa1bb67553edcbd318b3a247ed088a82561c15cdd3b8566313e094a1105

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 13:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
Size 1.6MB
Sample240612-p9qhwaware
SHA256 27f9baa1bb67553edcbd318b3a247ed088a82561c15cdd3b8566313e094a1105
MD5 3c8abe012610c66f314f22f44f089450
SHA1 b6cae7917aecf48a6a50bff72ae5b461632d6f4c
SHA512 de4e599e9e72c22610577e759811f51ea594ff665d8800d9c17177d37a1def8640f17fac9b155bf975025b98ad7c8a06e2528cbf5523a124e647c9e03fc88cb0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskm8:GemTLkNdfE0pZa9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/files/0x0006000000023298-4.dat	xmrig
behavioral2/files/0x000800000002342c-9.dat	xmrig
behavioral2/files/0x000700000002342e-19.dat	xmrig
behavioral2/files/0x000700000002342f-22.dat	xmrig
behavioral2/files/0x000700000002342d-15.dat	xmrig
behavioral2/files/0x0007000000023434-75.dat	xmrig
behavioral2/files/0x0007000000023446-128.dat	xmrig
behavioral2/files/0x0007000000023442-122.dat	xmrig
behavioral2/files/0x0007000000023440-161.dat	xmrig
behavioral2/files/0x000700000002343d-171.dat	xmrig
behavioral2/files/0x0007000000023452-170.dat	xmrig
behavioral2/files/0x0007000000023451-169.dat	xmrig
behavioral2/files/0x000700000002344c-167.dat	xmrig
behavioral2/files/0x0007000000023439-165.dat	xmrig
behavioral2/files/0x0007000000023450-164.dat	xmrig
behavioral2/files/0x000700000002344f-163.dat	xmrig
behavioral2/files/0x000700000002344e-160.dat	xmrig
behavioral2/files/0x000700000002343f-156.dat	xmrig
behavioral2/files/0x000700000002344d-152.dat	xmrig
behavioral2/files/0x000700000002343c-149.dat	xmrig
behavioral2/files/0x000700000002344b-145.dat	xmrig
behavioral2/files/0x000700000002344a-144.dat	xmrig
behavioral2/files/0x0007000000023449-143.dat	xmrig
behavioral2/files/0x0007000000023441-142.dat	xmrig
behavioral2/files/0x0007000000023448-136.dat	xmrig
behavioral2/files/0x000700000002343b-133.dat	xmrig
behavioral2/files/0x0007000000023447-131.dat	xmrig
behavioral2/files/0x000700000002343a-116.dat	xmrig
behavioral2/files/0x0007000000023445-127.dat	xmrig
behavioral2/files/0x0007000000023438-100.dat	xmrig
behavioral2/files/0x000700000002343e-96.dat	xmrig
behavioral2/files/0x0007000000023444-126.dat	xmrig
behavioral2/files/0x0007000000023443-123.dat	xmrig
behavioral2/files/0x0007000000023436-80.dat	xmrig
behavioral2/files/0x0007000000023435-79.dat	xmrig
behavioral2/files/0x0007000000023437-71.dat	xmrig
behavioral2/files/0x0007000000023433-61.dat	xmrig
behavioral2/files/0x0007000000023432-63.dat	xmrig
behavioral2/files/0x0007000000023431-54.dat	xmrig
behavioral2/files/0x0007000000023430-27.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4768	UuJeztl.exe
1840	gvADelD.exe
4044	ZQfkcOw.exe
4376	eZoZYsL.exe
4776	QzDInZi.exe
388	HMnaXfN.exe
2348	auagber.exe
468	oGPWYxk.exe
2088	yqMvPSv.exe
2524	bDtPtrj.exe
2956	xQwahKf.exe
976	oGIlLbu.exe
4024	QynfBgL.exe
2168	nsYfWrh.exe
2300	LxGenej.exe
4552	ADQbdOA.exe
1740	GTdcpOB.exe
2992	sJIohUO.exe
3308	ozvZLeu.exe
4448	LJMUBsV.exe
1316	IXkitjC.exe
2320	JFzvGje.exe
3132	lkpOSnV.exe
5076	OixJfqy.exe
3648	hTuychh.exe
4804	xpqvmjs.exe
1572	AHlMOkN.exe
2904	YkkNjaV.exe
4540	mQhPHlt.exe
3276	adWUyPQ.exe
4484	PkTNwlq.exe
3416	upJBTxO.exe
2728	QqATnTx.exe
3572	YSvdjRb.exe
4584	tYBWUby.exe
3312	SCLZYuE.exe
464	KMzhLlQ.exe
748	NkbCdWd.exe
1376	NYQlWem.exe
2732	uGAjyIh.exe
4332	ctoltyk.exe
2516	ZkZthyy.exe
4892	IpIhORY.exe
1964	lCXrjBQ.exe
2424	mqIIazW.exe
5040	OPvoLUg.exe
3580	pjCoUPj.exe
640	OTVhLgr.exe
3616	VcCtcXs.exe
3708	bbuDHgB.exe
2184	YaTxZFO.exe
536	hhrfpKj.exe
2156	mZsgniK.exe
4200	oLLhzhe.exe
624	rstPuid.exe
4412	aCNwhaq.exe
4476	eBpHFjf.exe
2444	GOmAeXE.exe
2872	gHChAwe.exe
5092	SPwiVZY.exe
2016	lbBTJyH.exe
1240	spmtWJm.exe
1516	LFLKCQE.exe
4852	mASMySc.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XvUWgbr.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\AbQOcTp.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\uZyCwlT.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\KEUSOxW.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\iqCUZUj.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\MkqrhOB.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\tCxiULB.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\qqYHROa.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\eCKZbHa.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\SCLZYuE.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\VMZDRBc.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\wmEYNgK.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\wTCLfYQ.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\uPOGyDq.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\UqiBAWA.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\YaJCgWa.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\bbuDHgB.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\OCUsgFG.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\TBvCktQ.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\uLgYhFX.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\XCHBXNS.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\IXpMdhk.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\qzHTzSP.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\ntDjyGF.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\uTCKxvW.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\ITiMkzI.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\ufTsMQy.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\RjljCEQ.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\tgPdpOA.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\HFfhSLD.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\LZBqtPU.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\mdatEaq.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\SoXfCzm.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\eNSZNpz.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\rCddEVs.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\GwUxsxo.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\ebbxqjL.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\FbKdXCe.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\afBfXMb.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\VzhMGJw.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\JAeVtzs.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\fkRUmoL.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\pgdWbim.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\XjvEdLH.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\dfDMfrU.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\dJhhklE.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\vrNGgTe.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\bQZnHYJ.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\FMLigPN.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\OcxPomq.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\GGFsBxo.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\OeyYjwq.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\TAkeRtf.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\nwbrAzj.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\uaNipyV.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\ciLTZHP.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\VKxaxJP.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\NQkNTfy.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\BFWhDZJ.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\inQgJSf.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\EwdbZJq.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\zNqkMrD.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\jWDquRv.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
File created	C:\Windows\System\uryWEPg.exe	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16860	dwm.exe
Token: SeChangeNotifyPrivilege	16860	dwm.exe
Token: 33	16860	dwm.exe
Token: SeIncBasePriorityPrivilege	16860	dwm.exe
Token: SeShutdownPrivilege	16860	dwm.exe
Token: SeCreatePagefilePrivilege	16860	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 4768	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	81
PID 2120 wrote to memory of 4768	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	81
PID 2120 wrote to memory of 1840	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	82
PID 2120 wrote to memory of 1840	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	82
PID 2120 wrote to memory of 4044	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	83
PID 2120 wrote to memory of 4044	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	83
PID 2120 wrote to memory of 4376	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	84
PID 2120 wrote to memory of 4376	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	84
PID 2120 wrote to memory of 4776	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	85
PID 2120 wrote to memory of 4776	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	85
PID 2120 wrote to memory of 388	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	86
PID 2120 wrote to memory of 388	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	86
PID 2120 wrote to memory of 2348	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	87
PID 2120 wrote to memory of 2348	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	87
PID 2120 wrote to memory of 468	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	88
PID 2120 wrote to memory of 468	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	88
PID 2120 wrote to memory of 2088	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	89
PID 2120 wrote to memory of 2088	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	89
PID 2120 wrote to memory of 2524	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	90
PID 2120 wrote to memory of 2524	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	90
PID 2120 wrote to memory of 2956	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	91
PID 2120 wrote to memory of 2956	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	91
PID 2120 wrote to memory of 976	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	92
PID 2120 wrote to memory of 976	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	92
PID 2120 wrote to memory of 4024	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	93
PID 2120 wrote to memory of 4024	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	93
PID 2120 wrote to memory of 2168	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	94
PID 2120 wrote to memory of 2168	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	94
PID 2120 wrote to memory of 1740	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	95
PID 2120 wrote to memory of 1740	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	95
PID 2120 wrote to memory of 2300	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	97
PID 2120 wrote to memory of 2300	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	97
PID 2120 wrote to memory of 4552	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	98
PID 2120 wrote to memory of 4552	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	98
PID 2120 wrote to memory of 2992	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	99
PID 2120 wrote to memory of 2992	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	99
PID 2120 wrote to memory of 3308	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	100
PID 2120 wrote to memory of 3308	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	100
PID 2120 wrote to memory of 4448	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	101
PID 2120 wrote to memory of 4448	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	101
PID 2120 wrote to memory of 1316	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	102
PID 2120 wrote to memory of 1316	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	102
PID 2120 wrote to memory of 2320	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	103
PID 2120 wrote to memory of 2320	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	103
PID 2120 wrote to memory of 3276	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	104
PID 2120 wrote to memory of 3276	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	104
PID 2120 wrote to memory of 3132	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	105
PID 2120 wrote to memory of 3132	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	105
PID 2120 wrote to memory of 5076	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	106
PID 2120 wrote to memory of 5076	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	106
PID 2120 wrote to memory of 3648	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	107
PID 2120 wrote to memory of 3648	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	107
PID 2120 wrote to memory of 4804	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	108
PID 2120 wrote to memory of 4804	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	108
PID 2120 wrote to memory of 1572	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	109
PID 2120 wrote to memory of 1572	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	109
PID 2120 wrote to memory of 2904	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	110
PID 2120 wrote to memory of 2904	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	110
PID 2120 wrote to memory of 4540	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	111
PID 2120 wrote to memory of 4540	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	111
PID 2120 wrote to memory of 4484	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	112
PID 2120 wrote to memory of 4484	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	112
PID 2120 wrote to memory of 3416	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	113
PID 2120 wrote to memory of 3416	2120	3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3c8abe012610c66f314f22f44f089450_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\System\UuJeztl.exe
  C:\Windows\System\UuJeztl.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\gvADelD.exe
  C:\Windows\System\gvADelD.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\ZQfkcOw.exe
  C:\Windows\System\ZQfkcOw.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\eZoZYsL.exe
  C:\Windows\System\eZoZYsL.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\QzDInZi.exe
  C:\Windows\System\QzDInZi.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\HMnaXfN.exe
  C:\Windows\System\HMnaXfN.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\auagber.exe
  C:\Windows\System\auagber.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\oGPWYxk.exe
  C:\Windows\System\oGPWYxk.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\yqMvPSv.exe
  C:\Windows\System\yqMvPSv.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\bDtPtrj.exe
  C:\Windows\System\bDtPtrj.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\xQwahKf.exe
  C:\Windows\System\xQwahKf.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\oGIlLbu.exe
  C:\Windows\System\oGIlLbu.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\QynfBgL.exe
  C:\Windows\System\QynfBgL.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\nsYfWrh.exe
  C:\Windows\System\nsYfWrh.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\GTdcpOB.exe
  C:\Windows\System\GTdcpOB.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\LxGenej.exe
  C:\Windows\System\LxGenej.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\ADQbdOA.exe
  C:\Windows\System\ADQbdOA.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\sJIohUO.exe
  C:\Windows\System\sJIohUO.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\ozvZLeu.exe
  C:\Windows\System\ozvZLeu.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\LJMUBsV.exe
  C:\Windows\System\LJMUBsV.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\IXkitjC.exe
  C:\Windows\System\IXkitjC.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\JFzvGje.exe
  C:\Windows\System\JFzvGje.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\adWUyPQ.exe
  C:\Windows\System\adWUyPQ.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\lkpOSnV.exe
  C:\Windows\System\lkpOSnV.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\OixJfqy.exe
  C:\Windows\System\OixJfqy.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\hTuychh.exe
  C:\Windows\System\hTuychh.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\xpqvmjs.exe
  C:\Windows\System\xpqvmjs.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\AHlMOkN.exe
  C:\Windows\System\AHlMOkN.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\YkkNjaV.exe
  C:\Windows\System\YkkNjaV.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\mQhPHlt.exe
  C:\Windows\System\mQhPHlt.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\PkTNwlq.exe
  C:\Windows\System\PkTNwlq.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\upJBTxO.exe
  C:\Windows\System\upJBTxO.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\QqATnTx.exe
  C:\Windows\System\QqATnTx.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\YSvdjRb.exe
  C:\Windows\System\YSvdjRb.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\tYBWUby.exe
  C:\Windows\System\tYBWUby.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\SCLZYuE.exe
  C:\Windows\System\SCLZYuE.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\KMzhLlQ.exe
  C:\Windows\System\KMzhLlQ.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\NkbCdWd.exe
  C:\Windows\System\NkbCdWd.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\NYQlWem.exe
  C:\Windows\System\NYQlWem.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\uGAjyIh.exe
  C:\Windows\System\uGAjyIh.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\ctoltyk.exe
  C:\Windows\System\ctoltyk.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\ZkZthyy.exe
  C:\Windows\System\ZkZthyy.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\IpIhORY.exe
  C:\Windows\System\IpIhORY.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\lCXrjBQ.exe
  C:\Windows\System\lCXrjBQ.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\mqIIazW.exe
  C:\Windows\System\mqIIazW.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\OPvoLUg.exe
  C:\Windows\System\OPvoLUg.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\pjCoUPj.exe
  C:\Windows\System\pjCoUPj.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\OTVhLgr.exe
  C:\Windows\System\OTVhLgr.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\VcCtcXs.exe
  C:\Windows\System\VcCtcXs.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\bbuDHgB.exe
  C:\Windows\System\bbuDHgB.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\YaTxZFO.exe
  C:\Windows\System\YaTxZFO.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\hhrfpKj.exe
  C:\Windows\System\hhrfpKj.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\mZsgniK.exe
  C:\Windows\System\mZsgniK.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\oLLhzhe.exe
  C:\Windows\System\oLLhzhe.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\rstPuid.exe
  C:\Windows\System\rstPuid.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\aCNwhaq.exe
  C:\Windows\System\aCNwhaq.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\eBpHFjf.exe
  C:\Windows\System\eBpHFjf.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\GOmAeXE.exe
  C:\Windows\System\GOmAeXE.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\gHChAwe.exe
  C:\Windows\System\gHChAwe.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\SPwiVZY.exe
  C:\Windows\System\SPwiVZY.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\lbBTJyH.exe
  C:\Windows\System\lbBTJyH.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\spmtWJm.exe
  C:\Windows\System\spmtWJm.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\LFLKCQE.exe
  C:\Windows\System\LFLKCQE.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\mASMySc.exe
  C:\Windows\System\mASMySc.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\iVSYCLR.exe
  C:\Windows\System\iVSYCLR.exe
  2⤵
  PID:4440
- C:\Windows\System\wASOQWz.exe
  C:\Windows\System\wASOQWz.exe
  2⤵
  PID:64
- C:\Windows\System\gOsvLKO.exe
  C:\Windows\System\gOsvLKO.exe
  2⤵
  PID:3140
- C:\Windows\System\pgdWbim.exe
  C:\Windows\System\pgdWbim.exe
  2⤵
  PID:3344
- C:\Windows\System\iqCUZUj.exe
  C:\Windows\System\iqCUZUj.exe
  2⤵
  PID:2896
- C:\Windows\System\qMYDVvN.exe
  C:\Windows\System\qMYDVvN.exe
  2⤵
  PID:4672
- C:\Windows\System\EQNVPXV.exe
  C:\Windows\System\EQNVPXV.exe
  2⤵
  PID:1668
- C:\Windows\System\NVYlCTE.exe
  C:\Windows\System\NVYlCTE.exe
  2⤵
  PID:3272
- C:\Windows\System\OCUsgFG.exe
  C:\Windows\System\OCUsgFG.exe
  2⤵
  PID:3900
- C:\Windows\System\rpOzeQv.exe
  C:\Windows\System\rpOzeQv.exe
  2⤵
  PID:1436
- C:\Windows\System\SEnyJIO.exe
  C:\Windows\System\SEnyJIO.exe
  2⤵
  PID:3832
- C:\Windows\System\TRSkdie.exe
  C:\Windows\System\TRSkdie.exe
  2⤵
  PID:2152
- C:\Windows\System\ndSsCQd.exe
  C:\Windows\System\ndSsCQd.exe
  2⤵
  PID:4992
- C:\Windows\System\AkbGcwo.exe
  C:\Windows\System\AkbGcwo.exe
  2⤵
  PID:4812
- C:\Windows\System\QAVNUXI.exe
  C:\Windows\System\QAVNUXI.exe
  2⤵
  PID:3940
- C:\Windows\System\BzqwPoq.exe
  C:\Windows\System\BzqwPoq.exe
  2⤵
  PID:312
- C:\Windows\System\yrqGswS.exe
  C:\Windows\System\yrqGswS.exe
  2⤵
  PID:4392
- C:\Windows\System\kuTXTsn.exe
  C:\Windows\System\kuTXTsn.exe
  2⤵
  PID:3088
- C:\Windows\System\pDoeMKY.exe
  C:\Windows\System\pDoeMKY.exe
  2⤵
  PID:5124
- C:\Windows\System\rnPQScA.exe
  C:\Windows\System\rnPQScA.exe
  2⤵
  PID:5140
- C:\Windows\System\ZkLZazs.exe
  C:\Windows\System\ZkLZazs.exe
  2⤵
  PID:5156
- C:\Windows\System\AbxiRPA.exe
  C:\Windows\System\AbxiRPA.exe
  2⤵
  PID:5172
- C:\Windows\System\oJufXFU.exe
  C:\Windows\System\oJufXFU.exe
  2⤵
  PID:5188
- C:\Windows\System\zmSocXD.exe
  C:\Windows\System\zmSocXD.exe
  2⤵
  PID:5648
- C:\Windows\System\ncXwtis.exe
  C:\Windows\System\ncXwtis.exe
  2⤵
  PID:5676
- C:\Windows\System\WDFbbtb.exe
  C:\Windows\System\WDFbbtb.exe
  2⤵
  PID:5696
- C:\Windows\System\sFXIDQm.exe
  C:\Windows\System\sFXIDQm.exe
  2⤵
  PID:5712
- C:\Windows\System\vzpRgoQ.exe
  C:\Windows\System\vzpRgoQ.exe
  2⤵
  PID:5728
- C:\Windows\System\HqYVBVg.exe
  C:\Windows\System\HqYVBVg.exe
  2⤵
  PID:5744
- C:\Windows\System\kRSjafa.exe
  C:\Windows\System\kRSjafa.exe
  2⤵
  PID:5772
- C:\Windows\System\FejTamq.exe
  C:\Windows\System\FejTamq.exe
  2⤵
  PID:5796
- C:\Windows\System\TBlJDUi.exe
  C:\Windows\System\TBlJDUi.exe
  2⤵
  PID:5812
- C:\Windows\System\LFMRRmy.exe
  C:\Windows\System\LFMRRmy.exe
  2⤵
  PID:5844
- C:\Windows\System\yddJctM.exe
  C:\Windows\System\yddJctM.exe
  2⤵
  PID:5876
- C:\Windows\System\DMsSGem.exe
  C:\Windows\System\DMsSGem.exe
  2⤵
  PID:5908
- C:\Windows\System\OhbTKhp.exe
  C:\Windows\System\OhbTKhp.exe
  2⤵
  PID:5928
- C:\Windows\System\cFwpmsG.exe
  C:\Windows\System\cFwpmsG.exe
  2⤵
  PID:5956
- C:\Windows\System\mBIIFIm.exe
  C:\Windows\System\mBIIFIm.exe
  2⤵
  PID:5980
- C:\Windows\System\agRlCyH.exe
  C:\Windows\System\agRlCyH.exe
  2⤵
  PID:6016
- C:\Windows\System\CmtbwMS.exe
  C:\Windows\System\CmtbwMS.exe
  2⤵
  PID:6044
- C:\Windows\System\gjhMKsS.exe
  C:\Windows\System\gjhMKsS.exe
  2⤵
  PID:6080
- C:\Windows\System\xeRtjrh.exe
  C:\Windows\System\xeRtjrh.exe
  2⤵
  PID:6108
- C:\Windows\System\OYlparL.exe
  C:\Windows\System\OYlparL.exe
  2⤵
  PID:6140
- C:\Windows\System\XjvEdLH.exe
  C:\Windows\System\XjvEdLH.exe
  2⤵
  PID:1432
- C:\Windows\System\vuQiryJ.exe
  C:\Windows\System\vuQiryJ.exe
  2⤵
  PID:2428
- C:\Windows\System\atohtcF.exe
  C:\Windows\System\atohtcF.exe
  2⤵
  PID:2504
- C:\Windows\System\gshGlBD.exe
  C:\Windows\System\gshGlBD.exe
  2⤵
  PID:2148
- C:\Windows\System\IYveQaK.exe
  C:\Windows\System\IYveQaK.exe
  2⤵
  PID:3092
- C:\Windows\System\nYMyyVO.exe
  C:\Windows\System\nYMyyVO.exe
  2⤵
  PID:3028
- C:\Windows\System\NliHdqo.exe
  C:\Windows\System\NliHdqo.exe
  2⤵
  PID:1260
- C:\Windows\System\LoFTpHN.exe
  C:\Windows\System\LoFTpHN.exe
  2⤵
  PID:1968
- C:\Windows\System\zPScguf.exe
  C:\Windows\System\zPScguf.exe
  2⤵
  PID:1068
- C:\Windows\System\EuyXOCE.exe
  C:\Windows\System\EuyXOCE.exe
  2⤵
  PID:5148
- C:\Windows\System\xUtowGg.exe
  C:\Windows\System\xUtowGg.exe
  2⤵
  PID:5184
- C:\Windows\System\JjoAngU.exe
  C:\Windows\System\JjoAngU.exe
  2⤵
  PID:5380
- C:\Windows\System\ytcMbgp.exe
  C:\Windows\System\ytcMbgp.exe
  2⤵
  PID:5416
- C:\Windows\System\aVdtrGI.exe
  C:\Windows\System\aVdtrGI.exe
  2⤵
  PID:3300
- C:\Windows\System\UxAdKrX.exe
  C:\Windows\System\UxAdKrX.exe
  2⤵
  PID:5612
- C:\Windows\System\PPCVrSX.exe
  C:\Windows\System\PPCVrSX.exe
  2⤵
  PID:3568
- C:\Windows\System\NRuRojx.exe
  C:\Windows\System\NRuRojx.exe
  2⤵
  PID:3256
- C:\Windows\System\TCKsXaI.exe
  C:\Windows\System\TCKsXaI.exe
  2⤵
  PID:2448
- C:\Windows\System\NFpNRKu.exe
  C:\Windows\System\NFpNRKu.exe
  2⤵
  PID:3980
- C:\Windows\System\qvndWSx.exe
  C:\Windows\System\qvndWSx.exe
  2⤵
  PID:1736
- C:\Windows\System\zYMILVk.exe
  C:\Windows\System\zYMILVk.exe
  2⤵
  PID:2824
- C:\Windows\System\uhuLKvb.exe
  C:\Windows\System\uhuLKvb.exe
  2⤵
  PID:772
- C:\Windows\System\oUFkIsi.exe
  C:\Windows\System\oUFkIsi.exe
  2⤵
  PID:5656
- C:\Windows\System\MPMkQmn.exe
  C:\Windows\System\MPMkQmn.exe
  2⤵
  PID:5464
- C:\Windows\System\ajKwjGD.exe
  C:\Windows\System\ajKwjGD.exe
  2⤵
  PID:5640
- C:\Windows\System\APmsajg.exe
  C:\Windows\System\APmsajg.exe
  2⤵
  PID:5760
- C:\Windows\System\dJYlUSb.exe
  C:\Windows\System\dJYlUSb.exe
  2⤵
  PID:5780
- C:\Windows\System\dLLzTjQ.exe
  C:\Windows\System\dLLzTjQ.exe
  2⤵
  PID:5892
- C:\Windows\System\HfeGzJk.exe
  C:\Windows\System\HfeGzJk.exe
  2⤵
  PID:6004
- C:\Windows\System\xlnaNXA.exe
  C:\Windows\System\xlnaNXA.exe
  2⤵
  PID:5964
- C:\Windows\System\cKpXZYm.exe
  C:\Windows\System\cKpXZYm.exe
  2⤵
  PID:6072
- C:\Windows\System\UOzJifY.exe
  C:\Windows\System\UOzJifY.exe
  2⤵
  PID:4860
- C:\Windows\System\dfDMfrU.exe
  C:\Windows\System\dfDMfrU.exe
  2⤵
  PID:2284
- C:\Windows\System\rdSbeBG.exe
  C:\Windows\System\rdSbeBG.exe
  2⤵
  PID:3248
- C:\Windows\System\kfJtLXw.exe
  C:\Windows\System\kfJtLXw.exe
  2⤵
  PID:1720
- C:\Windows\System\FdsovfJ.exe
  C:\Windows\System\FdsovfJ.exe
  2⤵
  PID:228
- C:\Windows\System\kcHoqzs.exe
  C:\Windows\System\kcHoqzs.exe
  2⤵
  PID:5224
- C:\Windows\System\iLPndPF.exe
  C:\Windows\System\iLPndPF.exe
  2⤵
  PID:3984
- C:\Windows\System\gFssYgJ.exe
  C:\Windows\System\gFssYgJ.exe
  2⤵
  PID:4492
- C:\Windows\System\jxnNsnV.exe
  C:\Windows\System\jxnNsnV.exe
  2⤵
  PID:3084
- C:\Windows\System\TBvCktQ.exe
  C:\Windows\System\TBvCktQ.exe
  2⤵
  PID:2616
- C:\Windows\System\CvgoWny.exe
  C:\Windows\System\CvgoWny.exe
  2⤵
  PID:5628
- C:\Windows\System\usSFwGH.exe
  C:\Windows\System\usSFwGH.exe
  2⤵
  PID:3856
- C:\Windows\System\ZqGrMey.exe
  C:\Windows\System\ZqGrMey.exe
  2⤵
  PID:5832
- C:\Windows\System\RPyKyns.exe
  C:\Windows\System\RPyKyns.exe
  2⤵
  PID:6024
- C:\Windows\System\zVhQbkQ.exe
  C:\Windows\System\zVhQbkQ.exe
  2⤵
  PID:3284
- C:\Windows\System\IAGkIFy.exe
  C:\Windows\System\IAGkIFy.exe
  2⤵
  PID:60
- C:\Windows\System\bceXXCH.exe
  C:\Windows\System\bceXXCH.exe
  2⤵
  PID:5216
- C:\Windows\System\mggDwSk.exe
  C:\Windows\System\mggDwSk.exe
  2⤵
  PID:1640
- C:\Windows\System\EeGACXP.exe
  C:\Windows\System\EeGACXP.exe
  2⤵
  PID:5708
- C:\Windows\System\wHGNiCd.exe
  C:\Windows\System\wHGNiCd.exe
  2⤵
  PID:6092
- C:\Windows\System\yoDjaRs.exe
  C:\Windows\System\yoDjaRs.exe
  2⤵
  PID:1344
- C:\Windows\System\hAataHG.exe
  C:\Windows\System\hAataHG.exe
  2⤵
  PID:5952
- C:\Windows\System\wYwxHDd.exe
  C:\Windows\System\wYwxHDd.exe
  2⤵
  PID:4360
- C:\Windows\System\UFFtURG.exe
  C:\Windows\System\UFFtURG.exe
  2⤵
  PID:6156
- C:\Windows\System\ZepRqsV.exe
  C:\Windows\System\ZepRqsV.exe
  2⤵
  PID:6172
- C:\Windows\System\pAwlQam.exe
  C:\Windows\System\pAwlQam.exe
  2⤵
  PID:6188
- C:\Windows\System\LNjIgDa.exe
  C:\Windows\System\LNjIgDa.exe
  2⤵
  PID:6204
- C:\Windows\System\SlMPHrk.exe
  C:\Windows\System\SlMPHrk.exe
  2⤵
  PID:6232
- C:\Windows\System\SFotudV.exe
  C:\Windows\System\SFotudV.exe
  2⤵
  PID:6260
- C:\Windows\System\GEcDbQk.exe
  C:\Windows\System\GEcDbQk.exe
  2⤵
  PID:6288
- C:\Windows\System\mFfhXNi.exe
  C:\Windows\System\mFfhXNi.exe
  2⤵
  PID:6324
- C:\Windows\System\bKjckkY.exe
  C:\Windows\System\bKjckkY.exe
  2⤵
  PID:6344
- C:\Windows\System\JVFzNSl.exe
  C:\Windows\System\JVFzNSl.exe
  2⤵
  PID:6372
- C:\Windows\System\wTCLfYQ.exe
  C:\Windows\System\wTCLfYQ.exe
  2⤵
  PID:6396
- C:\Windows\System\BodXaUc.exe
  C:\Windows\System\BodXaUc.exe
  2⤵
  PID:6420
- C:\Windows\System\OjgfMic.exe
  C:\Windows\System\OjgfMic.exe
  2⤵
  PID:6444
- C:\Windows\System\HFVtqNw.exe
  C:\Windows\System\HFVtqNw.exe
  2⤵
  PID:6476
- C:\Windows\System\jvzOhRJ.exe
  C:\Windows\System\jvzOhRJ.exe
  2⤵
  PID:6504
- C:\Windows\System\tFFnYKO.exe
  C:\Windows\System\tFFnYKO.exe
  2⤵
  PID:6532
- C:\Windows\System\cRUGJUk.exe
  C:\Windows\System\cRUGJUk.exe
  2⤵
  PID:6564
- C:\Windows\System\IXpMdhk.exe
  C:\Windows\System\IXpMdhk.exe
  2⤵
  PID:6596
- C:\Windows\System\jBhaBlM.exe
  C:\Windows\System\jBhaBlM.exe
  2⤵
  PID:6624
- C:\Windows\System\iAWkjiK.exe
  C:\Windows\System\iAWkjiK.exe
  2⤵
  PID:6640
- C:\Windows\System\UWSshNY.exe
  C:\Windows\System\UWSshNY.exe
  2⤵
  PID:6668
- C:\Windows\System\ViSbVnd.exe
  C:\Windows\System\ViSbVnd.exe
  2⤵
  PID:6696
- C:\Windows\System\DbgvIiF.exe
  C:\Windows\System\DbgvIiF.exe
  2⤵
  PID:6716
- C:\Windows\System\NBsvxDX.exe
  C:\Windows\System\NBsvxDX.exe
  2⤵
  PID:6740
- C:\Windows\System\GhIIcvA.exe
  C:\Windows\System\GhIIcvA.exe
  2⤵
  PID:6764
- C:\Windows\System\fwYtkwV.exe
  C:\Windows\System\fwYtkwV.exe
  2⤵
  PID:6796
- C:\Windows\System\CwDSvol.exe
  C:\Windows\System\CwDSvol.exe
  2⤵
  PID:6824
- C:\Windows\System\VDAVHTx.exe
  C:\Windows\System\VDAVHTx.exe
  2⤵
  PID:6896
- C:\Windows\System\hQbBFQj.exe
  C:\Windows\System\hQbBFQj.exe
  2⤵
  PID:6932
- C:\Windows\System\sprlAWQ.exe
  C:\Windows\System\sprlAWQ.exe
  2⤵
  PID:6964
- C:\Windows\System\xiArPpc.exe
  C:\Windows\System\xiArPpc.exe
  2⤵
  PID:6988
- C:\Windows\System\ZMWIzhH.exe
  C:\Windows\System\ZMWIzhH.exe
  2⤵
  PID:7008
- C:\Windows\System\ApqdfLt.exe
  C:\Windows\System\ApqdfLt.exe
  2⤵
  PID:7032
- C:\Windows\System\ZqZlUDw.exe
  C:\Windows\System\ZqZlUDw.exe
  2⤵
  PID:7060
- C:\Windows\System\WWeDYhq.exe
  C:\Windows\System\WWeDYhq.exe
  2⤵
  PID:7088
- C:\Windows\System\LhQSVzV.exe
  C:\Windows\System\LhQSVzV.exe
  2⤵
  PID:7116
- C:\Windows\System\mNAEoXW.exe
  C:\Windows\System\mNAEoXW.exe
  2⤵
  PID:7144
- C:\Windows\System\oWRXERp.exe
  C:\Windows\System\oWRXERp.exe
  2⤵
  PID:6168
- C:\Windows\System\aaxDyXH.exe
  C:\Windows\System\aaxDyXH.exe
  2⤵
  PID:6220
- C:\Windows\System\HFfhSLD.exe
  C:\Windows\System\HFfhSLD.exe
  2⤵
  PID:6316
- C:\Windows\System\BFWhDZJ.exe
  C:\Windows\System\BFWhDZJ.exe
  2⤵
  PID:6360
- C:\Windows\System\HCmXLCr.exe
  C:\Windows\System\HCmXLCr.exe
  2⤵
  PID:6408
- C:\Windows\System\xykRiWg.exe
  C:\Windows\System\xykRiWg.exe
  2⤵
  PID:6488
- C:\Windows\System\TAkeRtf.exe
  C:\Windows\System\TAkeRtf.exe
  2⤵
  PID:6496
- C:\Windows\System\bbYGiwu.exe
  C:\Windows\System\bbYGiwu.exe
  2⤵
  PID:6528
- C:\Windows\System\pWrHfcT.exe
  C:\Windows\System\pWrHfcT.exe
  2⤵
  PID:6692
- C:\Windows\System\TSZUwpj.exe
  C:\Windows\System\TSZUwpj.exe
  2⤵
  PID:6752
- C:\Windows\System\scsxZxa.exe
  C:\Windows\System\scsxZxa.exe
  2⤵
  PID:6776
- C:\Windows\System\lGilAcS.exe
  C:\Windows\System\lGilAcS.exe
  2⤵
  PID:6888
- C:\Windows\System\mmEkHby.exe
  C:\Windows\System\mmEkHby.exe
  2⤵
  PID:6960
- C:\Windows\System\QfuAORy.exe
  C:\Windows\System\QfuAORy.exe
  2⤵
  PID:6972
- C:\Windows\System\JAeVtzs.exe
  C:\Windows\System\JAeVtzs.exe
  2⤵
  PID:7100
- C:\Windows\System\Xirekqs.exe
  C:\Windows\System\Xirekqs.exe
  2⤵
  PID:7160
- C:\Windows\System\pjChiMp.exe
  C:\Windows\System\pjChiMp.exe
  2⤵
  PID:6252
- C:\Windows\System\oyHixLK.exe
  C:\Windows\System\oyHixLK.exe
  2⤵
  PID:6304
- C:\Windows\System\NHiGVwx.exe
  C:\Windows\System\NHiGVwx.exe
  2⤵
  PID:6584
- C:\Windows\System\TEFDYlH.exe
  C:\Windows\System\TEFDYlH.exe
  2⤵
  PID:6728
- C:\Windows\System\LUXKhDM.exe
  C:\Windows\System\LUXKhDM.exe
  2⤵
  PID:6944
- C:\Windows\System\aZqOnaa.exe
  C:\Windows\System\aZqOnaa.exe
  2⤵
  PID:7156
- C:\Windows\System\khhPhyC.exe
  C:\Windows\System\khhPhyC.exe
  2⤵
  PID:6468
- C:\Windows\System\gtjELER.exe
  C:\Windows\System\gtjELER.exe
  2⤵
  PID:6524
- C:\Windows\System\BWrgaqQ.exe
  C:\Windows\System\BWrgaqQ.exe
  2⤵
  PID:7072
- C:\Windows\System\DtxLffd.exe
  C:\Windows\System\DtxLffd.exe
  2⤵
  PID:7112
- C:\Windows\System\FwozKyN.exe
  C:\Windows\System\FwozKyN.exe
  2⤵
  PID:7188
- C:\Windows\System\XgXTeBa.exe
  C:\Windows\System\XgXTeBa.exe
  2⤵
  PID:7208
- C:\Windows\System\kGPsqCI.exe
  C:\Windows\System\kGPsqCI.exe
  2⤵
  PID:7224
- C:\Windows\System\ycMRbyq.exe
  C:\Windows\System\ycMRbyq.exe
  2⤵
  PID:7256
- C:\Windows\System\SvcGQuz.exe
  C:\Windows\System\SvcGQuz.exe
  2⤵
  PID:7292
- C:\Windows\System\YRcLNlR.exe
  C:\Windows\System\YRcLNlR.exe
  2⤵
  PID:7324
- C:\Windows\System\IOUTvuE.exe
  C:\Windows\System\IOUTvuE.exe
  2⤵
  PID:7344
- C:\Windows\System\DwUxyYN.exe
  C:\Windows\System\DwUxyYN.exe
  2⤵
  PID:7368
- C:\Windows\System\vbUWBYE.exe
  C:\Windows\System\vbUWBYE.exe
  2⤵
  PID:7396
- C:\Windows\System\ooGKQBH.exe
  C:\Windows\System\ooGKQBH.exe
  2⤵
  PID:7424
- C:\Windows\System\YAyZnBY.exe
  C:\Windows\System\YAyZnBY.exe
  2⤵
  PID:7456
- C:\Windows\System\MAEqCeW.exe
  C:\Windows\System\MAEqCeW.exe
  2⤵
  PID:7488
- C:\Windows\System\EnEnMPb.exe
  C:\Windows\System\EnEnMPb.exe
  2⤵
  PID:7512
- C:\Windows\System\gswqUmN.exe
  C:\Windows\System\gswqUmN.exe
  2⤵
  PID:7528
- C:\Windows\System\EqDpYcL.exe
  C:\Windows\System\EqDpYcL.exe
  2⤵
  PID:7552
- C:\Windows\System\KYoaYDj.exe
  C:\Windows\System\KYoaYDj.exe
  2⤵
  PID:7572
- C:\Windows\System\dJhhklE.exe
  C:\Windows\System\dJhhklE.exe
  2⤵
  PID:7612
- C:\Windows\System\XPLcJnu.exe
  C:\Windows\System\XPLcJnu.exe
  2⤵
  PID:7636
- C:\Windows\System\NZCMLkP.exe
  C:\Windows\System\NZCMLkP.exe
  2⤵
  PID:7660
- C:\Windows\System\inQgJSf.exe
  C:\Windows\System\inQgJSf.exe
  2⤵
  PID:7692
- C:\Windows\System\cwnBDHL.exe
  C:\Windows\System\cwnBDHL.exe
  2⤵
  PID:7716
- C:\Windows\System\aDPRfna.exe
  C:\Windows\System\aDPRfna.exe
  2⤵
  PID:7748
- C:\Windows\System\FdPfXVG.exe
  C:\Windows\System\FdPfXVG.exe
  2⤵
  PID:7780
- C:\Windows\System\IPWljID.exe
  C:\Windows\System\IPWljID.exe
  2⤵
  PID:7812
- C:\Windows\System\nwbrAzj.exe
  C:\Windows\System\nwbrAzj.exe
  2⤵
  PID:7840
- C:\Windows\System\hYSLaTe.exe
  C:\Windows\System\hYSLaTe.exe
  2⤵
  PID:7868
- C:\Windows\System\rYrjLRq.exe
  C:\Windows\System\rYrjLRq.exe
  2⤵
  PID:7904
- C:\Windows\System\GDnYcHN.exe
  C:\Windows\System\GDnYcHN.exe
  2⤵
  PID:7924
- C:\Windows\System\QXsBFzO.exe
  C:\Windows\System\QXsBFzO.exe
  2⤵
  PID:7948
- C:\Windows\System\UQVbGBy.exe
  C:\Windows\System\UQVbGBy.exe
  2⤵
  PID:7972
- C:\Windows\System\pbDfCMQ.exe
  C:\Windows\System\pbDfCMQ.exe
  2⤵
  PID:8004
- C:\Windows\System\ouKFiwL.exe
  C:\Windows\System\ouKFiwL.exe
  2⤵
  PID:8028
- C:\Windows\System\PsmaUec.exe
  C:\Windows\System\PsmaUec.exe
  2⤵
  PID:8056
- C:\Windows\System\BZwghlg.exe
  C:\Windows\System\BZwghlg.exe
  2⤵
  PID:8080
- C:\Windows\System\uQoVTfd.exe
  C:\Windows\System\uQoVTfd.exe
  2⤵
  PID:8104
- C:\Windows\System\dBRPtJK.exe
  C:\Windows\System\dBRPtJK.exe
  2⤵
  PID:8136
- C:\Windows\System\LGMUGCt.exe
  C:\Windows\System\LGMUGCt.exe
  2⤵
  PID:8164
- C:\Windows\System\lakdAqn.exe
  C:\Windows\System\lakdAqn.exe
  2⤵
  PID:6560
- C:\Windows\System\ylSXhVL.exe
  C:\Windows\System\ylSXhVL.exe
  2⤵
  PID:7204
- C:\Windows\System\FPubEVR.exe
  C:\Windows\System\FPubEVR.exe
  2⤵
  PID:7240
- C:\Windows\System\PFZtEhb.exe
  C:\Windows\System\PFZtEhb.exe
  2⤵
  PID:7316
- C:\Windows\System\UzLbwaX.exe
  C:\Windows\System\UzLbwaX.exe
  2⤵
  PID:7408
- C:\Windows\System\zAFQKos.exe
  C:\Windows\System\zAFQKos.exe
  2⤵
  PID:7472
- C:\Windows\System\YpIbJYx.exe
  C:\Windows\System\YpIbJYx.exe
  2⤵
  PID:7520
- C:\Windows\System\xFobueQ.exe
  C:\Windows\System\xFobueQ.exe
  2⤵
  PID:7648
- C:\Windows\System\EXeMecp.exe
  C:\Windows\System\EXeMecp.exe
  2⤵
  PID:7540
- C:\Windows\System\ogOYfcv.exe
  C:\Windows\System\ogOYfcv.exe
  2⤵
  PID:7712
- C:\Windows\System\uCtnIrV.exe
  C:\Windows\System\uCtnIrV.exe
  2⤵
  PID:7764
- C:\Windows\System\SIoYXZQ.exe
  C:\Windows\System\SIoYXZQ.exe
  2⤵
  PID:7856
- C:\Windows\System\KtKgDUe.exe
  C:\Windows\System\KtKgDUe.exe
  2⤵
  PID:7968
- C:\Windows\System\NhumgQn.exe
  C:\Windows\System\NhumgQn.exe
  2⤵
  PID:7960
- C:\Windows\System\tRhLSPq.exe
  C:\Windows\System\tRhLSPq.exe
  2⤵
  PID:8100
- C:\Windows\System\kYONeUN.exe
  C:\Windows\System\kYONeUN.exe
  2⤵
  PID:8092
- C:\Windows\System\iHsHQoW.exe
  C:\Windows\System\iHsHQoW.exe
  2⤵
  PID:8160
- C:\Windows\System\EwdbZJq.exe
  C:\Windows\System\EwdbZJq.exe
  2⤵
  PID:7364
- C:\Windows\System\vrNGgTe.exe
  C:\Windows\System\vrNGgTe.exe
  2⤵
  PID:7444
- C:\Windows\System\GZagJzg.exe
  C:\Windows\System\GZagJzg.exe
  2⤵
  PID:7740
- C:\Windows\System\ylaZWtU.exe
  C:\Windows\System\ylaZWtU.exe
  2⤵
  PID:7964
- C:\Windows\System\HXlcWVR.exe
  C:\Windows\System\HXlcWVR.exe
  2⤵
  PID:8112
- C:\Windows\System\yqdrYEC.exe
  C:\Windows\System\yqdrYEC.exe
  2⤵
  PID:8016
- C:\Windows\System\uVqAnUp.exe
  C:\Windows\System\uVqAnUp.exe
  2⤵
  PID:7300
- C:\Windows\System\RLScAMb.exe
  C:\Windows\System\RLScAMb.exe
  2⤵
  PID:7776
- C:\Windows\System\DZXOCBF.exe
  C:\Windows\System\DZXOCBF.exe
  2⤵
  PID:8156
- C:\Windows\System\OoepbOU.exe
  C:\Windows\System\OoepbOU.exe
  2⤵
  PID:8212
- C:\Windows\System\wMAtSQH.exe
  C:\Windows\System\wMAtSQH.exe
  2⤵
  PID:8240
- C:\Windows\System\jhWJTef.exe
  C:\Windows\System\jhWJTef.exe
  2⤵
  PID:8264
- C:\Windows\System\bgmtwVn.exe
  C:\Windows\System\bgmtwVn.exe
  2⤵
  PID:8296
- C:\Windows\System\ebbxqjL.exe
  C:\Windows\System\ebbxqjL.exe
  2⤵
  PID:8324
- C:\Windows\System\qzHTzSP.exe
  C:\Windows\System\qzHTzSP.exe
  2⤵
  PID:8348
- C:\Windows\System\dGHYfNC.exe
  C:\Windows\System\dGHYfNC.exe
  2⤵
  PID:8384
- C:\Windows\System\VDHyptV.exe
  C:\Windows\System\VDHyptV.exe
  2⤵
  PID:8416
- C:\Windows\System\ZLGODhV.exe
  C:\Windows\System\ZLGODhV.exe
  2⤵
  PID:8448
- C:\Windows\System\vZsRYJY.exe
  C:\Windows\System\vZsRYJY.exe
  2⤵
  PID:8468
- C:\Windows\System\ntDjyGF.exe
  C:\Windows\System\ntDjyGF.exe
  2⤵
  PID:8504
- C:\Windows\System\rxwFMIB.exe
  C:\Windows\System\rxwFMIB.exe
  2⤵
  PID:8532
- C:\Windows\System\GJbrmvy.exe
  C:\Windows\System\GJbrmvy.exe
  2⤵
  PID:8560
- C:\Windows\System\QhYvsSd.exe
  C:\Windows\System\QhYvsSd.exe
  2⤵
  PID:8600
- C:\Windows\System\cWInwlr.exe
  C:\Windows\System\cWInwlr.exe
  2⤵
  PID:8632
- C:\Windows\System\QLmmDoQ.exe
  C:\Windows\System\QLmmDoQ.exe
  2⤵
  PID:8660
- C:\Windows\System\CoPZRyF.exe
  C:\Windows\System\CoPZRyF.exe
  2⤵
  PID:8684
- C:\Windows\System\rWidLqj.exe
  C:\Windows\System\rWidLqj.exe
  2⤵
  PID:8712
- C:\Windows\System\KMUBaVR.exe
  C:\Windows\System\KMUBaVR.exe
  2⤵
  PID:8736
- C:\Windows\System\yNVoXXG.exe
  C:\Windows\System\yNVoXXG.exe
  2⤵
  PID:8772
- C:\Windows\System\QqbMztb.exe
  C:\Windows\System\QqbMztb.exe
  2⤵
  PID:8800
- C:\Windows\System\MzeJubs.exe
  C:\Windows\System\MzeJubs.exe
  2⤵
  PID:8828
- C:\Windows\System\zBrQeKZ.exe
  C:\Windows\System\zBrQeKZ.exe
  2⤵
  PID:8852
- C:\Windows\System\qcQJOUe.exe
  C:\Windows\System\qcQJOUe.exe
  2⤵
  PID:8880
- C:\Windows\System\CdNmhbm.exe
  C:\Windows\System\CdNmhbm.exe
  2⤵
  PID:8920
- C:\Windows\System\TQFscoZ.exe
  C:\Windows\System\TQFscoZ.exe
  2⤵
  PID:8948
- C:\Windows\System\xFhhJTz.exe
  C:\Windows\System\xFhhJTz.exe
  2⤵
  PID:8964
- C:\Windows\System\sCYoJXy.exe
  C:\Windows\System\sCYoJXy.exe
  2⤵
  PID:8996
- C:\Windows\System\JajXgMA.exe
  C:\Windows\System\JajXgMA.exe
  2⤵
  PID:9016
- C:\Windows\System\YUOYnUK.exe
  C:\Windows\System\YUOYnUK.exe
  2⤵
  PID:9032
- C:\Windows\System\pQvRUYn.exe
  C:\Windows\System\pQvRUYn.exe
  2⤵
  PID:9064
- C:\Windows\System\IyuyRIG.exe
  C:\Windows\System\IyuyRIG.exe
  2⤵
  PID:9092
- C:\Windows\System\bQZnHYJ.exe
  C:\Windows\System\bQZnHYJ.exe
  2⤵
  PID:9124
- C:\Windows\System\fkRUmoL.exe
  C:\Windows\System\fkRUmoL.exe
  2⤵
  PID:9148
- C:\Windows\System\bHBfdLS.exe
  C:\Windows\System\bHBfdLS.exe
  2⤵
  PID:9172
- C:\Windows\System\QHlYgIB.exe
  C:\Windows\System\QHlYgIB.exe
  2⤵
  PID:9196
- C:\Windows\System\bxJECAg.exe
  C:\Windows\System\bxJECAg.exe
  2⤵
  PID:7628
- C:\Windows\System\IZVRDqJ.exe
  C:\Windows\System\IZVRDqJ.exe
  2⤵
  PID:8248
- C:\Windows\System\gDfqJLu.exe
  C:\Windows\System\gDfqJLu.exe
  2⤵
  PID:8288
- C:\Windows\System\qkvkLXr.exe
  C:\Windows\System\qkvkLXr.exe
  2⤵
  PID:8336
- C:\Windows\System\xLZKojI.exe
  C:\Windows\System\xLZKojI.exe
  2⤵
  PID:8392
- C:\Windows\System\KhAaLVt.exe
  C:\Windows\System\KhAaLVt.exe
  2⤵
  PID:8492
- C:\Windows\System\ievjkIN.exe
  C:\Windows\System\ievjkIN.exe
  2⤵
  PID:8544
- C:\Windows\System\rMLksHu.exe
  C:\Windows\System\rMLksHu.exe
  2⤵
  PID:8668
- C:\Windows\System\hoIiVrY.exe
  C:\Windows\System\hoIiVrY.exe
  2⤵
  PID:2840
- C:\Windows\System\WcVIWzQ.exe
  C:\Windows\System\WcVIWzQ.exe
  2⤵
  PID:8780
- C:\Windows\System\wnLnfVW.exe
  C:\Windows\System\wnLnfVW.exe
  2⤵
  PID:8796
- C:\Windows\System\BFwWQRw.exe
  C:\Windows\System\BFwWQRw.exe
  2⤵
  PID:8864
- C:\Windows\System\jNvqvey.exe
  C:\Windows\System\jNvqvey.exe
  2⤵
  PID:8940
- C:\Windows\System\SxhkBHU.exe
  C:\Windows\System\SxhkBHU.exe
  2⤵
  PID:8992
- C:\Windows\System\sOMLAxe.exe
  C:\Windows\System\sOMLAxe.exe
  2⤵
  PID:9080
- C:\Windows\System\VSGOwlj.exe
  C:\Windows\System\VSGOwlj.exe
  2⤵
  PID:9116
- C:\Windows\System\ocnkBvT.exe
  C:\Windows\System\ocnkBvT.exe
  2⤵
  PID:9180
- C:\Windows\System\rBApmYG.exe
  C:\Windows\System\rBApmYG.exe
  2⤵
  PID:7484
- C:\Windows\System\kFkmxpu.exe
  C:\Windows\System\kFkmxpu.exe
  2⤵
  PID:8376
- C:\Windows\System\ZdQbcro.exe
  C:\Windows\System\ZdQbcro.exe
  2⤵
  PID:8436
- C:\Windows\System\jSatFYL.exe
  C:\Windows\System\jSatFYL.exe
  2⤵
  PID:8768
- C:\Windows\System\qzXQdUt.exe
  C:\Windows\System\qzXQdUt.exe
  2⤵
  PID:8844
- C:\Windows\System\CBATvlp.exe
  C:\Windows\System\CBATvlp.exe
  2⤵
  PID:8984
- C:\Windows\System\NgJRVDW.exe
  C:\Windows\System\NgJRVDW.exe
  2⤵
  PID:9120
- C:\Windows\System\wvLEdkX.exe
  C:\Windows\System\wvLEdkX.exe
  2⤵
  PID:8360
- C:\Windows\System\sMNVwnD.exe
  C:\Windows\System\sMNVwnD.exe
  2⤵
  PID:8788
- C:\Windows\System\qpeiKyy.exe
  C:\Windows\System\qpeiKyy.exe
  2⤵
  PID:9088
- C:\Windows\System\wjCdPeg.exe
  C:\Windows\System\wjCdPeg.exe
  2⤵
  PID:9204
- C:\Windows\System\FtMmiuP.exe
  C:\Windows\System\FtMmiuP.exe
  2⤵
  PID:9220
- C:\Windows\System\ZTLEKcb.exe
  C:\Windows\System\ZTLEKcb.exe
  2⤵
  PID:9248
- C:\Windows\System\XrHZbmX.exe
  C:\Windows\System\XrHZbmX.exe
  2⤵
  PID:9276
- C:\Windows\System\bgPqYMR.exe
  C:\Windows\System\bgPqYMR.exe
  2⤵
  PID:9308
- C:\Windows\System\pCWvyHm.exe
  C:\Windows\System\pCWvyHm.exe
  2⤵
  PID:9340
- C:\Windows\System\blbsJhz.exe
  C:\Windows\System\blbsJhz.exe
  2⤵
  PID:9360
- C:\Windows\System\dLjmaXe.exe
  C:\Windows\System\dLjmaXe.exe
  2⤵
  PID:9388
- C:\Windows\System\RZeuIiY.exe
  C:\Windows\System\RZeuIiY.exe
  2⤵
  PID:9432
- C:\Windows\System\DMmXvdt.exe
  C:\Windows\System\DMmXvdt.exe
  2⤵
  PID:9456
- C:\Windows\System\pDAVXUt.exe
  C:\Windows\System\pDAVXUt.exe
  2⤵
  PID:9476
- C:\Windows\System\eXZTyvn.exe
  C:\Windows\System\eXZTyvn.exe
  2⤵
  PID:9504
- C:\Windows\System\YdVtDTf.exe
  C:\Windows\System\YdVtDTf.exe
  2⤵
  PID:9528
- C:\Windows\System\XHBlyFo.exe
  C:\Windows\System\XHBlyFo.exe
  2⤵
  PID:9556
- C:\Windows\System\Amipscv.exe
  C:\Windows\System\Amipscv.exe
  2⤵
  PID:9588
- C:\Windows\System\HgfgpRn.exe
  C:\Windows\System\HgfgpRn.exe
  2⤵
  PID:9620
- C:\Windows\System\GhAEaXG.exe
  C:\Windows\System\GhAEaXG.exe
  2⤵
  PID:9656
- C:\Windows\System\vNIquUe.exe
  C:\Windows\System\vNIquUe.exe
  2⤵
  PID:9684
- C:\Windows\System\RPWeINo.exe
  C:\Windows\System\RPWeINo.exe
  2⤵
  PID:9712
- C:\Windows\System\nquWTkz.exe
  C:\Windows\System\nquWTkz.exe
  2⤵
  PID:9740
- C:\Windows\System\IvSWXuU.exe
  C:\Windows\System\IvSWXuU.exe
  2⤵
  PID:9768
- C:\Windows\System\QoZCVix.exe
  C:\Windows\System\QoZCVix.exe
  2⤵
  PID:9796
- C:\Windows\System\kfLgHAt.exe
  C:\Windows\System\kfLgHAt.exe
  2⤵
  PID:9824
- C:\Windows\System\CjPHVUi.exe
  C:\Windows\System\CjPHVUi.exe
  2⤵
  PID:9852
- C:\Windows\System\PrFHKqj.exe
  C:\Windows\System\PrFHKqj.exe
  2⤵
  PID:9884
- C:\Windows\System\kJqmFxM.exe
  C:\Windows\System\kJqmFxM.exe
  2⤵
  PID:9912
- C:\Windows\System\qNbiMgs.exe
  C:\Windows\System\qNbiMgs.exe
  2⤵
  PID:9936
- C:\Windows\System\BbCGQbk.exe
  C:\Windows\System\BbCGQbk.exe
  2⤵
  PID:9964
- C:\Windows\System\qiXpKVr.exe
  C:\Windows\System\qiXpKVr.exe
  2⤵
  PID:9996
- C:\Windows\System\TpDnSHc.exe
  C:\Windows\System\TpDnSHc.exe
  2⤵
  PID:10020
- C:\Windows\System\gYNnjBO.exe
  C:\Windows\System\gYNnjBO.exe
  2⤵
  PID:10048
- C:\Windows\System\xwYdiBl.exe
  C:\Windows\System\xwYdiBl.exe
  2⤵
  PID:10064
- C:\Windows\System\yIJJcye.exe
  C:\Windows\System\yIJJcye.exe
  2⤵
  PID:10100
- C:\Windows\System\youXrck.exe
  C:\Windows\System\youXrck.exe
  2⤵
  PID:10116
- C:\Windows\System\uLgYhFX.exe
  C:\Windows\System\uLgYhFX.exe
  2⤵
  PID:10144
- C:\Windows\System\mPuCEmw.exe
  C:\Windows\System\mPuCEmw.exe
  2⤵
  PID:10168
- C:\Windows\System\GcHigFh.exe
  C:\Windows\System\GcHigFh.exe
  2⤵
  PID:10220
- C:\Windows\System\DsQDFoD.exe
  C:\Windows\System\DsQDFoD.exe
  2⤵
  PID:8808
- C:\Windows\System\tzEYedp.exe
  C:\Windows\System\tzEYedp.exe
  2⤵
  PID:9256
- C:\Windows\System\FbKdXCe.exe
  C:\Windows\System\FbKdXCe.exe
  2⤵
  PID:9332
- C:\Windows\System\FMorujl.exe
  C:\Windows\System\FMorujl.exe
  2⤵
  PID:9440
- C:\Windows\System\mNGofKG.exe
  C:\Windows\System\mNGofKG.exe
  2⤵
  PID:9468
- C:\Windows\System\TRatzPp.exe
  C:\Windows\System\TRatzPp.exe
  2⤵
  PID:9572
- C:\Windows\System\yrUHahj.exe
  C:\Windows\System\yrUHahj.exe
  2⤵
  PID:9604
- C:\Windows\System\XHuoFSP.exe
  C:\Windows\System\XHuoFSP.exe
  2⤵
  PID:9704
- C:\Windows\System\tAkOWdY.exe
  C:\Windows\System\tAkOWdY.exe
  2⤵
  PID:9756
- C:\Windows\System\JVoAJfj.exe
  C:\Windows\System\JVoAJfj.exe
  2⤵
  PID:9816
- C:\Windows\System\SjYzchp.exe
  C:\Windows\System\SjYzchp.exe
  2⤵
  PID:9844
- C:\Windows\System\YjeBdxX.exe
  C:\Windows\System\YjeBdxX.exe
  2⤵
  PID:9948
- C:\Windows\System\rWuThZA.exe
  C:\Windows\System\rWuThZA.exe
  2⤵
  PID:9984
- C:\Windows\System\kygVoEG.exe
  C:\Windows\System\kygVoEG.exe
  2⤵
  PID:10036
- C:\Windows\System\XCHBXNS.exe
  C:\Windows\System\XCHBXNS.exe
  2⤵
  PID:10112
- C:\Windows\System\BloiPVn.exe
  C:\Windows\System\BloiPVn.exe
  2⤵
  PID:10196
- C:\Windows\System\heVWaVG.exe
  C:\Windows\System\heVWaVG.exe
  2⤵
  PID:9008
- C:\Windows\System\EljbthW.exe
  C:\Windows\System\EljbthW.exe
  2⤵
  PID:9296
- C:\Windows\System\xTcCzjE.exe
  C:\Windows\System\xTcCzjE.exe
  2⤵
  PID:9448
- C:\Windows\System\pjvMowA.exe
  C:\Windows\System\pjvMowA.exe
  2⤵
  PID:9616
- C:\Windows\System\gzPLpka.exe
  C:\Windows\System\gzPLpka.exe
  2⤵
  PID:9864
- C:\Windows\System\IFvghez.exe
  C:\Windows\System\IFvghez.exe
  2⤵
  PID:9976
- C:\Windows\System\invfvta.exe
  C:\Windows\System\invfvta.exe
  2⤵
  PID:10076
- C:\Windows\System\OfapMay.exe
  C:\Windows\System\OfapMay.exe
  2⤵
  PID:9244
- C:\Windows\System\tlknPCi.exe
  C:\Windows\System\tlknPCi.exe
  2⤵
  PID:9292
- C:\Windows\System\KdZxjSU.exe
  C:\Windows\System\KdZxjSU.exe
  2⤵
  PID:10236
- C:\Windows\System\pDdkIej.exe
  C:\Windows\System\pDdkIej.exe
  2⤵
  PID:9464
- C:\Windows\System\LuxJZNZ.exe
  C:\Windows\System\LuxJZNZ.exe
  2⤵
  PID:9780
- C:\Windows\System\yAUyvZN.exe
  C:\Windows\System\yAUyvZN.exe
  2⤵
  PID:10256
- C:\Windows\System\pHxNjJE.exe
  C:\Windows\System\pHxNjJE.exe
  2⤵
  PID:10284
- C:\Windows\System\AcytNLD.exe
  C:\Windows\System\AcytNLD.exe
  2⤵
  PID:10300
- C:\Windows\System\MjKWIza.exe
  C:\Windows\System\MjKWIza.exe
  2⤵
  PID:10328
- C:\Windows\System\GOhqmlS.exe
  C:\Windows\System\GOhqmlS.exe
  2⤵
  PID:10552
- C:\Windows\System\puELphW.exe
  C:\Windows\System\puELphW.exe
  2⤵
  PID:10572
- C:\Windows\System\fglRqzn.exe
  C:\Windows\System\fglRqzn.exe
  2⤵
  PID:10592
- C:\Windows\System\ECFbLGJ.exe
  C:\Windows\System\ECFbLGJ.exe
  2⤵
  PID:10608
- C:\Windows\System\CmrDpuh.exe
  C:\Windows\System\CmrDpuh.exe
  2⤵
  PID:10628
- C:\Windows\System\GxYSWav.exe
  C:\Windows\System\GxYSWav.exe
  2⤵
  PID:10652
- C:\Windows\System\yjxfqoU.exe
  C:\Windows\System\yjxfqoU.exe
  2⤵
  PID:10668
- C:\Windows\System\BWiktuo.exe
  C:\Windows\System\BWiktuo.exe
  2⤵
  PID:10684
- C:\Windows\System\CIqDDSf.exe
  C:\Windows\System\CIqDDSf.exe
  2⤵
  PID:10720
- C:\Windows\System\JACXSPp.exe
  C:\Windows\System\JACXSPp.exe
  2⤵
  PID:10748
- C:\Windows\System\FDmjzgs.exe
  C:\Windows\System\FDmjzgs.exe
  2⤵
  PID:10768
- C:\Windows\System\DuSQuEW.exe
  C:\Windows\System\DuSQuEW.exe
  2⤵
  PID:10804
- C:\Windows\System\QVGnVvz.exe
  C:\Windows\System\QVGnVvz.exe
  2⤵
  PID:10832
- C:\Windows\System\oQpXlnf.exe
  C:\Windows\System\oQpXlnf.exe
  2⤵
  PID:10852
- C:\Windows\System\cWaFeuY.exe
  C:\Windows\System\cWaFeuY.exe
  2⤵
  PID:10880
- C:\Windows\System\zXEcsQt.exe
  C:\Windows\System\zXEcsQt.exe
  2⤵
  PID:10920
- C:\Windows\System\jjrswZR.exe
  C:\Windows\System\jjrswZR.exe
  2⤵
  PID:10952
- C:\Windows\System\AOBGnAl.exe
  C:\Windows\System\AOBGnAl.exe
  2⤵
  PID:10972
- C:\Windows\System\UZjkJrg.exe
  C:\Windows\System\UZjkJrg.exe
  2⤵
  PID:11012
- C:\Windows\System\ibJKOOC.exe
  C:\Windows\System\ibJKOOC.exe
  2⤵
  PID:11036
- C:\Windows\System\rURqMcK.exe
  C:\Windows\System\rURqMcK.exe
  2⤵
  PID:11060
- C:\Windows\System\DlNJtOB.exe
  C:\Windows\System\DlNJtOB.exe
  2⤵
  PID:11076
- C:\Windows\System\mwYKtPM.exe
  C:\Windows\System\mwYKtPM.exe
  2⤵
  PID:11108
- C:\Windows\System\UMDdeQa.exe
  C:\Windows\System\UMDdeQa.exe
  2⤵
  PID:11136
- C:\Windows\System\HVTsQkW.exe
  C:\Windows\System\HVTsQkW.exe
  2⤵
  PID:11172
- C:\Windows\System\VmfQtuZ.exe
  C:\Windows\System\VmfQtuZ.exe
  2⤵
  PID:11192
- C:\Windows\System\jtFehRl.exe
  C:\Windows\System\jtFehRl.exe
  2⤵
  PID:11220
- C:\Windows\System\XvUWgbr.exe
  C:\Windows\System\XvUWgbr.exe
  2⤵
  PID:11248
- C:\Windows\System\HGJTZfi.exe
  C:\Windows\System\HGJTZfi.exe
  2⤵
  PID:10292
- C:\Windows\System\ETCCIoR.exe
  C:\Windows\System\ETCCIoR.exe
  2⤵
  PID:10344
- C:\Windows\System\tlybSAi.exe
  C:\Windows\System\tlybSAi.exe
  2⤵
  PID:10368
- C:\Windows\System\lMSgfyZ.exe
  C:\Windows\System\lMSgfyZ.exe
  2⤵
  PID:10396
- C:\Windows\System\FMLigPN.exe
  C:\Windows\System\FMLigPN.exe
  2⤵
  PID:10420
- C:\Windows\System\PKwvzhY.exe
  C:\Windows\System\PKwvzhY.exe
  2⤵
  PID:10456
- C:\Windows\System\YsFVBjY.exe
  C:\Windows\System\YsFVBjY.exe
  2⤵
  PID:10484
- C:\Windows\System\bTEPROo.exe
  C:\Windows\System\bTEPROo.exe
  2⤵
  PID:10508
- C:\Windows\System\LgQapMc.exe
  C:\Windows\System\LgQapMc.exe
  2⤵
  PID:10528
- C:\Windows\System\DGoEnsb.exe
  C:\Windows\System\DGoEnsb.exe
  2⤵
  PID:10564
- C:\Windows\System\KXvyaSE.exe
  C:\Windows\System\KXvyaSE.exe
  2⤵
  PID:10568
- C:\Windows\System\hTvaASM.exe
  C:\Windows\System\hTvaASM.exe
  2⤵
  PID:10680
- C:\Windows\System\YzLgTVq.exe
  C:\Windows\System\YzLgTVq.exe
  2⤵
  PID:10800
- C:\Windows\System\cxYTKAj.exe
  C:\Windows\System\cxYTKAj.exe
  2⤵
  PID:10896
- C:\Windows\System\fTlUerB.exe
  C:\Windows\System\fTlUerB.exe
  2⤵
  PID:10824
- C:\Windows\System\GMrlInI.exe
  C:\Windows\System\GMrlInI.exe
  2⤵
  PID:10984
- C:\Windows\System\dsTTRkI.exe
  C:\Windows\System\dsTTRkI.exe
  2⤵
  PID:10828
- C:\Windows\System\NLocDaW.exe
  C:\Windows\System\NLocDaW.exe
  2⤵
  PID:11152
- C:\Windows\System\urMGaKG.exe
  C:\Windows\System\urMGaKG.exe
  2⤵
  PID:11092
- C:\Windows\System\GSXeIqC.exe
  C:\Windows\System\GSXeIqC.exe
  2⤵
  PID:11184
- C:\Windows\System\uhqMjiK.exe
  C:\Windows\System\uhqMjiK.exe
  2⤵
  PID:9384
- C:\Windows\System\NHkpuWu.exe
  C:\Windows\System\NHkpuWu.exe
  2⤵
  PID:10476
- C:\Windows\System\kJLvtIr.exe
  C:\Windows\System\kJLvtIr.exe
  2⤵
  PID:10324
- C:\Windows\System\rkZGcrG.exe
  C:\Windows\System\rkZGcrG.exe
  2⤵
  PID:10412
- C:\Windows\System\ySXIDBO.exe
  C:\Windows\System\ySXIDBO.exe
  2⤵
  PID:10764
- C:\Windows\System\YTueGrP.exe
  C:\Windows\System\YTueGrP.exe
  2⤵
  PID:10932
- C:\Windows\System\nvhDxWO.exe
  C:\Windows\System\nvhDxWO.exe
  2⤵
  PID:10916
- C:\Windows\System\BMKUIoR.exe
  C:\Windows\System\BMKUIoR.exe
  2⤵
  PID:10276
- C:\Windows\System\ESKKZWW.exe
  C:\Windows\System\ESKKZWW.exe
  2⤵
  PID:11124
- C:\Windows\System\xLnUpJq.exe
  C:\Windows\System\xLnUpJq.exe
  2⤵
  PID:11212
- C:\Windows\System\bVcHDYu.exe
  C:\Windows\System\bVcHDYu.exe
  2⤵
  PID:11160
- C:\Windows\System\hYHzvff.exe
  C:\Windows\System\hYHzvff.exe
  2⤵
  PID:11276
- C:\Windows\System\euhSfJv.exe
  C:\Windows\System\euhSfJv.exe
  2⤵
  PID:11308
- C:\Windows\System\AEobtVv.exe
  C:\Windows\System\AEobtVv.exe
  2⤵
  PID:11340
- C:\Windows\System\lvSQCTS.exe
  C:\Windows\System\lvSQCTS.exe
  2⤵
  PID:11368
- C:\Windows\System\tgPdpOA.exe
  C:\Windows\System\tgPdpOA.exe
  2⤵
  PID:11388
- C:\Windows\System\KGkiUUY.exe
  C:\Windows\System\KGkiUUY.exe
  2⤵
  PID:11412
- C:\Windows\System\PMkGANp.exe
  C:\Windows\System\PMkGANp.exe
  2⤵
  PID:11444
- C:\Windows\System\odwliRV.exe
  C:\Windows\System\odwliRV.exe
  2⤵
  PID:11460
- C:\Windows\System\tjDueHf.exe
  C:\Windows\System\tjDueHf.exe
  2⤵
  PID:11492
- C:\Windows\System\uDSaeKJ.exe
  C:\Windows\System\uDSaeKJ.exe
  2⤵
  PID:11516
- C:\Windows\System\dXcoDZQ.exe
  C:\Windows\System\dXcoDZQ.exe
  2⤵
  PID:11548
- C:\Windows\System\mKHRYGF.exe
  C:\Windows\System\mKHRYGF.exe
  2⤵
  PID:11580
- C:\Windows\System\SSGudFE.exe
  C:\Windows\System\SSGudFE.exe
  2⤵
  PID:11612
- C:\Windows\System\EZTDNtM.exe
  C:\Windows\System\EZTDNtM.exe
  2⤵
  PID:11644
- C:\Windows\System\SoXfCzm.exe
  C:\Windows\System\SoXfCzm.exe
  2⤵
  PID:11672
- C:\Windows\System\BddXVhX.exe
  C:\Windows\System\BddXVhX.exe
  2⤵
  PID:11700
- C:\Windows\System\PUbtynQ.exe
  C:\Windows\System\PUbtynQ.exe
  2⤵
  PID:11720
- C:\Windows\System\eLePmWE.exe
  C:\Windows\System\eLePmWE.exe
  2⤵
  PID:11756
- C:\Windows\System\XpkyDmf.exe
  C:\Windows\System\XpkyDmf.exe
  2⤵
  PID:11780
- C:\Windows\System\ZNEAjpK.exe
  C:\Windows\System\ZNEAjpK.exe
  2⤵
  PID:11804
- C:\Windows\System\zhoQlAj.exe
  C:\Windows\System\zhoQlAj.exe
  2⤵
  PID:11836
- C:\Windows\System\BpkjfnK.exe
  C:\Windows\System\BpkjfnK.exe
  2⤵
  PID:11864
- C:\Windows\System\pHMUSBZ.exe
  C:\Windows\System\pHMUSBZ.exe
  2⤵
  PID:11900
- C:\Windows\System\gnypGhA.exe
  C:\Windows\System\gnypGhA.exe
  2⤵
  PID:11932
- C:\Windows\System\QehbjYr.exe
  C:\Windows\System\QehbjYr.exe
  2⤵
  PID:11956
- C:\Windows\System\TkxElTj.exe
  C:\Windows\System\TkxElTj.exe
  2⤵
  PID:11992
- C:\Windows\System\PZiiCWw.exe
  C:\Windows\System\PZiiCWw.exe
  2⤵
  PID:12020
- C:\Windows\System\vUopEME.exe
  C:\Windows\System\vUopEME.exe
  2⤵
  PID:12052
- C:\Windows\System\OcxPomq.exe
  C:\Windows\System\OcxPomq.exe
  2⤵
  PID:12080
- C:\Windows\System\dsmKfIR.exe
  C:\Windows\System\dsmKfIR.exe
  2⤵
  PID:12104
- C:\Windows\System\DGtsejJ.exe
  C:\Windows\System\DGtsejJ.exe
  2⤵
  PID:12136
- C:\Windows\System\MppUEiy.exe
  C:\Windows\System\MppUEiy.exe
  2⤵
  PID:12160
- C:\Windows\System\eKKUpZO.exe
  C:\Windows\System\eKKUpZO.exe
  2⤵
  PID:12192
- C:\Windows\System\cLxKzjv.exe
  C:\Windows\System\cLxKzjv.exe
  2⤵
  PID:12224
- C:\Windows\System\cQhMcJx.exe
  C:\Windows\System\cQhMcJx.exe
  2⤵
  PID:12256
- C:\Windows\System\BlvLmrv.exe
  C:\Windows\System\BlvLmrv.exe
  2⤵
  PID:10504
- C:\Windows\System\ZqoIAns.exe
  C:\Windows\System\ZqoIAns.exe
  2⤵
  PID:10968
- C:\Windows\System\afBfXMb.exe
  C:\Windows\System\afBfXMb.exe
  2⤵
  PID:11544
- C:\Windows\System\BvjyXZX.exe
  C:\Windows\System\BvjyXZX.exe
  2⤵
  PID:11400
- C:\Windows\System\GlvqPOX.exe
  C:\Windows\System\GlvqPOX.exe
  2⤵
  PID:11512
- C:\Windows\System\UnYYhCF.exe
  C:\Windows\System\UnYYhCF.exe
  2⤵
  PID:11600
- C:\Windows\System\deDupfB.exe
  C:\Windows\System\deDupfB.exe
  2⤵
  PID:11684
- C:\Windows\System\eGZRLaq.exe
  C:\Windows\System\eGZRLaq.exe
  2⤵
  PID:11628
- C:\Windows\System\qFMwCQN.exe
  C:\Windows\System\qFMwCQN.exe
  2⤵
  PID:11856
- C:\Windows\System\GGFsBxo.exe
  C:\Windows\System\GGFsBxo.exe
  2⤵
  PID:11860
- C:\Windows\System\uTCKxvW.exe
  C:\Windows\System\uTCKxvW.exe
  2⤵
  PID:12016
- C:\Windows\System\nKOiaWW.exe
  C:\Windows\System\nKOiaWW.exe
  2⤵
  PID:12012
- C:\Windows\System\zUluNGP.exe
  C:\Windows\System\zUluNGP.exe
  2⤵
  PID:12048
- C:\Windows\System\XSsOuTu.exe
  C:\Windows\System\XSsOuTu.exe
  2⤵
  PID:12180
- C:\Windows\System\DdeDMDJ.exe
  C:\Windows\System\DdeDMDJ.exe
  2⤵
  PID:12208
- C:\Windows\System\hQTTDPH.exe
  C:\Windows\System\hQTTDPH.exe
  2⤵
  PID:12276
- C:\Windows\System\iHeGWft.exe
  C:\Windows\System\iHeGWft.exe
  2⤵
  PID:10356
- C:\Windows\System\MtsEYEG.exe
  C:\Windows\System\MtsEYEG.exe
  2⤵
  PID:11476
- C:\Windows\System\JookRcB.exe
  C:\Windows\System\JookRcB.exe
  2⤵
  PID:11740
- C:\Windows\System\uPOGyDq.exe
  C:\Windows\System\uPOGyDq.exe
  2⤵
  PID:11732
- C:\Windows\System\CPuqUjc.exe
  C:\Windows\System\CPuqUjc.exe
  2⤵
  PID:11852
- C:\Windows\System\UiblhsV.exe
  C:\Windows\System\UiblhsV.exe
  2⤵
  PID:12036
- C:\Windows\System\QgAIwhd.exe
  C:\Windows\System\QgAIwhd.exe
  2⤵
  PID:11944
- C:\Windows\System\UqiBAWA.exe
  C:\Windows\System\UqiBAWA.exe
  2⤵
  PID:12244
- C:\Windows\System\hJHeeuy.exe
  C:\Windows\System\hJHeeuy.exe
  2⤵
  PID:10436
- C:\Windows\System\EbeHUql.exe
  C:\Windows\System\EbeHUql.exe
  2⤵
  PID:11564
- C:\Windows\System\GQTbYVp.exe
  C:\Windows\System\GQTbYVp.exe
  2⤵
  PID:11800
- C:\Windows\System\JUauFoC.exe
  C:\Windows\System\JUauFoC.exe
  2⤵
  PID:11820
- C:\Windows\System\XEWwHVW.exe
  C:\Windows\System\XEWwHVW.exe
  2⤵
  PID:12312
- C:\Windows\System\aDRdSae.exe
  C:\Windows\System\aDRdSae.exe
  2⤵
  PID:12348
- C:\Windows\System\IBEwVRA.exe
  C:\Windows\System\IBEwVRA.exe
  2⤵
  PID:12372
- C:\Windows\System\WYFBPXX.exe
  C:\Windows\System\WYFBPXX.exe
  2⤵
  PID:12400
- C:\Windows\System\bJAyiUJ.exe
  C:\Windows\System\bJAyiUJ.exe
  2⤵
  PID:12428
- C:\Windows\System\juZnqRF.exe
  C:\Windows\System\juZnqRF.exe
  2⤵
  PID:12452
- C:\Windows\System\hNuoeWj.exe
  C:\Windows\System\hNuoeWj.exe
  2⤵
  PID:12472
- C:\Windows\System\VMZDRBc.exe
  C:\Windows\System\VMZDRBc.exe
  2⤵
  PID:12504
- C:\Windows\System\nSerXyG.exe
  C:\Windows\System\nSerXyG.exe
  2⤵
  PID:12540
- C:\Windows\System\UdsNTDa.exe
  C:\Windows\System\UdsNTDa.exe
  2⤵
  PID:12564
- C:\Windows\System\WSTvZrE.exe
  C:\Windows\System\WSTvZrE.exe
  2⤵
  PID:12592
- C:\Windows\System\XODDUHV.exe
  C:\Windows\System\XODDUHV.exe
  2⤵
  PID:12620
- C:\Windows\System\fTyHwMm.exe
  C:\Windows\System\fTyHwMm.exe
  2⤵
  PID:12644
- C:\Windows\System\tsnHwtA.exe
  C:\Windows\System\tsnHwtA.exe
  2⤵
  PID:12684
- C:\Windows\System\RzkIniT.exe
  C:\Windows\System\RzkIniT.exe
  2⤵
  PID:12708
- C:\Windows\System\svmHlyD.exe
  C:\Windows\System\svmHlyD.exe
  2⤵
  PID:12744
- C:\Windows\System\gjvLwIc.exe
  C:\Windows\System\gjvLwIc.exe
  2⤵
  PID:12764
- C:\Windows\System\tOsqcEv.exe
  C:\Windows\System\tOsqcEv.exe
  2⤵
  PID:12796
- C:\Windows\System\lHLaiJo.exe
  C:\Windows\System\lHLaiJo.exe
  2⤵
  PID:12820
- C:\Windows\System\sifmJoR.exe
  C:\Windows\System\sifmJoR.exe
  2⤵
  PID:12848
- C:\Windows\System\wCLGbYD.exe
  C:\Windows\System\wCLGbYD.exe
  2⤵
  PID:12872
- C:\Windows\System\zNqkMrD.exe
  C:\Windows\System\zNqkMrD.exe
  2⤵
  PID:12904
- C:\Windows\System\xAhoTex.exe
  C:\Windows\System\xAhoTex.exe
  2⤵
  PID:12936
- C:\Windows\System\DSeQDKt.exe
  C:\Windows\System\DSeQDKt.exe
  2⤵
  PID:12972
- C:\Windows\System\QdBMzNe.exe
  C:\Windows\System\QdBMzNe.exe
  2⤵
  PID:13000
- C:\Windows\System\UutVQoR.exe
  C:\Windows\System\UutVQoR.exe
  2⤵
  PID:13032
- C:\Windows\System\PKzaiJw.exe
  C:\Windows\System\PKzaiJw.exe
  2⤵
  PID:13052
- C:\Windows\System\mOszssk.exe
  C:\Windows\System\mOszssk.exe
  2⤵
  PID:13072
- C:\Windows\System\FxOEjsA.exe
  C:\Windows\System\FxOEjsA.exe
  2⤵
  PID:13096
- C:\Windows\System\CGxhwcN.exe
  C:\Windows\System\CGxhwcN.exe
  2⤵
  PID:13124
- C:\Windows\System\nIEqetm.exe
  C:\Windows\System\nIEqetm.exe
  2⤵
  PID:13152
- C:\Windows\System\xkSkeUv.exe
  C:\Windows\System\xkSkeUv.exe
  2⤵
  PID:13188
- C:\Windows\System\QBlrUVJ.exe
  C:\Windows\System\QBlrUVJ.exe
  2⤵
  PID:13212
- C:\Windows\System\Qdgzian.exe
  C:\Windows\System\Qdgzian.exe
  2⤵
  PID:13244
- C:\Windows\System\yVfEioZ.exe
  C:\Windows\System\yVfEioZ.exe
  2⤵
  PID:13272
- C:\Windows\System\yoeLxEO.exe
  C:\Windows\System\yoeLxEO.exe
  2⤵
  PID:13300
- C:\Windows\System\NbxjxWk.exe
  C:\Windows\System\NbxjxWk.exe
  2⤵
  PID:12204
- C:\Windows\System\ZWrMXoT.exe
  C:\Windows\System\ZWrMXoT.exe
  2⤵
  PID:12340
- C:\Windows\System\GzzZPDM.exe
  C:\Windows\System\GzzZPDM.exe
  2⤵
  PID:12332
- C:\Windows\System\ofuDKFN.exe
  C:\Windows\System\ofuDKFN.exe
  2⤵
  PID:12424
- C:\Windows\System\TLhIbkA.exe
  C:\Windows\System\TLhIbkA.exe
  2⤵
  PID:12464
- C:\Windows\System\KKoWKxH.exe
  C:\Windows\System\KKoWKxH.exe
  2⤵
  PID:12628
- C:\Windows\System\YaJCgWa.exe
  C:\Windows\System\YaJCgWa.exe
  2⤵
  PID:12724
- C:\Windows\System\DOKetrS.exe
  C:\Windows\System\DOKetrS.exe
  2⤵
  PID:12664
- C:\Windows\System\fEWBgRV.exe
  C:\Windows\System\fEWBgRV.exe
  2⤵
  PID:12756
- C:\Windows\System\VzhMGJw.exe
  C:\Windows\System\VzhMGJw.exe
  2⤵
  PID:12864
- C:\Windows\System\BatGvbD.exe
  C:\Windows\System\BatGvbD.exe
  2⤵
  PID:12944
- C:\Windows\System\AyezoTw.exe
  C:\Windows\System\AyezoTw.exe
  2⤵
  PID:12956
- C:\Windows\System\FodmcgP.exe
  C:\Windows\System\FodmcgP.exe
  2⤵
  PID:13024
- C:\Windows\System\PUFheFC.exe
  C:\Windows\System\PUFheFC.exe
  2⤵
  PID:13028
- C:\Windows\System\ysSuxuJ.exe
  C:\Windows\System\ysSuxuJ.exe
  2⤵
  PID:13204
- C:\Windows\System\YyBsMJF.exe
  C:\Windows\System\YyBsMJF.exe
  2⤵
  PID:13180
- C:\Windows\System\LdaeKwj.exe
  C:\Windows\System\LdaeKwj.exe
  2⤵
  PID:13252
- C:\Windows\System\Liexaps.exe
  C:\Windows\System\Liexaps.exe
  2⤵
  PID:13296
- C:\Windows\System\arcJzpQ.exe
  C:\Windows\System\arcJzpQ.exe
  2⤵
  PID:12388
- C:\Windows\System\YBnSogp.exe
  C:\Windows\System\YBnSogp.exe
  2⤵
  PID:12420
- C:\Windows\System\ytFJbkm.exe
  C:\Windows\System\ytFJbkm.exe
  2⤵
  PID:12952
- C:\Windows\System\rnANHHC.exe
  C:\Windows\System\rnANHHC.exe
  2⤵
  PID:12892
- C:\Windows\System\aETnLKE.exe
  C:\Windows\System\aETnLKE.exe
  2⤵
  PID:13060
- C:\Windows\System\igENXXL.exe
  C:\Windows\System\igENXXL.exe
  2⤵
  PID:12576
- C:\Windows\System\MCkgKzJ.exe
  C:\Windows\System\MCkgKzJ.exe
  2⤵
  PID:13044
- C:\Windows\System\wFtMKRI.exe
  C:\Windows\System\wFtMKRI.exe
  2⤵
  PID:13120
- C:\Windows\System\DdrNkxw.exe
  C:\Windows\System\DdrNkxw.exe
  2⤵
  PID:12984
- C:\Windows\System\qwnLIIn.exe
  C:\Windows\System\qwnLIIn.exe
  2⤵
  PID:13332
- C:\Windows\System\ySIWDjU.exe
  C:\Windows\System\ySIWDjU.exe
  2⤵
  PID:13352
- C:\Windows\System\RybdawE.exe
  C:\Windows\System\RybdawE.exe
  2⤵
  PID:13384
- C:\Windows\System\KPFxOex.exe
  C:\Windows\System\KPFxOex.exe
  2⤵
  PID:13404
- C:\Windows\System\GsHpOXl.exe
  C:\Windows\System\GsHpOXl.exe
  2⤵
  PID:13424
- C:\Windows\System\KMDfclA.exe
  C:\Windows\System\KMDfclA.exe
  2⤵
  PID:13452
- C:\Windows\System\uXZEtkS.exe
  C:\Windows\System\uXZEtkS.exe
  2⤵
  PID:13480
- C:\Windows\System\aRMyQqZ.exe
  C:\Windows\System\aRMyQqZ.exe
  2⤵
  PID:13500
- C:\Windows\System\ZbDMutO.exe
  C:\Windows\System\ZbDMutO.exe
  2⤵
  PID:13524
- C:\Windows\System\RzrtZwM.exe
  C:\Windows\System\RzrtZwM.exe
  2⤵
  PID:13560
- C:\Windows\System\mTeOktc.exe
  C:\Windows\System\mTeOktc.exe
  2⤵
  PID:13588
- C:\Windows\System\DnllQMn.exe
  C:\Windows\System\DnllQMn.exe
  2⤵
  PID:13620
- C:\Windows\System\MkqrhOB.exe
  C:\Windows\System\MkqrhOB.exe
  2⤵
  PID:13652
- C:\Windows\System\EGXgEFK.exe
  C:\Windows\System\EGXgEFK.exe
  2⤵
  PID:13680
- C:\Windows\System\EQaseQM.exe
  C:\Windows\System\EQaseQM.exe
  2⤵
  PID:13708
- C:\Windows\System\klJTOpL.exe
  C:\Windows\System\klJTOpL.exe
  2⤵
  PID:13728
- C:\Windows\System\zTiijRv.exe
  C:\Windows\System\zTiijRv.exe
  2⤵
  PID:13768
- C:\Windows\System\KuhJQJq.exe
  C:\Windows\System\KuhJQJq.exe
  2⤵
  PID:13796
- C:\Windows\System\GkQNlvI.exe
  C:\Windows\System\GkQNlvI.exe
  2⤵
  PID:13836
- C:\Windows\System\EBvNhoQ.exe
  C:\Windows\System\EBvNhoQ.exe
  2⤵
  PID:13868
- C:\Windows\System\ITiMkzI.exe
  C:\Windows\System\ITiMkzI.exe
  2⤵
  PID:13884
- C:\Windows\System\PNQzSnz.exe
  C:\Windows\System\PNQzSnz.exe
  2⤵
  PID:13916
- C:\Windows\System\bkljGqQ.exe
  C:\Windows\System\bkljGqQ.exe
  2⤵
  PID:13936
- C:\Windows\System\sfWpMMu.exe
  C:\Windows\System\sfWpMMu.exe
  2⤵
  PID:13968
- C:\Windows\System\KfRQzbc.exe
  C:\Windows\System\KfRQzbc.exe
  2⤵
  PID:13992
- C:\Windows\System\tzbgBjh.exe
  C:\Windows\System\tzbgBjh.exe
  2⤵
  PID:14016
- C:\Windows\System\rSEfCis.exe
  C:\Windows\System\rSEfCis.exe
  2⤵
  PID:14044
- C:\Windows\System\YHLvYwx.exe
  C:\Windows\System\YHLvYwx.exe
  2⤵
  PID:14072
- C:\Windows\System\HSMGrEe.exe
  C:\Windows\System\HSMGrEe.exe
  2⤵
  PID:14108
- C:\Windows\System\ssZVsJX.exe
  C:\Windows\System\ssZVsJX.exe
  2⤵
  PID:14140
- C:\Windows\System\uryWEPg.exe
  C:\Windows\System\uryWEPg.exe
  2⤵
  PID:14164
- C:\Windows\System\LkLqGpo.exe
  C:\Windows\System\LkLqGpo.exe
  2⤵
  PID:14192
- C:\Windows\System\MUbTAeq.exe
  C:\Windows\System\MUbTAeq.exe
  2⤵
  PID:14216
- C:\Windows\System\SuljBre.exe
  C:\Windows\System\SuljBre.exe
  2⤵
  PID:14248
- C:\Windows\System\QYJrQlh.exe
  C:\Windows\System\QYJrQlh.exe
  2⤵
  PID:14276
- C:\Windows\System\cOqxJkp.exe
  C:\Windows\System\cOqxJkp.exe
  2⤵
  PID:14300
- C:\Windows\System\UoksKBt.exe
  C:\Windows\System\UoksKBt.exe
  2⤵
  PID:13088
- C:\Windows\System\ScaibhM.exe
  C:\Windows\System\ScaibhM.exe
  2⤵
  PID:13172
- C:\Windows\System\iQfWOqJ.exe
  C:\Windows\System\iQfWOqJ.exe
  2⤵
  PID:13344
- C:\Windows\System\FXcrQQS.exe
  C:\Windows\System\FXcrQQS.exe
  2⤵
  PID:13416
- C:\Windows\System\vtUTshv.exe
  C:\Windows\System\vtUTshv.exe
  2⤵
  PID:13548
- C:\Windows\System\WEmjnPX.exe
  C:\Windows\System\WEmjnPX.exe
  2⤵
  PID:13628
- C:\Windows\System\AOPRfeb.exe
  C:\Windows\System\AOPRfeb.exe
  2⤵
  PID:13544
- C:\Windows\System\zRwIRBS.exe
  C:\Windows\System\zRwIRBS.exe
  2⤵
  PID:13692
- C:\Windows\System\fHaVGpd.exe
  C:\Windows\System\fHaVGpd.exe
  2⤵
  PID:13696
- C:\Windows\System\tCxiULB.exe
  C:\Windows\System\tCxiULB.exe
  2⤵
  PID:13856
- C:\Windows\System\geCctQQ.exe
  C:\Windows\System\geCctQQ.exe
  2⤵
  PID:13876
- C:\Windows\System\sCnXCpe.exe
  C:\Windows\System\sCnXCpe.exe
  2⤵
  PID:13880
- C:\Windows\System\FIvIFoH.exe
  C:\Windows\System\FIvIFoH.exe
  2⤵
  PID:14012
- C:\Windows\System\GJBWsVs.exe
  C:\Windows\System\GJBWsVs.exe
  2⤵
  PID:14148
- C:\Windows\System\xqlYWSI.exe
  C:\Windows\System\xqlYWSI.exe
  2⤵
  PID:14136
- C:\Windows\System\VWATplh.exe
  C:\Windows\System\VWATplh.exe
  2⤵
  PID:14172
- C:\Windows\System\xfkOJKq.exe
  C:\Windows\System\xfkOJKq.exe
  2⤵
  PID:14264
- C:\Windows\System\sJgswpG.exe
  C:\Windows\System\sJgswpG.exe
  2⤵
  PID:13200
- C:\Windows\System\WGmmner.exe
  C:\Windows\System\WGmmner.exe
  2⤵
  PID:14332
- C:\Windows\System\KmlUaze.exe
  C:\Windows\System\KmlUaze.exe
  2⤵
  PID:13496
- C:\Windows\System\zhEVNtw.exe
  C:\Windows\System\zhEVNtw.exe
  2⤵
  PID:13612
- C:\Windows\System\NQkNTfy.exe
  C:\Windows\System\NQkNTfy.exe
  2⤵
  PID:13988
- C:\Windows\System\yhFvSFA.exe
  C:\Windows\System\yhFvSFA.exe
  2⤵
  PID:14056
- C:\Windows\System\FdryBXi.exe
  C:\Windows\System\FdryBXi.exe
  2⤵
  PID:14036
- C:\Windows\System\qjLiCno.exe
  C:\Windows\System\qjLiCno.exe
  2⤵
  PID:14292
- C:\Windows\System\rwGpAkQ.exe
  C:\Windows\System\rwGpAkQ.exe
  2⤵
  PID:13720
- C:\Windows\System\AIFReXy.exe
  C:\Windows\System\AIFReXy.exe
  2⤵
  PID:14296
- C:\Windows\System\ufTsMQy.exe
  C:\Windows\System\ufTsMQy.exe
  2⤵
  PID:14340
- C:\Windows\System\zheLerP.exe
  C:\Windows\System\zheLerP.exe
  2⤵
  PID:14356
- C:\Windows\System\oxRhosI.exe
  C:\Windows\System\oxRhosI.exe
  2⤵
  PID:14392
- C:\Windows\System\zVECWMT.exe
  C:\Windows\System\zVECWMT.exe
  2⤵
  PID:14408
- C:\Windows\System\YujSiyG.exe
  C:\Windows\System\YujSiyG.exe
  2⤵
  PID:14440
- C:\Windows\System\IMEapCh.exe
  C:\Windows\System\IMEapCh.exe
  2⤵
  PID:14464
- C:\Windows\System\qqYHROa.exe
  C:\Windows\System\qqYHROa.exe
  2⤵
  PID:14488
- C:\Windows\System\NKucTMC.exe
  C:\Windows\System\NKucTMC.exe
  2⤵
  PID:14516
- C:\Windows\System\aBVFvJT.exe
  C:\Windows\System\aBVFvJT.exe
  2⤵
  PID:14548
- C:\Windows\System\RUTAolM.exe
  C:\Windows\System\RUTAolM.exe
  2⤵
  PID:14576
- C:\Windows\System\CttdbZP.exe
  C:\Windows\System\CttdbZP.exe
  2⤵
  PID:14608
- C:\Windows\System\HBHrRhP.exe
  C:\Windows\System\HBHrRhP.exe
  2⤵
  PID:14632
- C:\Windows\System\cXNdkVV.exe
  C:\Windows\System\cXNdkVV.exe
  2⤵
  PID:14660
- C:\Windows\System\rzcBskq.exe
  C:\Windows\System\rzcBskq.exe
  2⤵
  PID:14688
- C:\Windows\System\eftneza.exe
  C:\Windows\System\eftneza.exe
  2⤵
  PID:14724
- C:\Windows\System\TCCPGMg.exe
  C:\Windows\System\TCCPGMg.exe
  2⤵
  PID:14756
- C:\Windows\System\uaNipyV.exe
  C:\Windows\System\uaNipyV.exe
  2⤵
  PID:14788
- C:\Windows\System\GmsUfRT.exe
  C:\Windows\System\GmsUfRT.exe
  2⤵
  PID:14836
- C:\Windows\System\GZedoUy.exe
  C:\Windows\System\GZedoUy.exe
  2⤵
  PID:14872
- C:\Windows\System\pCMJgJS.exe
  C:\Windows\System\pCMJgJS.exe
  2⤵
  PID:14896
- C:\Windows\System\XeTOSIb.exe
  C:\Windows\System\XeTOSIb.exe
  2⤵
  PID:14928
- C:\Windows\System\adomcZl.exe
  C:\Windows\System\adomcZl.exe
  2⤵
  PID:14960
- C:\Windows\System\uGqbsSX.exe
  C:\Windows\System\uGqbsSX.exe
  2⤵
  PID:14984
- C:\Windows\System\BoexmhE.exe
  C:\Windows\System\BoexmhE.exe
  2⤵
  PID:15004
- C:\Windows\System\NiKIlks.exe
  C:\Windows\System\NiKIlks.exe
  2⤵
  PID:15032
- C:\Windows\System\pDxqtBz.exe
  C:\Windows\System\pDxqtBz.exe
  2⤵
  PID:15052
- C:\Windows\System\eCKZbHa.exe
  C:\Windows\System\eCKZbHa.exe
  2⤵
  PID:15084
- C:\Windows\System\YGvDRPG.exe
  C:\Windows\System\YGvDRPG.exe
  2⤵
  PID:15112
- C:\Windows\System\qWcDuDd.exe
  C:\Windows\System\qWcDuDd.exe
  2⤵
  PID:15148
- C:\Windows\System\LXchjWZ.exe
  C:\Windows\System\LXchjWZ.exe
  2⤵
  PID:15176
- C:\Windows\System\TOCurSS.exe
  C:\Windows\System\TOCurSS.exe
  2⤵
  PID:15208
- C:\Windows\System\KhNLKGO.exe
  C:\Windows\System\KhNLKGO.exe
  2⤵
  PID:15232
- C:\Windows\System\NPFMTXk.exe
  C:\Windows\System\NPFMTXk.exe
  2⤵
  PID:15264
- C:\Windows\System\niPkVnE.exe
  C:\Windows\System\niPkVnE.exe
  2⤵
  PID:15292
- C:\Windows\System\DnQtCnN.exe
  C:\Windows\System\DnQtCnN.exe
  2⤵
  PID:15312
- C:\Windows\System\MTWZDqJ.exe
  C:\Windows\System\MTWZDqJ.exe
  2⤵
  PID:15348
- C:\Windows\System\rBgpiQi.exe
  C:\Windows\System\rBgpiQi.exe
  2⤵
  PID:13324
- C:\Windows\System\UpxxDJh.exe
  C:\Windows\System\UpxxDJh.exe
  2⤵
  PID:13904
- C:\Windows\System\MeQPbIU.exe
  C:\Windows\System\MeQPbIU.exe
  2⤵
  PID:14328
- C:\Windows\System\DcOovnn.exe
  C:\Windows\System\DcOovnn.exe
  2⤵
  PID:14420
- C:\Windows\System\KHBbFIp.exe
  C:\Windows\System\KHBbFIp.exe
  2⤵
  PID:14564
- C:\Windows\System\olDbUpt.exe
  C:\Windows\System\olDbUpt.exe
  2⤵
  PID:14600
- C:\Windows\System\IRDLvdD.exe
  C:\Windows\System\IRDLvdD.exe
  2⤵
  PID:14628
- C:\Windows\System\AWtJNpl.exe
  C:\Windows\System\AWtJNpl.exe
  2⤵
  PID:14672
- C:\Windows\System\GxAutcG.exe
  C:\Windows\System\GxAutcG.exe
  2⤵
  PID:14644
- C:\Windows\System\yQfpxqJ.exe
  C:\Windows\System\yQfpxqJ.exe
  2⤵
  PID:14800
- C:\Windows\System\MmfVvtJ.exe
  C:\Windows\System\MmfVvtJ.exe
  2⤵
  PID:14920
- C:\Windows\System\UHprOQn.exe
  C:\Windows\System\UHprOQn.exe
  2⤵
  PID:14956
- C:\Windows\System\RutxmlD.exe
  C:\Windows\System\RutxmlD.exe
  2⤵
  PID:15028
- C:\Windows\System\OTePhmp.exe
  C:\Windows\System\OTePhmp.exe
  2⤵
  PID:15076
- C:\Windows\System\qxkQsXj.exe
  C:\Windows\System\qxkQsXj.exe
  2⤵
  PID:15172
- C:\Windows\System\iolZvIf.exe
  C:\Windows\System\iolZvIf.exe
  2⤵
  PID:15224
- C:\Windows\System\iFIkAcQ.exe
  C:\Windows\System\iFIkAcQ.exe
  2⤵
  PID:14100
- C:\Windows\System\oZJozhs.exe
  C:\Windows\System\oZJozhs.exe
  2⤵
  PID:15356
- C:\Windows\System\mLDWxWw.exe
  C:\Windows\System\mLDWxWw.exe
  2⤵
  PID:14376
- C:\Windows\System\NMwxbsJ.exe
  C:\Windows\System\NMwxbsJ.exe
  2⤵
  PID:14556
- C:\Windows\System\BRBTBkB.exe
  C:\Windows\System\BRBTBkB.exe
  2⤵
  PID:14712
- C:\Windows\System\ycMXtCv.exe
  C:\Windows\System\ycMXtCv.exe
  2⤵
  PID:15020
- C:\Windows\System\fauXIQQ.exe
  C:\Windows\System\fauXIQQ.exe
  2⤵
  PID:15284
- C:\Windows\System\rXipRIQ.exe
  C:\Windows\System\rXipRIQ.exe
  2⤵
  PID:15192
- C:\Windows\System\lFNPyBp.exe
  C:\Windows\System\lFNPyBp.exe
  2⤵
  PID:15220
- C:\Windows\System\eCNECMS.exe
  C:\Windows\System\eCNECMS.exe
  2⤵
  PID:13392
- C:\Windows\System\eNSZNpz.exe
  C:\Windows\System\eNSZNpz.exe
  2⤵
  PID:14976
- C:\Windows\System\RiWcOaw.exe
  C:\Windows\System\RiWcOaw.exe
  2⤵
  PID:14816
- C:\Windows\System\ohTkZZd.exe
  C:\Windows\System\ohTkZZd.exe
  2⤵
  PID:15372
- C:\Windows\System\wwubqLL.exe
  C:\Windows\System\wwubqLL.exe
  2⤵
  PID:15400
- C:\Windows\System\EwuNyrp.exe
  C:\Windows\System\EwuNyrp.exe
  2⤵
  PID:15432
- C:\Windows\System\jIlUbyv.exe
  C:\Windows\System\jIlUbyv.exe
  2⤵
  PID:15468
- C:\Windows\System\HEzSUyi.exe
  C:\Windows\System\HEzSUyi.exe
  2⤵
  PID:15484
- C:\Windows\System\WBlIpSy.exe
  C:\Windows\System\WBlIpSy.exe
  2⤵
  PID:15508
- C:\Windows\System\qBjOsHs.exe
  C:\Windows\System\qBjOsHs.exe
  2⤵
  PID:15524
- C:\Windows\System\dkNjTTO.exe
  C:\Windows\System\dkNjTTO.exe
  2⤵
  PID:15540
- C:\Windows\System\QiCKXRA.exe
  C:\Windows\System\QiCKXRA.exe
  2⤵
  PID:15572
- C:\Windows\System\RzhbCSx.exe
  C:\Windows\System\RzhbCSx.exe
  2⤵
  PID:15588
- C:\Windows\System\RepumoM.exe
  C:\Windows\System\RepumoM.exe
  2⤵
  PID:15612
- C:\Windows\System\byXSHrv.exe
  C:\Windows\System\byXSHrv.exe
  2⤵
  PID:15632
- C:\Windows\System\uEOkwSL.exe
  C:\Windows\System\uEOkwSL.exe
  2⤵
  PID:15668
- C:\Windows\System\ZyqDzwZ.exe
  C:\Windows\System\ZyqDzwZ.exe
  2⤵
  PID:15696
- C:\Windows\System\ZqGGOZq.exe
  C:\Windows\System\ZqGGOZq.exe
  2⤵
  PID:15720
- C:\Windows\System\jSQRdUT.exe
  C:\Windows\System\jSQRdUT.exe
  2⤵
  PID:15748
- C:\Windows\System\OkEvhqo.exe
  C:\Windows\System\OkEvhqo.exe
  2⤵
  PID:15776
- C:\Windows\System\CbkpWkT.exe
  C:\Windows\System\CbkpWkT.exe
  2⤵
  PID:15808
- C:\Windows\System\djXFoVc.exe
  C:\Windows\System\djXFoVc.exe
  2⤵
  PID:15828
- C:\Windows\System\fogPnoi.exe
  C:\Windows\System\fogPnoi.exe
  2⤵
  PID:15852
- C:\Windows\System\AgOOCnX.exe
  C:\Windows\System\AgOOCnX.exe
  2⤵
  PID:15876
- C:\Windows\System\rCddEVs.exe
  C:\Windows\System\rCddEVs.exe
  2⤵
  PID:15904
- C:\Windows\System\uZyCwlT.exe
  C:\Windows\System\uZyCwlT.exe
  2⤵
  PID:15928
- C:\Windows\System\jjwWBpg.exe
  C:\Windows\System\jjwWBpg.exe
  2⤵
  PID:15960
- C:\Windows\System\JZqofBU.exe
  C:\Windows\System\JZqofBU.exe
  2⤵
  PID:15988
- C:\Windows\System\AEMMuKZ.exe
  C:\Windows\System\AEMMuKZ.exe
  2⤵
  PID:16016
- C:\Windows\System\dELTmGR.exe
  C:\Windows\System\dELTmGR.exe
  2⤵
  PID:16052
- C:\Windows\System\MCVQkBF.exe
  C:\Windows\System\MCVQkBF.exe
  2⤵
  PID:16076
- C:\Windows\System\ozbiyLV.exe
  C:\Windows\System\ozbiyLV.exe
  2⤵
  PID:16100
- C:\Windows\System\qcACzPn.exe
  C:\Windows\System\qcACzPn.exe
  2⤵
  PID:16124
- C:\Windows\System\LZBqtPU.exe
  C:\Windows\System\LZBqtPU.exe
  2⤵
  PID:16148
- C:\Windows\System\MKVWGpc.exe
  C:\Windows\System\MKVWGpc.exe
  2⤵
  PID:16188
- C:\Windows\System\unOuoze.exe
  C:\Windows\System\unOuoze.exe
  2⤵
  PID:16224
- C:\Windows\System\nPMxdZl.exe
  C:\Windows\System\nPMxdZl.exe
  2⤵
  PID:16240
- C:\Windows\System\nTDXgIN.exe
  C:\Windows\System\nTDXgIN.exe
  2⤵
  PID:16264
- C:\Windows\System\davXqlu.exe
  C:\Windows\System\davXqlu.exe
  2⤵
  PID:16280
- C:\Windows\System\mBOkiBO.exe
  C:\Windows\System\mBOkiBO.exe
  2⤵
  PID:16312
- C:\Windows\System\eRlUSCo.exe
  C:\Windows\System\eRlUSCo.exe
  2⤵
  PID:16344
- C:\Windows\System\SrnYagE.exe
  C:\Windows\System\SrnYagE.exe
  2⤵
  PID:14700
- C:\Windows\System\RydRTZp.exe
  C:\Windows\System\RydRTZp.exe
  2⤵
  PID:15364
- C:\Windows\System\aAyVfhT.exe
  C:\Windows\System\aAyVfhT.exe
  2⤵
  PID:15444
- C:\Windows\System\RWflSWe.exe
  C:\Windows\System\RWflSWe.exe
  2⤵
  PID:15504
- C:\Windows\System\ZToFEZt.exe
  C:\Windows\System\ZToFEZt.exe
  2⤵
  PID:15516
- C:\Windows\System\TqMmQqJ.exe
  C:\Windows\System\TqMmQqJ.exe
  2⤵
  PID:15568
- C:\Windows\System\DXafErO.exe
  C:\Windows\System\DXafErO.exe
  2⤵
  PID:15520
- C:\Windows\System\jhGykdK.exe
  C:\Windows\System\jhGykdK.exe
  2⤵
  PID:15732
- C:\Windows\System\jtaotbs.exe
  C:\Windows\System\jtaotbs.exe
  2⤵
  PID:15844
- C:\Windows\System\caqlGMm.exe
  C:\Windows\System\caqlGMm.exe
  2⤵
  PID:1792
- C:\Windows\System\JKLcakN.exe
  C:\Windows\System\JKLcakN.exe
  2⤵
  PID:15936
- C:\Windows\System\sFnCDIW.exe
  C:\Windows\System\sFnCDIW.exe
  2⤵
  PID:15872
- C:\Windows\System\ciLTZHP.exe
  C:\Windows\System\ciLTZHP.exe
  2⤵
  PID:15952
- C:\Windows\System\tjxHUlY.exe
  C:\Windows\System\tjxHUlY.exe
  2⤵
  PID:16160
- C:\Windows\System\WmlgRgf.exe
  C:\Windows\System\WmlgRgf.exe
  2⤵
  PID:16260
- C:\Windows\System\iCfcSuf.exe
  C:\Windows\System\iCfcSuf.exe
  2⤵
  PID:16060
- C:\Windows\System\AbQOcTp.exe
  C:\Windows\System\AbQOcTp.exe
  2⤵
  PID:16200
- C:\Windows\System\xHvwxxO.exe
  C:\Windows\System\xHvwxxO.exe
  2⤵
  PID:16276
- C:\Windows\System\KwpLCTt.exe
  C:\Windows\System\KwpLCTt.exe
  2⤵
  PID:16360
- C:\Windows\System\KUNFQgF.exe
  C:\Windows\System\KUNFQgF.exe
  2⤵
  PID:15320
- C:\Windows\System\nZTmyQr.exe
  C:\Windows\System\nZTmyQr.exe
  2⤵
  PID:15600
- C:\Windows\System\mdatEaq.exe
  C:\Windows\System\mdatEaq.exe
  2⤵
  PID:15608
- C:\Windows\System\KTdYmCu.exe
  C:\Windows\System\KTdYmCu.exe
  2⤵
  PID:15868
- C:\Windows\System\vFPEyXu.exe
  C:\Windows\System\vFPEyXu.exe
  2⤵
  PID:16392
- C:\Windows\System\zMngAKN.exe
  C:\Windows\System\zMngAKN.exe
  2⤵
  PID:16424
- C:\Windows\System\DmZPDNe.exe
  C:\Windows\System\DmZPDNe.exe
  2⤵
  PID:16444
- C:\Windows\System\QPCOHMV.exe
  C:\Windows\System\QPCOHMV.exe
  2⤵
  PID:16472
- C:\Windows\System\naMZNiS.exe
  C:\Windows\System\naMZNiS.exe
  2⤵
  PID:16488
- C:\Windows\System\nCHCEEM.exe
  C:\Windows\System\nCHCEEM.exe
  2⤵
  PID:16512
- C:\Windows\System\WkpfMmm.exe
  C:\Windows\System\WkpfMmm.exe
  2⤵
  PID:16544
- C:\Windows\System\LwZMdDu.exe
  C:\Windows\System\LwZMdDu.exe
  2⤵
  PID:16560
- C:\Windows\System\uuJQSBl.exe
  C:\Windows\System\uuJQSBl.exe
  2⤵
  PID:16592
- C:\Windows\System\iDPNeJV.exe
  C:\Windows\System\iDPNeJV.exe
  2⤵
  PID:16624
- C:\Windows\System\lvmeGnt.exe
  C:\Windows\System\lvmeGnt.exe
  2⤵
  PID:16656
- C:\Windows\System\OeyYjwq.exe
  C:\Windows\System\OeyYjwq.exe
  2⤵
  PID:16696
- C:\Windows\System\GgldeiG.exe
  C:\Windows\System\GgldeiG.exe
  2⤵
  PID:16720
- C:\Windows\System\fQSQmRP.exe
  C:\Windows\System\fQSQmRP.exe
  2⤵
  PID:16744
- C:\Windows\System\NxPiCXt.exe
  C:\Windows\System\NxPiCXt.exe
  2⤵
  PID:16760
- C:\Windows\System\RjljCEQ.exe
  C:\Windows\System\RjljCEQ.exe
  2⤵
  PID:16780
- C:\Windows\System\JlsfiGh.exe
  C:\Windows\System\JlsfiGh.exe
  2⤵
  PID:16820
- C:\Windows\System\lTPhVXx.exe
  C:\Windows\System\lTPhVXx.exe
  2⤵
  PID:16852
- C:\Windows\System\UAsTTIh.exe
  C:\Windows\System\UAsTTIh.exe
  2⤵
  PID:16868
- C:\Windows\System\ROMoCzl.exe
  C:\Windows\System\ROMoCzl.exe
  2⤵
  PID:16904
- C:\Windows\System\CWexgUm.exe
  C:\Windows\System\CWexgUm.exe
  2⤵
  PID:16932
- C:\Windows\System\feYqmVD.exe
  C:\Windows\System\feYqmVD.exe
  2⤵
  PID:16956
- C:\Windows\System\QDIRKWM.exe
  C:\Windows\System\QDIRKWM.exe
  2⤵
  PID:16984
- C:\Windows\System\xsaeBbR.exe
  C:\Windows\System\xsaeBbR.exe
  2⤵
  PID:17008
- C:\Windows\System\LgDmBbo.exe
  C:\Windows\System\LgDmBbo.exe
  2⤵
  PID:17036
- C:\Windows\System\PKwwqQm.exe
  C:\Windows\System\PKwwqQm.exe
  2⤵
  PID:17056
- C:\Windows\System\tkUPLBP.exe
  C:\Windows\System\tkUPLBP.exe
  2⤵
  PID:17080
- C:\Windows\System\oBBBRpp.exe
  C:\Windows\System\oBBBRpp.exe
  2⤵
  PID:17104
- C:\Windows\System\dcblWDP.exe
  C:\Windows\System\dcblWDP.exe
  2⤵
  PID:17136
- C:\Windows\System\uDJGaeN.exe
  C:\Windows\System\uDJGaeN.exe
  2⤵
  PID:17176
- C:\Windows\System\rSLTwih.exe
  C:\Windows\System\rSLTwih.exe
  2⤵
  PID:17196
- C:\Windows\System\DOHBZiM.exe
  C:\Windows\System\DOHBZiM.exe
  2⤵
  PID:17232
- C:\Windows\System\LJwEDZt.exe
  C:\Windows\System\LJwEDZt.exe
  2⤵
  PID:17252
- C:\Windows\System\QzVlmEK.exe
  C:\Windows\System\QzVlmEK.exe
  2⤵
  PID:17280
- C:\Windows\System\CVrcdEq.exe
  C:\Windows\System\CVrcdEq.exe
  2⤵
  PID:17308
- C:\Windows\System\KEUSOxW.exe
  C:\Windows\System\KEUSOxW.exe
  2⤵
  PID:17340
- C:\Windows\System\cVjynru.exe
  C:\Windows\System\cVjynru.exe
  2⤵
  PID:17356
- C:\Windows\System\hwaXzAa.exe
  C:\Windows\System\hwaXzAa.exe
  2⤵
  PID:17384
- C:\Windows\System\ixHfeed.exe
  C:\Windows\System\ixHfeed.exe
  2⤵
  PID:16092
- C:\Windows\System\mVfDwZC.exe
  C:\Windows\System\mVfDwZC.exe
  2⤵
  PID:15772
- C:\Windows\System\cuxUNaD.exe
  C:\Windows\System\cuxUNaD.exe
  2⤵
  PID:16216
- C:\Windows\System\BlIoTnr.exe
  C:\Windows\System\BlIoTnr.exe
  2⤵
  PID:16436
- C:\Windows\System\MmLBpae.exe
  C:\Windows\System\MmLBpae.exe
  2⤵
  PID:16508
- C:\Windows\System\UUrzSpB.exe
  C:\Windows\System\UUrzSpB.exe
  2⤵
  PID:16644
- C:\Windows\System\yLmnUKP.exe
  C:\Windows\System\yLmnUKP.exe
  2⤵
  PID:16484
- C:\Windows\System\MpMvePJ.exe
  C:\Windows\System\MpMvePJ.exe
  2⤵
  PID:16708
- C:\Windows\System\jWDquRv.exe
  C:\Windows\System\jWDquRv.exe
  2⤵
  PID:16920
- C:\Windows\System\gnSmdZC.exe
  C:\Windows\System\gnSmdZC.exe
  2⤵
  PID:17248

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ADQbdOA.exe

Path C:\Windows\System\ADQbdOA.exe
Size 1.6MB
SHA256 b1b26b9f56642bf1479cdd326b8c4a0d7f7c0934065e3e699cef6d6df8f1d9b1
MD5 ed065ea6388da83ab00d42154b96d2d5
SHA1 9d5c1af1eb7f372dfd752afc6cfcac1dda1bafb6
SHA512 ecec1d225a59995d1a6b92afdaa742c35fce24552a8fecd0383755a68b92b91019428e3d26da80253dfcbc1486c0210f251d896d30b4cc783e15868b4d34d070
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmJ:GemTLkNdfE0pZaI
MD5 SHA1 SHA512 SSDEEP

Submit Download

AHlMOkN.exe

Path C:\Windows\System\AHlMOkN.exe
Size 1.6MB
SHA256 b82cec63b5bf809bd21139d47fc7bd7397cd437b49d50962e83775f818e10d59
MD5 d43472642f35f1d93bf4b4e4659b206f
SHA1 ce24bf39100ee5e8e02a32cb2eb63c6799814ee2
SHA512 5f29cd35674b8704bfc35186a616bada071132abf0cc01ffc99be24b6116697734889149a86c45c9f37f39ab2a3f86c8101aaa7d1b87212b8780eda02c6eab14
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmA:GemTLkNdfE0pZaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

GTdcpOB.exe

Path C:\Windows\System\GTdcpOB.exe
Size 1.6MB
SHA256 76262807567502508470fed5b3d6ef38e48b6ccb9be285178201516cfd3cac53
MD5 18ef4238a94e319fbe8eca8f6f5ab326
SHA1 752481094eff4b458198f27a0448421f6c71fd29
SHA512 50e321c38f7b8d23e7d11745c1ec53f60066bd5c86dfe347f48f50cf699f64ddcbe360f770a5a5c11a6101250e6075dd44cad274f2794d74810298b130dcaa36
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmF:GemTLkNdfE0pZaQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

HMnaXfN.exe

Path C:\Windows\System\HMnaXfN.exe
Size 1.6MB
SHA256 f816cdad5c425301065efc052881c66f773f6bada3c6b45e0d9e330bdc97a163
MD5 59a68c5162f3a34aef4d0e4b61909696
SHA1 15d387018d92c0500645189a5b9d549b2838b979
SHA512 c4f434613d0b0e18142ebab67223e7912824fa87db3256ca2f45f6d689002c9600ea0d9095cad2a0cfe6e63119a6ac31093f92dc36bc7d422760cafc91d5c8c4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmP:GemTLkNdfE0pZas
MD5 SHA1 SHA512 SSDEEP

Submit Download

IXkitjC.exe

Path C:\Windows\System\IXkitjC.exe
Size 1.6MB
SHA256 9e4316740e652d278f8e63d3810bb294517a06901af68264cce70be07684a9be
MD5 0a5a9c33f39ded4b0dcd3f850b5a416d
SHA1 cd218d503dc237c5fb9d335c407cf61dbddf6b91
SHA512 328584bebe9c88b7b43ebb2570cd2c86510b5fedb2d7c5e09b30338442b3eedb894f5db0c9dc19a572b1963938e22c2c88e99bc8d8b215a3a8bb094d2e2ba2d0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmL:GemTLkNdfE0pZaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

JFzvGje.exe

Path C:\Windows\System\JFzvGje.exe
Size 1.6MB
SHA256 4ed6e0b214a468d35ce28c269f6200c75721448f329bfed5862d9475c18069a4
MD5 232be383eeaac964f4e1d12b7cfb0566
SHA1 55ab94e248e0e50f1edce9728da2c0bf9928c9cf
SHA512 6712ab9fbb90c96d688f94a53d85a4ea834d1c119db0355fdadb49b7315752c52945d9e5a35f557d23d0df61c6b7386e4e7379d884d88605f1a882219fd883cf
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmS:GemTLkNdfE0pZat
MD5 SHA1 SHA512 SSDEEP

Submit Download

KMzhLlQ.exe

Path C:\Windows\System\KMzhLlQ.exe
Size 1.6MB
SHA256 d09293afaaf015b2c2d8df90e0ffe93fadbf65c3cb376c353d21c400f9655dad
MD5 70ec4d6ddb58e873915e20359fe228dd
SHA1 0ce22e3e65e6abb3ef05215b5f7785fe8921d06f
SHA512 fefdb9fa00dbe6e0b84f2e36b1daa9f8b89b936657581013c4b92358c340d387b7420226d0ce18d75a2ca763841a862226087edb40f5eb0c5fd76ad045f4f866
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmB:GemTLkNdfE0pZas
MD5 SHA1 SHA512 SSDEEP

Submit Download

LJMUBsV.exe

Path C:\Windows\System\LJMUBsV.exe
Size 1.6MB
SHA256 da391fe94ba7d83894929d7e5f2215a9f860fe996cf3ec28d6a711093f5c8d4d
MD5 69123d107ff808398e1eb196b0a53eb2
SHA1 a189644a06d4c1408e64213c136ee17fa37de6f7
SHA512 7bc051d417b2095e39286a47ec080243d8c6b85efb2ebfc7a09f79aa586671c5d5329a1d9e59ef3a34050b37541b04c722e23726b767dba0ef9359244a3a7787
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmf:GemTLkNdfE0pZac
MD5 SHA1 SHA512 SSDEEP

Submit Download

LxGenej.exe

Path C:\Windows\System\LxGenej.exe
Size 1.6MB
SHA256 d239d86d079120561171a9ac7c61224069479a61b5bcf3281a90deb091d025ac
MD5 112509a8426b0ca7b7ba973839bd7aeb
SHA1 cc104d63c61dce28ee343d369d7a93a98302f723
SHA512 a3d6421ca9be4a632c7b7e07ae1c4e57722e7aa2f5af27b08f5556dd525cbe17fbfe4ba199b21a8bfebf31bab41beaeea7e794690011cc63386ff54cae346b7b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmB:GemTLkNdfE0pZaW
MD5 SHA1 SHA512 SSDEEP

Submit Download

NYQlWem.exe

Path C:\Windows\System\NYQlWem.exe
Size 1.6MB
SHA256 aeba8fa51ecb8f3f5832a4e183968c492e75489301ca60c8f7df5aa1aa24e29f
MD5 286ed0c9bb939f5940bacb96eb44ac71
SHA1 04fdd772a4b5c65707252e7fa3e88f1c9171ce6c
SHA512 da23bcc322590ce3d01a7f56cfcaa1164887a9c96c67f60c965ea4c907dde37393d54484862827c749d29e1f7588f098ad63c62db04a47067c76ab56e58ea125
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmO:GemTLkNdfE0pZab
MD5 SHA1 SHA512 SSDEEP

Submit Download

NkbCdWd.exe

Path C:\Windows\System\NkbCdWd.exe
Size 1.6MB
SHA256 099d82df27a2f2e0349e788c0d9388edc3efaf4db882d43cad577a36129dc7f8
MD5 36c048f249169f6db7b6be950b05cc81
SHA1 72fb5c78889ce5d7e41a598d7c61a577d0b3fc13
SHA512 4927f2cd8ded522eb5436e443ce8cd3be91dfa058600bf5cef6919c41aa397d25fb5233b8ae8e6f9eb8787727c01fc7fb2eefd84215f354be1e17269b6c1c4fc
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmg:GemTLkNdfE0pZab
MD5 SHA1 SHA512 SSDEEP

Submit Download

OixJfqy.exe

Path C:\Windows\System\OixJfqy.exe
Size 1.6MB
SHA256 9eef7c47eac4b435f553386df248e6fe927bf5ec1d339c0d56a59402b38d9122
MD5 3e75d425c48573daf58d39d0583f1902
SHA1 43cc03f7ae936e2ee2f4eaf99724a7c9b47cd256
SHA512 c81d0abdc3ae4ae81bf9eec03eb3f8e7393c9134355a60f039f8cd7d061888d33dd4358ed74a216009bc419bb7d15f453f43b7799d6ac68a64add1d28babe21b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskm4:GemTLkNdfE0pZah
MD5 SHA1 SHA512 SSDEEP

Submit Download

PkTNwlq.exe

Path C:\Windows\System\PkTNwlq.exe
Size 1.6MB
SHA256 db30539cb528e5b225e699d416d19f640d097cd8d0494bf3b490b06aa7508e5f
MD5 558a501b146e3de85a6e1da2d3b31721
SHA1 015db5e7307a0e84e503cdf58e8143bbb1d09a87
SHA512 51796302b9d387e286fe2dbe795c75830f597931da933c75e7d03057154b1133aa1f342bfd2cb46ed1795a9b9c0ff1ae8ff46e0acfcc0812611581759a69747d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmj:GemTLkNdfE0pZai
MD5 SHA1 SHA512 SSDEEP

Submit Download

QqATnTx.exe

Path C:\Windows\System\QqATnTx.exe
Size 1.6MB
SHA256 be4ac6ec35a242f01e2ff4367d5a936331cddfcd7f31c17ddd2bf8efd483566f
MD5 ab8d672724d4c887a6f7199e765c30fa
SHA1 4910a2b7f3e7445cd6f23e5cc8f345707e52c4be
SHA512 216e65e67ac720fc3330e537e38aa05f71371a2e97b95c983df792ec3effb88e902958474ad2b5e835f38122c526f6cd59246a68e4fce915a5aa78b02c92281c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmi:GemTLkNdfE0pZaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

QynfBgL.exe

Path C:\Windows\System\QynfBgL.exe
Size 1.6MB
SHA256 1fa316cdb6870f31d19bf04bd9289da6019af7239c4abf685f688cc7fd8d7716
MD5 b2a42032972aa72b207686bfcf5f0a31
SHA1 de3603c5aa921415b9ac0a8fea34a5611e106b25
SHA512 7dece48406153641e385177dc08075d03dede293918510c8ac4c94dde064fd70ebcbffe7b8a661c695146d03232c145266db83ce89bbbea998af3a339ba55cfc
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmA:GemTLkNdfE0pZa5
MD5 SHA1 SHA512 SSDEEP

Submit Download

QzDInZi.exe

Path C:\Windows\System\QzDInZi.exe
Size 1.6MB
SHA256 c69d8fd5a243077349e4a9ca1d89032d49fe88e1869a14ae54a31bdd7e22bdb5
MD5 940573e2bcffd61223934342e2f3c4d9
SHA1 da888fc36a4bda06c83719cc48b41d448dae1d16
SHA512 68be1a9c2888e27cdac3d4d557df796f11c5749fb09223bc949506dd6ffa3303592362442c32744a0c6480e7ea46875d7d165098c314ab277625e379af0f07d1
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmO:GemTLkNdfE0pZa7
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCLZYuE.exe

Path C:\Windows\System\SCLZYuE.exe
Size 1.6MB
SHA256 3aab0810a37a6a1133e5eac31ec41cdb141daceebf7a8fdb7f93095796e56979
MD5 6b590dd080a7d3353a06fb7f146a7b39
SHA1 3b8a7da9c4e939849657118b5536d35f89d155d7
SHA512 c50108d9f20e0aafb3e59b681e39ce6ccc9696799918daf188e5913d2c49ff6f428323208cdcf93647a67cef2a7c8342952d50e25e4462a98280582856468b5e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmE:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

UuJeztl.exe

Path C:\Windows\System\UuJeztl.exe
Size 1.6MB
SHA256 ca5d09f655018c5bf460a4502f8578ec6bbd999694f81c8141c92587f8ae158b
MD5 aa8541beb350d8f726998cb61d26e928
SHA1 5a715a6acb4439d29952e93ff10d911ae17161c2
SHA512 c340c1be954ac29eaa69b8e74573005eede9d1f108d1e7c94c0e90495661737b3203f335ad1e77a23b20a3a18fcabab4535e5160567854c8aa3e6119a304027c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskm2:GemTLkNdfE0pZaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

YSvdjRb.exe

Path C:\Windows\System\YSvdjRb.exe
Size 1.6MB
SHA256 b9974258a1404f4b8cf625067f4279e05b10a434f61867c8828124516d6e154d
MD5 777d89e9b4af7ae651768478e31855a9
SHA1 f8579319de2a790203d623c0f45c7ceca15fc19c
SHA512 e6e9dea1db2e1a72b0a333ef570654661e6aa75095c39c4ec457d3473d36f362701a04753b01773026873973f8e71cfa8ab5ab9de3640b0faa5d29c91e8b8888
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmo:GemTLkNdfE0pZav
MD5 SHA1 SHA512 SSDEEP

Submit Download

YkkNjaV.exe

Path C:\Windows\System\YkkNjaV.exe
Size 1.6MB
SHA256 b7a2081e337047eb8c8561a74702d347f4aa49c9b7e1343e8081e8f8609400e7
MD5 d4f6cdc481ed1421663236d58efc6340
SHA1 876386793e3657e782bdfc0b9db9687b5d9bc933
SHA512 f416b33463d800b62e4ccacbfeb2a4bb982a5364be67a642bf00e5adf3b3f54e0f915a62dfe48e8ecc8f3634f1569f083a2e0d90d4561c71cb5fcc15a16ee573
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskme:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZQfkcOw.exe

Path C:\Windows\System\ZQfkcOw.exe
Size 1.6MB
SHA256 cc483de7205b63d400299053cd4e525f443ecc4a62f34c459bb52046ef16671a
MD5 a55a9880c73384192f619bc60cf71c9d
SHA1 15e03420b0b86b44df9e91b618149de901079453
SHA512 9fe19706d08166073be593da9175e2b08aaaad9a27535b757f81b727eddf4378b079b0c62fb6cd1c3db2a364c013e1ece3d9ff21bd84aea72fb3fbb7296c3ed0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmt:GemTLkNdfE0pZaw
MD5 SHA1 SHA512 SSDEEP

Submit Download

adWUyPQ.exe

Path C:\Windows\System\adWUyPQ.exe
Size 1.6MB
SHA256 2a745c2eec3b8243f319e305ef463a235229a12d58923feaed63ead4fbf1a964
MD5 11dc127558d6d7c45f4b103da9d9377f
SHA1 002ad5d29589a6a53e75c439772515ce836f5190
SHA512 4557b6d8c4c83407278aa95963e2ab9e49d71d5ac3e7ae1f96c21fca6cd1918d1e4186f2eaaa02262f505c1506d32c5f05126dd347ab4b1fc9482984057e70e9
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskm1:GemTLkNdfE0pZa0
MD5 SHA1 SHA512 SSDEEP

Submit Download

auagber.exe

Path C:\Windows\System\auagber.exe
Size 1.6MB
SHA256 12a5d519a1f24f00d15a73476462a4c5b1d18115756fe9673758ca84eda5a82b
MD5 3679274c4a69d2f107771aa69d0b6548
SHA1 3715656ad13ad517694cfddcf03cf46148a820c2
SHA512 9d12d049630e316a272beb78f8a176b8fd81dcad797187f1a2d3612ed2a5808204d961efd3b03ad70fcfad84d5d047a1ffd8f141dfaaced5af33d46cfbb47a14
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmD:GemTLkNdfE0pZae
MD5 SHA1 SHA512 SSDEEP

Submit Download

bDtPtrj.exe

Path C:\Windows\System\bDtPtrj.exe
Size 1.6MB
SHA256 86c289e519cd4be4340532b252dac3bf9b5cabaddb3a8758edca159d38d00721
MD5 582c34a50d1e06ab369023f898c2ac81
SHA1 99d3df5bd8a612e963c63c64a0d7cd30be23d196
SHA512 2c8e9f2ac882460cc5cd7c4507cd8efd9f8114c9d8e211d005162fdcc83bf3da163e1a06d9cfc1483b6b08c151ec2d96273cc00d4e8d54bcf8d4c21ebfe8a808
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmw:GemTLkNdfE0pZaL
MD5 SHA1 SHA512 SSDEEP

Submit Download

eZoZYsL.exe

Path C:\Windows\System\eZoZYsL.exe
Size 1.6MB
SHA256 9f3bcf3313bc4588551e7c9acd0a420f84db976e94e662b4492c47f8cf93820a
MD5 6d29dc4885b178518be1f8b03222c910
SHA1 c48664b062fb7b0c59c3a997bbbbcf5efbcadc6c
SHA512 83fac8bf773547c009af777d5e7012e7b7f182ebfedd241440be013ca456c3985cad5ef2c490addcefba9e52eca09ad9b1a77bea5c858380bb83722e0b436226
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmg:GemTLkNdfE0pZav
MD5 SHA1 SHA512 SSDEEP

Submit Download

gvADelD.exe

Path C:\Windows\System\gvADelD.exe
Size 1.6MB
SHA256 1a263121ec76d72250a92cbf43e8da2506989adfa45c7844d96646ca4d4bf6bc
MD5 fb7132b900b91bf017407eb7a8e44e7f
SHA1 4be0e0f3be9d05246440fc57d897e137e6a83d29
SHA512 f8d515ac80ed971bac1a478f87dd944cb7d37b050f3f53714fc6aed75ec148fa67aa59812db22dba33474360b75dab6b8b2dda33b35322b254b996d6374acaa5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmn:GemTLkNdfE0pZak
MD5 SHA1 SHA512 SSDEEP

Submit Download

hTuychh.exe

Path C:\Windows\System\hTuychh.exe
Size 1.6MB
SHA256 bd0a4f2dee61a16747c6c877e297b46b08d78ef798563813ccbb1b59aea03a8f
MD5 a0f9c1d8c45840c6914af98d637f24e9
SHA1 3f961eedd60aa3d7f1e983d1228576dda32c510b
SHA512 c71c958ea2bd7cf999b3dc0cb17a45ddcfff65220dc43a527bd0878a0b0b29434f2f5c79af9a52035109675d599f5a3b48293713159ae346312770b411c8b96c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmu:GemTLkNdfE0pZaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

lkpOSnV.exe

Path C:\Windows\System\lkpOSnV.exe
Size 1.6MB
SHA256 26ce1b070b8c75566659b2be7554c56618473c4eda65c919c1b8ed63373b4934
MD5 4838fbf2c8cb57306b90281aaf26aa01
SHA1 8847a363108c565ec2cab214e26525cd7430e395
SHA512 5889366ad25e35b6425ce904127193efae78c4671ff33f7980aa574af030181a424c95e71a14392afd60e54f3f1c5d5d48e8c58f6eb35c93e17732993ca71184
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskm9:GemTLkNdfE0pZaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

mQhPHlt.exe

Path C:\Windows\System\mQhPHlt.exe
Size 1.6MB
SHA256 2d3618503ec49bda0d5ac9a3463a72980fab07df09d3712e350104fe53cdf40a
MD5 1f51390c57688e673439caea01ede4b0
SHA1 a1d9269067026a75e2f0c86ff6db678bd761c610
SHA512 c727b421112be53dedec58cb33d45b0f53166a4ac468a5086be88f520e34f24cf70aa06eea91c697e19a4fb14fafe183ec01e1a1819405b6f61dcc746e576b40
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskm0:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsYfWrh.exe

Path C:\Windows\System\nsYfWrh.exe
Size 1.6MB
SHA256 8bb624a345992c50aa8f094fb022aa53112e8c5c85fb9f211fef4589ad577abd
MD5 99d3d35e85d779d8fd9c73e842c4ea1b
SHA1 08510c8c0f40aac1244e0b6c01d30ff137bd5a45
SHA512 cabca8c5c99367684379c0d19b7b7e4ec459a31b66bbcfc23cfb4e4c4666621831813200a93991687fef7d8e14919bb7a103f50e77154617a64c78956020f6fc
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmc:GemTLkNdfE0pZaH
MD5 SHA1 SHA512 SSDEEP

Submit Download

oGIlLbu.exe

Path C:\Windows\System\oGIlLbu.exe
Size 1.6MB
SHA256 42a4eb68cd9cc6888382f632f8a5e458e4e17ef850abe1cae7903af61ef92328
MD5 01e7b216a91b1ef3719b1d6a06c5a3ff
SHA1 dc4055742df740bbc60a56abe4475e08f65c4e1c
SHA512 4b9d7f2cfcda0daae42f73972fca31230cb272efec6e4c14b471645699a79e8f166029771ababcf1be01fa9eac86b874d5b612b81788b5ff3db86dad9c72ba65
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskm6:GemTLkNdfE0pZaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

oGPWYxk.exe

Path C:\Windows\System\oGPWYxk.exe
Size 1.6MB
SHA256 cb0abd8d7be32cf0d89e9e73c0341a948f1d372cfe0bc2303707311362df3ab1
MD5 d361f75656ddc54095636f840045e515
SHA1 7047cccdfaffe46d737fb34416f81b8a211ee1bd
SHA512 d902361fed48d18ab39aa5692e307458e76430bc1462b3b325b769abe9834cfa9d6b5ba17a5414c145ecfa16899b5b33b8709347a56095f9e22a2dd805bdfdad
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmF:GemTLkNdfE0pZaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ozvZLeu.exe

Path C:\Windows\System\ozvZLeu.exe
Size 1.6MB
SHA256 f5df14bf25d7ae5442a6df0e7fda07684d51aeee4c0e2ce1f051f547cba980d6
MD5 6a65ef6192defc96fd427e63742d291b
SHA1 e5aa3ac0989bdf6b2debc42a06a05dad4a69ffa3
SHA512 0c7d9b697376edc74b674697a9658e17ecdbcedb06772a9d285e48c9dcefbd94aaaa38b26abda2387d89b764848ba3bb79d95db05dec7af66443bb580b11ae69
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmw:GemTLkNdfE0pZah
MD5 SHA1 SHA512 SSDEEP

Submit Download

sJIohUO.exe

Path C:\Windows\System\sJIohUO.exe
Size 1.6MB
SHA256 f460d46263443282ad26ed3771b8bace390f9e74e8aea24fab34c9a5ca7a72b3
MD5 d1933c4366ea83412c5747eaaf70e65a
SHA1 20b5ab275d83b06eb8ebec6bfb4046a0a636a7c6
SHA512 74849e5a1e99e45034d68b1c0789842a6eb85176cfbb3fa3908de810b8a901516b043870dec392dc017e1d37ae1a6b9aeaeae8289eeb230a893ebd0b7d742e76
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmc:GemTLkNdfE0pZaf
MD5 SHA1 SHA512 SSDEEP

Submit Download

tYBWUby.exe

Path C:\Windows\System\tYBWUby.exe
Size 1.6MB
SHA256 7418972c35a4ec71486535131a5e950468490780ca84067c556c33975cf74879
MD5 ce695020d63b9c859cbcb948a3c02e78
SHA1 69b544d5a5ca34f757a6f6815a6ca55c856381c4
SHA512 4395e41ec00349c75bf6d988b599d97d18fe59c9fff62b05f50e92f95dde8ec5f14fff5b361c8bba8863a8d7d42e277eab8cfa038959a74085c05b628aa183e2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmH:GemTLkNdfE0pZaS
MD5 SHA1 SHA512 SSDEEP

Submit Download

uGAjyIh.exe

Path C:\Windows\System\uGAjyIh.exe
Size 1.6MB
SHA256 b59d018dbd0fb9a42a792fb157af47f41ae49ae87217c26ddf8041c29eaabbae
MD5 5e2b6871a554a8df1218cac7f2fcf1c1
SHA1 b7a2e249f332e5afdf39ef3e25606dc667634eef
SHA512 cd7d3071f859c558da229850178b3a0f1c777b8529073751962549e093932dcb01dc86b707a24f6d5ee85b1c7f68ef2e47dc994b43f14222fa920bc33e8b4ac7
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmFl:GemTLkNdfE0pZaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

upJBTxO.exe

Path C:\Windows\System\upJBTxO.exe
Size 1.6MB
SHA256 d6aa246708cff16154617fc2a2663fb6b44e7293952ed40fa9e5f593247a8831
MD5 f69d0251df4045587e2a9197ae081c19
SHA1 7a698992a0ff914c40376833ff86583e07bc881e
SHA512 ce35b33a923a6bf2af8a60ec6f9852f66a9057f150407c1832f89e3186c960b34cd2a03ac580c07b573205314605a82ac06156871015e66f8771577738cdabf7
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmj:GemTLkNdfE0pZaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

xQwahKf.exe

Path C:\Windows\System\xQwahKf.exe
Size 1.6MB
SHA256 4a3c9feec20f8c2718e6b0b17c19922e1107f8f27a3fe25c073f97b768682744
MD5 3c4cc8806effc7fb870791f25454430a
SHA1 b8c2051039e325c6837a481c30c72f3a64f61b95
SHA512 4d7fd2d3cdff3e43fcc76e38cc34cafa670fb181e55e82b7a31cc8e83625edeba76c5db87b29db22bf223d3363679a3205505153efa56dc6baa42a8bf8e9199d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjskmT:GemTLkNdfE0pZaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

xpqvmjs.exe

Path C:\Windows\System\xpqvmjs.exe
Size 1.6MB
SHA256 5e68bda792fafee97f3f4fd001662ae7dfc1995ebadc67c251525e5941c1016c
MD5 f0952eb475143501a463f3e627835f03
SHA1 eeb189af56516dcdf56a033aadc691e7a112889f
SHA512 70124fbd39dcd281e006ad2471afe8f1d3604a5163fe3cbde9732dc8ccff829d9d6a1bde4c5a9f00ea0f479362b1e8e3dca4d1e87a9a3d289835d20395e0762c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskm6:GemTLkNdfE0pZa/
MD5 SHA1 SHA512 SSDEEP

Submit Download

yqMvPSv.exe

Path C:\Windows\System\yqMvPSv.exe
Size 1.6MB
SHA256 ccaa100d8afc2a05e3d59d5b60060be19cb9939af257bdab1c6e78d55525f7e7
MD5 80e21fd14504062e1b1827c43af0e8fd
SHA1 cbd8cea050bbca70bed888cf776f0bde12107600
SHA512 37ac1fb6dcd751fc47b116f178974229d7aee91e67a52630b6af8df81dff167e6645537924e44a6a50a1aa48eb33ba2c01eaf18463e72666a2ed8ac92b224a3b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6Wjskmm:GemTLkNdfE0pZaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2120-0-0x000002250E190000-0x000002250E1A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads