xmrig | 9779fabdc89fc34dd19e65ba33e839efb79ce9d3b67ab799bd86984b2275e7ea

Analysis

max time kernel
146s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
Size 1.6MB
Sample240613-egycxaxbpm
SHA256 9779fabdc89fc34dd19e65ba33e839efb79ce9d3b67ab799bd86984b2275e7ea
MD5 5c54daef36115c15d160d1c1e78ca500
SHA1 ed554b8dd380b6a59e0fae04cd465151623ba5a0
SHA512 672199f1d820e99392f4a1009f9443f942f231f93c570aaea5311708712e9acd446d28dae2978b6054f1750d6bc915a4c63441bf98644f27acd72ee329703e15
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3i:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000900000002361a-4.dat	xmrig
behavioral2/files/0x0008000000023620-9.dat	xmrig
behavioral2/files/0x0007000000023621-12.dat	xmrig
behavioral2/files/0x0007000000023622-18.dat	xmrig
behavioral2/files/0x0007000000023623-25.dat	xmrig
behavioral2/files/0x0007000000023625-32.dat	xmrig
behavioral2/files/0x0007000000023624-33.dat	xmrig
behavioral2/files/0x000800000002361e-41.dat	xmrig
behavioral2/files/0x0007000000023626-43.dat	xmrig
behavioral2/files/0x0007000000023627-46.dat	xmrig
behavioral2/files/0x0007000000023628-54.dat	xmrig
behavioral2/files/0x0007000000023629-60.dat	xmrig
behavioral2/files/0x000700000002362a-64.dat	xmrig
behavioral2/files/0x000700000002362c-72.dat	xmrig
behavioral2/files/0x000700000002362d-81.dat	xmrig
behavioral2/files/0x000700000002362e-85.dat	xmrig
behavioral2/files/0x000700000002362b-73.dat	xmrig
behavioral2/files/0x000700000002362f-88.dat	xmrig
behavioral2/files/0x0007000000023630-93.dat	xmrig
behavioral2/files/0x0007000000023632-103.dat	xmrig
behavioral2/files/0x0007000000023633-109.dat	xmrig
behavioral2/files/0x0007000000023631-102.dat	xmrig
behavioral2/files/0x0007000000023634-114.dat	xmrig
behavioral2/files/0x00060000000168a5-122.dat	xmrig
behavioral2/files/0x00120000000006c3-123.dat	xmrig
behavioral2/files/0x0007000000023635-129.dat	xmrig
behavioral2/files/0x0007000000023636-134.dat	xmrig
behavioral2/files/0x0007000000023637-141.dat	xmrig
behavioral2/files/0x0007000000023639-145.dat	xmrig
behavioral2/files/0x0007000000023638-146.dat	xmrig
behavioral2/files/0x000700000002363a-154.dat	xmrig
behavioral2/files/0x000700000002363c-164.dat	xmrig
behavioral2/files/0x000700000002363b-161.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2516	taMMHeg.exe
3324	lKFvmPf.exe
3232	VocrgRR.exe
3408	kwtmpWO.exe
3016	CJhTHis.exe
1488	HmYrQyv.exe
3460	WfOknSy.exe
4576	ajbNzsH.exe
1240	ZGNVFQs.exe
1992	TfEJsss.exe
1904	FMviskz.exe
2220	fJAFxRc.exe
4968	ZvFrOVV.exe
3032	SZAqQJF.exe
5068	fJMQMUv.exe
4072	oGddGqM.exe
1560	AEGrHrV.exe
3112	lBQvYfR.exe
856	IjPpYtA.exe
5108	pAKXbjA.exe
2748	wEEVhKI.exe
2304	bkgWGuq.exe
2928	lIjhmyI.exe
4508	ngTIQDh.exe
3252	JnuwttU.exe
2388	qmGyWmf.exe
4988	mWVJDTE.exe
836	YAEZIqE.exe
4440	NAGpYfT.exe
3440	UMZVSMx.exe
2876	GUNrjYC.exe
4708	vuTteQA.exe
1756	QOAUbTq.exe
4136	kwjGvBg.exe
2328	JduSIjq.exe
844	mmiPowI.exe
4984	VmLQLAG.exe
4376	AINrotz.exe
4700	krVWwOX.exe
3476	OgYqfMP.exe
2324	scxAKyA.exe
2100	yRseFKv.exe
2648	WJYbryX.exe
4016	LdXybPZ.exe
4600	SVwHfEs.exe
2872	ErFJNTT.exe
384	mlaHkbg.exe
1892	xgjyFPS.exe
4452	yKzzwmD.exe
4164	MxiUzfd.exe
616	OUbDkzi.exe
116	rxBBXQz.exe
1308	LwCJOod.exe
2160	PgPqLIW.exe
2172	ekNCcEe.exe
3812	jThfVKt.exe
1336	OAaHpNL.exe
4020	ZXNiDrQ.exe
3176	tXNpipa.exe
2656	bgXqibk.exe
4808	rcirKNH.exe
3656	lGEnYOH.exe
544	paNKTOw.exe
5152	jkFmGmW.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UOfUdZX.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\ylcUmDS.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\UZznzTn.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\MOsIZFr.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\VslaVHq.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\zgYNhep.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\cZzZGsL.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\dwWzvbn.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\LeqjNrW.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\flrsjzk.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\kOlFrAy.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\PFPMyWp.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\PzVVwHu.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\NobRRhB.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\lpkZMfJ.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\KcEAvzZ.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\rLFHaDM.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\JnuwttU.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\YBDKDgu.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\QDyaBvL.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\lKFvmPf.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\EVVvWXR.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\ERhjnQi.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\KqHixEq.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\qYPpNYm.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\zBFkcEz.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\GQaaQRH.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\QCUBBYx.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\ylByNGd.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\AEGrHrV.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\TsVDtdV.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\RofyFIt.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\dHpCGUt.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\IIGhMhn.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\pAKXbjA.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\SVwHfEs.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\hvqgAJA.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\UjSRlsK.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\rpVsuFY.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\WfOknSy.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\zxujPkk.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\WFMPYOk.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\txGChJJ.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\vrkNdic.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\vFhRSbq.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\pjvYXfz.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\xftIdRv.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\tSfLpmL.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\WpFJjWo.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\nMcXrKh.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\vbajqct.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\SehMppZ.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\pPaysqo.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\wWmhxqG.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\Obtypmg.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\ErFJNTT.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\zBddsGP.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\UPPaEfi.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\tDckuGm.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\NqHuJdA.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\CJhTHis.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\nIfWUNJ.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\XnwMZkF.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
File created	C:\Windows\System\KBgXULj.exe	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16672	dwm.exe
Token: SeChangeNotifyPrivilege	16672	dwm.exe
Token: 33	16672	dwm.exe
Token: SeIncBasePriorityPrivilege	16672	dwm.exe
Token: SeShutdownPrivilege	16672	dwm.exe
Token: SeCreatePagefilePrivilege	16672	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 2516	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	90
PID 4828 wrote to memory of 2516	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	90
PID 4828 wrote to memory of 3324	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	91
PID 4828 wrote to memory of 3324	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	91
PID 4828 wrote to memory of 3232	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	92
PID 4828 wrote to memory of 3232	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	92
PID 4828 wrote to memory of 3408	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	93
PID 4828 wrote to memory of 3408	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	93
PID 4828 wrote to memory of 3016	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	94
PID 4828 wrote to memory of 3016	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	94
PID 4828 wrote to memory of 1488	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	95
PID 4828 wrote to memory of 1488	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	95
PID 4828 wrote to memory of 3460	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	96
PID 4828 wrote to memory of 3460	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	96
PID 4828 wrote to memory of 4576	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	97
PID 4828 wrote to memory of 4576	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	97
PID 4828 wrote to memory of 1240	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	98
PID 4828 wrote to memory of 1240	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	98
PID 4828 wrote to memory of 1992	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	99
PID 4828 wrote to memory of 1992	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	99
PID 4828 wrote to memory of 1904	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	100
PID 4828 wrote to memory of 1904	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	100
PID 4828 wrote to memory of 2220	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	101
PID 4828 wrote to memory of 2220	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	101
PID 4828 wrote to memory of 4968	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	102
PID 4828 wrote to memory of 4968	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	102
PID 4828 wrote to memory of 3032	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	103
PID 4828 wrote to memory of 3032	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	103
PID 4828 wrote to memory of 5068	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	104
PID 4828 wrote to memory of 5068	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	104
PID 4828 wrote to memory of 4072	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	105
PID 4828 wrote to memory of 4072	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	105
PID 4828 wrote to memory of 1560	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	106
PID 4828 wrote to memory of 1560	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	106
PID 4828 wrote to memory of 3112	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	107
PID 4828 wrote to memory of 3112	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	107
PID 4828 wrote to memory of 856	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	108
PID 4828 wrote to memory of 856	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	108
PID 4828 wrote to memory of 5108	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	109
PID 4828 wrote to memory of 5108	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	109
PID 4828 wrote to memory of 2748	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	110
PID 4828 wrote to memory of 2748	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	110
PID 4828 wrote to memory of 2304	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	111
PID 4828 wrote to memory of 2304	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	111
PID 4828 wrote to memory of 2928	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	112
PID 4828 wrote to memory of 2928	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	112
PID 4828 wrote to memory of 4508	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	116
PID 4828 wrote to memory of 4508	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	116
PID 4828 wrote to memory of 3252	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	117
PID 4828 wrote to memory of 3252	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	117
PID 4828 wrote to memory of 2388	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	118
PID 4828 wrote to memory of 2388	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	118
PID 4828 wrote to memory of 4988	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	120
PID 4828 wrote to memory of 4988	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	120
PID 4828 wrote to memory of 836	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	121
PID 4828 wrote to memory of 836	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	121
PID 4828 wrote to memory of 4440	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	122
PID 4828 wrote to memory of 4440	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	122
PID 4828 wrote to memory of 3440	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	123
PID 4828 wrote to memory of 3440	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	123
PID 4828 wrote to memory of 2876	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	124
PID 4828 wrote to memory of 2876	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	124
PID 4828 wrote to memory of 4708	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	126
PID 4828 wrote to memory of 4708	4828	5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe	126

C:\Users\Admin\AppData\Local\Temp\5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5c54daef36115c15d160d1c1e78ca500_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\System\taMMHeg.exe
  C:\Windows\System\taMMHeg.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\lKFvmPf.exe
  C:\Windows\System\lKFvmPf.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\VocrgRR.exe
  C:\Windows\System\VocrgRR.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\kwtmpWO.exe
  C:\Windows\System\kwtmpWO.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\CJhTHis.exe
  C:\Windows\System\CJhTHis.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\HmYrQyv.exe
  C:\Windows\System\HmYrQyv.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\WfOknSy.exe
  C:\Windows\System\WfOknSy.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\ajbNzsH.exe
  C:\Windows\System\ajbNzsH.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\ZGNVFQs.exe
  C:\Windows\System\ZGNVFQs.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\TfEJsss.exe
  C:\Windows\System\TfEJsss.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\FMviskz.exe
  C:\Windows\System\FMviskz.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\fJAFxRc.exe
  C:\Windows\System\fJAFxRc.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\ZvFrOVV.exe
  C:\Windows\System\ZvFrOVV.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\SZAqQJF.exe
  C:\Windows\System\SZAqQJF.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\fJMQMUv.exe
  C:\Windows\System\fJMQMUv.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\oGddGqM.exe
  C:\Windows\System\oGddGqM.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\AEGrHrV.exe
  C:\Windows\System\AEGrHrV.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\lBQvYfR.exe
  C:\Windows\System\lBQvYfR.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\IjPpYtA.exe
  C:\Windows\System\IjPpYtA.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\pAKXbjA.exe
  C:\Windows\System\pAKXbjA.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\wEEVhKI.exe
  C:\Windows\System\wEEVhKI.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\bkgWGuq.exe
  C:\Windows\System\bkgWGuq.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\lIjhmyI.exe
  C:\Windows\System\lIjhmyI.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\ngTIQDh.exe
  C:\Windows\System\ngTIQDh.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\JnuwttU.exe
  C:\Windows\System\JnuwttU.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\qmGyWmf.exe
  C:\Windows\System\qmGyWmf.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\mWVJDTE.exe
  C:\Windows\System\mWVJDTE.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\YAEZIqE.exe
  C:\Windows\System\YAEZIqE.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\NAGpYfT.exe
  C:\Windows\System\NAGpYfT.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\UMZVSMx.exe
  C:\Windows\System\UMZVSMx.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\GUNrjYC.exe
  C:\Windows\System\GUNrjYC.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\vuTteQA.exe
  C:\Windows\System\vuTteQA.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\QOAUbTq.exe
  C:\Windows\System\QOAUbTq.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\kwjGvBg.exe
  C:\Windows\System\kwjGvBg.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\JduSIjq.exe
  C:\Windows\System\JduSIjq.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\mmiPowI.exe
  C:\Windows\System\mmiPowI.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\VmLQLAG.exe
  C:\Windows\System\VmLQLAG.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\AINrotz.exe
  C:\Windows\System\AINrotz.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\krVWwOX.exe
  C:\Windows\System\krVWwOX.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\OgYqfMP.exe
  C:\Windows\System\OgYqfMP.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\scxAKyA.exe
  C:\Windows\System\scxAKyA.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\yRseFKv.exe
  C:\Windows\System\yRseFKv.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\WJYbryX.exe
  C:\Windows\System\WJYbryX.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\LdXybPZ.exe
  C:\Windows\System\LdXybPZ.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\SVwHfEs.exe
  C:\Windows\System\SVwHfEs.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\ErFJNTT.exe
  C:\Windows\System\ErFJNTT.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\mlaHkbg.exe
  C:\Windows\System\mlaHkbg.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\xgjyFPS.exe
  C:\Windows\System\xgjyFPS.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\yKzzwmD.exe
  C:\Windows\System\yKzzwmD.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\MxiUzfd.exe
  C:\Windows\System\MxiUzfd.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\OUbDkzi.exe
  C:\Windows\System\OUbDkzi.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\rxBBXQz.exe
  C:\Windows\System\rxBBXQz.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\LwCJOod.exe
  C:\Windows\System\LwCJOod.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\PgPqLIW.exe
  C:\Windows\System\PgPqLIW.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\ekNCcEe.exe
  C:\Windows\System\ekNCcEe.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\jThfVKt.exe
  C:\Windows\System\jThfVKt.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\OAaHpNL.exe
  C:\Windows\System\OAaHpNL.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\ZXNiDrQ.exe
  C:\Windows\System\ZXNiDrQ.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\tXNpipa.exe
  C:\Windows\System\tXNpipa.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\bgXqibk.exe
  C:\Windows\System\bgXqibk.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\rcirKNH.exe
  C:\Windows\System\rcirKNH.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\lGEnYOH.exe
  C:\Windows\System\lGEnYOH.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\paNKTOw.exe
  C:\Windows\System\paNKTOw.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\jkFmGmW.exe
  C:\Windows\System\jkFmGmW.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\PzDmCut.exe
  C:\Windows\System\PzDmCut.exe
  2⤵
  PID:5184
- C:\Windows\System\ELSDdBZ.exe
  C:\Windows\System\ELSDdBZ.exe
  2⤵
  PID:5224
- C:\Windows\System\AtLimvI.exe
  C:\Windows\System\AtLimvI.exe
  2⤵
  PID:5252
- C:\Windows\System\zyrUhHc.exe
  C:\Windows\System\zyrUhHc.exe
  2⤵
  PID:5280
- C:\Windows\System\lPLVqvg.exe
  C:\Windows\System\lPLVqvg.exe
  2⤵
  PID:5308
- C:\Windows\System\sLVjPCl.exe
  C:\Windows\System\sLVjPCl.exe
  2⤵
  PID:5336
- C:\Windows\System\XjIIGHd.exe
  C:\Windows\System\XjIIGHd.exe
  2⤵
  PID:5364
- C:\Windows\System\txGChJJ.exe
  C:\Windows\System\txGChJJ.exe
  2⤵
  PID:5392
- C:\Windows\System\ctuhrWr.exe
  C:\Windows\System\ctuhrWr.exe
  2⤵
  PID:5432
- C:\Windows\System\pyaZggz.exe
  C:\Windows\System\pyaZggz.exe
  2⤵
  PID:5448
- C:\Windows\System\LwDlJuz.exe
  C:\Windows\System\LwDlJuz.exe
  2⤵
  PID:5476
- C:\Windows\System\HWsWvqT.exe
  C:\Windows\System\HWsWvqT.exe
  2⤵
  PID:5504
- C:\Windows\System\SwWJYVh.exe
  C:\Windows\System\SwWJYVh.exe
  2⤵
  PID:5524
- C:\Windows\System\RbjjGPA.exe
  C:\Windows\System\RbjjGPA.exe
  2⤵
  PID:5560
- C:\Windows\System\QMGsAGm.exe
  C:\Windows\System\QMGsAGm.exe
  2⤵
  PID:5588
- C:\Windows\System\cZzZGsL.exe
  C:\Windows\System\cZzZGsL.exe
  2⤵
  PID:5612
- C:\Windows\System\CoVCZlJ.exe
  C:\Windows\System\CoVCZlJ.exe
  2⤵
  PID:5640
- C:\Windows\System\CpcBUkN.exe
  C:\Windows\System\CpcBUkN.exe
  2⤵
  PID:5660
- C:\Windows\System\UxXcShC.exe
  C:\Windows\System\UxXcShC.exe
  2⤵
  PID:5688
- C:\Windows\System\eqjSgOT.exe
  C:\Windows\System\eqjSgOT.exe
  2⤵
  PID:5716
- C:\Windows\System\FwcwdWp.exe
  C:\Windows\System\FwcwdWp.exe
  2⤵
  PID:5744
- C:\Windows\System\Zfvgkxj.exe
  C:\Windows\System\Zfvgkxj.exe
  2⤵
  PID:5772
- C:\Windows\System\sHTEZQA.exe
  C:\Windows\System\sHTEZQA.exe
  2⤵
  PID:5808
- C:\Windows\System\twVrjMB.exe
  C:\Windows\System\twVrjMB.exe
  2⤵
  PID:5848
- C:\Windows\System\uagaXDz.exe
  C:\Windows\System\uagaXDz.exe
  2⤵
  PID:5876
- C:\Windows\System\MNwlwmV.exe
  C:\Windows\System\MNwlwmV.exe
  2⤵
  PID:5900
- C:\Windows\System\EyJkbqq.exe
  C:\Windows\System\EyJkbqq.exe
  2⤵
  PID:5924
- C:\Windows\System\uxCRrDT.exe
  C:\Windows\System\uxCRrDT.exe
  2⤵
  PID:5948
- C:\Windows\System\VrKxDDV.exe
  C:\Windows\System\VrKxDDV.exe
  2⤵
  PID:5972
- C:\Windows\System\wlpNzZr.exe
  C:\Windows\System\wlpNzZr.exe
  2⤵
  PID:5996
- C:\Windows\System\wmoNqJg.exe
  C:\Windows\System\wmoNqJg.exe
  2⤵
  PID:6028
- C:\Windows\System\UDXCiFM.exe
  C:\Windows\System\UDXCiFM.exe
  2⤵
  PID:6064
- C:\Windows\System\hnKcWzb.exe
  C:\Windows\System\hnKcWzb.exe
  2⤵
  PID:6104
- C:\Windows\System\TBfxrTM.exe
  C:\Windows\System\TBfxrTM.exe
  2⤵
  PID:6132
- C:\Windows\System\VCBTPhH.exe
  C:\Windows\System\VCBTPhH.exe
  2⤵
  PID:5140
- C:\Windows\System\bzczItr.exe
  C:\Windows\System\bzczItr.exe
  2⤵
  PID:5192
- C:\Windows\System\KqHixEq.exe
  C:\Windows\System\KqHixEq.exe
  2⤵
  PID:5240
- C:\Windows\System\NvOsXJy.exe
  C:\Windows\System\NvOsXJy.exe
  2⤵
  PID:5296
- C:\Windows\System\Obtypmg.exe
  C:\Windows\System\Obtypmg.exe
  2⤵
  PID:5360
- C:\Windows\System\olopBKK.exe
  C:\Windows\System\olopBKK.exe
  2⤵
  PID:5460
- C:\Windows\System\FpcPOqF.exe
  C:\Windows\System\FpcPOqF.exe
  2⤵
  PID:5520
- C:\Windows\System\DaoOnVd.exe
  C:\Windows\System\DaoOnVd.exe
  2⤵
  PID:5572
- C:\Windows\System\Wfufvba.exe
  C:\Windows\System\Wfufvba.exe
  2⤵
  PID:5632
- C:\Windows\System\ZXYnwne.exe
  C:\Windows\System\ZXYnwne.exe
  2⤵
  PID:5672
- C:\Windows\System\rqeIOxZ.exe
  C:\Windows\System\rqeIOxZ.exe
  2⤵
  PID:5756
- C:\Windows\System\DpiZxeU.exe
  C:\Windows\System\DpiZxeU.exe
  2⤵
  PID:5824
- C:\Windows\System\CzQIRkD.exe
  C:\Windows\System\CzQIRkD.exe
  2⤵
  PID:5908
- C:\Windows\System\GZDmENZ.exe
  C:\Windows\System\GZDmENZ.exe
  2⤵
  PID:5960
- C:\Windows\System\PlOUZBo.exe
  C:\Windows\System\PlOUZBo.exe
  2⤵
  PID:6024
- C:\Windows\System\xZahYRD.exe
  C:\Windows\System\xZahYRD.exe
  2⤵
  PID:6096
- C:\Windows\System\ylcUmDS.exe
  C:\Windows\System\ylcUmDS.exe
  2⤵
  PID:1248
- C:\Windows\System\nmWlYPr.exe
  C:\Windows\System\nmWlYPr.exe
  2⤵
  PID:5332
- C:\Windows\System\amxgpLC.exe
  C:\Windows\System\amxgpLC.exe
  2⤵
  PID:5496
- C:\Windows\System\ZVFJOzY.exe
  C:\Windows\System\ZVFJOzY.exe
  2⤵
  PID:5648
- C:\Windows\System\moKxBHI.exe
  C:\Windows\System\moKxBHI.exe
  2⤵
  PID:5764
- C:\Windows\System\pvwYhDp.exe
  C:\Windows\System\pvwYhDp.exe
  2⤵
  PID:6016
- C:\Windows\System\QUmFJFs.exe
  C:\Windows\System\QUmFJFs.exe
  2⤵
  PID:6040
- C:\Windows\System\tYlFkTV.exe
  C:\Windows\System\tYlFkTV.exe
  2⤵
  PID:5200
- C:\Windows\System\JtztdCD.exe
  C:\Windows\System\JtztdCD.exe
  2⤵
  PID:5416
- C:\Windows\System\yxKBHyt.exe
  C:\Windows\System\yxKBHyt.exe
  2⤵
  PID:5736
- C:\Windows\System\HrfezJa.exe
  C:\Windows\System\HrfezJa.exe
  2⤵
  PID:5832
- C:\Windows\System\WMyqwGF.exe
  C:\Windows\System\WMyqwGF.exe
  2⤵
  PID:5544
- C:\Windows\System\SHrZOPW.exe
  C:\Windows\System\SHrZOPW.exe
  2⤵
  PID:6156
- C:\Windows\System\HPfrBii.exe
  C:\Windows\System\HPfrBii.exe
  2⤵
  PID:6176
- C:\Windows\System\yjpvkps.exe
  C:\Windows\System\yjpvkps.exe
  2⤵
  PID:6196
- C:\Windows\System\rsHoFMi.exe
  C:\Windows\System\rsHoFMi.exe
  2⤵
  PID:6228
- C:\Windows\System\UFqttOD.exe
  C:\Windows\System\UFqttOD.exe
  2⤵
  PID:6256
- C:\Windows\System\YdxSJBM.exe
  C:\Windows\System\YdxSJBM.exe
  2⤵
  PID:6284
- C:\Windows\System\oJxXXGs.exe
  C:\Windows\System\oJxXXGs.exe
  2⤵
  PID:6320
- C:\Windows\System\UlKiCaB.exe
  C:\Windows\System\UlKiCaB.exe
  2⤵
  PID:6344
- C:\Windows\System\TsVDtdV.exe
  C:\Windows\System\TsVDtdV.exe
  2⤵
  PID:6368
- C:\Windows\System\cWGLADh.exe
  C:\Windows\System\cWGLADh.exe
  2⤵
  PID:6420
- C:\Windows\System\aTqbksC.exe
  C:\Windows\System\aTqbksC.exe
  2⤵
  PID:6452
- C:\Windows\System\vJJVRKN.exe
  C:\Windows\System\vJJVRKN.exe
  2⤵
  PID:6480
- C:\Windows\System\NobRRhB.exe
  C:\Windows\System\NobRRhB.exe
  2⤵
  PID:6504
- C:\Windows\System\RtbfOwn.exe
  C:\Windows\System\RtbfOwn.exe
  2⤵
  PID:6528
- C:\Windows\System\WlNkZPT.exe
  C:\Windows\System\WlNkZPT.exe
  2⤵
  PID:6552
- C:\Windows\System\yeJWjYY.exe
  C:\Windows\System\yeJWjYY.exe
  2⤵
  PID:6580
- C:\Windows\System\npUjdrR.exe
  C:\Windows\System\npUjdrR.exe
  2⤵
  PID:6620
- C:\Windows\System\DgStwxm.exe
  C:\Windows\System\DgStwxm.exe
  2⤵
  PID:6648
- C:\Windows\System\COQtqcf.exe
  C:\Windows\System\COQtqcf.exe
  2⤵
  PID:6664
- C:\Windows\System\YxkcCHw.exe
  C:\Windows\System\YxkcCHw.exe
  2⤵
  PID:6700
- C:\Windows\System\cqpDBNs.exe
  C:\Windows\System\cqpDBNs.exe
  2⤵
  PID:6732
- C:\Windows\System\hyXKZoc.exe
  C:\Windows\System\hyXKZoc.exe
  2⤵
  PID:6760
- C:\Windows\System\uoBLPXd.exe
  C:\Windows\System\uoBLPXd.exe
  2⤵
  PID:6788
- C:\Windows\System\efZQHUW.exe
  C:\Windows\System\efZQHUW.exe
  2⤵
  PID:6804
- C:\Windows\System\pPaysqo.exe
  C:\Windows\System\pPaysqo.exe
  2⤵
  PID:6820
- C:\Windows\System\vENGkxr.exe
  C:\Windows\System\vENGkxr.exe
  2⤵
  PID:6860
- C:\Windows\System\hLizMMX.exe
  C:\Windows\System\hLizMMX.exe
  2⤵
  PID:6888
- C:\Windows\System\CoohDZV.exe
  C:\Windows\System\CoohDZV.exe
  2⤵
  PID:6908
- C:\Windows\System\GGyXZJv.exe
  C:\Windows\System\GGyXZJv.exe
  2⤵
  PID:6944
- C:\Windows\System\mbnMOcT.exe
  C:\Windows\System\mbnMOcT.exe
  2⤵
  PID:6960
- C:\Windows\System\hrcuJsh.exe
  C:\Windows\System\hrcuJsh.exe
  2⤵
  PID:6992
- C:\Windows\System\ewhnhnz.exe
  C:\Windows\System\ewhnhnz.exe
  2⤵
  PID:7032
- C:\Windows\System\bZCypei.exe
  C:\Windows\System\bZCypei.exe
  2⤵
  PID:7068
- C:\Windows\System\KrNQYEH.exe
  C:\Windows\System\KrNQYEH.exe
  2⤵
  PID:7096
- C:\Windows\System\zdoiMKW.exe
  C:\Windows\System\zdoiMKW.exe
  2⤵
  PID:7124
- C:\Windows\System\elCwUkG.exe
  C:\Windows\System\elCwUkG.exe
  2⤵
  PID:7152
- C:\Windows\System\IeGsACL.exe
  C:\Windows\System\IeGsACL.exe
  2⤵
  PID:6220
- C:\Windows\System\zBddsGP.exe
  C:\Windows\System\zBddsGP.exe
  2⤵
  PID:6292
- C:\Windows\System\LqJBpCp.exe
  C:\Windows\System\LqJBpCp.exe
  2⤵
  PID:6268
- C:\Windows\System\LAjYWtu.exe
  C:\Windows\System\LAjYWtu.exe
  2⤵
  PID:6332
- C:\Windows\System\ClXsORD.exe
  C:\Windows\System\ClXsORD.exe
  2⤵
  PID:6412
- C:\Windows\System\PyhpOBs.exe
  C:\Windows\System\PyhpOBs.exe
  2⤵
  PID:6512
- C:\Windows\System\XHyVRBf.exe
  C:\Windows\System\XHyVRBf.exe
  2⤵
  PID:6564
- C:\Windows\System\zTNXwOD.exe
  C:\Windows\System\zTNXwOD.exe
  2⤵
  PID:6616
- C:\Windows\System\qdywGhw.exe
  C:\Windows\System\qdywGhw.exe
  2⤵
  PID:6684
- C:\Windows\System\UPdyViR.exe
  C:\Windows\System\UPdyViR.exe
  2⤵
  PID:5844
- C:\Windows\System\kOlFrAy.exe
  C:\Windows\System\kOlFrAy.exe
  2⤵
  PID:6816
- C:\Windows\System\pZBoEVy.exe
  C:\Windows\System\pZBoEVy.exe
  2⤵
  PID:6880
- C:\Windows\System\BfBoFaz.exe
  C:\Windows\System\BfBoFaz.exe
  2⤵
  PID:6936
- C:\Windows\System\oFRXVcQ.exe
  C:\Windows\System\oFRXVcQ.exe
  2⤵
  PID:6984
- C:\Windows\System\jmMgznO.exe
  C:\Windows\System\jmMgznO.exe
  2⤵
  PID:7088
- C:\Windows\System\XovKjlH.exe
  C:\Windows\System\XovKjlH.exe
  2⤵
  PID:7144
- C:\Windows\System\TWuJywp.exe
  C:\Windows\System\TWuJywp.exe
  2⤵
  PID:6240
- C:\Windows\System\dBufZlo.exe
  C:\Windows\System\dBufZlo.exe
  2⤵
  PID:6360
- C:\Windows\System\lIEYSjm.exe
  C:\Windows\System\lIEYSjm.exe
  2⤵
  PID:6544
- C:\Windows\System\sRevkaL.exe
  C:\Windows\System\sRevkaL.exe
  2⤵
  PID:6656
- C:\Windows\System\cNzmOTz.exe
  C:\Windows\System\cNzmOTz.exe
  2⤵
  PID:6800
- C:\Windows\System\XTwSYGR.exe
  C:\Windows\System\XTwSYGR.exe
  2⤵
  PID:6896
- C:\Windows\System\dahJZFH.exe
  C:\Windows\System\dahJZFH.exe
  2⤵
  PID:6988
- C:\Windows\System\lIntGgZ.exe
  C:\Windows\System\lIntGgZ.exe
  2⤵
  PID:6192
- C:\Windows\System\WifQnkw.exe
  C:\Windows\System\WifQnkw.exe
  2⤵
  PID:6568
- C:\Windows\System\noxkglg.exe
  C:\Windows\System\noxkglg.exe
  2⤵
  PID:6148
- C:\Windows\System\CvCZSvM.exe
  C:\Windows\System\CvCZSvM.exe
  2⤵
  PID:6884
- C:\Windows\System\lYHrXVf.exe
  C:\Windows\System\lYHrXVf.exe
  2⤵
  PID:7188
- C:\Windows\System\EVVvWXR.exe
  C:\Windows\System\EVVvWXR.exe
  2⤵
  PID:7212
- C:\Windows\System\SFvVPUE.exe
  C:\Windows\System\SFvVPUE.exe
  2⤵
  PID:7232
- C:\Windows\System\ggWCyFb.exe
  C:\Windows\System\ggWCyFb.exe
  2⤵
  PID:7256
- C:\Windows\System\GQaaQRH.exe
  C:\Windows\System\GQaaQRH.exe
  2⤵
  PID:7284
- C:\Windows\System\flrsjzk.exe
  C:\Windows\System\flrsjzk.exe
  2⤵
  PID:7324
- C:\Windows\System\CiBRJOI.exe
  C:\Windows\System\CiBRJOI.exe
  2⤵
  PID:7360
- C:\Windows\System\DXReDPC.exe
  C:\Windows\System\DXReDPC.exe
  2⤵
  PID:7392
- C:\Windows\System\alWnNeF.exe
  C:\Windows\System\alWnNeF.exe
  2⤵
  PID:7420
- C:\Windows\System\MjplIOy.exe
  C:\Windows\System\MjplIOy.exe
  2⤵
  PID:7444
- C:\Windows\System\LCnBmfh.exe
  C:\Windows\System\LCnBmfh.exe
  2⤵
  PID:7468
- C:\Windows\System\KaCoaVX.exe
  C:\Windows\System\KaCoaVX.exe
  2⤵
  PID:7492
- C:\Windows\System\KDhDwRa.exe
  C:\Windows\System\KDhDwRa.exe
  2⤵
  PID:7520
- C:\Windows\System\UXNKbOO.exe
  C:\Windows\System\UXNKbOO.exe
  2⤵
  PID:7548
- C:\Windows\System\ppipVwU.exe
  C:\Windows\System\ppipVwU.exe
  2⤵
  PID:7572
- C:\Windows\System\ntUjzDJ.exe
  C:\Windows\System\ntUjzDJ.exe
  2⤵
  PID:7604
- C:\Windows\System\hvqgAJA.exe
  C:\Windows\System\hvqgAJA.exe
  2⤵
  PID:7644
- C:\Windows\System\wsUAJhG.exe
  C:\Windows\System\wsUAJhG.exe
  2⤵
  PID:7672
- C:\Windows\System\XSezkfH.exe
  C:\Windows\System\XSezkfH.exe
  2⤵
  PID:7700
- C:\Windows\System\gGeaXmF.exe
  C:\Windows\System\gGeaXmF.exe
  2⤵
  PID:7728
- C:\Windows\System\PcWYnLq.exe
  C:\Windows\System\PcWYnLq.exe
  2⤵
  PID:7744
- C:\Windows\System\hXHvOQZ.exe
  C:\Windows\System\hXHvOQZ.exe
  2⤵
  PID:7768
- C:\Windows\System\TnSGmiV.exe
  C:\Windows\System\TnSGmiV.exe
  2⤵
  PID:7792
- C:\Windows\System\XTTrTGV.exe
  C:\Windows\System\XTTrTGV.exe
  2⤵
  PID:7828
- C:\Windows\System\oCWTBzB.exe
  C:\Windows\System\oCWTBzB.exe
  2⤵
  PID:7856
- C:\Windows\System\vpIfvPp.exe
  C:\Windows\System\vpIfvPp.exe
  2⤵
  PID:7884
- C:\Windows\System\NMleflo.exe
  C:\Windows\System\NMleflo.exe
  2⤵
  PID:7900
- C:\Windows\System\vinzSSs.exe
  C:\Windows\System\vinzSSs.exe
  2⤵
  PID:7924
- C:\Windows\System\ZeUihVF.exe
  C:\Windows\System\ZeUihVF.exe
  2⤵
  PID:7964
- C:\Windows\System\gewzKbz.exe
  C:\Windows\System\gewzKbz.exe
  2⤵
  PID:7996
- C:\Windows\System\MDfllFx.exe
  C:\Windows\System\MDfllFx.exe
  2⤵
  PID:8020
- C:\Windows\System\oOjDFLl.exe
  C:\Windows\System\oOjDFLl.exe
  2⤵
  PID:8036
- C:\Windows\System\nAgfyDE.exe
  C:\Windows\System\nAgfyDE.exe
  2⤵
  PID:8092
- C:\Windows\System\RqvdkGG.exe
  C:\Windows\System\RqvdkGG.exe
  2⤵
  PID:8120
- C:\Windows\System\MMDidQa.exe
  C:\Windows\System\MMDidQa.exe
  2⤵
  PID:8148
- C:\Windows\System\gpQzHda.exe
  C:\Windows\System\gpQzHda.exe
  2⤵
  PID:8176
- C:\Windows\System\tBVckVQ.exe
  C:\Windows\System\tBVckVQ.exe
  2⤵
  PID:7184
- C:\Windows\System\YBDKDgu.exe
  C:\Windows\System\YBDKDgu.exe
  2⤵
  PID:7244
- C:\Windows\System\tBZSMPM.exe
  C:\Windows\System\tBZSMPM.exe
  2⤵
  PID:7296
- C:\Windows\System\EVbgYRz.exe
  C:\Windows\System\EVbgYRz.exe
  2⤵
  PID:7340
- C:\Windows\System\MPWPSJb.exe
  C:\Windows\System\MPWPSJb.exe
  2⤵
  PID:7384
- C:\Windows\System\IxFKDsP.exe
  C:\Windows\System\IxFKDsP.exe
  2⤵
  PID:7428
- C:\Windows\System\Cfitduh.exe
  C:\Windows\System\Cfitduh.exe
  2⤵
  PID:7512
- C:\Windows\System\UjSRlsK.exe
  C:\Windows\System\UjSRlsK.exe
  2⤵
  PID:7560
- C:\Windows\System\jnsFCsH.exe
  C:\Windows\System\jnsFCsH.exe
  2⤵
  PID:7656
- C:\Windows\System\DOWFvVZ.exe
  C:\Windows\System\DOWFvVZ.exe
  2⤵
  PID:7696
- C:\Windows\System\RkxcmQh.exe
  C:\Windows\System\RkxcmQh.exe
  2⤵
  PID:7780
- C:\Windows\System\FeuifYF.exe
  C:\Windows\System\FeuifYF.exe
  2⤵
  PID:7868
- C:\Windows\System\VHcFcku.exe
  C:\Windows\System\VHcFcku.exe
  2⤵
  PID:7912
- C:\Windows\System\RYNzNjo.exe
  C:\Windows\System\RYNzNjo.exe
  2⤵
  PID:7984
- C:\Windows\System\mWjwMlB.exe
  C:\Windows\System\mWjwMlB.exe
  2⤵
  PID:8076
- C:\Windows\System\MwtGQBJ.exe
  C:\Windows\System\MwtGQBJ.exe
  2⤵
  PID:8132
- C:\Windows\System\OTOwVeH.exe
  C:\Windows\System\OTOwVeH.exe
  2⤵
  PID:6184
- C:\Windows\System\bHYPJko.exe
  C:\Windows\System\bHYPJko.exe
  2⤵
  PID:7268
- C:\Windows\System\eplIXrC.exe
  C:\Windows\System\eplIXrC.exe
  2⤵
  PID:7544
- C:\Windows\System\gBNtZRh.exe
  C:\Windows\System\gBNtZRh.exe
  2⤵
  PID:7600
- C:\Windows\System\qeXHmYr.exe
  C:\Windows\System\qeXHmYr.exe
  2⤵
  PID:7764
- C:\Windows\System\IIGhMhn.exe
  C:\Windows\System\IIGhMhn.exe
  2⤵
  PID:7948
- C:\Windows\System\tbZQIWg.exe
  C:\Windows\System\tbZQIWg.exe
  2⤵
  PID:8160
- C:\Windows\System\vNcsIsm.exe
  C:\Windows\System\vNcsIsm.exe
  2⤵
  PID:7408
- C:\Windows\System\Odyybjh.exe
  C:\Windows\System\Odyybjh.exe
  2⤵
  PID:7852
- C:\Windows\System\icghidE.exe
  C:\Windows\System\icghidE.exe
  2⤵
  PID:7692
- C:\Windows\System\dBKIBYU.exe
  C:\Windows\System\dBKIBYU.exe
  2⤵
  PID:7248
- C:\Windows\System\OKltTfx.exe
  C:\Windows\System\OKltTfx.exe
  2⤵
  PID:8216
- C:\Windows\System\fxcbHjv.exe
  C:\Windows\System\fxcbHjv.exe
  2⤵
  PID:8236
- C:\Windows\System\pVubZTu.exe
  C:\Windows\System\pVubZTu.exe
  2⤵
  PID:8264
- C:\Windows\System\mLEMerv.exe
  C:\Windows\System\mLEMerv.exe
  2⤵
  PID:8304
- C:\Windows\System\cnyQRff.exe
  C:\Windows\System\cnyQRff.exe
  2⤵
  PID:8332
- C:\Windows\System\lMiMVQe.exe
  C:\Windows\System\lMiMVQe.exe
  2⤵
  PID:8360
- C:\Windows\System\DkicPaQ.exe
  C:\Windows\System\DkicPaQ.exe
  2⤵
  PID:8388
- C:\Windows\System\nVRERjl.exe
  C:\Windows\System\nVRERjl.exe
  2⤵
  PID:8416
- C:\Windows\System\WAeaYJM.exe
  C:\Windows\System\WAeaYJM.exe
  2⤵
  PID:8444
- C:\Windows\System\CiKDsBu.exe
  C:\Windows\System\CiKDsBu.exe
  2⤵
  PID:8460
- C:\Windows\System\HzMmbzI.exe
  C:\Windows\System\HzMmbzI.exe
  2⤵
  PID:8492
- C:\Windows\System\eTeEiRj.exe
  C:\Windows\System\eTeEiRj.exe
  2⤵
  PID:8516
- C:\Windows\System\TzkLgCh.exe
  C:\Windows\System\TzkLgCh.exe
  2⤵
  PID:8556
- C:\Windows\System\slyRyXy.exe
  C:\Windows\System\slyRyXy.exe
  2⤵
  PID:8584
- C:\Windows\System\CeMsHRz.exe
  C:\Windows\System\CeMsHRz.exe
  2⤵
  PID:8600
- C:\Windows\System\oDXHIRH.exe
  C:\Windows\System\oDXHIRH.exe
  2⤵
  PID:8636
- C:\Windows\System\ERhjnQi.exe
  C:\Windows\System\ERhjnQi.exe
  2⤵
  PID:8668
- C:\Windows\System\OleRGSq.exe
  C:\Windows\System\OleRGSq.exe
  2⤵
  PID:8684
- C:\Windows\System\vcXsmGf.exe
  C:\Windows\System\vcXsmGf.exe
  2⤵
  PID:8716
- C:\Windows\System\HcTcWio.exe
  C:\Windows\System\HcTcWio.exe
  2⤵
  PID:8740
- C:\Windows\System\hbPRpzB.exe
  C:\Windows\System\hbPRpzB.exe
  2⤵
  PID:8772
- C:\Windows\System\xftIdRv.exe
  C:\Windows\System\xftIdRv.exe
  2⤵
  PID:8808
- C:\Windows\System\yPKvScO.exe
  C:\Windows\System\yPKvScO.exe
  2⤵
  PID:8824
- C:\Windows\System\uehYfoM.exe
  C:\Windows\System\uehYfoM.exe
  2⤵
  PID:8852
- C:\Windows\System\IqqkBfT.exe
  C:\Windows\System\IqqkBfT.exe
  2⤵
  PID:8888
- C:\Windows\System\JJpVLBi.exe
  C:\Windows\System\JJpVLBi.exe
  2⤵
  PID:8908
- C:\Windows\System\kxBunPQ.exe
  C:\Windows\System\kxBunPQ.exe
  2⤵
  PID:8936
- C:\Windows\System\rnDHhyR.exe
  C:\Windows\System\rnDHhyR.exe
  2⤵
  PID:8964
- C:\Windows\System\CKvpoyS.exe
  C:\Windows\System\CKvpoyS.exe
  2⤵
  PID:8988
- C:\Windows\System\DoVTZeg.exe
  C:\Windows\System\DoVTZeg.exe
  2⤵
  PID:9044
- C:\Windows\System\jFfsQaS.exe
  C:\Windows\System\jFfsQaS.exe
  2⤵
  PID:9060
- C:\Windows\System\UxOhgVn.exe
  C:\Windows\System\UxOhgVn.exe
  2⤵
  PID:9088
- C:\Windows\System\kxHiHsU.exe
  C:\Windows\System\kxHiHsU.exe
  2⤵
  PID:9112
- C:\Windows\System\JaqCEEO.exe
  C:\Windows\System\JaqCEEO.exe
  2⤵
  PID:9144
- C:\Windows\System\plUCAqD.exe
  C:\Windows\System\plUCAqD.exe
  2⤵
  PID:9164
- C:\Windows\System\GMnhPSr.exe
  C:\Windows\System\GMnhPSr.exe
  2⤵
  PID:9188
- C:\Windows\System\TewSZzP.exe
  C:\Windows\System\TewSZzP.exe
  2⤵
  PID:8228
- C:\Windows\System\EVlxOFR.exe
  C:\Windows\System\EVlxOFR.exe
  2⤵
  PID:8256
- C:\Windows\System\EtSQwvo.exe
  C:\Windows\System\EtSQwvo.exe
  2⤵
  PID:8356
- C:\Windows\System\VyoigYC.exe
  C:\Windows\System\VyoigYC.exe
  2⤵
  PID:8408
- C:\Windows\System\NYfMomh.exe
  C:\Windows\System\NYfMomh.exe
  2⤵
  PID:8476
- C:\Windows\System\jjVUdAF.exe
  C:\Windows\System\jjVUdAF.exe
  2⤵
  PID:8548
- C:\Windows\System\JuCdUuf.exe
  C:\Windows\System\JuCdUuf.exe
  2⤵
  PID:8568
- C:\Windows\System\dHpCGUt.exe
  C:\Windows\System\dHpCGUt.exe
  2⤵
  PID:8656
- C:\Windows\System\rRWcZLn.exe
  C:\Windows\System\rRWcZLn.exe
  2⤵
  PID:8752
- C:\Windows\System\MzADnIb.exe
  C:\Windows\System\MzADnIb.exe
  2⤵
  PID:8764
- C:\Windows\System\fvIPmqJ.exe
  C:\Windows\System\fvIPmqJ.exe
  2⤵
  PID:8844
- C:\Windows\System\tPERPeq.exe
  C:\Windows\System\tPERPeq.exe
  2⤵
  PID:8928
- C:\Windows\System\RyDVcus.exe
  C:\Windows\System\RyDVcus.exe
  2⤵
  PID:9004
- C:\Windows\System\fiihriS.exe
  C:\Windows\System\fiihriS.exe
  2⤵
  PID:9052
- C:\Windows\System\DkMEGAP.exe
  C:\Windows\System\DkMEGAP.exe
  2⤵
  PID:9120
- C:\Windows\System\bqXndvR.exe
  C:\Windows\System\bqXndvR.exe
  2⤵
  PID:9184
- C:\Windows\System\DoujSWZ.exe
  C:\Windows\System\DoujSWZ.exe
  2⤵
  PID:8316
- C:\Windows\System\UuRTsle.exe
  C:\Windows\System\UuRTsle.exe
  2⤵
  PID:8400
- C:\Windows\System\ADYOBRe.exe
  C:\Windows\System\ADYOBRe.exe
  2⤵
  PID:8532
- C:\Windows\System\gHjrQom.exe
  C:\Windows\System\gHjrQom.exe
  2⤵
  PID:8700
- C:\Windows\System\zaiaGYb.exe
  C:\Windows\System\zaiaGYb.exe
  2⤵
  PID:8792
- C:\Windows\System\VdOOBKF.exe
  C:\Windows\System\VdOOBKF.exe
  2⤵
  PID:8916
- C:\Windows\System\ypZYhgE.exe
  C:\Windows\System\ypZYhgE.exe
  2⤵
  PID:9128
- C:\Windows\System\zevPeAe.exe
  C:\Windows\System\zevPeAe.exe
  2⤵
  PID:8292
- C:\Windows\System\MWtCgaT.exe
  C:\Windows\System\MWtCgaT.exe
  2⤵
  PID:8836
- C:\Windows\System\iwSwyvn.exe
  C:\Windows\System\iwSwyvn.exe
  2⤵
  PID:8976
- C:\Windows\System\zgOGEHz.exe
  C:\Windows\System\zgOGEHz.exe
  2⤵
  PID:9104
- C:\Windows\System\LzLwmOq.exe
  C:\Windows\System\LzLwmOq.exe
  2⤵
  PID:8200
- C:\Windows\System\aoKNGQR.exe
  C:\Windows\System\aoKNGQR.exe
  2⤵
  PID:9236
- C:\Windows\System\mDDSDaL.exe
  C:\Windows\System\mDDSDaL.exe
  2⤵
  PID:9260
- C:\Windows\System\wLJitLH.exe
  C:\Windows\System\wLJitLH.exe
  2⤵
  PID:9292
- C:\Windows\System\qBGPYsI.exe
  C:\Windows\System\qBGPYsI.exe
  2⤵
  PID:9324
- C:\Windows\System\yDxwQux.exe
  C:\Windows\System\yDxwQux.exe
  2⤵
  PID:9348
- C:\Windows\System\VULXEMV.exe
  C:\Windows\System\VULXEMV.exe
  2⤵
  PID:9380
- C:\Windows\System\HXZBxmM.exe
  C:\Windows\System\HXZBxmM.exe
  2⤵
  PID:9428
- C:\Windows\System\SJMNWjY.exe
  C:\Windows\System\SJMNWjY.exe
  2⤵
  PID:9456
- C:\Windows\System\FFICUlZ.exe
  C:\Windows\System\FFICUlZ.exe
  2⤵
  PID:9484
- C:\Windows\System\EmseQMh.exe
  C:\Windows\System\EmseQMh.exe
  2⤵
  PID:9512
- C:\Windows\System\NJPxmLc.exe
  C:\Windows\System\NJPxmLc.exe
  2⤵
  PID:9540
- C:\Windows\System\tvRLEoV.exe
  C:\Windows\System\tvRLEoV.exe
  2⤵
  PID:9556
- C:\Windows\System\YZRqqTE.exe
  C:\Windows\System\YZRqqTE.exe
  2⤵
  PID:9572
- C:\Windows\System\HHpzNNV.exe
  C:\Windows\System\HHpzNNV.exe
  2⤵
  PID:9604
- C:\Windows\System\JlIiJVD.exe
  C:\Windows\System\JlIiJVD.exe
  2⤵
  PID:9632
- C:\Windows\System\knbXPZK.exe
  C:\Windows\System\knbXPZK.exe
  2⤵
  PID:9700
- C:\Windows\System\NprgCru.exe
  C:\Windows\System\NprgCru.exe
  2⤵
  PID:9716
- C:\Windows\System\ZFmwMWJ.exe
  C:\Windows\System\ZFmwMWJ.exe
  2⤵
  PID:9744
- C:\Windows\System\heePGuy.exe
  C:\Windows\System\heePGuy.exe
  2⤵
  PID:9772
- C:\Windows\System\niaXGPI.exe
  C:\Windows\System\niaXGPI.exe
  2⤵
  PID:9800
- C:\Windows\System\TinUzli.exe
  C:\Windows\System\TinUzli.exe
  2⤵
  PID:9828
- C:\Windows\System\jBWZmpv.exe
  C:\Windows\System\jBWZmpv.exe
  2⤵
  PID:9856
- C:\Windows\System\PTvYXKB.exe
  C:\Windows\System\PTvYXKB.exe
  2⤵
  PID:9884
- C:\Windows\System\ILydlto.exe
  C:\Windows\System\ILydlto.exe
  2⤵
  PID:9912
- C:\Windows\System\lRKGRZx.exe
  C:\Windows\System\lRKGRZx.exe
  2⤵
  PID:9940
- C:\Windows\System\TLtVqHc.exe
  C:\Windows\System\TLtVqHc.exe
  2⤵
  PID:9964
- C:\Windows\System\HfFrSTk.exe
  C:\Windows\System\HfFrSTk.exe
  2⤵
  PID:9992
- C:\Windows\System\VuFMlYs.exe
  C:\Windows\System\VuFMlYs.exe
  2⤵
  PID:10012
- C:\Windows\System\cbmqGrB.exe
  C:\Windows\System\cbmqGrB.exe
  2⤵
  PID:10040
- C:\Windows\System\qiUlXRi.exe
  C:\Windows\System\qiUlXRi.exe
  2⤵
  PID:10068
- C:\Windows\System\ZjnNlrt.exe
  C:\Windows\System\ZjnNlrt.exe
  2⤵
  PID:10084
- C:\Windows\System\WEkQnNT.exe
  C:\Windows\System\WEkQnNT.exe
  2⤵
  PID:10116
- C:\Windows\System\EnJsHex.exe
  C:\Windows\System\EnJsHex.exe
  2⤵
  PID:10152
- C:\Windows\System\CxXoewu.exe
  C:\Windows\System\CxXoewu.exe
  2⤵
  PID:10180
- C:\Windows\System\LunDsxR.exe
  C:\Windows\System\LunDsxR.exe
  2⤵
  PID:10196
- C:\Windows\System\HXXBMmo.exe
  C:\Windows\System\HXXBMmo.exe
  2⤵
  PID:10228
- C:\Windows\System\syvgIKh.exe
  C:\Windows\System\syvgIKh.exe
  2⤵
  PID:9244
- C:\Windows\System\TcLyySp.exe
  C:\Windows\System\TcLyySp.exe
  2⤵
  PID:9288
- C:\Windows\System\fYaHzkJ.exe
  C:\Windows\System\fYaHzkJ.exe
  2⤵
  PID:9360
- C:\Windows\System\vFnsxsN.exe
  C:\Windows\System\vFnsxsN.exe
  2⤵
  PID:9480
- C:\Windows\System\inPtPhh.exe
  C:\Windows\System\inPtPhh.exe
  2⤵
  PID:9528
- C:\Windows\System\pdTcRPk.exe
  C:\Windows\System\pdTcRPk.exe
  2⤵
  PID:9640
- C:\Windows\System\rFyEmxZ.exe
  C:\Windows\System\rFyEmxZ.exe
  2⤵
  PID:9684
- C:\Windows\System\NfRHloI.exe
  C:\Windows\System\NfRHloI.exe
  2⤵
  PID:9756
- C:\Windows\System\wEBZhFg.exe
  C:\Windows\System\wEBZhFg.exe
  2⤵
  PID:9816
- C:\Windows\System\QWtmFym.exe
  C:\Windows\System\QWtmFym.exe
  2⤵
  PID:9876
- C:\Windows\System\kUKFjhs.exe
  C:\Windows\System\kUKFjhs.exe
  2⤵
  PID:9960
- C:\Windows\System\nnCBMcY.exe
  C:\Windows\System\nnCBMcY.exe
  2⤵
  PID:9980
- C:\Windows\System\nFhwket.exe
  C:\Windows\System\nFhwket.exe
  2⤵
  PID:10056
- C:\Windows\System\PXfgvIE.exe
  C:\Windows\System\PXfgvIE.exe
  2⤵
  PID:10100
- C:\Windows\System\cAaYjwi.exe
  C:\Windows\System\cAaYjwi.exe
  2⤵
  PID:10208
- C:\Windows\System\lpkZMfJ.exe
  C:\Windows\System\lpkZMfJ.exe
  2⤵
  PID:9252
- C:\Windows\System\BeyLArb.exe
  C:\Windows\System\BeyLArb.exe
  2⤵
  PID:9248
- C:\Windows\System\qMWCWqs.exe
  C:\Windows\System\qMWCWqs.exe
  2⤵
  PID:9508
- C:\Windows\System\pLVZwnf.exe
  C:\Windows\System\pLVZwnf.exe
  2⤵
  PID:9736
- C:\Windows\System\BaotdVe.exe
  C:\Windows\System\BaotdVe.exe
  2⤵
  PID:9880
- C:\Windows\System\yLxIhtF.exe
  C:\Windows\System\yLxIhtF.exe
  2⤵
  PID:10008
- C:\Windows\System\zBVQTAv.exe
  C:\Windows\System\zBVQTAv.exe
  2⤵
  PID:10148
- C:\Windows\System\OrLdCeO.exe
  C:\Windows\System\OrLdCeO.exe
  2⤵
  PID:9276
- C:\Windows\System\dwWzvbn.exe
  C:\Windows\System\dwWzvbn.exe
  2⤵
  PID:9656
- C:\Windows\System\OlyyAgN.exe
  C:\Windows\System\OlyyAgN.exe
  2⤵
  PID:10168
- C:\Windows\System\nIfWUNJ.exe
  C:\Windows\System\nIfWUNJ.exe
  2⤵
  PID:9956
- C:\Windows\System\DBRDTKV.exe
  C:\Windows\System\DBRDTKV.exe
  2⤵
  PID:10248
- C:\Windows\System\uLLGbvY.exe
  C:\Windows\System\uLLGbvY.exe
  2⤵
  PID:10280
- C:\Windows\System\WWgebzs.exe
  C:\Windows\System\WWgebzs.exe
  2⤵
  PID:10300
- C:\Windows\System\wTWbSTN.exe
  C:\Windows\System\wTWbSTN.exe
  2⤵
  PID:10324
- C:\Windows\System\JeQkRGy.exe
  C:\Windows\System\JeQkRGy.exe
  2⤵
  PID:10352
- C:\Windows\System\OLhXAes.exe
  C:\Windows\System\OLhXAes.exe
  2⤵
  PID:10376
- C:\Windows\System\KFEkbrw.exe
  C:\Windows\System\KFEkbrw.exe
  2⤵
  PID:10400
- C:\Windows\System\kvJqZyv.exe
  C:\Windows\System\kvJqZyv.exe
  2⤵
  PID:10424
- C:\Windows\System\GaZLBke.exe
  C:\Windows\System\GaZLBke.exe
  2⤵
  PID:10472
- C:\Windows\System\kDWsijg.exe
  C:\Windows\System\kDWsijg.exe
  2⤵
  PID:10492
- C:\Windows\System\oNjjJWh.exe
  C:\Windows\System\oNjjJWh.exe
  2⤵
  PID:10532
- C:\Windows\System\UuFvIjt.exe
  C:\Windows\System\UuFvIjt.exe
  2⤵
  PID:10548
- C:\Windows\System\opoyybg.exe
  C:\Windows\System\opoyybg.exe
  2⤵
  PID:10568
- C:\Windows\System\gzmrsVK.exe
  C:\Windows\System\gzmrsVK.exe
  2⤵
  PID:10616
- C:\Windows\System\mhyGQLU.exe
  C:\Windows\System\mhyGQLU.exe
  2⤵
  PID:10632
- C:\Windows\System\lpgTHCs.exe
  C:\Windows\System\lpgTHCs.exe
  2⤵
  PID:10672
- C:\Windows\System\sIqlhnh.exe
  C:\Windows\System\sIqlhnh.exe
  2⤵
  PID:10700
- C:\Windows\System\rIjmaQP.exe
  C:\Windows\System\rIjmaQP.exe
  2⤵
  PID:10720
- C:\Windows\System\ewWpnHB.exe
  C:\Windows\System\ewWpnHB.exe
  2⤵
  PID:10744
- C:\Windows\System\iHAuiut.exe
  C:\Windows\System\iHAuiut.exe
  2⤵
  PID:10772
- C:\Windows\System\FykAHmS.exe
  C:\Windows\System\FykAHmS.exe
  2⤵
  PID:10800
- C:\Windows\System\ffZSYOX.exe
  C:\Windows\System\ffZSYOX.exe
  2⤵
  PID:10840
- C:\Windows\System\cauxVhk.exe
  C:\Windows\System\cauxVhk.exe
  2⤵
  PID:10860
- C:\Windows\System\mTzrxTX.exe
  C:\Windows\System\mTzrxTX.exe
  2⤵
  PID:10896
- C:\Windows\System\zPExvVP.exe
  C:\Windows\System\zPExvVP.exe
  2⤵
  PID:10912
- C:\Windows\System\PFPMyWp.exe
  C:\Windows\System\PFPMyWp.exe
  2⤵
  PID:10940
- C:\Windows\System\jfQYTdC.exe
  C:\Windows\System\jfQYTdC.exe
  2⤵
  PID:10980
- C:\Windows\System\UOfUdZX.exe
  C:\Windows\System\UOfUdZX.exe
  2⤵
  PID:11008
- C:\Windows\System\hmtMODh.exe
  C:\Windows\System\hmtMODh.exe
  2⤵
  PID:11028
- C:\Windows\System\vRhOuZL.exe
  C:\Windows\System\vRhOuZL.exe
  2⤵
  PID:11056
- C:\Windows\System\PzVVwHu.exe
  C:\Windows\System\PzVVwHu.exe
  2⤵
  PID:11092
- C:\Windows\System\Jrkzruz.exe
  C:\Windows\System\Jrkzruz.exe
  2⤵
  PID:11120
- C:\Windows\System\EilfrlW.exe
  C:\Windows\System\EilfrlW.exe
  2⤵
  PID:11164
- C:\Windows\System\CwGiOpA.exe
  C:\Windows\System\CwGiOpA.exe
  2⤵
  PID:11184
- C:\Windows\System\INXQxCC.exe
  C:\Windows\System\INXQxCC.exe
  2⤵
  PID:11212
- C:\Windows\System\lmUdQUy.exe
  C:\Windows\System\lmUdQUy.exe
  2⤵
  PID:11240
- C:\Windows\System\zIGGgkh.exe
  C:\Windows\System\zIGGgkh.exe
  2⤵
  PID:9332
- C:\Windows\System\yrdVXvk.exe
  C:\Windows\System\yrdVXvk.exe
  2⤵
  PID:10288
- C:\Windows\System\wyJEvzw.exe
  C:\Windows\System\wyJEvzw.exe
  2⤵
  PID:10416
- C:\Windows\System\LvhvxVB.exe
  C:\Windows\System\LvhvxVB.exe
  2⤵
  PID:10420
- C:\Windows\System\PWffgbZ.exe
  C:\Windows\System\PWffgbZ.exe
  2⤵
  PID:10480
- C:\Windows\System\QCUBBYx.exe
  C:\Windows\System\QCUBBYx.exe
  2⤵
  PID:10508
- C:\Windows\System\QtBScNx.exe
  C:\Windows\System\QtBScNx.exe
  2⤵
  PID:10608
- C:\Windows\System\ktEjwpQ.exe
  C:\Windows\System\ktEjwpQ.exe
  2⤵
  PID:10648
- C:\Windows\System\YhldDWB.exe
  C:\Windows\System\YhldDWB.exe
  2⤵
  PID:10756
- C:\Windows\System\QOSNWyr.exe
  C:\Windows\System\QOSNWyr.exe
  2⤵
  PID:10820
- C:\Windows\System\QZjNxTL.exe
  C:\Windows\System\QZjNxTL.exe
  2⤵
  PID:10856
- C:\Windows\System\xGHqaNT.exe
  C:\Windows\System\xGHqaNT.exe
  2⤵
  PID:10908
- C:\Windows\System\cUSkOmH.exe
  C:\Windows\System\cUSkOmH.exe
  2⤵
  PID:10976
- C:\Windows\System\qRHvqqD.exe
  C:\Windows\System\qRHvqqD.exe
  2⤵
  PID:11064
- C:\Windows\System\IARDuzi.exe
  C:\Windows\System\IARDuzi.exe
  2⤵
  PID:11160
- C:\Windows\System\yxXtDOm.exe
  C:\Windows\System\yxXtDOm.exe
  2⤵
  PID:11224
- C:\Windows\System\fDvXrwb.exe
  C:\Windows\System\fDvXrwb.exe
  2⤵
  PID:11256
- C:\Windows\System\bMOJFVv.exe
  C:\Windows\System\bMOJFVv.exe
  2⤵
  PID:10316
- C:\Windows\System\BdYNSwx.exe
  C:\Windows\System\BdYNSwx.exe
  2⤵
  PID:10516
- C:\Windows\System\RuwayIV.exe
  C:\Windows\System\RuwayIV.exe
  2⤵
  PID:10624
- C:\Windows\System\SyMRJbv.exe
  C:\Windows\System\SyMRJbv.exe
  2⤵
  PID:10728
- C:\Windows\System\QvYiDiM.exe
  C:\Windows\System\QvYiDiM.exe
  2⤵
  PID:10904
- C:\Windows\System\KvBWioF.exe
  C:\Windows\System\KvBWioF.exe
  2⤵
  PID:10936
- C:\Windows\System\DTCACJr.exe
  C:\Windows\System\DTCACJr.exe
  2⤵
  PID:11252
- C:\Windows\System\cHwwAAW.exe
  C:\Windows\System\cHwwAAW.exe
  2⤵
  PID:10600
- C:\Windows\System\UfbDqwn.exe
  C:\Windows\System\UfbDqwn.exe
  2⤵
  PID:10972
- C:\Windows\System\fZqZNyw.exe
  C:\Windows\System\fZqZNyw.exe
  2⤵
  PID:10652
- C:\Windows\System\ITRBPxN.exe
  C:\Windows\System\ITRBPxN.exe
  2⤵
  PID:11276
- C:\Windows\System\wlZhhHC.exe
  C:\Windows\System\wlZhhHC.exe
  2⤵
  PID:11296
- C:\Windows\System\vwGzgFb.exe
  C:\Windows\System\vwGzgFb.exe
  2⤵
  PID:11328
- C:\Windows\System\eQDgaYn.exe
  C:\Windows\System\eQDgaYn.exe
  2⤵
  PID:11352
- C:\Windows\System\QNoDelA.exe
  C:\Windows\System\QNoDelA.exe
  2⤵
  PID:11384
- C:\Windows\System\pzzQcpi.exe
  C:\Windows\System\pzzQcpi.exe
  2⤵
  PID:11404
- C:\Windows\System\KwaYdCn.exe
  C:\Windows\System\KwaYdCn.exe
  2⤵
  PID:11432
- C:\Windows\System\QhlVCZD.exe
  C:\Windows\System\QhlVCZD.exe
  2⤵
  PID:11460
- C:\Windows\System\IewKxyv.exe
  C:\Windows\System\IewKxyv.exe
  2⤵
  PID:11496
- C:\Windows\System\Tojtwgg.exe
  C:\Windows\System\Tojtwgg.exe
  2⤵
  PID:11524
- C:\Windows\System\LKbjbeU.exe
  C:\Windows\System\LKbjbeU.exe
  2⤵
  PID:11552
- C:\Windows\System\spYtNtY.exe
  C:\Windows\System\spYtNtY.exe
  2⤵
  PID:11576
- C:\Windows\System\HJGfnFe.exe
  C:\Windows\System\HJGfnFe.exe
  2⤵
  PID:11604
- C:\Windows\System\yutDtHW.exe
  C:\Windows\System\yutDtHW.exe
  2⤵
  PID:11632
- C:\Windows\System\gCvjzba.exe
  C:\Windows\System\gCvjzba.exe
  2⤵
  PID:11668
- C:\Windows\System\ufGeWjt.exe
  C:\Windows\System\ufGeWjt.exe
  2⤵
  PID:11700
- C:\Windows\System\wZlLLoZ.exe
  C:\Windows\System\wZlLLoZ.exe
  2⤵
  PID:11716
- C:\Windows\System\eGgUXSX.exe
  C:\Windows\System\eGgUXSX.exe
  2⤵
  PID:11748
- C:\Windows\System\IPKnesg.exe
  C:\Windows\System\IPKnesg.exe
  2⤵
  PID:11776
- C:\Windows\System\nvqLZhA.exe
  C:\Windows\System\nvqLZhA.exe
  2⤵
  PID:11804
- C:\Windows\System\uWGmUty.exe
  C:\Windows\System\uWGmUty.exe
  2⤵
  PID:11836
- C:\Windows\System\qLloYyj.exe
  C:\Windows\System\qLloYyj.exe
  2⤵
  PID:11856
- C:\Windows\System\zgieQbl.exe
  C:\Windows\System\zgieQbl.exe
  2⤵
  PID:11872
- C:\Windows\System\HQIoviP.exe
  C:\Windows\System\HQIoviP.exe
  2⤵
  PID:11904
- C:\Windows\System\MNtVJBh.exe
  C:\Windows\System\MNtVJBh.exe
  2⤵
  PID:11940
- C:\Windows\System\JWngled.exe
  C:\Windows\System\JWngled.exe
  2⤵
  PID:11980
- C:\Windows\System\FpzOkOv.exe
  C:\Windows\System\FpzOkOv.exe
  2⤵
  PID:12000
- C:\Windows\System\ExiGvSq.exe
  C:\Windows\System\ExiGvSq.exe
  2⤵
  PID:12028
- C:\Windows\System\fTQuHKT.exe
  C:\Windows\System\fTQuHKT.exe
  2⤵
  PID:12052
- C:\Windows\System\Euvndfe.exe
  C:\Windows\System\Euvndfe.exe
  2⤵
  PID:12092
- C:\Windows\System\qLKhyyh.exe
  C:\Windows\System\qLKhyyh.exe
  2⤵
  PID:12120
- C:\Windows\System\RcmXqbL.exe
  C:\Windows\System\RcmXqbL.exe
  2⤵
  PID:12148
- C:\Windows\System\oYoyWpv.exe
  C:\Windows\System\oYoyWpv.exe
  2⤵
  PID:12176
- C:\Windows\System\XcIqIBb.exe
  C:\Windows\System\XcIqIBb.exe
  2⤵
  PID:12192
- C:\Windows\System\JLeeqku.exe
  C:\Windows\System\JLeeqku.exe
  2⤵
  PID:12224
- C:\Windows\System\pzfQejS.exe
  C:\Windows\System\pzfQejS.exe
  2⤵
  PID:12252
- C:\Windows\System\WFnwaXg.exe
  C:\Windows\System\WFnwaXg.exe
  2⤵
  PID:12280
- C:\Windows\System\lDbjnfd.exe
  C:\Windows\System\lDbjnfd.exe
  2⤵
  PID:11292
- C:\Windows\System\cmECYSn.exe
  C:\Windows\System\cmECYSn.exe
  2⤵
  PID:11348
- C:\Windows\System\lNujWJd.exe
  C:\Windows\System\lNujWJd.exe
  2⤵
  PID:11456
- C:\Windows\System\bmJKpNT.exe
  C:\Windows\System\bmJKpNT.exe
  2⤵
  PID:11480
- C:\Windows\System\skFXjbw.exe
  C:\Windows\System\skFXjbw.exe
  2⤵
  PID:11508
- C:\Windows\System\CgJBizS.exe
  C:\Windows\System\CgJBizS.exe
  2⤵
  PID:11648
- C:\Windows\System\hDMQmnA.exe
  C:\Windows\System\hDMQmnA.exe
  2⤵
  PID:11684
- C:\Windows\System\FaEEMzx.exe
  C:\Windows\System\FaEEMzx.exe
  2⤵
  PID:11740
- C:\Windows\System\XnwMZkF.exe
  C:\Windows\System\XnwMZkF.exe
  2⤵
  PID:11824
- C:\Windows\System\rpVsuFY.exe
  C:\Windows\System\rpVsuFY.exe
  2⤵
  PID:11864
- C:\Windows\System\pHFUyhm.exe
  C:\Windows\System\pHFUyhm.exe
  2⤵
  PID:11928
- C:\Windows\System\GEeihih.exe
  C:\Windows\System\GEeihih.exe
  2⤵
  PID:12036
- C:\Windows\System\BcfwMUQ.exe
  C:\Windows\System\BcfwMUQ.exe
  2⤵
  PID:12084
- C:\Windows\System\UZznzTn.exe
  C:\Windows\System\UZznzTn.exe
  2⤵
  PID:12116
- C:\Windows\System\VHKkiCm.exe
  C:\Windows\System\VHKkiCm.exe
  2⤵
  PID:12188
- C:\Windows\System\OWKJbTy.exe
  C:\Windows\System\OWKJbTy.exe
  2⤵
  PID:12276
- C:\Windows\System\PfoMMgo.exe
  C:\Windows\System\PfoMMgo.exe
  2⤵
  PID:11308
- C:\Windows\System\KvFZdcJ.exe
  C:\Windows\System\KvFZdcJ.exe
  2⤵
  PID:11444
- C:\Windows\System\nyyiQAx.exe
  C:\Windows\System\nyyiQAx.exe
  2⤵
  PID:11544
- C:\Windows\System\snnrgQF.exe
  C:\Windows\System\snnrgQF.exe
  2⤵
  PID:11764
- C:\Windows\System\HtDmDFq.exe
  C:\Windows\System\HtDmDFq.exe
  2⤵
  PID:11896
- C:\Windows\System\hmgBVGO.exe
  C:\Windows\System\hmgBVGO.exe
  2⤵
  PID:12112
- C:\Windows\System\qHLtOkg.exe
  C:\Windows\System\qHLtOkg.exe
  2⤵
  PID:12248
- C:\Windows\System\tSfLpmL.exe
  C:\Windows\System\tSfLpmL.exe
  2⤵
  PID:11512
- C:\Windows\System\AUcHyJu.exe
  C:\Windows\System\AUcHyJu.exe
  2⤵
  PID:11792
- C:\Windows\System\uBEIPjX.exe
  C:\Windows\System\uBEIPjX.exe
  2⤵
  PID:12108
- C:\Windows\System\abdWRIY.exe
  C:\Windows\System\abdWRIY.exe
  2⤵
  PID:11416
- C:\Windows\System\xqtwceF.exe
  C:\Windows\System\xqtwceF.exe
  2⤵
  PID:12172
- C:\Windows\System\thGAJOq.exe
  C:\Windows\System\thGAJOq.exe
  2⤵
  PID:12304
- C:\Windows\System\rHsWSCY.exe
  C:\Windows\System\rHsWSCY.exe
  2⤵
  PID:12344
- C:\Windows\System\DyznkWJ.exe
  C:\Windows\System\DyznkWJ.exe
  2⤵
  PID:12360
- C:\Windows\System\WpFJjWo.exe
  C:\Windows\System\WpFJjWo.exe
  2⤵
  PID:12376
- C:\Windows\System\KBgXULj.exe
  C:\Windows\System\KBgXULj.exe
  2⤵
  PID:12404
- C:\Windows\System\qYPpNYm.exe
  C:\Windows\System\qYPpNYm.exe
  2⤵
  PID:12456
- C:\Windows\System\JqWyBag.exe
  C:\Windows\System\JqWyBag.exe
  2⤵
  PID:12476
- C:\Windows\System\nUMfSDr.exe
  C:\Windows\System\nUMfSDr.exe
  2⤵
  PID:12504
- C:\Windows\System\Xipnwtp.exe
  C:\Windows\System\Xipnwtp.exe
  2⤵
  PID:12544
- C:\Windows\System\QPDgMmu.exe
  C:\Windows\System\QPDgMmu.exe
  2⤵
  PID:12560
- C:\Windows\System\UtFzHKj.exe
  C:\Windows\System\UtFzHKj.exe
  2⤵
  PID:12600
- C:\Windows\System\TdJWPzL.exe
  C:\Windows\System\TdJWPzL.exe
  2⤵
  PID:12628
- C:\Windows\System\ylByNGd.exe
  C:\Windows\System\ylByNGd.exe
  2⤵
  PID:12656
- C:\Windows\System\DJWwrTd.exe
  C:\Windows\System\DJWwrTd.exe
  2⤵
  PID:12672
- C:\Windows\System\guAkUab.exe
  C:\Windows\System\guAkUab.exe
  2⤵
  PID:12700
- C:\Windows\System\LeqjNrW.exe
  C:\Windows\System\LeqjNrW.exe
  2⤵
  PID:12728
- C:\Windows\System\dfPYcPM.exe
  C:\Windows\System\dfPYcPM.exe
  2⤵
  PID:12756
- C:\Windows\System\fLbztvP.exe
  C:\Windows\System\fLbztvP.exe
  2⤵
  PID:12796
- C:\Windows\System\pZQpCZx.exe
  C:\Windows\System\pZQpCZx.exe
  2⤵
  PID:12824
- C:\Windows\System\nfLpqcJ.exe
  C:\Windows\System\nfLpqcJ.exe
  2⤵
  PID:12852
- C:\Windows\System\WuRPJtB.exe
  C:\Windows\System\WuRPJtB.exe
  2⤵
  PID:12868
- C:\Windows\System\DFMmDNj.exe
  C:\Windows\System\DFMmDNj.exe
  2⤵
  PID:12896
- C:\Windows\System\UceiNOP.exe
  C:\Windows\System\UceiNOP.exe
  2⤵
  PID:12928
- C:\Windows\System\DKZYouT.exe
  C:\Windows\System\DKZYouT.exe
  2⤵
  PID:12952
- C:\Windows\System\GFbbpVi.exe
  C:\Windows\System\GFbbpVi.exe
  2⤵
  PID:12988
- C:\Windows\System\xKqviam.exe
  C:\Windows\System\xKqviam.exe
  2⤵
  PID:13008
- C:\Windows\System\KjCWudB.exe
  C:\Windows\System\KjCWudB.exe
  2⤵
  PID:13040
- C:\Windows\System\gBQSGXs.exe
  C:\Windows\System\gBQSGXs.exe
  2⤵
  PID:13064
- C:\Windows\System\ZxhINCu.exe
  C:\Windows\System\ZxhINCu.exe
  2⤵
  PID:13084
- C:\Windows\System\kJUgUiG.exe
  C:\Windows\System\kJUgUiG.exe
  2⤵
  PID:13120
- C:\Windows\System\lmvMByS.exe
  C:\Windows\System\lmvMByS.exe
  2⤵
  PID:13160
- C:\Windows\System\jIaiGFr.exe
  C:\Windows\System\jIaiGFr.exe
  2⤵
  PID:13188
- C:\Windows\System\ShzxDSr.exe
  C:\Windows\System\ShzxDSr.exe
  2⤵
  PID:13216
- C:\Windows\System\ZjmQJvN.exe
  C:\Windows\System\ZjmQJvN.exe
  2⤵
  PID:13244
- C:\Windows\System\tUHNMui.exe
  C:\Windows\System\tUHNMui.exe
  2⤵
  PID:13268
- C:\Windows\System\JVCSoWa.exe
  C:\Windows\System\JVCSoWa.exe
  2⤵
  PID:13300
- C:\Windows\System\uQcHYie.exe
  C:\Windows\System\uQcHYie.exe
  2⤵
  PID:12316
- C:\Windows\System\KcEAvzZ.exe
  C:\Windows\System\KcEAvzZ.exe
  2⤵
  PID:12372
- C:\Windows\System\whaZRCm.exe
  C:\Windows\System\whaZRCm.exe
  2⤵
  PID:12448
- C:\Windows\System\aQKhfzw.exe
  C:\Windows\System\aQKhfzw.exe
  2⤵
  PID:12496
- C:\Windows\System\MOsIZFr.exe
  C:\Windows\System\MOsIZFr.exe
  2⤵
  PID:12584
- C:\Windows\System\eMpzjaV.exe
  C:\Windows\System\eMpzjaV.exe
  2⤵
  PID:12640
- C:\Windows\System\rsICPXm.exe
  C:\Windows\System\rsICPXm.exe
  2⤵
  PID:12684
- C:\Windows\System\FFvUYhU.exe
  C:\Windows\System\FFvUYhU.exe
  2⤵
  PID:12748
- C:\Windows\System\ArBiflm.exe
  C:\Windows\System\ArBiflm.exe
  2⤵
  PID:12816
- C:\Windows\System\nMcXrKh.exe
  C:\Windows\System\nMcXrKh.exe
  2⤵
  PID:12864
- C:\Windows\System\AbhlWKP.exe
  C:\Windows\System\AbhlWKP.exe
  2⤵
  PID:12968
- C:\Windows\System\vbajqct.exe
  C:\Windows\System\vbajqct.exe
  2⤵
  PID:13056
- C:\Windows\System\OcBorQF.exe
  C:\Windows\System\OcBorQF.exe
  2⤵
  PID:13036
- C:\Windows\System\sCnblPd.exe
  C:\Windows\System\sCnblPd.exe
  2⤵
  PID:13128
- C:\Windows\System\SxwMsiN.exe
  C:\Windows\System\SxwMsiN.exe
  2⤵
  PID:13204
- C:\Windows\System\ZzkLkUL.exe
  C:\Windows\System\ZzkLkUL.exe
  2⤵
  PID:13260
- C:\Windows\System\Owrsuzr.exe
  C:\Windows\System\Owrsuzr.exe
  2⤵
  PID:11676
- C:\Windows\System\wGtBOda.exe
  C:\Windows\System\wGtBOda.exe
  2⤵
  PID:12432
- C:\Windows\System\rpjlqcC.exe
  C:\Windows\System\rpjlqcC.exe
  2⤵
  PID:12620
- C:\Windows\System\ulLMAVQ.exe
  C:\Windows\System\ulLMAVQ.exe
  2⤵
  PID:12740
- C:\Windows\System\UsfDcJs.exe
  C:\Windows\System\UsfDcJs.exe
  2⤵
  PID:12848
- C:\Windows\System\EmKPjiK.exe
  C:\Windows\System\EmKPjiK.exe
  2⤵
  PID:13020
- C:\Windows\System\xWNlDaH.exe
  C:\Windows\System\xWNlDaH.exe
  2⤵
  PID:13104
- C:\Windows\System\dXnkQjd.exe
  C:\Windows\System\dXnkQjd.exe
  2⤵
  PID:13292
- C:\Windows\System\XPXsoyU.exe
  C:\Windows\System\XPXsoyU.exe
  2⤵
  PID:12556
- C:\Windows\System\VqHNmHh.exe
  C:\Windows\System\VqHNmHh.exe
  2⤵
  PID:13072
- C:\Windows\System\TqvOBVx.exe
  C:\Windows\System\TqvOBVx.exe
  2⤵
  PID:13316
- C:\Windows\System\KotkYNs.exe
  C:\Windows\System\KotkYNs.exe
  2⤵
  PID:13344
- C:\Windows\System\igIAziJ.exe
  C:\Windows\System\igIAziJ.exe
  2⤵
  PID:13364
- C:\Windows\System\QsRQoix.exe
  C:\Windows\System\QsRQoix.exe
  2⤵
  PID:13392
- C:\Windows\System\TrsSjaC.exe
  C:\Windows\System\TrsSjaC.exe
  2⤵
  PID:13428
- C:\Windows\System\aKRevvZ.exe
  C:\Windows\System\aKRevvZ.exe
  2⤵
  PID:13444
- C:\Windows\System\FRIwJyx.exe
  C:\Windows\System\FRIwJyx.exe
  2⤵
  PID:13472
- C:\Windows\System\LxOrzXM.exe
  C:\Windows\System\LxOrzXM.exe
  2⤵
  PID:13496
- C:\Windows\System\bRGhcry.exe
  C:\Windows\System\bRGhcry.exe
  2⤵
  PID:13528
- C:\Windows\System\PiOUimy.exe
  C:\Windows\System\PiOUimy.exe
  2⤵
  PID:13556
- C:\Windows\System\vEhLbUV.exe
  C:\Windows\System\vEhLbUV.exe
  2⤵
  PID:13584
- C:\Windows\System\YWavwwB.exe
  C:\Windows\System\YWavwwB.exe
  2⤵
  PID:13616
- C:\Windows\System\XUQyvAs.exe
  C:\Windows\System\XUQyvAs.exe
  2⤵
  PID:13644
- C:\Windows\System\CWcfvxP.exe
  C:\Windows\System\CWcfvxP.exe
  2⤵
  PID:13668
- C:\Windows\System\YZIXVtp.exe
  C:\Windows\System\YZIXVtp.exe
  2⤵
  PID:13696
- C:\Windows\System\DPOGGBU.exe
  C:\Windows\System\DPOGGBU.exe
  2⤵
  PID:13724
- C:\Windows\System\RXKYDdT.exe
  C:\Windows\System\RXKYDdT.exe
  2⤵
  PID:13756
- C:\Windows\System\SehMppZ.exe
  C:\Windows\System\SehMppZ.exe
  2⤵
  PID:13796
- C:\Windows\System\wtgBGWZ.exe
  C:\Windows\System\wtgBGWZ.exe
  2⤵
  PID:13824
- C:\Windows\System\AeAqlNb.exe
  C:\Windows\System\AeAqlNb.exe
  2⤵
  PID:13840
- C:\Windows\System\SPGJtGS.exe
  C:\Windows\System\SPGJtGS.exe
  2⤵
  PID:13880
- C:\Windows\System\zeHrcDA.exe
  C:\Windows\System\zeHrcDA.exe
  2⤵
  PID:13908
- C:\Windows\System\UKMAKhp.exe
  C:\Windows\System\UKMAKhp.exe
  2⤵
  PID:13936
- C:\Windows\System\kJiDLQb.exe
  C:\Windows\System\kJiDLQb.exe
  2⤵
  PID:13960
- C:\Windows\System\XBWHHON.exe
  C:\Windows\System\XBWHHON.exe
  2⤵
  PID:13980
- C:\Windows\System\qbCLaQM.exe
  C:\Windows\System\qbCLaQM.exe
  2⤵
  PID:14008
- C:\Windows\System\rjAevxN.exe
  C:\Windows\System\rjAevxN.exe
  2⤵
  PID:14024
- C:\Windows\System\fpkKkum.exe
  C:\Windows\System\fpkKkum.exe
  2⤵
  PID:14048
- C:\Windows\System\EkjKuKT.exe
  C:\Windows\System\EkjKuKT.exe
  2⤵
  PID:14080
- C:\Windows\System\nFsVxvT.exe
  C:\Windows\System\nFsVxvT.exe
  2⤵
  PID:14132
- C:\Windows\System\VNWlRZW.exe
  C:\Windows\System\VNWlRZW.exe
  2⤵
  PID:14160
- C:\Windows\System\vqoEozO.exe
  C:\Windows\System\vqoEozO.exe
  2⤵
  PID:14176
- C:\Windows\System\zLnDrlN.exe
  C:\Windows\System\zLnDrlN.exe
  2⤵
  PID:14196
- C:\Windows\System\WYFShSF.exe
  C:\Windows\System\WYFShSF.exe
  2⤵
  PID:14220
- C:\Windows\System\lSspwWe.exe
  C:\Windows\System\lSspwWe.exe
  2⤵
  PID:14240
- C:\Windows\System\YwZBtdJ.exe
  C:\Windows\System\YwZBtdJ.exe
  2⤵
  PID:14276
- C:\Windows\System\qpVupDY.exe
  C:\Windows\System\qpVupDY.exe
  2⤵
  PID:14300
- C:\Windows\System\iXHKGJi.exe
  C:\Windows\System\iXHKGJi.exe
  2⤵
  PID:13200
- C:\Windows\System\kzAiMUF.exe
  C:\Windows\System\kzAiMUF.exe
  2⤵
  PID:13332
- C:\Windows\System\xedmsJW.exe
  C:\Windows\System\xedmsJW.exe
  2⤵
  PID:13436
- C:\Windows\System\eTBKJGl.exe
  C:\Windows\System\eTBKJGl.exe
  2⤵
  PID:13488
- C:\Windows\System\ueQwoXB.exe
  C:\Windows\System\ueQwoXB.exe
  2⤵
  PID:13568
- C:\Windows\System\oUwKhNk.exe
  C:\Windows\System\oUwKhNk.exe
  2⤵
  PID:13656
- C:\Windows\System\piEMcRA.exe
  C:\Windows\System\piEMcRA.exe
  2⤵
  PID:13684
- C:\Windows\System\tVhNHoP.exe
  C:\Windows\System\tVhNHoP.exe
  2⤵
  PID:13688
- C:\Windows\System\PdlfwmM.exe
  C:\Windows\System\PdlfwmM.exe
  2⤵
  PID:13788
- C:\Windows\System\XgOndSp.exe
  C:\Windows\System\XgOndSp.exe
  2⤵
  PID:13900
- C:\Windows\System\HOJXflx.exe
  C:\Windows\System\HOJXflx.exe
  2⤵
  PID:13948
- C:\Windows\System\SBdNnvp.exe
  C:\Windows\System\SBdNnvp.exe
  2⤵
  PID:14000
- C:\Windows\System\EtPoRMs.exe
  C:\Windows\System\EtPoRMs.exe
  2⤵
  PID:14060
- C:\Windows\System\vrkNdic.exe
  C:\Windows\System\vrkNdic.exe
  2⤵
  PID:14188
- C:\Windows\System\aVddicX.exe
  C:\Windows\System\aVddicX.exe
  2⤵
  PID:14212
- C:\Windows\System\kzzuskn.exe
  C:\Windows\System\kzzuskn.exe
  2⤵
  PID:14236
- C:\Windows\System\uXmgkdl.exe
  C:\Windows\System\uXmgkdl.exe
  2⤵
  PID:14320
- C:\Windows\System\MUCKzKL.exe
  C:\Windows\System\MUCKzKL.exe
  2⤵
  PID:13504
- C:\Windows\System\TULHaXu.exe
  C:\Windows\System\TULHaXu.exe
  2⤵
  PID:13544
- C:\Windows\System\pdjvInw.exe
  C:\Windows\System\pdjvInw.exe
  2⤵
  PID:13748
- C:\Windows\System\BZAiKkT.exe
  C:\Windows\System\BZAiKkT.exe
  2⤵
  PID:13876
- C:\Windows\System\aeFEAuO.exe
  C:\Windows\System\aeFEAuO.exe
  2⤵
  PID:13992
- C:\Windows\System\hgwvZSX.exe
  C:\Windows\System\hgwvZSX.exe
  2⤵
  PID:14128
- C:\Windows\System\ZpINbSt.exe
  C:\Windows\System\ZpINbSt.exe
  2⤵
  PID:14328
- C:\Windows\System\PeisXzQ.exe
  C:\Windows\System\PeisXzQ.exe
  2⤵
  PID:13928
- C:\Windows\System\HEJzqaD.exe
  C:\Windows\System\HEJzqaD.exe
  2⤵
  PID:14072
- C:\Windows\System\bEXDbtD.exe
  C:\Windows\System\bEXDbtD.exe
  2⤵
  PID:14312
- C:\Windows\System\anlpCyX.exe
  C:\Windows\System\anlpCyX.exe
  2⤵
  PID:13548
- C:\Windows\System\fKHFaxK.exe
  C:\Windows\System\fKHFaxK.exe
  2⤵
  PID:13540
- C:\Windows\System\bHQIzQI.exe
  C:\Windows\System\bHQIzQI.exe
  2⤵
  PID:14368
- C:\Windows\System\ozJhtjI.exe
  C:\Windows\System\ozJhtjI.exe
  2⤵
  PID:14428
- C:\Windows\System\YkylpAZ.exe
  C:\Windows\System\YkylpAZ.exe
  2⤵
  PID:14444
- C:\Windows\System\cVVKznM.exe
  C:\Windows\System\cVVKznM.exe
  2⤵
  PID:14472
- C:\Windows\System\vvcURrk.exe
  C:\Windows\System\vvcURrk.exe
  2⤵
  PID:14488
- C:\Windows\System\PVtpcAo.exe
  C:\Windows\System\PVtpcAo.exe
  2⤵
  PID:14512
- C:\Windows\System\EOJTXfC.exe
  C:\Windows\System\EOJTXfC.exe
  2⤵
  PID:14540
- C:\Windows\System\LEUGjKZ.exe
  C:\Windows\System\LEUGjKZ.exe
  2⤵
  PID:14568
- C:\Windows\System\zxujPkk.exe
  C:\Windows\System\zxujPkk.exe
  2⤵
  PID:14588
- C:\Windows\System\uCxNdze.exe
  C:\Windows\System\uCxNdze.exe
  2⤵
  PID:14644
- C:\Windows\System\zPrNZEN.exe
  C:\Windows\System\zPrNZEN.exe
  2⤵
  PID:14672
- C:\Windows\System\PhGPjOz.exe
  C:\Windows\System\PhGPjOz.exe
  2⤵
  PID:14700
- C:\Windows\System\csizJrS.exe
  C:\Windows\System\csizJrS.exe
  2⤵
  PID:14720
- C:\Windows\System\DVbsTRl.exe
  C:\Windows\System\DVbsTRl.exe
  2⤵
  PID:14744
- C:\Windows\System\sVnMSUj.exe
  C:\Windows\System\sVnMSUj.exe
  2⤵
  PID:14772
- C:\Windows\System\liVebsM.exe
  C:\Windows\System\liVebsM.exe
  2⤵
  PID:14812
- C:\Windows\System\gmKavjs.exe
  C:\Windows\System\gmKavjs.exe
  2⤵
  PID:14828
- C:\Windows\System\zJgnRbw.exe
  C:\Windows\System\zJgnRbw.exe
  2⤵
  PID:14844
- C:\Windows\System\stGAfRB.exe
  C:\Windows\System\stGAfRB.exe
  2⤵
  PID:14872
- C:\Windows\System\payHXNN.exe
  C:\Windows\System\payHXNN.exe
  2⤵
  PID:14896
- C:\Windows\System\EkmATDx.exe
  C:\Windows\System\EkmATDx.exe
  2⤵
  PID:14928
- C:\Windows\System\AJmhCuj.exe
  C:\Windows\System\AJmhCuj.exe
  2⤵
  PID:14960
- C:\Windows\System\EQCKahj.exe
  C:\Windows\System\EQCKahj.exe
  2⤵
  PID:14992
- C:\Windows\System\dgjXdEs.exe
  C:\Windows\System\dgjXdEs.exe
  2⤵
  PID:15012
- C:\Windows\System\FBmunvs.exe
  C:\Windows\System\FBmunvs.exe
  2⤵
  PID:15036
- C:\Windows\System\gOdIexw.exe
  C:\Windows\System\gOdIexw.exe
  2⤵
  PID:15068
- C:\Windows\System\ZNlSVsp.exe
  C:\Windows\System\ZNlSVsp.exe
  2⤵
  PID:15100
- C:\Windows\System\UPPaEfi.exe
  C:\Windows\System\UPPaEfi.exe
  2⤵
  PID:15136
- C:\Windows\System\mCGrdrf.exe
  C:\Windows\System\mCGrdrf.exe
  2⤵
  PID:15156
- C:\Windows\System\mbQMnuF.exe
  C:\Windows\System\mbQMnuF.exe
  2⤵
  PID:15180
- C:\Windows\System\vFhRSbq.exe
  C:\Windows\System\vFhRSbq.exe
  2⤵
  PID:15208
- C:\Windows\System\tsSDaCf.exe
  C:\Windows\System\tsSDaCf.exe
  2⤵
  PID:15236
- C:\Windows\System\gbGNYqU.exe
  C:\Windows\System\gbGNYqU.exe
  2⤵
  PID:15260
- C:\Windows\System\QrPlVbX.exe
  C:\Windows\System\QrPlVbX.exe
  2⤵
  PID:15284
- C:\Windows\System\aGgUPJy.exe
  C:\Windows\System\aGgUPJy.exe
  2⤵
  PID:15344
- C:\Windows\System\FPYhxrL.exe
  C:\Windows\System\FPYhxrL.exe
  2⤵
  PID:14344
- C:\Windows\System\VQTHsRR.exe
  C:\Windows\System\VQTHsRR.exe
  2⤵
  PID:14424
- C:\Windows\System\PIzxvgz.exe
  C:\Windows\System\PIzxvgz.exe
  2⤵
  PID:14468
- C:\Windows\System\uKgRMbV.exe
  C:\Windows\System\uKgRMbV.exe
  2⤵
  PID:14500
- C:\Windows\System\ibzJzkB.exe
  C:\Windows\System\ibzJzkB.exe
  2⤵
  PID:14608
- C:\Windows\System\FdGAKup.exe
  C:\Windows\System\FdGAKup.exe
  2⤵
  PID:14660
- C:\Windows\System\WBurpHx.exe
  C:\Windows\System\WBurpHx.exe
  2⤵
  PID:14732
- C:\Windows\System\XCDtYyX.exe
  C:\Windows\System\XCDtYyX.exe
  2⤵
  PID:14804
- C:\Windows\System\SLrYovA.exe
  C:\Windows\System\SLrYovA.exe
  2⤵
  PID:14860
- C:\Windows\System\QDJnfmc.exe
  C:\Windows\System\QDJnfmc.exe
  2⤵
  PID:14920
- C:\Windows\System\XguQpVo.exe
  C:\Windows\System\XguQpVo.exe
  2⤵
  PID:14952
- C:\Windows\System\OcvoLjR.exe
  C:\Windows\System\OcvoLjR.exe
  2⤵
  PID:15032
- C:\Windows\System\KyKKWOC.exe
  C:\Windows\System\KyKKWOC.exe
  2⤵
  PID:15064
- C:\Windows\System\lhZvZpr.exe
  C:\Windows\System\lhZvZpr.exe
  2⤵
  PID:15120
- C:\Windows\System\fKvlgEX.exe
  C:\Windows\System\fKvlgEX.exe
  2⤵
  PID:15196
- C:\Windows\System\iYDYuAE.exe
  C:\Windows\System\iYDYuAE.exe
  2⤵
  PID:15248
- C:\Windows\System\YMvoMhs.exe
  C:\Windows\System\YMvoMhs.exe
  2⤵
  PID:15324
- C:\Windows\System\jNorIUE.exe
  C:\Windows\System\jNorIUE.exe
  2⤵
  PID:14412
- C:\Windows\System\lxhZYbd.exe
  C:\Windows\System\lxhZYbd.exe
  2⤵
  PID:14560
- C:\Windows\System\pjvYXfz.exe
  C:\Windows\System\pjvYXfz.exe
  2⤵
  PID:14792
- C:\Windows\System\UyLIOBc.exe
  C:\Windows\System\UyLIOBc.exe
  2⤵
  PID:14856
- C:\Windows\System\PkkXxgS.exe
  C:\Windows\System\PkkXxgS.exe
  2⤵
  PID:15024
- C:\Windows\System\EMpynxJ.exe
  C:\Windows\System\EMpynxJ.exe
  2⤵
  PID:15096
- C:\Windows\System\VslaVHq.exe
  C:\Windows\System\VslaVHq.exe
  2⤵
  PID:14364
- C:\Windows\System\rLFHaDM.exe
  C:\Windows\System\rLFHaDM.exe
  2⤵
  PID:14768
- C:\Windows\System\qGLdAbT.exe
  C:\Windows\System\qGLdAbT.exe
  2⤵
  PID:15080
- C:\Windows\System\OAkaKtc.exe
  C:\Windows\System\OAkaKtc.exe
  2⤵
  PID:14836
- C:\Windows\System\rGZCrOn.exe
  C:\Windows\System\rGZCrOn.exe
  2⤵
  PID:14580
- C:\Windows\System\QDyaBvL.exe
  C:\Windows\System\QDyaBvL.exe
  2⤵
  PID:15384
- C:\Windows\System\kCMhyQy.exe
  C:\Windows\System\kCMhyQy.exe
  2⤵
  PID:15412
- C:\Windows\System\eHtkXew.exe
  C:\Windows\System\eHtkXew.exe
  2⤵
  PID:15436
- C:\Windows\System\NgqBRXI.exe
  C:\Windows\System\NgqBRXI.exe
  2⤵
  PID:15456
- C:\Windows\System\dRzcADj.exe
  C:\Windows\System\dRzcADj.exe
  2⤵
  PID:15488
- C:\Windows\System\LKWLNFg.exe
  C:\Windows\System\LKWLNFg.exe
  2⤵
  PID:15508
- C:\Windows\System\scSQqis.exe
  C:\Windows\System\scSQqis.exe
  2⤵
  PID:15532
- C:\Windows\System\XgTvjsu.exe
  C:\Windows\System\XgTvjsu.exe
  2⤵
  PID:15568
- C:\Windows\System\DFkJPge.exe
  C:\Windows\System\DFkJPge.exe
  2⤵
  PID:15608
- C:\Windows\System\kuEXiyX.exe
  C:\Windows\System\kuEXiyX.exe
  2⤵
  PID:15632
- C:\Windows\System\WsqizhP.exe
  C:\Windows\System\WsqizhP.exe
  2⤵
  PID:15664
- C:\Windows\System\vWodyiQ.exe
  C:\Windows\System\vWodyiQ.exe
  2⤵
  PID:15696
- C:\Windows\System\qeftMys.exe
  C:\Windows\System\qeftMys.exe
  2⤵
  PID:15720
- C:\Windows\System\SjDahNo.exe
  C:\Windows\System\SjDahNo.exe
  2⤵
  PID:15760
- C:\Windows\System\zTJXpFm.exe
  C:\Windows\System\zTJXpFm.exe
  2⤵
  PID:15788
- C:\Windows\System\oZwuEet.exe
  C:\Windows\System\oZwuEet.exe
  2⤵
  PID:15816
- C:\Windows\System\tmKAfcu.exe
  C:\Windows\System\tmKAfcu.exe
  2⤵
  PID:15844
- C:\Windows\System\bitsSVO.exe
  C:\Windows\System\bitsSVO.exe
  2⤵
  PID:15872
- C:\Windows\System\FfkzlNe.exe
  C:\Windows\System\FfkzlNe.exe
  2⤵
  PID:15900
- C:\Windows\System\yualKKY.exe
  C:\Windows\System\yualKKY.exe
  2⤵
  PID:15928
- C:\Windows\System\psgaJzD.exe
  C:\Windows\System\psgaJzD.exe
  2⤵
  PID:15944
- C:\Windows\System\fIXuFaz.exe
  C:\Windows\System\fIXuFaz.exe
  2⤵
  PID:15972
- C:\Windows\System\lkQfnNm.exe
  C:\Windows\System\lkQfnNm.exe
  2⤵
  PID:15996
- C:\Windows\System\zBFkcEz.exe
  C:\Windows\System\zBFkcEz.exe
  2⤵
  PID:16028
- C:\Windows\System\cQOwaen.exe
  C:\Windows\System\cQOwaen.exe
  2⤵
  PID:16068
- C:\Windows\System\qLpvtuf.exe
  C:\Windows\System\qLpvtuf.exe
  2⤵
  PID:16084
- C:\Windows\System\qtuosMm.exe
  C:\Windows\System\qtuosMm.exe
  2⤵
  PID:16112
- C:\Windows\System\bJkkmIR.exe
  C:\Windows\System\bJkkmIR.exe
  2⤵
  PID:16140
- C:\Windows\System\YiBGgvj.exe
  C:\Windows\System\YiBGgvj.exe
  2⤵
  PID:16168
- C:\Windows\System\atJhVtG.exe
  C:\Windows\System\atJhVtG.exe
  2⤵
  PID:16196
- C:\Windows\System\RANdPWn.exe
  C:\Windows\System\RANdPWn.exe
  2⤵
  PID:16224
- C:\Windows\System\CoPydWs.exe
  C:\Windows\System\CoPydWs.exe
  2⤵
  PID:16256
- C:\Windows\System\IcDpIrY.exe
  C:\Windows\System\IcDpIrY.exe
  2⤵
  PID:16280
- C:\Windows\System\wMJixhF.exe
  C:\Windows\System\wMJixhF.exe
  2⤵
  PID:16308
- C:\Windows\System\jYfAxtx.exe
  C:\Windows\System\jYfAxtx.exe
  2⤵
  PID:16328
- C:\Windows\System\vuEWQNa.exe
  C:\Windows\System\vuEWQNa.exe
  2⤵
  PID:16360
- C:\Windows\System\jkUvzpN.exe
  C:\Windows\System\jkUvzpN.exe
  2⤵
  PID:15424
- C:\Windows\System\AiVfgCO.exe
  C:\Windows\System\AiVfgCO.exe
  2⤵
  PID:15404
- C:\Windows\System\WBDkAaa.exe
  C:\Windows\System\WBDkAaa.exe
  2⤵
  PID:15504
- C:\Windows\System\zzySfSm.exe
  C:\Windows\System\zzySfSm.exe
  2⤵
  PID:15552
- C:\Windows\System\GwnuMzQ.exe
  C:\Windows\System\GwnuMzQ.exe
  2⤵
  PID:15628
- C:\Windows\System\ddEfeBd.exe
  C:\Windows\System\ddEfeBd.exe
  2⤵
  PID:15648
- C:\Windows\System\BmntWJr.exe
  C:\Windows\System\BmntWJr.exe
  2⤵
  PID:15716
- C:\Windows\System\lKHSvfu.exe
  C:\Windows\System\lKHSvfu.exe
  2⤵
  PID:15832
- C:\Windows\System\cbzTNAG.exe
  C:\Windows\System\cbzTNAG.exe
  2⤵
  PID:15884
- C:\Windows\System\zgYNhep.exe
  C:\Windows\System\zgYNhep.exe
  2⤵
  PID:15956
- C:\Windows\System\PextdjW.exe
  C:\Windows\System\PextdjW.exe
  2⤵
  PID:16016
- C:\Windows\System\AlxBEHZ.exe
  C:\Windows\System\AlxBEHZ.exe
  2⤵
  PID:16080
- C:\Windows\System\DYRlKZk.exe
  C:\Windows\System\DYRlKZk.exe
  2⤵
  PID:16188
- C:\Windows\System\uAuNjmx.exe
  C:\Windows\System\uAuNjmx.exe
  2⤵
  PID:16192
- C:\Windows\System\pMPQGHD.exe
  C:\Windows\System\pMPQGHD.exe
  2⤵
  PID:16296
- C:\Windows\System\nNQnKCR.exe
  C:\Windows\System\nNQnKCR.exe
  2⤵
  PID:16320
- C:\Windows\System\RSWyVEQ.exe
  C:\Windows\System\RSWyVEQ.exe
  2⤵
  PID:14968
- C:\Windows\System\ETljmHu.exe
  C:\Windows\System\ETljmHu.exe
  2⤵
  PID:15520
- C:\Windows\System\QqZrUNk.exe
  C:\Windows\System\QqZrUNk.exe
  2⤵
  PID:15688
- C:\Windows\System\DGVXhJf.exe
  C:\Windows\System\DGVXhJf.exe
  2⤵
  PID:15868
- C:\Windows\System\fWGTNPF.exe
  C:\Windows\System\fWGTNPF.exe
  2⤵
  PID:16064
- C:\Windows\System\xOMCEFy.exe
  C:\Windows\System\xOMCEFy.exe
  2⤵
  PID:16180
- C:\Windows\System\OJBkZYU.exe
  C:\Windows\System\OJBkZYU.exe
  2⤵
  PID:16300
- C:\Windows\System\VKOjkiC.exe
  C:\Windows\System\VKOjkiC.exe
  2⤵
  PID:15772
- C:\Windows\System\Ghipxmd.exe
  C:\Windows\System\Ghipxmd.exe
  2⤵
  PID:15624
- C:\Windows\System\DibuKrM.exe
  C:\Windows\System\DibuKrM.exe
  2⤵
  PID:16096
- C:\Windows\System\phieAWA.exe
  C:\Windows\System\phieAWA.exe
  2⤵
  PID:3124
- C:\Windows\System\TCpmouX.exe
  C:\Windows\System\TCpmouX.exe
  2⤵
  PID:16372
- C:\Windows\System\iBKUHrU.exe
  C:\Windows\System\iBKUHrU.exe
  2⤵
  PID:15804
- C:\Windows\System\SQuaOZK.exe
  C:\Windows\System\SQuaOZK.exe
  2⤵
  PID:16408
- C:\Windows\System\qIrGZKx.exe
  C:\Windows\System\qIrGZKx.exe
  2⤵
  PID:16436
- C:\Windows\System\ZIuSmov.exe
  C:\Windows\System\ZIuSmov.exe
  2⤵
  PID:16464
- C:\Windows\System\XfgNMXk.exe
  C:\Windows\System\XfgNMXk.exe
  2⤵
  PID:16492
- C:\Windows\System\tDckuGm.exe
  C:\Windows\System\tDckuGm.exe
  2⤵
  PID:16508
- C:\Windows\System\hLcwGuT.exe
  C:\Windows\System\hLcwGuT.exe
  2⤵
  PID:16532
- C:\Windows\System\AcoyePH.exe
  C:\Windows\System\AcoyePH.exe
  2⤵
  PID:16572
- C:\Windows\System\MiQgpMK.exe
  C:\Windows\System\MiQgpMK.exe
  2⤵
  PID:16592
- C:\Windows\System\RqbkHuo.exe
  C:\Windows\System\RqbkHuo.exe
  2⤵
  PID:16632
- C:\Windows\System\QwneEfh.exe
  C:\Windows\System\QwneEfh.exe
  2⤵
  PID:16660
- C:\Windows\System\zQmqwNz.exe
  C:\Windows\System\zQmqwNz.exe
  2⤵
  PID:16676
- C:\Windows\System\DhHKcLn.exe
  C:\Windows\System\DhHKcLn.exe
  2⤵
  PID:16704
- C:\Windows\System\DZcjyfD.exe
  C:\Windows\System\DZcjyfD.exe
  2⤵
  PID:16732
- C:\Windows\System\PYBmiAC.exe
  C:\Windows\System\PYBmiAC.exe
  2⤵
  PID:16748
- C:\Windows\System\rnfanQo.exe
  C:\Windows\System\rnfanQo.exe
  2⤵
  PID:16804
- C:\Windows\System\oFcLSaP.exe
  C:\Windows\System\oFcLSaP.exe
  2⤵
  PID:16832
- C:\Windows\System\KidafUc.exe
  C:\Windows\System\KidafUc.exe
  2⤵
  PID:16860
- C:\Windows\System\wWmhxqG.exe
  C:\Windows\System\wWmhxqG.exe
  2⤵
  PID:16888
- C:\Windows\System\nbsmrUC.exe
  C:\Windows\System\nbsmrUC.exe
  2⤵
  PID:16908
- C:\Windows\System\jfRgMph.exe
  C:\Windows\System\jfRgMph.exe
  2⤵
  PID:16932
- C:\Windows\System\LxIXyXC.exe
  C:\Windows\System\LxIXyXC.exe
  2⤵
  PID:16960
- C:\Windows\System\SjWiWRD.exe
  C:\Windows\System\SjWiWRD.exe
  2⤵
  PID:16984
- C:\Windows\System\xzXdnbT.exe
  C:\Windows\System\xzXdnbT.exe
  2⤵
  PID:17028
- C:\Windows\System\PcmdCxB.exe
  C:\Windows\System\PcmdCxB.exe
  2⤵
  PID:17044
- C:\Windows\System\UMqcefI.exe
  C:\Windows\System\UMqcefI.exe
  2⤵
  PID:17072
- C:\Windows\System\vBNjyTK.exe
  C:\Windows\System\vBNjyTK.exe
  2⤵
  PID:17100
- C:\Windows\System\iBQBRap.exe
  C:\Windows\System\iBQBRap.exe
  2⤵
  PID:17140
- C:\Windows\System\FnRFXaw.exe
  C:\Windows\System\FnRFXaw.exe
  2⤵
  PID:17168
- C:\Windows\System\kivNdDp.exe
  C:\Windows\System\kivNdDp.exe
  2⤵
  PID:17196
- C:\Windows\System\cEgLlAx.exe
  C:\Windows\System\cEgLlAx.exe
  2⤵
  PID:17224
- C:\Windows\System\aJNxMnn.exe
  C:\Windows\System\aJNxMnn.exe
  2⤵
  PID:17244
- C:\Windows\System\Erxbxtn.exe
  C:\Windows\System\Erxbxtn.exe
  2⤵
  PID:17268
- C:\Windows\System\fQagBRy.exe
  C:\Windows\System\fQagBRy.exe
  2⤵
  PID:17304
- C:\Windows\System\QXEplCJ.exe
  C:\Windows\System\QXEplCJ.exe
  2⤵
  PID:17324
- C:\Windows\System\galxnLO.exe
  C:\Windows\System\galxnLO.exe
  2⤵
  PID:17348
- C:\Windows\System\KPDjOuc.exe
  C:\Windows\System\KPDjOuc.exe
  2⤵
  PID:17372
- C:\Windows\System\RiuqxXw.exe
  C:\Windows\System\RiuqxXw.exe
  2⤵
  PID:16060
- C:\Windows\System\lebgYFx.exe
  C:\Windows\System\lebgYFx.exe
  2⤵
  PID:16388
- C:\Windows\System\TOKDXqY.exe
  C:\Windows\System\TOKDXqY.exe
  2⤵
  PID:16448
- C:\Windows\System\LZUPPLC.exe
  C:\Windows\System\LZUPPLC.exe
  2⤵
  PID:16500
- C:\Windows\System\WFMPYOk.exe
  C:\Windows\System\WFMPYOk.exe
  2⤵
  PID:15660
- C:\Windows\System\mkLKsCy.exe
  C:\Windows\System\mkLKsCy.exe
  2⤵
  PID:16628
- C:\Windows\System\vOfTVJM.exe
  C:\Windows\System\vOfTVJM.exe
  2⤵
  PID:16724
- C:\Windows\System\RofyFIt.exe
  C:\Windows\System\RofyFIt.exe
  2⤵
  PID:16792
- C:\Windows\System\hKeajVv.exe
  C:\Windows\System\hKeajVv.exe
  2⤵
  PID:16876
- C:\Windows\System\PfhjvCs.exe
  C:\Windows\System\PfhjvCs.exe
  2⤵
  PID:16976
- C:\Windows\System\UwOdRru.exe
  C:\Windows\System\UwOdRru.exe
  2⤵
  PID:16972
- C:\Windows\System\BdmMXGJ.exe
  C:\Windows\System\BdmMXGJ.exe
  2⤵
  PID:17064
- C:\Windows\System\IOtsrUq.exe
  C:\Windows\System\IOtsrUq.exe
  2⤵
  PID:17120
- C:\Windows\System\CEnaQqJ.exe
  C:\Windows\System\CEnaQqJ.exe
  2⤵
  PID:17188
- C:\Windows\System\NqHuJdA.exe
  C:\Windows\System\NqHuJdA.exe
  2⤵
  PID:17240
- C:\Windows\System\UGBXqsm.exe
  C:\Windows\System\UGBXqsm.exe
  2⤵
  PID:17316
- C:\Windows\System\fDRNvUV.exe
  C:\Windows\System\fDRNvUV.exe
  2⤵
  PID:17400
- C:\Windows\System\DHyiKtt.exe
  C:\Windows\System\DHyiKtt.exe
  2⤵
  PID:16484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4292,i,3595107284059830391,18018199024659337217,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:8
1⤵
PID:460

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AEGrHrV.exe

Path C:\Windows\System\AEGrHrV.exe
Size 1.6MB
SHA256 b703cf1d50822921cef7bccf0ea689d9d14c86aac57e0d87f60ba360cd95fae9
MD5 f0b9f3d9799e168c15e05eb11ece27a5
SHA1 20add36223e11589cfc1e67d71a31fa165cf7610
SHA512 845cc30056adc803ee5c9c508c8d1021d318807759f9b9d4e47517ed4c1518a3be134851f75f333b3795f10998c615b123581ee6f97a6653978ca4139a0669a4
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3B:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8P
MD5 SHA1 SHA512 SSDEEP

Submit Download

CJhTHis.exe

Path C:\Windows\System\CJhTHis.exe
Size 1.6MB
SHA256 a872795dc6cf27bc60427ff61a8d348729dbd354c946892aa23dc1396f7482c7
MD5 c359001a5d31c1bb6357b27f88f07a10
SHA1 d57cf64bd84fd491d689fff57b594df4dce60dad
SHA512 637c3c15aefa45fc38fd6a2ff4a784412a7268a826e3c2bee1144c82997c7df81e6de4a731576b4537a37d3b2bf041c315e169554a0ddee61cd29531b00cc28b
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt37:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm85
MD5 SHA1 SHA512 SSDEEP

Submit Download

FMviskz.exe

Path C:\Windows\System\FMviskz.exe
Size 1.6MB
SHA256 8220f904dcf06c3a73df24517399f402fa9c4d3470c621611e47668a29c71521
MD5 8a7ded43e011a2c68249fceaca728e46
SHA1 ac1e3adae55df6870228655a82bbee9e38431351
SHA512 54e3785f8677f414b60aa7e7f7be15944a71d2b94fbfbbe17ed942cbf942155d8913c161352a48a4fc6c7219a30273d389d0a8906890b2fe811470001d4dc13b
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3w:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm82
MD5 SHA1 SHA512 SSDEEP

Submit Download

GUNrjYC.exe

Path C:\Windows\System\GUNrjYC.exe
Size 1.6MB
SHA256 8c7231ba3c447e8ccf7aa224c6a2a1cab1608a68098795f85770ea1c1c473d45
MD5 c52c33e9f9f79939cc7100ac011a1ee6
SHA1 0c9c0cb4061aeab85bc3ba8141e19756252390a0
SHA512 6041dc7acb01d131336edd932ab9663f861fbf82ad869402f85223085a2fcc77c15759df10b207734861d7d640ed41594666c494d56a95ce4929be9f856b001c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt30:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8q
MD5 SHA1 SHA512 SSDEEP

Submit Download

HmYrQyv.exe

Path C:\Windows\System\HmYrQyv.exe
Size 1.6MB
SHA256 c123a771a8867952f261841a5f907b123c52218c942bcb6aeb2a6fcef4c86cf7
MD5 29c4b67103a6a8eab222d587cf572f72
SHA1 1d916a2a93028ea59b2bf4808d0e3762cc74fe7f
SHA512 35765420e7d4b24df277d95766ddbed97e123efd27720e342769981b2882a2f4af918d96ae04292aa7ccb31df875cdd8a443e17ab66f9b23d4b62f493f4ff233
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3q:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm84
MD5 SHA1 SHA512 SSDEEP

Submit Download

IjPpYtA.exe

Path C:\Windows\System\IjPpYtA.exe
Size 1.6MB
SHA256 d66f3edda292c96d9726d9d6410360d1558cdb3cbc9c2f83eaa4c6f0d3ae8d05
MD5 fed9403d4d79885a2007aed0fa0a6263
SHA1 9973f9148cae24e1e19a8ae65a9af772683655d9
SHA512 0e96dffd0504a704100475aafa021e711bba34d3d317321e80cb24a2245adee8216aba326dfa232b7f6ed0271d771167191dd8ac2d59a5ed0f31eaa09fb2215e
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3e:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm84
MD5 SHA1 SHA512 SSDEEP

Submit Download

JnuwttU.exe

Path C:\Windows\System\JnuwttU.exe
Size 1.6MB
SHA256 1770bea909e477ad0eeeb8ed4d0abd60b020b6898aef4deb8bb998f85763fdd9
MD5 d7c5621b2f2f7349fb0dcd25fb8389e9
SHA1 d8b20d3d41e87b4e8e09c814340793305b31a76e
SHA512 05bdc7f2cf05f031d4d9de85973ec8433a26263a33542a12a14698475a1f833e59e838ebddea7c8f2b6a34161fadae22c106d82fbf8104cb2f8e69020d41b387
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3M:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8y
MD5 SHA1 SHA512 SSDEEP

Submit Download

NAGpYfT.exe

Path C:\Windows\System\NAGpYfT.exe
Size 1.6MB
SHA256 9534c0f7b1613c87c3b7f5e06ba747074b36df04765ab0fab383a3fd193fc18f
MD5 82ee7c6cf7cfe64008394221991f4456
SHA1 89694eac5ff75a19969ba05ef7f83ec9d80df37f
SHA512 f56d4419a7af0d117bfde81a6a66c35fd1254c47c52202c637218ce2c66439c3e47b837ac6777686b0795045f59b500661288aa15eb681eabd4a68134e09e1d5
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3X:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8p
MD5 SHA1 SHA512 SSDEEP

Submit Download

QOAUbTq.exe

Path C:\Windows\System\QOAUbTq.exe
Size 1.6MB
SHA256 debc16445683589f56cd3f6aa2381f5c5d9a9b4f9e8306dc00e51d091449b279
MD5 ea122f476bf1e483e4cb02ace3c364cc
SHA1 64bc4028fc491762094cc4d6a757f48ca56898d7
SHA512 766c2ae5c38a1a1edc64105cae2908a8cdd51cd8238b781320a5719c28cb456ebad6e645cf12a60afa81c0b518b08c4154f1a30cdc9eacdf370602da5c4bb388
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3b:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8J
MD5 SHA1 SHA512 SSDEEP

Submit Download

SZAqQJF.exe

Path C:\Windows\System\SZAqQJF.exe
Size 1.6MB
SHA256 30e573ec0d7c948dda1f659803db94bd27a7d2ce09ab81912c1d8fe207ea4cfd
MD5 d20b4e0f62dfda5badd32b8f80562178
SHA1 b9a77a567a64be0585e6e6d8ddb7c8e7ffd1e8ce
SHA512 e911f6a4494e8ad819e73f6a4c8e27335c0df2559ff637f20dc31fff70c40c5d4aed8b05cfd0119692f63f32580f4031c7eab620938de89866791ac11015ae61
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3T:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8h
MD5 SHA1 SHA512 SSDEEP

Submit Download

TfEJsss.exe

Path C:\Windows\System\TfEJsss.exe
Size 1.6MB
SHA256 e27757b5454f90c85787d38702abddf18aa6b3d4a7b53011a1962bf81b4a770a
MD5 d161b9718be4f3241a5aaff6ac1fb387
SHA1 dc32a78925bc92cd2819941139d35a4ee1a2cfdd
SHA512 26e75b647cc8a214274f33d94f3d081703e3dc01fad37859626d8f4d71338051810953ee3835c0aed5a4771d22e65b9b836980e49d8f917785f8ac07a689b895
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt34:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8e
MD5 SHA1 SHA512 SSDEEP

Submit Download

UMZVSMx.exe

Path C:\Windows\System\UMZVSMx.exe
Size 1.6MB
SHA256 84ca3c41504ed0ea8b5d02bbb31944ebf43d21d53bd8ef1727ceeb92382679ab
MD5 88113fd0ce062366171877b04711462e
SHA1 586d74644187e520c19480dcd68e9abc906e6bf0
SHA512 e05bc6267efea1d73a6d5c96456adcfa496e1ff08ed18665f5a2daa10540308dc50eb6aa48e043dfa4a5344157263dfd50f7eda2fe764030da281eec2d21726d
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt36:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8k
MD5 SHA1 SHA512 SSDEEP

Submit Download

VocrgRR.exe

Path C:\Windows\System\VocrgRR.exe
Size 1.6MB
SHA256 c10906ffae0b3403fed21c8a55c7ec1d96756389fb5d57ae4c41d69acce3a974
MD5 2b76bfa5075074c8ccb993587a5cb88c
SHA1 b4d8c24212a91d2d46e44edf86bf0901dfa0321a
SHA512 3b4982a370b094b44f21e80d9ce416112fda9145a163eef9bab3e4a2f5a7a2a2006de82c333ff2fe3af5918edf2ec1812e273ceae2307442fe24dc5680e5ea1f
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3P:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm89
MD5 SHA1 SHA512 SSDEEP

Submit Download

WfOknSy.exe

Path C:\Windows\System\WfOknSy.exe
Size 1.6MB
SHA256 f418890ab284b91a10ec5218c0e9854558940c49544a836ed18e8d97b222c59d
MD5 f51d263262b4aa86ebc3a776b4659ba9
SHA1 cb3fba99538c1422f5f6f15f8f0ca71f0c2b25db
SHA512 0f31128a7a0dd2e4674aba8d7f2a0e22ec3725446a4e1ec5a15fe27feca28027eb3f38e73652d958a7a0fba93d302ae0ac12dbf41aa7afd912b98b06c184cfdb
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3Y:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8q
MD5 SHA1 SHA512 SSDEEP

Submit Download

YAEZIqE.exe

Path C:\Windows\System\YAEZIqE.exe
Size 1.6MB
SHA256 6cdfdccbeccd96f5220c058298ed4652d6a185b9d4e4da0e350ea98c7e129f58
MD5 07b63a7c81c3b724c1ccdb4eae71a44f
SHA1 25f0441f560f38d7617f5c2310245e88a04d9db0
SHA512 f0b9d60ee8186b129be319abef5372052ee2994560a5f02a255f67602331b9ca0daf29a0df777c7136e49f21c310771a739d87ac8b82640bf805b28397599cc6
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3f:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8J
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZGNVFQs.exe

Path C:\Windows\System\ZGNVFQs.exe
Size 1.6MB
SHA256 f73f9c7c073008b50b3b30804fd1efe389330d8ad7c4c565b0c5cf86538881a6
MD5 9d5c25b6a6b45e94f614e3a7803bb638
SHA1 d8668a4e34c8a5dcc288c662128af3d28db16a22
SHA512 b34bc21786cd3f7a8d39a16508b8f211f37696c106e984316e3abf9a532080c24473d26ee9b590c186995873fbb950d3b0a0bf77c6fbd57d28c5378e1830e376
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt32:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm88
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZvFrOVV.exe

Path C:\Windows\System\ZvFrOVV.exe
Size 1.6MB
SHA256 5654952a3e0ac9bd2f1a6729e3563bd8092c0bfb41fd3c039d0889c388f3efb5
MD5 b928d82e9194e6b7e1f6cc0745bbd5c2
SHA1 8cec3efa09d85a7f439c18295dfc1f3d6b909fd6
SHA512 4083f714e91f9a22067d44f100fe6dcca74db4e1d36bb2089c80169b9034ac189baf3842299c6b56482631259b3149ccee20fd176ee3e7c0210c0046ee26083a
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3/:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8B
MD5 SHA1 SHA512 SSDEEP

Submit Download

ajbNzsH.exe

Path C:\Windows\System\ajbNzsH.exe
Size 1.6MB
SHA256 c1e106a1b6ca1ff66849c8c1d622613c485bc5dbe073694502463a5163fdf1bc
MD5 20455561df8de544598f79d727792e9a
SHA1 56c108076c51136bd626d1d08d5ad0fde5b923ed
SHA512 2c768dff1e17e9de335150a00d91665a1d1b8dba862f4b0680f1cf5a510c8f97c9794da15872456e2f9baf9d16927460655729625390063b171cfe287efd6c09
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3+:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm80
MD5 SHA1 SHA512 SSDEEP

Submit Download

bkgWGuq.exe

Path C:\Windows\System\bkgWGuq.exe
Size 1.6MB
SHA256 8c78bee7a44fde81ef71217b1a711f9ea335bfba5253537fc27b7e4b904479a7
MD5 e04d1b97c4f38fb9a4c65a728c7ef999
SHA1 608b570f029048a4f083fdc86d2be8b9642bdc31
SHA512 47f4a8146dd3c8f1b2556f685c5df7cc33028b16537cae2da5d656b64c1eb3b3a9ba70c256865000fc9a066d4f7cd88b69d6eacd196ea75a76642432fdd10a9e
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3T:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

fJAFxRc.exe

Path C:\Windows\System\fJAFxRc.exe
Size 1.6MB
SHA256 119653af86e58b0e684771785066548bf60a32172c75ef338944b6497d21fbb9
MD5 03930b7ff0f40580b8e07be176f771a6
SHA1 67f91f531781e6253dbc0f136cf5dd1f9aa82c1d
SHA512 6b3a43cf6bb0a323ab0c237531763b5f9d75ba87b106fae22362de2d4f7da00f393b745ea701eb03cbf11c15384ca42baef0209dbc4df2b19bde93372e0ac378
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3/:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8N
MD5 SHA1 SHA512 SSDEEP

Submit Download

fJMQMUv.exe

Path C:\Windows\System\fJMQMUv.exe
Size 1.6MB
SHA256 b03dd96a7b0cab3c13507a6945f1f5777918c2c9a1c849c713f35132ab651b7c
MD5 98813dc2c30e270b11d2ea29dcbf9fb0
SHA1 5862f3adadc0fba7084c7316a1894e8177bb8e05
SHA512 1721dd3c23cf693e48d554a2d9a8d1a65f926f98a2289b8bff8aa411c8856fe7cfff53f3dc886c31005168514f4ad6e98af7235403bd8a60ab258d67a93e7735
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3T:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8B
MD5 SHA1 SHA512 SSDEEP

Submit Download

kwtmpWO.exe

Path C:\Windows\System\kwtmpWO.exe
Size 1.6MB
SHA256 7a3f49e22f21fc04868be09b04a32e404c8118beffc01db75170abce7f99af03
MD5 a6a5bb53c1a25a5bff6a8802000fb015
SHA1 818af0d10bbf2016eccbaa84d2edb426d2e7825b
SHA512 84341e59d81f0ddcbdf56b03344aba4b9a914d57600bb596054c84e7c60bae4ffea9c9d77916991e0a1c22464552b340455297870e4187494ea29982242c53b5
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3H:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8N
MD5 SHA1 SHA512 SSDEEP

Submit Download

lBQvYfR.exe

Path C:\Windows\System\lBQvYfR.exe
Size 1.6MB
SHA256 b0d1be2a055ae7a82a405cd7ae63ccf2692900df72dac2a6fd6ea42e4d5c3bf5
MD5 b5905678aff1b57cd0a7c05c75a8875c
SHA1 b978ae40026174a6f7fb459b3d4f693ad9a0dfc0
SHA512 64a707cc74613242c84da7ba239040eb5efa6e5fb44fed4523c9874423cff63fb28b180fe400e4ba1606ea6df50aa470cae1e6dc1dfcf8328b9dcc7eb3af37cc
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt39:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8n
MD5 SHA1 SHA512 SSDEEP

Submit Download

lIjhmyI.exe

Path C:\Windows\System\lIjhmyI.exe
Size 1.6MB
SHA256 fd68cc30c4697f14ca7d6d9cb02e243dcaa69137994a3f4d559ec28f014a618f
MD5 97d75dd59e08163f76c3e49b0348c519
SHA1 504e9ace8318e53970364bd7b4b51ce34b7a8a41
SHA512 413657679ebc26a4bfec8d3577aadac899c6595d9efeccb44b1028f81b7ad104c27c5fead7d88447928de5d9f6aae90d698198d60d684d1e9c6f7dd086d727f6
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt37:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8J
MD5 SHA1 SHA512 SSDEEP

Submit Download

lKFvmPf.exe

Path C:\Windows\System\lKFvmPf.exe
Size 1.6MB
SHA256 8786daa6246ad92f6a1238d1d9135f99d5f288350c6ea3a45dc8f62bb737df45
MD5 9ab6bd7ce99b958d96b641ad9ddf6872
SHA1 138830c49fc3ee8589b96cbd9dc9a643be071d59
SHA512 25fa6540d3493f75d4e4a2dcd5c3041e546e251f5561ba8e83bb3f3f5f5d21bc133401b5a6fb9529b16f2e373c6cbabaea489a44de95d8aed6058b29b65d02cd
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3p:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8v
MD5 SHA1 SHA512 SSDEEP

Submit Download

mWVJDTE.exe

Path C:\Windows\System\mWVJDTE.exe
Size 1.6MB
SHA256 15102e5a7ff4fd8f3b8ee944f57e6141c03888b18c8c4eab1017a72912b0cc7f
MD5 5bfc86155715775d98e44cab3db58bf6
SHA1 9d410f089acd0afae6ae6cfba5f45edf1778f160
SHA512 4577ab1bf138d75d8f4a65d36efe59102ec485d1d7ab5581991ba4c5b4847e8d295c212d070894220156026177216ba7ec93fc526ac68b5f117dc565251ce739
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt39:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ngTIQDh.exe

Path C:\Windows\System\ngTIQDh.exe
Size 1.6MB
SHA256 edc04ff58bcf0110800325492d6100539c13dde48d27dad4aa07f50610336669
MD5 e4bfe84388af5d417ca376bdd9b9ba6e
SHA1 05b6c0c780a8967fed8ca0371709d1c0f2050fc2
SHA512 d137f4a744ea09869a13e46c1f30971163d8686831d49fb2347e66578cc9bfbfddd83abb11335279cd370a9984b4a781819357d972557ec03359c835947e5eeb
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3h:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8v
MD5 SHA1 SHA512 SSDEEP

Submit Download

oGddGqM.exe

Path C:\Windows\System\oGddGqM.exe
Size 1.6MB
SHA256 ec1a86eab55e2cb3c0768a13f3f56a5e875d02968a58eff6f2f05fb67c1fb1bf
MD5 a140c24c0a27aaa5789640240cc140ac
SHA1 cfa7059ac87311ab11ead33e9eacaaab238eda6b
SHA512 d6db11fa08f09b52224d5fa06348979aa0d4db4a5d3f160691212760af6c967582f7f1cfd9560d5d77a183dee26c427e848ca168d730f6cb41a019c721d7c833
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3l:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8X
MD5 SHA1 SHA512 SSDEEP

Submit Download

pAKXbjA.exe

Path C:\Windows\System\pAKXbjA.exe
Size 1.6MB
SHA256 8a81532c396edfa16019f58270d4c3634d4e0c2ee41ea9737a1987071d64ea48
MD5 515ea9750985225e6bb011c03afdd383
SHA1 d5c2f45e501890368d4cffea3eee761bb28f9b2a
SHA512 c4ba1b210cbe5504ea0cca5a4e24f2aa8b9e08295baaa79e8de7feccc36dc847394f83036a0864ac3bdf17771370c7e1e3925b3b49f0b88859ead606498ab4a4
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3T:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

qmGyWmf.exe

Path C:\Windows\System\qmGyWmf.exe
Size 1.6MB
SHA256 ee8abb0543b5f846002722af751becbef1d98679ebb369f6e854a254e4ab5abe
MD5 792d3953d88381e137b83bacce4966c8
SHA1 227986c7ccad04306333531059b37e4188ab599e
SHA512 43478e49d2b8406081c0f06a1a3519f4dd8dd23521b132350568cb3f8acb09289d61b997c4a26c39570f6e66e733fca09e0c74118986760a46f6f200ada2042b
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3N:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

taMMHeg.exe

Path C:\Windows\System\taMMHeg.exe
Size 1.6MB
SHA256 4b0fb6f146276c541e01a622146d183426c398bf4d373ed165b50b50680d00bc
MD5 484cf67e91df0e7b54c5a8bf12c1d737
SHA1 ef4131b0547d62eaf2a744e002a5c628af2e2406
SHA512 b4bcd5f208035e274af0e2a2e63e2acf9b3f88371cde824de727cf424e37ccc2d01d6b446996c055fafe05552ab8d859566866bba1cd7af6e1db6d961b769f07
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3H:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8h
MD5 SHA1 SHA512 SSDEEP

Submit Download

vuTteQA.exe

Path C:\Windows\System\vuTteQA.exe
Size 1.6MB
SHA256 bea0448ffb9dfa71f4be179634e03594c40794c1087bf9af096ee03b6949fa50
MD5 d9c64b2dc5eb9041b201a1e500394347
SHA1 7faec9d4733d242c589286873a5c3101243726ab
SHA512 3840d733f12969a24a2ac029b8b4b9c5f9a91dda84095f764e24ea0481cdc7251e266a0b9b583b16b86fe28e3c2dd42e6f59c0e58dd23b927eb8bf0bc3630e4c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt3c:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm86
MD5 SHA1 SHA512 SSDEEP

Submit Download

wEEVhKI.exe

Path C:\Windows\System\wEEVhKI.exe
Size 1.6MB
SHA256 5ef2ae755a980d4f6c6c1f2520f4116129489c8b7b1af6ae277425b962d38c4a
MD5 76cb75d89f1443d462b774bd5355b780
SHA1 332e7c51dc346c578451997b18b49dd2d985c461
SHA512 6428a3ad181d6d0af28a2d04b43db6d4a5ace9e7fc5dbe8ffcb686c50add97fbda397a35897ae88912411ca14d92d1cd42bc47af47d3c813078a34e9947f9790
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszHV4a1ymtwFJdpi/Wt32:GezaTF8FcNkNdfE0pZ9oztFwIR1Mm8c
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4828-0-0x000001A781A80000-0x000001A781A90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads