xmrig | ed68a26afae1fc3f5ab0754833ed168478d20dddb3de15369c9a6ac70a407630

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
Size 1.7MB
Sample240614-k4cydatenh
SHA256 ed68a26afae1fc3f5ab0754833ed168478d20dddb3de15369c9a6ac70a407630
MD5 b3425fba57c033ce92bb146c0c764280
SHA1 904c3d402d01cd63f960c21ca6a0d84605117fb4
SHA512 d67c6986fd21db440f83e42f1730147c1812e325962c07201cf83a186fcf5f77fc5eb3f691dc933cad9001f6e4f805cbafcbca3d33606d2a358d9bdfdc62f4ad
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE56:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000900000002351c-4.dat	xmrig
behavioral2/files/0x0007000000023523-12.dat	xmrig
behavioral2/files/0x0007000000023524-15.dat	xmrig
behavioral2/files/0x0007000000023525-19.dat	xmrig
behavioral2/files/0x0007000000023526-22.dat	xmrig
behavioral2/files/0x0007000000023527-29.dat	xmrig
behavioral2/files/0x0007000000023528-35.dat	xmrig
behavioral2/files/0x0008000000023520-39.dat	xmrig
behavioral2/files/0x0007000000023529-44.dat	xmrig
behavioral2/files/0x000700000002352a-49.dat	xmrig
behavioral2/files/0x000700000002352b-54.dat	xmrig
behavioral2/files/0x0007000000023532-89.dat	xmrig
behavioral2/files/0x0007000000023537-111.dat	xmrig
behavioral2/files/0x0007000000023541-161.dat	xmrig
behavioral2/files/0x000700000002353f-159.dat	xmrig
behavioral2/files/0x0007000000023540-156.dat	xmrig
behavioral2/files/0x000700000002353e-151.dat	xmrig
behavioral2/files/0x000700000002353d-147.dat	xmrig
behavioral2/files/0x000700000002353c-142.dat	xmrig
behavioral2/files/0x000700000002353b-137.dat	xmrig
behavioral2/files/0x000700000002353a-132.dat	xmrig
behavioral2/files/0x0007000000023539-126.dat	xmrig
behavioral2/files/0x0007000000023538-122.dat	xmrig
behavioral2/files/0x0007000000023536-112.dat	xmrig
behavioral2/files/0x0007000000023535-106.dat	xmrig
behavioral2/files/0x0007000000023534-102.dat	xmrig
behavioral2/files/0x0007000000023533-94.dat	xmrig
behavioral2/files/0x0007000000023531-84.dat	xmrig
behavioral2/files/0x0007000000023530-79.dat	xmrig
behavioral2/files/0x000700000002352f-74.dat	xmrig
behavioral2/files/0x000700000002352e-69.dat	xmrig
behavioral2/files/0x000700000002352d-64.dat	xmrig
behavioral2/files/0x000700000002352c-59.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3908	XWQUriP.exe
2128	NYeMzWd.exe
1012	fbdIFrq.exe
3904	PzeajJx.exe
4684	vFZFlxo.exe
2604	irQhgtc.exe
3400	ijrtoZx.exe
1380	ENDGbcw.exe
532	vgljJrZ.exe
1572	yApBzFn.exe
2912	PCMHlrX.exe
2272	sILTyYY.exe
2788	USUdXfc.exe
1332	KHjdVsZ.exe
1052	mjdDZKt.exe
4252	elthXej.exe
2532	WrUrZqX.exe
1644	JyQmfqi.exe
3952	leJViLu.exe
4276	mlPrHqP.exe
4888	TnKPzHs.exe
2492	NalRaSr.exe
3876	fchOOhW.exe
920	rvwwgzX.exe
116	IDBReRV.exe
1668	iYfnNtl.exe
1220	wtgmZOi.exe
1100	XviLxpr.exe
4040	fyrzpLb.exe
4344	enVQKKp.exe
1400	naMdIQz.exe
3212	TLWAEgu.exe
3980	kZRdcly.exe
5044	yrqLeSy.exe
1468	ryuHxpT.exe
5116	MucSDkD.exe
1844	bQgJfwv.exe
4640	PRDSzBP.exe
4300	dQFjKGC.exe
1568	HgqDapn.exe
1360	dPKTtvM.exe
2364	CYJtyVC.exe
2076	mLRpIFy.exe
3024	NkpRsNP.exe
3120	gOaQGmf.exe
4680	nMdUnnX.exe
1384	wXVHcuT.exe
3656	kGBCOQO.exe
3596	rORcfZu.exe
2020	rObLYHm.exe
4176	oaqravb.exe
5144	sJNdRWR.exe
5172	jkpKwoF.exe
5200	CgYeuCF.exe
5232	SngCSci.exe
5260	HKCiqZx.exe
5288	EDgpujO.exe
5312	pmZKxGh.exe
5344	aSzeNZf.exe
5372	WEfibqj.exe
5396	ZDlxHCq.exe
5424	MOciJvL.exe
5452	ifNltUE.exe
5480	aSFZhwv.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ejkjWac.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\lOCzKtY.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\zFjqSKh.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\oyZizCz.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\ZgRXOud.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\EQHWkdO.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\KYngJeP.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\skYIMXN.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\liquaVT.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\msgXdTG.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\WTFzGad.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\ECCXoeR.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\hORwkXJ.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\CDeCNwo.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\GEcRpFF.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\HZGXoxu.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\PZMlKNX.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\mlPrHqP.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\giqBgjb.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\GIkRpUx.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\seBVomz.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\kpNbIDr.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\xRaeakk.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\okAWfFg.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\smxoPbR.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\yOYTYAY.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\iXOVmJA.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\EdNvydq.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\zOJObWj.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\ZDlxHCq.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\lytGNCl.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\udMlyCN.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\adUKmTN.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\XkKaiuN.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\MxpDeOT.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\xNyEUSN.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\klWSfeI.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\TqnJxNf.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\WkuYfKj.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\zPPETbj.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\nmVgrad.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\FkwiQqm.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\JeBYVRd.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\tDFlCqn.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\mneKChl.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\ZledxWg.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\AwWNNXA.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\QaFNKKo.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\qLvvxsS.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\wOKMvnC.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\JZaGQnC.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\VJgrNMM.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\qhwrGTo.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\fvZYKFJ.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\wQRddmx.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\yTRgXAj.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\yKsJxQo.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\lqcgkvI.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\eFTzBam.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\QjQEuEj.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\qPigrTl.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\qynlBuk.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\OGSOSgV.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
File created	C:\Windows\System\WdPSsBZ.exe	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16504	dwm.exe
Token: SeChangeNotifyPrivilege	16504	dwm.exe
Token: 33	16504	dwm.exe
Token: SeIncBasePriorityPrivilege	16504	dwm.exe
Token: SeShutdownPrivilege	16504	dwm.exe
Token: SeCreatePagefilePrivilege	16504	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 3908	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	91
PID 1952 wrote to memory of 3908	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	91
PID 1952 wrote to memory of 2128	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	92
PID 1952 wrote to memory of 2128	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	92
PID 1952 wrote to memory of 1012	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	93
PID 1952 wrote to memory of 1012	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	93
PID 1952 wrote to memory of 3904	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	94
PID 1952 wrote to memory of 3904	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	94
PID 1952 wrote to memory of 4684	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	95
PID 1952 wrote to memory of 4684	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	95
PID 1952 wrote to memory of 2604	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	96
PID 1952 wrote to memory of 2604	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	96
PID 1952 wrote to memory of 3400	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	99
PID 1952 wrote to memory of 3400	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	99
PID 1952 wrote to memory of 1380	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	101
PID 1952 wrote to memory of 1380	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	101
PID 1952 wrote to memory of 532	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	102
PID 1952 wrote to memory of 532	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	102
PID 1952 wrote to memory of 1572	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	103
PID 1952 wrote to memory of 1572	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	103
PID 1952 wrote to memory of 2912	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	104
PID 1952 wrote to memory of 2912	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	104
PID 1952 wrote to memory of 2272	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	105
PID 1952 wrote to memory of 2272	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	105
PID 1952 wrote to memory of 2788	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	106
PID 1952 wrote to memory of 2788	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	106
PID 1952 wrote to memory of 1332	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	107
PID 1952 wrote to memory of 1332	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	107
PID 1952 wrote to memory of 1052	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	108
PID 1952 wrote to memory of 1052	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	108
PID 1952 wrote to memory of 4252	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	109
PID 1952 wrote to memory of 4252	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	109
PID 1952 wrote to memory of 2532	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	110
PID 1952 wrote to memory of 2532	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	110
PID 1952 wrote to memory of 1644	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	111
PID 1952 wrote to memory of 1644	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	111
PID 1952 wrote to memory of 3952	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	112
PID 1952 wrote to memory of 3952	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	112
PID 1952 wrote to memory of 4276	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	113
PID 1952 wrote to memory of 4276	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	113
PID 1952 wrote to memory of 4888	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	114
PID 1952 wrote to memory of 4888	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	114
PID 1952 wrote to memory of 2492	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	115
PID 1952 wrote to memory of 2492	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	115
PID 1952 wrote to memory of 3876	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	116
PID 1952 wrote to memory of 3876	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	116
PID 1952 wrote to memory of 920	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	117
PID 1952 wrote to memory of 920	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	117
PID 1952 wrote to memory of 116	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	118
PID 1952 wrote to memory of 116	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	118
PID 1952 wrote to memory of 1668	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	119
PID 1952 wrote to memory of 1668	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	119
PID 1952 wrote to memory of 1220	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	120
PID 1952 wrote to memory of 1220	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	120
PID 1952 wrote to memory of 1100	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	121
PID 1952 wrote to memory of 1100	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	121
PID 1952 wrote to memory of 4040	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	122
PID 1952 wrote to memory of 4040	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	122
PID 1952 wrote to memory of 4344	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	123
PID 1952 wrote to memory of 4344	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	123
PID 1952 wrote to memory of 1400	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	124
PID 1952 wrote to memory of 1400	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	124
PID 1952 wrote to memory of 3212	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	125
PID 1952 wrote to memory of 3212	1952	b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe	125

C:\Users\Admin\AppData\Local\Temp\b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b3425fba57c033ce92bb146c0c764280_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\System\XWQUriP.exe
  C:\Windows\System\XWQUriP.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\NYeMzWd.exe
  C:\Windows\System\NYeMzWd.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\fbdIFrq.exe
  C:\Windows\System\fbdIFrq.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\PzeajJx.exe
  C:\Windows\System\PzeajJx.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\vFZFlxo.exe
  C:\Windows\System\vFZFlxo.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\irQhgtc.exe
  C:\Windows\System\irQhgtc.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\ijrtoZx.exe
  C:\Windows\System\ijrtoZx.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\ENDGbcw.exe
  C:\Windows\System\ENDGbcw.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\vgljJrZ.exe
  C:\Windows\System\vgljJrZ.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\yApBzFn.exe
  C:\Windows\System\yApBzFn.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\PCMHlrX.exe
  C:\Windows\System\PCMHlrX.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\sILTyYY.exe
  C:\Windows\System\sILTyYY.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\USUdXfc.exe
  C:\Windows\System\USUdXfc.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\KHjdVsZ.exe
  C:\Windows\System\KHjdVsZ.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\mjdDZKt.exe
  C:\Windows\System\mjdDZKt.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\elthXej.exe
  C:\Windows\System\elthXej.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\WrUrZqX.exe
  C:\Windows\System\WrUrZqX.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\JyQmfqi.exe
  C:\Windows\System\JyQmfqi.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\leJViLu.exe
  C:\Windows\System\leJViLu.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\mlPrHqP.exe
  C:\Windows\System\mlPrHqP.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\TnKPzHs.exe
  C:\Windows\System\TnKPzHs.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\NalRaSr.exe
  C:\Windows\System\NalRaSr.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\fchOOhW.exe
  C:\Windows\System\fchOOhW.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\rvwwgzX.exe
  C:\Windows\System\rvwwgzX.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\IDBReRV.exe
  C:\Windows\System\IDBReRV.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\iYfnNtl.exe
  C:\Windows\System\iYfnNtl.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\wtgmZOi.exe
  C:\Windows\System\wtgmZOi.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\XviLxpr.exe
  C:\Windows\System\XviLxpr.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\fyrzpLb.exe
  C:\Windows\System\fyrzpLb.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\enVQKKp.exe
  C:\Windows\System\enVQKKp.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\naMdIQz.exe
  C:\Windows\System\naMdIQz.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\TLWAEgu.exe
  C:\Windows\System\TLWAEgu.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\kZRdcly.exe
  C:\Windows\System\kZRdcly.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\yrqLeSy.exe
  C:\Windows\System\yrqLeSy.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\ryuHxpT.exe
  C:\Windows\System\ryuHxpT.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\MucSDkD.exe
  C:\Windows\System\MucSDkD.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\bQgJfwv.exe
  C:\Windows\System\bQgJfwv.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\PRDSzBP.exe
  C:\Windows\System\PRDSzBP.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\dQFjKGC.exe
  C:\Windows\System\dQFjKGC.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\HgqDapn.exe
  C:\Windows\System\HgqDapn.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\dPKTtvM.exe
  C:\Windows\System\dPKTtvM.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\CYJtyVC.exe
  C:\Windows\System\CYJtyVC.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\mLRpIFy.exe
  C:\Windows\System\mLRpIFy.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\NkpRsNP.exe
  C:\Windows\System\NkpRsNP.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\gOaQGmf.exe
  C:\Windows\System\gOaQGmf.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\nMdUnnX.exe
  C:\Windows\System\nMdUnnX.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\wXVHcuT.exe
  C:\Windows\System\wXVHcuT.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\kGBCOQO.exe
  C:\Windows\System\kGBCOQO.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\rORcfZu.exe
  C:\Windows\System\rORcfZu.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\rObLYHm.exe
  C:\Windows\System\rObLYHm.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\oaqravb.exe
  C:\Windows\System\oaqravb.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\sJNdRWR.exe
  C:\Windows\System\sJNdRWR.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\jkpKwoF.exe
  C:\Windows\System\jkpKwoF.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\System\CgYeuCF.exe
  C:\Windows\System\CgYeuCF.exe
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\Windows\System\SngCSci.exe
  C:\Windows\System\SngCSci.exe
  2⤵
  - Executes dropped EXE
  PID:5232
- C:\Windows\System\HKCiqZx.exe
  C:\Windows\System\HKCiqZx.exe
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Windows\System\EDgpujO.exe
  C:\Windows\System\EDgpujO.exe
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Windows\System\pmZKxGh.exe
  C:\Windows\System\pmZKxGh.exe
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Windows\System\aSzeNZf.exe
  C:\Windows\System\aSzeNZf.exe
  2⤵
  - Executes dropped EXE
  PID:5344
- C:\Windows\System\WEfibqj.exe
  C:\Windows\System\WEfibqj.exe
  2⤵
  - Executes dropped EXE
  PID:5372
- C:\Windows\System\ZDlxHCq.exe
  C:\Windows\System\ZDlxHCq.exe
  2⤵
  - Executes dropped EXE
  PID:5396
- C:\Windows\System\MOciJvL.exe
  C:\Windows\System\MOciJvL.exe
  2⤵
  - Executes dropped EXE
  PID:5424
- C:\Windows\System\ifNltUE.exe
  C:\Windows\System\ifNltUE.exe
  2⤵
  - Executes dropped EXE
  PID:5452
- C:\Windows\System\aSFZhwv.exe
  C:\Windows\System\aSFZhwv.exe
  2⤵
  - Executes dropped EXE
  PID:5480
- C:\Windows\System\uUTqYxZ.exe
  C:\Windows\System\uUTqYxZ.exe
  2⤵
  PID:5512
- C:\Windows\System\iIFefQS.exe
  C:\Windows\System\iIFefQS.exe
  2⤵
  PID:5536
- C:\Windows\System\vHHqvWb.exe
  C:\Windows\System\vHHqvWb.exe
  2⤵
  PID:5564
- C:\Windows\System\WTmDyZU.exe
  C:\Windows\System\WTmDyZU.exe
  2⤵
  PID:5628
- C:\Windows\System\RTjIeAg.exe
  C:\Windows\System\RTjIeAg.exe
  2⤵
  PID:5644
- C:\Windows\System\ZwjESSD.exe
  C:\Windows\System\ZwjESSD.exe
  2⤵
  PID:5660
- C:\Windows\System\UtYUbvR.exe
  C:\Windows\System\UtYUbvR.exe
  2⤵
  PID:5688
- C:\Windows\System\Pyaihzn.exe
  C:\Windows\System\Pyaihzn.exe
  2⤵
  PID:5716
- C:\Windows\System\BptlmSv.exe
  C:\Windows\System\BptlmSv.exe
  2⤵
  PID:5744
- C:\Windows\System\vnlDwnU.exe
  C:\Windows\System\vnlDwnU.exe
  2⤵
  PID:5772
- C:\Windows\System\KzlGMsr.exe
  C:\Windows\System\KzlGMsr.exe
  2⤵
  PID:5796
- C:\Windows\System\GtPnZSL.exe
  C:\Windows\System\GtPnZSL.exe
  2⤵
  PID:5824
- C:\Windows\System\skYIMXN.exe
  C:\Windows\System\skYIMXN.exe
  2⤵
  PID:5852
- C:\Windows\System\uPqlqAO.exe
  C:\Windows\System\uPqlqAO.exe
  2⤵
  PID:5880
- C:\Windows\System\tDFlCqn.exe
  C:\Windows\System\tDFlCqn.exe
  2⤵
  PID:5912
- C:\Windows\System\uqhIEBH.exe
  C:\Windows\System\uqhIEBH.exe
  2⤵
  PID:5940
- C:\Windows\System\rDlmvIq.exe
  C:\Windows\System\rDlmvIq.exe
  2⤵
  PID:5968
- C:\Windows\System\aBYvCTn.exe
  C:\Windows\System\aBYvCTn.exe
  2⤵
  PID:5992
- C:\Windows\System\ketjVUI.exe
  C:\Windows\System\ketjVUI.exe
  2⤵
  PID:6016
- C:\Windows\System\ddrUZCh.exe
  C:\Windows\System\ddrUZCh.exe
  2⤵
  PID:6044
- C:\Windows\System\cvgLXcW.exe
  C:\Windows\System\cvgLXcW.exe
  2⤵
  PID:6072
- C:\Windows\System\mZnpEZq.exe
  C:\Windows\System\mZnpEZq.exe
  2⤵
  PID:6100
- C:\Windows\System\slCsTmj.exe
  C:\Windows\System\slCsTmj.exe
  2⤵
  PID:6124
- C:\Windows\System\qfwaxlV.exe
  C:\Windows\System\qfwaxlV.exe
  2⤵
  PID:1916
- C:\Windows\System\QngZcIV.exe
  C:\Windows\System\QngZcIV.exe
  2⤵
  PID:912
- C:\Windows\System\scdIGnX.exe
  C:\Windows\System\scdIGnX.exe
  2⤵
  PID:4356
- C:\Windows\System\xFnQAXe.exe
  C:\Windows\System\xFnQAXe.exe
  2⤵
  PID:3932
- C:\Windows\System\cbyONKc.exe
  C:\Windows\System\cbyONKc.exe
  2⤵
  PID:2588
- C:\Windows\System\sjwRZRc.exe
  C:\Windows\System\sjwRZRc.exe
  2⤵
  PID:5164
- C:\Windows\System\GuECgtE.exe
  C:\Windows\System\GuECgtE.exe
  2⤵
  PID:5240
- C:\Windows\System\tEuBiah.exe
  C:\Windows\System\tEuBiah.exe
  2⤵
  PID:5308
- C:\Windows\System\fKzlLlV.exe
  C:\Windows\System\fKzlLlV.exe
  2⤵
  PID:5364
- C:\Windows\System\ZkrmIvw.exe
  C:\Windows\System\ZkrmIvw.exe
  2⤵
  PID:5436
- C:\Windows\System\VSFOeTt.exe
  C:\Windows\System\VSFOeTt.exe
  2⤵
  PID:5500
- C:\Windows\System\WdPSsBZ.exe
  C:\Windows\System\WdPSsBZ.exe
  2⤵
  PID:5556
- C:\Windows\System\toigVTe.exe
  C:\Windows\System\toigVTe.exe
  2⤵
  PID:5636
- C:\Windows\System\hjwAHVx.exe
  C:\Windows\System\hjwAHVx.exe
  2⤵
  PID:5700
- C:\Windows\System\UUVWgUx.exe
  C:\Windows\System\UUVWgUx.exe
  2⤵
  PID:5756
- C:\Windows\System\QmHAuIf.exe
  C:\Windows\System\QmHAuIf.exe
  2⤵
  PID:5816
- C:\Windows\System\xghwswD.exe
  C:\Windows\System\xghwswD.exe
  2⤵
  PID:5876
- C:\Windows\System\zNyQbwL.exe
  C:\Windows\System\zNyQbwL.exe
  2⤵
  PID:5952
- C:\Windows\System\cBuvSlZ.exe
  C:\Windows\System\cBuvSlZ.exe
  2⤵
  PID:6008
- C:\Windows\System\SxILtMx.exe
  C:\Windows\System\SxILtMx.exe
  2⤵
  PID:6080
- C:\Windows\System\flWgAvz.exe
  C:\Windows\System\flWgAvz.exe
  2⤵
  PID:6140
- C:\Windows\System\TIbhLax.exe
  C:\Windows\System\TIbhLax.exe
  2⤵
  PID:2960
- C:\Windows\System\YEdClXK.exe
  C:\Windows\System\YEdClXK.exe
  2⤵
  PID:5132
- C:\Windows\System\aJwigZQ.exe
  C:\Windows\System\aJwigZQ.exe
  2⤵
  PID:5276
- C:\Windows\System\VgnNecg.exe
  C:\Windows\System\VgnNecg.exe
  2⤵
  PID:5408
- C:\Windows\System\CXNugas.exe
  C:\Windows\System\CXNugas.exe
  2⤵
  PID:5532
- C:\Windows\System\nPLhnDU.exe
  C:\Windows\System\nPLhnDU.exe
  2⤵
  PID:5728
- C:\Windows\System\RhuWJUO.exe
  C:\Windows\System\RhuWJUO.exe
  2⤵
  PID:6148
- C:\Windows\System\argJqOD.exe
  C:\Windows\System\argJqOD.exe
  2⤵
  PID:6176
- C:\Windows\System\yIlaNvN.exe
  C:\Windows\System\yIlaNvN.exe
  2⤵
  PID:6204
- C:\Windows\System\ZBMPIIQ.exe
  C:\Windows\System\ZBMPIIQ.exe
  2⤵
  PID:6232
- C:\Windows\System\kpNiQuB.exe
  C:\Windows\System\kpNiQuB.exe
  2⤵
  PID:6260
- C:\Windows\System\JxCSXbE.exe
  C:\Windows\System\JxCSXbE.exe
  2⤵
  PID:6288
- C:\Windows\System\JjYoNTH.exe
  C:\Windows\System\JjYoNTH.exe
  2⤵
  PID:6316
- C:\Windows\System\YusKcGZ.exe
  C:\Windows\System\YusKcGZ.exe
  2⤵
  PID:6344
- C:\Windows\System\QjPPLJp.exe
  C:\Windows\System\QjPPLJp.exe
  2⤵
  PID:6372
- C:\Windows\System\ngXTQMh.exe
  C:\Windows\System\ngXTQMh.exe
  2⤵
  PID:6400
- C:\Windows\System\UzqvzFb.exe
  C:\Windows\System\UzqvzFb.exe
  2⤵
  PID:6428
- C:\Windows\System\fFEqdTw.exe
  C:\Windows\System\fFEqdTw.exe
  2⤵
  PID:6456
- C:\Windows\System\xSJdOBq.exe
  C:\Windows\System\xSJdOBq.exe
  2⤵
  PID:6484
- C:\Windows\System\ntbUCOY.exe
  C:\Windows\System\ntbUCOY.exe
  2⤵
  PID:6512
- C:\Windows\System\RKozPee.exe
  C:\Windows\System\RKozPee.exe
  2⤵
  PID:6540
- C:\Windows\System\dOgvPJK.exe
  C:\Windows\System\dOgvPJK.exe
  2⤵
  PID:6568
- C:\Windows\System\oczTCOJ.exe
  C:\Windows\System\oczTCOJ.exe
  2⤵
  PID:6596
- C:\Windows\System\ymQJnTL.exe
  C:\Windows\System\ymQJnTL.exe
  2⤵
  PID:6624
- C:\Windows\System\AbUHUzk.exe
  C:\Windows\System\AbUHUzk.exe
  2⤵
  PID:6652
- C:\Windows\System\ABAsmgg.exe
  C:\Windows\System\ABAsmgg.exe
  2⤵
  PID:6680
- C:\Windows\System\PLuAoSb.exe
  C:\Windows\System\PLuAoSb.exe
  2⤵
  PID:6712
- C:\Windows\System\oRZRfNn.exe
  C:\Windows\System\oRZRfNn.exe
  2⤵
  PID:6736
- C:\Windows\System\fmSEFTc.exe
  C:\Windows\System\fmSEFTc.exe
  2⤵
  PID:6764
- C:\Windows\System\ulggOxi.exe
  C:\Windows\System\ulggOxi.exe
  2⤵
  PID:6792
- C:\Windows\System\QytYLBo.exe
  C:\Windows\System\QytYLBo.exe
  2⤵
  PID:6820
- C:\Windows\System\PVVARVC.exe
  C:\Windows\System\PVVARVC.exe
  2⤵
  PID:6848
- C:\Windows\System\yxYHtyo.exe
  C:\Windows\System\yxYHtyo.exe
  2⤵
  PID:6876
- C:\Windows\System\feOxBFD.exe
  C:\Windows\System\feOxBFD.exe
  2⤵
  PID:6904
- C:\Windows\System\lbiZxjz.exe
  C:\Windows\System\lbiZxjz.exe
  2⤵
  PID:6932
- C:\Windows\System\tZhnWjE.exe
  C:\Windows\System\tZhnWjE.exe
  2⤵
  PID:6960
- C:\Windows\System\EuQtOTH.exe
  C:\Windows\System\EuQtOTH.exe
  2⤵
  PID:6988
- C:\Windows\System\CxQtVrl.exe
  C:\Windows\System\CxQtVrl.exe
  2⤵
  PID:7016
- C:\Windows\System\UjUrVYw.exe
  C:\Windows\System\UjUrVYw.exe
  2⤵
  PID:7044
- C:\Windows\System\lMQhNgC.exe
  C:\Windows\System\lMQhNgC.exe
  2⤵
  PID:7072
- C:\Windows\System\zICGmxZ.exe
  C:\Windows\System\zICGmxZ.exe
  2⤵
  PID:7100
- C:\Windows\System\LgJGdBo.exe
  C:\Windows\System\LgJGdBo.exe
  2⤵
  PID:7128
- C:\Windows\System\mqbyBJT.exe
  C:\Windows\System\mqbyBJT.exe
  2⤵
  PID:7156
- C:\Windows\System\DsfyvHR.exe
  C:\Windows\System\DsfyvHR.exe
  2⤵
  PID:5928
- C:\Windows\System\hvcrtxw.exe
  C:\Windows\System\hvcrtxw.exe
  2⤵
  PID:6108
- C:\Windows\System\EhKfrph.exe
  C:\Windows\System\EhKfrph.exe
  2⤵
  PID:1368
- C:\Windows\System\IHNgQoU.exe
  C:\Windows\System\IHNgQoU.exe
  2⤵
  PID:3504
- C:\Windows\System\gnrJzsU.exe
  C:\Windows\System\gnrJzsU.exe
  2⤵
  PID:5784
- C:\Windows\System\qeVZlQe.exe
  C:\Windows\System\qeVZlQe.exe
  2⤵
  PID:6192
- C:\Windows\System\FggBAxa.exe
  C:\Windows\System\FggBAxa.exe
  2⤵
  PID:6252
- C:\Windows\System\jmSJKua.exe
  C:\Windows\System\jmSJKua.exe
  2⤵
  PID:6328
- C:\Windows\System\lOCzKtY.exe
  C:\Windows\System\lOCzKtY.exe
  2⤵
  PID:6384
- C:\Windows\System\icWtGbM.exe
  C:\Windows\System\icWtGbM.exe
  2⤵
  PID:6444
- C:\Windows\System\nXThKJd.exe
  C:\Windows\System\nXThKJd.exe
  2⤵
  PID:6500
- C:\Windows\System\PBDQWoU.exe
  C:\Windows\System\PBDQWoU.exe
  2⤵
  PID:6560
- C:\Windows\System\TlCThEg.exe
  C:\Windows\System\TlCThEg.exe
  2⤵
  PID:6636
- C:\Windows\System\ajrSylp.exe
  C:\Windows\System\ajrSylp.exe
  2⤵
  PID:4492
- C:\Windows\System\dDIeLxy.exe
  C:\Windows\System\dDIeLxy.exe
  2⤵
  PID:6752
- C:\Windows\System\fgOnxZD.exe
  C:\Windows\System\fgOnxZD.exe
  2⤵
  PID:6804
- C:\Windows\System\Vumhiqj.exe
  C:\Windows\System\Vumhiqj.exe
  2⤵
  PID:6864
- C:\Windows\System\FesCTKS.exe
  C:\Windows\System\FesCTKS.exe
  2⤵
  PID:6924
- C:\Windows\System\ovindMP.exe
  C:\Windows\System\ovindMP.exe
  2⤵
  PID:7000
- C:\Windows\System\QMGpbTk.exe
  C:\Windows\System\QMGpbTk.exe
  2⤵
  PID:7060
- C:\Windows\System\sFwjaTT.exe
  C:\Windows\System\sFwjaTT.exe
  2⤵
  PID:7120
- C:\Windows\System\gzGNxNo.exe
  C:\Windows\System\gzGNxNo.exe
  2⤵
  PID:5868
- C:\Windows\System\obqdthh.exe
  C:\Windows\System\obqdthh.exe
  2⤵
  PID:3184
- C:\Windows\System\rTbNexk.exe
  C:\Windows\System\rTbNexk.exe
  2⤵
  PID:2228
- C:\Windows\System\NkYqlEw.exe
  C:\Windows\System\NkYqlEw.exe
  2⤵
  PID:3452
- C:\Windows\System\dAiBeAB.exe
  C:\Windows\System\dAiBeAB.exe
  2⤵
  PID:3964
- C:\Windows\System\GGKJunj.exe
  C:\Windows\System\GGKJunj.exe
  2⤵
  PID:6476
- C:\Windows\System\gBRohEq.exe
  C:\Windows\System\gBRohEq.exe
  2⤵
  PID:6664
- C:\Windows\System\rgYbFHP.exe
  C:\Windows\System\rgYbFHP.exe
  2⤵
  PID:6720
- C:\Windows\System\yOnRGlD.exe
  C:\Windows\System\yOnRGlD.exe
  2⤵
  PID:6972
- C:\Windows\System\wOKMvnC.exe
  C:\Windows\System\wOKMvnC.exe
  2⤵
  PID:5028
- C:\Windows\System\CxvKbyr.exe
  C:\Windows\System\CxvKbyr.exe
  2⤵
  PID:3608
- C:\Windows\System\RpgMsYc.exe
  C:\Windows\System\RpgMsYc.exe
  2⤵
  PID:6036
- C:\Windows\System\yTRgXAj.exe
  C:\Windows\System\yTRgXAj.exe
  2⤵
  PID:2132
- C:\Windows\System\qAaNvpn.exe
  C:\Windows\System\qAaNvpn.exe
  2⤵
  PID:6280
- C:\Windows\System\UyHLIbZ.exe
  C:\Windows\System\UyHLIbZ.exe
  2⤵
  PID:6164
- C:\Windows\System\MHwofLv.exe
  C:\Windows\System\MHwofLv.exe
  2⤵
  PID:4968
- C:\Windows\System\SEGdjPB.exe
  C:\Windows\System\SEGdjPB.exe
  2⤵
  PID:452
- C:\Windows\System\nLwSywM.exe
  C:\Windows\System\nLwSywM.exe
  2⤵
  PID:7028
- C:\Windows\System\hCrNVID.exe
  C:\Windows\System\hCrNVID.exe
  2⤵
  PID:4224
- C:\Windows\System\uOwOvMB.exe
  C:\Windows\System\uOwOvMB.exe
  2⤵
  PID:368
- C:\Windows\System\AfRmIRe.exe
  C:\Windows\System\AfRmIRe.exe
  2⤵
  PID:4972
- C:\Windows\System\JNCjryK.exe
  C:\Windows\System\JNCjryK.exe
  2⤵
  PID:6052
- C:\Windows\System\wnDCwRp.exe
  C:\Windows\System\wnDCwRp.exe
  2⤵
  PID:7088
- C:\Windows\System\NhOAzSF.exe
  C:\Windows\System\NhOAzSF.exe
  2⤵
  PID:7176
- C:\Windows\System\GQFUZZm.exe
  C:\Windows\System\GQFUZZm.exe
  2⤵
  PID:7208
- C:\Windows\System\LaZZIHd.exe
  C:\Windows\System\LaZZIHd.exe
  2⤵
  PID:7236
- C:\Windows\System\KVWsjDx.exe
  C:\Windows\System\KVWsjDx.exe
  2⤵
  PID:7264
- C:\Windows\System\rmWjmPQ.exe
  C:\Windows\System\rmWjmPQ.exe
  2⤵
  PID:7292
- C:\Windows\System\FfcUOus.exe
  C:\Windows\System\FfcUOus.exe
  2⤵
  PID:7328
- C:\Windows\System\CQmznue.exe
  C:\Windows\System\CQmznue.exe
  2⤵
  PID:7360
- C:\Windows\System\PrNhrqe.exe
  C:\Windows\System\PrNhrqe.exe
  2⤵
  PID:7388
- C:\Windows\System\dlHlsmj.exe
  C:\Windows\System\dlHlsmj.exe
  2⤵
  PID:7416
- C:\Windows\System\KOgUuxP.exe
  C:\Windows\System\KOgUuxP.exe
  2⤵
  PID:7432
- C:\Windows\System\keAWarT.exe
  C:\Windows\System\keAWarT.exe
  2⤵
  PID:7460
- C:\Windows\System\leQEqyv.exe
  C:\Windows\System\leQEqyv.exe
  2⤵
  PID:7488
- C:\Windows\System\NtMnHpS.exe
  C:\Windows\System\NtMnHpS.exe
  2⤵
  PID:7520
- C:\Windows\System\htbUUdc.exe
  C:\Windows\System\htbUUdc.exe
  2⤵
  PID:7536
- C:\Windows\System\XSfXILZ.exe
  C:\Windows\System\XSfXILZ.exe
  2⤵
  PID:7560
- C:\Windows\System\uHrmQMA.exe
  C:\Windows\System\uHrmQMA.exe
  2⤵
  PID:7576
- C:\Windows\System\QzvrrYv.exe
  C:\Windows\System\QzvrrYv.exe
  2⤵
  PID:7628
- C:\Windows\System\ZXeQxdl.exe
  C:\Windows\System\ZXeQxdl.exe
  2⤵
  PID:7668
- C:\Windows\System\ADJkHEV.exe
  C:\Windows\System\ADJkHEV.exe
  2⤵
  PID:7684
- C:\Windows\System\cnuMWNb.exe
  C:\Windows\System\cnuMWNb.exe
  2⤵
  PID:7712
- C:\Windows\System\fEpKQAp.exe
  C:\Windows\System\fEpKQAp.exe
  2⤵
  PID:7740
- C:\Windows\System\GPqBQbW.exe
  C:\Windows\System\GPqBQbW.exe
  2⤵
  PID:7780
- C:\Windows\System\OzCJZal.exe
  C:\Windows\System\OzCJZal.exe
  2⤵
  PID:7808
- C:\Windows\System\JvinrtC.exe
  C:\Windows\System\JvinrtC.exe
  2⤵
  PID:7836
- C:\Windows\System\NGpIMkf.exe
  C:\Windows\System\NGpIMkf.exe
  2⤵
  PID:7864
- C:\Windows\System\rKJQlWx.exe
  C:\Windows\System\rKJQlWx.exe
  2⤵
  PID:7896
- C:\Windows\System\xeQgzXw.exe
  C:\Windows\System\xeQgzXw.exe
  2⤵
  PID:7924
- C:\Windows\System\gXOSLfv.exe
  C:\Windows\System\gXOSLfv.exe
  2⤵
  PID:7940
- C:\Windows\System\ZvZRlhI.exe
  C:\Windows\System\ZvZRlhI.exe
  2⤵
  PID:7968
- C:\Windows\System\DLpHSls.exe
  C:\Windows\System\DLpHSls.exe
  2⤵
  PID:7992
- C:\Windows\System\rFVGyyx.exe
  C:\Windows\System\rFVGyyx.exe
  2⤵
  PID:8024
- C:\Windows\System\eKjJlbk.exe
  C:\Windows\System\eKjJlbk.exe
  2⤵
  PID:8040
- C:\Windows\System\sujKMuR.exe
  C:\Windows\System\sujKMuR.exe
  2⤵
  PID:8080
- C:\Windows\System\lytGNCl.exe
  C:\Windows\System\lytGNCl.exe
  2⤵
  PID:8108
- C:\Windows\System\mBIvITX.exe
  C:\Windows\System\mBIvITX.exe
  2⤵
  PID:8128
- C:\Windows\System\OeuZNOG.exe
  C:\Windows\System\OeuZNOG.exe
  2⤵
  PID:8176
- C:\Windows\System\nRfsVcB.exe
  C:\Windows\System\nRfsVcB.exe
  2⤵
  PID:7172
- C:\Windows\System\vGHUlZg.exe
  C:\Windows\System\vGHUlZg.exe
  2⤵
  PID:7220
- C:\Windows\System\FnCecDx.exe
  C:\Windows\System\FnCecDx.exe
  2⤵
  PID:7304
- C:\Windows\System\xNyEUSN.exe
  C:\Windows\System\xNyEUSN.exe
  2⤵
  PID:7324
- C:\Windows\System\WhzbGpm.exe
  C:\Windows\System\WhzbGpm.exe
  2⤵
  PID:7404
- C:\Windows\System\vTlUqEc.exe
  C:\Windows\System\vTlUqEc.exe
  2⤵
  PID:7472
- C:\Windows\System\xKEAvQO.exe
  C:\Windows\System\xKEAvQO.exe
  2⤵
  PID:7544
- C:\Windows\System\ZcYpnbo.exe
  C:\Windows\System\ZcYpnbo.exe
  2⤵
  PID:7548
- C:\Windows\System\apNqAMA.exe
  C:\Windows\System\apNqAMA.exe
  2⤵
  PID:7656
- C:\Windows\System\wxoVHgl.exe
  C:\Windows\System\wxoVHgl.exe
  2⤵
  PID:7704
- C:\Windows\System\CmRvlzH.exe
  C:\Windows\System\CmRvlzH.exe
  2⤵
  PID:7760
- C:\Windows\System\KvTgowX.exe
  C:\Windows\System\KvTgowX.exe
  2⤵
  PID:7888
- C:\Windows\System\hlFxiZT.exe
  C:\Windows\System\hlFxiZT.exe
  2⤵
  PID:7980
- C:\Windows\System\gGFyUbZ.exe
  C:\Windows\System\gGFyUbZ.exe
  2⤵
  PID:8012
- C:\Windows\System\zCQaFsT.exe
  C:\Windows\System\zCQaFsT.exe
  2⤵
  PID:8060
- C:\Windows\System\MGLfRPM.exe
  C:\Windows\System\MGLfRPM.exe
  2⤵
  PID:8160
- C:\Windows\System\cvywexh.exe
  C:\Windows\System\cvywexh.exe
  2⤵
  PID:2476
- C:\Windows\System\zPPETbj.exe
  C:\Windows\System\zPPETbj.exe
  2⤵
  PID:7384
- C:\Windows\System\xfIOnoB.exe
  C:\Windows\System\xfIOnoB.exe
  2⤵
  PID:7444
- C:\Windows\System\OnaVleD.exe
  C:\Windows\System\OnaVleD.exe
  2⤵
  PID:7596
- C:\Windows\System\YubqhQb.exe
  C:\Windows\System\YubqhQb.exe
  2⤵
  PID:7568
- C:\Windows\System\ebuBzkR.exe
  C:\Windows\System\ebuBzkR.exe
  2⤵
  PID:7796
- C:\Windows\System\DBRkqPr.exe
  C:\Windows\System\DBRkqPr.exe
  2⤵
  PID:8052
- C:\Windows\System\xxvzFcb.exe
  C:\Windows\System\xxvzFcb.exe
  2⤵
  PID:7448
- C:\Windows\System\rRdfkeQ.exe
  C:\Windows\System\rRdfkeQ.exe
  2⤵
  PID:7592
- C:\Windows\System\wfXFjCh.exe
  C:\Windows\System\wfXFjCh.exe
  2⤵
  PID:8008
- C:\Windows\System\MuHSrDv.exe
  C:\Windows\System\MuHSrDv.exe
  2⤵
  PID:7772
- C:\Windows\System\qPigrTl.exe
  C:\Windows\System\qPigrTl.exe
  2⤵
  PID:8096
- C:\Windows\System\xkRXATx.exe
  C:\Windows\System\xkRXATx.exe
  2⤵
  PID:8200
- C:\Windows\System\OTswjnB.exe
  C:\Windows\System\OTswjnB.exe
  2⤵
  PID:8216
- C:\Windows\System\GuQOAds.exe
  C:\Windows\System\GuQOAds.exe
  2⤵
  PID:8236
- C:\Windows\System\heKVheW.exe
  C:\Windows\System\heKVheW.exe
  2⤵
  PID:8304
- C:\Windows\System\YcWrQRL.exe
  C:\Windows\System\YcWrQRL.exe
  2⤵
  PID:8336
- C:\Windows\System\vLDdBHs.exe
  C:\Windows\System\vLDdBHs.exe
  2⤵
  PID:8364
- C:\Windows\System\VhjZpDb.exe
  C:\Windows\System\VhjZpDb.exe
  2⤵
  PID:8380
- C:\Windows\System\lpDUKeG.exe
  C:\Windows\System\lpDUKeG.exe
  2⤵
  PID:8408
- C:\Windows\System\PNjjNYn.exe
  C:\Windows\System\PNjjNYn.exe
  2⤵
  PID:8448
- C:\Windows\System\Uyuwsoc.exe
  C:\Windows\System\Uyuwsoc.exe
  2⤵
  PID:8464
- C:\Windows\System\xpibdPe.exe
  C:\Windows\System\xpibdPe.exe
  2⤵
  PID:8504
- C:\Windows\System\RxnhxLW.exe
  C:\Windows\System\RxnhxLW.exe
  2⤵
  PID:8524
- C:\Windows\System\UXmHgiW.exe
  C:\Windows\System\UXmHgiW.exe
  2⤵
  PID:8548
- C:\Windows\System\SwYFMsM.exe
  C:\Windows\System\SwYFMsM.exe
  2⤵
  PID:8576
- C:\Windows\System\KisfLvS.exe
  C:\Windows\System\KisfLvS.exe
  2⤵
  PID:8608
- C:\Windows\System\LcEUQEa.exe
  C:\Windows\System\LcEUQEa.exe
  2⤵
  PID:8644
- C:\Windows\System\YWvBDJe.exe
  C:\Windows\System\YWvBDJe.exe
  2⤵
  PID:8668
- C:\Windows\System\EfxYlZO.exe
  C:\Windows\System\EfxYlZO.exe
  2⤵
  PID:8688
- C:\Windows\System\JZaGQnC.exe
  C:\Windows\System\JZaGQnC.exe
  2⤵
  PID:8716
- C:\Windows\System\OPyTFjW.exe
  C:\Windows\System\OPyTFjW.exe
  2⤵
  PID:8752
- C:\Windows\System\coWkCoj.exe
  C:\Windows\System\coWkCoj.exe
  2⤵
  PID:8784
- C:\Windows\System\LCUTdzr.exe
  C:\Windows\System\LCUTdzr.exe
  2⤵
  PID:8800
- C:\Windows\System\zHEiSLG.exe
  C:\Windows\System\zHEiSLG.exe
  2⤵
  PID:8836
- C:\Windows\System\gxmpSNq.exe
  C:\Windows\System\gxmpSNq.exe
  2⤵
  PID:8868
- C:\Windows\System\udMlyCN.exe
  C:\Windows\System\udMlyCN.exe
  2⤵
  PID:8896
- C:\Windows\System\ugglVnt.exe
  C:\Windows\System\ugglVnt.exe
  2⤵
  PID:8912
- C:\Windows\System\BUqbjbR.exe
  C:\Windows\System\BUqbjbR.exe
  2⤵
  PID:8952
- C:\Windows\System\KEALrCn.exe
  C:\Windows\System\KEALrCn.exe
  2⤵
  PID:8968
- C:\Windows\System\zafRJAG.exe
  C:\Windows\System\zafRJAG.exe
  2⤵
  PID:8996
- C:\Windows\System\tprrIAi.exe
  C:\Windows\System\tprrIAi.exe
  2⤵
  PID:9024
- C:\Windows\System\JgpqKeT.exe
  C:\Windows\System\JgpqKeT.exe
  2⤵
  PID:9040
- C:\Windows\System\nmVgrad.exe
  C:\Windows\System\nmVgrad.exe
  2⤵
  PID:9056
- C:\Windows\System\OjFJMOB.exe
  C:\Windows\System\OjFJMOB.exe
  2⤵
  PID:9088
- C:\Windows\System\dtqJtZi.exe
  C:\Windows\System\dtqJtZi.exe
  2⤵
  PID:9148
- C:\Windows\System\DTdFLDu.exe
  C:\Windows\System\DTdFLDu.exe
  2⤵
  PID:9176
- C:\Windows\System\VbTRzyo.exe
  C:\Windows\System\VbTRzyo.exe
  2⤵
  PID:9204
- C:\Windows\System\vXvpMaE.exe
  C:\Windows\System\vXvpMaE.exe
  2⤵
  PID:8196
- C:\Windows\System\hebaGaI.exe
  C:\Windows\System\hebaGaI.exe
  2⤵
  PID:8208
- C:\Windows\System\hNdbkeU.exe
  C:\Windows\System\hNdbkeU.exe
  2⤵
  PID:8332
- C:\Windows\System\PkGfZMX.exe
  C:\Windows\System\PkGfZMX.exe
  2⤵
  PID:8392
- C:\Windows\System\whsrUws.exe
  C:\Windows\System\whsrUws.exe
  2⤵
  PID:8484
- C:\Windows\System\Bafxbiy.exe
  C:\Windows\System\Bafxbiy.exe
  2⤵
  PID:8512
- C:\Windows\System\eVzEnVy.exe
  C:\Windows\System\eVzEnVy.exe
  2⤵
  PID:8592
- C:\Windows\System\DFeKxii.exe
  C:\Windows\System\DFeKxii.exe
  2⤵
  PID:8652
- C:\Windows\System\qbgtDTG.exe
  C:\Windows\System\qbgtDTG.exe
  2⤵
  PID:8700
- C:\Windows\System\zFjqSKh.exe
  C:\Windows\System\zFjqSKh.exe
  2⤵
  PID:8776
- C:\Windows\System\AwWNNXA.exe
  C:\Windows\System\AwWNNXA.exe
  2⤵
  PID:8852
- C:\Windows\System\JHIvADK.exe
  C:\Windows\System\JHIvADK.exe
  2⤵
  PID:8904
- C:\Windows\System\eBjstZf.exe
  C:\Windows\System\eBjstZf.exe
  2⤵
  PID:9036
- C:\Windows\System\kbSpJhJ.exe
  C:\Windows\System\kbSpJhJ.exe
  2⤵
  PID:9012
- C:\Windows\System\qScxsiz.exe
  C:\Windows\System\qScxsiz.exe
  2⤵
  PID:9080
- C:\Windows\System\qynlBuk.exe
  C:\Windows\System\qynlBuk.exe
  2⤵
  PID:9164
- C:\Windows\System\ATeoYBn.exe
  C:\Windows\System\ATeoYBn.exe
  2⤵
  PID:8268
- C:\Windows\System\wOGdRQt.exe
  C:\Windows\System\wOGdRQt.exe
  2⤵
  PID:8492
- C:\Windows\System\jAAuLTx.exe
  C:\Windows\System\jAAuLTx.exe
  2⤵
  PID:8564
- C:\Windows\System\qBLGrMt.exe
  C:\Windows\System\qBLGrMt.exe
  2⤵
  PID:8760
- C:\Windows\System\ZRLdsXn.exe
  C:\Windows\System\ZRLdsXn.exe
  2⤵
  PID:8908
- C:\Windows\System\QEEIAWt.exe
  C:\Windows\System\QEEIAWt.exe
  2⤵
  PID:8960
- C:\Windows\System\PDYOjXZ.exe
  C:\Windows\System\PDYOjXZ.exe
  2⤵
  PID:9212
- C:\Windows\System\hgzogqK.exe
  C:\Windows\System\hgzogqK.exe
  2⤵
  PID:8428
- C:\Windows\System\adUKmTN.exe
  C:\Windows\System\adUKmTN.exe
  2⤵
  PID:8888
- C:\Windows\System\jwrhVMn.exe
  C:\Windows\System\jwrhVMn.exe
  2⤵
  PID:8292
- C:\Windows\System\dYvDjfG.exe
  C:\Windows\System\dYvDjfG.exe
  2⤵
  PID:9052
- C:\Windows\System\mCYRyOf.exe
  C:\Windows\System\mCYRyOf.exe
  2⤵
  PID:8748
- C:\Windows\System\ECCXoeR.exe
  C:\Windows\System\ECCXoeR.exe
  2⤵
  PID:9252
- C:\Windows\System\YEzekYN.exe
  C:\Windows\System\YEzekYN.exe
  2⤵
  PID:9280
- C:\Windows\System\JWgPmQH.exe
  C:\Windows\System\JWgPmQH.exe
  2⤵
  PID:9308
- C:\Windows\System\UPIrkGO.exe
  C:\Windows\System\UPIrkGO.exe
  2⤵
  PID:9336
- C:\Windows\System\jwaGbmi.exe
  C:\Windows\System\jwaGbmi.exe
  2⤵
  PID:9372
- C:\Windows\System\ZbIGTdi.exe
  C:\Windows\System\ZbIGTdi.exe
  2⤵
  PID:9388
- C:\Windows\System\ujHGuUx.exe
  C:\Windows\System\ujHGuUx.exe
  2⤵
  PID:9416
- C:\Windows\System\cUpJqau.exe
  C:\Windows\System\cUpJqau.exe
  2⤵
  PID:9456
- C:\Windows\System\JJQWcwv.exe
  C:\Windows\System\JJQWcwv.exe
  2⤵
  PID:9484
- C:\Windows\System\BrDWNOm.exe
  C:\Windows\System\BrDWNOm.exe
  2⤵
  PID:9512
- C:\Windows\System\iXOVmJA.exe
  C:\Windows\System\iXOVmJA.exe
  2⤵
  PID:9540
- C:\Windows\System\okAWfFg.exe
  C:\Windows\System\okAWfFg.exe
  2⤵
  PID:9556
- C:\Windows\System\kObJyzq.exe
  C:\Windows\System\kObJyzq.exe
  2⤵
  PID:9584
- C:\Windows\System\siKtmwr.exe
  C:\Windows\System\siKtmwr.exe
  2⤵
  PID:9600
- C:\Windows\System\oyZizCz.exe
  C:\Windows\System\oyZizCz.exe
  2⤵
  PID:9628
- C:\Windows\System\hORwkXJ.exe
  C:\Windows\System\hORwkXJ.exe
  2⤵
  PID:9660
- C:\Windows\System\YMPNdAJ.exe
  C:\Windows\System\YMPNdAJ.exe
  2⤵
  PID:9696
- C:\Windows\System\VJgrNMM.exe
  C:\Windows\System\VJgrNMM.exe
  2⤵
  PID:9736
- C:\Windows\System\qnpxvsd.exe
  C:\Windows\System\qnpxvsd.exe
  2⤵
  PID:9752
- C:\Windows\System\kDWjaHz.exe
  C:\Windows\System\kDWjaHz.exe
  2⤵
  PID:9792
- C:\Windows\System\EzSUfkm.exe
  C:\Windows\System\EzSUfkm.exe
  2⤵
  PID:9820
- C:\Windows\System\gNIKEgf.exe
  C:\Windows\System\gNIKEgf.exe
  2⤵
  PID:9848
- C:\Windows\System\lJTRQXA.exe
  C:\Windows\System\lJTRQXA.exe
  2⤵
  PID:9876
- C:\Windows\System\lsGhOdP.exe
  C:\Windows\System\lsGhOdP.exe
  2⤵
  PID:9892
- C:\Windows\System\nLEqrWW.exe
  C:\Windows\System\nLEqrWW.exe
  2⤵
  PID:9920
- C:\Windows\System\PjaBmUq.exe
  C:\Windows\System\PjaBmUq.exe
  2⤵
  PID:9948
- C:\Windows\System\xKJrKkg.exe
  C:\Windows\System\xKJrKkg.exe
  2⤵
  PID:9968
- C:\Windows\System\QhrGpDF.exe
  C:\Windows\System\QhrGpDF.exe
  2⤵
  PID:10004
- C:\Windows\System\PPwLgHF.exe
  C:\Windows\System\PPwLgHF.exe
  2⤵
  PID:10032
- C:\Windows\System\OHlfhpo.exe
  C:\Windows\System\OHlfhpo.exe
  2⤵
  PID:10072
- C:\Windows\System\xepoLqK.exe
  C:\Windows\System\xepoLqK.exe
  2⤵
  PID:10096
- C:\Windows\System\ePTiOIT.exe
  C:\Windows\System\ePTiOIT.exe
  2⤵
  PID:10116
- C:\Windows\System\IzIdjTt.exe
  C:\Windows\System\IzIdjTt.exe
  2⤵
  PID:10144
- C:\Windows\System\ErDuRBZ.exe
  C:\Windows\System\ErDuRBZ.exe
  2⤵
  PID:10160
- C:\Windows\System\MZknslI.exe
  C:\Windows\System\MZknslI.exe
  2⤵
  PID:10188
- C:\Windows\System\YMtdkva.exe
  C:\Windows\System\YMtdkva.exe
  2⤵
  PID:10236
- C:\Windows\System\xVGWGLY.exe
  C:\Windows\System\xVGWGLY.exe
  2⤵
  PID:9248
- C:\Windows\System\jeICkhA.exe
  C:\Windows\System\jeICkhA.exe
  2⤵
  PID:9300
- C:\Windows\System\UkrnAUM.exe
  C:\Windows\System\UkrnAUM.exe
  2⤵
  PID:9380
- C:\Windows\System\YdOwDWK.exe
  C:\Windows\System\YdOwDWK.exe
  2⤵
  PID:9444
- C:\Windows\System\uhlcEVJ.exe
  C:\Windows\System\uhlcEVJ.exe
  2⤵
  PID:9536
- C:\Windows\System\QdQMRkI.exe
  C:\Windows\System\QdQMRkI.exe
  2⤵
  PID:9596
- C:\Windows\System\bfoUWYC.exe
  C:\Windows\System\bfoUWYC.exe
  2⤵
  PID:9644
- C:\Windows\System\BOJrGzc.exe
  C:\Windows\System\BOJrGzc.exe
  2⤵
  PID:9728
- C:\Windows\System\Yzjyvex.exe
  C:\Windows\System\Yzjyvex.exe
  2⤵
  PID:9804
- C:\Windows\System\rWAnjND.exe
  C:\Windows\System\rWAnjND.exe
  2⤵
  PID:9844
- C:\Windows\System\hUGVwen.exe
  C:\Windows\System\hUGVwen.exe
  2⤵
  PID:9908
- C:\Windows\System\vJkcsWV.exe
  C:\Windows\System\vJkcsWV.exe
  2⤵
  PID:9980
- C:\Windows\System\AhLLCLx.exe
  C:\Windows\System\AhLLCLx.exe
  2⤵
  PID:10024
- C:\Windows\System\jiiXLyq.exe
  C:\Windows\System\jiiXLyq.exe
  2⤵
  PID:10088
- C:\Windows\System\pexQmme.exe
  C:\Windows\System\pexQmme.exe
  2⤵
  PID:10180
- C:\Windows\System\dKgnzWP.exe
  C:\Windows\System\dKgnzWP.exe
  2⤵
  PID:10228
- C:\Windows\System\jUiytxv.exe
  C:\Windows\System\jUiytxv.exe
  2⤵
  PID:9292
- C:\Windows\System\BVvnFmf.exe
  C:\Windows\System\BVvnFmf.exe
  2⤵
  PID:9500
- C:\Windows\System\uPMdeBt.exe
  C:\Windows\System\uPMdeBt.exe
  2⤵
  PID:9572
- C:\Windows\System\YlUGAio.exe
  C:\Windows\System\YlUGAio.exe
  2⤵
  PID:9688
- C:\Windows\System\uXXkaLS.exe
  C:\Windows\System\uXXkaLS.exe
  2⤵
  PID:9996
- C:\Windows\System\giqBgjb.exe
  C:\Windows\System\giqBgjb.exe
  2⤵
  PID:10104
- C:\Windows\System\DUPQvNy.exe
  C:\Windows\System\DUPQvNy.exe
  2⤵
  PID:9412
- C:\Windows\System\lKkTFld.exe
  C:\Windows\System\lKkTFld.exe
  2⤵
  PID:9832
- C:\Windows\System\jaKYIsK.exe
  C:\Windows\System\jaKYIsK.exe
  2⤵
  PID:9788
- C:\Windows\System\GIkRpUx.exe
  C:\Windows\System\GIkRpUx.exe
  2⤵
  PID:10156
- C:\Windows\System\ooOyoHN.exe
  C:\Windows\System\ooOyoHN.exe
  2⤵
  PID:9364
- C:\Windows\System\xJlYQYm.exe
  C:\Windows\System\xJlYQYm.exe
  2⤵
  PID:10252
- C:\Windows\System\IUvsais.exe
  C:\Windows\System\IUvsais.exe
  2⤵
  PID:10284
- C:\Windows\System\AOVXaKe.exe
  C:\Windows\System\AOVXaKe.exe
  2⤵
  PID:10312
- C:\Windows\System\sBBeKsZ.exe
  C:\Windows\System\sBBeKsZ.exe
  2⤵
  PID:10336
- C:\Windows\System\YUSNKop.exe
  C:\Windows\System\YUSNKop.exe
  2⤵
  PID:10368
- C:\Windows\System\YCcgabH.exe
  C:\Windows\System\YCcgabH.exe
  2⤵
  PID:10384
- C:\Windows\System\DrOnmQY.exe
  C:\Windows\System\DrOnmQY.exe
  2⤵
  PID:10412
- C:\Windows\System\NLrBMAH.exe
  C:\Windows\System\NLrBMAH.exe
  2⤵
  PID:10440
- C:\Windows\System\OdVKlqU.exe
  C:\Windows\System\OdVKlqU.exe
  2⤵
  PID:10472
- C:\Windows\System\XkKaiuN.exe
  C:\Windows\System\XkKaiuN.exe
  2⤵
  PID:10520
- C:\Windows\System\vmAbaQl.exe
  C:\Windows\System\vmAbaQl.exe
  2⤵
  PID:10540
- C:\Windows\System\TpPAGVx.exe
  C:\Windows\System\TpPAGVx.exe
  2⤵
  PID:10568
- C:\Windows\System\RSJbiIl.exe
  C:\Windows\System\RSJbiIl.exe
  2⤵
  PID:10596
- C:\Windows\System\TfoVbkc.exe
  C:\Windows\System\TfoVbkc.exe
  2⤵
  PID:10620
- C:\Windows\System\ZgRXOud.exe
  C:\Windows\System\ZgRXOud.exe
  2⤵
  PID:10648
- C:\Windows\System\EdNvydq.exe
  C:\Windows\System\EdNvydq.exe
  2⤵
  PID:10680
- C:\Windows\System\qahnkut.exe
  C:\Windows\System\qahnkut.exe
  2⤵
  PID:10708
- C:\Windows\System\wOFgRBf.exe
  C:\Windows\System\wOFgRBf.exe
  2⤵
  PID:10748
- C:\Windows\System\xpRdtzn.exe
  C:\Windows\System\xpRdtzn.exe
  2⤵
  PID:10764
- C:\Windows\System\oMMRzTE.exe
  C:\Windows\System\oMMRzTE.exe
  2⤵
  PID:10780
- C:\Windows\System\XygUxQQ.exe
  C:\Windows\System\XygUxQQ.exe
  2⤵
  PID:10804
- C:\Windows\System\mXCHlQS.exe
  C:\Windows\System\mXCHlQS.exe
  2⤵
  PID:10844
- C:\Windows\System\ispWVgK.exe
  C:\Windows\System\ispWVgK.exe
  2⤵
  PID:10872
- C:\Windows\System\qhwrGTo.exe
  C:\Windows\System\qhwrGTo.exe
  2⤵
  PID:10904
- C:\Windows\System\sIQEqBZ.exe
  C:\Windows\System\sIQEqBZ.exe
  2⤵
  PID:10932
- C:\Windows\System\sxlbaLn.exe
  C:\Windows\System\sxlbaLn.exe
  2⤵
  PID:10960
- C:\Windows\System\usUEWBU.exe
  C:\Windows\System\usUEWBU.exe
  2⤵
  PID:10988
- C:\Windows\System\dHyMfjn.exe
  C:\Windows\System\dHyMfjn.exe
  2⤵
  PID:11016
- C:\Windows\System\CpzUdJr.exe
  C:\Windows\System\CpzUdJr.exe
  2⤵
  PID:11044
- C:\Windows\System\lewVIxU.exe
  C:\Windows\System\lewVIxU.exe
  2⤵
  PID:11072
- C:\Windows\System\gFsPYMF.exe
  C:\Windows\System\gFsPYMF.exe
  2⤵
  PID:11096
- C:\Windows\System\vUgVfai.exe
  C:\Windows\System\vUgVfai.exe
  2⤵
  PID:11128
- C:\Windows\System\PBfzNNv.exe
  C:\Windows\System\PBfzNNv.exe
  2⤵
  PID:11156
- C:\Windows\System\GjwKYej.exe
  C:\Windows\System\GjwKYej.exe
  2⤵
  PID:11192
- C:\Windows\System\WaKLhTx.exe
  C:\Windows\System\WaKLhTx.exe
  2⤵
  PID:11208
- C:\Windows\System\KOYNQVO.exe
  C:\Windows\System\KOYNQVO.exe
  2⤵
  PID:11228
- C:\Windows\System\PIcFWtu.exe
  C:\Windows\System\PIcFWtu.exe
  2⤵
  PID:10264
- C:\Windows\System\pqgUNsB.exe
  C:\Windows\System\pqgUNsB.exe
  2⤵
  PID:10324
- C:\Windows\System\pGOudqP.exe
  C:\Windows\System\pGOudqP.exe
  2⤵
  PID:10396
- C:\Windows\System\ghsFgCu.exe
  C:\Windows\System\ghsFgCu.exe
  2⤵
  PID:10468
- C:\Windows\System\PLcLtbr.exe
  C:\Windows\System\PLcLtbr.exe
  2⤵
  PID:10464
- C:\Windows\System\gcUOWTB.exe
  C:\Windows\System\gcUOWTB.exe
  2⤵
  PID:10552
- C:\Windows\System\ejkjWac.exe
  C:\Windows\System\ejkjWac.exe
  2⤵
  PID:10632
- C:\Windows\System\AppJmco.exe
  C:\Windows\System\AppJmco.exe
  2⤵
  PID:10692
- C:\Windows\System\vOVZsxJ.exe
  C:\Windows\System\vOVZsxJ.exe
  2⤵
  PID:10760
- C:\Windows\System\flhSjcN.exe
  C:\Windows\System\flhSjcN.exe
  2⤵
  PID:10856
- C:\Windows\System\XZxhCeV.exe
  C:\Windows\System\XZxhCeV.exe
  2⤵
  PID:10828
- C:\Windows\System\IlCYkEu.exe
  C:\Windows\System\IlCYkEu.exe
  2⤵
  PID:10948
- C:\Windows\System\XswIYle.exe
  C:\Windows\System\XswIYle.exe
  2⤵
  PID:11008
- C:\Windows\System\GNbLGWW.exe
  C:\Windows\System\GNbLGWW.exe
  2⤵
  PID:11080
- C:\Windows\System\IyREBXk.exe
  C:\Windows\System\IyREBXk.exe
  2⤵
  PID:11120
- C:\Windows\System\tdmYiIY.exe
  C:\Windows\System\tdmYiIY.exe
  2⤵
  PID:11224
- C:\Windows\System\fRDGHQW.exe
  C:\Windows\System\fRDGHQW.exe
  2⤵
  PID:9616
- C:\Windows\System\IjFWbVr.exe
  C:\Windows\System\IjFWbVr.exe
  2⤵
  PID:10456
- C:\Windows\System\yrEhbOQ.exe
  C:\Windows\System\yrEhbOQ.exe
  2⤵
  PID:10592
- C:\Windows\System\sXHuqfL.exe
  C:\Windows\System\sXHuqfL.exe
  2⤵
  PID:10728
- C:\Windows\System\tqRIyfp.exe
  C:\Windows\System\tqRIyfp.exe
  2⤵
  PID:10892
- C:\Windows\System\MhxEmJE.exe
  C:\Windows\System\MhxEmJE.exe
  2⤵
  PID:10888
- C:\Windows\System\GivpZfW.exe
  C:\Windows\System\GivpZfW.exe
  2⤵
  PID:11184
- C:\Windows\System\fNoPlNT.exe
  C:\Windows\System\fNoPlNT.exe
  2⤵
  PID:11256
- C:\Windows\System\twHalWK.exe
  C:\Windows\System\twHalWK.exe
  2⤵
  PID:10508
- C:\Windows\System\yKsJxQo.exe
  C:\Windows\System\yKsJxQo.exe
  2⤵
  PID:10824
- C:\Windows\System\mneKChl.exe
  C:\Windows\System\mneKChl.exe
  2⤵
  PID:11108
- C:\Windows\System\SaJNFrm.exe
  C:\Windows\System\SaJNFrm.exe
  2⤵
  PID:11260
- C:\Windows\System\pPdyvpa.exe
  C:\Windows\System\pPdyvpa.exe
  2⤵
  PID:11276
- C:\Windows\System\wSKRasm.exe
  C:\Windows\System\wSKRasm.exe
  2⤵
  PID:11296
- C:\Windows\System\uyqyUaU.exe
  C:\Windows\System\uyqyUaU.exe
  2⤵
  PID:11336
- C:\Windows\System\AwfJhKO.exe
  C:\Windows\System\AwfJhKO.exe
  2⤵
  PID:11368
- C:\Windows\System\TEScZnD.exe
  C:\Windows\System\TEScZnD.exe
  2⤵
  PID:11440
- C:\Windows\System\kxOExsk.exe
  C:\Windows\System\kxOExsk.exe
  2⤵
  PID:11456
- C:\Windows\System\aGIZkyo.exe
  C:\Windows\System\aGIZkyo.exe
  2⤵
  PID:11484
- C:\Windows\System\LNRDGcU.exe
  C:\Windows\System\LNRDGcU.exe
  2⤵
  PID:11504
- C:\Windows\System\qsJsJRn.exe
  C:\Windows\System\qsJsJRn.exe
  2⤵
  PID:11528
- C:\Windows\System\pfRuVFX.exe
  C:\Windows\System\pfRuVFX.exe
  2⤵
  PID:11564
- C:\Windows\System\wOzrcRp.exe
  C:\Windows\System\wOzrcRp.exe
  2⤵
  PID:11612
- C:\Windows\System\ADBPrKJ.exe
  C:\Windows\System\ADBPrKJ.exe
  2⤵
  PID:11628
- C:\Windows\System\FkwiQqm.exe
  C:\Windows\System\FkwiQqm.exe
  2⤵
  PID:11656
- C:\Windows\System\kGTxFcy.exe
  C:\Windows\System\kGTxFcy.exe
  2⤵
  PID:11684
- C:\Windows\System\XtpZgKm.exe
  C:\Windows\System\XtpZgKm.exe
  2⤵
  PID:11712
- C:\Windows\System\ZNBDaIy.exe
  C:\Windows\System\ZNBDaIy.exe
  2⤵
  PID:11752
- C:\Windows\System\hIEVUcq.exe
  C:\Windows\System\hIEVUcq.exe
  2⤵
  PID:11776
- C:\Windows\System\krIRcjn.exe
  C:\Windows\System\krIRcjn.exe
  2⤵
  PID:11808
- C:\Windows\System\PmepQuo.exe
  C:\Windows\System\PmepQuo.exe
  2⤵
  PID:11824
- C:\Windows\System\dhcJSoy.exe
  C:\Windows\System\dhcJSoy.exe
  2⤵
  PID:11856
- C:\Windows\System\RJIpqno.exe
  C:\Windows\System\RJIpqno.exe
  2⤵
  PID:11892
- C:\Windows\System\aoAhXQz.exe
  C:\Windows\System\aoAhXQz.exe
  2⤵
  PID:11908
- C:\Windows\System\bGzOcAx.exe
  C:\Windows\System\bGzOcAx.exe
  2⤵
  PID:11936
- C:\Windows\System\lqcgkvI.exe
  C:\Windows\System\lqcgkvI.exe
  2⤵
  PID:11964
- C:\Windows\System\CDeCNwo.exe
  C:\Windows\System\CDeCNwo.exe
  2⤵
  PID:11984
- C:\Windows\System\NbwxfVO.exe
  C:\Windows\System\NbwxfVO.exe
  2⤵
  PID:12020
- C:\Windows\System\TXMFPpg.exe
  C:\Windows\System\TXMFPpg.exe
  2⤵
  PID:12044
- C:\Windows\System\FUrKuzF.exe
  C:\Windows\System\FUrKuzF.exe
  2⤵
  PID:12076
- C:\Windows\System\cxUEbZZ.exe
  C:\Windows\System\cxUEbZZ.exe
  2⤵
  PID:12092
- C:\Windows\System\KKrlAMh.exe
  C:\Windows\System\KKrlAMh.exe
  2⤵
  PID:12120
- C:\Windows\System\pWQlUAx.exe
  C:\Windows\System\pWQlUAx.exe
  2⤵
  PID:12136
- C:\Windows\System\kRWZgxo.exe
  C:\Windows\System\kRWZgxo.exe
  2⤵
  PID:12156
- C:\Windows\System\WazGAzP.exe
  C:\Windows\System\WazGAzP.exe
  2⤵
  PID:12172
- C:\Windows\System\smxoPbR.exe
  C:\Windows\System\smxoPbR.exe
  2⤵
  PID:12188
- C:\Windows\System\VSROJWl.exe
  C:\Windows\System\VSROJWl.exe
  2⤵
  PID:12220
- C:\Windows\System\TjwxhJq.exe
  C:\Windows\System\TjwxhJq.exe
  2⤵
  PID:12248
- C:\Windows\System\roJjbOC.exe
  C:\Windows\System\roJjbOC.exe
  2⤵
  PID:10424
- C:\Windows\System\wgeGQsU.exe
  C:\Windows\System\wgeGQsU.exe
  2⤵
  PID:10920
- C:\Windows\System\cdtekke.exe
  C:\Windows\System\cdtekke.exe
  2⤵
  PID:11288
- C:\Windows\System\yDAWHsl.exe
  C:\Windows\System\yDAWHsl.exe
  2⤵
  PID:11424
- C:\Windows\System\YaFZeEA.exe
  C:\Windows\System\YaFZeEA.exe
  2⤵
  PID:11492
- C:\Windows\System\LyDUfnk.exe
  C:\Windows\System\LyDUfnk.exe
  2⤵
  PID:11648
- C:\Windows\System\WizYEjM.exe
  C:\Windows\System\WizYEjM.exe
  2⤵
  PID:11672
- C:\Windows\System\qHwvhee.exe
  C:\Windows\System\qHwvhee.exe
  2⤵
  PID:11708
- C:\Windows\System\hJSMJuY.exe
  C:\Windows\System\hJSMJuY.exe
  2⤵
  PID:11852
- C:\Windows\System\NlGpKmf.exe
  C:\Windows\System\NlGpKmf.exe
  2⤵
  PID:11928
- C:\Windows\System\WssfYJS.exe
  C:\Windows\System\WssfYJS.exe
  2⤵
  PID:11980
- C:\Windows\System\FQlJgrj.exe
  C:\Windows\System\FQlJgrj.exe
  2⤵
  PID:12004
- C:\Windows\System\doWLQjr.exe
  C:\Windows\System\doWLQjr.exe
  2⤵
  PID:12084
- C:\Windows\System\UcZoLHv.exe
  C:\Windows\System\UcZoLHv.exe
  2⤵
  PID:12108
- C:\Windows\System\fMwUzwT.exe
  C:\Windows\System\fMwUzwT.exe
  2⤵
  PID:12168
- C:\Windows\System\AUpAoHW.exe
  C:\Windows\System\AUpAoHW.exe
  2⤵
  PID:12276
- C:\Windows\System\ZwDdaMf.exe
  C:\Windows\System\ZwDdaMf.exe
  2⤵
  PID:11272
- C:\Windows\System\TLvZhcl.exe
  C:\Windows\System\TLvZhcl.exe
  2⤵
  PID:11404
- C:\Windows\System\klPjUnI.exe
  C:\Windows\System\klPjUnI.exe
  2⤵
  PID:11588
- C:\Windows\System\ElguyUW.exe
  C:\Windows\System\ElguyUW.exe
  2⤵
  PID:11736
- C:\Windows\System\LFktkYq.exe
  C:\Windows\System\LFktkYq.exe
  2⤵
  PID:11876
- C:\Windows\System\xasIQUl.exe
  C:\Windows\System\xasIQUl.exe
  2⤵
  PID:12144
- C:\Windows\System\mvHfKLG.exe
  C:\Windows\System\mvHfKLG.exe
  2⤵
  PID:12284
- C:\Windows\System\HmazJiS.exe
  C:\Windows\System\HmazJiS.exe
  2⤵
  PID:11496
- C:\Windows\System\liquaVT.exe
  C:\Windows\System\liquaVT.exe
  2⤵
  PID:12052
- C:\Windows\System\AKNAHYE.exe
  C:\Windows\System\AKNAHYE.exe
  2⤵
  PID:11596
- C:\Windows\System\KONrakh.exe
  C:\Windows\System\KONrakh.exe
  2⤵
  PID:11848
- C:\Windows\System\ZledxWg.exe
  C:\Windows\System\ZledxWg.exe
  2⤵
  PID:12296
- C:\Windows\System\zOJObWj.exe
  C:\Windows\System\zOJObWj.exe
  2⤵
  PID:12316
- C:\Windows\System\UTWLAPY.exe
  C:\Windows\System\UTWLAPY.exe
  2⤵
  PID:12336
- C:\Windows\System\qPyIyvc.exe
  C:\Windows\System\qPyIyvc.exe
  2⤵
  PID:12364
- C:\Windows\System\TnvhpiK.exe
  C:\Windows\System\TnvhpiK.exe
  2⤵
  PID:12388
- C:\Windows\System\DwHkzkQ.exe
  C:\Windows\System\DwHkzkQ.exe
  2⤵
  PID:12420
- C:\Windows\System\dePjsgb.exe
  C:\Windows\System\dePjsgb.exe
  2⤵
  PID:12456
- C:\Windows\System\sZQMsFg.exe
  C:\Windows\System\sZQMsFg.exe
  2⤵
  PID:12472
- C:\Windows\System\WMbwIrd.exe
  C:\Windows\System\WMbwIrd.exe
  2⤵
  PID:12508
- C:\Windows\System\ElkKtIT.exe
  C:\Windows\System\ElkKtIT.exe
  2⤵
  PID:12552
- C:\Windows\System\klWSfeI.exe
  C:\Windows\System\klWSfeI.exe
  2⤵
  PID:12580
- C:\Windows\System\nMmtmPy.exe
  C:\Windows\System\nMmtmPy.exe
  2⤵
  PID:12596
- C:\Windows\System\JJsLnZw.exe
  C:\Windows\System\JJsLnZw.exe
  2⤵
  PID:12616
- C:\Windows\System\hygsMVx.exe
  C:\Windows\System\hygsMVx.exe
  2⤵
  PID:12644
- C:\Windows\System\TqSCnwG.exe
  C:\Windows\System\TqSCnwG.exe
  2⤵
  PID:12664
- C:\Windows\System\xuCIJjH.exe
  C:\Windows\System\xuCIJjH.exe
  2⤵
  PID:12696
- C:\Windows\System\dHHNmmP.exe
  C:\Windows\System\dHHNmmP.exe
  2⤵
  PID:12720
- C:\Windows\System\SMqdQax.exe
  C:\Windows\System\SMqdQax.exe
  2⤵
  PID:12744
- C:\Windows\System\UEJesrY.exe
  C:\Windows\System\UEJesrY.exe
  2⤵
  PID:12772
- C:\Windows\System\nNyYxAq.exe
  C:\Windows\System\nNyYxAq.exe
  2⤵
  PID:12800
- C:\Windows\System\PCmqAuv.exe
  C:\Windows\System\PCmqAuv.exe
  2⤵
  PID:12840
- C:\Windows\System\gAwzKjb.exe
  C:\Windows\System\gAwzKjb.exe
  2⤵
  PID:12868
- C:\Windows\System\wUmyRHt.exe
  C:\Windows\System\wUmyRHt.exe
  2⤵
  PID:12900
- C:\Windows\System\lQyfmXq.exe
  C:\Windows\System\lQyfmXq.exe
  2⤵
  PID:12916
- C:\Windows\System\SEwjWCJ.exe
  C:\Windows\System\SEwjWCJ.exe
  2⤵
  PID:12932
- C:\Windows\System\dmTqhLw.exe
  C:\Windows\System\dmTqhLw.exe
  2⤵
  PID:12952
- C:\Windows\System\jUfgaBZ.exe
  C:\Windows\System\jUfgaBZ.exe
  2⤵
  PID:13004
- C:\Windows\System\fTPNoJU.exe
  C:\Windows\System\fTPNoJU.exe
  2⤵
  PID:13024
- C:\Windows\System\awFMfJS.exe
  C:\Windows\System\awFMfJS.exe
  2⤵
  PID:13040
- C:\Windows\System\DgCUgSh.exe
  C:\Windows\System\DgCUgSh.exe
  2⤵
  PID:13120
- C:\Windows\System\BEhPwRr.exe
  C:\Windows\System\BEhPwRr.exe
  2⤵
  PID:13160
- C:\Windows\System\rfSOPZE.exe
  C:\Windows\System\rfSOPZE.exe
  2⤵
  PID:13188
- C:\Windows\System\qLvvxsS.exe
  C:\Windows\System\qLvvxsS.exe
  2⤵
  PID:13212
- C:\Windows\System\AjSQLEN.exe
  C:\Windows\System\AjSQLEN.exe
  2⤵
  PID:13232
- C:\Windows\System\axYKwRi.exe
  C:\Windows\System\axYKwRi.exe
  2⤵
  PID:13272
- C:\Windows\System\utmfJkH.exe
  C:\Windows\System\utmfJkH.exe
  2⤵
  PID:13300
- C:\Windows\System\RYyJRQu.exe
  C:\Windows\System\RYyJRQu.exe
  2⤵
  PID:12312
- C:\Windows\System\ycqQibh.exe
  C:\Windows\System\ycqQibh.exe
  2⤵
  PID:12360
- C:\Windows\System\wIuiIID.exe
  C:\Windows\System\wIuiIID.exe
  2⤵
  PID:12408
- C:\Windows\System\SHCjtIT.exe
  C:\Windows\System\SHCjtIT.exe
  2⤵
  PID:12484
- C:\Windows\System\LMDWUlA.exe
  C:\Windows\System\LMDWUlA.exe
  2⤵
  PID:12536
- C:\Windows\System\fUSCENz.exe
  C:\Windows\System\fUSCENz.exe
  2⤵
  PID:12636
- C:\Windows\System\FYUXpRv.exe
  C:\Windows\System\FYUXpRv.exe
  2⤵
  PID:12704
- C:\Windows\System\oTtfKYC.exe
  C:\Windows\System\oTtfKYC.exe
  2⤵
  PID:12764
- C:\Windows\System\nYfxVSb.exe
  C:\Windows\System\nYfxVSb.exe
  2⤵
  PID:12864
- C:\Windows\System\kpNbIDr.exe
  C:\Windows\System\kpNbIDr.exe
  2⤵
  PID:12912
- C:\Windows\System\OGSOSgV.exe
  C:\Windows\System\OGSOSgV.exe
  2⤵
  PID:12892
- C:\Windows\System\SnYyjde.exe
  C:\Windows\System\SnYyjde.exe
  2⤵
  PID:13000
- C:\Windows\System\QZTZjJk.exe
  C:\Windows\System\QZTZjJk.exe
  2⤵
  PID:13080
- C:\Windows\System\FLwBIte.exe
  C:\Windows\System\FLwBIte.exe
  2⤵
  PID:13156
- C:\Windows\System\mzghHCm.exe
  C:\Windows\System\mzghHCm.exe
  2⤵
  PID:13220
- C:\Windows\System\PktyZEr.exe
  C:\Windows\System\PktyZEr.exe
  2⤵
  PID:13284
- C:\Windows\System\EWeJwoS.exe
  C:\Windows\System\EWeJwoS.exe
  2⤵
  PID:12384
- C:\Windows\System\ACfZeVA.exe
  C:\Windows\System\ACfZeVA.exe
  2⤵
  PID:12592
- C:\Windows\System\YRBjQbz.exe
  C:\Windows\System\YRBjQbz.exe
  2⤵
  PID:12736
- C:\Windows\System\mPirSmX.exe
  C:\Windows\System\mPirSmX.exe
  2⤵
  PID:12828
- C:\Windows\System\CYZsWyK.exe
  C:\Windows\System\CYZsWyK.exe
  2⤵
  PID:13032
- C:\Windows\System\oyClisZ.exe
  C:\Windows\System\oyClisZ.exe
  2⤵
  PID:13064
- C:\Windows\System\OMkdMZl.exe
  C:\Windows\System\OMkdMZl.exe
  2⤵
  PID:11640
- C:\Windows\System\NPudKHf.exe
  C:\Windows\System\NPudKHf.exe
  2⤵
  PID:12532
- C:\Windows\System\AeBUPJp.exe
  C:\Windows\System\AeBUPJp.exe
  2⤵
  PID:13020
- C:\Windows\System\WXfqNpX.exe
  C:\Windows\System\WXfqNpX.exe
  2⤵
  PID:12496
- C:\Windows\System\wRZidUU.exe
  C:\Windows\System\wRZidUU.exe
  2⤵
  PID:12996
- C:\Windows\System\qhFSEAU.exe
  C:\Windows\System\qhFSEAU.exe
  2⤵
  PID:13328
- C:\Windows\System\navxOpb.exe
  C:\Windows\System\navxOpb.exe
  2⤵
  PID:13356
- C:\Windows\System\sjnemfl.exe
  C:\Windows\System\sjnemfl.exe
  2⤵
  PID:13384
- C:\Windows\System\QAbxIsE.exe
  C:\Windows\System\QAbxIsE.exe
  2⤵
  PID:13400
- C:\Windows\System\ZaVxcXw.exe
  C:\Windows\System\ZaVxcXw.exe
  2⤵
  PID:13440
- C:\Windows\System\XdXtkvW.exe
  C:\Windows\System\XdXtkvW.exe
  2⤵
  PID:13468
- C:\Windows\System\qItwrjN.exe
  C:\Windows\System\qItwrjN.exe
  2⤵
  PID:13496
- C:\Windows\System\xZPofgT.exe
  C:\Windows\System\xZPofgT.exe
  2⤵
  PID:13524
- C:\Windows\System\zUJYWlT.exe
  C:\Windows\System\zUJYWlT.exe
  2⤵
  PID:13540
- C:\Windows\System\wlEPeir.exe
  C:\Windows\System\wlEPeir.exe
  2⤵
  PID:13580
- C:\Windows\System\wTyKxrA.exe
  C:\Windows\System\wTyKxrA.exe
  2⤵
  PID:13620
- C:\Windows\System\qXXUecs.exe
  C:\Windows\System\qXXUecs.exe
  2⤵
  PID:13648
- C:\Windows\System\wzUWkLN.exe
  C:\Windows\System\wzUWkLN.exe
  2⤵
  PID:13664
- C:\Windows\System\PCRAgBn.exe
  C:\Windows\System\PCRAgBn.exe
  2⤵
  PID:13684
- C:\Windows\System\SvZsSus.exe
  C:\Windows\System\SvZsSus.exe
  2⤵
  PID:13732
- C:\Windows\System\cIPXNbn.exe
  C:\Windows\System\cIPXNbn.exe
  2⤵
  PID:13760
- C:\Windows\System\HblLvWK.exe
  C:\Windows\System\HblLvWK.exe
  2⤵
  PID:13788
- C:\Windows\System\fmcDdjS.exe
  C:\Windows\System\fmcDdjS.exe
  2⤵
  PID:13816
- C:\Windows\System\phTXooM.exe
  C:\Windows\System\phTXooM.exe
  2⤵
  PID:13844
- C:\Windows\System\cdiPXUP.exe
  C:\Windows\System\cdiPXUP.exe
  2⤵
  PID:13864
- C:\Windows\System\RlZRBGo.exe
  C:\Windows\System\RlZRBGo.exe
  2⤵
  PID:13900
- C:\Windows\System\EqNrHuT.exe
  C:\Windows\System\EqNrHuT.exe
  2⤵
  PID:13928
- C:\Windows\System\vvRhLZd.exe
  C:\Windows\System\vvRhLZd.exe
  2⤵
  PID:13956
- C:\Windows\System\MZPFQWI.exe
  C:\Windows\System\MZPFQWI.exe
  2⤵
  PID:13976
- C:\Windows\System\qRHFxmH.exe
  C:\Windows\System\qRHFxmH.exe
  2⤵
  PID:14012
- C:\Windows\System\ppWRAlk.exe
  C:\Windows\System\ppWRAlk.exe
  2⤵
  PID:14036
- C:\Windows\System\DMaBtBG.exe
  C:\Windows\System\DMaBtBG.exe
  2⤵
  PID:14092
- C:\Windows\System\IdUUTPj.exe
  C:\Windows\System\IdUUTPj.exe
  2⤵
  PID:14136
- C:\Windows\System\wJmjRpO.exe
  C:\Windows\System\wJmjRpO.exe
  2⤵
  PID:14172
- C:\Windows\System\eYFzqZj.exe
  C:\Windows\System\eYFzqZj.exe
  2⤵
  PID:14200
- C:\Windows\System\hLhAGBw.exe
  C:\Windows\System\hLhAGBw.exe
  2⤵
  PID:14220
- C:\Windows\System\ZzPwcXX.exe
  C:\Windows\System\ZzPwcXX.exe
  2⤵
  PID:14240
- C:\Windows\System\RIlNQJz.exe
  C:\Windows\System\RIlNQJz.exe
  2⤵
  PID:14268
- C:\Windows\System\zPXQOTa.exe
  C:\Windows\System\zPXQOTa.exe
  2⤵
  PID:14320
- C:\Windows\System\QjQEuEj.exe
  C:\Windows\System\QjQEuEj.exe
  2⤵
  PID:13340
- C:\Windows\System\YYLFfVK.exe
  C:\Windows\System\YYLFfVK.exe
  2⤵
  PID:13364
- C:\Windows\System\eFTzBam.exe
  C:\Windows\System\eFTzBam.exe
  2⤵
  PID:13412
- C:\Windows\System\OUVFvcl.exe
  C:\Windows\System\OUVFvcl.exe
  2⤵
  PID:13516
- C:\Windows\System\WPtfvfL.exe
  C:\Windows\System\WPtfvfL.exe
  2⤵
  PID:13560
- C:\Windows\System\PBmtHsM.exe
  C:\Windows\System\PBmtHsM.exe
  2⤵
  PID:13616
- C:\Windows\System\JuHRwpb.exe
  C:\Windows\System\JuHRwpb.exe
  2⤵
  PID:13680
- C:\Windows\System\txJpkyx.exe
  C:\Windows\System\txJpkyx.exe
  2⤵
  PID:13748
- C:\Windows\System\QjmmqNC.exe
  C:\Windows\System\QjmmqNC.exe
  2⤵
  PID:13800
- C:\Windows\System\wGGXCEw.exe
  C:\Windows\System\wGGXCEw.exe
  2⤵
  PID:13856
- C:\Windows\System\ENPFkwx.exe
  C:\Windows\System\ENPFkwx.exe
  2⤵
  PID:13940
- C:\Windows\System\dhQAwvX.exe
  C:\Windows\System\dhQAwvX.exe
  2⤵
  PID:14004
- C:\Windows\System\msgXdTG.exe
  C:\Windows\System\msgXdTG.exe
  2⤵
  PID:14080
- C:\Windows\System\gNhKyqM.exe
  C:\Windows\System\gNhKyqM.exe
  2⤵
  PID:14184
- C:\Windows\System\qixadbR.exe
  C:\Windows\System\qixadbR.exe
  2⤵
  PID:14248
- C:\Windows\System\FXIzXOz.exe
  C:\Windows\System\FXIzXOz.exe
  2⤵
  PID:14316
- C:\Windows\System\vOxBUmW.exe
  C:\Windows\System\vOxBUmW.exe
  2⤵
  PID:13376
- C:\Windows\System\BCnbdmp.exe
  C:\Windows\System\BCnbdmp.exe
  2⤵
  PID:13532
- C:\Windows\System\HtWPvLR.exe
  C:\Windows\System\HtWPvLR.exe
  2⤵
  PID:13644
- C:\Windows\System\swLXLjq.exe
  C:\Windows\System\swLXLjq.exe
  2⤵
  PID:13884
- C:\Windows\System\nxZSZwE.exe
  C:\Windows\System\nxZSZwE.exe
  2⤵
  PID:14068
- C:\Windows\System\MxpDeOT.exe
  C:\Windows\System\MxpDeOT.exe
  2⤵
  PID:14292
- C:\Windows\System\TsjzXjB.exe
  C:\Windows\System\TsjzXjB.exe
  2⤵
  PID:13320
- C:\Windows\System\mhepSWn.exe
  C:\Windows\System\mhepSWn.exe
  2⤵
  PID:13784
- C:\Windows\System\iIcHwRZ.exe
  C:\Windows\System\iIcHwRZ.exe
  2⤵
  PID:14232
- C:\Windows\System\UISTHQV.exe
  C:\Windows\System\UISTHQV.exe
  2⤵
  PID:13952
- C:\Windows\System\pjwErXF.exe
  C:\Windows\System\pjwErXF.exe
  2⤵
  PID:13772
- C:\Windows\System\seBVomz.exe
  C:\Windows\System\seBVomz.exe
  2⤵
  PID:14360
- C:\Windows\System\qsZjjfN.exe
  C:\Windows\System\qsZjjfN.exe
  2⤵
  PID:14384
- C:\Windows\System\JpQmvry.exe
  C:\Windows\System\JpQmvry.exe
  2⤵
  PID:14412
- C:\Windows\System\aYeEgLJ.exe
  C:\Windows\System\aYeEgLJ.exe
  2⤵
  PID:14444
- C:\Windows\System\yRvnzzr.exe
  C:\Windows\System\yRvnzzr.exe
  2⤵
  PID:14464
- C:\Windows\System\bxhHxXI.exe
  C:\Windows\System\bxhHxXI.exe
  2⤵
  PID:14492
- C:\Windows\System\VQdwuvg.exe
  C:\Windows\System\VQdwuvg.exe
  2⤵
  PID:14516
- C:\Windows\System\lbwNXSe.exe
  C:\Windows\System\lbwNXSe.exe
  2⤵
  PID:14532
- C:\Windows\System\LjcOdyU.exe
  C:\Windows\System\LjcOdyU.exe
  2⤵
  PID:14596
- C:\Windows\System\CrAVtPs.exe
  C:\Windows\System\CrAVtPs.exe
  2⤵
  PID:14612
- C:\Windows\System\LZWQCLE.exe
  C:\Windows\System\LZWQCLE.exe
  2⤵
  PID:14632
- C:\Windows\System\aynsObV.exe
  C:\Windows\System\aynsObV.exe
  2⤵
  PID:14660
- C:\Windows\System\XIwcwNn.exe
  C:\Windows\System\XIwcwNn.exe
  2⤵
  PID:14708
- C:\Windows\System\CHUlBxq.exe
  C:\Windows\System\CHUlBxq.exe
  2⤵
  PID:14724
- C:\Windows\System\htiKAoD.exe
  C:\Windows\System\htiKAoD.exe
  2⤵
  PID:14764
- C:\Windows\System\HEJNaAI.exe
  C:\Windows\System\HEJNaAI.exe
  2⤵
  PID:14780
- C:\Windows\System\cGydMXY.exe
  C:\Windows\System\cGydMXY.exe
  2⤵
  PID:14808
- C:\Windows\System\SILwyQR.exe
  C:\Windows\System\SILwyQR.exe
  2⤵
  PID:14828
- C:\Windows\System\owoKLTt.exe
  C:\Windows\System\owoKLTt.exe
  2⤵
  PID:14856
- C:\Windows\System\xzwPMDN.exe
  C:\Windows\System\xzwPMDN.exe
  2⤵
  PID:14880
- C:\Windows\System\ErFGNhV.exe
  C:\Windows\System\ErFGNhV.exe
  2⤵
  PID:14908
- C:\Windows\System\GEcRpFF.exe
  C:\Windows\System\GEcRpFF.exe
  2⤵
  PID:14960
- C:\Windows\System\YJQRcrl.exe
  C:\Windows\System\YJQRcrl.exe
  2⤵
  PID:14988
- C:\Windows\System\RzvFlwE.exe
  C:\Windows\System\RzvFlwE.exe
  2⤵
  PID:15004
- C:\Windows\System\aukNkPy.exe
  C:\Windows\System\aukNkPy.exe
  2⤵
  PID:15032
- C:\Windows\System\JtEkXNj.exe
  C:\Windows\System\JtEkXNj.exe
  2⤵
  PID:15048
- C:\Windows\System\GbrvWwx.exe
  C:\Windows\System\GbrvWwx.exe
  2⤵
  PID:15092
- C:\Windows\System\IisLPYn.exe
  C:\Windows\System\IisLPYn.exe
  2⤵
  PID:15116
- C:\Windows\System\uHkVegI.exe
  C:\Windows\System\uHkVegI.exe
  2⤵
  PID:15144
- C:\Windows\System\XfFytzs.exe
  C:\Windows\System\XfFytzs.exe
  2⤵
  PID:15164
- C:\Windows\System\GqucWjQ.exe
  C:\Windows\System\GqucWjQ.exe
  2⤵
  PID:15200
- C:\Windows\System\EdYYyst.exe
  C:\Windows\System\EdYYyst.exe
  2⤵
  PID:15228
- C:\Windows\System\nruSkHq.exe
  C:\Windows\System\nruSkHq.exe
  2⤵
  PID:15256
- C:\Windows\System\gqqunOP.exe
  C:\Windows\System\gqqunOP.exe
  2⤵
  PID:15284
- C:\Windows\System\oYnMYUH.exe
  C:\Windows\System\oYnMYUH.exe
  2⤵
  PID:15312
- C:\Windows\System\HQYYAuo.exe
  C:\Windows\System\HQYYAuo.exe
  2⤵
  PID:15328
- C:\Windows\System\BMKHvli.exe
  C:\Windows\System\BMKHvli.exe
  2⤵
  PID:15356
- C:\Windows\System\xQRTqpf.exe
  C:\Windows\System\xQRTqpf.exe
  2⤵
  PID:14348
- C:\Windows\System\fOYkFaZ.exe
  C:\Windows\System\fOYkFaZ.exe
  2⤵
  PID:14372
- C:\Windows\System\zWDuxXr.exe
  C:\Windows\System\zWDuxXr.exe
  2⤵
  PID:14480
- C:\Windows\System\sEdSfir.exe
  C:\Windows\System\sEdSfir.exe
  2⤵
  PID:14528
- C:\Windows\System\eSRyuwM.exe
  C:\Windows\System\eSRyuwM.exe
  2⤵
  PID:14640
- C:\Windows\System\QYAOynV.exe
  C:\Windows\System\QYAOynV.exe
  2⤵
  PID:14696
- C:\Windows\System\YQeARwP.exe
  C:\Windows\System\YQeARwP.exe
  2⤵
  PID:14776
- C:\Windows\System\iJnmoSX.exe
  C:\Windows\System\iJnmoSX.exe
  2⤵
  PID:14800
- C:\Windows\System\jzcEFNL.exe
  C:\Windows\System\jzcEFNL.exe
  2⤵
  PID:14980
- C:\Windows\System\icdrFdh.exe
  C:\Windows\System\icdrFdh.exe
  2⤵
  PID:13996
- C:\Windows\System\iNvuKxl.exe
  C:\Windows\System\iNvuKxl.exe
  2⤵
  PID:15084
- C:\Windows\System\iKGYFlS.exe
  C:\Windows\System\iKGYFlS.exe
  2⤵
  PID:15128
- C:\Windows\System\tOhrcwf.exe
  C:\Windows\System\tOhrcwf.exe
  2⤵
  PID:15192
- C:\Windows\System\sZoQXiF.exe
  C:\Windows\System\sZoQXiF.exe
  2⤵
  PID:15212
- C:\Windows\System\KkvWkaz.exe
  C:\Windows\System\KkvWkaz.exe
  2⤵
  PID:15308
- C:\Windows\System\ELMIcnf.exe
  C:\Windows\System\ELMIcnf.exe
  2⤵
  PID:14344
- C:\Windows\System\HMpLVUr.exe
  C:\Windows\System\HMpLVUr.exe
  2⤵
  PID:14436
- C:\Windows\System\PEAyEUX.exe
  C:\Windows\System\PEAyEUX.exe
  2⤵
  PID:14684
- C:\Windows\System\commSPr.exe
  C:\Windows\System\commSPr.exe
  2⤵
  PID:14924
- C:\Windows\System\gqxunnR.exe
  C:\Windows\System\gqxunnR.exe
  2⤵
  PID:15000
- C:\Windows\System\yiYTZsm.exe
  C:\Windows\System\yiYTZsm.exe
  2⤵
  PID:15160
- C:\Windows\System\pGBycII.exe
  C:\Windows\System\pGBycII.exe
  2⤵
  PID:15340
- C:\Windows\System\JVhzZln.exe
  C:\Windows\System\JVhzZln.exe
  2⤵
  PID:14736
- C:\Windows\System\UoVdvDe.exe
  C:\Windows\System\UoVdvDe.exe
  2⤵
  PID:15156
- C:\Windows\System\noQPmAu.exe
  C:\Windows\System\noQPmAu.exe
  2⤵
  PID:15324
- C:\Windows\System\aNANjwT.exe
  C:\Windows\System\aNANjwT.exe
  2⤵
  PID:14432
- C:\Windows\System\AeZDVah.exe
  C:\Windows\System\AeZDVah.exe
  2⤵
  PID:15368
- C:\Windows\System\xRaeakk.exe
  C:\Windows\System\xRaeakk.exe
  2⤵
  PID:15400
- C:\Windows\System\bpUpXqQ.exe
  C:\Windows\System\bpUpXqQ.exe
  2⤵
  PID:15428
- C:\Windows\System\xzqWdKZ.exe
  C:\Windows\System\xzqWdKZ.exe
  2⤵
  PID:15460
- C:\Windows\System\eGwoKbG.exe
  C:\Windows\System\eGwoKbG.exe
  2⤵
  PID:15492
- C:\Windows\System\YlmkYNw.exe
  C:\Windows\System\YlmkYNw.exe
  2⤵
  PID:15520
- C:\Windows\System\MZxQtvF.exe
  C:\Windows\System\MZxQtvF.exe
  2⤵
  PID:15564
- C:\Windows\System\FYYMDfy.exe
  C:\Windows\System\FYYMDfy.exe
  2⤵
  PID:15592
- C:\Windows\System\wuVvRqF.exe
  C:\Windows\System\wuVvRqF.exe
  2⤵
  PID:15608
- C:\Windows\System\fdjPQjC.exe
  C:\Windows\System\fdjPQjC.exe
  2⤵
  PID:15624
- C:\Windows\System\ytxKRtn.exe
  C:\Windows\System\ytxKRtn.exe
  2⤵
  PID:15676
- C:\Windows\System\XmNPWWX.exe
  C:\Windows\System\XmNPWWX.exe
  2⤵
  PID:15700
- C:\Windows\System\EPTpwXO.exe
  C:\Windows\System\EPTpwXO.exe
  2⤵
  PID:15720
- C:\Windows\System\hovNLDL.exe
  C:\Windows\System\hovNLDL.exe
  2⤵
  PID:15748
- C:\Windows\System\vEcOlKZ.exe
  C:\Windows\System\vEcOlKZ.exe
  2⤵
  PID:15768
- C:\Windows\System\MytgwWi.exe
  C:\Windows\System\MytgwWi.exe
  2⤵
  PID:15792
- C:\Windows\System\YTNvoIt.exe
  C:\Windows\System\YTNvoIt.exe
  2⤵
  PID:15828
- C:\Windows\System\WTFzGad.exe
  C:\Windows\System\WTFzGad.exe
  2⤵
  PID:15848
- C:\Windows\System\bYOhggy.exe
  C:\Windows\System\bYOhggy.exe
  2⤵
  PID:15864
- C:\Windows\System\lJcExBw.exe
  C:\Windows\System\lJcExBw.exe
  2⤵
  PID:15888
- C:\Windows\System\LDJEGdX.exe
  C:\Windows\System\LDJEGdX.exe
  2⤵
  PID:15928
- C:\Windows\System\eqhBSyZ.exe
  C:\Windows\System\eqhBSyZ.exe
  2⤵
  PID:15952
- C:\Windows\System\qsvFVSW.exe
  C:\Windows\System\qsvFVSW.exe
  2⤵
  PID:15976
- C:\Windows\System\dFMcPQK.exe
  C:\Windows\System\dFMcPQK.exe
  2⤵
  PID:16000
- C:\Windows\System\fvZYKFJ.exe
  C:\Windows\System\fvZYKFJ.exe
  2⤵
  PID:16036
- C:\Windows\System\oZRkkqZ.exe
  C:\Windows\System\oZRkkqZ.exe
  2⤵
  PID:16060
- C:\Windows\System\cuPrwuv.exe
  C:\Windows\System\cuPrwuv.exe
  2⤵
  PID:16096
- C:\Windows\System\bbOXhKC.exe
  C:\Windows\System\bbOXhKC.exe
  2⤵
  PID:16128
- C:\Windows\System\KjDmGTR.exe
  C:\Windows\System\KjDmGTR.exe
  2⤵
  PID:16168
- C:\Windows\System\ZqtghSR.exe
  C:\Windows\System\ZqtghSR.exe
  2⤵
  PID:16188
- C:\Windows\System\MUEiCpE.exe
  C:\Windows\System\MUEiCpE.exe
  2⤵
  PID:16220
- C:\Windows\System\IudksIs.exe
  C:\Windows\System\IudksIs.exe
  2⤵
  PID:16252
- C:\Windows\System\OSJUHvN.exe
  C:\Windows\System\OSJUHvN.exe
  2⤵
  PID:16268
- C:\Windows\System\EXkinuN.exe
  C:\Windows\System\EXkinuN.exe
  2⤵
  PID:16300
- C:\Windows\System\jgXkeAU.exe
  C:\Windows\System\jgXkeAU.exe
  2⤵
  PID:16328
- C:\Windows\System\JSjDYhw.exe
  C:\Windows\System\JSjDYhw.exe
  2⤵
  PID:16348
- C:\Windows\System\eMFYhth.exe
  C:\Windows\System\eMFYhth.exe
  2⤵
  PID:16380
- C:\Windows\System\ejRJYDc.exe
  C:\Windows\System\ejRJYDc.exe
  2⤵
  PID:15408
- C:\Windows\System\JbyVlcI.exe
  C:\Windows\System\JbyVlcI.exe
  2⤵
  PID:15440
- C:\Windows\System\FIqUQFf.exe
  C:\Windows\System\FIqUQFf.exe
  2⤵
  PID:15508
- C:\Windows\System\bdmruZY.exe
  C:\Windows\System\bdmruZY.exe
  2⤵
  PID:15556
- C:\Windows\System\ejKMlWc.exe
  C:\Windows\System\ejKMlWc.exe
  2⤵
  PID:15604
- C:\Windows\System\CVRqPzQ.exe
  C:\Windows\System\CVRqPzQ.exe
  2⤵
  PID:15684
- C:\Windows\System\PkGyuWg.exe
  C:\Windows\System\PkGyuWg.exe
  2⤵
  PID:15740
- C:\Windows\System\HZGXoxu.exe
  C:\Windows\System\HZGXoxu.exe
  2⤵
  PID:15816
- C:\Windows\System\dWzhpfG.exe
  C:\Windows\System\dWzhpfG.exe
  2⤵
  PID:15876
- C:\Windows\System\UlCFPtl.exe
  C:\Windows\System\UlCFPtl.exe
  2⤵
  PID:15916
- C:\Windows\System\xVZUqUV.exe
  C:\Windows\System\xVZUqUV.exe
  2⤵
  PID:15960
- C:\Windows\System\qPDVQov.exe
  C:\Windows\System\qPDVQov.exe
  2⤵
  PID:16068
- C:\Windows\System\UqdskWt.exe
  C:\Windows\System\UqdskWt.exe
  2⤵
  PID:16140
- C:\Windows\System\kVfpJXf.exe
  C:\Windows\System\kVfpJXf.exe
  2⤵
  PID:16208
- C:\Windows\System\bDBxXvD.exe
  C:\Windows\System\bDBxXvD.exe
  2⤵
  PID:16344
- C:\Windows\System\jyKHSLY.exe
  C:\Windows\System\jyKHSLY.exe
  2⤵
  PID:16372
- C:\Windows\System\JsbgkgY.exe
  C:\Windows\System\JsbgkgY.exe
  2⤵
  PID:14976
- C:\Windows\System\eLghBwC.exe
  C:\Windows\System\eLghBwC.exe
  2⤵
  PID:15416
- C:\Windows\System\yCfNOkw.exe
  C:\Windows\System\yCfNOkw.exe
  2⤵
  PID:15884
- C:\Windows\System\vlkccCH.exe
  C:\Windows\System\vlkccCH.exe
  2⤵
  PID:15924
- C:\Windows\System\EzBheZT.exe
  C:\Windows\System\EzBheZT.exe
  2⤵
  PID:16048
- C:\Windows\System\BAxdQHE.exe
  C:\Windows\System\BAxdQHE.exe
  2⤵
  PID:16236
- C:\Windows\System\INDwzeu.exe
  C:\Windows\System\INDwzeu.exe
  2⤵
  PID:15352
- C:\Windows\System\PZMlKNX.exe
  C:\Windows\System\PZMlKNX.exe
  2⤵
  PID:16232
- C:\Windows\System\xJfHrzx.exe
  C:\Windows\System\xJfHrzx.exe
  2⤵
  PID:15784
- C:\Windows\System\yOYTYAY.exe
  C:\Windows\System\yOYTYAY.exe
  2⤵
  PID:16396
- C:\Windows\System\YhTwJGh.exe
  C:\Windows\System\YhTwJGh.exe
  2⤵
  PID:16424
- C:\Windows\System\BauACsx.exe
  C:\Windows\System\BauACsx.exe
  2⤵
  PID:16440
- C:\Windows\System\mYNVzsI.exe
  C:\Windows\System\mYNVzsI.exe
  2⤵
  PID:16468
- C:\Windows\System\IZEDIzB.exe
  C:\Windows\System\IZEDIzB.exe
  2⤵
  PID:16484
- C:\Windows\System\DKPTwAt.exe
  C:\Windows\System\DKPTwAt.exe
  2⤵
  PID:16508
- C:\Windows\System\yHQcTIn.exe
  C:\Windows\System\yHQcTIn.exe
  2⤵
  PID:16528
- C:\Windows\System\cjEzmbO.exe
  C:\Windows\System\cjEzmbO.exe
  2⤵
  PID:16572
- C:\Windows\System\DWxvgHi.exe
  C:\Windows\System\DWxvgHi.exe
  2⤵
  PID:16600
- C:\Windows\System\GYtsFNA.exe
  C:\Windows\System\GYtsFNA.exe
  2⤵
  PID:16640
- C:\Windows\System\RdaPkYA.exe
  C:\Windows\System\RdaPkYA.exe
  2⤵
  PID:16664
- C:\Windows\System\TqnJxNf.exe
  C:\Windows\System\TqnJxNf.exe
  2⤵
  PID:16688
- C:\Windows\System\uUusstd.exe
  C:\Windows\System\uUusstd.exe
  2⤵
  PID:16712
- C:\Windows\System\tCmMyFy.exe
  C:\Windows\System\tCmMyFy.exe
  2⤵
  PID:16736
- C:\Windows\System\DJrWxgK.exe
  C:\Windows\System\DJrWxgK.exe
  2⤵
  PID:16760
- C:\Windows\System\JeBYVRd.exe
  C:\Windows\System\JeBYVRd.exe
  2⤵
  PID:16792
- C:\Windows\System\FDvmWoi.exe
  C:\Windows\System\FDvmWoi.exe
  2⤵
  PID:16824
- C:\Windows\System\vPKLilP.exe
  C:\Windows\System\vPKLilP.exe
  2⤵
  PID:16852
- C:\Windows\System\IQcYqPX.exe
  C:\Windows\System\IQcYqPX.exe
  2⤵
  PID:16888
- C:\Windows\System\oDQuicZ.exe
  C:\Windows\System\oDQuicZ.exe
  2⤵
  PID:16908
- C:\Windows\System\EQHWkdO.exe
  C:\Windows\System\EQHWkdO.exe
  2⤵
  PID:16924
- C:\Windows\System\pgjgMIg.exe
  C:\Windows\System\pgjgMIg.exe
  2⤵
  PID:16956
- C:\Windows\System\VXXFbJo.exe
  C:\Windows\System\VXXFbJo.exe
  2⤵
  PID:17008
- C:\Windows\System\aGnqiqH.exe
  C:\Windows\System\aGnqiqH.exe
  2⤵
  PID:17032
- C:\Windows\System\fquzmyV.exe
  C:\Windows\System\fquzmyV.exe
  2⤵
  PID:17056
- C:\Windows\System\xBpUQun.exe
  C:\Windows\System\xBpUQun.exe
  2⤵
  PID:17084
- C:\Windows\System\AMxlOFP.exe
  C:\Windows\System\AMxlOFP.exe
  2⤵
  PID:17112
- C:\Windows\System\CMbTZPO.exe
  C:\Windows\System\CMbTZPO.exe
  2⤵
  PID:17140
- C:\Windows\System\DbgcARb.exe
  C:\Windows\System\DbgcARb.exe
  2⤵
  PID:17180
- C:\Windows\System\pNoCbwF.exe
  C:\Windows\System\pNoCbwF.exe
  2⤵
  PID:17196
- C:\Windows\System\ofquUYn.exe
  C:\Windows\System\ofquUYn.exe
  2⤵
  PID:17212
- C:\Windows\System\DvZyvIX.exe
  C:\Windows\System\DvZyvIX.exe
  2⤵
  PID:17264
- C:\Windows\System\QaFNKKo.exe
  C:\Windows\System\QaFNKKo.exe
  2⤵
  PID:17296
- C:\Windows\System\ZqlGMrz.exe
  C:\Windows\System\ZqlGMrz.exe
  2⤵
  PID:17324
- C:\Windows\System\VBhPtxC.exe
  C:\Windows\System\VBhPtxC.exe
  2⤵
  PID:17340
- C:\Windows\System\cqKrNqi.exe
  C:\Windows\System\cqKrNqi.exe
  2⤵
  PID:17368
- C:\Windows\System\deSmvAp.exe
  C:\Windows\System\deSmvAp.exe
  2⤵
  PID:17384
- C:\Windows\System\UbmYcdb.exe
  C:\Windows\System\UbmYcdb.exe
  2⤵
  PID:16452
- C:\Windows\System\IDLkIBk.exe
  C:\Windows\System\IDLkIBk.exe
  2⤵
  PID:16480
- C:\Windows\System\VgmWJJb.exe
  C:\Windows\System\VgmWJJb.exe
  2⤵
  PID:16524
- C:\Windows\System\TrVNdcy.exe
  C:\Windows\System\TrVNdcy.exe
  2⤵
  PID:16656
- C:\Windows\System\kdBZWmw.exe
  C:\Windows\System\kdBZWmw.exe
  2⤵
  PID:16684
- C:\Windows\System\ViEvexa.exe
  C:\Windows\System\ViEvexa.exe
  2⤵
  PID:16724
- C:\Windows\System\BqVDFHB.exe
  C:\Windows\System\BqVDFHB.exe
  2⤵
  PID:16840
- C:\Windows\System\GfLOTLU.exe
  C:\Windows\System\GfLOTLU.exe
  2⤵
  PID:16884
- C:\Windows\System\EfrxFgo.exe
  C:\Windows\System\EfrxFgo.exe
  2⤵
  PID:16948
- C:\Windows\System\CmrCWvb.exe
  C:\Windows\System\CmrCWvb.exe
  2⤵
  PID:16996
- C:\Windows\System\KYngJeP.exe
  C:\Windows\System\KYngJeP.exe
  2⤵
  PID:17028
- C:\Windows\System\IZPIZMA.exe
  C:\Windows\System\IZPIZMA.exe
  2⤵
  PID:17124
- C:\Windows\System\YFvCpkE.exe
  C:\Windows\System\YFvCpkE.exe
  2⤵
  PID:17164
- C:\Windows\System\lCOcrgx.exe
  C:\Windows\System\lCOcrgx.exe
  2⤵
  PID:17276
- C:\Windows\System\WtKFdIm.exe
  C:\Windows\System\WtKFdIm.exe
  2⤵
  PID:17352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4008,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8
1⤵
PID:6224

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ENDGbcw.exe

Path C:\Windows\System\ENDGbcw.exe
Size 1.7MB
SHA256 2e1d322b7fe3dc43358e16810cb320ba753abeebc8f2682971f3586b08e48090
MD5 f44efce1c485d41ca5d98e656e0050b5
SHA1 4f271c20fb26126331969530302d3ac6b78f0e25
SHA512 8f066638708435fbfd8b6421f918847bc91f05933e76aa5771df8f4037b705f1749e9ca9518866a95b09bd34f14b0770922a245c8f4739e8867d910ea91765cd
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5J:GemTLkNdfE0pZa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IDBReRV.exe

Path C:\Windows\System\IDBReRV.exe
Size 1.7MB
SHA256 7102dd70281f966792eed76625469009ce14ef67eed0fe49059e8ee8fe393fbf
MD5 32f87513b023f1a413825bdbd30765a5
SHA1 1dbc1b9c1484ecb993b916b3271f12446ad3a22f
SHA512 73d92711ae369cc16922a168570c0fcf2dbe14af1758fd424c61aedba299dfa10be5b84b50e977e12e7f6930ac80c75594026a88a6b086e3072f48b7d4762611
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE56:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

JyQmfqi.exe

Path C:\Windows\System\JyQmfqi.exe
Size 1.7MB
SHA256 7e2004979315ab16b8bf57d9efba8770df196c29d48f3a87b8afb3e6f26990ff
MD5 9430ead258a57f20424f38ee952efa0c
SHA1 6f2131d32d4afac831c7662c9dab160376c50db6
SHA512 dcf82b204c539028a244ac7c8eb544b5f214d50ebe96cbddc7cebc7cefd319fbf7802f999829ee0eb491b8877c361b5f5d4a6f4061a2fdba13a76cc52c334fc1
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5t:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

KHjdVsZ.exe

Path C:\Windows\System\KHjdVsZ.exe
Size 1.7MB
SHA256 e64579395bd500dd99f66e868a36bcd3abde8581571686a935873c2a3bdb485f
MD5 1f7ab292457b75fec1b2f70d3b26024c
SHA1 16e61aa5f75beab7ab3e5b3345c642e8ab34c186
SHA512 c41a4289e9263f3fa612b2aca0fd58ab2c00e4898be9343b22f27e7f0c7632c22fc4f06885f9a243c05ab19b5c0d676b665482ac6342965bb80a089eaa1b4cf6
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5U:GemTLkNdfE0pZaS
MD5 SHA1 SHA512 SSDEEP

Submit Download

NYeMzWd.exe

Path C:\Windows\System\NYeMzWd.exe
Size 1.7MB
SHA256 61d58386ca1a2f5cd503781fed03c20eae784f7c6966166954ba49d169cdfbe0
MD5 b22287b570427f3281ccb3f4eeed56ab
SHA1 1c74738b6b7aa35bf99ab82f00bb5a127c40eb64
SHA512 1709b52da0febda92a6e9cd89367dd7245a921535f147edad5515c3bf37537ae511ac2ce3790b35dd86bc074356e393cbf011263b7bcd3dbad27bc260066660e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5t:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

NalRaSr.exe

Path C:\Windows\System\NalRaSr.exe
Size 1.7MB
SHA256 c73323f41d2694131bf5e9ef4fe06ce37288a353a398c5f706c0d10ea1c72e3d
MD5 570f35afa1db56cd436f3adc25adeede
SHA1 0aca602e692dde99d83ec740698a4d37e717db6e
SHA512 32135a138bcf437f9539fcffdf9c6c9a9aae9932f53cb6a1348087686cdd9937e3a84f3f1c74870ae6c860f167247c218d3ed42a0ab61379ebd5ca98f9beb321
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5Y:GemTLkNdfE0pZa2
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCMHlrX.exe

Path C:\Windows\System\PCMHlrX.exe
Size 1.7MB
SHA256 ab8adf6c8c65fd6b9afc0a98cfaa19cec390a554cd411d7d3c7433d3adbfdd7e
MD5 dcceb04fdc1bcaff44b6a86cc1172fcc
SHA1 b92f01a1d89c44934f5f7fc9e6a1f527b1ce8a43
SHA512 e7a4e9ba40f58713da3d97edb3d68f204159eb4e51a7cf806b6246fd0309c54d7b06ccc50e48cdc6245e473f58437e017dce4dc2c06535137a46661ef20c57c9
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5F:GemTLkNdfE0pZaP
MD5 SHA1 SHA512 SSDEEP

Submit Download

PzeajJx.exe

Path C:\Windows\System\PzeajJx.exe
Size 1.7MB
SHA256 837cbd30d8af2daae8dc216e868057945dd5ecb2ef934ee64ffdf30bada7dc4a
MD5 09bcbe1445cf1f5c0b3ec1469b70c176
SHA1 0a8b5dc22456aa32fc01d7d615ae91371a6cecf1
SHA512 8c0fb0191e9a7667570b0ed11c8ff3f5715d284f751fe6e9347fb9c00c0cb782e0b09069321b3554965a77b4d3b9709082cc0c8833b7fcefaced5e49f70df63b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5H:GemTLkNdfE0pZaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

TLWAEgu.exe

Path C:\Windows\System\TLWAEgu.exe
Size 1.7MB
SHA256 59cef6486ae9ea839f8ac02c4ed5fcfd74b9ef79ada9430301accb3504308faf
MD5 8516f125d161d7eef54feab125c0ef03
SHA1 cb11000c94df13bb0f98c1bb43526573be6403d8
SHA512 ff8c23c596dbcf5dba248163d3a261e5a7e0360ba5234b5e4efc561cf9508925c49387cd53d18d85cb333fc96765313bf2d437878be8086f4dace4b0a5394579
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE53:GemTLkNdfE0pZaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TnKPzHs.exe

Path C:\Windows\System\TnKPzHs.exe
Size 1.7MB
SHA256 99d96515c8b735c73002c83b23e1979e0799bb02fffac86c811184787b9911e6
MD5 08c9d877afdaa47d28e67228038e2aa0
SHA1 0649176722a1ec769ec31511e8a39f7e4050baf3
SHA512 da24912df3cbbc6001d2ec5c4da18f08c2749da96a8d0c9390fa62fd237db69987af651a6881a7a3f817cbee11f65dd817a1abe6c85938e0ea55cea07ef1e669
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5P:GemTLkNdfE0pZaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

USUdXfc.exe

Path C:\Windows\System\USUdXfc.exe
Size 1.7MB
SHA256 233dbc581349b135182adbb2f8d53e38c433cd59de9511e91f93e042e0699a25
MD5 6a88f2f91571e4758231ff62a0bfcfd3
SHA1 c0508e4a8fb7f928ac8fd671171c05fee84b7260
SHA512 126aa9a43cdf58414c362a66ca53fbd8a73e4a235c95f88f976e3677a64f6577f9194201a620cb6ea85387ae896159889841164b3d18dcae3815b6070440ff41
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5q:GemTLkNdfE0pZaQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WrUrZqX.exe

Path C:\Windows\System\WrUrZqX.exe
Size 1.7MB
SHA256 5d52e93026cd68ae16997d509ebdb59345f2443dd9c4088bd1da2bc1703152ee
MD5 456d0e6994de2fbdbcf21da8aef22a14
SHA1 1e22f932fba6b28a596d1812872d600333a7de97
SHA512 e087c0a09f2b80c790d864a344ea7ab381700a2b94cf0c8e2eeaed3382350c4bce4ee7eabb8a3c22370645160442f82c7508b9a68183db67cde7b582af46e24f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5l:GemTLkNdfE0pZaH
MD5 SHA1 SHA512 SSDEEP

Submit Download

XWQUriP.exe

Path C:\Windows\System\XWQUriP.exe
Size 1.7MB
SHA256 6e9a85c1e06bed955d7eddb9346cb802f8dd926c63b9dad38fe0f9aa851d39fc
MD5 38a5e7e6c2669387dd651eccf1350ae3
SHA1 344e0af3969be6925dca70dc9dab651224acc030
SHA512 d9f9d0979ce00bd83bae24078a69ec3dc8e8b36fde9e0c09f1ed7bf628d20e6f8fe03bcd3cc8cb79098258905fa7987338af2a08558ca88e79e8ad7fb4af6968
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE58:GemTLkNdfE0pZai
MD5 SHA1 SHA512 SSDEEP

Submit Download

XviLxpr.exe

Path C:\Windows\System\XviLxpr.exe
Size 1.7MB
SHA256 0e858cc115aba10b2e6b75f5d6594dc845cd6844efb53ce10aca9e2ad9e9ab64
MD5 fa831c51087ba207ce47eedfce102980
SHA1 8c7da0651fd5e1ee0334b473341973ca2e156b3f
SHA512 f56c99cc2ea57b3293b2ce96c8db655bdb6438efabb1b4100e882d322c687e591f79a064cbba650907fbe665da7ebe28c3fcab1023a094c20c9df147ad01574b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5R:GemTLkNdfE0pZaf
MD5 SHA1 SHA512 SSDEEP

Submit Download

elthXej.exe

Path C:\Windows\System\elthXej.exe
Size 1.7MB
SHA256 a670389b4a70837f3e295dfca55d854f557875fd4643c43972134d0df4bec5a7
MD5 904d0555094f1c069201a4cf4c89132a
SHA1 3827a56e55c2c90bb275ea15f648e98456de47cb
SHA512 ddc4edf82000dafaca9ef281472eb2b6b20b26bf08fa208f58ecb761b04ac47bc60905bf8a329b272f6c8a11f062802a9d7bd9f12a89f534c13280002d42418f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5a:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

enVQKKp.exe

Path C:\Windows\System\enVQKKp.exe
Size 1.7MB
SHA256 9cf565e1b409859886f4946c841ccaebda72dfdd5721a6761fb8036c285f36e3
MD5 33771480eae70924d8fcabc7a5d52018
SHA1 32cdb997f85bec6930f2886696a48a1e06e8d912
SHA512 fa765265f84dc11d791f5b4dd3fe70f29eaebb746b37b4235fff610801d20ca23c81340ce07ba0c99fc3bff0acd78429b8487bfc378d62aa6a56377063373da0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5e:GemTLkNdfE0pZas
MD5 SHA1 SHA512 SSDEEP

Submit Download

fbdIFrq.exe

Path C:\Windows\System\fbdIFrq.exe
Size 1.7MB
SHA256 67106b67f3f467f7591f08f9408a48aefe59d5ae281ac323ff419af288f33337
MD5 14e2bfca4981f5784e9e8c1004e7af8b
SHA1 9eef44e3c5e14fdd16d6c03636acd7c93cb10fad
SHA512 b29893693a984d0280a27c02f35a6834276ea5dccf26244bff0d7431780d9fa7b5d707f8f621161c7ba4a0fa4cf0ba12f2e5e794ac30607c69baff5944f10ead
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5V:GemTLkNdfE0pZav
MD5 SHA1 SHA512 SSDEEP

Submit Download

fchOOhW.exe

Path C:\Windows\System\fchOOhW.exe
Size 1.7MB
SHA256 e94c50a4a8a8015befa75d19e454c14f0573392df15f33f7baf3427ed03619f5
MD5 1cfe265a24b8fc8c772d3d6775551397
SHA1 d94c70d9e587013d7756a3ed292c024d14e87e5a
SHA512 3812739109b95f377854ff21179a4938b79f24b934cd52684c670e66b966fcfdff2a87323442329348009ce226eb784625179e7a0a253b24fbdb782f58ff8d2d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5D:GemTLkNdfE0pZaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

fyrzpLb.exe

Path C:\Windows\System\fyrzpLb.exe
Size 1.7MB
SHA256 3c4ceca6081cad1c52da40f92fc1c4cb7634b6cbf5023285bfb21de89b0b58d0
MD5 b74538c0a149054f6b41e882d0c7e356
SHA1 5e1d0697050f2ed13e1d02773930386036030861
SHA512 e5b704c73ff9de6e146b8ad047009dc27bb57e0554ec876dfb4052f661ea54904f84d85c2130a554000390b7f5dfb25fea6f8dc326a98451aedab7cf9180c2c3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5H:GemTLkNdfE0pZax
MD5 SHA1 SHA512 SSDEEP

Submit Download

iYfnNtl.exe

Path C:\Windows\System\iYfnNtl.exe
Size 1.7MB
SHA256 b5c4aec8d7e5ff24b4b9ae3f72c0e7755df83354d80b00606203977ef3ee70b7
MD5 251efd0927f6e02cdd23f6744ef4b061
SHA1 08e7166d642dba87d5243d665137cb042a5974bb
SHA512 44281b735f374225d2c5d1d635dc521348838826b97c1fb53e11ce9ea24e4319a2e4850518d5e9a51fdc21d458d1a97fdaa5bf77308270087cbac36c0d5e2aac
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5z:GemTLkNdfE0pZap
MD5 SHA1 SHA512 SSDEEP

Submit Download

ijrtoZx.exe

Path C:\Windows\System\ijrtoZx.exe
Size 1.7MB
SHA256 870f9ced011a7a2f786c4b44e7390374dbf2b26df8c3ed38f733d481a68c463a
MD5 d63ba882b2a068804c7af3dce40a7fd3
SHA1 5f8c76fbcceccbb43aeea559bc4cfb2bedb06d22
SHA512 6efc323a889f375cae85bfab4150a50a569f64304831ce80a83b79e44ca0a185f06516762fd04090b3886eadf9cc3336c542acfaf816ea1c112aa062e14cc0f2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5M:GemTLkNdfE0pZa2
MD5 SHA1 SHA512 SSDEEP

Submit Download

irQhgtc.exe

Path C:\Windows\System\irQhgtc.exe
Size 1.7MB
SHA256 d9f75cce021e83e121fc8ea8f459c32ee5c18add9f5a991d279ea29b45154dfa
MD5 645d102d25cca95f133d1d346d032df8
SHA1 6feaffb549b1a0ce4f04fbca1f5ea8b54a369243
SHA512 e486437629fb20478f5c54553e80d7e4de312791d5670d08e0cdf8c1fa675819f61eda84b9ffd138992ef80490ba29d510791e3487bb0558c02b12496116f016
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE56:GemTLkNdfE0pZac
MD5 SHA1 SHA512 SSDEEP

Submit Download

kZRdcly.exe

Path C:\Windows\System\kZRdcly.exe
Size 1.7MB
SHA256 f76037e1fecde80b204d66feb5b491f6261820a933921b97c1d83a36c79f9d8d
MD5 fe46fc090902acf2fee5b929293d2227
SHA1 715b07cb229502f07699258c6ac6b7c5bac03d35
SHA512 274a0a7907a572fc6ec7d8f469328b90bb7ba0a443291d5baca3f6aa665a5bc0d212d5db61debff40cd9ca22a8607c5acb9b3823494f988eba12042262d96d10
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5Y:GemTLkNdfE0pZaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

leJViLu.exe

Path C:\Windows\System\leJViLu.exe
Size 1.7MB
SHA256 165508204a113845cec4b7eef437b98cf491d9d7aa147bf8951b8fd31f47cb78
MD5 a18e9f1f9f389fc01c02f4ca4949d43f
SHA1 6e74937b82a176e2202a40c81da1059bb71a2ba5
SHA512 4e64635d169a2fe00de91a2bb283bc7b21761a2ee15076b215b8b33c780fd9edb98f98c9e43fbef302a216d0af0725ff858703e8bd430f6926021c774725e6f1
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE586:GemTLkNdfE0pZaL
MD5 SHA1 SHA512 SSDEEP

Submit Download

mjdDZKt.exe

Path C:\Windows\System\mjdDZKt.exe
Size 1.7MB
SHA256 1df1d3f6137ab1e972baa429fbeeb05b306d2b2195a3561703659a45a30621b7
MD5 7d7eab6235ed9f1b97431e20bea62a00
SHA1 1ed0f82df8f893d41e3a8b92c371f1bc64d4ecdc
SHA512 8e6f030bb48cae60f47e63322083b928807c34e5c64c8e1c6c32aa50543d586462338c971215fd83b3aef455be2649ccebe20a93a44200921ff70ab5b084f00e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE57:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Submit Download

mlPrHqP.exe

Path C:\Windows\System\mlPrHqP.exe
Size 1.7MB
SHA256 bd1bfe918fa1a4781dd4cddc7fac233bd35ce4b801aa226464549bb1225ebc41
MD5 5db68d8aa32b323247f5fc49fca69a62
SHA1 a55fe5e3f8432e6e444bc1a3b329bb83f17e017e
SHA512 5486d11cb34fd4ec654fadaf05484c74325277dba9371f9f862b949476579c7ad23c786de649e8d61b6c652e79430a1548970feaa688023d2113c0d2b00e2944
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5v:GemTLkNdfE0pZat
MD5 SHA1 SHA512 SSDEEP

Submit Download

naMdIQz.exe

Path C:\Windows\System\naMdIQz.exe
Size 1.7MB
SHA256 c6ebf0b365f700274357c50c1869e186f2c5e25eac0bd930fc9f7e5854e93ebb
MD5 d2ac512ea3fe1edd6a4faea5837a8b64
SHA1 4defe2a098c82407cc23dcf94cac2d5f9ec06797
SHA512 a51b19be786c65a305767154abb36c37d08a11a5cf60ac43238795aae81116a16235084aea335b7b780a180e2154698905745aace6460e8326510003a742c24a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5X:GemTLkNdfE0pZa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

rvwwgzX.exe

Path C:\Windows\System\rvwwgzX.exe
Size 1.7MB
SHA256 2e5c34a80c8a8eaeede5583c6f5f770363e023b5f1fb138327e939a1379723ec
MD5 cead8989e8bc0b8d4f6766e80b99e7af
SHA1 329c3b665c92eb83ac04e8922db350c716ecf7e0
SHA512 888ff64fd6f9a74d58c70c3da276b223e21fd9760a3afacb2c0898f7ab307e451ee187a41f2e9b708b79002f4850b3b99fcc436d8272082f6bfff06952703b42
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE54:GemTLkNdfE0pZaW
MD5 SHA1 SHA512 SSDEEP

Submit Download

sILTyYY.exe

Path C:\Windows\System\sILTyYY.exe
Size 1.7MB
SHA256 b8830a57279a57b316d200052db9c947809cca408420e4bf71a9787acf824ede
MD5 72e09d3241aec7fc08cfd89f5e1be9bf
SHA1 18320047b0428306b35000fe00e1030a8c74dcb3
SHA512 524a6fe70f4a5bf2bd4ce7cac3b709081efebd54ec42a6b0a21291e2e3fe54df7b383110be4b47db98232f889c29df0f48d987c0e93fd977e567951deb18750f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5P:GemTLkNdfE0pZaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

vFZFlxo.exe

Path C:\Windows\System\vFZFlxo.exe
Size 1.7MB
SHA256 3b70f086590662aa8756bcfff92bc0d687b72244c42cd3120c164ae49586f2d2
MD5 55bac23f20d501758309f02c814846e2
SHA1 b0310c72e38aa9127b8409211b6db6a8978ac970
SHA512 3284e9ccd3a1b1c65ea838b7ef53e13ef8de0a424fda2d93c98e99f29673260b4dfde9beb685c164d7c3a179bf86a37e3cab56e12c25f3ee0937ca6faf610bc8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5R:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

vgljJrZ.exe

Path C:\Windows\System\vgljJrZ.exe
Size 1.7MB
SHA256 b6b31181f82b2309b33bf7d8ed3a00d90ad32b45c7004c645cf27b350ebf2705
MD5 0d121510b731fd152f733d03d34d9278
SHA1 2f85a4b3d10d160dc7c9c952b73dbcbc074bd745
SHA512 ffcb529dd11ba1c15f5ad7491030462be96b76f4f98a1143b11e725791231621064faa797ceb9d9ad7451ab52d038e0fdf5afc61ca2702527b08fea5f14188ac
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5y:GemTLkNdfE0pZag
MD5 SHA1 SHA512 SSDEEP

Submit Download

wtgmZOi.exe

Path C:\Windows\System\wtgmZOi.exe
Size 1.7MB
SHA256 e3abd1e89906ef7bb2eb43f26cf3ecf048d5f793df5ca4f721a9860000d28003
MD5 3f4844ee4e32a58cb4d629b9d4c879fe
SHA1 87d0664c27fa96652e7a5e6bf42c8d7d8708618c
SHA512 e4f635398a61a32ded54e9e46086f8017cac1bee2ba804fc1e306e43a3735d95425977b92210b79adfb06249b5646ebd0eb4660bb014ecc17b3e3e174b9490b3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5n:GemTLkNdfE0pZaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

yApBzFn.exe

Path C:\Windows\System\yApBzFn.exe
Size 1.7MB
SHA256 3d410d1a8ffea08dd849b41452d732b394b79f87ae321ab8f9c65c5b8fc36d3c
MD5 7a8e39e3f9cfbab1895dca5abb8da9a9
SHA1 630ffb32debbccba18281a4de1218f2a3d8eb7fe
SHA512 90bf6d4155de313a17241ed5435cc27b8febf5421c03e7644833e2270dfbd1d9cd805c02ca3c17c3048e77e1b4a10476457d60831d14ef0294ea119882e375e6
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkv4lEq/wE5F:GemTLkNdfE0pZa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1952-0-0x000002761D490000-0x000002761D4A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads