xmrig | b9a3f2d00110d5b2827d23c9f060da5694c55748134e7b2cd6d5c851e185416e

Analysis

max time kernel
131s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
Size 1.6MB
Sample240614-aw2awsxfrb
SHA256 b9a3f2d00110d5b2827d23c9f060da5694c55748134e7b2cd6d5c851e185416e
MD5 9427ff53d7fe3be04fc194ff7418d230
SHA1 41826ba85b9d1069d40f710b0f243f9b7c652481
SHA512 384101a6eadb617b930a8907177259189a0455237e12cee7cb5c1c727e62a4fb3305b6061d1e35ed03fd7c5bc67f4ae945da1a73c96995c6ac00ff1ac764f7cd
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelq:GemTLkNdfE0pZaX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023419-4.dat	xmrig
behavioral2/files/0x000700000002341d-14.dat	xmrig
behavioral2/files/0x0007000000023420-22.dat	xmrig
behavioral2/files/0x0007000000023421-30.dat	xmrig
behavioral2/files/0x000700000002341f-26.dat	xmrig
behavioral2/files/0x000700000002341e-24.dat	xmrig
behavioral2/files/0x0007000000023422-34.dat	xmrig
behavioral2/files/0x0007000000023423-41.dat	xmrig
behavioral2/files/0x0007000000023426-57.dat	xmrig
behavioral2/files/0x0007000000023427-58.dat	xmrig
behavioral2/files/0x0007000000023424-62.dat	xmrig
behavioral2/files/0x0007000000023425-75.dat	xmrig
behavioral2/files/0x000700000002342a-83.dat	xmrig
behavioral2/files/0x000700000002342b-85.dat	xmrig
behavioral2/files/0x0007000000023429-81.dat	xmrig
behavioral2/files/0x0007000000023428-79.dat	xmrig
behavioral2/files/0x000800000002341a-44.dat	xmrig
behavioral2/files/0x000700000002342c-91.dat	xmrig
behavioral2/files/0x000700000002342e-99.dat	xmrig
behavioral2/files/0x0007000000023430-106.dat	xmrig
behavioral2/files/0x0007000000023432-122.dat	xmrig
behavioral2/files/0x000700000002343c-170.dat	xmrig
behavioral2/files/0x000700000002343b-164.dat	xmrig
behavioral2/files/0x000700000002343d-172.dat	xmrig
behavioral2/files/0x0007000000023435-161.dat	xmrig
behavioral2/files/0x0007000000023434-158.dat	xmrig
behavioral2/files/0x000700000002343a-157.dat	xmrig
behavioral2/files/0x0007000000023433-153.dat	xmrig
behavioral2/files/0x0007000000023439-151.dat	xmrig
behavioral2/files/0x0007000000023436-147.dat	xmrig
behavioral2/files/0x0007000000023437-146.dat	xmrig
behavioral2/files/0x0007000000023431-139.dat	xmrig
behavioral2/files/0x0007000000023438-136.dat	xmrig
behavioral2/files/0x000700000002342f-112.dat	xmrig
behavioral2/files/0x000700000002342d-95.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3444	pgAYTUd.exe
2972	WZvKuhi.exe
324	uFbsowF.exe
1348	hlQkbmH.exe
2472	vQWuynW.exe
4012	qUDrkCp.exe
628	bTLpMZz.exe
2720	tduouJC.exe
4316	wauhFvo.exe
452	CMWKCrU.exe
2868	wbpRgNZ.exe
4864	ShHdPNs.exe
1968	LEQGOgk.exe
2004	mniChTz.exe
4712	gObmtpn.exe
2228	MhSLGDl.exe
3824	WTHiMyJ.exe
2924	PMnRSlG.exe
2120	fpiupdZ.exe
2248	AqqAssN.exe
2780	qjhuDxL.exe
2300	uaCgeUk.exe
4064	vFHbjAT.exe
4188	EeglUZk.exe
4428	pcpqAeJ.exe
2296	VTzUfvm.exe
1844	QqWFpLj.exe
1396	sAhlmSB.exe
4388	huuyHmf.exe
2952	gcJsMpC.exe
1564	VsWvXnX.exe
1984	GOqZwfk.exe
3548	FYRRwYD.exe
3664	YvQtVOU.exe
2888	GeeAZfm.exe
2884	YjOXPpQ.exe
3160	FlEOMDo.exe
1704	olDQQBb.exe
1796	gOYfBAL.exe
1740	XUVqvqJ.exe
4268	UJUsaLN.exe
3816	HWunTnD.exe
1256	pGBmDZS.exe
4632	GFlmYSH.exe
1688	YtZYBCl.exe
4776	XFcfhQw.exe
4360	rKnJQuI.exe
4444	wcDKWeR.exe
4908	GFBmByv.exe
3524	kyQYQMQ.exe
3616	IjBLufn.exe
2800	pXfShIb.exe
4408	LHNrQWl.exe
3104	JRATeDG.exe
3028	tYGFExY.exe
3036	VKuGZYg.exe
1680	wtLZLbQ.exe
4800	NLBwdWD.exe
4328	zaHNlaG.exe
3116	IrTZagh.exe
3128	KGiHpyY.exe
1268	bmxWDBu.exe
3992	pKEsZIU.exe
1040	cvqNnyo.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fWMrqjz.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\pVLouHK.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\KGiHpyY.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\pHLYljs.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\sAhlmSB.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\CjCwNIq.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\EeglUZk.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\AABTGVj.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\pezYfqI.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\wWjieEy.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\cGyAqFg.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\IehXNHe.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\uLfZcLd.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\NzDnvak.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\ahaxRiR.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\sruLkWp.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\zaHNlaG.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\VjwRPNG.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\jJcfWcx.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\RSAEfYx.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\RWYmpYG.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\rWGrmMT.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\pshHAXJ.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\mXALzQr.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\nZdpZOY.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\ExlNrYF.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\rEnhoEl.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\KwyAcaa.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\aqtBQGv.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\LxeUdNe.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\jMUZNIy.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\EeSofUB.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\uwkyYiK.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\sVgyIWg.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\TGptqEa.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\YTiefhC.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\SARBpmi.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\VyEeqRb.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\oaTncuq.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\FAggNMV.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\QZbThZb.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\fIjSQKd.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\fpiupdZ.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\EnkPMqF.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\wITofXf.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\bGRpsHU.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\dGsvzgo.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\JytFLRE.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\IhSEqzQ.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\GaaNtzw.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\HCVxSFg.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\mczYGGv.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\MexatEX.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\rcuNOXa.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\psdrLNE.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\lSLdaun.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\MXXyVes.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\NtfUjqK.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\CMWKCrU.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\uSuQvlw.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\AdnXUjU.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\ImNebdW.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\cBZsoDw.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
File created	C:\Windows\System\WKgPzFs.exe	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16780	dwm.exe
Token: SeChangeNotifyPrivilege	16780	dwm.exe
Token: 33	16780	dwm.exe
Token: SeIncBasePriorityPrivilege	16780	dwm.exe
Token: SeShutdownPrivilege	16780	dwm.exe
Token: SeCreatePagefilePrivilege	16780	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 3444	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	84
PID 1208 wrote to memory of 3444	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	84
PID 1208 wrote to memory of 2972	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	85
PID 1208 wrote to memory of 2972	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	85
PID 1208 wrote to memory of 324	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	86
PID 1208 wrote to memory of 324	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	86
PID 1208 wrote to memory of 1348	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	87
PID 1208 wrote to memory of 1348	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	87
PID 1208 wrote to memory of 2472	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	88
PID 1208 wrote to memory of 2472	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	88
PID 1208 wrote to memory of 4012	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	89
PID 1208 wrote to memory of 4012	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	89
PID 1208 wrote to memory of 628	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	90
PID 1208 wrote to memory of 628	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	90
PID 1208 wrote to memory of 2720	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	91
PID 1208 wrote to memory of 2720	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	91
PID 1208 wrote to memory of 4316	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	92
PID 1208 wrote to memory of 4316	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	92
PID 1208 wrote to memory of 452	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	93
PID 1208 wrote to memory of 452	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	93
PID 1208 wrote to memory of 2868	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	94
PID 1208 wrote to memory of 2868	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	94
PID 1208 wrote to memory of 4864	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	95
PID 1208 wrote to memory of 4864	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	95
PID 1208 wrote to memory of 1968	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	96
PID 1208 wrote to memory of 1968	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	96
PID 1208 wrote to memory of 2004	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	97
PID 1208 wrote to memory of 2004	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	97
PID 1208 wrote to memory of 4712	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	98
PID 1208 wrote to memory of 4712	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	98
PID 1208 wrote to memory of 2228	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	99
PID 1208 wrote to memory of 2228	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	99
PID 1208 wrote to memory of 3824	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	100
PID 1208 wrote to memory of 3824	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	100
PID 1208 wrote to memory of 2924	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	101
PID 1208 wrote to memory of 2924	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	101
PID 1208 wrote to memory of 2120	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	102
PID 1208 wrote to memory of 2120	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	102
PID 1208 wrote to memory of 2248	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	103
PID 1208 wrote to memory of 2248	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	103
PID 1208 wrote to memory of 2780	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	104
PID 1208 wrote to memory of 2780	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	104
PID 1208 wrote to memory of 2300	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	105
PID 1208 wrote to memory of 2300	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	105
PID 1208 wrote to memory of 4064	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	106
PID 1208 wrote to memory of 4064	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	106
PID 1208 wrote to memory of 4188	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	107
PID 1208 wrote to memory of 4188	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	107
PID 1208 wrote to memory of 4428	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	108
PID 1208 wrote to memory of 4428	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	108
PID 1208 wrote to memory of 2296	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	109
PID 1208 wrote to memory of 2296	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	109
PID 1208 wrote to memory of 1844	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	110
PID 1208 wrote to memory of 1844	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	110
PID 1208 wrote to memory of 1396	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	111
PID 1208 wrote to memory of 1396	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	111
PID 1208 wrote to memory of 4388	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	112
PID 1208 wrote to memory of 4388	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	112
PID 1208 wrote to memory of 2952	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	113
PID 1208 wrote to memory of 2952	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	113
PID 1208 wrote to memory of 1564	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	114
PID 1208 wrote to memory of 1564	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	114
PID 1208 wrote to memory of 1984	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	115
PID 1208 wrote to memory of 1984	1208	9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9427ff53d7fe3be04fc194ff7418d230_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\System\pgAYTUd.exe
  C:\Windows\System\pgAYTUd.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\WZvKuhi.exe
  C:\Windows\System\WZvKuhi.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\uFbsowF.exe
  C:\Windows\System\uFbsowF.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\hlQkbmH.exe
  C:\Windows\System\hlQkbmH.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\vQWuynW.exe
  C:\Windows\System\vQWuynW.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\qUDrkCp.exe
  C:\Windows\System\qUDrkCp.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\bTLpMZz.exe
  C:\Windows\System\bTLpMZz.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\tduouJC.exe
  C:\Windows\System\tduouJC.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\wauhFvo.exe
  C:\Windows\System\wauhFvo.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\CMWKCrU.exe
  C:\Windows\System\CMWKCrU.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\wbpRgNZ.exe
  C:\Windows\System\wbpRgNZ.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\ShHdPNs.exe
  C:\Windows\System\ShHdPNs.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\LEQGOgk.exe
  C:\Windows\System\LEQGOgk.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\mniChTz.exe
  C:\Windows\System\mniChTz.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\gObmtpn.exe
  C:\Windows\System\gObmtpn.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\MhSLGDl.exe
  C:\Windows\System\MhSLGDl.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\WTHiMyJ.exe
  C:\Windows\System\WTHiMyJ.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\PMnRSlG.exe
  C:\Windows\System\PMnRSlG.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\fpiupdZ.exe
  C:\Windows\System\fpiupdZ.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\AqqAssN.exe
  C:\Windows\System\AqqAssN.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\qjhuDxL.exe
  C:\Windows\System\qjhuDxL.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\uaCgeUk.exe
  C:\Windows\System\uaCgeUk.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\vFHbjAT.exe
  C:\Windows\System\vFHbjAT.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\EeglUZk.exe
  C:\Windows\System\EeglUZk.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\pcpqAeJ.exe
  C:\Windows\System\pcpqAeJ.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\VTzUfvm.exe
  C:\Windows\System\VTzUfvm.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\QqWFpLj.exe
  C:\Windows\System\QqWFpLj.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\sAhlmSB.exe
  C:\Windows\System\sAhlmSB.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\huuyHmf.exe
  C:\Windows\System\huuyHmf.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\gcJsMpC.exe
  C:\Windows\System\gcJsMpC.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\VsWvXnX.exe
  C:\Windows\System\VsWvXnX.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\GOqZwfk.exe
  C:\Windows\System\GOqZwfk.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\FYRRwYD.exe
  C:\Windows\System\FYRRwYD.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\YvQtVOU.exe
  C:\Windows\System\YvQtVOU.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\GeeAZfm.exe
  C:\Windows\System\GeeAZfm.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\YjOXPpQ.exe
  C:\Windows\System\YjOXPpQ.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\FlEOMDo.exe
  C:\Windows\System\FlEOMDo.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\olDQQBb.exe
  C:\Windows\System\olDQQBb.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\gOYfBAL.exe
  C:\Windows\System\gOYfBAL.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\XUVqvqJ.exe
  C:\Windows\System\XUVqvqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\UJUsaLN.exe
  C:\Windows\System\UJUsaLN.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\HWunTnD.exe
  C:\Windows\System\HWunTnD.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\pGBmDZS.exe
  C:\Windows\System\pGBmDZS.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\GFlmYSH.exe
  C:\Windows\System\GFlmYSH.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\YtZYBCl.exe
  C:\Windows\System\YtZYBCl.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\XFcfhQw.exe
  C:\Windows\System\XFcfhQw.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\rKnJQuI.exe
  C:\Windows\System\rKnJQuI.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\wcDKWeR.exe
  C:\Windows\System\wcDKWeR.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\GFBmByv.exe
  C:\Windows\System\GFBmByv.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\kyQYQMQ.exe
  C:\Windows\System\kyQYQMQ.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\IjBLufn.exe
  C:\Windows\System\IjBLufn.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\pXfShIb.exe
  C:\Windows\System\pXfShIb.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\LHNrQWl.exe
  C:\Windows\System\LHNrQWl.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\JRATeDG.exe
  C:\Windows\System\JRATeDG.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\tYGFExY.exe
  C:\Windows\System\tYGFExY.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\VKuGZYg.exe
  C:\Windows\System\VKuGZYg.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\wtLZLbQ.exe
  C:\Windows\System\wtLZLbQ.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\NLBwdWD.exe
  C:\Windows\System\NLBwdWD.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\zaHNlaG.exe
  C:\Windows\System\zaHNlaG.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\IrTZagh.exe
  C:\Windows\System\IrTZagh.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\KGiHpyY.exe
  C:\Windows\System\KGiHpyY.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\bmxWDBu.exe
  C:\Windows\System\bmxWDBu.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\pKEsZIU.exe
  C:\Windows\System\pKEsZIU.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\cvqNnyo.exe
  C:\Windows\System\cvqNnyo.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\vsdIeul.exe
  C:\Windows\System\vsdIeul.exe
  2⤵
  PID:912
- C:\Windows\System\mjBjQBT.exe
  C:\Windows\System\mjBjQBT.exe
  2⤵
  PID:1932
- C:\Windows\System\bgnrljQ.exe
  C:\Windows\System\bgnrljQ.exe
  2⤵
  PID:2392
- C:\Windows\System\aDcXlms.exe
  C:\Windows\System\aDcXlms.exe
  2⤵
  PID:2944
- C:\Windows\System\noUxhhD.exe
  C:\Windows\System\noUxhhD.exe
  2⤵
  PID:1664
- C:\Windows\System\EnkPMqF.exe
  C:\Windows\System\EnkPMqF.exe
  2⤵
  PID:4176
- C:\Windows\System\aQYSyzi.exe
  C:\Windows\System\aQYSyzi.exe
  2⤵
  PID:1084
- C:\Windows\System\YgZtiPg.exe
  C:\Windows\System\YgZtiPg.exe
  2⤵
  PID:3740
- C:\Windows\System\zmLHAKe.exe
  C:\Windows\System\zmLHAKe.exe
  2⤵
  PID:1484
- C:\Windows\System\mzevEGQ.exe
  C:\Windows\System\mzevEGQ.exe
  2⤵
  PID:1216
- C:\Windows\System\CdCVUOP.exe
  C:\Windows\System\CdCVUOP.exe
  2⤵
  PID:4456
- C:\Windows\System\wxzQxAX.exe
  C:\Windows\System\wxzQxAX.exe
  2⤵
  PID:1480
- C:\Windows\System\xvSMPej.exe
  C:\Windows\System\xvSMPej.exe
  2⤵
  PID:5104
- C:\Windows\System\sZePqrc.exe
  C:\Windows\System\sZePqrc.exe
  2⤵
  PID:4672
- C:\Windows\System\vBWgFvP.exe
  C:\Windows\System\vBWgFvP.exe
  2⤵
  PID:4640
- C:\Windows\System\ZBsmTsU.exe
  C:\Windows\System\ZBsmTsU.exe
  2⤵
  PID:3144
- C:\Windows\System\LNRCBSS.exe
  C:\Windows\System\LNRCBSS.exe
  2⤵
  PID:1264
- C:\Windows\System\pshHAXJ.exe
  C:\Windows\System\pshHAXJ.exe
  2⤵
  PID:3008
- C:\Windows\System\gRooABd.exe
  C:\Windows\System\gRooABd.exe
  2⤵
  PID:2468
- C:\Windows\System\mUREFIt.exe
  C:\Windows\System\mUREFIt.exe
  2⤵
  PID:3536
- C:\Windows\System\OtFgVNt.exe
  C:\Windows\System\OtFgVNt.exe
  2⤵
  PID:3568
- C:\Windows\System\wsxPxiB.exe
  C:\Windows\System\wsxPxiB.exe
  2⤵
  PID:3624
- C:\Windows\System\uSuQvlw.exe
  C:\Windows\System\uSuQvlw.exe
  2⤵
  PID:2604
- C:\Windows\System\EkDSESd.exe
  C:\Windows\System\EkDSESd.exe
  2⤵
  PID:4900
- C:\Windows\System\JHEWmJF.exe
  C:\Windows\System\JHEWmJF.exe
  2⤵
  PID:1372
- C:\Windows\System\oHcSSbd.exe
  C:\Windows\System\oHcSSbd.exe
  2⤵
  PID:716
- C:\Windows\System\EQweukQ.exe
  C:\Windows\System\EQweukQ.exe
  2⤵
  PID:1976
- C:\Windows\System\PozVvhh.exe
  C:\Windows\System\PozVvhh.exe
  2⤵
  PID:2280
- C:\Windows\System\pHLYljs.exe
  C:\Windows\System\pHLYljs.exe
  2⤵
  PID:1428
- C:\Windows\System\LJMOPWQ.exe
  C:\Windows\System\LJMOPWQ.exe
  2⤵
  PID:4976
- C:\Windows\System\DiuAZXv.exe
  C:\Windows\System\DiuAZXv.exe
  2⤵
  PID:1436
- C:\Windows\System\PMnrUnR.exe
  C:\Windows\System\PMnrUnR.exe
  2⤵
  PID:2724
- C:\Windows\System\MCiqRJa.exe
  C:\Windows\System\MCiqRJa.exe
  2⤵
  PID:5144
- C:\Windows\System\hUJZGuw.exe
  C:\Windows\System\hUJZGuw.exe
  2⤵
  PID:5172
- C:\Windows\System\hgPqsac.exe
  C:\Windows\System\hgPqsac.exe
  2⤵
  PID:5204
- C:\Windows\System\qAqXTYY.exe
  C:\Windows\System\qAqXTYY.exe
  2⤵
  PID:5228
- C:\Windows\System\YbxpIHe.exe
  C:\Windows\System\YbxpIHe.exe
  2⤵
  PID:5272
- C:\Windows\System\WbJESsS.exe
  C:\Windows\System\WbJESsS.exe
  2⤵
  PID:5312
- C:\Windows\System\CPrjuTn.exe
  C:\Windows\System\CPrjuTn.exe
  2⤵
  PID:5328
- C:\Windows\System\jbCZecz.exe
  C:\Windows\System\jbCZecz.exe
  2⤵
  PID:5344
- C:\Windows\System\yBkSdsg.exe
  C:\Windows\System\yBkSdsg.exe
  2⤵
  PID:5360
- C:\Windows\System\DrjPJRs.exe
  C:\Windows\System\DrjPJRs.exe
  2⤵
  PID:5384
- C:\Windows\System\mRhiAtx.exe
  C:\Windows\System\mRhiAtx.exe
  2⤵
  PID:5420
- C:\Windows\System\LZgIujV.exe
  C:\Windows\System\LZgIujV.exe
  2⤵
  PID:5452
- C:\Windows\System\sCJoBcy.exe
  C:\Windows\System\sCJoBcy.exe
  2⤵
  PID:5484
- C:\Windows\System\AcjzJWx.exe
  C:\Windows\System\AcjzJWx.exe
  2⤵
  PID:5516
- C:\Windows\System\OXLHBoK.exe
  C:\Windows\System\OXLHBoK.exe
  2⤵
  PID:5556
- C:\Windows\System\wyliEOt.exe
  C:\Windows\System\wyliEOt.exe
  2⤵
  PID:5572
- C:\Windows\System\UBwDrlS.exe
  C:\Windows\System\UBwDrlS.exe
  2⤵
  PID:5604
- C:\Windows\System\ACoDdDS.exe
  C:\Windows\System\ACoDdDS.exe
  2⤵
  PID:5636
- C:\Windows\System\aKwCUoi.exe
  C:\Windows\System\aKwCUoi.exe
  2⤵
  PID:5660
- C:\Windows\System\AdnXUjU.exe
  C:\Windows\System\AdnXUjU.exe
  2⤵
  PID:5696
- C:\Windows\System\zZapTLU.exe
  C:\Windows\System\zZapTLU.exe
  2⤵
  PID:5732
- C:\Windows\System\HtkrSRF.exe
  C:\Windows\System\HtkrSRF.exe
  2⤵
  PID:5756
- C:\Windows\System\LZkCQYR.exe
  C:\Windows\System\LZkCQYR.exe
  2⤵
  PID:5780
- C:\Windows\System\bPHZYNA.exe
  C:\Windows\System\bPHZYNA.exe
  2⤵
  PID:5808
- C:\Windows\System\PQibtnj.exe
  C:\Windows\System\PQibtnj.exe
  2⤵
  PID:5832
- C:\Windows\System\UTWJpAM.exe
  C:\Windows\System\UTWJpAM.exe
  2⤵
  PID:5852
- C:\Windows\System\niFmUNY.exe
  C:\Windows\System\niFmUNY.exe
  2⤵
  PID:5876
- C:\Windows\System\RSAEfYx.exe
  C:\Windows\System\RSAEfYx.exe
  2⤵
  PID:5912
- C:\Windows\System\AfBTyQj.exe
  C:\Windows\System\AfBTyQj.exe
  2⤵
  PID:5948
- C:\Windows\System\UgunGPV.exe
  C:\Windows\System\UgunGPV.exe
  2⤵
  PID:5964
- C:\Windows\System\LqdKpIZ.exe
  C:\Windows\System\LqdKpIZ.exe
  2⤵
  PID:5988
- C:\Windows\System\pOzgQQO.exe
  C:\Windows\System\pOzgQQO.exe
  2⤵
  PID:6024
- C:\Windows\System\udUDsGK.exe
  C:\Windows\System\udUDsGK.exe
  2⤵
  PID:6052
- C:\Windows\System\VjwRPNG.exe
  C:\Windows\System\VjwRPNG.exe
  2⤵
  PID:6088
- C:\Windows\System\kNPLbfJ.exe
  C:\Windows\System\kNPLbfJ.exe
  2⤵
  PID:6104
- C:\Windows\System\IfpYOcy.exe
  C:\Windows\System\IfpYOcy.exe
  2⤵
  PID:3220
- C:\Windows\System\uuxQhmK.exe
  C:\Windows\System\uuxQhmK.exe
  2⤵
  PID:5156
- C:\Windows\System\nTbwEYq.exe
  C:\Windows\System\nTbwEYq.exe
  2⤵
  PID:5220
- C:\Windows\System\LaWBqDy.exe
  C:\Windows\System\LaWBqDy.exe
  2⤵
  PID:5296
- C:\Windows\System\xtcubRZ.exe
  C:\Windows\System\xtcubRZ.exe
  2⤵
  PID:5320
- C:\Windows\System\EeSofUB.exe
  C:\Windows\System\EeSofUB.exe
  2⤵
  PID:5404
- C:\Windows\System\GiTbnHe.exe
  C:\Windows\System\GiTbnHe.exe
  2⤵
  PID:5508
- C:\Windows\System\uuDgOkn.exe
  C:\Windows\System\uuDgOkn.exe
  2⤵
  PID:5540
- C:\Windows\System\jdghKqq.exe
  C:\Windows\System\jdghKqq.exe
  2⤵
  PID:5624
- C:\Windows\System\vMfKepz.exe
  C:\Windows\System\vMfKepz.exe
  2⤵
  PID:5652
- C:\Windows\System\kwdaZqC.exe
  C:\Windows\System\kwdaZqC.exe
  2⤵
  PID:5684
- C:\Windows\System\etbXwfm.exe
  C:\Windows\System\etbXwfm.exe
  2⤵
  PID:5772
- C:\Windows\System\QRuBpmh.exe
  C:\Windows\System\QRuBpmh.exe
  2⤵
  PID:5816
- C:\Windows\System\qcWcpAL.exe
  C:\Windows\System\qcWcpAL.exe
  2⤵
  PID:5844
- C:\Windows\System\OfowUPj.exe
  C:\Windows\System\OfowUPj.exe
  2⤵
  PID:5904
- C:\Windows\System\ALGJFOW.exe
  C:\Windows\System\ALGJFOW.exe
  2⤵
  PID:5976
- C:\Windows\System\ioqveKl.exe
  C:\Windows\System\ioqveKl.exe
  2⤵
  PID:6060
- C:\Windows\System\GtuWRxl.exe
  C:\Windows\System\GtuWRxl.exe
  2⤵
  PID:6124
- C:\Windows\System\GiNjijm.exe
  C:\Windows\System\GiNjijm.exe
  2⤵
  PID:5004
- C:\Windows\System\rvnDDlh.exe
  C:\Windows\System\rvnDDlh.exe
  2⤵
  PID:5380
- C:\Windows\System\jsafWjk.exe
  C:\Windows\System\jsafWjk.exe
  2⤵
  PID:5536
- C:\Windows\System\yOybkmM.exe
  C:\Windows\System\yOybkmM.exe
  2⤵
  PID:5776
- C:\Windows\System\rxOrODD.exe
  C:\Windows\System\rxOrODD.exe
  2⤵
  PID:5868
- C:\Windows\System\rtqWdiD.exe
  C:\Windows\System\rtqWdiD.exe
  2⤵
  PID:5824
- C:\Windows\System\GPbSYCN.exe
  C:\Windows\System\GPbSYCN.exe
  2⤵
  PID:6100
- C:\Windows\System\RqFqctn.exe
  C:\Windows\System\RqFqctn.exe
  2⤵
  PID:5356
- C:\Windows\System\KfAVxtr.exe
  C:\Windows\System\KfAVxtr.exe
  2⤵
  PID:5796
- C:\Windows\System\WTxCOii.exe
  C:\Windows\System\WTxCOii.exe
  2⤵
  PID:5464
- C:\Windows\System\zxJxKfz.exe
  C:\Windows\System\zxJxKfz.exe
  2⤵
  PID:6076
- C:\Windows\System\rVOFJAZ.exe
  C:\Windows\System\rVOFJAZ.exe
  2⤵
  PID:6176
- C:\Windows\System\KwyAcaa.exe
  C:\Windows\System\KwyAcaa.exe
  2⤵
  PID:6196
- C:\Windows\System\zFJLhCM.exe
  C:\Windows\System\zFJLhCM.exe
  2⤵
  PID:6228
- C:\Windows\System\gqBcGdT.exe
  C:\Windows\System\gqBcGdT.exe
  2⤵
  PID:6248
- C:\Windows\System\nSbcRnK.exe
  C:\Windows\System\nSbcRnK.exe
  2⤵
  PID:6276
- C:\Windows\System\uBNKzeh.exe
  C:\Windows\System\uBNKzeh.exe
  2⤵
  PID:6308
- C:\Windows\System\lpBUjMv.exe
  C:\Windows\System\lpBUjMv.exe
  2⤵
  PID:6324
- C:\Windows\System\aPHIJXL.exe
  C:\Windows\System\aPHIJXL.exe
  2⤵
  PID:6352
- C:\Windows\System\FCCJjfO.exe
  C:\Windows\System\FCCJjfO.exe
  2⤵
  PID:6380
- C:\Windows\System\TXnHRof.exe
  C:\Windows\System\TXnHRof.exe
  2⤵
  PID:6404
- C:\Windows\System\uMmJmJB.exe
  C:\Windows\System\uMmJmJB.exe
  2⤵
  PID:6440
- C:\Windows\System\sqwDCBE.exe
  C:\Windows\System\sqwDCBE.exe
  2⤵
  PID:6488
- C:\Windows\System\bDwACEB.exe
  C:\Windows\System\bDwACEB.exe
  2⤵
  PID:6516
- C:\Windows\System\CPwgsWH.exe
  C:\Windows\System\CPwgsWH.exe
  2⤵
  PID:6544
- C:\Windows\System\CdFjWff.exe
  C:\Windows\System\CdFjWff.exe
  2⤵
  PID:6560
- C:\Windows\System\TWzcPib.exe
  C:\Windows\System\TWzcPib.exe
  2⤵
  PID:6576
- C:\Windows\System\gWWJJXl.exe
  C:\Windows\System\gWWJJXl.exe
  2⤵
  PID:6604
- C:\Windows\System\qUVaDqv.exe
  C:\Windows\System\qUVaDqv.exe
  2⤵
  PID:6644
- C:\Windows\System\UEgBHhH.exe
  C:\Windows\System\UEgBHhH.exe
  2⤵
  PID:6664
- C:\Windows\System\ImNebdW.exe
  C:\Windows\System\ImNebdW.exe
  2⤵
  PID:6700
- C:\Windows\System\qbqnvuh.exe
  C:\Windows\System\qbqnvuh.exe
  2⤵
  PID:6740
- C:\Windows\System\KiVMBFM.exe
  C:\Windows\System\KiVMBFM.exe
  2⤵
  PID:6760
- C:\Windows\System\SSkTTNF.exe
  C:\Windows\System\SSkTTNF.exe
  2⤵
  PID:6796
- C:\Windows\System\nDIETvK.exe
  C:\Windows\System\nDIETvK.exe
  2⤵
  PID:6824
- C:\Windows\System\SQSvSSv.exe
  C:\Windows\System\SQSvSSv.exe
  2⤵
  PID:6852
- C:\Windows\System\iPImijz.exe
  C:\Windows\System\iPImijz.exe
  2⤵
  PID:6892
- C:\Windows\System\KQzOvKF.exe
  C:\Windows\System\KQzOvKF.exe
  2⤵
  PID:6912
- C:\Windows\System\umwnumF.exe
  C:\Windows\System\umwnumF.exe
  2⤵
  PID:6928
- C:\Windows\System\xGtvnqx.exe
  C:\Windows\System\xGtvnqx.exe
  2⤵
  PID:6948
- C:\Windows\System\KjWJkzr.exe
  C:\Windows\System\KjWJkzr.exe
  2⤵
  PID:6968
- C:\Windows\System\aqtBQGv.exe
  C:\Windows\System\aqtBQGv.exe
  2⤵
  PID:6992
- C:\Windows\System\ZQcdufG.exe
  C:\Windows\System\ZQcdufG.exe
  2⤵
  PID:7028
- C:\Windows\System\XWNKOQX.exe
  C:\Windows\System\XWNKOQX.exe
  2⤵
  PID:7056
- C:\Windows\System\XOLObiD.exe
  C:\Windows\System\XOLObiD.exe
  2⤵
  PID:7084
- C:\Windows\System\TOueqwR.exe
  C:\Windows\System\TOueqwR.exe
  2⤵
  PID:7116
- C:\Windows\System\vipHOAw.exe
  C:\Windows\System\vipHOAw.exe
  2⤵
  PID:7140
- C:\Windows\System\DbaCLBr.exe
  C:\Windows\System\DbaCLBr.exe
  2⤵
  PID:5688
- C:\Windows\System\rEEjXBn.exe
  C:\Windows\System\rEEjXBn.exe
  2⤵
  PID:6184
- C:\Windows\System\AtrdCGy.exe
  C:\Windows\System\AtrdCGy.exe
  2⤵
  PID:6284
- C:\Windows\System\dZvytUY.exe
  C:\Windows\System\dZvytUY.exe
  2⤵
  PID:6344
- C:\Windows\System\KXwKZFA.exe
  C:\Windows\System\KXwKZFA.exe
  2⤵
  PID:6452
- C:\Windows\System\dDDDPob.exe
  C:\Windows\System\dDDDPob.exe
  2⤵
  PID:6456
- C:\Windows\System\GGEglGM.exe
  C:\Windows\System\GGEglGM.exe
  2⤵
  PID:6504
- C:\Windows\System\nfkbXuF.exe
  C:\Windows\System\nfkbXuF.exe
  2⤵
  PID:6600
- C:\Windows\System\IzBwVot.exe
  C:\Windows\System\IzBwVot.exe
  2⤵
  PID:6592
- C:\Windows\System\AcBCAkY.exe
  C:\Windows\System\AcBCAkY.exe
  2⤵
  PID:6680
- C:\Windows\System\jtazDKK.exe
  C:\Windows\System\jtazDKK.exe
  2⤵
  PID:6728
- C:\Windows\System\vaFMRBk.exe
  C:\Windows\System\vaFMRBk.exe
  2⤵
  PID:6836
- C:\Windows\System\STonYSY.exe
  C:\Windows\System\STonYSY.exe
  2⤵
  PID:6900
- C:\Windows\System\mIHZAGr.exe
  C:\Windows\System\mIHZAGr.exe
  2⤵
  PID:6960
- C:\Windows\System\zcHePEC.exe
  C:\Windows\System\zcHePEC.exe
  2⤵
  PID:7004
- C:\Windows\System\OsuqOoI.exe
  C:\Windows\System\OsuqOoI.exe
  2⤵
  PID:7080
- C:\Windows\System\YkGXqKM.exe
  C:\Windows\System\YkGXqKM.exe
  2⤵
  PID:6152
- C:\Windows\System\CRHaTCb.exe
  C:\Windows\System\CRHaTCb.exe
  2⤵
  PID:6296
- C:\Windows\System\wMTvRfK.exe
  C:\Windows\System\wMTvRfK.exe
  2⤵
  PID:6368
- C:\Windows\System\lnNvMpx.exe
  C:\Windows\System\lnNvMpx.exe
  2⤵
  PID:6588
- C:\Windows\System\YSuVsHo.exe
  C:\Windows\System\YSuVsHo.exe
  2⤵
  PID:6620
- C:\Windows\System\ktPEwEP.exe
  C:\Windows\System\ktPEwEP.exe
  2⤵
  PID:6808
- C:\Windows\System\GJcaVEV.exe
  C:\Windows\System\GJcaVEV.exe
  2⤵
  PID:7016
- C:\Windows\System\yUtZvSV.exe
  C:\Windows\System\yUtZvSV.exe
  2⤵
  PID:7092
- C:\Windows\System\MtaMwDw.exe
  C:\Windows\System\MtaMwDw.exe
  2⤵
  PID:7100
- C:\Windows\System\HWfKCuu.exe
  C:\Windows\System\HWfKCuu.exe
  2⤵
  PID:6756
- C:\Windows\System\tCmeKQq.exe
  C:\Windows\System\tCmeKQq.exe
  2⤵
  PID:6988
- C:\Windows\System\WkWDhgE.exe
  C:\Windows\System\WkWDhgE.exe
  2⤵
  PID:7176
- C:\Windows\System\sVgyIWg.exe
  C:\Windows\System\sVgyIWg.exe
  2⤵
  PID:7216
- C:\Windows\System\qmTTGnm.exe
  C:\Windows\System\qmTTGnm.exe
  2⤵
  PID:7240
- C:\Windows\System\sILIDXv.exe
  C:\Windows\System\sILIDXv.exe
  2⤵
  PID:7268
- C:\Windows\System\wYqbDJj.exe
  C:\Windows\System\wYqbDJj.exe
  2⤵
  PID:7292
- C:\Windows\System\EhgSXQw.exe
  C:\Windows\System\EhgSXQw.exe
  2⤵
  PID:7316
- C:\Windows\System\fxrakSQ.exe
  C:\Windows\System\fxrakSQ.exe
  2⤵
  PID:7348
- C:\Windows\System\gIZLmUn.exe
  C:\Windows\System\gIZLmUn.exe
  2⤵
  PID:7376
- C:\Windows\System\QTcGqyY.exe
  C:\Windows\System\QTcGqyY.exe
  2⤵
  PID:7392
- C:\Windows\System\ZLjiJFN.exe
  C:\Windows\System\ZLjiJFN.exe
  2⤵
  PID:7424
- C:\Windows\System\BVoXdnt.exe
  C:\Windows\System\BVoXdnt.exe
  2⤵
  PID:7440
- C:\Windows\System\ppcIVVw.exe
  C:\Windows\System\ppcIVVw.exe
  2⤵
  PID:7460
- C:\Windows\System\PbvNiHr.exe
  C:\Windows\System\PbvNiHr.exe
  2⤵
  PID:7488
- C:\Windows\System\mWIfgHf.exe
  C:\Windows\System\mWIfgHf.exe
  2⤵
  PID:7516
- C:\Windows\System\eXMgyxB.exe
  C:\Windows\System\eXMgyxB.exe
  2⤵
  PID:7548
- C:\Windows\System\QcGYeJx.exe
  C:\Windows\System\QcGYeJx.exe
  2⤵
  PID:7576
- C:\Windows\System\pRWPXjL.exe
  C:\Windows\System\pRWPXjL.exe
  2⤵
  PID:7608
- C:\Windows\System\ggNVuwQ.exe
  C:\Windows\System\ggNVuwQ.exe
  2⤵
  PID:7636
- C:\Windows\System\AReBGnK.exe
  C:\Windows\System\AReBGnK.exe
  2⤵
  PID:7660
- C:\Windows\System\JAgoHjx.exe
  C:\Windows\System\JAgoHjx.exe
  2⤵
  PID:7684
- C:\Windows\System\xVdjxyY.exe
  C:\Windows\System\xVdjxyY.exe
  2⤵
  PID:7708
- C:\Windows\System\MDGoEZx.exe
  C:\Windows\System\MDGoEZx.exe
  2⤵
  PID:7736
- C:\Windows\System\mXALzQr.exe
  C:\Windows\System\mXALzQr.exe
  2⤵
  PID:7768
- C:\Windows\System\eILfxZK.exe
  C:\Windows\System\eILfxZK.exe
  2⤵
  PID:7800
- C:\Windows\System\HNNqEFy.exe
  C:\Windows\System\HNNqEFy.exe
  2⤵
  PID:7836
- C:\Windows\System\bRGJiYj.exe
  C:\Windows\System\bRGJiYj.exe
  2⤵
  PID:7864
- C:\Windows\System\rBZjEvY.exe
  C:\Windows\System\rBZjEvY.exe
  2⤵
  PID:7900
- C:\Windows\System\HAJyoSL.exe
  C:\Windows\System\HAJyoSL.exe
  2⤵
  PID:7928
- C:\Windows\System\FXJNRjJ.exe
  C:\Windows\System\FXJNRjJ.exe
  2⤵
  PID:7956
- C:\Windows\System\ZblOmFV.exe
  C:\Windows\System\ZblOmFV.exe
  2⤵
  PID:7992
- C:\Windows\System\OSMghyK.exe
  C:\Windows\System\OSMghyK.exe
  2⤵
  PID:8020
- C:\Windows\System\bvrGJPA.exe
  C:\Windows\System\bvrGJPA.exe
  2⤵
  PID:8064
- C:\Windows\System\MdGXiWb.exe
  C:\Windows\System\MdGXiWb.exe
  2⤵
  PID:8092
- C:\Windows\System\oQIwmRU.exe
  C:\Windows\System\oQIwmRU.exe
  2⤵
  PID:8112
- C:\Windows\System\FXyfNzz.exe
  C:\Windows\System\FXyfNzz.exe
  2⤵
  PID:8132
- C:\Windows\System\WlCRHVy.exe
  C:\Windows\System\WlCRHVy.exe
  2⤵
  PID:8160
- C:\Windows\System\fHHnCPO.exe
  C:\Windows\System\fHHnCPO.exe
  2⤵
  PID:8180
- C:\Windows\System\AXsUJIy.exe
  C:\Windows\System\AXsUJIy.exe
  2⤵
  PID:6816
- C:\Windows\System\pyfXBMI.exe
  C:\Windows\System\pyfXBMI.exe
  2⤵
  PID:7236
- C:\Windows\System\yEenhoe.exe
  C:\Windows\System\yEenhoe.exe
  2⤵
  PID:7308
- C:\Windows\System\hsWeZYE.exe
  C:\Windows\System\hsWeZYE.exe
  2⤵
  PID:7388
- C:\Windows\System\hdnaGwu.exe
  C:\Windows\System\hdnaGwu.exe
  2⤵
  PID:7304
- C:\Windows\System\rCwmISV.exe
  C:\Windows\System\rCwmISV.exe
  2⤵
  PID:7480
- C:\Windows\System\cxpfMhI.exe
  C:\Windows\System\cxpfMhI.exe
  2⤵
  PID:7532
- C:\Windows\System\gUmjSFM.exe
  C:\Windows\System\gUmjSFM.exe
  2⤵
  PID:7620
- C:\Windows\System\kizJeoy.exe
  C:\Windows\System\kizJeoy.exe
  2⤵
  PID:7564
- C:\Windows\System\iAcAphK.exe
  C:\Windows\System\iAcAphK.exe
  2⤵
  PID:7780
- C:\Windows\System\RWYmpYG.exe
  C:\Windows\System\RWYmpYG.exe
  2⤵
  PID:7824
- C:\Windows\System\QjvyGVB.exe
  C:\Windows\System\QjvyGVB.exe
  2⤵
  PID:7880
- C:\Windows\System\STVEaBB.exe
  C:\Windows\System\STVEaBB.exe
  2⤵
  PID:8004
- C:\Windows\System\lpeiqvl.exe
  C:\Windows\System\lpeiqvl.exe
  2⤵
  PID:7952
- C:\Windows\System\xcxvBek.exe
  C:\Windows\System\xcxvBek.exe
  2⤵
  PID:8044
- C:\Windows\System\IJTgeLE.exe
  C:\Windows\System\IJTgeLE.exe
  2⤵
  PID:8148
- C:\Windows\System\OdjIPzB.exe
  C:\Windows\System\OdjIPzB.exe
  2⤵
  PID:8172
- C:\Windows\System\iBAebZY.exe
  C:\Windows\System\iBAebZY.exe
  2⤵
  PID:6512
- C:\Windows\System\nnkKHFb.exe
  C:\Windows\System\nnkKHFb.exe
  2⤵
  PID:7228
- C:\Windows\System\OowjYEl.exe
  C:\Windows\System\OowjYEl.exe
  2⤵
  PID:7432
- C:\Windows\System\jDMVMpY.exe
  C:\Windows\System\jDMVMpY.exe
  2⤵
  PID:7628
- C:\Windows\System\xRFsuOp.exe
  C:\Windows\System\xRFsuOp.exe
  2⤵
  PID:7936
- C:\Windows\System\jDbefjE.exe
  C:\Windows\System\jDbefjE.exe
  2⤵
  PID:8100
- C:\Windows\System\kJOVBEN.exe
  C:\Windows\System\kJOVBEN.exe
  2⤵
  PID:7704
- C:\Windows\System\qecVxmH.exe
  C:\Windows\System\qecVxmH.exe
  2⤵
  PID:8156
- C:\Windows\System\VmQEnuR.exe
  C:\Windows\System\VmQEnuR.exe
  2⤵
  PID:8016
- C:\Windows\System\XVhYaUi.exe
  C:\Windows\System\XVhYaUi.exe
  2⤵
  PID:8196
- C:\Windows\System\FCDsZCz.exe
  C:\Windows\System\FCDsZCz.exe
  2⤵
  PID:8216
- C:\Windows\System\zJEUOKP.exe
  C:\Windows\System\zJEUOKP.exe
  2⤵
  PID:8244
- C:\Windows\System\MLkhCpV.exe
  C:\Windows\System\MLkhCpV.exe
  2⤵
  PID:8264
- C:\Windows\System\giNgOYf.exe
  C:\Windows\System\giNgOYf.exe
  2⤵
  PID:8296
- C:\Windows\System\lzJcwjD.exe
  C:\Windows\System\lzJcwjD.exe
  2⤵
  PID:8324
- C:\Windows\System\cGyAqFg.exe
  C:\Windows\System\cGyAqFg.exe
  2⤵
  PID:8348
- C:\Windows\System\lcjrTln.exe
  C:\Windows\System\lcjrTln.exe
  2⤵
  PID:8384
- C:\Windows\System\VUDwNzv.exe
  C:\Windows\System\VUDwNzv.exe
  2⤵
  PID:8408
- C:\Windows\System\BtxsYqU.exe
  C:\Windows\System\BtxsYqU.exe
  2⤵
  PID:8440
- C:\Windows\System\nZdpZOY.exe
  C:\Windows\System\nZdpZOY.exe
  2⤵
  PID:8464
- C:\Windows\System\PGxaLrI.exe
  C:\Windows\System\PGxaLrI.exe
  2⤵
  PID:8492
- C:\Windows\System\vRtbOGd.exe
  C:\Windows\System\vRtbOGd.exe
  2⤵
  PID:8512
- C:\Windows\System\fWMrqjz.exe
  C:\Windows\System\fWMrqjz.exe
  2⤵
  PID:8536
- C:\Windows\System\wToGMbi.exe
  C:\Windows\System\wToGMbi.exe
  2⤵
  PID:8552
- C:\Windows\System\astAXjr.exe
  C:\Windows\System\astAXjr.exe
  2⤵
  PID:8568
- C:\Windows\System\CfsDuKf.exe
  C:\Windows\System\CfsDuKf.exe
  2⤵
  PID:8596
- C:\Windows\System\SfUBQhm.exe
  C:\Windows\System\SfUBQhm.exe
  2⤵
  PID:8628
- C:\Windows\System\xaHzhDj.exe
  C:\Windows\System\xaHzhDj.exe
  2⤵
  PID:8660
- C:\Windows\System\wITofXf.exe
  C:\Windows\System\wITofXf.exe
  2⤵
  PID:8696
- C:\Windows\System\ZPMGhBC.exe
  C:\Windows\System\ZPMGhBC.exe
  2⤵
  PID:8724
- C:\Windows\System\nwnZpRq.exe
  C:\Windows\System\nwnZpRq.exe
  2⤵
  PID:8756
- C:\Windows\System\WBTczgf.exe
  C:\Windows\System\WBTczgf.exe
  2⤵
  PID:8792
- C:\Windows\System\LxeUdNe.exe
  C:\Windows\System\LxeUdNe.exe
  2⤵
  PID:8820
- C:\Windows\System\jnzkPDj.exe
  C:\Windows\System\jnzkPDj.exe
  2⤵
  PID:8840
- C:\Windows\System\aWmDXFp.exe
  C:\Windows\System\aWmDXFp.exe
  2⤵
  PID:8876
- C:\Windows\System\dqnwSkr.exe
  C:\Windows\System\dqnwSkr.exe
  2⤵
  PID:8900
- C:\Windows\System\LhvjjHH.exe
  C:\Windows\System\LhvjjHH.exe
  2⤵
  PID:8924
- C:\Windows\System\QggyqMs.exe
  C:\Windows\System\QggyqMs.exe
  2⤵
  PID:8952
- C:\Windows\System\BNQgrjd.exe
  C:\Windows\System\BNQgrjd.exe
  2⤵
  PID:8984
- C:\Windows\System\NXNRhYY.exe
  C:\Windows\System\NXNRhYY.exe
  2⤵
  PID:9012
- C:\Windows\System\aSkVNIB.exe
  C:\Windows\System\aSkVNIB.exe
  2⤵
  PID:9040
- C:\Windows\System\pVLouHK.exe
  C:\Windows\System\pVLouHK.exe
  2⤵
  PID:9072
- C:\Windows\System\mczYGGv.exe
  C:\Windows\System\mczYGGv.exe
  2⤵
  PID:9104
- C:\Windows\System\HqlLetJ.exe
  C:\Windows\System\HqlLetJ.exe
  2⤵
  PID:9140
- C:\Windows\System\psdrLNE.exe
  C:\Windows\System\psdrLNE.exe
  2⤵
  PID:9164
- C:\Windows\System\vSOvVqa.exe
  C:\Windows\System\vSOvVqa.exe
  2⤵
  PID:9188
- C:\Windows\System\NIvIIJs.exe
  C:\Windows\System\NIvIIJs.exe
  2⤵
  PID:9208
- C:\Windows\System\IVdKhcP.exe
  C:\Windows\System\IVdKhcP.exe
  2⤵
  PID:8228
- C:\Windows\System\LscdqGS.exe
  C:\Windows\System\LscdqGS.exe
  2⤵
  PID:8280
- C:\Windows\System\OQPuDEy.exe
  C:\Windows\System\OQPuDEy.exe
  2⤵
  PID:8368
- C:\Windows\System\MexatEX.exe
  C:\Windows\System\MexatEX.exe
  2⤵
  PID:8448
- C:\Windows\System\VvRXaGR.exe
  C:\Windows\System\VvRXaGR.exe
  2⤵
  PID:8484
- C:\Windows\System\MIJtTQu.exe
  C:\Windows\System\MIJtTQu.exe
  2⤵
  PID:8544
- C:\Windows\System\eqDBFtb.exe
  C:\Windows\System\eqDBFtb.exe
  2⤵
  PID:8584
- C:\Windows\System\zHCtBWD.exe
  C:\Windows\System\zHCtBWD.exe
  2⤵
  PID:8608
- C:\Windows\System\InESENB.exe
  C:\Windows\System\InESENB.exe
  2⤵
  PID:8780
- C:\Windows\System\RZAYykY.exe
  C:\Windows\System\RZAYykY.exe
  2⤵
  PID:8872
- C:\Windows\System\sQrGtsZ.exe
  C:\Windows\System\sQrGtsZ.exe
  2⤵
  PID:8920
- C:\Windows\System\NWhQLFd.exe
  C:\Windows\System\NWhQLFd.exe
  2⤵
  PID:9036
- C:\Windows\System\kgTujEm.exe
  C:\Windows\System\kgTujEm.exe
  2⤵
  PID:9060
- C:\Windows\System\XjtmNcR.exe
  C:\Windows\System\XjtmNcR.exe
  2⤵
  PID:9160
- C:\Windows\System\vyoPZNg.exe
  C:\Windows\System\vyoPZNg.exe
  2⤵
  PID:9148
- C:\Windows\System\qWuXIWU.exe
  C:\Windows\System\qWuXIWU.exe
  2⤵
  PID:9196
- C:\Windows\System\DNDJadT.exe
  C:\Windows\System\DNDJadT.exe
  2⤵
  PID:8456
- C:\Windows\System\IpfXadB.exe
  C:\Windows\System\IpfXadB.exe
  2⤵
  PID:8752
- C:\Windows\System\PeIuQgU.exe
  C:\Windows\System\PeIuQgU.exe
  2⤵
  PID:8640
- C:\Windows\System\DMbHpfK.exe
  C:\Windows\System\DMbHpfK.exe
  2⤵
  PID:8860
- C:\Windows\System\gxBnTjs.exe
  C:\Windows\System\gxBnTjs.exe
  2⤵
  PID:9056
- C:\Windows\System\hKnEqtV.exe
  C:\Windows\System\hKnEqtV.exe
  2⤵
  PID:9068
- C:\Windows\System\cwFKZPu.exe
  C:\Windows\System\cwFKZPu.exe
  2⤵
  PID:8232
- C:\Windows\System\OKcjXhB.exe
  C:\Windows\System\OKcjXhB.exe
  2⤵
  PID:8672
- C:\Windows\System\nJuCvmQ.exe
  C:\Windows\System\nJuCvmQ.exe
  2⤵
  PID:8560
- C:\Windows\System\IaQkatM.exe
  C:\Windows\System\IaQkatM.exe
  2⤵
  PID:8320
- C:\Windows\System\xJmnsbC.exe
  C:\Windows\System\xJmnsbC.exe
  2⤵
  PID:9232
- C:\Windows\System\mvRZGEo.exe
  C:\Windows\System\mvRZGEo.exe
  2⤵
  PID:9260
- C:\Windows\System\GRiwDdG.exe
  C:\Windows\System\GRiwDdG.exe
  2⤵
  PID:9292
- C:\Windows\System\qeNQLDt.exe
  C:\Windows\System\qeNQLDt.exe
  2⤵
  PID:9316
- C:\Windows\System\LnnMyuS.exe
  C:\Windows\System\LnnMyuS.exe
  2⤵
  PID:9340
- C:\Windows\System\zzuHFpP.exe
  C:\Windows\System\zzuHFpP.exe
  2⤵
  PID:9364
- C:\Windows\System\IFbFyoy.exe
  C:\Windows\System\IFbFyoy.exe
  2⤵
  PID:9392
- C:\Windows\System\YNxmGGb.exe
  C:\Windows\System\YNxmGGb.exe
  2⤵
  PID:9424
- C:\Windows\System\QUjGiZv.exe
  C:\Windows\System\QUjGiZv.exe
  2⤵
  PID:9456
- C:\Windows\System\JKKdTKy.exe
  C:\Windows\System\JKKdTKy.exe
  2⤵
  PID:9480
- C:\Windows\System\OgipxhD.exe
  C:\Windows\System\OgipxhD.exe
  2⤵
  PID:9504
- C:\Windows\System\TGptqEa.exe
  C:\Windows\System\TGptqEa.exe
  2⤵
  PID:9540
- C:\Windows\System\NbeFTAA.exe
  C:\Windows\System\NbeFTAA.exe
  2⤵
  PID:9560
- C:\Windows\System\sMzcAGC.exe
  C:\Windows\System\sMzcAGC.exe
  2⤵
  PID:9592
- C:\Windows\System\QLMpEMo.exe
  C:\Windows\System\QLMpEMo.exe
  2⤵
  PID:9612
- C:\Windows\System\nVdnbMB.exe
  C:\Windows\System\nVdnbMB.exe
  2⤵
  PID:9632
- C:\Windows\System\SfhkQqR.exe
  C:\Windows\System\SfhkQqR.exe
  2⤵
  PID:9660
- C:\Windows\System\WbHfPTq.exe
  C:\Windows\System\WbHfPTq.exe
  2⤵
  PID:9688
- C:\Windows\System\QJTqIwa.exe
  C:\Windows\System\QJTqIwa.exe
  2⤵
  PID:9720
- C:\Windows\System\EuYaUly.exe
  C:\Windows\System\EuYaUly.exe
  2⤵
  PID:9744
- C:\Windows\System\YooMDQa.exe
  C:\Windows\System\YooMDQa.exe
  2⤵
  PID:9772
- C:\Windows\System\qfsltXk.exe
  C:\Windows\System\qfsltXk.exe
  2⤵
  PID:9800
- C:\Windows\System\mLIxuJu.exe
  C:\Windows\System\mLIxuJu.exe
  2⤵
  PID:9832
- C:\Windows\System\xgejlBd.exe
  C:\Windows\System\xgejlBd.exe
  2⤵
  PID:9852
- C:\Windows\System\meujbAd.exe
  C:\Windows\System\meujbAd.exe
  2⤵
  PID:9888
- C:\Windows\System\kFgVyQh.exe
  C:\Windows\System\kFgVyQh.exe
  2⤵
  PID:9920
- C:\Windows\System\kzmQEzn.exe
  C:\Windows\System\kzmQEzn.exe
  2⤵
  PID:9952
- C:\Windows\System\bEpbPcc.exe
  C:\Windows\System\bEpbPcc.exe
  2⤵
  PID:9972
- C:\Windows\System\ZSyRwdy.exe
  C:\Windows\System\ZSyRwdy.exe
  2⤵
  PID:9988
- C:\Windows\System\eTqRIet.exe
  C:\Windows\System\eTqRIet.exe
  2⤵
  PID:10012
- C:\Windows\System\bKVDCIE.exe
  C:\Windows\System\bKVDCIE.exe
  2⤵
  PID:10040
- C:\Windows\System\AWGIgMU.exe
  C:\Windows\System\AWGIgMU.exe
  2⤵
  PID:10072
- C:\Windows\System\vDFQjlw.exe
  C:\Windows\System\vDFQjlw.exe
  2⤵
  PID:10112
- C:\Windows\System\PeRcILJ.exe
  C:\Windows\System\PeRcILJ.exe
  2⤵
  PID:10132
- C:\Windows\System\Xmozkje.exe
  C:\Windows\System\Xmozkje.exe
  2⤵
  PID:10156
- C:\Windows\System\dGsvzgo.exe
  C:\Windows\System\dGsvzgo.exe
  2⤵
  PID:10180
- C:\Windows\System\IyzNLED.exe
  C:\Windows\System\IyzNLED.exe
  2⤵
  PID:10196
- C:\Windows\System\jalnqWm.exe
  C:\Windows\System\jalnqWm.exe
  2⤵
  PID:9324
- C:\Windows\System\EqXPNMq.exe
  C:\Windows\System\EqXPNMq.exe
  2⤵
  PID:9416
- C:\Windows\System\LbnpOPX.exe
  C:\Windows\System\LbnpOPX.exe
  2⤵
  PID:9468
- C:\Windows\System\nUqvZaS.exe
  C:\Windows\System\nUqvZaS.exe
  2⤵
  PID:9520
- C:\Windows\System\JytFLRE.exe
  C:\Windows\System\JytFLRE.exe
  2⤵
  PID:9576
- C:\Windows\System\aaluGLU.exe
  C:\Windows\System\aaluGLU.exe
  2⤵
  PID:9672
- C:\Windows\System\IhSEqzQ.exe
  C:\Windows\System\IhSEqzQ.exe
  2⤵
  PID:9604
- C:\Windows\System\zNsHgNf.exe
  C:\Windows\System\zNsHgNf.exe
  2⤵
  PID:9712
- C:\Windows\System\yyscrKb.exe
  C:\Windows\System\yyscrKb.exe
  2⤵
  PID:9844
- C:\Windows\System\KaGWjup.exe
  C:\Windows\System\KaGWjup.exe
  2⤵
  PID:9896
- C:\Windows\System\RLnBueG.exe
  C:\Windows\System\RLnBueG.exe
  2⤵
  PID:9864
- C:\Windows\System\IehXNHe.exe
  C:\Windows\System\IehXNHe.exe
  2⤵
  PID:10004
- C:\Windows\System\RfYhSdu.exe
  C:\Windows\System\RfYhSdu.exe
  2⤵
  PID:10028
- C:\Windows\System\vZUagxv.exe
  C:\Windows\System\vZUagxv.exe
  2⤵
  PID:10120
- C:\Windows\System\wpYWRSb.exe
  C:\Windows\System\wpYWRSb.exe
  2⤵
  PID:10176
- C:\Windows\System\rWGrmMT.exe
  C:\Windows\System\rWGrmMT.exe
  2⤵
  PID:10208
- C:\Windows\System\SoAAxLw.exe
  C:\Windows\System\SoAAxLw.exe
  2⤵
  PID:10220
- C:\Windows\System\fvAtCjY.exe
  C:\Windows\System\fvAtCjY.exe
  2⤵
  PID:9388
- C:\Windows\System\XSLisdu.exe
  C:\Windows\System\XSLisdu.exe
  2⤵
  PID:9600
- C:\Windows\System\cxJzAfR.exe
  C:\Windows\System\cxJzAfR.exe
  2⤵
  PID:9696
- C:\Windows\System\iXDGiTq.exe
  C:\Windows\System\iXDGiTq.exe
  2⤵
  PID:9912
- C:\Windows\System\NfPTFjc.exe
  C:\Windows\System\NfPTFjc.exe
  2⤵
  PID:9980
- C:\Windows\System\EPZDvEf.exe
  C:\Windows\System\EPZDvEf.exe
  2⤵
  PID:10084
- C:\Windows\System\LzHZsHR.exe
  C:\Windows\System\LzHZsHR.exe
  2⤵
  PID:9492
- C:\Windows\System\uxpTvBm.exe
  C:\Windows\System\uxpTvBm.exe
  2⤵
  PID:9876
- C:\Windows\System\LngmeGn.exe
  C:\Windows\System\LngmeGn.exe
  2⤵
  PID:9908
- C:\Windows\System\ljZSVTL.exe
  C:\Windows\System\ljZSVTL.exe
  2⤵
  PID:9760
- C:\Windows\System\AFtAWUK.exe
  C:\Windows\System\AFtAWUK.exe
  2⤵
  PID:10268
- C:\Windows\System\TeXVYnj.exe
  C:\Windows\System\TeXVYnj.exe
  2⤵
  PID:10288
- C:\Windows\System\KzXRnDJ.exe
  C:\Windows\System\KzXRnDJ.exe
  2⤵
  PID:10308
- C:\Windows\System\UoWVOWA.exe
  C:\Windows\System\UoWVOWA.exe
  2⤵
  PID:10324
- C:\Windows\System\SHZkcRz.exe
  C:\Windows\System\SHZkcRz.exe
  2⤵
  PID:10348
- C:\Windows\System\WDhDoon.exe
  C:\Windows\System\WDhDoon.exe
  2⤵
  PID:10372
- C:\Windows\System\jjlLvKr.exe
  C:\Windows\System\jjlLvKr.exe
  2⤵
  PID:10396
- C:\Windows\System\wCJnoSC.exe
  C:\Windows\System\wCJnoSC.exe
  2⤵
  PID:10428
- C:\Windows\System\bJFGvlP.exe
  C:\Windows\System\bJFGvlP.exe
  2⤵
  PID:10456
- C:\Windows\System\xNcavvi.exe
  C:\Windows\System\xNcavvi.exe
  2⤵
  PID:10496
- C:\Windows\System\hPpHUna.exe
  C:\Windows\System\hPpHUna.exe
  2⤵
  PID:10524
- C:\Windows\System\HoKHOtB.exe
  C:\Windows\System\HoKHOtB.exe
  2⤵
  PID:10544
- C:\Windows\System\RcgTmma.exe
  C:\Windows\System\RcgTmma.exe
  2⤵
  PID:10572
- C:\Windows\System\yskORnJ.exe
  C:\Windows\System\yskORnJ.exe
  2⤵
  PID:10592
- C:\Windows\System\wqgvSqY.exe
  C:\Windows\System\wqgvSqY.exe
  2⤵
  PID:10624
- C:\Windows\System\ubLnXjn.exe
  C:\Windows\System\ubLnXjn.exe
  2⤵
  PID:10660
- C:\Windows\System\yYHntkr.exe
  C:\Windows\System\yYHntkr.exe
  2⤵
  PID:10688
- C:\Windows\System\KimoiGp.exe
  C:\Windows\System\KimoiGp.exe
  2⤵
  PID:10708
- C:\Windows\System\TRJDqVB.exe
  C:\Windows\System\TRJDqVB.exe
  2⤵
  PID:10736
- C:\Windows\System\fjtLGzv.exe
  C:\Windows\System\fjtLGzv.exe
  2⤵
  PID:10772
- C:\Windows\System\SsQiXUH.exe
  C:\Windows\System\SsQiXUH.exe
  2⤵
  PID:10804
- C:\Windows\System\TgneArm.exe
  C:\Windows\System\TgneArm.exe
  2⤵
  PID:10832
- C:\Windows\System\KHEdfZA.exe
  C:\Windows\System\KHEdfZA.exe
  2⤵
  PID:10856
- C:\Windows\System\ljACVIN.exe
  C:\Windows\System\ljACVIN.exe
  2⤵
  PID:10884
- C:\Windows\System\VKXbHMK.exe
  C:\Windows\System\VKXbHMK.exe
  2⤵
  PID:10916
- C:\Windows\System\FnJySwA.exe
  C:\Windows\System\FnJySwA.exe
  2⤵
  PID:10944
- C:\Windows\System\kefumsP.exe
  C:\Windows\System\kefumsP.exe
  2⤵
  PID:10964
- C:\Windows\System\pWTmRdn.exe
  C:\Windows\System\pWTmRdn.exe
  2⤵
  PID:10992
- C:\Windows\System\wXdookb.exe
  C:\Windows\System\wXdookb.exe
  2⤵
  PID:11024
- C:\Windows\System\lRCDobi.exe
  C:\Windows\System\lRCDobi.exe
  2⤵
  PID:11040
- C:\Windows\System\xYdGMNS.exe
  C:\Windows\System\xYdGMNS.exe
  2⤵
  PID:11068
- C:\Windows\System\XjbBqiQ.exe
  C:\Windows\System\XjbBqiQ.exe
  2⤵
  PID:11092
- C:\Windows\System\TJtSWJm.exe
  C:\Windows\System\TJtSWJm.exe
  2⤵
  PID:11120
- C:\Windows\System\PrOkrom.exe
  C:\Windows\System\PrOkrom.exe
  2⤵
  PID:11148
- C:\Windows\System\wFiBOFP.exe
  C:\Windows\System\wFiBOFP.exe
  2⤵
  PID:11184
- C:\Windows\System\vgrLMTu.exe
  C:\Windows\System\vgrLMTu.exe
  2⤵
  PID:11212
- C:\Windows\System\AZPiXrj.exe
  C:\Windows\System\AZPiXrj.exe
  2⤵
  PID:11244
- C:\Windows\System\fwZAXdE.exe
  C:\Windows\System\fwZAXdE.exe
  2⤵
  PID:9184
- C:\Windows\System\CKxYbFE.exe
  C:\Windows\System\CKxYbFE.exe
  2⤵
  PID:10320
- C:\Windows\System\PaQeKXk.exe
  C:\Windows\System\PaQeKXk.exe
  2⤵
  PID:10248
- C:\Windows\System\QJTqNsz.exe
  C:\Windows\System\QJTqNsz.exe
  2⤵
  PID:10424
- C:\Windows\System\WcsgBKE.exe
  C:\Windows\System\WcsgBKE.exe
  2⤵
  PID:10420
- C:\Windows\System\gOTDoKb.exe
  C:\Windows\System\gOTDoKb.exe
  2⤵
  PID:10392
- C:\Windows\System\cBnKXaF.exe
  C:\Windows\System\cBnKXaF.exe
  2⤵
  PID:10492
- C:\Windows\System\fQOpnVB.exe
  C:\Windows\System\fQOpnVB.exe
  2⤵
  PID:10680
- C:\Windows\System\XSQFkRO.exe
  C:\Windows\System\XSQFkRO.exe
  2⤵
  PID:10732
- C:\Windows\System\PUlOvwY.exe
  C:\Windows\System\PUlOvwY.exe
  2⤵
  PID:10792
- C:\Windows\System\WJooNas.exe
  C:\Windows\System\WJooNas.exe
  2⤵
  PID:10796
- C:\Windows\System\hdFKYsG.exe
  C:\Windows\System\hdFKYsG.exe
  2⤵
  PID:10872
- C:\Windows\System\MfTaXai.exe
  C:\Windows\System\MfTaXai.exe
  2⤵
  PID:10932
- C:\Windows\System\MrLwXlE.exe
  C:\Windows\System\MrLwXlE.exe
  2⤵
  PID:10960
- C:\Windows\System\BBEdyEv.exe
  C:\Windows\System\BBEdyEv.exe
  2⤵
  PID:10984
- C:\Windows\System\ruYuUkf.exe
  C:\Windows\System\ruYuUkf.exe
  2⤵
  PID:11132
- C:\Windows\System\HrAKSLJ.exe
  C:\Windows\System\HrAKSLJ.exe
  2⤵
  PID:11168
- C:\Windows\System\OFJpzDX.exe
  C:\Windows\System\OFJpzDX.exe
  2⤵
  PID:11108
- C:\Windows\System\XvWnVvA.exe
  C:\Windows\System\XvWnVvA.exe
  2⤵
  PID:11228
- C:\Windows\System\euxCrIn.exe
  C:\Windows\System\euxCrIn.exe
  2⤵
  PID:10336
- C:\Windows\System\xYixhMX.exe
  C:\Windows\System\xYixhMX.exe
  2⤵
  PID:10384
- C:\Windows\System\YhDMjao.exe
  C:\Windows\System\YhDMjao.exe
  2⤵
  PID:9536
- C:\Windows\System\GirvFHk.exe
  C:\Windows\System\GirvFHk.exe
  2⤵
  PID:10936
- C:\Windows\System\ypyrtwP.exe
  C:\Windows\System\ypyrtwP.exe
  2⤵
  PID:10760
- C:\Windows\System\vIsMDry.exe
  C:\Windows\System\vIsMDry.exe
  2⤵
  PID:11112
- C:\Windows\System\egiGrbF.exe
  C:\Windows\System\egiGrbF.exe
  2⤵
  PID:10540
- C:\Windows\System\iMgJrDG.exe
  C:\Windows\System\iMgJrDG.exe
  2⤵
  PID:11268
- C:\Windows\System\VXCPjYW.exe
  C:\Windows\System\VXCPjYW.exe
  2⤵
  PID:11292
- C:\Windows\System\fYYVvCg.exe
  C:\Windows\System\fYYVvCg.exe
  2⤵
  PID:11316
- C:\Windows\System\QJdEukp.exe
  C:\Windows\System\QJdEukp.exe
  2⤵
  PID:11352
- C:\Windows\System\sdHrZKZ.exe
  C:\Windows\System\sdHrZKZ.exe
  2⤵
  PID:11384
- C:\Windows\System\jJcfWcx.exe
  C:\Windows\System\jJcfWcx.exe
  2⤵
  PID:11404
- C:\Windows\System\WXCoCHo.exe
  C:\Windows\System\WXCoCHo.exe
  2⤵
  PID:11428
- C:\Windows\System\xEvrlad.exe
  C:\Windows\System\xEvrlad.exe
  2⤵
  PID:11456
- C:\Windows\System\pIAFJlS.exe
  C:\Windows\System\pIAFJlS.exe
  2⤵
  PID:11484
- C:\Windows\System\vKJLnrU.exe
  C:\Windows\System\vKJLnrU.exe
  2⤵
  PID:11508
- C:\Windows\System\rDhbIpZ.exe
  C:\Windows\System\rDhbIpZ.exe
  2⤵
  PID:11544
- C:\Windows\System\qDeHyvp.exe
  C:\Windows\System\qDeHyvp.exe
  2⤵
  PID:11564
- C:\Windows\System\WZYNnXr.exe
  C:\Windows\System\WZYNnXr.exe
  2⤵
  PID:11592
- C:\Windows\System\pwNtudR.exe
  C:\Windows\System\pwNtudR.exe
  2⤵
  PID:11620
- C:\Windows\System\VgAKmrZ.exe
  C:\Windows\System\VgAKmrZ.exe
  2⤵
  PID:11656
- C:\Windows\System\jMUZNIy.exe
  C:\Windows\System\jMUZNIy.exe
  2⤵
  PID:11672
- C:\Windows\System\lxXgZYF.exe
  C:\Windows\System\lxXgZYF.exe
  2⤵
  PID:11708
- C:\Windows\System\QlIHSth.exe
  C:\Windows\System\QlIHSth.exe
  2⤵
  PID:11736
- C:\Windows\System\dwUZbSW.exe
  C:\Windows\System\dwUZbSW.exe
  2⤵
  PID:11768
- C:\Windows\System\ExlNrYF.exe
  C:\Windows\System\ExlNrYF.exe
  2⤵
  PID:11796
- C:\Windows\System\lSLdaun.exe
  C:\Windows\System\lSLdaun.exe
  2⤵
  PID:11816
- C:\Windows\System\LTFbHMy.exe
  C:\Windows\System\LTFbHMy.exe
  2⤵
  PID:11852
- C:\Windows\System\glPmiuc.exe
  C:\Windows\System\glPmiuc.exe
  2⤵
  PID:11868
- C:\Windows\System\cBZsoDw.exe
  C:\Windows\System\cBZsoDw.exe
  2⤵
  PID:11892
- C:\Windows\System\BnnIclQ.exe
  C:\Windows\System\BnnIclQ.exe
  2⤵
  PID:11924
- C:\Windows\System\OLFpmWk.exe
  C:\Windows\System\OLFpmWk.exe
  2⤵
  PID:11956
- C:\Windows\System\WkznkBd.exe
  C:\Windows\System\WkznkBd.exe
  2⤵
  PID:11984
- C:\Windows\System\JFrWbAT.exe
  C:\Windows\System\JFrWbAT.exe
  2⤵
  PID:12008
- C:\Windows\System\THhpLLh.exe
  C:\Windows\System\THhpLLh.exe
  2⤵
  PID:12036
- C:\Windows\System\KWbvSLG.exe
  C:\Windows\System\KWbvSLG.exe
  2⤵
  PID:12056
- C:\Windows\System\AsXMQyK.exe
  C:\Windows\System\AsXMQyK.exe
  2⤵
  PID:12084
- C:\Windows\System\CIhTfmz.exe
  C:\Windows\System\CIhTfmz.exe
  2⤵
  PID:12120
- C:\Windows\System\jNFHDIX.exe
  C:\Windows\System\jNFHDIX.exe
  2⤵
  PID:12140
- C:\Windows\System\ElUeIZJ.exe
  C:\Windows\System\ElUeIZJ.exe
  2⤵
  PID:12168
- C:\Windows\System\LasoHFA.exe
  C:\Windows\System\LasoHFA.exe
  2⤵
  PID:12192
- C:\Windows\System\Cattfgp.exe
  C:\Windows\System\Cattfgp.exe
  2⤵
  PID:12220
- C:\Windows\System\RsHKeLm.exe
  C:\Windows\System\RsHKeLm.exe
  2⤵
  PID:12248
- C:\Windows\System\TKTwALx.exe
  C:\Windows\System\TKTwALx.exe
  2⤵
  PID:12272
- C:\Windows\System\crMvvGS.exe
  C:\Windows\System\crMvvGS.exe
  2⤵
  PID:11136
- C:\Windows\System\zsbQGjX.exe
  C:\Windows\System\zsbQGjX.exe
  2⤵
  PID:11344
- C:\Windows\System\RWAxwsm.exe
  C:\Windows\System\RWAxwsm.exe
  2⤵
  PID:11232
- C:\Windows\System\nLXmhEr.exe
  C:\Windows\System\nLXmhEr.exe
  2⤵
  PID:11324
- C:\Windows\System\iyITJkR.exe
  C:\Windows\System\iyITJkR.exe
  2⤵
  PID:11452
- C:\Windows\System\gyTtSUj.exe
  C:\Windows\System\gyTtSUj.exe
  2⤵
  PID:11480
- C:\Windows\System\aTkIEvE.exe
  C:\Windows\System\aTkIEvE.exe
  2⤵
  PID:11608
- C:\Windows\System\GhDuvTu.exe
  C:\Windows\System\GhDuvTu.exe
  2⤵
  PID:11628
- C:\Windows\System\oaTncuq.exe
  C:\Windows\System\oaTncuq.exe
  2⤵
  PID:11752
- C:\Windows\System\AFPaFyh.exe
  C:\Windows\System\AFPaFyh.exe
  2⤵
  PID:11604
- C:\Windows\System\UgzILlm.exe
  C:\Windows\System\UgzILlm.exe
  2⤵
  PID:11640
- C:\Windows\System\rZyDKxO.exe
  C:\Windows\System\rZyDKxO.exe
  2⤵
  PID:11748
- C:\Windows\System\PCibsQA.exe
  C:\Windows\System\PCibsQA.exe
  2⤵
  PID:12032
- C:\Windows\System\BaUTiXW.exe
  C:\Windows\System\BaUTiXW.exe
  2⤵
  PID:12104
- C:\Windows\System\oIDlovG.exe
  C:\Windows\System\oIDlovG.exe
  2⤵
  PID:12152
- C:\Windows\System\KgrdgRp.exe
  C:\Windows\System\KgrdgRp.exe
  2⤵
  PID:11972
- C:\Windows\System\xayKWJp.exe
  C:\Windows\System\xayKWJp.exe
  2⤵
  PID:12180
- C:\Windows\System\ckigpKA.exe
  C:\Windows\System\ckigpKA.exe
  2⤵
  PID:12128
- C:\Windows\System\kurhRjO.exe
  C:\Windows\System\kurhRjO.exe
  2⤵
  PID:11368
- C:\Windows\System\JyzDujM.exe
  C:\Windows\System\JyzDujM.exe
  2⤵
  PID:12236
- C:\Windows\System\DMCvCFT.exe
  C:\Windows\System\DMCvCFT.exe
  2⤵
  PID:10636
- C:\Windows\System\nJOKfzI.exe
  C:\Windows\System\nJOKfzI.exe
  2⤵
  PID:11588
- C:\Windows\System\jopNAAm.exe
  C:\Windows\System\jopNAAm.exe
  2⤵
  PID:11836
- C:\Windows\System\gNJeTun.exe
  C:\Windows\System\gNJeTun.exe
  2⤵
  PID:12232
- C:\Windows\System\RvZrKcn.exe
  C:\Windows\System\RvZrKcn.exe
  2⤵
  PID:11692
- C:\Windows\System\AXNOcpg.exe
  C:\Windows\System\AXNOcpg.exe
  2⤵
  PID:12284
- C:\Windows\System\NieSQKa.exe
  C:\Windows\System\NieSQKa.exe
  2⤵
  PID:12304
- C:\Windows\System\KoCjazm.exe
  C:\Windows\System\KoCjazm.exe
  2⤵
  PID:12332
- C:\Windows\System\WoStgmU.exe
  C:\Windows\System\WoStgmU.exe
  2⤵
  PID:12356
- C:\Windows\System\CDaVtes.exe
  C:\Windows\System\CDaVtes.exe
  2⤵
  PID:12388
- C:\Windows\System\jsVgFuE.exe
  C:\Windows\System\jsVgFuE.exe
  2⤵
  PID:12416
- C:\Windows\System\IdmCKkC.exe
  C:\Windows\System\IdmCKkC.exe
  2⤵
  PID:12444
- C:\Windows\System\sdhAAwk.exe
  C:\Windows\System\sdhAAwk.exe
  2⤵
  PID:12472
- C:\Windows\System\WQhAVye.exe
  C:\Windows\System\WQhAVye.exe
  2⤵
  PID:12496
- C:\Windows\System\MOAtpqx.exe
  C:\Windows\System\MOAtpqx.exe
  2⤵
  PID:12524
- C:\Windows\System\ZIAWKdJ.exe
  C:\Windows\System\ZIAWKdJ.exe
  2⤵
  PID:12544
- C:\Windows\System\lYnnTLN.exe
  C:\Windows\System\lYnnTLN.exe
  2⤵
  PID:12580
- C:\Windows\System\MLVITeE.exe
  C:\Windows\System\MLVITeE.exe
  2⤵
  PID:12596
- C:\Windows\System\AABTGVj.exe
  C:\Windows\System\AABTGVj.exe
  2⤵
  PID:12628
- C:\Windows\System\oSDunlT.exe
  C:\Windows\System\oSDunlT.exe
  2⤵
  PID:12664
- C:\Windows\System\pJNPNWp.exe
  C:\Windows\System\pJNPNWp.exe
  2⤵
  PID:12688
- C:\Windows\System\VwsOgXy.exe
  C:\Windows\System\VwsOgXy.exe
  2⤵
  PID:12712
- C:\Windows\System\WEFAjlk.exe
  C:\Windows\System\WEFAjlk.exe
  2⤵
  PID:12760
- C:\Windows\System\bzzMicc.exe
  C:\Windows\System\bzzMicc.exe
  2⤵
  PID:12780
- C:\Windows\System\aonxtCl.exe
  C:\Windows\System\aonxtCl.exe
  2⤵
  PID:12804
- C:\Windows\System\GKDRYeY.exe
  C:\Windows\System\GKDRYeY.exe
  2⤵
  PID:12832
- C:\Windows\System\SgEKvlc.exe
  C:\Windows\System\SgEKvlc.exe
  2⤵
  PID:12860
- C:\Windows\System\EspwxlY.exe
  C:\Windows\System\EspwxlY.exe
  2⤵
  PID:12884
- C:\Windows\System\byGOcwP.exe
  C:\Windows\System\byGOcwP.exe
  2⤵
  PID:12904
- C:\Windows\System\qajEDJb.exe
  C:\Windows\System\qajEDJb.exe
  2⤵
  PID:12928
- C:\Windows\System\PfqHpFQ.exe
  C:\Windows\System\PfqHpFQ.exe
  2⤵
  PID:12952
- C:\Windows\System\osSIjDR.exe
  C:\Windows\System\osSIjDR.exe
  2⤵
  PID:12980
- C:\Windows\System\tHArjbY.exe
  C:\Windows\System\tHArjbY.exe
  2⤵
  PID:13004
- C:\Windows\System\nIhMjPb.exe
  C:\Windows\System\nIhMjPb.exe
  2⤵
  PID:13032
- C:\Windows\System\MyvEPSg.exe
  C:\Windows\System\MyvEPSg.exe
  2⤵
  PID:13056
- C:\Windows\System\EEydkHP.exe
  C:\Windows\System\EEydkHP.exe
  2⤵
  PID:13092
- C:\Windows\System\FUzxCIf.exe
  C:\Windows\System\FUzxCIf.exe
  2⤵
  PID:13120
- C:\Windows\System\mndFHIK.exe
  C:\Windows\System\mndFHIK.exe
  2⤵
  PID:13144
- C:\Windows\System\sjiacAu.exe
  C:\Windows\System\sjiacAu.exe
  2⤵
  PID:13168
- C:\Windows\System\mRoHuPb.exe
  C:\Windows\System\mRoHuPb.exe
  2⤵
  PID:13200
- C:\Windows\System\pUuUsEE.exe
  C:\Windows\System\pUuUsEE.exe
  2⤵
  PID:13224
- C:\Windows\System\luXLzif.exe
  C:\Windows\System\luXLzif.exe
  2⤵
  PID:13256
- C:\Windows\System\GaaNtzw.exe
  C:\Windows\System\GaaNtzw.exe
  2⤵
  PID:13284
- C:\Windows\System\JmIAirF.exe
  C:\Windows\System\JmIAirF.exe
  2⤵
  PID:13304
- C:\Windows\System\CnsrSXd.exe
  C:\Windows\System\CnsrSXd.exe
  2⤵
  PID:11720
- C:\Windows\System\woZFSBR.exe
  C:\Windows\System\woZFSBR.exe
  2⤵
  PID:11528
- C:\Windows\System\YTZSuxk.exe
  C:\Windows\System\YTZSuxk.exe
  2⤵
  PID:12296
- C:\Windows\System\XJAIHyg.exe
  C:\Windows\System\XJAIHyg.exe
  2⤵
  PID:11716
- C:\Windows\System\SpAZufw.exe
  C:\Windows\System\SpAZufw.exe
  2⤵
  PID:11700
- C:\Windows\System\srdRqcq.exe
  C:\Windows\System\srdRqcq.exe
  2⤵
  PID:12436
- C:\Windows\System\EoxKHzt.exe
  C:\Windows\System\EoxKHzt.exe
  2⤵
  PID:12508
- C:\Windows\System\RghXVlc.exe
  C:\Windows\System\RghXVlc.exe
  2⤵
  PID:12704
- C:\Windows\System\rjHkXOS.exe
  C:\Windows\System\rjHkXOS.exe
  2⤵
  PID:12460
- C:\Windows\System\QAZCvlR.exe
  C:\Windows\System\QAZCvlR.exe
  2⤵
  PID:12484
- C:\Windows\System\oDAqEHx.exe
  C:\Windows\System\oDAqEHx.exe
  2⤵
  PID:12812
- C:\Windows\System\nJGKgvG.exe
  C:\Windows\System\nJGKgvG.exe
  2⤵
  PID:12588
- C:\Windows\System\AwlkKPE.exe
  C:\Windows\System\AwlkKPE.exe
  2⤵
  PID:12968
- C:\Windows\System\kNcYUsY.exe
  C:\Windows\System\kNcYUsY.exe
  2⤵
  PID:12772
- C:\Windows\System\bxXjfXi.exe
  C:\Windows\System\bxXjfXi.exe
  2⤵
  PID:12788
- C:\Windows\System\EEVEoyW.exe
  C:\Windows\System\EEVEoyW.exe
  2⤵
  PID:12996
- C:\Windows\System\sCKrxaG.exe
  C:\Windows\System\sCKrxaG.exe
  2⤵
  PID:12880
- C:\Windows\System\qvrrVnP.exe
  C:\Windows\System\qvrrVnP.exe
  2⤵
  PID:12948
- C:\Windows\System\uAKldCL.exe
  C:\Windows\System\uAKldCL.exe
  2⤵
  PID:13184
- C:\Windows\System\tMDdLCi.exe
  C:\Windows\System\tMDdLCi.exe
  2⤵
  PID:13076
- C:\Windows\System\UvmFvXB.exe
  C:\Windows\System\UvmFvXB.exe
  2⤵
  PID:11976
- C:\Windows\System\ccfvGfh.exe
  C:\Windows\System\ccfvGfh.exe
  2⤵
  PID:13220
- C:\Windows\System\UEAEQdP.exe
  C:\Windows\System\UEAEQdP.exe
  2⤵
  PID:12736
- C:\Windows\System\JhkYxEZ.exe
  C:\Windows\System\JhkYxEZ.exe
  2⤵
  PID:12700
- C:\Windows\System\UnMbocc.exe
  C:\Windows\System\UnMbocc.exe
  2⤵
  PID:12924
- C:\Windows\System\ORztzHa.exe
  C:\Windows\System\ORztzHa.exe
  2⤵
  PID:13156
- C:\Windows\System\AhusAHx.exe
  C:\Windows\System\AhusAHx.exe
  2⤵
  PID:12520
- C:\Windows\System\NDPFScT.exe
  C:\Windows\System\NDPFScT.exe
  2⤵
  PID:13292
- C:\Windows\System\IAsYqXd.exe
  C:\Windows\System\IAsYqXd.exe
  2⤵
  PID:13268
- C:\Windows\System\CTNTXsM.exe
  C:\Windows\System\CTNTXsM.exe
  2⤵
  PID:13328
- C:\Windows\System\eOCQvTV.exe
  C:\Windows\System\eOCQvTV.exe
  2⤵
  PID:13360
- C:\Windows\System\vdhhawq.exe
  C:\Windows\System\vdhhawq.exe
  2⤵
  PID:13388
- C:\Windows\System\uLfZcLd.exe
  C:\Windows\System\uLfZcLd.exe
  2⤵
  PID:13408
- C:\Windows\System\aurAmyV.exe
  C:\Windows\System\aurAmyV.exe
  2⤵
  PID:13432
- C:\Windows\System\TRnWMiR.exe
  C:\Windows\System\TRnWMiR.exe
  2⤵
  PID:13460
- C:\Windows\System\zjYDoBB.exe
  C:\Windows\System\zjYDoBB.exe
  2⤵
  PID:13488
- C:\Windows\System\xLxjGyr.exe
  C:\Windows\System\xLxjGyr.exe
  2⤵
  PID:13512
- C:\Windows\System\TMCiXco.exe
  C:\Windows\System\TMCiXco.exe
  2⤵
  PID:13540
- C:\Windows\System\JmykVtF.exe
  C:\Windows\System\JmykVtF.exe
  2⤵
  PID:13568
- C:\Windows\System\xDlrZVS.exe
  C:\Windows\System\xDlrZVS.exe
  2⤵
  PID:13596
- C:\Windows\System\vihaUbB.exe
  C:\Windows\System\vihaUbB.exe
  2⤵
  PID:13620
- C:\Windows\System\vuRcFSN.exe
  C:\Windows\System\vuRcFSN.exe
  2⤵
  PID:13648
- C:\Windows\System\gwNJoUq.exe
  C:\Windows\System\gwNJoUq.exe
  2⤵
  PID:13664
- C:\Windows\System\XiYjJea.exe
  C:\Windows\System\XiYjJea.exe
  2⤵
  PID:13684
- C:\Windows\System\rvuuoPG.exe
  C:\Windows\System\rvuuoPG.exe
  2⤵
  PID:13708
- C:\Windows\System\NzDnvak.exe
  C:\Windows\System\NzDnvak.exe
  2⤵
  PID:13736
- C:\Windows\System\jtmWxZk.exe
  C:\Windows\System\jtmWxZk.exe
  2⤵
  PID:13764
- C:\Windows\System\XMOtsrM.exe
  C:\Windows\System\XMOtsrM.exe
  2⤵
  PID:13788
- C:\Windows\System\rEnhoEl.exe
  C:\Windows\System\rEnhoEl.exe
  2⤵
  PID:13820
- C:\Windows\System\neouPwf.exe
  C:\Windows\System\neouPwf.exe
  2⤵
  PID:13844
- C:\Windows\System\icysmoU.exe
  C:\Windows\System\icysmoU.exe
  2⤵
  PID:13876
- C:\Windows\System\TGdKMbr.exe
  C:\Windows\System\TGdKMbr.exe
  2⤵
  PID:13896
- C:\Windows\System\AtiPCNd.exe
  C:\Windows\System\AtiPCNd.exe
  2⤵
  PID:13912
- C:\Windows\System\DFIrWYc.exe
  C:\Windows\System\DFIrWYc.exe
  2⤵
  PID:13936
- C:\Windows\System\YTiefhC.exe
  C:\Windows\System\YTiefhC.exe
  2⤵
  PID:13964
- C:\Windows\System\RQpuXfu.exe
  C:\Windows\System\RQpuXfu.exe
  2⤵
  PID:13984
- C:\Windows\System\WlpdHBs.exe
  C:\Windows\System\WlpdHBs.exe
  2⤵
  PID:14016
- C:\Windows\System\xoGGxnu.exe
  C:\Windows\System\xoGGxnu.exe
  2⤵
  PID:14032
- C:\Windows\System\maBQTGy.exe
  C:\Windows\System\maBQTGy.exe
  2⤵
  PID:14076
- C:\Windows\System\ChbluUy.exe
  C:\Windows\System\ChbluUy.exe
  2⤵
  PID:14100
- C:\Windows\System\LYMzSnf.exe
  C:\Windows\System\LYMzSnf.exe
  2⤵
  PID:14128
- C:\Windows\System\dgfSPDI.exe
  C:\Windows\System\dgfSPDI.exe
  2⤵
  PID:14148
- C:\Windows\System\iYajpUU.exe
  C:\Windows\System\iYajpUU.exe
  2⤵
  PID:14180
- C:\Windows\System\yVldVkT.exe
  C:\Windows\System\yVldVkT.exe
  2⤵
  PID:14196
- C:\Windows\System\JHLVYyA.exe
  C:\Windows\System\JHLVYyA.exe
  2⤵
  PID:14220
- C:\Windows\System\EMjYXIx.exe
  C:\Windows\System\EMjYXIx.exe
  2⤵
  PID:14252
- C:\Windows\System\QgRYvAq.exe
  C:\Windows\System\QgRYvAq.exe
  2⤵
  PID:14280
- C:\Windows\System\FAggNMV.exe
  C:\Windows\System\FAggNMV.exe
  2⤵
  PID:14312
- C:\Windows\System\IQfvsSS.exe
  C:\Windows\System\IQfvsSS.exe
  2⤵
  PID:12532
- C:\Windows\System\usBreXd.exe
  C:\Windows\System\usBreXd.exe
  2⤵
  PID:12616
- C:\Windows\System\sPvnTpo.exe
  C:\Windows\System\sPvnTpo.exe
  2⤵
  PID:12512
- C:\Windows\System\SqjELPB.exe
  C:\Windows\System\SqjELPB.exe
  2⤵
  PID:13324
- C:\Windows\System\rdyttga.exe
  C:\Windows\System\rdyttga.exe
  2⤵
  PID:12992
- C:\Windows\System\eeQxTlq.exe
  C:\Windows\System\eeQxTlq.exe
  2⤵
  PID:12552
- C:\Windows\System\MXjCxzP.exe
  C:\Windows\System\MXjCxzP.exe
  2⤵
  PID:13396
- C:\Windows\System\jmxOQxn.exe
  C:\Windows\System\jmxOQxn.exe
  2⤵
  PID:11084
- C:\Windows\System\UwkMlmS.exe
  C:\Windows\System\UwkMlmS.exe
  2⤵
  PID:13680
- C:\Windows\System\rAtSZnt.exe
  C:\Windows\System\rAtSZnt.exe
  2⤵
  PID:10584
- C:\Windows\System\NBaezbp.exe
  C:\Windows\System\NBaezbp.exe
  2⤵
  PID:13840
- C:\Windows\System\doIuaYd.exe
  C:\Windows\System\doIuaYd.exe
  2⤵
  PID:13640
- C:\Windows\System\ZOoKzWa.exe
  C:\Windows\System\ZOoKzWa.exe
  2⤵
  PID:14028
- C:\Windows\System\uUoKxst.exe
  C:\Windows\System\uUoKxst.exe
  2⤵
  PID:14052
- C:\Windows\System\JcovrgN.exe
  C:\Windows\System\JcovrgN.exe
  2⤵
  PID:14096
- C:\Windows\System\bGRpsHU.exe
  C:\Windows\System\bGRpsHU.exe
  2⤵
  PID:13584
- C:\Windows\System\EkenlpZ.exe
  C:\Windows\System\EkenlpZ.exe
  2⤵
  PID:13908
- C:\Windows\System\ahaxRiR.exe
  C:\Windows\System\ahaxRiR.exe
  2⤵
  PID:14292
- C:\Windows\System\DLKCpWB.exe
  C:\Windows\System\DLKCpWB.exe
  2⤵
  PID:14024
- C:\Windows\System\mSDZNeG.exe
  C:\Windows\System\mSDZNeG.exe
  2⤵
  PID:10276
- C:\Windows\System\gUdFpCt.exe
  C:\Windows\System\gUdFpCt.exe
  2⤵
  PID:12412
- C:\Windows\System\SepYvSm.exe
  C:\Windows\System\SepYvSm.exe
  2⤵
  PID:14236
- C:\Windows\System\hYzUTrZ.exe
  C:\Windows\System\hYzUTrZ.exe
  2⤵
  PID:14360
- C:\Windows\System\VdbQcoD.exe
  C:\Windows\System\VdbQcoD.exe
  2⤵
  PID:14388
- C:\Windows\System\JpfngAF.exe
  C:\Windows\System\JpfngAF.exe
  2⤵
  PID:14404
- C:\Windows\System\vrGfjMs.exe
  C:\Windows\System\vrGfjMs.exe
  2⤵
  PID:14436
- C:\Windows\System\fPsluQk.exe
  C:\Windows\System\fPsluQk.exe
  2⤵
  PID:14464
- C:\Windows\System\STrHclP.exe
  C:\Windows\System\STrHclP.exe
  2⤵
  PID:14480
- C:\Windows\System\iBPrYuN.exe
  C:\Windows\System\iBPrYuN.exe
  2⤵
  PID:14504
- C:\Windows\System\pDtvbXx.exe
  C:\Windows\System\pDtvbXx.exe
  2⤵
  PID:14524
- C:\Windows\System\QAAdmkp.exe
  C:\Windows\System\QAAdmkp.exe
  2⤵
  PID:14560
- C:\Windows\System\DifqGHe.exe
  C:\Windows\System\DifqGHe.exe
  2⤵
  PID:14584
- C:\Windows\System\FpPTjCw.exe
  C:\Windows\System\FpPTjCw.exe
  2⤵
  PID:14608
- C:\Windows\System\suWznAX.exe
  C:\Windows\System\suWznAX.exe
  2⤵
  PID:14632
- C:\Windows\System\xPspycG.exe
  C:\Windows\System\xPspycG.exe
  2⤵
  PID:14660
- C:\Windows\System\ymnjEec.exe
  C:\Windows\System\ymnjEec.exe
  2⤵
  PID:14692
- C:\Windows\System\tQiOuzt.exe
  C:\Windows\System\tQiOuzt.exe
  2⤵
  PID:14720
- C:\Windows\System\rUNYcqB.exe
  C:\Windows\System\rUNYcqB.exe
  2⤵
  PID:14748
- C:\Windows\System\LtTfsNd.exe
  C:\Windows\System\LtTfsNd.exe
  2⤵
  PID:14776
- C:\Windows\System\sJkMWnF.exe
  C:\Windows\System\sJkMWnF.exe
  2⤵
  PID:14800
- C:\Windows\System\vcOVosZ.exe
  C:\Windows\System\vcOVosZ.exe
  2⤵
  PID:14832
- C:\Windows\System\dFZuyRM.exe
  C:\Windows\System\dFZuyRM.exe
  2⤵
  PID:14848
- C:\Windows\System\uwkyYiK.exe
  C:\Windows\System\uwkyYiK.exe
  2⤵
  PID:14868
- C:\Windows\System\WLzNMph.exe
  C:\Windows\System\WLzNMph.exe
  2⤵
  PID:14908
- C:\Windows\System\PfjNwHc.exe
  C:\Windows\System\PfjNwHc.exe
  2⤵
  PID:14936
- C:\Windows\System\fYxtYbl.exe
  C:\Windows\System\fYxtYbl.exe
  2⤵
  PID:14960
- C:\Windows\System\WKgPzFs.exe
  C:\Windows\System\WKgPzFs.exe
  2⤵
  PID:14988
- C:\Windows\System\HMbMcVx.exe
  C:\Windows\System\HMbMcVx.exe
  2⤵
  PID:15016
- C:\Windows\System\NJgaDwU.exe
  C:\Windows\System\NJgaDwU.exe
  2⤵
  PID:15044
- C:\Windows\System\LGaQAAw.exe
  C:\Windows\System\LGaQAAw.exe
  2⤵
  PID:15064
- C:\Windows\System\jcokNFq.exe
  C:\Windows\System\jcokNFq.exe
  2⤵
  PID:15092
- C:\Windows\System\QDkYohg.exe
  C:\Windows\System\QDkYohg.exe
  2⤵
  PID:15128
- C:\Windows\System\JeqGodJ.exe
  C:\Windows\System\JeqGodJ.exe
  2⤵
  PID:15164
- C:\Windows\System\XYCHziR.exe
  C:\Windows\System\XYCHziR.exe
  2⤵
  PID:15192
- C:\Windows\System\VymvKsa.exe
  C:\Windows\System\VymvKsa.exe
  2⤵
  PID:15220
- C:\Windows\System\yLsRGPk.exe
  C:\Windows\System\yLsRGPk.exe
  2⤵
  PID:15244
- C:\Windows\System\MXXyVes.exe
  C:\Windows\System\MXXyVes.exe
  2⤵
  PID:15268
- C:\Windows\System\vORfhHe.exe
  C:\Windows\System\vORfhHe.exe
  2⤵
  PID:15300
- C:\Windows\System\lwaNGyi.exe
  C:\Windows\System\lwaNGyi.exe
  2⤵
  PID:15320
- C:\Windows\System\HCVxSFg.exe
  C:\Windows\System\HCVxSFg.exe
  2⤵
  PID:15356
- C:\Windows\System\JIvoFfK.exe
  C:\Windows\System\JIvoFfK.exe
  2⤵
  PID:14304
- C:\Windows\System\yqWQeoT.exe
  C:\Windows\System\yqWQeoT.exe
  2⤵
  PID:13752
- C:\Windows\System\pezYfqI.exe
  C:\Windows\System\pezYfqI.exe
  2⤵
  PID:13132
- C:\Windows\System\rcuNOXa.exe
  C:\Windows\System\rcuNOXa.exe
  2⤵
  PID:13932
- C:\Windows\System\NtfUjqK.exe
  C:\Windows\System\NtfUjqK.exe
  2⤵
  PID:14324
- C:\Windows\System\xCIORpx.exe
  C:\Windows\System\xCIORpx.exe
  2⤵
  PID:14216
- C:\Windows\System\YVxUxjK.exe
  C:\Windows\System\YVxUxjK.exe
  2⤵
  PID:14308
- C:\Windows\System\nXhIvzI.exe
  C:\Windows\System\nXhIvzI.exe
  2⤵
  PID:14192
- C:\Windows\System\AXqVXOC.exe
  C:\Windows\System\AXqVXOC.exe
  2⤵
  PID:14088
- C:\Windows\System\sruLkWp.exe
  C:\Windows\System\sruLkWp.exe
  2⤵
  PID:14212
- C:\Windows\System\yQFzseu.exe
  C:\Windows\System\yQFzseu.exe
  2⤵
  PID:14684
- C:\Windows\System\djRPMdQ.exe
  C:\Windows\System\djRPMdQ.exe
  2⤵
  PID:14424
- C:\Windows\System\kbrLmma.exe
  C:\Windows\System\kbrLmma.exe
  2⤵
  PID:14456
- C:\Windows\System\ktcHpqf.exe
  C:\Windows\System\ktcHpqf.exe
  2⤵
  PID:14112
- C:\Windows\System\CjCwNIq.exe
  C:\Windows\System\CjCwNIq.exe
  2⤵
  PID:14624
- C:\Windows\System\NSncELW.exe
  C:\Windows\System\NSncELW.exe
  2⤵
  PID:14732
- C:\Windows\System\eDMfAMr.exe
  C:\Windows\System\eDMfAMr.exe
  2⤵
  PID:15140
- C:\Windows\System\CEWgDBM.exe
  C:\Windows\System\CEWgDBM.exe
  2⤵
  PID:14828
- C:\Windows\System\SEnqddH.exe
  C:\Windows\System\SEnqddH.exe
  2⤵
  PID:14880
- C:\Windows\System\FJSHfiS.exe
  C:\Windows\System\FJSHfiS.exe
  2⤵
  PID:15284
- C:\Windows\System\LcqkFcM.exe
  C:\Windows\System\LcqkFcM.exe
  2⤵
  PID:15328
- C:\Windows\System\leTcHbK.exe
  C:\Windows\System\leTcHbK.exe
  2⤵
  PID:15352
- C:\Windows\System\yRZQMVG.exe
  C:\Windows\System\yRZQMVG.exe
  2⤵
  PID:15084
- C:\Windows\System\VjqOiSA.exe
  C:\Windows\System\VjqOiSA.exe
  2⤵
  PID:13552
- C:\Windows\System\OGsFNLS.exe
  C:\Windows\System\OGsFNLS.exe
  2⤵
  PID:14376
- C:\Windows\System\KJIaUGI.exe
  C:\Windows\System\KJIaUGI.exe
  2⤵
  PID:13808
- C:\Windows\System\fcLyJhR.exe
  C:\Windows\System\fcLyJhR.exe
  2⤵
  PID:15276
- C:\Windows\System\GFxxNHs.exe
  C:\Windows\System\GFxxNHs.exe
  2⤵
  PID:15384
- C:\Windows\System\yOJisaH.exe
  C:\Windows\System\yOJisaH.exe
  2⤵
  PID:15412
- C:\Windows\System\FLpZjPU.exe
  C:\Windows\System\FLpZjPU.exe
  2⤵
  PID:15436
- C:\Windows\System\cKWRlGa.exe
  C:\Windows\System\cKWRlGa.exe
  2⤵
  PID:15464
- C:\Windows\System\kLqtnvq.exe
  C:\Windows\System\kLqtnvq.exe
  2⤵
  PID:15488
- C:\Windows\System\bJcvbvi.exe
  C:\Windows\System\bJcvbvi.exe
  2⤵
  PID:15520
- C:\Windows\System\MycaylQ.exe
  C:\Windows\System\MycaylQ.exe
  2⤵
  PID:15536
- C:\Windows\System\xpbCsad.exe
  C:\Windows\System\xpbCsad.exe
  2⤵
  PID:15564
- C:\Windows\System\MeoaqEr.exe
  C:\Windows\System\MeoaqEr.exe
  2⤵
  PID:15584
- C:\Windows\System\ElduJyL.exe
  C:\Windows\System\ElduJyL.exe
  2⤵
  PID:15688
- C:\Windows\System\hkrpZrv.exe
  C:\Windows\System\hkrpZrv.exe
  2⤵
  PID:15720
- C:\Windows\System\FeReXps.exe
  C:\Windows\System\FeReXps.exe
  2⤵
  PID:15756
- C:\Windows\System\HQxbQAs.exe
  C:\Windows\System\HQxbQAs.exe
  2⤵
  PID:15796
- C:\Windows\System\BTKQTVx.exe
  C:\Windows\System\BTKQTVx.exe
  2⤵
  PID:15836
- C:\Windows\System\TASFbPL.exe
  C:\Windows\System\TASFbPL.exe
  2⤵
  PID:15860
- C:\Windows\System\fugfPKs.exe
  C:\Windows\System\fugfPKs.exe
  2⤵
  PID:15892
- C:\Windows\System\igxjoCL.exe
  C:\Windows\System\igxjoCL.exe
  2⤵
  PID:15912
- C:\Windows\System\SARBpmi.exe
  C:\Windows\System\SARBpmi.exe
  2⤵
  PID:15936
- C:\Windows\System\rUuHTmg.exe
  C:\Windows\System\rUuHTmg.exe
  2⤵
  PID:15952
- C:\Windows\System\FCyisnu.exe
  C:\Windows\System\FCyisnu.exe
  2⤵
  PID:15984
- C:\Windows\System\HUkpJQN.exe
  C:\Windows\System\HUkpJQN.exe
  2⤵
  PID:16000
- C:\Windows\System\VyEeqRb.exe
  C:\Windows\System\VyEeqRb.exe
  2⤵
  PID:16024
- C:\Windows\System\GxDPOje.exe
  C:\Windows\System\GxDPOje.exe
  2⤵
  PID:16044
- C:\Windows\System\TVVPiVw.exe
  C:\Windows\System\TVVPiVw.exe
  2⤵
  PID:16072
- C:\Windows\System\YvidgiP.exe
  C:\Windows\System\YvidgiP.exe
  2⤵
  PID:16088
- C:\Windows\System\agORZHR.exe
  C:\Windows\System\agORZHR.exe
  2⤵
  PID:16120
- C:\Windows\System\VXSqBft.exe
  C:\Windows\System\VXSqBft.exe
  2⤵
  PID:16152
- C:\Windows\System\lnjxExX.exe
  C:\Windows\System\lnjxExX.exe
  2⤵
  PID:16176
- C:\Windows\System\XFbVBCL.exe
  C:\Windows\System\XFbVBCL.exe
  2⤵
  PID:16204
- C:\Windows\System\hckUwfG.exe
  C:\Windows\System\hckUwfG.exe
  2⤵
  PID:16224
- C:\Windows\System\AWrvnmO.exe
  C:\Windows\System\AWrvnmO.exe
  2⤵
  PID:16260
- C:\Windows\System\WWdXEMW.exe
  C:\Windows\System\WWdXEMW.exe
  2⤵
  PID:16308
- C:\Windows\System\QZbThZb.exe
  C:\Windows\System\QZbThZb.exe
  2⤵
  PID:16348
- C:\Windows\System\kxtAGfW.exe
  C:\Windows\System\kxtAGfW.exe
  2⤵
  PID:16368
- C:\Windows\System\BxdJeRs.exe
  C:\Windows\System\BxdJeRs.exe
  2⤵
  PID:14600
- C:\Windows\System\oOaHAEP.exe
  C:\Windows\System\oOaHAEP.exe
  2⤵
  PID:13508
- C:\Windows\System\WGGwLvq.exe
  C:\Windows\System\WGGwLvq.exe
  2⤵
  PID:13384
- C:\Windows\System\OmSRpPZ.exe
  C:\Windows\System\OmSRpPZ.exe
  2⤵
  PID:14000
- C:\Windows\System\UjcvhEr.exe
  C:\Windows\System\UjcvhEr.exe
  2⤵
  PID:14276
- C:\Windows\System\QovCObe.exe
  C:\Windows\System\QovCObe.exe
  2⤵
  PID:15256
- C:\Windows\System\yUqgyCf.exe
  C:\Windows\System\yUqgyCf.exe
  2⤵
  PID:15424
- C:\Windows\System\uhMhULU.exe
  C:\Windows\System\uhMhULU.exe
  2⤵
  PID:15448
- C:\Windows\System\NdsjXNV.exe
  C:\Windows\System\NdsjXNV.exe
  2⤵
  PID:15484
- C:\Windows\System\fKCwLSJ.exe
  C:\Windows\System\fKCwLSJ.exe
  2⤵
  PID:14208
- C:\Windows\System\WnrQEmt.exe
  C:\Windows\System\WnrQEmt.exe
  2⤵
  PID:14928
- C:\Windows\System\mqtufZO.exe
  C:\Windows\System\mqtufZO.exe
  2⤵
  PID:15516
- C:\Windows\System\tGNVlHX.exe
  C:\Windows\System\tGNVlHX.exe
  2⤵
  PID:15560
- C:\Windows\System\cxIybIJ.exe
  C:\Windows\System\cxIybIJ.exe
  2⤵
  PID:14792
- C:\Windows\System\QpPbWnQ.exe
  C:\Windows\System\QpPbWnQ.exe
  2⤵
  PID:14952
- C:\Windows\System\fIjSQKd.exe
  C:\Windows\System\fIjSQKd.exe
  2⤵
  PID:15592
- C:\Windows\System\uaicQOp.exe
  C:\Windows\System\uaicQOp.exe
  2⤵
  PID:15600
- C:\Windows\System\aNOZkal.exe
  C:\Windows\System\aNOZkal.exe
  2⤵
  PID:15972
- C:\Windows\System\JOCuEet.exe
  C:\Windows\System\JOCuEet.exe
  2⤵
  PID:16012
- C:\Windows\System\ptSugxQ.exe
  C:\Windows\System\ptSugxQ.exe
  2⤵
  PID:15744
- C:\Windows\System\wWjieEy.exe
  C:\Windows\System\wWjieEy.exe
  2⤵
  PID:15780
- C:\Windows\System\AUhbuQl.exe
  C:\Windows\System\AUhbuQl.exe
  2⤵
  PID:15808
- C:\Windows\System\NkIqyUU.exe
  C:\Windows\System\NkIqyUU.exe
  2⤵
  PID:16016
- C:\Windows\System\iuyxtIk.exe
  C:\Windows\System\iuyxtIk.exe
  2⤵
  PID:16060
- C:\Windows\System\WAaOYPv.exe
  C:\Windows\System\WAaOYPv.exe
  2⤵
  PID:16144
- C:\Windows\System\kdTlHvt.exe
  C:\Windows\System\kdTlHvt.exe
  2⤵
  PID:16296
- C:\Windows\System\DmFrcGl.exe
  C:\Windows\System\DmFrcGl.exe
  2⤵
  PID:15928
- C:\Windows\System\ccNSQKn.exe
  C:\Windows\System\ccNSQKn.exe
  2⤵
  PID:16400
- C:\Windows\System\BLbYmOw.exe
  C:\Windows\System\BLbYmOw.exe
  2⤵
  PID:16432
- C:\Windows\System\KApxrDl.exe
  C:\Windows\System\KApxrDl.exe
  2⤵
  PID:16456
- C:\Windows\System\AhtgxMx.exe
  C:\Windows\System\AhtgxMx.exe
  2⤵
  PID:16476
- C:\Windows\System\VBDYZUz.exe
  C:\Windows\System\VBDYZUz.exe
  2⤵
  PID:16492
- C:\Windows\System\goOEutI.exe
  C:\Windows\System\goOEutI.exe
  2⤵
  PID:16516
- C:\Windows\System\MYAQSJh.exe
  C:\Windows\System\MYAQSJh.exe
  2⤵
  PID:16540
- C:\Windows\System\NKhfLZk.exe
  C:\Windows\System\NKhfLZk.exe
  2⤵
  PID:16560
- C:\Windows\System\UIghBej.exe
  C:\Windows\System\UIghBej.exe
  2⤵
  PID:16576
- C:\Windows\System\NYmhuge.exe
  C:\Windows\System\NYmhuge.exe
  2⤵
  PID:16612
- C:\Windows\System\ABsoUht.exe
  C:\Windows\System\ABsoUht.exe
  2⤵
  PID:16644
- C:\Windows\System\ubfjigY.exe
  C:\Windows\System\ubfjigY.exe
  2⤵
  PID:16676
- C:\Windows\System\eErFkjw.exe
  C:\Windows\System\eErFkjw.exe
  2⤵
  PID:16704
- C:\Windows\System\wLTkTtP.exe
  C:\Windows\System\wLTkTtP.exe
  2⤵
  PID:16736
- C:\Windows\System\TEXeWSp.exe
  C:\Windows\System\TEXeWSp.exe
  2⤵
  PID:16768
- C:\Windows\System\OJoDqeO.exe
  C:\Windows\System\OJoDqeO.exe
  2⤵
  PID:16796
- C:\Windows\System\RaIIHmp.exe
  C:\Windows\System\RaIIHmp.exe
  2⤵
  PID:16824
- C:\Windows\System\BmnVHQY.exe
  C:\Windows\System\BmnVHQY.exe
  2⤵
  PID:16840
- C:\Windows\System\RvKtxhr.exe
  C:\Windows\System\RvKtxhr.exe
  2⤵
  PID:16872
- C:\Windows\System\GBMPgoC.exe
  C:\Windows\System\GBMPgoC.exe
  2⤵
  PID:16896
- C:\Windows\System\lXcYLZi.exe
  C:\Windows\System\lXcYLZi.exe
  2⤵
  PID:16916
- C:\Windows\System\xLAqwes.exe
  C:\Windows\System\xLAqwes.exe
  2⤵
  PID:16944
- C:\Windows\System\ePsltpc.exe
  C:\Windows\System\ePsltpc.exe
  2⤵
  PID:16968
- C:\Windows\System\QIZwkon.exe
  C:\Windows\System\QIZwkon.exe
  2⤵
  PID:17004
- C:\Windows\System\xqPCkJm.exe
  C:\Windows\System\xqPCkJm.exe
  2⤵
  PID:17020
- C:\Windows\System\VBwxVMU.exe
  C:\Windows\System\VBwxVMU.exe
  2⤵
  PID:17052
- C:\Windows\System\dofcIfE.exe
  C:\Windows\System\dofcIfE.exe
  2⤵
  PID:17084
- C:\Windows\System\CLULSVl.exe
  C:\Windows\System\CLULSVl.exe
  2⤵
  PID:17100
- C:\Windows\System\mytEMTE.exe
  C:\Windows\System\mytEMTE.exe
  2⤵
  PID:17140
- C:\Windows\System\wpYSeYm.exe
  C:\Windows\System\wpYSeYm.exe
  2⤵
  PID:17156
- C:\Windows\System\qIKeovc.exe
  C:\Windows\System\qIKeovc.exe
  2⤵
  PID:17188
- C:\Windows\System\tunpsdZ.exe
  C:\Windows\System\tunpsdZ.exe
  2⤵
  PID:17232
- C:\Windows\System\yWEUXoX.exe
  C:\Windows\System\yWEUXoX.exe
  2⤵
  PID:17260
- C:\Windows\System\xUoDLmR.exe
  C:\Windows\System\xUoDLmR.exe
  2⤵
  PID:17276
- C:\Windows\System\PraBVqa.exe
  C:\Windows\System\PraBVqa.exe
  2⤵
  PID:17292
- C:\Windows\System\ijsbPJO.exe
  C:\Windows\System\ijsbPJO.exe
  2⤵
  PID:17328
- C:\Windows\System\DFwiDrb.exe
  C:\Windows\System\DFwiDrb.exe
  2⤵
  PID:17352
- C:\Windows\System\NAztzCK.exe
  C:\Windows\System\NAztzCK.exe
  2⤵
  PID:17372
- C:\Windows\System\BfOwAHV.exe
  C:\Windows\System\BfOwAHV.exe
  2⤵
  PID:17388
- C:\Windows\System\tIHYCqf.exe
  C:\Windows\System\tIHYCqf.exe
  2⤵
  PID:15964
- C:\Windows\System\VwzIxCo.exe
  C:\Windows\System\VwzIxCo.exe
  2⤵
  PID:15672
- C:\Windows\System\tSfJiFp.exe
  C:\Windows\System\tSfJiFp.exe
  2⤵
  PID:16128
- C:\Windows\System\bXJtQuw.exe
  C:\Windows\System\bXJtQuw.exe
  2⤵
  PID:15792
- C:\Windows\System\XFwUlPE.exe
  C:\Windows\System\XFwUlPE.exe
  2⤵
  PID:15512
- C:\Windows\System\CfEaFAo.exe
  C:\Windows\System\CfEaFAo.exe
  2⤵
  PID:16344
- C:\Windows\System\uobtJIR.exe
  C:\Windows\System\uobtJIR.exe
  2⤵
  PID:14700
- C:\Windows\System\ZxcoGJf.exe
  C:\Windows\System\ZxcoGJf.exe
  2⤵
  PID:15596

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AqqAssN.exe

Path C:\Windows\System\AqqAssN.exe
Size 1.6MB
SHA256 18787b1279d31dd372194affbf113bb88db9d888bbb0f42721857c0aacaef3f6
MD5 ec8bb6fafba25023688b6e40811412a2
SHA1 ac9333343b1695b92d49c9d0f08f3375272af5bc
SHA512 e4c24547cce60c1c03c93da210fcacae99490472ebdc8a22e8c09616ca70c9dd7b81067bf32b462fa0df2af0f9eafd01b2fecff37090fe1952de31596d1ebef8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZeli:GemTLkNdfE0pZaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

CMWKCrU.exe

Path C:\Windows\System\CMWKCrU.exe
Size 1.6MB
SHA256 0fcb91fc5716bfb5ff4491546d5a728f873250c9659874379a3ee3f378aecf3b
MD5 56c7939b677b46f9cdd4bd8ac9f90863
SHA1 d64e54b3d73c7ff4020fe424ae819b700e6b877a
SHA512 c3b6115cb9acbc44fc45a0cb61662fe402bfc021d1bc17e5f55dc0f7e57526fa697149fa01ac1fbc7cdb6e84a4d9c809daf6ed3944257ac40160ba0f7cc931e1
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZeld:GemTLkNdfE0pZa+
MD5 SHA1 SHA512 SSDEEP

Submit Download

EeglUZk.exe

Path C:\Windows\System\EeglUZk.exe
Size 1.6MB
SHA256 0f4723d9411b18f9933ea3d7684b1335a4537fb49ddca3d063ae4fb2cdce8c52
MD5 e361a941fc65ef77023b30bc812803ff
SHA1 98c122327b23a11c4671151e9075e9aef757bc72
SHA512 5b9f92d85ef2b4f51d4876d82e0e6b579e4a27f892b95bae32b61a03ba56df4d46cc2d1ac2714e88b22a33bf42bdc86fb59d9447397a0ac0db6af0269d96d14f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelG:GemTLkNdfE0pZal
MD5 SHA1 SHA512 SSDEEP

Submit Download

FYRRwYD.exe

Path C:\Windows\System\FYRRwYD.exe
Size 1.6MB
SHA256 bb499409832423b1e8c5e2a25dab1ac6ed9ca388fa125471db696687d3c1431e
MD5 1948f939ea58df7ae3264685a0a756dd
SHA1 3418feff90933ef60687ca52fb1c71cd3e31d3d4
SHA512 eb4b6f6282fdf503b7e577af58f779b7ba88527c29c105d070ae37d91742fc76b21e353b75d0bb2dd8ab2e4bdd704b834b747f5f2682a16b1d5cddb7e1f54d5f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelz:GemTLkNdfE0pZai
MD5 SHA1 SHA512 SSDEEP

Submit Download

GOqZwfk.exe

Path C:\Windows\System\GOqZwfk.exe
Size 1.6MB
SHA256 a8e4102d84fe8208b4de5bebfe0bff9cf7a791f00ea024c2680d04efe76fad20
MD5 cdc558bd76e2920ec97e91d0451749c1
SHA1 9996b5ec04bef53d48b875ca6ea799e24dd4f913
SHA512 a3ad2f1067169eae504d8dc6027597036f9085835a826218dbf29864c9686f62be93f8a0a0531ffc8bf043936feed3a2b9d6121ff18e20d028dc57d526b42fd8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelL:GemTLkNdfE0pZag
MD5 SHA1 SHA512 SSDEEP

Submit Download

GeeAZfm.exe

Path C:\Windows\System\GeeAZfm.exe
Size 1.6MB
SHA256 f162ef373d1f09fe2d8afcc913ee8a0e5ec2052c61345e26bf3d1f1d9007872f
MD5 6be6305c77a72a656912dea4652f0a57
SHA1 70d9f542d02056849861a76121b34e0658b5919f
SHA512 aad4001a1ac85e9887275cce73694684610d4654f1ab8ada2a67a8d0aa6f5c9e1c85797a7a6a4ad88b862c8d03025a68d5fb03b509e83fa4a870d4f09152ccf4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelE:GemTLkNdfE0pZaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

LEQGOgk.exe

Path C:\Windows\System\LEQGOgk.exe
Size 1.6MB
SHA256 35abd50c61272ae7e90d4befdbe618ad01b381ef7905b093ca9cce0f7ca7faf9
MD5 bb0624e03db15b7c0f0be25b55d1f9b8
SHA1 7292668e982e93d7f624825bc3550572724ea937
SHA512 8e750ab8bd5d527d6c2a849d71774a04ee9d9673668d41ab0b08ce814de4461979234760648c06bf14d1ad8afed4b263421f8378d22977396b650bd165250545
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZel2:GemTLkNdfE0pZaP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MhSLGDl.exe

Path C:\Windows\System\MhSLGDl.exe
Size 1.6MB
SHA256 1b71b3013162a9ec0724819f6d865bbae5b68d5ec017fb6c0c9f7ee33619c188
MD5 23dee27a95e1818a8cb7ec31756615a0
SHA1 c231eb6a40269d3b70aed947683fb8f6f15c3f1c
SHA512 31b7536629b1b4d1c40391afe092164749ad1709f3b87886b0078664157cc9455f22bf4921bf57b1488ae7e06494312b9932be7aed7d446cd7d2061c4dc1c54e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelB:GemTLkNdfE0pZa6
MD5 SHA1 SHA512 SSDEEP

Submit Download

PMnRSlG.exe

Path C:\Windows\System\PMnRSlG.exe
Size 1.6MB
SHA256 f15a0dbbd0a1cf9f3333f58030315783f988954cf13e23c6f75f50b53001c1ad
MD5 24785d4bc54395512cf02d157d5ccf3b
SHA1 302dc53bf27a4e941e80346b6175bd3fcc47bcfd
SHA512 80d7ed6f56d435f515c86da82507256f59c015f6235883c1c425be23d406d7e633c9d38b70e3de4b4e225f2796e01c4d2b351abf7a4c3a103411fc804fe67578
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelB:GemTLkNdfE0pZaq
MD5 SHA1 SHA512 SSDEEP

Submit Download

QqWFpLj.exe

Path C:\Windows\System\QqWFpLj.exe
Size 1.6MB
SHA256 e1214779bd901ac12086c521c987993492eee46511b336f6fc688f27d197161e
MD5 0f8acf6eb477246feb4ff389be25a3e2
SHA1 d64ffd24e52381fb81383a14adb5af5f189ee750
SHA512 ad7269f17eb03e3794d0748a4f9bcb0dde5e1761b9a79a59b2c607fd14e1367fcef465ff50364d19ede7e286f876ab470a278ecbff5a73a393c62757998b121b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelr:GemTLkNdfE0pZaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ShHdPNs.exe

Path C:\Windows\System\ShHdPNs.exe
Size 1.6MB
SHA256 872d7968daa777e278cb21c7c3d47bf8b33e7b88545c310f7ed91e5ea9dfe0de
MD5 f118a381e92759ab6d82dc4aad5809f4
SHA1 8ed38bb58331881fbd6c7e254b28ce1a0475fd16
SHA512 8b9bc84117e04385d5e205875130e3576562c5ee03817b88848059bdad6e22f875bbc4e3a8ef7ac117eac63c9394f709fdb0e0dcb56a7875e661ad4d4c0896b9
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelq:GemTLkNdfE0pZax
MD5 SHA1 SHA512 SSDEEP

Submit Download

VTzUfvm.exe

Path C:\Windows\System\VTzUfvm.exe
Size 1.6MB
SHA256 8c09d7c82347b1e189b909a1a9029aba97460033cc88dec8b6a9e56670ebcbb8
MD5 d565f1b94bead7ab47180d722d628c17
SHA1 3570b184361078c3a8bca2d7284c9156f7616641
SHA512 11dda9c6a69bd1af1e80a57d47a01bc28379952f942d150984e31956f532712ebfece4f6024b8b5ea8057b7bdd747ade99afaaf40c9b683a8b73936552f143c3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelq:GemTLkNdfE0pZat
MD5 SHA1 SHA512 SSDEEP

Submit Download

VsWvXnX.exe

Path C:\Windows\System\VsWvXnX.exe
Size 1.6MB
SHA256 79df44ce7e48a6ea7f8197c972403d0cec239a35c59f7a2c4e2287c7d27ad03b
MD5 0d45556a01821628f37203a992689b4a
SHA1 8ae5e24d72080578431fb4c8b1feba7ae7afb572
SHA512 7c0f2ff787aaa2c41a84f9d88f3cb80c65599564779bd9a6e8ffde12402f795f3e746d1cc1bf41a00ebde420c1c0993c932443b9406fa9c6e58eb600c4e520cf
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelG:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

WTHiMyJ.exe

Path C:\Windows\System\WTHiMyJ.exe
Size 1.6MB
SHA256 33188d1910785adff61ed6de72dcea6a721dc4bd31eaf67ae97ce8dae25855d7
MD5 fd8972f35822b14b65396be1c35ef32a
SHA1 7f6fc2cd9acd3b005a2e1a2486c71b1fcc2e0dca
SHA512 984f743fee3897992792a5e59ed6dc818190b02d45b218817e4ef8300b57d5cd8022b0162c93bf9cd5f0fb676df3e0567579752bf4b6b2a74ae9dad63a9cb590
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelx:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

WZvKuhi.exe

Path C:\Windows\System\WZvKuhi.exe
Size 1.6MB
SHA256 6f790cde16e3a8374924b933a89f5dbbbc8a257218bb37883a339330b8ba834a
MD5 a2d2727304405476dd76baecab77a3f8
SHA1 d6ab8d6eb480653dcb29c8e3d5b55134ca3dac96
SHA512 b8cf3d906b5fa63be7451a87e9f8813de207b26be8814c374249bc408d084dad90b56d7acab0f5cdb25dd3af7263571d47a22ff435cdb4f3e0bdea5be53ac55f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZel/:GemTLkNdfE0pZag
MD5 SHA1 SHA512 SSDEEP

Submit Download

YvQtVOU.exe

Path C:\Windows\System\YvQtVOU.exe
Size 1.6MB
SHA256 dc7f5a0ea88abd5c3f560b4db52390845150934dd0729735e8908d733c1a0f48
MD5 75bd9bb998b7733f55e29ac3447f8f3d
SHA1 a44054b9fc11492cee61d1c9811b278136f2516d
SHA512 5696b8dee4a02e5f25f170d456fbc5edc32df143aa7e44d030f5442d709b4cfa9b4c1171da47d8250a811852a85046ed9677e25cdbaa47d5eda6e5a360254cf6
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelm:GemTLkNdfE0pZaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

bTLpMZz.exe

Path C:\Windows\System\bTLpMZz.exe
Size 1.6MB
SHA256 a7f4a2a6e27770eef86a23452a6efcaa2009872920ac20b84639f321030456fd
MD5 6bcf00866ffc476667fdded38a84e5bc
SHA1 88fed9952b846aa60c0fa6c88deec512423b9a7c
SHA512 5e4ebb143cb7fc0a99bf9a51fc43995496fa174e7003a96eaaca4ce727aa545d1616d6b9be0ab90fb4ed9e089328f95c09ed3a9092d5322951a0ee83fc0f2b1e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelT:GemTLkNdfE0pZae
MD5 SHA1 SHA512 SSDEEP

Submit Download

fpiupdZ.exe

Path C:\Windows\System\fpiupdZ.exe
Size 1.6MB
SHA256 aa6487ea466008d096120a321dc203ec013e1efdfe8b1547716ca5e0b4ced921
MD5 0d831f8e2cbbe459eb21f37d90355f42
SHA1 514ace3484fb68747cf910906239ff7596b719ba
SHA512 f6492925c40a654213f184d599040bafc09ef0195877cce8270f068b2a4133b31ede7feb1900591f11f4954860f0f943c5c40c5331df9af38d26b33e49249920
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelg:GemTLkNdfE0pZat
MD5 SHA1 SHA512 SSDEEP

Submit Download

gObmtpn.exe

Path C:\Windows\System\gObmtpn.exe
Size 1.6MB
SHA256 f83470fd4eb814ee19ad00799ec91fdbca858965021d86e993ef10979a4a2cc6
MD5 e8ff4ce502d0e722fc23a2b8094a65df
SHA1 050df9ccefde1aeaaf0659b3da44d7984b49b60b
SHA512 c28a053899d66777662b6e46e5f2a36daf3d2cfe5cab24d52cefa24c9a9762e482ba7987b107f6190c380d2d5b3e82b4907a5a2216e764287253f12276394383
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelE:GemTLkNdfE0pZat
MD5 SHA1 SHA512 SSDEEP

Submit Download

gcJsMpC.exe

Path C:\Windows\System\gcJsMpC.exe
Size 1.6MB
SHA256 3c4b2d29e2ee90e55a977af0a41f34618deffe343683624666f4c1ebcdd5cedc
MD5 a466f0e1d7117b115c4b0d72162b5f4d
SHA1 1711caf56b8a48703ea59cf4d7272f6caeb0c5d8
SHA512 037097d0a1edeaca292dd6385b95aa8259b7836464945b6cfde1adebbc17d862b31fecad6c196b5148e757b5be5843bfd3fc2610d827d8a6f88e37fcc4220eab
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZel3:GemTLkNdfE0pZa0
MD5 SHA1 SHA512 SSDEEP

Submit Download

hlQkbmH.exe

Path C:\Windows\System\hlQkbmH.exe
Size 1.6MB
SHA256 4eda2439388745502f5c68cf863e0b8077a9f55af9898b8b674a9bbcc82d79df
MD5 4993254bd23f6cc1077bfa3f9a306d50
SHA1 4b2b741fc434822539c8f56529ef7e3d24e36107
SHA512 6fad12602001d85c66b153296c61fbfc83ee54f014aac8c7c9bbab42905bd07f8c35943426aa1c01a7529d192ebe00ba10b68a5819a50b24346e88290c03c1f2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelf:GemTLkNdfE0pZaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

huuyHmf.exe

Path C:\Windows\System\huuyHmf.exe
Size 1.6MB
SHA256 fd4f4e6944a7fd99d7fcba659f746dbce4d9cc635d1a2c988adb624cc6d0e379
MD5 c30219bb1831712c9acbfdf08101e9b2
SHA1 ba93f81c87312c031801c3939ae07752117af112
SHA512 8b84a42a5232ab77493f48094242ad453eca083b4db6678dd0afbdbbef914ce00fcb252ff849780bc68cb4e1ea71e5f81066648bb26de06e7044ee9a18358368
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelo5:GemTLkNdfE0pZab
MD5 SHA1 SHA512 SSDEEP

Submit Download

mniChTz.exe

Path C:\Windows\System\mniChTz.exe
Size 1.6MB
SHA256 eacb5a61e3955cbef4fdf8f2ea93507c006c630527ddeacc7e1e58eafbbd8a08
MD5 460e8ddca6f837c5a03f96c08001fcbc
SHA1 41191332bec69530679444bb8ea272e728192a65
SHA512 972b36818984f4bba05a9261a642ead75fa08ecede4d30afd4e4bb63cef41e0c86c11f93df12a4722eb4c5d4cdcbdd7f632a6f174eb32daec4b8e929498e7a74
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelP:GemTLkNdfE0pZa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

pcpqAeJ.exe

Path C:\Windows\System\pcpqAeJ.exe
Size 1.6MB
SHA256 de345ae24365540e25be2955005efc4cb863aba2f3341a37d77d7311730879cb
MD5 0e45608ecdc12d70d753faa6d56362e9
SHA1 a436392c120f7b6d40b1a779d02d555ecd825b82
SHA512 3e28188917703e02a61586b584ffcc685373c4a0f813789155178f2adf2686d4fc31cfc39f516f51e8dd61ef93263b6cf157f046f53e1dd845608384f8ace22a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelJ:GemTLkNdfE0pZag
MD5 SHA1 SHA512 SSDEEP

Submit Download

pgAYTUd.exe

Path C:\Windows\System\pgAYTUd.exe
Size 1.6MB
SHA256 c84278a63446dd4ae5c4f23ececbd62df77ceb62520f912a4115f48c93864fd8
MD5 32e365840010360fd2ad5f541ff5fa49
SHA1 026412e1ca2967bfcdf154a86fcbd579f70311b9
SHA512 1502a0d6dd20bb0c796cd3ca06ef3f62265744e27c0a5536ee383e45d54a111ba56c4905b17501c4bc9b6b8f609faab9e77073c38cf4dd042335153fa03a4534
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZeld:GemTLkNdfE0pZac
MD5 SHA1 SHA512 SSDEEP

Submit Download

qUDrkCp.exe

Path C:\Windows\System\qUDrkCp.exe
Size 1.6MB
SHA256 2cd6a036cf41acf950a9c491a421041dd3f9e081c2a3ce214b7ad930bef2b064
MD5 eed1a71ca1d716bb8b04072e95794691
SHA1 1123548049b89c73e670400df95c9f847500cc44
SHA512 2125d66f563d44f04174f18749a0f702c97bc4e96e731d9c28dbcc7bb19d48b6bb8502335dfcc44ca048ad4a38f97a69bd2879cfbcff2e7a5d1913744e137ded
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelw:GemTLkNdfE0pZaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

qjhuDxL.exe

Path C:\Windows\System\qjhuDxL.exe
Size 1.6MB
SHA256 9e95868f124fcc092e335334769835f31f28acc75c7b08a2f3902c5adfea12b5
MD5 0454d9418f38151e19f2015e34350416
SHA1 8e4c4cbe84a8c3a4ff768dadd76feaa64ed7de83
SHA512 f6e34bbf6f2d83df05dc66c76df1898f4c8dd304419ec36bcb279f6ea6728e6bd80bdedf38b112322d805d1d3a294ad255a656ffd5ffb34cdaacbf57013da1bd
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZel3:GemTLkNdfE0pZaW
MD5 SHA1 SHA512 SSDEEP

Submit Download

sAhlmSB.exe

Path C:\Windows\System\sAhlmSB.exe
Size 1.6MB
SHA256 ff2dcbb0a0e5fd60ff8dc35a0222d35450332e1aac1e94cb4db09555e8d5ba4d
MD5 1b0eab7b084021ce1374962654facba4
SHA1 a61f9b64f21b3e929cd44d06ca4f95ea92b5dd41
SHA512 7705262ce586749782db67e163dabbc7e4ca24fd7f84fbe2b4a1f07a9919710dd1938d3fa841cc3ab70249327948484e12e485570db09e2fa8a83c3b75ca9604
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelf:GemTLkNdfE0pZaI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tduouJC.exe

Path C:\Windows\System\tduouJC.exe
Size 1.6MB
SHA256 c17275f693a4f5e2a256ecc1ab974a522f875621da32ed46b05e55666fc5c396
MD5 24a327e05c34dfaa0b6d8228ebe2b706
SHA1 530405b9eb7332a954532db6c15299cd32826e11
SHA512 0fcbf221beb0555c53eef1765f51a08221e3f5d629c4684661d13d6b973ebd024202f6ea4561b8bdb9bba3a6ccf97c416cc5f83f52f42c52a72fd537250522b0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelT3:GemTLkNdfE0pZaw
MD5 SHA1 SHA512 SSDEEP

Submit Download

uFbsowF.exe

Path C:\Windows\System\uFbsowF.exe
Size 1.6MB
SHA256 9ed4d89a2f66709514042410bd69b0f23703da25a9ce7ebbed58aba1e167547f
MD5 2b87732644c9be2903eaeb890a69c073
SHA1 cc4f5472bb198fe33274f103343108ab1721f896
SHA512 c3bbc07392fb5157942eeb2633f58767cdbbb984693d93c996d4d827e91f673d04c63735598f03e965429fb71bff9c27557ee86a90a72cfe588b760ab499da73
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZell:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

uaCgeUk.exe

Path C:\Windows\System\uaCgeUk.exe
Size 1.6MB
SHA256 494d37298af5ce3493d6d563c92a0fdda9475d6d5c194c782f13e5980b7b1c7b
MD5 51f07399da8c985d6ca7a60bf7e4effb
SHA1 52e5ff4b6ea791007881190f199d9e09341c3145
SHA512 0e46988061a7cf271fd340d50fd6b07031b4dd8d94d5e0e3af51d9c21576d4fca34b751dd64eb210eb3db2284ec803f35d9696ff883aa0d1eeaf7180d53c75de
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelc:GemTLkNdfE0pZa/
MD5 SHA1 SHA512 SSDEEP

Submit Download

vFHbjAT.exe

Path C:\Windows\System\vFHbjAT.exe
Size 1.6MB
SHA256 bb8ee20a5a34d6053ad216e9ce3e3ed87439c61ec8a80b6200307ddf9d451999
MD5 8c8b08083da7b511465748d2ccabb059
SHA1 f73d6bd21aae585c3af144e29f06d790a9b1a095
SHA512 b55ba02df142a8ae95f9549c88e53c8ad9fb13c7acf714ff409cf6ae5f4c15f7137b22f28365b872518e5944513b9e50ba74aaa16ee838c521e0b95c4cebaa8a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZel4:GemTLkNdfE0pZaR
MD5 SHA1 SHA512 SSDEEP

Submit Download

vQWuynW.exe

Path C:\Windows\System\vQWuynW.exe
Size 1.6MB
SHA256 3f18fc1eee975bbb8918cab0e6cc6ebd8ec6cfeb47467de366b14058e1ed5c2d
MD5 4297d6b67e048df60c3b41843c7635ce
SHA1 900eca0a4178c460d1a8378f0586d27f463fcde1
SHA512 adb0fdfc4eb80679da016d34ee51944625a8d144cb4bcb7f339057ddf21626428fb5b81022af74fb79d3f19dc5c6d6654f5595a2cbd99f42a63fa7904fe5621a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelw:GemTLkNdfE0pZa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

wauhFvo.exe

Path C:\Windows\System\wauhFvo.exe
Size 1.6MB
SHA256 a4853d1870a1befb8b69190260853b4be7e69adaef8e489f8c998ce16dfdbe49
MD5 899919fee042f11cc52a865315ffa34e
SHA1 60c4e1c7b59f363af2a44cb26ee6dba83b85e702
SHA512 269a9ab4791c18b0872524cd6c56bdfffa0224f36f3db4b9f9ae42500c83ed9105731885bc5686837f6cc3e5ab99a0ba1e1a4441266a4cf388f6126009971103
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelo:GemTLkNdfE0pZaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbpRgNZ.exe

Path C:\Windows\System\wbpRgNZ.exe
Size 1.6MB
SHA256 ed34ad7b48638cec1baf75a6bab0e34786a93930b8740db78e15c2ac034c8db8
MD5 9f9b52bb6df321a03b69bf688e45e603
SHA1 0747d0b7c781a208b6ffd63c64994ba4e469ea21
SHA512 1a0439d782b86b990b2843274ef0fd5022a4a26b70754d937b651790e6bd15572c5e8bfa0eb17fa0bc993472749d759fe068cdcca62726c85a1bb27ab6558a24
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1yZ50b6WjZelg:GemTLkNdfE0pZa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1208-0-0x0000029EE45B0000-0x0000029EE45C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads