xmrig | 11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
Size

1.8MB
MD5

5021235e26907f6891b556d50e5336e0
SHA1

693bab7b2dedf7dec3859c06cceabcd4d144618a
SHA256

11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc
SHA512

4c601a65462da259e5939d1fb317e56d36653fa010055eab66586ca1f942899ea8cc078f600b22461b91ce0060efd054b750a3c1648bad73d599d0cc75b6e8eb
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4cTxzjnGq:GemTLkNdfE0pZan

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000700000002327a-4.dat	xmrig
behavioral2/files/0x0009000000023401-12.dat	xmrig
behavioral2/files/0x0007000000023405-11.dat	xmrig
behavioral2/files/0x0007000000023407-28.dat	xmrig
behavioral2/files/0x0007000000023409-44.dat	xmrig
behavioral2/files/0x000700000002340e-59.dat	xmrig
behavioral2/files/0x000700000002340c-64.dat	xmrig
behavioral2/files/0x000700000002340f-84.dat	xmrig
behavioral2/files/0x0007000000023418-110.dat	xmrig
behavioral2/files/0x0007000000023417-108.dat	xmrig
behavioral2/files/0x0007000000023416-106.dat	xmrig
behavioral2/files/0x0007000000023413-104.dat	xmrig
behavioral2/files/0x0007000000023412-102.dat	xmrig
behavioral2/files/0x0007000000023415-100.dat	xmrig
behavioral2/files/0x0007000000023414-98.dat	xmrig
behavioral2/files/0x0007000000023411-92.dat	xmrig
behavioral2/files/0x0007000000023410-88.dat	xmrig
behavioral2/files/0x000700000002340d-70.dat	xmrig
behavioral2/files/0x000700000002340b-61.dat	xmrig
behavioral2/files/0x0007000000023408-57.dat	xmrig
behavioral2/files/0x000700000002340a-53.dat	xmrig
behavioral2/files/0x0007000000023419-114.dat	xmrig
behavioral2/files/0x000700000002341a-118.dat	xmrig
behavioral2/files/0x000700000002341b-129.dat	xmrig
behavioral2/files/0x0008000000023402-135.dat	xmrig
behavioral2/files/0x000700000002341f-145.dat	xmrig
behavioral2/files/0x000700000002341e-142.dat	xmrig
behavioral2/files/0x0007000000023421-158.dat	xmrig
behavioral2/files/0x0007000000023424-164.dat	xmrig
behavioral2/files/0x0007000000023420-163.dat	xmrig
behavioral2/files/0x0007000000023423-162.dat	xmrig
behavioral2/files/0x0007000000023422-159.dat	xmrig
behavioral2/files/0x000700000002341c-154.dat	xmrig
behavioral2/files/0x000700000002341d-150.dat	xmrig
behavioral2/files/0x0007000000023406-25.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
996	SAocsYE.exe
1776	iyNPSmK.exe
4220	uiNurLc.exe
4024	LykMcZn.exe
4244	XkqsBNO.exe
3468	nPsaOKL.exe
5072	TSbJVFw.exe
4512	zZylAYy.exe
2116	rtjmTFT.exe
1176	qQVbINI.exe
1380	xJyKZgK.exe
4268	EpGTRKD.exe
3844	RinnlYB.exe
4932	zMpUEye.exe
2568	cVKPWzO.exe
2144	PUMubKO.exe
1068	MryBvNu.exe
4920	LZyXZdv.exe
3604	iURGAgE.exe
2488	QkVliFa.exe
1484	EnGbiAh.exe
1540	UhzClYc.exe
868	wSQuFqu.exe
8	lZUyTdz.exe
1960	jKkisfs.exe
1356	AgoNBGw.exe
4344	avnbyxW.exe
936	lkuHMpO.exe
864	uKWbQsu.exe
3104	mOeFmGa.exe
1768	TKlbtmc.exe
1624	MnVWpOM.exe
1372	jTiIjtL.exe
2332	gTtoNWE.exe
4884	wbBUnlg.exe
2276	DPPueqY.exe
4416	SUKqOTM.exe
1632	HeMiTWp.exe
5008	aGVrBiT.exe
4704	BYUybgV.exe
4000	XLKGGlZ.exe
3636	nnPqXel.exe
536	uLUfATO.exe
4340	zJTptrV.exe
5116	HGBOeOz.exe
4328	mwZHNSM.exe
4900	fGGUcvj.exe
3260	BbsumUo.exe
2492	NPXkxpn.exe
4292	AZfUZbN.exe
2368	iMYecjH.exe
1016	EbKOpdF.exe
2740	xelRnJi.exe
3728	yvNcYRs.exe
2564	bIExDBO.exe
2240	IhTPcgS.exe
3788	KoUCDrM.exe
1836	DggHbxr.exe
224	YeWaEvQ.exe
4984	zDQsFje.exe
4756	RMYXIBV.exe
4716	KMbanQz.exe
1436	JNiqfoR.exe
4004	LwAjgXV.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iSgmVWY.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\BAnmPxs.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\sMEMsxR.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\jmkHheh.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\SMNgefV.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\jieEqBX.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\dNpNkvg.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\VezQSyn.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\VqFtGzt.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\XDEcBcf.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\qUiNlif.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\EyQXxQt.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\WLSXoAs.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\yDMzvHy.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\hYAKASf.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\beucpLm.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\MWqyPDW.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\YPWfqAF.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\CtdmNkN.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\ZFDLmyt.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\MLcbTBG.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\jPxSteA.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\pTDbovm.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\AsZXtMi.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\RihbQpi.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\VexMdwU.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\FQEWORQ.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\uiNurLc.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\YhQCCfo.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\UGTiMeZ.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\fEUOHhd.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\InhIEtN.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\eJrgQfy.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\ywOZMZG.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\dyVoOcI.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\NgzgocN.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\eZNBAsW.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\XKoQWmy.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\rKfiJwG.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\hXUWYod.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\adeQzIl.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\MVUpsRY.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\FGhFhpp.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\iOkiZBV.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\UVifhnF.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\mmOlTgO.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\oSktWcH.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\KWLabeb.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\RXqkobZ.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\IxcrZnw.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\CnhqUAn.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\qvHCSse.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\wZthWds.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\ErAMcwo.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\JjGHqJh.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\ZiKnzEr.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\uQgCsCA.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\TKcvNEj.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\nPsaOKL.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\qBrnYAT.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\cXvqvkK.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\StCqmIJ.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\HvJbnNA.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
File created	C:\Windows\System\jgkrPPe.exe	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4256	dwm.exe
Token: SeChangeNotifyPrivilege	4256	dwm.exe
Token: 33	4256	dwm.exe
Token: SeIncBasePriorityPrivilege	4256	dwm.exe
Token: SeShutdownPrivilege	4256	dwm.exe
Token: SeCreatePagefilePrivilege	4256	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 996	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	83
PID 4476 wrote to memory of 996	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	83
PID 4476 wrote to memory of 1776	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	84
PID 4476 wrote to memory of 1776	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	84
PID 4476 wrote to memory of 4220	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	85
PID 4476 wrote to memory of 4220	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	85
PID 4476 wrote to memory of 4024	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	86
PID 4476 wrote to memory of 4024	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	86
PID 4476 wrote to memory of 4244	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	87
PID 4476 wrote to memory of 4244	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	87
PID 4476 wrote to memory of 4512	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	88
PID 4476 wrote to memory of 4512	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	88
PID 4476 wrote to memory of 3468	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	89
PID 4476 wrote to memory of 3468	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	89
PID 4476 wrote to memory of 5072	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	90
PID 4476 wrote to memory of 5072	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	90
PID 4476 wrote to memory of 2116	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	91
PID 4476 wrote to memory of 2116	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	91
PID 4476 wrote to memory of 1176	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	92
PID 4476 wrote to memory of 1176	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	92
PID 4476 wrote to memory of 1380	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	93
PID 4476 wrote to memory of 1380	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	93
PID 4476 wrote to memory of 4268	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	94
PID 4476 wrote to memory of 4268	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	94
PID 4476 wrote to memory of 3844	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	95
PID 4476 wrote to memory of 3844	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	95
PID 4476 wrote to memory of 4932	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	96
PID 4476 wrote to memory of 4932	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	96
PID 4476 wrote to memory of 2568	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	97
PID 4476 wrote to memory of 2568	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	97
PID 4476 wrote to memory of 2144	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	98
PID 4476 wrote to memory of 2144	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	98
PID 4476 wrote to memory of 1068	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	99
PID 4476 wrote to memory of 1068	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	99
PID 4476 wrote to memory of 4920	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	100
PID 4476 wrote to memory of 4920	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	100
PID 4476 wrote to memory of 3604	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	101
PID 4476 wrote to memory of 3604	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	101
PID 4476 wrote to memory of 2488	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	102
PID 4476 wrote to memory of 2488	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	102
PID 4476 wrote to memory of 1484	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	103
PID 4476 wrote to memory of 1484	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	103
PID 4476 wrote to memory of 1540	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	104
PID 4476 wrote to memory of 1540	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	104
PID 4476 wrote to memory of 868	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	105
PID 4476 wrote to memory of 868	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	105
PID 4476 wrote to memory of 8	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	106
PID 4476 wrote to memory of 8	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	106
PID 4476 wrote to memory of 1960	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	107
PID 4476 wrote to memory of 1960	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	107
PID 4476 wrote to memory of 1356	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	108
PID 4476 wrote to memory of 1356	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	108
PID 4476 wrote to memory of 4344	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	109
PID 4476 wrote to memory of 4344	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	109
PID 4476 wrote to memory of 936	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	110
PID 4476 wrote to memory of 936	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	110
PID 4476 wrote to memory of 864	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	111
PID 4476 wrote to memory of 864	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	111
PID 4476 wrote to memory of 3104	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	112
PID 4476 wrote to memory of 3104	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	112
PID 4476 wrote to memory of 2332	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	113
PID 4476 wrote to memory of 2332	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	113
PID 4476 wrote to memory of 1768	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	114
PID 4476 wrote to memory of 1768	4476	11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\11289a54ad335c0a4c7c6252595f26ea9b83cc4645f04785dbfaa3797bc966cc_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\System\SAocsYE.exe
  C:\Windows\System\SAocsYE.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\iyNPSmK.exe
  C:\Windows\System\iyNPSmK.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\uiNurLc.exe
  C:\Windows\System\uiNurLc.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\LykMcZn.exe
  C:\Windows\System\LykMcZn.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\XkqsBNO.exe
  C:\Windows\System\XkqsBNO.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\zZylAYy.exe
  C:\Windows\System\zZylAYy.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\nPsaOKL.exe
  C:\Windows\System\nPsaOKL.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\TSbJVFw.exe
  C:\Windows\System\TSbJVFw.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\rtjmTFT.exe
  C:\Windows\System\rtjmTFT.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\qQVbINI.exe
  C:\Windows\System\qQVbINI.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\xJyKZgK.exe
  C:\Windows\System\xJyKZgK.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\EpGTRKD.exe
  C:\Windows\System\EpGTRKD.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\RinnlYB.exe
  C:\Windows\System\RinnlYB.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\zMpUEye.exe
  C:\Windows\System\zMpUEye.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\cVKPWzO.exe
  C:\Windows\System\cVKPWzO.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\PUMubKO.exe
  C:\Windows\System\PUMubKO.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\MryBvNu.exe
  C:\Windows\System\MryBvNu.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\LZyXZdv.exe
  C:\Windows\System\LZyXZdv.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\iURGAgE.exe
  C:\Windows\System\iURGAgE.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\QkVliFa.exe
  C:\Windows\System\QkVliFa.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\EnGbiAh.exe
  C:\Windows\System\EnGbiAh.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\UhzClYc.exe
  C:\Windows\System\UhzClYc.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\wSQuFqu.exe
  C:\Windows\System\wSQuFqu.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\lZUyTdz.exe
  C:\Windows\System\lZUyTdz.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\jKkisfs.exe
  C:\Windows\System\jKkisfs.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\AgoNBGw.exe
  C:\Windows\System\AgoNBGw.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\avnbyxW.exe
  C:\Windows\System\avnbyxW.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\lkuHMpO.exe
  C:\Windows\System\lkuHMpO.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\uKWbQsu.exe
  C:\Windows\System\uKWbQsu.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\mOeFmGa.exe
  C:\Windows\System\mOeFmGa.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\gTtoNWE.exe
  C:\Windows\System\gTtoNWE.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\TKlbtmc.exe
  C:\Windows\System\TKlbtmc.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\MnVWpOM.exe
  C:\Windows\System\MnVWpOM.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\jTiIjtL.exe
  C:\Windows\System\jTiIjtL.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\wbBUnlg.exe
  C:\Windows\System\wbBUnlg.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\DPPueqY.exe
  C:\Windows\System\DPPueqY.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\SUKqOTM.exe
  C:\Windows\System\SUKqOTM.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\HeMiTWp.exe
  C:\Windows\System\HeMiTWp.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\aGVrBiT.exe
  C:\Windows\System\aGVrBiT.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\BYUybgV.exe
  C:\Windows\System\BYUybgV.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\XLKGGlZ.exe
  C:\Windows\System\XLKGGlZ.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\nnPqXel.exe
  C:\Windows\System\nnPqXel.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\uLUfATO.exe
  C:\Windows\System\uLUfATO.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\zJTptrV.exe
  C:\Windows\System\zJTptrV.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\HGBOeOz.exe
  C:\Windows\System\HGBOeOz.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\mwZHNSM.exe
  C:\Windows\System\mwZHNSM.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\fGGUcvj.exe
  C:\Windows\System\fGGUcvj.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\BbsumUo.exe
  C:\Windows\System\BbsumUo.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\NPXkxpn.exe
  C:\Windows\System\NPXkxpn.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\AZfUZbN.exe
  C:\Windows\System\AZfUZbN.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\iMYecjH.exe
  C:\Windows\System\iMYecjH.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\EbKOpdF.exe
  C:\Windows\System\EbKOpdF.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\xelRnJi.exe
  C:\Windows\System\xelRnJi.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\yvNcYRs.exe
  C:\Windows\System\yvNcYRs.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\bIExDBO.exe
  C:\Windows\System\bIExDBO.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\IhTPcgS.exe
  C:\Windows\System\IhTPcgS.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\KoUCDrM.exe
  C:\Windows\System\KoUCDrM.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\DggHbxr.exe
  C:\Windows\System\DggHbxr.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\YeWaEvQ.exe
  C:\Windows\System\YeWaEvQ.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\zDQsFje.exe
  C:\Windows\System\zDQsFje.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\RMYXIBV.exe
  C:\Windows\System\RMYXIBV.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\KMbanQz.exe
  C:\Windows\System\KMbanQz.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\JNiqfoR.exe
  C:\Windows\System\JNiqfoR.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\LwAjgXV.exe
  C:\Windows\System\LwAjgXV.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\oVQHlNX.exe
  C:\Windows\System\oVQHlNX.exe
  2⤵
  PID:2748
- C:\Windows\System\eSVfevM.exe
  C:\Windows\System\eSVfevM.exe
  2⤵
  PID:1064
- C:\Windows\System\VqkoNQk.exe
  C:\Windows\System\VqkoNQk.exe
  2⤵
  PID:4480
- C:\Windows\System\lPFEaMA.exe
  C:\Windows\System\lPFEaMA.exe
  2⤵
  PID:468
- C:\Windows\System\rCkgdhp.exe
  C:\Windows\System\rCkgdhp.exe
  2⤵
  PID:4460
- C:\Windows\System\sOUCtKm.exe
  C:\Windows\System\sOUCtKm.exe
  2⤵
  PID:60
- C:\Windows\System\yUzOFet.exe
  C:\Windows\System\yUzOFet.exe
  2⤵
  PID:4140
- C:\Windows\System\cZDrKpc.exe
  C:\Windows\System\cZDrKpc.exe
  2⤵
  PID:832
- C:\Windows\System\KplTTnn.exe
  C:\Windows\System\KplTTnn.exe
  2⤵
  PID:2324
- C:\Windows\System\gqmbogC.exe
  C:\Windows\System\gqmbogC.exe
  2⤵
  PID:1288
- C:\Windows\System\sOQgsyZ.exe
  C:\Windows\System\sOQgsyZ.exe
  2⤵
  PID:3244
- C:\Windows\System\LWSJyRS.exe
  C:\Windows\System\LWSJyRS.exe
  2⤵
  PID:2916
- C:\Windows\System\YPWfqAF.exe
  C:\Windows\System\YPWfqAF.exe
  2⤵
  PID:1256
- C:\Windows\System\nEGWmoX.exe
  C:\Windows\System\nEGWmoX.exe
  2⤵
  PID:4316
- C:\Windows\System\VoXjiKM.exe
  C:\Windows\System\VoXjiKM.exe
  2⤵
  PID:5084
- C:\Windows\System\meYScaz.exe
  C:\Windows\System\meYScaz.exe
  2⤵
  PID:2900
- C:\Windows\System\JXCIjBa.exe
  C:\Windows\System\JXCIjBa.exe
  2⤵
  PID:1104
- C:\Windows\System\OEuhUnx.exe
  C:\Windows\System\OEuhUnx.exe
  2⤵
  PID:552
- C:\Windows\System\KwfhngA.exe
  C:\Windows\System\KwfhngA.exe
  2⤵
  PID:1548
- C:\Windows\System\PLAghQm.exe
  C:\Windows\System\PLAghQm.exe
  2⤵
  PID:4052
- C:\Windows\System\mbzuQwc.exe
  C:\Windows\System\mbzuQwc.exe
  2⤵
  PID:1444
- C:\Windows\System\UiZcowZ.exe
  C:\Windows\System\UiZcowZ.exe
  2⤵
  PID:2964
- C:\Windows\System\KlADYmO.exe
  C:\Windows\System\KlADYmO.exe
  2⤵
  PID:4924
- C:\Windows\System\xDAaATI.exe
  C:\Windows\System\xDAaATI.exe
  2⤵
  PID:3408
- C:\Windows\System\hECcrBF.exe
  C:\Windows\System\hECcrBF.exe
  2⤵
  PID:2012
- C:\Windows\System\CtTKmbx.exe
  C:\Windows\System\CtTKmbx.exe
  2⤵
  PID:1912
- C:\Windows\System\BLGhOVH.exe
  C:\Windows\System\BLGhOVH.exe
  2⤵
  PID:2296
- C:\Windows\System\gOOWuAv.exe
  C:\Windows\System\gOOWuAv.exe
  2⤵
  PID:2640
- C:\Windows\System\gxZqgxv.exe
  C:\Windows\System\gxZqgxv.exe
  2⤵
  PID:5052
- C:\Windows\System\WzBNoTv.exe
  C:\Windows\System\WzBNoTv.exe
  2⤵
  PID:4616
- C:\Windows\System\fiKIXna.exe
  C:\Windows\System\fiKIXna.exe
  2⤵
  PID:2024
- C:\Windows\System\ESgYRjR.exe
  C:\Windows\System\ESgYRjR.exe
  2⤵
  PID:1556
- C:\Windows\System\qCPAKKK.exe
  C:\Windows\System\qCPAKKK.exe
  2⤵
  PID:3676
- C:\Windows\System\jztzzuU.exe
  C:\Windows\System\jztzzuU.exe
  2⤵
  PID:5152
- C:\Windows\System\cuDVRqg.exe
  C:\Windows\System\cuDVRqg.exe
  2⤵
  PID:5168
- C:\Windows\System\IGKZgQM.exe
  C:\Windows\System\IGKZgQM.exe
  2⤵
  PID:5208
- C:\Windows\System\kPIQSlo.exe
  C:\Windows\System\kPIQSlo.exe
  2⤵
  PID:5240
- C:\Windows\System\jlTGovY.exe
  C:\Windows\System\jlTGovY.exe
  2⤵
  PID:5272
- C:\Windows\System\SAHfGvm.exe
  C:\Windows\System\SAHfGvm.exe
  2⤵
  PID:5292
- C:\Windows\System\nKurGNh.exe
  C:\Windows\System\nKurGNh.exe
  2⤵
  PID:5328
- C:\Windows\System\fAHcbgd.exe
  C:\Windows\System\fAHcbgd.exe
  2⤵
  PID:5360
- C:\Windows\System\UKpwOEB.exe
  C:\Windows\System\UKpwOEB.exe
  2⤵
  PID:5384
- C:\Windows\System\XwnDewj.exe
  C:\Windows\System\XwnDewj.exe
  2⤵
  PID:5412
- C:\Windows\System\gFKLdnl.exe
  C:\Windows\System\gFKLdnl.exe
  2⤵
  PID:5432
- C:\Windows\System\eWuCATr.exe
  C:\Windows\System\eWuCATr.exe
  2⤵
  PID:5468
- C:\Windows\System\zMTiiYe.exe
  C:\Windows\System\zMTiiYe.exe
  2⤵
  PID:5484
- C:\Windows\System\zDheflb.exe
  C:\Windows\System\zDheflb.exe
  2⤵
  PID:5516
- C:\Windows\System\XKoQWmy.exe
  C:\Windows\System\XKoQWmy.exe
  2⤵
  PID:5552
- C:\Windows\System\CtdmNkN.exe
  C:\Windows\System\CtdmNkN.exe
  2⤵
  PID:5580
- C:\Windows\System\LLPWJRD.exe
  C:\Windows\System\LLPWJRD.exe
  2⤵
  PID:5616
- C:\Windows\System\TvZsoTe.exe
  C:\Windows\System\TvZsoTe.exe
  2⤵
  PID:5648
- C:\Windows\System\GIvTlfr.exe
  C:\Windows\System\GIvTlfr.exe
  2⤵
  PID:5684
- C:\Windows\System\lCuRVnj.exe
  C:\Windows\System\lCuRVnj.exe
  2⤵
  PID:5712
- C:\Windows\System\VexMdwU.exe
  C:\Windows\System\VexMdwU.exe
  2⤵
  PID:5744
- C:\Windows\System\nmceBdK.exe
  C:\Windows\System\nmceBdK.exe
  2⤵
  PID:5772
- C:\Windows\System\VKpHuhu.exe
  C:\Windows\System\VKpHuhu.exe
  2⤵
  PID:5800
- C:\Windows\System\ZeqFZmq.exe
  C:\Windows\System\ZeqFZmq.exe
  2⤵
  PID:5828
- C:\Windows\System\XKvJLlR.exe
  C:\Windows\System\XKvJLlR.exe
  2⤵
  PID:5864
- C:\Windows\System\COvGzlu.exe
  C:\Windows\System\COvGzlu.exe
  2⤵
  PID:5892
- C:\Windows\System\IxcrZnw.exe
  C:\Windows\System\IxcrZnw.exe
  2⤵
  PID:5912
- C:\Windows\System\nrSpWfm.exe
  C:\Windows\System\nrSpWfm.exe
  2⤵
  PID:5952
- C:\Windows\System\OtFTreS.exe
  C:\Windows\System\OtFTreS.exe
  2⤵
  PID:5996
- C:\Windows\System\TWxZCgS.exe
  C:\Windows\System\TWxZCgS.exe
  2⤵
  PID:6028
- C:\Windows\System\KkgbPlL.exe
  C:\Windows\System\KkgbPlL.exe
  2⤵
  PID:6060
- C:\Windows\System\eKMIKEP.exe
  C:\Windows\System\eKMIKEP.exe
  2⤵
  PID:6076
- C:\Windows\System\uRXtAdx.exe
  C:\Windows\System\uRXtAdx.exe
  2⤵
  PID:6116
- C:\Windows\System\VfZEJNA.exe
  C:\Windows\System\VfZEJNA.exe
  2⤵
  PID:2020
- C:\Windows\System\FlOBwZT.exe
  C:\Windows\System\FlOBwZT.exe
  2⤵
  PID:5204
- C:\Windows\System\TZeYUVb.exe
  C:\Windows\System\TZeYUVb.exe
  2⤵
  PID:5268
- C:\Windows\System\LsyhamZ.exe
  C:\Windows\System\LsyhamZ.exe
  2⤵
  PID:5352
- C:\Windows\System\PpuncVS.exe
  C:\Windows\System\PpuncVS.exe
  2⤵
  PID:5440
- C:\Windows\System\SbgjKqI.exe
  C:\Windows\System\SbgjKqI.exe
  2⤵
  PID:5480
- C:\Windows\System\biBVXzk.exe
  C:\Windows\System\biBVXzk.exe
  2⤵
  PID:5512
- C:\Windows\System\HdwPPgB.exe
  C:\Windows\System\HdwPPgB.exe
  2⤵
  PID:5628
- C:\Windows\System\nggKWRX.exe
  C:\Windows\System\nggKWRX.exe
  2⤵
  PID:5724
- C:\Windows\System\KfZTYKT.exe
  C:\Windows\System\KfZTYKT.exe
  2⤵
  PID:5784
- C:\Windows\System\XGCnmJh.exe
  C:\Windows\System\XGCnmJh.exe
  2⤵
  PID:5856
- C:\Windows\System\pwACBMR.exe
  C:\Windows\System\pwACBMR.exe
  2⤵
  PID:5932
- C:\Windows\System\wfVgBbb.exe
  C:\Windows\System\wfVgBbb.exe
  2⤵
  PID:6016
- C:\Windows\System\iOdhQXH.exe
  C:\Windows\System\iOdhQXH.exe
  2⤵
  PID:6112
- C:\Windows\System\JESlUvm.exe
  C:\Windows\System\JESlUvm.exe
  2⤵
  PID:1092
- C:\Windows\System\RNgqCFf.exe
  C:\Windows\System\RNgqCFf.exe
  2⤵
  PID:5264
- C:\Windows\System\rKfiJwG.exe
  C:\Windows\System\rKfiJwG.exe
  2⤵
  PID:5340
- C:\Windows\System\kDbfMCn.exe
  C:\Windows\System\kDbfMCn.exe
  2⤵
  PID:4532
- C:\Windows\System\QIRIOQy.exe
  C:\Windows\System\QIRIOQy.exe
  2⤵
  PID:5568
- C:\Windows\System\akyXNLL.exe
  C:\Windows\System\akyXNLL.exe
  2⤵
  PID:5048
- C:\Windows\System\yPQSIDX.exe
  C:\Windows\System\yPQSIDX.exe
  2⤵
  PID:5824
- C:\Windows\System\mnOmfEZ.exe
  C:\Windows\System\mnOmfEZ.exe
  2⤵
  PID:6096
- C:\Windows\System\CVQEgok.exe
  C:\Windows\System\CVQEgok.exe
  2⤵
  PID:5320
- C:\Windows\System\pkDtJdN.exe
  C:\Windows\System\pkDtJdN.exe
  2⤵
  PID:2908
- C:\Windows\System\RVDaEWb.exe
  C:\Windows\System\RVDaEWb.exe
  2⤵
  PID:5792
- C:\Windows\System\msqtgBp.exe
  C:\Windows\System\msqtgBp.exe
  2⤵
  PID:5420
- C:\Windows\System\KbBsInI.exe
  C:\Windows\System\KbBsInI.exe
  2⤵
  PID:5300
- C:\Windows\System\QYvuvub.exe
  C:\Windows\System\QYvuvub.exe
  2⤵
  PID:6164
- C:\Windows\System\NlfVira.exe
  C:\Windows\System\NlfVira.exe
  2⤵
  PID:6196
- C:\Windows\System\yLJyfzV.exe
  C:\Windows\System\yLJyfzV.exe
  2⤵
  PID:6212
- C:\Windows\System\bhtjwQR.exe
  C:\Windows\System\bhtjwQR.exe
  2⤵
  PID:6228
- C:\Windows\System\wIthPQt.exe
  C:\Windows\System\wIthPQt.exe
  2⤵
  PID:6256
- C:\Windows\System\sHDOGnL.exe
  C:\Windows\System\sHDOGnL.exe
  2⤵
  PID:6284
- C:\Windows\System\UyVxOUp.exe
  C:\Windows\System\UyVxOUp.exe
  2⤵
  PID:6308
- C:\Windows\System\PATNIzA.exe
  C:\Windows\System\PATNIzA.exe
  2⤵
  PID:6344
- C:\Windows\System\ZFDLmyt.exe
  C:\Windows\System\ZFDLmyt.exe
  2⤵
  PID:6380
- C:\Windows\System\ctCtAaP.exe
  C:\Windows\System\ctCtAaP.exe
  2⤵
  PID:6412
- C:\Windows\System\JjGHqJh.exe
  C:\Windows\System\JjGHqJh.exe
  2⤵
  PID:6436
- C:\Windows\System\FQEWORQ.exe
  C:\Windows\System\FQEWORQ.exe
  2⤵
  PID:6472
- C:\Windows\System\JfYFkdJ.exe
  C:\Windows\System\JfYFkdJ.exe
  2⤵
  PID:6504
- C:\Windows\System\dADqkxP.exe
  C:\Windows\System\dADqkxP.exe
  2⤵
  PID:6520
- C:\Windows\System\oWpaZaP.exe
  C:\Windows\System\oWpaZaP.exe
  2⤵
  PID:6556
- C:\Windows\System\ZchhOkb.exe
  C:\Windows\System\ZchhOkb.exe
  2⤵
  PID:6588
- C:\Windows\System\fEUOHhd.exe
  C:\Windows\System\fEUOHhd.exe
  2⤵
  PID:6616
- C:\Windows\System\Zcsufxt.exe
  C:\Windows\System\Zcsufxt.exe
  2⤵
  PID:6644
- C:\Windows\System\tbLpxgx.exe
  C:\Windows\System\tbLpxgx.exe
  2⤵
  PID:6660
- C:\Windows\System\FkzFLNl.exe
  C:\Windows\System\FkzFLNl.exe
  2⤵
  PID:6676
- C:\Windows\System\rXkjskF.exe
  C:\Windows\System\rXkjskF.exe
  2⤵
  PID:6692
- C:\Windows\System\cNjFHfg.exe
  C:\Windows\System\cNjFHfg.exe
  2⤵
  PID:6708
- C:\Windows\System\ySUNwIT.exe
  C:\Windows\System\ySUNwIT.exe
  2⤵
  PID:6724
- C:\Windows\System\qAhdymL.exe
  C:\Windows\System\qAhdymL.exe
  2⤵
  PID:6748
- C:\Windows\System\iOkiZBV.exe
  C:\Windows\System\iOkiZBV.exe
  2⤵
  PID:6780
- C:\Windows\System\ZIzdzEx.exe
  C:\Windows\System\ZIzdzEx.exe
  2⤵
  PID:6812
- C:\Windows\System\eFVeHDv.exe
  C:\Windows\System\eFVeHDv.exe
  2⤵
  PID:6860
- C:\Windows\System\ETfBvTN.exe
  C:\Windows\System\ETfBvTN.exe
  2⤵
  PID:6888
- C:\Windows\System\smIWFRr.exe
  C:\Windows\System\smIWFRr.exe
  2⤵
  PID:6928
- C:\Windows\System\fxFFZUR.exe
  C:\Windows\System\fxFFZUR.exe
  2⤵
  PID:6956
- C:\Windows\System\TuwoRdr.exe
  C:\Windows\System\TuwoRdr.exe
  2⤵
  PID:6984
- C:\Windows\System\FcazDRv.exe
  C:\Windows\System\FcazDRv.exe
  2⤵
  PID:7012
- C:\Windows\System\mWXMYzO.exe
  C:\Windows\System\mWXMYzO.exe
  2⤵
  PID:7040
- C:\Windows\System\gjAANnd.exe
  C:\Windows\System\gjAANnd.exe
  2⤵
  PID:7080
- C:\Windows\System\bzZdJka.exe
  C:\Windows\System\bzZdJka.exe
  2⤵
  PID:7120
- C:\Windows\System\uTcNdex.exe
  C:\Windows\System\uTcNdex.exe
  2⤵
  PID:7148
- C:\Windows\System\zCCDsCZ.exe
  C:\Windows\System\zCCDsCZ.exe
  2⤵
  PID:6148
- C:\Windows\System\RHkETeD.exe
  C:\Windows\System\RHkETeD.exe
  2⤵
  PID:6220
- C:\Windows\System\ZiKnzEr.exe
  C:\Windows\System\ZiKnzEr.exe
  2⤵
  PID:6304
- C:\Windows\System\UjnLFFR.exe
  C:\Windows\System\UjnLFFR.exe
  2⤵
  PID:6340
- C:\Windows\System\phXNIUU.exe
  C:\Windows\System\phXNIUU.exe
  2⤵
  PID:6392
- C:\Windows\System\nHAZkFP.exe
  C:\Windows\System\nHAZkFP.exe
  2⤵
  PID:6460
- C:\Windows\System\tbeXsLj.exe
  C:\Windows\System\tbeXsLj.exe
  2⤵
  PID:6544
- C:\Windows\System\vDGsoij.exe
  C:\Windows\System\vDGsoij.exe
  2⤵
  PID:6584
- C:\Windows\System\CnhqUAn.exe
  C:\Windows\System\CnhqUAn.exe
  2⤵
  PID:6668
- C:\Windows\System\zgdrfky.exe
  C:\Windows\System\zgdrfky.exe
  2⤵
  PID:6720
- C:\Windows\System\WofLDOd.exe
  C:\Windows\System\WofLDOd.exe
  2⤵
  PID:6796
- C:\Windows\System\SsMVkCd.exe
  C:\Windows\System\SsMVkCd.exe
  2⤵
  PID:6848
- C:\Windows\System\CcoXYiZ.exe
  C:\Windows\System\CcoXYiZ.exe
  2⤵
  PID:6940
- C:\Windows\System\eSpyKXM.exe
  C:\Windows\System\eSpyKXM.exe
  2⤵
  PID:7000
- C:\Windows\System\rgowKvL.exe
  C:\Windows\System\rgowKvL.exe
  2⤵
  PID:7076
- C:\Windows\System\UVifhnF.exe
  C:\Windows\System\UVifhnF.exe
  2⤵
  PID:5760
- C:\Windows\System\FwYXSAV.exe
  C:\Windows\System\FwYXSAV.exe
  2⤵
  PID:6360
- C:\Windows\System\EyQXxQt.exe
  C:\Windows\System\EyQXxQt.exe
  2⤵
  PID:6512
- C:\Windows\System\InhIEtN.exe
  C:\Windows\System\InhIEtN.exe
  2⤵
  PID:6684
- C:\Windows\System\HDJIiko.exe
  C:\Windows\System\HDJIiko.exe
  2⤵
  PID:6840
- C:\Windows\System\SBTParQ.exe
  C:\Windows\System\SBTParQ.exe
  2⤵
  PID:6972
- C:\Windows\System\CKHpsXf.exe
  C:\Windows\System\CKHpsXf.exe
  2⤵
  PID:7160
- C:\Windows\System\chdYNSd.exe
  C:\Windows\System\chdYNSd.exe
  2⤵
  PID:6488
- C:\Windows\System\qLlIEix.exe
  C:\Windows\System\qLlIEix.exe
  2⤵
  PID:7056
- C:\Windows\System\UBMsbnJ.exe
  C:\Windows\System\UBMsbnJ.exe
  2⤵
  PID:7048
- C:\Windows\System\ZEuvWfv.exe
  C:\Windows\System\ZEuvWfv.exe
  2⤵
  PID:7188
- C:\Windows\System\DGlOmgl.exe
  C:\Windows\System\DGlOmgl.exe
  2⤵
  PID:7204
- C:\Windows\System\dfsuSVM.exe
  C:\Windows\System\dfsuSVM.exe
  2⤵
  PID:7236
- C:\Windows\System\dyVoOcI.exe
  C:\Windows\System\dyVoOcI.exe
  2⤵
  PID:7256
- C:\Windows\System\pkQjyZb.exe
  C:\Windows\System\pkQjyZb.exe
  2⤵
  PID:7276
- C:\Windows\System\hXUWYod.exe
  C:\Windows\System\hXUWYod.exe
  2⤵
  PID:7292
- C:\Windows\System\msuXLFS.exe
  C:\Windows\System\msuXLFS.exe
  2⤵
  PID:7324
- C:\Windows\System\hEvKVlG.exe
  C:\Windows\System\hEvKVlG.exe
  2⤵
  PID:7356
- C:\Windows\System\AyhVqYr.exe
  C:\Windows\System\AyhVqYr.exe
  2⤵
  PID:7400
- C:\Windows\System\DKLFeWs.exe
  C:\Windows\System\DKLFeWs.exe
  2⤵
  PID:7432
- C:\Windows\System\CfNCJiA.exe
  C:\Windows\System\CfNCJiA.exe
  2⤵
  PID:7456
- C:\Windows\System\nwWCAPf.exe
  C:\Windows\System\nwWCAPf.exe
  2⤵
  PID:7472
- C:\Windows\System\RSYjuQm.exe
  C:\Windows\System\RSYjuQm.exe
  2⤵
  PID:7492
- C:\Windows\System\wesTCSo.exe
  C:\Windows\System\wesTCSo.exe
  2⤵
  PID:7516
- C:\Windows\System\TtgudRf.exe
  C:\Windows\System\TtgudRf.exe
  2⤵
  PID:7536
- C:\Windows\System\mKNxkzl.exe
  C:\Windows\System\mKNxkzl.exe
  2⤵
  PID:7576
- C:\Windows\System\HlxUbWj.exe
  C:\Windows\System\HlxUbWj.exe
  2⤵
  PID:7612
- C:\Windows\System\KzPGqra.exe
  C:\Windows\System\KzPGqra.exe
  2⤵
  PID:7644
- C:\Windows\System\xNOvpJO.exe
  C:\Windows\System\xNOvpJO.exe
  2⤵
  PID:7672
- C:\Windows\System\JolXkwV.exe
  C:\Windows\System\JolXkwV.exe
  2⤵
  PID:7712
- C:\Windows\System\SiTysnt.exe
  C:\Windows\System\SiTysnt.exe
  2⤵
  PID:7740
- C:\Windows\System\kjbtjvj.exe
  C:\Windows\System\kjbtjvj.exe
  2⤵
  PID:7776
- C:\Windows\System\rvdBssy.exe
  C:\Windows\System\rvdBssy.exe
  2⤵
  PID:7804
- C:\Windows\System\kxuHCSi.exe
  C:\Windows\System\kxuHCSi.exe
  2⤵
  PID:7832
- C:\Windows\System\lsvlMLP.exe
  C:\Windows\System\lsvlMLP.exe
  2⤵
  PID:7860
- C:\Windows\System\KwwMUfh.exe
  C:\Windows\System\KwwMUfh.exe
  2⤵
  PID:7888
- C:\Windows\System\XtyvOUa.exe
  C:\Windows\System\XtyvOUa.exe
  2⤵
  PID:7924
- C:\Windows\System\iBPRvtE.exe
  C:\Windows\System\iBPRvtE.exe
  2⤵
  PID:7944
- C:\Windows\System\RLOtFFZ.exe
  C:\Windows\System\RLOtFFZ.exe
  2⤵
  PID:7960
- C:\Windows\System\sSjYyBz.exe
  C:\Windows\System\sSjYyBz.exe
  2⤵
  PID:8000
- C:\Windows\System\sVlqjiS.exe
  C:\Windows\System\sVlqjiS.exe
  2⤵
  PID:8016
- C:\Windows\System\ilbqiJt.exe
  C:\Windows\System\ilbqiJt.exe
  2⤵
  PID:8048
- C:\Windows\System\SGoHOTm.exe
  C:\Windows\System\SGoHOTm.exe
  2⤵
  PID:8076
- C:\Windows\System\NtjJLZb.exe
  C:\Windows\System\NtjJLZb.exe
  2⤵
  PID:8112
- C:\Windows\System\kjncyzr.exe
  C:\Windows\System\kjncyzr.exe
  2⤵
  PID:8132
- C:\Windows\System\MrxzqFo.exe
  C:\Windows\System\MrxzqFo.exe
  2⤵
  PID:8168
- C:\Windows\System\gMDBNMh.exe
  C:\Windows\System\gMDBNMh.exe
  2⤵
  PID:7172
- C:\Windows\System\McZrBSD.exe
  C:\Windows\System\McZrBSD.exe
  2⤵
  PID:7200
- C:\Windows\System\AsfIQFZ.exe
  C:\Windows\System\AsfIQFZ.exe
  2⤵
  PID:7284
- C:\Windows\System\NojggMq.exe
  C:\Windows\System\NojggMq.exe
  2⤵
  PID:7368
- C:\Windows\System\KhBMgnW.exe
  C:\Windows\System\KhBMgnW.exe
  2⤵
  PID:7452
- C:\Windows\System\bsWPyyF.exe
  C:\Windows\System\bsWPyyF.exe
  2⤵
  PID:7508
- C:\Windows\System\lUBRBxC.exe
  C:\Windows\System\lUBRBxC.exe
  2⤵
  PID:7544
- C:\Windows\System\CbsOGcS.exe
  C:\Windows\System\CbsOGcS.exe
  2⤵
  PID:7640
- C:\Windows\System\xUBYlHH.exe
  C:\Windows\System\xUBYlHH.exe
  2⤵
  PID:7720
- C:\Windows\System\MEaCloS.exe
  C:\Windows\System\MEaCloS.exe
  2⤵
  PID:7772
- C:\Windows\System\lMOMpbE.exe
  C:\Windows\System\lMOMpbE.exe
  2⤵
  PID:7844
- C:\Windows\System\WLSXoAs.exe
  C:\Windows\System\WLSXoAs.exe
  2⤵
  PID:7880
- C:\Windows\System\UPgaeTL.exe
  C:\Windows\System\UPgaeTL.exe
  2⤵
  PID:7936
- C:\Windows\System\CJtTOgO.exe
  C:\Windows\System\CJtTOgO.exe
  2⤵
  PID:8028
- C:\Windows\System\HPTDNbE.exe
  C:\Windows\System\HPTDNbE.exe
  2⤵
  PID:8096
- C:\Windows\System\aNBwweO.exe
  C:\Windows\System\aNBwweO.exe
  2⤵
  PID:8164
- C:\Windows\System\mmOlTgO.exe
  C:\Windows\System\mmOlTgO.exe
  2⤵
  PID:7224
- C:\Windows\System\ooxxXQP.exe
  C:\Windows\System\ooxxXQP.exe
  2⤵
  PID:7416
- C:\Windows\System\NuVtcRF.exe
  C:\Windows\System\NuVtcRF.exe
  2⤵
  PID:7556
- C:\Windows\System\WutChPG.exe
  C:\Windows\System\WutChPG.exe
  2⤵
  PID:7824
- C:\Windows\System\qBrnYAT.exe
  C:\Windows\System\qBrnYAT.exe
  2⤵
  PID:7972
- C:\Windows\System\zevdNXt.exe
  C:\Windows\System\zevdNXt.exe
  2⤵
  PID:8128
- C:\Windows\System\nRzsBJF.exe
  C:\Windows\System\nRzsBJF.exe
  2⤵
  PID:7196
- C:\Windows\System\KbYEzOx.exe
  C:\Windows\System\KbYEzOx.exe
  2⤵
  PID:7624
- C:\Windows\System\ccdSBBc.exe
  C:\Windows\System\ccdSBBc.exe
  2⤵
  PID:8036
- C:\Windows\System\LZlCOgJ.exe
  C:\Windows\System\LZlCOgJ.exe
  2⤵
  PID:7872
- C:\Windows\System\spWmqDK.exe
  C:\Windows\System\spWmqDK.exe
  2⤵
  PID:8216
- C:\Windows\System\YxDpwhI.exe
  C:\Windows\System\YxDpwhI.exe
  2⤵
  PID:8244
- C:\Windows\System\WDGqpcj.exe
  C:\Windows\System\WDGqpcj.exe
  2⤵
  PID:8288
- C:\Windows\System\ScgECFa.exe
  C:\Windows\System\ScgECFa.exe
  2⤵
  PID:8320
- C:\Windows\System\suYuDbw.exe
  C:\Windows\System\suYuDbw.exe
  2⤵
  PID:8356
- C:\Windows\System\MDGjSzb.exe
  C:\Windows\System\MDGjSzb.exe
  2⤵
  PID:8380
- C:\Windows\System\UfcnuRq.exe
  C:\Windows\System\UfcnuRq.exe
  2⤵
  PID:8416
- C:\Windows\System\oZkpcMl.exe
  C:\Windows\System\oZkpcMl.exe
  2⤵
  PID:8452
- C:\Windows\System\sLbceQY.exe
  C:\Windows\System\sLbceQY.exe
  2⤵
  PID:8476
- C:\Windows\System\virbJnK.exe
  C:\Windows\System\virbJnK.exe
  2⤵
  PID:8500
- C:\Windows\System\RfkAxRF.exe
  C:\Windows\System\RfkAxRF.exe
  2⤵
  PID:8516
- C:\Windows\System\EixHFnp.exe
  C:\Windows\System\EixHFnp.exe
  2⤵
  PID:8552
- C:\Windows\System\VUwaMss.exe
  C:\Windows\System\VUwaMss.exe
  2⤵
  PID:8588
- C:\Windows\System\TIwpzOH.exe
  C:\Windows\System\TIwpzOH.exe
  2⤵
  PID:8628
- C:\Windows\System\dABPVnO.exe
  C:\Windows\System\dABPVnO.exe
  2⤵
  PID:8652
- C:\Windows\System\IezdgjP.exe
  C:\Windows\System\IezdgjP.exe
  2⤵
  PID:8676
- C:\Windows\System\DWYjwjp.exe
  C:\Windows\System\DWYjwjp.exe
  2⤵
  PID:8700
- C:\Windows\System\ECQxjlg.exe
  C:\Windows\System\ECQxjlg.exe
  2⤵
  PID:8732
- C:\Windows\System\ORBtSHX.exe
  C:\Windows\System\ORBtSHX.exe
  2⤵
  PID:8760
- C:\Windows\System\zctbfeP.exe
  C:\Windows\System\zctbfeP.exe
  2⤵
  PID:8792
- C:\Windows\System\esUZAeR.exe
  C:\Windows\System\esUZAeR.exe
  2⤵
  PID:8836
- C:\Windows\System\yRpeiZj.exe
  C:\Windows\System\yRpeiZj.exe
  2⤵
  PID:8876
- C:\Windows\System\GrhQyUK.exe
  C:\Windows\System\GrhQyUK.exe
  2⤵
  PID:8904
- C:\Windows\System\bgkkbdQ.exe
  C:\Windows\System\bgkkbdQ.exe
  2⤵
  PID:8936
- C:\Windows\System\vOKHHhl.exe
  C:\Windows\System\vOKHHhl.exe
  2⤵
  PID:8952
- C:\Windows\System\BGKaexb.exe
  C:\Windows\System\BGKaexb.exe
  2⤵
  PID:8972
- C:\Windows\System\gyhBAjA.exe
  C:\Windows\System\gyhBAjA.exe
  2⤵
  PID:8988
- C:\Windows\System\gSkoRbc.exe
  C:\Windows\System\gSkoRbc.exe
  2⤵
  PID:9016
- C:\Windows\System\hkgAkKh.exe
  C:\Windows\System\hkgAkKh.exe
  2⤵
  PID:9044
- C:\Windows\System\FRSdwus.exe
  C:\Windows\System\FRSdwus.exe
  2⤵
  PID:9076
- C:\Windows\System\VmdqgMz.exe
  C:\Windows\System\VmdqgMz.exe
  2⤵
  PID:9108
- C:\Windows\System\XajlgPL.exe
  C:\Windows\System\XajlgPL.exe
  2⤵
  PID:9144
- C:\Windows\System\UjFAKgN.exe
  C:\Windows\System\UjFAKgN.exe
  2⤵
  PID:9168
- C:\Windows\System\ENXJeVe.exe
  C:\Windows\System\ENXJeVe.exe
  2⤵
  PID:9200
- C:\Windows\System\FxhktuY.exe
  C:\Windows\System\FxhktuY.exe
  2⤵
  PID:8160
- C:\Windows\System\NjqIoAa.exe
  C:\Windows\System\NjqIoAa.exe
  2⤵
  PID:8232
- C:\Windows\System\kAmEEdP.exe
  C:\Windows\System\kAmEEdP.exe
  2⤵
  PID:8372
- C:\Windows\System\VVymUGU.exe
  C:\Windows\System\VVymUGU.exe
  2⤵
  PID:8460
- C:\Windows\System\OOBXNzW.exe
  C:\Windows\System\OOBXNzW.exe
  2⤵
  PID:8536
- C:\Windows\System\pjJostF.exe
  C:\Windows\System\pjJostF.exe
  2⤵
  PID:8616
- C:\Windows\System\lRaDPHq.exe
  C:\Windows\System\lRaDPHq.exe
  2⤵
  PID:8688
- C:\Windows\System\fZuUCye.exe
  C:\Windows\System\fZuUCye.exe
  2⤵
  PID:8800
- C:\Windows\System\HFLKUEN.exe
  C:\Windows\System\HFLKUEN.exe
  2⤵
  PID:8892
- C:\Windows\System\vWWPipw.exe
  C:\Windows\System\vWWPipw.exe
  2⤵
  PID:8960
- C:\Windows\System\fKlLkKI.exe
  C:\Windows\System\fKlLkKI.exe
  2⤵
  PID:9036
- C:\Windows\System\xAIMRON.exe
  C:\Windows\System\xAIMRON.exe
  2⤵
  PID:9136
- C:\Windows\System\WyHJKwc.exe
  C:\Windows\System\WyHJKwc.exe
  2⤵
  PID:9124
- C:\Windows\System\gssAANt.exe
  C:\Windows\System\gssAANt.exe
  2⤵
  PID:8256
- C:\Windows\System\HRlezNG.exe
  C:\Windows\System\HRlezNG.exe
  2⤵
  PID:8448
- C:\Windows\System\adeQzIl.exe
  C:\Windows\System\adeQzIl.exe
  2⤵
  PID:8584
- C:\Windows\System\FXYFgyx.exe
  C:\Windows\System\FXYFgyx.exe
  2⤵
  PID:8752
- C:\Windows\System\MGjNGks.exe
  C:\Windows\System\MGjNGks.exe
  2⤵
  PID:8848
- C:\Windows\System\DdtwVUv.exe
  C:\Windows\System\DdtwVUv.exe
  2⤵
  PID:9064
- C:\Windows\System\wVhkgEx.exe
  C:\Windows\System\wVhkgEx.exe
  2⤵
  PID:9208
- C:\Windows\System\lxOhBzG.exe
  C:\Windows\System\lxOhBzG.exe
  2⤵
  PID:8364
- C:\Windows\System\SevuDEm.exe
  C:\Windows\System\SevuDEm.exe
  2⤵
  PID:8860
- C:\Windows\System\tEYRWRy.exe
  C:\Windows\System\tEYRWRy.exe
  2⤵
  PID:8204
- C:\Windows\System\jpkBzyz.exe
  C:\Windows\System\jpkBzyz.exe
  2⤵
  PID:9244
- C:\Windows\System\duQmdkk.exe
  C:\Windows\System\duQmdkk.exe
  2⤵
  PID:9280
- C:\Windows\System\EahAynD.exe
  C:\Windows\System\EahAynD.exe
  2⤵
  PID:9304
- C:\Windows\System\LJanWFO.exe
  C:\Windows\System\LJanWFO.exe
  2⤵
  PID:9324
- C:\Windows\System\QUszqPt.exe
  C:\Windows\System\QUszqPt.exe
  2⤵
  PID:9340
- C:\Windows\System\MLcbTBG.exe
  C:\Windows\System\MLcbTBG.exe
  2⤵
  PID:9360
- C:\Windows\System\qgDrpCd.exe
  C:\Windows\System\qgDrpCd.exe
  2⤵
  PID:9384
- C:\Windows\System\BbHNoVO.exe
  C:\Windows\System\BbHNoVO.exe
  2⤵
  PID:9400
- C:\Windows\System\lGoCLbL.exe
  C:\Windows\System\lGoCLbL.exe
  2⤵
  PID:9416
- C:\Windows\System\Lbgxwpa.exe
  C:\Windows\System\Lbgxwpa.exe
  2⤵
  PID:9432
- C:\Windows\System\MaLXONe.exe
  C:\Windows\System\MaLXONe.exe
  2⤵
  PID:9468
- C:\Windows\System\YeVqaWQ.exe
  C:\Windows\System\YeVqaWQ.exe
  2⤵
  PID:9484
- C:\Windows\System\SoDQPlX.exe
  C:\Windows\System\SoDQPlX.exe
  2⤵
  PID:9500
- C:\Windows\System\yDMzvHy.exe
  C:\Windows\System\yDMzvHy.exe
  2⤵
  PID:9536
- C:\Windows\System\gFVbatU.exe
  C:\Windows\System\gFVbatU.exe
  2⤵
  PID:9568
- C:\Windows\System\keYKSws.exe
  C:\Windows\System\keYKSws.exe
  2⤵
  PID:9596
- C:\Windows\System\hicGAxW.exe
  C:\Windows\System\hicGAxW.exe
  2⤵
  PID:9644
- C:\Windows\System\jKluCLI.exe
  C:\Windows\System\jKluCLI.exe
  2⤵
  PID:9680
- C:\Windows\System\MGGWGdv.exe
  C:\Windows\System\MGGWGdv.exe
  2⤵
  PID:9708
- C:\Windows\System\WAclenC.exe
  C:\Windows\System\WAclenC.exe
  2⤵
  PID:9732
- C:\Windows\System\hQfiWTh.exe
  C:\Windows\System\hQfiWTh.exe
  2⤵
  PID:9760
- C:\Windows\System\XuqwhRY.exe
  C:\Windows\System\XuqwhRY.exe
  2⤵
  PID:9796
- C:\Windows\System\cdnntwB.exe
  C:\Windows\System\cdnntwB.exe
  2⤵
  PID:9832
- C:\Windows\System\ZjjNcjU.exe
  C:\Windows\System\ZjjNcjU.exe
  2⤵
  PID:9856
- C:\Windows\System\TuMPBPb.exe
  C:\Windows\System\TuMPBPb.exe
  2⤵
  PID:9888
- C:\Windows\System\lDWWvsi.exe
  C:\Windows\System\lDWWvsi.exe
  2⤵
  PID:9908
- C:\Windows\System\aqXuqaa.exe
  C:\Windows\System\aqXuqaa.exe
  2⤵
  PID:9944
- C:\Windows\System\vwoJNjU.exe
  C:\Windows\System\vwoJNjU.exe
  2⤵
  PID:9976
- C:\Windows\System\GFhtlJP.exe
  C:\Windows\System\GFhtlJP.exe
  2⤵
  PID:10008
- C:\Windows\System\sFHroel.exe
  C:\Windows\System\sFHroel.exe
  2⤵
  PID:10048
- C:\Windows\System\bLnySgB.exe
  C:\Windows\System\bLnySgB.exe
  2⤵
  PID:10084
- C:\Windows\System\SyaZCld.exe
  C:\Windows\System\SyaZCld.exe
  2⤵
  PID:10112
- C:\Windows\System\iYkUtIk.exe
  C:\Windows\System\iYkUtIk.exe
  2⤵
  PID:10136
- C:\Windows\System\nNEzPva.exe
  C:\Windows\System\nNEzPva.exe
  2⤵
  PID:10176
- C:\Windows\System\MYnlHSo.exe
  C:\Windows\System\MYnlHSo.exe
  2⤵
  PID:10204
- C:\Windows\System\MVUpsRY.exe
  C:\Windows\System\MVUpsRY.exe
  2⤵
  PID:10236
- C:\Windows\System\CBQaDOL.exe
  C:\Windows\System\CBQaDOL.exe
  2⤵
  PID:9252
- C:\Windows\System\HELBMhG.exe
  C:\Windows\System\HELBMhG.exe
  2⤵
  PID:9316
- C:\Windows\System\OLoScly.exe
  C:\Windows\System\OLoScly.exe
  2⤵
  PID:9276
- C:\Windows\System\KxSQnzZ.exe
  C:\Windows\System\KxSQnzZ.exe
  2⤵
  PID:9408
- C:\Windows\System\DYgotJL.exe
  C:\Windows\System\DYgotJL.exe
  2⤵
  PID:9564
- C:\Windows\System\tvYEzZJ.exe
  C:\Windows\System\tvYEzZJ.exe
  2⤵
  PID:9668
- C:\Windows\System\ZVALTYu.exe
  C:\Windows\System\ZVALTYu.exe
  2⤵
  PID:9624
- C:\Windows\System\BjasxUj.exe
  C:\Windows\System\BjasxUj.exe
  2⤵
  PID:9780
- C:\Windows\System\gifPbVp.exe
  C:\Windows\System\gifPbVp.exe
  2⤵
  PID:3656
- C:\Windows\System\bfraOAp.exe
  C:\Windows\System\bfraOAp.exe
  2⤵
  PID:9928
- C:\Windows\System\LscESoC.exe
  C:\Windows\System\LscESoC.exe
  2⤵
  PID:9968
- C:\Windows\System\NOVMbLx.exe
  C:\Windows\System\NOVMbLx.exe
  2⤵
  PID:9964
- C:\Windows\System\qdqXekN.exe
  C:\Windows\System\qdqXekN.exe
  2⤵
  PID:10032
- C:\Windows\System\JkyLqhD.exe
  C:\Windows\System\JkyLqhD.exe
  2⤵
  PID:10156
- C:\Windows\System\yEZZPDp.exe
  C:\Windows\System\yEZZPDp.exe
  2⤵
  PID:10232
- C:\Windows\System\KeOPJuM.exe
  C:\Windows\System\KeOPJuM.exe
  2⤵
  PID:9296
- C:\Windows\System\jmkHheh.exe
  C:\Windows\System\jmkHheh.exe
  2⤵
  PID:9332
- C:\Windows\System\hYAKASf.exe
  C:\Windows\System\hYAKASf.exe
  2⤵
  PID:9352
- C:\Windows\System\oWoxCWT.exe
  C:\Windows\System\oWoxCWT.exe
  2⤵
  PID:9704
- C:\Windows\System\WeVdlSG.exe
  C:\Windows\System\WeVdlSG.exe
  2⤵
  PID:9916
- C:\Windows\System\LtTNMIy.exe
  C:\Windows\System\LtTNMIy.exe
  2⤵
  PID:10160
- C:\Windows\System\zuPTYlu.exe
  C:\Windows\System\zuPTYlu.exe
  2⤵
  PID:10200
- C:\Windows\System\dTFwuWv.exe
  C:\Windows\System\dTFwuWv.exe
  2⤵
  PID:9372
- C:\Windows\System\dJzAzOd.exe
  C:\Windows\System\dJzAzOd.exe
  2⤵
  PID:9880
- C:\Windows\System\tGJYNIV.exe
  C:\Windows\System\tGJYNIV.exe
  2⤵
  PID:9228
- C:\Windows\System\nhGaTJs.exe
  C:\Windows\System\nhGaTJs.exe
  2⤵
  PID:8580
- C:\Windows\System\sLHRJRF.exe
  C:\Windows\System\sLHRJRF.exe
  2⤵
  PID:10244
- C:\Windows\System\zFmuSMC.exe
  C:\Windows\System\zFmuSMC.exe
  2⤵
  PID:10280
- C:\Windows\System\NbFjbxX.exe
  C:\Windows\System\NbFjbxX.exe
  2⤵
  PID:10312
- C:\Windows\System\kEKEJUl.exe
  C:\Windows\System\kEKEJUl.exe
  2⤵
  PID:10344
- C:\Windows\System\AayYEtb.exe
  C:\Windows\System\AayYEtb.exe
  2⤵
  PID:10372
- C:\Windows\System\sbjhCWT.exe
  C:\Windows\System\sbjhCWT.exe
  2⤵
  PID:10400
- C:\Windows\System\wyseVxq.exe
  C:\Windows\System\wyseVxq.exe
  2⤵
  PID:10432
- C:\Windows\System\bOiKJLS.exe
  C:\Windows\System\bOiKJLS.exe
  2⤵
  PID:10456
- C:\Windows\System\poLHLoU.exe
  C:\Windows\System\poLHLoU.exe
  2⤵
  PID:10492
- C:\Windows\System\stLhzxf.exe
  C:\Windows\System\stLhzxf.exe
  2⤵
  PID:10524
- C:\Windows\System\WmLCMmi.exe
  C:\Windows\System\WmLCMmi.exe
  2⤵
  PID:10540
- C:\Windows\System\hRovJCp.exe
  C:\Windows\System\hRovJCp.exe
  2⤵
  PID:10568
- C:\Windows\System\wIukHuT.exe
  C:\Windows\System\wIukHuT.exe
  2⤵
  PID:10604
- C:\Windows\System\REthYMw.exe
  C:\Windows\System\REthYMw.exe
  2⤵
  PID:10636
- C:\Windows\System\zKMRUBZ.exe
  C:\Windows\System\zKMRUBZ.exe
  2⤵
  PID:10652
- C:\Windows\System\arIpUng.exe
  C:\Windows\System\arIpUng.exe
  2⤵
  PID:10680
- C:\Windows\System\oPhNPmP.exe
  C:\Windows\System\oPhNPmP.exe
  2⤵
  PID:10708
- C:\Windows\System\vKZpjnS.exe
  C:\Windows\System\vKZpjnS.exe
  2⤵
  PID:10732
- C:\Windows\System\oonxert.exe
  C:\Windows\System\oonxert.exe
  2⤵
  PID:10764
- C:\Windows\System\JvfjJwa.exe
  C:\Windows\System\JvfjJwa.exe
  2⤵
  PID:10788
- C:\Windows\System\KWLabeb.exe
  C:\Windows\System\KWLabeb.exe
  2⤵
  PID:10808
- C:\Windows\System\HBuTzRp.exe
  C:\Windows\System\HBuTzRp.exe
  2⤵
  PID:10844
- C:\Windows\System\SMNgefV.exe
  C:\Windows\System\SMNgefV.exe
  2⤵
  PID:10876
- C:\Windows\System\sYPutcc.exe
  C:\Windows\System\sYPutcc.exe
  2⤵
  PID:10904
- C:\Windows\System\deuzdVP.exe
  C:\Windows\System\deuzdVP.exe
  2⤵
  PID:10940
- C:\Windows\System\yEecdFo.exe
  C:\Windows\System\yEecdFo.exe
  2⤵
  PID:10984
- C:\Windows\System\XzuFGCW.exe
  C:\Windows\System\XzuFGCW.exe
  2⤵
  PID:11008
- C:\Windows\System\emptXpZ.exe
  C:\Windows\System\emptXpZ.exe
  2⤵
  PID:11024
- C:\Windows\System\ovoZEuq.exe
  C:\Windows\System\ovoZEuq.exe
  2⤵
  PID:11044
- C:\Windows\System\ZjSZtNm.exe
  C:\Windows\System\ZjSZtNm.exe
  2⤵
  PID:11072
- C:\Windows\System\AmdaAeQ.exe
  C:\Windows\System\AmdaAeQ.exe
  2⤵
  PID:11120
- C:\Windows\System\pSJPubp.exe
  C:\Windows\System\pSJPubp.exe
  2⤵
  PID:11144
- C:\Windows\System\wRgkbXK.exe
  C:\Windows\System\wRgkbXK.exe
  2⤵
  PID:11172
- C:\Windows\System\gdDdOCj.exe
  C:\Windows\System\gdDdOCj.exe
  2⤵
  PID:11208
- C:\Windows\System\lJLFejE.exe
  C:\Windows\System\lJLFejE.exe
  2⤵
  PID:11224
- C:\Windows\System\aPllsAL.exe
  C:\Windows\System\aPllsAL.exe
  2⤵
  PID:11252
- C:\Windows\System\beucpLm.exe
  C:\Windows\System\beucpLm.exe
  2⤵
  PID:10300
- C:\Windows\System\HMqNnXr.exe
  C:\Windows\System\HMqNnXr.exe
  2⤵
  PID:10332
- C:\Windows\System\mRiMyEy.exe
  C:\Windows\System\mRiMyEy.exe
  2⤵
  PID:10356
- C:\Windows\System\XDEcBcf.exe
  C:\Windows\System\XDEcBcf.exe
  2⤵
  PID:10428
- C:\Windows\System\afqpEXF.exe
  C:\Windows\System\afqpEXF.exe
  2⤵
  PID:10504
- C:\Windows\System\XvKcsYs.exe
  C:\Windows\System\XvKcsYs.exe
  2⤵
  PID:10596
- C:\Windows\System\jMUZaNo.exe
  C:\Windows\System\jMUZaNo.exe
  2⤵
  PID:10624
- C:\Windows\System\JmgAzAC.exe
  C:\Windows\System\JmgAzAC.exe
  2⤵
  PID:10704
- C:\Windows\System\efDYeDw.exe
  C:\Windows\System\efDYeDw.exe
  2⤵
  PID:10752
- C:\Windows\System\OBAyEmi.exe
  C:\Windows\System\OBAyEmi.exe
  2⤵
  PID:10856
- C:\Windows\System\SkvdyuU.exe
  C:\Windows\System\SkvdyuU.exe
  2⤵
  PID:10912
- C:\Windows\System\HRMLEzG.exe
  C:\Windows\System\HRMLEzG.exe
  2⤵
  PID:10980
- C:\Windows\System\mTYLqvH.exe
  C:\Windows\System\mTYLqvH.exe
  2⤵
  PID:11036
- C:\Windows\System\zMrmwRW.exe
  C:\Windows\System\zMrmwRW.exe
  2⤵
  PID:11112
- C:\Windows\System\pSkVdak.exe
  C:\Windows\System\pSkVdak.exe
  2⤵
  PID:11180
- C:\Windows\System\IcgETjt.exe
  C:\Windows\System\IcgETjt.exe
  2⤵
  PID:11200
- C:\Windows\System\QaALUWE.exe
  C:\Windows\System\QaALUWE.exe
  2⤵
  PID:9896
- C:\Windows\System\pthzpHl.exe
  C:\Windows\System\pthzpHl.exe
  2⤵
  PID:10272
- C:\Windows\System\XcIgpJf.exe
  C:\Windows\System\XcIgpJf.exe
  2⤵
  PID:10536
- C:\Windows\System\kKApfnb.exe
  C:\Windows\System\kKApfnb.exe
  2⤵
  PID:10668
- C:\Windows\System\ZGZNjnB.exe
  C:\Windows\System\ZGZNjnB.exe
  2⤵
  PID:10900
- C:\Windows\System\FrQUcRn.exe
  C:\Windows\System\FrQUcRn.exe
  2⤵
  PID:11032
- C:\Windows\System\hLKMnYa.exe
  C:\Windows\System\hLKMnYa.exe
  2⤵
  PID:11192
- C:\Windows\System\ebWwDIm.exe
  C:\Windows\System\ebWwDIm.exe
  2⤵
  PID:11248
- C:\Windows\System\AxOgMqw.exe
  C:\Windows\System\AxOgMqw.exe
  2⤵
  PID:10772
- C:\Windows\System\jTwDMnr.exe
  C:\Windows\System\jTwDMnr.exe
  2⤵
  PID:10920
- C:\Windows\System\NqERvrw.exe
  C:\Windows\System\NqERvrw.exe
  2⤵
  PID:9312
- C:\Windows\System\jhFtWBf.exe
  C:\Windows\System\jhFtWBf.exe
  2⤵
  PID:11272
- C:\Windows\System\fCVseiU.exe
  C:\Windows\System\fCVseiU.exe
  2⤵
  PID:11296
- C:\Windows\System\oSktWcH.exe
  C:\Windows\System\oSktWcH.exe
  2⤵
  PID:11328
- C:\Windows\System\UDnImkn.exe
  C:\Windows\System\UDnImkn.exe
  2⤵
  PID:11348
- C:\Windows\System\gxZmkda.exe
  C:\Windows\System\gxZmkda.exe
  2⤵
  PID:11384
- C:\Windows\System\OjHFeJA.exe
  C:\Windows\System\OjHFeJA.exe
  2⤵
  PID:11404
- C:\Windows\System\RHRnlKX.exe
  C:\Windows\System\RHRnlKX.exe
  2⤵
  PID:11424
- C:\Windows\System\LMozUiA.exe
  C:\Windows\System\LMozUiA.exe
  2⤵
  PID:11452
- C:\Windows\System\BJbiAng.exe
  C:\Windows\System\BJbiAng.exe
  2⤵
  PID:11480
- C:\Windows\System\CHxCrqj.exe
  C:\Windows\System\CHxCrqj.exe
  2⤵
  PID:11508
- C:\Windows\System\qvHCSse.exe
  C:\Windows\System\qvHCSse.exe
  2⤵
  PID:11552
- C:\Windows\System\YwPtBIA.exe
  C:\Windows\System\YwPtBIA.exe
  2⤵
  PID:11580
- C:\Windows\System\IRNzpIE.exe
  C:\Windows\System\IRNzpIE.exe
  2⤵
  PID:11608
- C:\Windows\System\PnMxIaB.exe
  C:\Windows\System\PnMxIaB.exe
  2⤵
  PID:11632
- C:\Windows\System\mhNrpqn.exe
  C:\Windows\System\mhNrpqn.exe
  2⤵
  PID:11664
- C:\Windows\System\qMwwSPt.exe
  C:\Windows\System\qMwwSPt.exe
  2⤵
  PID:11692
- C:\Windows\System\hWvIaxM.exe
  C:\Windows\System\hWvIaxM.exe
  2⤵
  PID:11724
- C:\Windows\System\xTCGSPd.exe
  C:\Windows\System\xTCGSPd.exe
  2⤵
  PID:11752
- C:\Windows\System\FltOgIB.exe
  C:\Windows\System\FltOgIB.exe
  2⤵
  PID:11788
- C:\Windows\System\EdEOHdc.exe
  C:\Windows\System\EdEOHdc.exe
  2⤵
  PID:11804
- C:\Windows\System\MbMjwOg.exe
  C:\Windows\System\MbMjwOg.exe
  2⤵
  PID:11840
- C:\Windows\System\bKkEQsk.exe
  C:\Windows\System\bKkEQsk.exe
  2⤵
  PID:11868
- C:\Windows\System\JhSEWgL.exe
  C:\Windows\System\JhSEWgL.exe
  2⤵
  PID:11892
- C:\Windows\System\KMmXnIO.exe
  C:\Windows\System\KMmXnIO.exe
  2⤵
  PID:11924
- C:\Windows\System\cWERuSV.exe
  C:\Windows\System\cWERuSV.exe
  2⤵
  PID:11968
- C:\Windows\System\iKZHHCl.exe
  C:\Windows\System\iKZHHCl.exe
  2⤵
  PID:11996
- C:\Windows\System\eBJdnxP.exe
  C:\Windows\System\eBJdnxP.exe
  2⤵
  PID:12024
- C:\Windows\System\XqmaRME.exe
  C:\Windows\System\XqmaRME.exe
  2⤵
  PID:12040
- C:\Windows\System\HUqQdqH.exe
  C:\Windows\System\HUqQdqH.exe
  2⤵
  PID:12072
- C:\Windows\System\FVBKIHQ.exe
  C:\Windows\System\FVBKIHQ.exe
  2⤵
  PID:12092
- C:\Windows\System\vUxnjek.exe
  C:\Windows\System\vUxnjek.exe
  2⤵
  PID:12120
- C:\Windows\System\RLMgwSj.exe
  C:\Windows\System\RLMgwSj.exe
  2⤵
  PID:12160
- C:\Windows\System\lcCclmH.exe
  C:\Windows\System\lcCclmH.exe
  2⤵
  PID:12196
- C:\Windows\System\hhCEAun.exe
  C:\Windows\System\hhCEAun.exe
  2⤵
  PID:12232
- C:\Windows\System\QhLqWWX.exe
  C:\Windows\System\QhLqWWX.exe
  2⤵
  PID:12256
- C:\Windows\System\TckKiaE.exe
  C:\Windows\System\TckKiaE.exe
  2⤵
  PID:10932
- C:\Windows\System\GjXGUYL.exe
  C:\Windows\System\GjXGUYL.exe
  2⤵
  PID:11268
- C:\Windows\System\dEFngTC.exe
  C:\Windows\System\dEFngTC.exe
  2⤵
  PID:11376
- C:\Windows\System\jZVYheJ.exe
  C:\Windows\System\jZVYheJ.exe
  2⤵
  PID:11412
- C:\Windows\System\olbrywI.exe
  C:\Windows\System\olbrywI.exe
  2⤵
  PID:11468
- C:\Windows\System\SGugatp.exe
  C:\Windows\System\SGugatp.exe
  2⤵
  PID:11572
- C:\Windows\System\rIzoNZo.exe
  C:\Windows\System\rIzoNZo.exe
  2⤵
  PID:11648
- C:\Windows\System\eKpiBkv.exe
  C:\Windows\System\eKpiBkv.exe
  2⤵
  PID:11700
- C:\Windows\System\jPxSteA.exe
  C:\Windows\System\jPxSteA.exe
  2⤵
  PID:11732
- C:\Windows\System\mrOCqom.exe
  C:\Windows\System\mrOCqom.exe
  2⤵
  PID:11824
- C:\Windows\System\zmUqRAb.exe
  C:\Windows\System\zmUqRAb.exe
  2⤵
  PID:11888
- C:\Windows\System\XQEsGRd.exe
  C:\Windows\System\XQEsGRd.exe
  2⤵
  PID:11948
- C:\Windows\System\iybwnlk.exe
  C:\Windows\System\iybwnlk.exe
  2⤵
  PID:12032
- C:\Windows\System\BnlcTdp.exe
  C:\Windows\System\BnlcTdp.exe
  2⤵
  PID:12148
- C:\Windows\System\qUiNlif.exe
  C:\Windows\System\qUiNlif.exe
  2⤵
  PID:12224
- C:\Windows\System\wZthWds.exe
  C:\Windows\System\wZthWds.exe
  2⤵
  PID:12268
- C:\Windows\System\RBbGfQv.exe
  C:\Windows\System\RBbGfQv.exe
  2⤵
  PID:11292
- C:\Windows\System\nvjXDlf.exe
  C:\Windows\System\nvjXDlf.exe
  2⤵
  PID:11520
- C:\Windows\System\AFDDiwA.exe
  C:\Windows\System\AFDDiwA.exe
  2⤵
  PID:11688
- C:\Windows\System\ZZKxMcF.exe
  C:\Windows\System\ZZKxMcF.exe
  2⤵
  PID:11800
- C:\Windows\System\nGLNqFn.exe
  C:\Windows\System\nGLNqFn.exe
  2⤵
  PID:12080
- C:\Windows\System\sktgaqV.exe
  C:\Windows\System\sktgaqV.exe
  2⤵
  PID:12184
- C:\Windows\System\nFoFHsf.exe
  C:\Windows\System\nFoFHsf.exe
  2⤵
  PID:12284
- C:\Windows\System\asOhIaO.exe
  C:\Windows\System\asOhIaO.exe
  2⤵
  PID:11736
- C:\Windows\System\UQiuydi.exe
  C:\Windows\System\UQiuydi.exe
  2⤵
  PID:11980
- C:\Windows\System\VeohBrz.exe
  C:\Windows\System\VeohBrz.exe
  2⤵
  PID:11476
- C:\Windows\System\SmvGRYf.exe
  C:\Windows\System\SmvGRYf.exe
  2⤵
  PID:12304
- C:\Windows\System\eLOOoZJ.exe
  C:\Windows\System\eLOOoZJ.exe
  2⤵
  PID:12336
- C:\Windows\System\HDnjxzD.exe
  C:\Windows\System\HDnjxzD.exe
  2⤵
  PID:12372
- C:\Windows\System\WIUNxns.exe
  C:\Windows\System\WIUNxns.exe
  2⤵
  PID:12392
- C:\Windows\System\yCwCtTK.exe
  C:\Windows\System\yCwCtTK.exe
  2⤵
  PID:12436
- C:\Windows\System\okKsGPZ.exe
  C:\Windows\System\okKsGPZ.exe
  2⤵
  PID:12452
- C:\Windows\System\HJrUvvv.exe
  C:\Windows\System\HJrUvvv.exe
  2⤵
  PID:12468
- C:\Windows\System\VobyJqf.exe
  C:\Windows\System\VobyJqf.exe
  2⤵
  PID:12492
- C:\Windows\System\DjvnNQy.exe
  C:\Windows\System\DjvnNQy.exe
  2⤵
  PID:12524
- C:\Windows\System\ohRbavL.exe
  C:\Windows\System\ohRbavL.exe
  2⤵
  PID:12560
- C:\Windows\System\pevUwdd.exe
  C:\Windows\System\pevUwdd.exe
  2⤵
  PID:12584
- C:\Windows\System\OooTrSf.exe
  C:\Windows\System\OooTrSf.exe
  2⤵
  PID:12620
- C:\Windows\System\uAoUGAl.exe
  C:\Windows\System\uAoUGAl.exe
  2⤵
  PID:12648
- C:\Windows\System\jieEqBX.exe
  C:\Windows\System\jieEqBX.exe
  2⤵
  PID:12676
- C:\Windows\System\TflXovm.exe
  C:\Windows\System\TflXovm.exe
  2⤵
  PID:12712
- C:\Windows\System\bIswztO.exe
  C:\Windows\System\bIswztO.exe
  2⤵
  PID:12740
- C:\Windows\System\JFNwiwF.exe
  C:\Windows\System\JFNwiwF.exe
  2⤵
  PID:12760
- C:\Windows\System\UQMwsJx.exe
  C:\Windows\System\UQMwsJx.exe
  2⤵
  PID:12784
- C:\Windows\System\YmkjYnG.exe
  C:\Windows\System\YmkjYnG.exe
  2⤵
  PID:12816
- C:\Windows\System\DyGMpqF.exe
  C:\Windows\System\DyGMpqF.exe
  2⤵
  PID:12848
- C:\Windows\System\jZAllAA.exe
  C:\Windows\System\jZAllAA.exe
  2⤵
  PID:12876
- C:\Windows\System\JNYjGwi.exe
  C:\Windows\System\JNYjGwi.exe
  2⤵
  PID:12904
- C:\Windows\System\IXubmPD.exe
  C:\Windows\System\IXubmPD.exe
  2⤵
  PID:12940
- C:\Windows\System\sERetzJ.exe
  C:\Windows\System\sERetzJ.exe
  2⤵
  PID:12960
- C:\Windows\System\TrEKaNL.exe
  C:\Windows\System\TrEKaNL.exe
  2⤵
  PID:12976
- C:\Windows\System\TyIcYHx.exe
  C:\Windows\System\TyIcYHx.exe
  2⤵
  PID:13008
- C:\Windows\System\xgfDksU.exe
  C:\Windows\System\xgfDksU.exe
  2⤵
  PID:13032
- C:\Windows\System\uQgCsCA.exe
  C:\Windows\System\uQgCsCA.exe
  2⤵
  PID:13064
- C:\Windows\System\cXvqvkK.exe
  C:\Windows\System\cXvqvkK.exe
  2⤵
  PID:13100
- C:\Windows\System\MrrCRrn.exe
  C:\Windows\System\MrrCRrn.exe
  2⤵
  PID:13128
- C:\Windows\System\vIPSWrm.exe
  C:\Windows\System\vIPSWrm.exe
  2⤵
  PID:13156
- C:\Windows\System\shwCuoZ.exe
  C:\Windows\System\shwCuoZ.exe
  2⤵
  PID:13184
- C:\Windows\System\oWOIQas.exe
  C:\Windows\System\oWOIQas.exe
  2⤵
  PID:13212
- C:\Windows\System\DwORwQS.exe
  C:\Windows\System\DwORwQS.exe
  2⤵
  PID:13240
- C:\Windows\System\IobzZPA.exe
  C:\Windows\System\IobzZPA.exe
  2⤵
  PID:13268
- C:\Windows\System\jaXOtHr.exe
  C:\Windows\System\jaXOtHr.exe
  2⤵
  PID:13304
- C:\Windows\System\jrOsCZT.exe
  C:\Windows\System\jrOsCZT.exe
  2⤵
  PID:11564
- C:\Windows\System\zoOzPkp.exe
  C:\Windows\System\zoOzPkp.exe
  2⤵
  PID:12320
- C:\Windows\System\vZrlhGY.exe
  C:\Windows\System\vZrlhGY.exe
  2⤵
  PID:12364
- C:\Windows\System\bBYuTZs.exe
  C:\Windows\System\bBYuTZs.exe
  2⤵
  PID:12504
- C:\Windows\System\VznULgs.exe
  C:\Windows\System\VznULgs.exe
  2⤵
  PID:12488
- C:\Windows\System\rMaqeVf.exe
  C:\Windows\System\rMaqeVf.exe
  2⤵
  PID:12576
- C:\Windows\System\mRMrXGv.exe
  C:\Windows\System\mRMrXGv.exe
  2⤵
  PID:12660
- C:\Windows\System\gZjWXxW.exe
  C:\Windows\System\gZjWXxW.exe
  2⤵
  PID:12756
- C:\Windows\System\IIdmCce.exe
  C:\Windows\System\IIdmCce.exe
  2⤵
  PID:12772
- C:\Windows\System\cQlQgCM.exe
  C:\Windows\System\cQlQgCM.exe
  2⤵
  PID:12864
- C:\Windows\System\kgfCkao.exe
  C:\Windows\System\kgfCkao.exe
  2⤵
  PID:12924
- C:\Windows\System\EfGkALy.exe
  C:\Windows\System\EfGkALy.exe
  2⤵
  PID:13000
- C:\Windows\System\NZmJtGc.exe
  C:\Windows\System\NZmJtGc.exe
  2⤵
  PID:13048
- C:\Windows\System\xWlIDHj.exe
  C:\Windows\System\xWlIDHj.exe
  2⤵
  PID:13112
- C:\Windows\System\mAbxfWq.exe
  C:\Windows\System\mAbxfWq.exe
  2⤵
  PID:13204
- C:\Windows\System\StCqmIJ.exe
  C:\Windows\System\StCqmIJ.exe
  2⤵
  PID:13280
- C:\Windows\System\evNaelP.exe
  C:\Windows\System\evNaelP.exe
  2⤵
  PID:13296
- C:\Windows\System\UPytMoj.exe
  C:\Windows\System\UPytMoj.exe
  2⤵
  PID:12368
- C:\Windows\System\mvMqTzW.exe
  C:\Windows\System\mvMqTzW.exe
  2⤵
  PID:12552
- C:\Windows\System\brHutCM.exe
  C:\Windows\System\brHutCM.exe
  2⤵
  PID:12736
- C:\Windows\System\HjpwdwC.exe
  C:\Windows\System\HjpwdwC.exe
  2⤵
  PID:12836
- C:\Windows\System\mYYflBw.exe
  C:\Windows\System\mYYflBw.exe
  2⤵
  PID:13028
- C:\Windows\System\YEmQssR.exe
  C:\Windows\System\YEmQssR.exe
  2⤵
  PID:13168
- C:\Windows\System\MmxNCXt.exe
  C:\Windows\System\MmxNCXt.exe
  2⤵
  PID:12344
- C:\Windows\System\ihgrBmY.exe
  C:\Windows\System\ihgrBmY.exe
  2⤵
  PID:12636
- C:\Windows\System\uSwTJqH.exe
  C:\Windows\System\uSwTJqH.exe
  2⤵
  PID:13092
- C:\Windows\System\LOEkXaS.exe
  C:\Windows\System\LOEkXaS.exe
  2⤵
  PID:10448
- C:\Windows\System\AvTMNTq.exe
  C:\Windows\System\AvTMNTq.exe
  2⤵
  PID:12952
- C:\Windows\System\vILgYVb.exe
  C:\Windows\System\vILgYVb.exe
  2⤵
  PID:13332
- C:\Windows\System\xiWLOXi.exe
  C:\Windows\System\xiWLOXi.exe
  2⤵
  PID:13352
- C:\Windows\System\AEaTsGZ.exe
  C:\Windows\System\AEaTsGZ.exe
  2⤵
  PID:13376
- C:\Windows\System\zAqhFjD.exe
  C:\Windows\System\zAqhFjD.exe
  2⤵
  PID:13412
- C:\Windows\System\nRVQDEY.exe
  C:\Windows\System\nRVQDEY.exe
  2⤵
  PID:13440
- C:\Windows\System\WKfQbkd.exe
  C:\Windows\System\WKfQbkd.exe
  2⤵
  PID:13476
- C:\Windows\System\npUPDzH.exe
  C:\Windows\System\npUPDzH.exe
  2⤵
  PID:13504
- C:\Windows\System\yayalTn.exe
  C:\Windows\System\yayalTn.exe
  2⤵
  PID:13532
- C:\Windows\System\rIYydgP.exe
  C:\Windows\System\rIYydgP.exe
  2⤵
  PID:13572
- C:\Windows\System\mpjDmgj.exe
  C:\Windows\System\mpjDmgj.exe
  2⤵
  PID:13588
- C:\Windows\System\iYWjpbD.exe
  C:\Windows\System\iYWjpbD.exe
  2⤵
  PID:13616
- C:\Windows\System\NPVVfec.exe
  C:\Windows\System\NPVVfec.exe
  2⤵
  PID:13644
- C:\Windows\System\sTNNIDP.exe
  C:\Windows\System\sTNNIDP.exe
  2⤵
  PID:13672
- C:\Windows\System\KAxneXJ.exe
  C:\Windows\System\KAxneXJ.exe
  2⤵
  PID:13696
- C:\Windows\System\ytMxBpw.exe
  C:\Windows\System\ytMxBpw.exe
  2⤵
  PID:13712
- C:\Windows\System\vNUfAjf.exe
  C:\Windows\System\vNUfAjf.exe
  2⤵
  PID:13732
- C:\Windows\System\BQTfEQL.exe
  C:\Windows\System\BQTfEQL.exe
  2⤵
  PID:13756
- C:\Windows\System\LsIcWIQ.exe
  C:\Windows\System\LsIcWIQ.exe
  2⤵
  PID:13788
- C:\Windows\System\YUMUzVJ.exe
  C:\Windows\System\YUMUzVJ.exe
  2⤵
  PID:13816
- C:\Windows\System\LCUpwkc.exe
  C:\Windows\System\LCUpwkc.exe
  2⤵
  PID:13852
- C:\Windows\System\dikgdRJ.exe
  C:\Windows\System\dikgdRJ.exe
  2⤵
  PID:13868
- C:\Windows\System\kILqAFo.exe
  C:\Windows\System\kILqAFo.exe
  2⤵
  PID:13896
- C:\Windows\System\ZoanfyF.exe
  C:\Windows\System\ZoanfyF.exe
  2⤵
  PID:13928
- C:\Windows\System\UApYMJS.exe
  C:\Windows\System\UApYMJS.exe
  2⤵
  PID:13952
- C:\Windows\System\ZnQGdMU.exe
  C:\Windows\System\ZnQGdMU.exe
  2⤵
  PID:13988
- C:\Windows\System\yCHvkmT.exe
  C:\Windows\System\yCHvkmT.exe
  2⤵
  PID:14028
- C:\Windows\System\ywckupR.exe
  C:\Windows\System\ywckupR.exe
  2⤵
  PID:14052
- C:\Windows\System\TOLDaYU.exe
  C:\Windows\System\TOLDaYU.exe
  2⤵
  PID:14080
- C:\Windows\System\zWCkjxH.exe
  C:\Windows\System\zWCkjxH.exe
  2⤵
  PID:14116
- C:\Windows\System\xcttcXM.exe
  C:\Windows\System\xcttcXM.exe
  2⤵
  PID:14144
- C:\Windows\System\VDuVTlH.exe
  C:\Windows\System\VDuVTlH.exe
  2⤵
  PID:14172
- C:\Windows\System\SLkDKxP.exe
  C:\Windows\System\SLkDKxP.exe
  2⤵
  PID:14196
- C:\Windows\System\uMWvJIV.exe
  C:\Windows\System\uMWvJIV.exe
  2⤵
  PID:14232
- C:\Windows\System\OFhOLVn.exe
  C:\Windows\System\OFhOLVn.exe
  2⤵
  PID:14260
- C:\Windows\System\LZFTeLC.exe
  C:\Windows\System\LZFTeLC.exe
  2⤵
  PID:14288
- C:\Windows\System\IYjyOCE.exe
  C:\Windows\System\IYjyOCE.exe
  2⤵
  PID:14316
- C:\Windows\System\dGQuwJC.exe
  C:\Windows\System\dGQuwJC.exe
  2⤵
  PID:14332
- C:\Windows\System\tUNyoPr.exe
  C:\Windows\System\tUNyoPr.exe
  2⤵
  PID:13372
- C:\Windows\System\DoLkWVf.exe
  C:\Windows\System\DoLkWVf.exe
  2⤵
  PID:13428
- C:\Windows\System\xOZdQKI.exe
  C:\Windows\System\xOZdQKI.exe
  2⤵
  PID:13544
- C:\Windows\System\wZhyrnj.exe
  C:\Windows\System\wZhyrnj.exe
  2⤵
  PID:13552
- C:\Windows\System\shMTVgA.exe
  C:\Windows\System\shMTVgA.exe
  2⤵
  PID:13612
- C:\Windows\System\dNpNkvg.exe
  C:\Windows\System\dNpNkvg.exe
  2⤵
  PID:13664
- C:\Windows\System\wFzxWGj.exe
  C:\Windows\System\wFzxWGj.exe
  2⤵
  PID:13744
- C:\Windows\System\iSgmVWY.exe
  C:\Windows\System\iSgmVWY.exe
  2⤵
  PID:13780
- C:\Windows\System\VezQSyn.exe
  C:\Windows\System\VezQSyn.exe
  2⤵
  PID:13836
- C:\Windows\System\ZbYIJvj.exe
  C:\Windows\System\ZbYIJvj.exe
  2⤵
  PID:13948
- C:\Windows\System\eJrgQfy.exe
  C:\Windows\System\eJrgQfy.exe
  2⤵
  PID:14020
- C:\Windows\System\frHSKLa.exe
  C:\Windows\System\frHSKLa.exe
  2⤵
  PID:14048
- C:\Windows\System\cCEsWuy.exe
  C:\Windows\System\cCEsWuy.exe
  2⤵
  PID:14092
- C:\Windows\System\XCLCVFy.exe
  C:\Windows\System\XCLCVFy.exe
  2⤵
  PID:14156
- C:\Windows\System\tnaGdKb.exe
  C:\Windows\System\tnaGdKb.exe
  2⤵
  PID:14216
- C:\Windows\System\WpOvKID.exe
  C:\Windows\System\WpOvKID.exe
  2⤵
  PID:14300
- C:\Windows\System\qhjKLsZ.exe
  C:\Windows\System\qhjKLsZ.exe
  2⤵
  PID:13320
- C:\Windows\System\nmbWKJM.exe
  C:\Windows\System\nmbWKJM.exe
  2⤵
  PID:13472
- C:\Windows\System\sCWIisV.exe
  C:\Windows\System\sCWIisV.exe
  2⤵
  PID:13660
- C:\Windows\System\lCnSket.exe
  C:\Windows\System\lCnSket.exe
  2⤵
  PID:13728
- C:\Windows\System\rhYYdus.exe
  C:\Windows\System\rhYYdus.exe
  2⤵
  PID:14000
- C:\Windows\System\hfxQWFo.exe
  C:\Windows\System\hfxQWFo.exe
  2⤵
  PID:14104
- C:\Windows\System\iYYHPOy.exe
  C:\Windows\System\iYYHPOy.exe
  2⤵
  PID:14184
- C:\Windows\System\xnCJJbB.exe
  C:\Windows\System\xnCJJbB.exe
  2⤵
  PID:13608
- C:\Windows\System\wDeyubR.exe
  C:\Windows\System\wDeyubR.exe
  2⤵
  PID:14272
- C:\Windows\System\efwQWid.exe
  C:\Windows\System\efwQWid.exe
  2⤵
  PID:14276
- C:\Windows\System\pTDbovm.exe
  C:\Windows\System\pTDbovm.exe
  2⤵
  PID:14364
- C:\Windows\System\KqbgXvJ.exe
  C:\Windows\System\KqbgXvJ.exe
  2⤵
  PID:14396
- C:\Windows\System\BefPHEj.exe
  C:\Windows\System\BefPHEj.exe
  2⤵
  PID:14420
- C:\Windows\System\EJEbQvw.exe
  C:\Windows\System\EJEbQvw.exe
  2⤵
  PID:14448
- C:\Windows\System\sIVjKFD.exe
  C:\Windows\System\sIVjKFD.exe
  2⤵
  PID:14484
- C:\Windows\System\TeTwMGG.exe
  C:\Windows\System\TeTwMGG.exe
  2⤵
  PID:14504
- C:\Windows\System\jbMOtDb.exe
  C:\Windows\System\jbMOtDb.exe
  2⤵
  PID:14536
- C:\Windows\System\rHXdSKx.exe
  C:\Windows\System\rHXdSKx.exe
  2⤵
  PID:14572
- C:\Windows\System\bRyMwfS.exe
  C:\Windows\System\bRyMwfS.exe
  2⤵
  PID:14592
- C:\Windows\System\RgHXtWs.exe
  C:\Windows\System\RgHXtWs.exe
  2⤵
  PID:14616
- C:\Windows\System\ywOZMZG.exe
  C:\Windows\System\ywOZMZG.exe
  2⤵
  PID:14644
- C:\Windows\System\VvIzaeG.exe
  C:\Windows\System\VvIzaeG.exe
  2⤵
  PID:14672
- C:\Windows\System\TTtJYpj.exe
  C:\Windows\System\TTtJYpj.exe
  2⤵
  PID:14704
- C:\Windows\System\CUbRsqZ.exe
  C:\Windows\System\CUbRsqZ.exe
  2⤵
  PID:14732
- C:\Windows\System\ErAMcwo.exe
  C:\Windows\System\ErAMcwo.exe
  2⤵
  PID:14756
- C:\Windows\System\iOFtSkl.exe
  C:\Windows\System\iOFtSkl.exe
  2⤵
  PID:14784
- C:\Windows\System\wASJgwB.exe
  C:\Windows\System\wASJgwB.exe
  2⤵
  PID:14812
- C:\Windows\System\gDXsTui.exe
  C:\Windows\System\gDXsTui.exe
  2⤵
  PID:14840
- C:\Windows\System\iTefbPt.exe
  C:\Windows\System\iTefbPt.exe
  2⤵
  PID:14856
- C:\Windows\System\HiDWvyF.exe
  C:\Windows\System\HiDWvyF.exe
  2⤵
  PID:14872
- C:\Windows\System\aimnsRd.exe
  C:\Windows\System\aimnsRd.exe
  2⤵
  PID:14888
- C:\Windows\System\ocuWNWb.exe
  C:\Windows\System\ocuWNWb.exe
  2⤵
  PID:14908
- C:\Windows\System\aEeOrIF.exe
  C:\Windows\System\aEeOrIF.exe
  2⤵
  PID:14928
- C:\Windows\System\LePOcgf.exe
  C:\Windows\System\LePOcgf.exe
  2⤵
  PID:14964
- C:\Windows\System\FOCqibT.exe
  C:\Windows\System\FOCqibT.exe
  2⤵
  PID:15000
- C:\Windows\System\qMcuNZW.exe
  C:\Windows\System\qMcuNZW.exe
  2⤵
  PID:15040
- C:\Windows\System\BAnmPxs.exe
  C:\Windows\System\BAnmPxs.exe
  2⤵
  PID:15068
- C:\Windows\System\dwEKpVn.exe
  C:\Windows\System\dwEKpVn.exe
  2⤵
  PID:15096
- C:\Windows\System\iZDqMkK.exe
  C:\Windows\System\iZDqMkK.exe
  2⤵
  PID:15136
- C:\Windows\System\WMrNRrE.exe
  C:\Windows\System\WMrNRrE.exe
  2⤵
  PID:15164
- C:\Windows\System\VKXITOb.exe
  C:\Windows\System\VKXITOb.exe
  2⤵
  PID:15180
- C:\Windows\System\XVeHJoU.exe
  C:\Windows\System\XVeHJoU.exe
  2⤵
  PID:15216
- C:\Windows\System\xTNXgXM.exe
  C:\Windows\System\xTNXgXM.exe
  2⤵
  PID:15256
- C:\Windows\System\qaaXiHw.exe
  C:\Windows\System\qaaXiHw.exe
  2⤵
  PID:15284
- C:\Windows\System\TEpWeLo.exe
  C:\Windows\System\TEpWeLo.exe
  2⤵
  PID:15312
- C:\Windows\System\vSbQEBO.exe
  C:\Windows\System\vSbQEBO.exe
  2⤵
  PID:15344
- C:\Windows\System\DaHuTzH.exe
  C:\Windows\System\DaHuTzH.exe
  2⤵
  PID:13600
- C:\Windows\System\VpHwsgO.exe
  C:\Windows\System\VpHwsgO.exe
  2⤵
  PID:14404
- C:\Windows\System\xYULfhY.exe
  C:\Windows\System\xYULfhY.exe
  2⤵
  PID:14440
- C:\Windows\System\oVFyqpa.exe
  C:\Windows\System\oVFyqpa.exe
  2⤵
  PID:14520
- C:\Windows\System\zwVnETr.exe
  C:\Windows\System\zwVnETr.exe
  2⤵
  PID:14604
- C:\Windows\System\GgCtkpI.exe
  C:\Windows\System\GgCtkpI.exe
  2⤵
  PID:14656
- C:\Windows\System\uRcLjnx.exe
  C:\Windows\System\uRcLjnx.exe
  2⤵
  PID:14724
- C:\Windows\System\UNtLhBy.exe
  C:\Windows\System\UNtLhBy.exe
  2⤵
  PID:14804
- C:\Windows\System\DUnhdaj.exe
  C:\Windows\System\DUnhdaj.exe
  2⤵
  PID:14852
- C:\Windows\System\IqdGmdi.exe
  C:\Windows\System\IqdGmdi.exe
  2⤵
  PID:14864
- C:\Windows\System\sVytucw.exe
  C:\Windows\System\sVytucw.exe
  2⤵
  PID:14956
- C:\Windows\System\LhRCsEO.exe
  C:\Windows\System\LhRCsEO.exe
  2⤵
  PID:15080
- C:\Windows\System\Rtiojzl.exe
  C:\Windows\System\Rtiojzl.exe
  2⤵
  PID:15104
- C:\Windows\System\TKEDIHb.exe
  C:\Windows\System\TKEDIHb.exe
  2⤵
  PID:15128
- C:\Windows\System\EQNvANX.exe
  C:\Windows\System\EQNvANX.exe
  2⤵
  PID:15176
- C:\Windows\System\kcaUfDv.exe
  C:\Windows\System\kcaUfDv.exe
  2⤵
  PID:15276
- C:\Windows\System\fJObRte.exe
  C:\Windows\System\fJObRte.exe
  2⤵
  PID:15324
- C:\Windows\System\AsZXtMi.exe
  C:\Windows\System\AsZXtMi.exe
  2⤵
  PID:14392
- C:\Windows\System\PfUNSaI.exe
  C:\Windows\System\PfUNSaI.exe
  2⤵
  PID:14556
- C:\Windows\System\NgzgocN.exe
  C:\Windows\System\NgzgocN.exe
  2⤵
  PID:14776
- C:\Windows\System\FjJFNCx.exe
  C:\Windows\System\FjJFNCx.exe
  2⤵
  PID:14952
- C:\Windows\System\ltAGAie.exe
  C:\Windows\System\ltAGAie.exe
  2⤵
  PID:14992
- C:\Windows\System\BsxYfvX.exe
  C:\Windows\System\BsxYfvX.exe
  2⤵
  PID:15264
- C:\Windows\System\ARLFtDl.exe
  C:\Windows\System\ARLFtDl.exe
  2⤵
  PID:14628
- C:\Windows\System\DnTDUrR.exe
  C:\Windows\System\DnTDUrR.exe
  2⤵
  PID:14920
- C:\Windows\System\oIJSJdN.exe
  C:\Windows\System\oIJSJdN.exe
  2⤵
  PID:15376
- C:\Windows\System\FNMLbfx.exe
  C:\Windows\System\FNMLbfx.exe
  2⤵
  PID:15412
- C:\Windows\System\qltsUvo.exe
  C:\Windows\System\qltsUvo.exe
  2⤵
  PID:15436
- C:\Windows\System\qUaQSih.exe
  C:\Windows\System\qUaQSih.exe
  2⤵
  PID:15456
- C:\Windows\System\gUbkmcN.exe
  C:\Windows\System\gUbkmcN.exe
  2⤵
  PID:15492
- C:\Windows\System\ygiPrOM.exe
  C:\Windows\System\ygiPrOM.exe
  2⤵
  PID:15520
- C:\Windows\System\SSyxYml.exe
  C:\Windows\System\SSyxYml.exe
  2⤵
  PID:15556
- C:\Windows\System\aJiGEFB.exe
  C:\Windows\System\aJiGEFB.exe
  2⤵
  PID:15592
- C:\Windows\System\FtPrHPr.exe
  C:\Windows\System\FtPrHPr.exe
  2⤵
  PID:15608
- C:\Windows\System\eZNBAsW.exe
  C:\Windows\System\eZNBAsW.exe
  2⤵
  PID:15648
- C:\Windows\System\YDEuXmI.exe
  C:\Windows\System\YDEuXmI.exe
  2⤵
  PID:15668
- C:\Windows\System\mypidke.exe
  C:\Windows\System\mypidke.exe
  2⤵
  PID:15692
- C:\Windows\System\qVncCzY.exe
  C:\Windows\System\qVncCzY.exe
  2⤵
  PID:15728
- C:\Windows\System\qYDnNPR.exe
  C:\Windows\System\qYDnNPR.exe
  2⤵
  PID:15756
- C:\Windows\System\mVzpULb.exe
  C:\Windows\System\mVzpULb.exe
  2⤵
  PID:15784
- C:\Windows\System\XyBRBhD.exe
  C:\Windows\System\XyBRBhD.exe
  2⤵
  PID:15820
- C:\Windows\System\BnLFTgq.exe
  C:\Windows\System\BnLFTgq.exe
  2⤵
  PID:15852
- C:\Windows\System\tmeZprS.exe
  C:\Windows\System\tmeZprS.exe
  2⤵
  PID:15888
- C:\Windows\System\qgoRpvC.exe
  C:\Windows\System\qgoRpvC.exe
  2⤵
  PID:15908
- C:\Windows\System\VwOqeKW.exe
  C:\Windows\System\VwOqeKW.exe
  2⤵
  PID:15944
- C:\Windows\System\BqUuvGz.exe
  C:\Windows\System\BqUuvGz.exe
  2⤵
  PID:15972
- C:\Windows\System\eYZmqOD.exe
  C:\Windows\System\eYZmqOD.exe
  2⤵
  PID:15988
- C:\Windows\System\tAuhXYz.exe
  C:\Windows\System\tAuhXYz.exe
  2⤵
  PID:16020
- C:\Windows\System\DvgidPP.exe
  C:\Windows\System\DvgidPP.exe
  2⤵
  PID:16044
- C:\Windows\System\ctSLvYk.exe
  C:\Windows\System\ctSLvYk.exe
  2⤵
  PID:16060
- C:\Windows\System\mUNjDKu.exe
  C:\Windows\System\mUNjDKu.exe
  2⤵
  PID:16084
- C:\Windows\System\xHOwfrY.exe
  C:\Windows\System\xHOwfrY.exe
  2⤵
  PID:16100
- C:\Windows\System\buQGvBL.exe
  C:\Windows\System\buQGvBL.exe
  2⤵
  PID:16120
- C:\Windows\System\WMnYxIO.exe
  C:\Windows\System\WMnYxIO.exe
  2⤵
  PID:16148
- C:\Windows\System\NUSzxAw.exe
  C:\Windows\System\NUSzxAw.exe
  2⤵
  PID:16172
- C:\Windows\System\QpQeMXC.exe
  C:\Windows\System\QpQeMXC.exe
  2⤵
  PID:16204
- C:\Windows\System\oPOOkKC.exe
  C:\Windows\System\oPOOkKC.exe
  2⤵
  PID:16228
- C:\Windows\System\egNetJQ.exe
  C:\Windows\System\egNetJQ.exe
  2⤵
  PID:16248
- C:\Windows\System\LkwpziY.exe
  C:\Windows\System\LkwpziY.exe
  2⤵
  PID:16264
- C:\Windows\System\VJkUTrp.exe
  C:\Windows\System\VJkUTrp.exe
  2⤵
  PID:16308
- C:\Windows\System\YqlqZJp.exe
  C:\Windows\System\YqlqZJp.exe
  2⤵
  PID:16336
- C:\Windows\System\OYBAYJk.exe
  C:\Windows\System\OYBAYJk.exe
  2⤵
  PID:16364
- C:\Windows\System\YGrCLdE.exe
  C:\Windows\System\YGrCLdE.exe
  2⤵
  PID:14568
- C:\Windows\System\HvJbnNA.exe
  C:\Windows\System\HvJbnNA.exe
  2⤵
  PID:15392
- C:\Windows\System\VQzQxCo.exe
  C:\Windows\System\VQzQxCo.exe
  2⤵
  PID:15452
- C:\Windows\System\QJMdqXp.exe
  C:\Windows\System\QJMdqXp.exe
  2⤵
  PID:15576
- C:\Windows\System\cUXkdKe.exe
  C:\Windows\System\cUXkdKe.exe
  2⤵
  PID:15512
- C:\Windows\System\hxpnlhk.exe
  C:\Windows\System\hxpnlhk.exe
  2⤵
  PID:15580
- C:\Windows\System\lkqhaEq.exe
  C:\Windows\System\lkqhaEq.exe
  2⤵
  PID:15688
- C:\Windows\System\GHUppJe.exe
  C:\Windows\System\GHUppJe.exe
  2⤵
  PID:15768
- C:\Windows\System\MWqyPDW.exe
  C:\Windows\System\MWqyPDW.exe
  2⤵
  PID:15840
- C:\Windows\System\RihbQpi.exe
  C:\Windows\System\RihbQpi.exe
  2⤵
  PID:15872
- C:\Windows\System\FoLWMUg.exe
  C:\Windows\System\FoLWMUg.exe
  2⤵
  PID:15980
- C:\Windows\System\nRwpHYr.exe
  C:\Windows\System\nRwpHYr.exe
  2⤵
  PID:15984
- C:\Windows\System\ugQvmom.exe
  C:\Windows\System\ugQvmom.exe
  2⤵
  PID:2408
- C:\Windows\System\SAtMiRs.exe
  C:\Windows\System\SAtMiRs.exe
  2⤵
  PID:16052
- C:\Windows\System\UHPnsTk.exe
  C:\Windows\System\UHPnsTk.exe
  2⤵
  PID:16144
- C:\Windows\System\adUhSYc.exe
  C:\Windows\System\adUhSYc.exe
  2⤵
  PID:16216
- C:\Windows\System\MYHZxYt.exe
  C:\Windows\System\MYHZxYt.exe
  2⤵
  PID:16332
- C:\Windows\System\LSUwdye.exe
  C:\Windows\System\LSUwdye.exe
  2⤵
  PID:16356
- C:\Windows\System\IrZdOTX.exe
  C:\Windows\System\IrZdOTX.exe
  2⤵
  PID:16344
- C:\Windows\System\VqFtGzt.exe
  C:\Windows\System\VqFtGzt.exe
  2⤵
  PID:16076
- C:\Windows\System\KBVYGLA.exe
  C:\Windows\System\KBVYGLA.exe
  2⤵
  PID:16260
- C:\Windows\System\jERGEab.exe
  C:\Windows\System\jERGEab.exe
  2⤵
  PID:1352
- C:\Windows\System\jmbVEkJ.exe
  C:\Windows\System\jmbVEkJ.exe
  2⤵
  PID:16220
- C:\Windows\System\gfByAIp.exe
  C:\Windows\System\gfByAIp.exe
  2⤵
  PID:15472
- C:\Windows\System\vFUzMEh.exe
  C:\Windows\System\vFUzMEh.exe
  2⤵
  PID:15864
- C:\Windows\System\NExrNFn.exe
  C:\Windows\System\NExrNFn.exe
  2⤵
  PID:1644
- C:\Windows\System\qRunNSV.exe
  C:\Windows\System\qRunNSV.exe
  2⤵
  PID:15368
- C:\Windows\System\MjruObR.exe
  C:\Windows\System\MjruObR.exe
  2⤵
  PID:16388
- C:\Windows\System\sLZAicn.exe
  C:\Windows\System\sLZAicn.exe
  2⤵
  PID:16412
- C:\Windows\System\TKcvNEj.exe
  C:\Windows\System\TKcvNEj.exe
  2⤵
  PID:16440
- C:\Windows\System\IwSByCc.exe
  C:\Windows\System\IwSByCc.exe
  2⤵
  PID:16468
- C:\Windows\System\AmeSbWy.exe
  C:\Windows\System\AmeSbWy.exe
  2⤵
  PID:16496
- C:\Windows\System\vVDGhAQ.exe
  C:\Windows\System\vVDGhAQ.exe
  2⤵
  PID:16532
- C:\Windows\System\ekYMNDP.exe
  C:\Windows\System\ekYMNDP.exe
  2⤵
  PID:16564
- C:\Windows\System\YhQCCfo.exe
  C:\Windows\System\YhQCCfo.exe
  2⤵
  PID:16592
- C:\Windows\System\PXxKhxg.exe
  C:\Windows\System\PXxKhxg.exe
  2⤵
  PID:16620
- C:\Windows\System\VgBUnLv.exe
  C:\Windows\System\VgBUnLv.exe
  2⤵
  PID:16652
- C:\Windows\System\GdivDhW.exe
  C:\Windows\System\GdivDhW.exe
  2⤵
  PID:16680
- C:\Windows\System\JOVnMix.exe
  C:\Windows\System\JOVnMix.exe
  2⤵
  PID:16704
- C:\Windows\System\yumroOp.exe
  C:\Windows\System\yumroOp.exe
  2⤵
  PID:16736
- C:\Windows\System\eXVcVIT.exe
  C:\Windows\System\eXVcVIT.exe
  2⤵
  PID:16768
- C:\Windows\System\jgkrPPe.exe
  C:\Windows\System\jgkrPPe.exe
  2⤵
  PID:16812
- C:\Windows\System\WSJvHEx.exe
  C:\Windows\System\WSJvHEx.exe
  2⤵
  PID:16844
- C:\Windows\System\EQxENnH.exe
  C:\Windows\System\EQxENnH.exe
  2⤵
  PID:16872
- C:\Windows\System\sMEMsxR.exe
  C:\Windows\System\sMEMsxR.exe
  2⤵
  PID:16900
- C:\Windows\System\jEgXeKe.exe
  C:\Windows\System\jEgXeKe.exe
  2⤵
  PID:16916
- C:\Windows\System\bwHHrQP.exe
  C:\Windows\System\bwHHrQP.exe
  2⤵
  PID:16944
- C:\Windows\System\hFANMgy.exe
  C:\Windows\System\hFANMgy.exe
  2⤵
  PID:16972
- C:\Windows\System\uXCjERc.exe
  C:\Windows\System\uXCjERc.exe
  2⤵
  PID:17000
- C:\Windows\System\qyolINf.exe
  C:\Windows\System\qyolINf.exe
  2⤵
  PID:17028
- C:\Windows\System\HjKLaYX.exe
  C:\Windows\System\HjKLaYX.exe
  2⤵
  PID:17056
- C:\Windows\System\gQPYvWt.exe
  C:\Windows\System\gQPYvWt.exe
  2⤵
  PID:17084
- C:\Windows\System\JMnZXKa.exe
  C:\Windows\System\JMnZXKa.exe
  2⤵
  PID:17124
- C:\Windows\System\UGTiMeZ.exe
  C:\Windows\System\UGTiMeZ.exe
  2⤵
  PID:17140
- C:\Windows\System\lgNiXzr.exe
  C:\Windows\System\lgNiXzr.exe
  2⤵
  PID:17168
- C:\Windows\System\IlmfuiE.exe
  C:\Windows\System\IlmfuiE.exe
  2⤵
  PID:17196
- C:\Windows\System\KCOoVQN.exe
  C:\Windows\System\KCOoVQN.exe
  2⤵
  PID:17220
- C:\Windows\System\BRYPsLD.exe
  C:\Windows\System\BRYPsLD.exe
  2⤵
  PID:17244
- C:\Windows\System\oKkWMjL.exe
  C:\Windows\System\oKkWMjL.exe
  2⤵
  PID:17280
- C:\Windows\System\bCtFczI.exe
  C:\Windows\System\bCtFczI.exe
  2⤵
  PID:17304
- C:\Windows\System\smxnHhW.exe
  C:\Windows\System\smxnHhW.exe
  2⤵
  PID:17340
- C:\Windows\System\UTAVjSN.exe
  C:\Windows\System\UTAVjSN.exe
  2⤵
  PID:17364
- C:\Windows\System\waJBEja.exe
  C:\Windows\System\waJBEja.exe
  2⤵
  PID:17396
- C:\Windows\System\TSwGyJe.exe
  C:\Windows\System\TSwGyJe.exe
  2⤵
  PID:15120
- C:\Windows\System\FCygmYY.exe
  C:\Windows\System\FCygmYY.exe
  2⤵
  PID:16404
- C:\Windows\System\twWGGPb.exe
  C:\Windows\System\twWGGPb.exe
  2⤵
  PID:16464
- C:\Windows\System\ynOWrcu.exe
  C:\Windows\System\ynOWrcu.exe
  2⤵
  PID:16520
- C:\Windows\System\tTaJsDj.exe
  C:\Windows\System\tTaJsDj.exe
  2⤵
  PID:16528
- C:\Windows\System\VAVGBIa.exe
  C:\Windows\System\VAVGBIa.exe
  2⤵
  PID:16660
- C:\Windows\System\PqqLmEC.exe
  C:\Windows\System\PqqLmEC.exe
  2⤵
  PID:16760
- C:\Windows\System\RnNtrlp.exe
  C:\Windows\System\RnNtrlp.exe
  2⤵
  PID:16820
- C:\Windows\System\tmcyzPS.exe
  C:\Windows\System\tmcyzPS.exe
  2⤵
  PID:16856
- C:\Windows\System\zGdlemm.exe
  C:\Windows\System\zGdlemm.exe
  2⤵
  PID:16932
- C:\Windows\System\IbRUXgv.exe
  C:\Windows\System\IbRUXgv.exe
  2⤵
  PID:16992
- C:\Windows\System\hfPsgQP.exe
  C:\Windows\System\hfPsgQP.exe
  2⤵
  PID:17112
- C:\Windows\System\vRcwdbI.exe
  C:\Windows\System\vRcwdbI.exe
  2⤵
  PID:17180
- C:\Windows\System\jPGLXmG.exe
  C:\Windows\System\jPGLXmG.exe
  2⤵
  PID:17240
- C:\Windows\System\BBCwjmr.exe
  C:\Windows\System\BBCwjmr.exe
  2⤵
  PID:17264
- C:\Windows\System\tbhFRfu.exe
  C:\Windows\System\tbhFRfu.exe
  2⤵
  PID:17300
- C:\Windows\System\rtIdcfY.exe
  C:\Windows\System\rtIdcfY.exe
  2⤵
  PID:16180
- C:\Windows\System\pKXWovJ.exe
  C:\Windows\System\pKXWovJ.exe
  2⤵
  PID:16460
- C:\Windows\System\dsSBhwm.exe
  C:\Windows\System\dsSBhwm.exe
  2⤵
  PID:16560
- C:\Windows\System\EGRUUTC.exe
  C:\Windows\System\EGRUUTC.exe
  2⤵
  PID:16604
- C:\Windows\System\EubvSTn.exe
  C:\Windows\System\EubvSTn.exe
  2⤵
  PID:16784
- C:\Windows\System\UbcJean.exe
  C:\Windows\System\UbcJean.exe
  2⤵
  PID:16912

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AgoNBGw.exe

Filesize
1.8MB

MD5
8666137232f9a21c546a0a7f6da2a0ef

SHA1
22eec7b85d5a7af8577eb77e19d840583e2e0027

SHA256
e60d6211667819a80a9aac77b95d679fbf95fc37deabe6e860b39ce7fa3c9a8c

SHA512
c74dc9888dec4d572ea42ac11b0790f5f7d3ee7532554636eabbc1cf1e7a037b73dee42883a3118481d0e2826e4209a2a934adc09805db659a248a2be59d7fc7

Download Submit
C:\Windows\System\EnGbiAh.exe

Filesize
1.8MB

MD5
5da3f3d04972990b5e5a6aaf703d7c09

SHA1
62f19c2a22502ad69a7abe4df9c10927b435050c

SHA256
f140becdb3aed5281a9deccab6db2218494006194dbddc168d5595f863e01922

SHA512
f162cffe1163a17f1943f68ee49ad8f6f6e9171c3d1045005fc9581776a7ea27d63ee33a8c303436c842acf56133a18376bc5851feaea2dd1db3dc7412948791

Download Submit
C:\Windows\System\EpGTRKD.exe

Filesize
1.8MB

MD5
0eb2fd7c8ee0d10d75dfae84cf49e3cf

SHA1
37cf4868bedb9e189c130bd7255cc7201843e7b7

SHA256
d6fda6ef004a2ffb01549fca82ac466e933ece182e4222878d76e0097a35f32b

SHA512
17c823ad7b6bb9e2dcecddfa820b9bd1176a9286c2fd9db3957286ec05068a675d1f424b27f8cb1850471bd34bccd75945dd834c483b024f306508bf3532d084

Download Submit
C:\Windows\System\LZyXZdv.exe

Filesize
1.8MB

MD5
ed11e171a1c3ee587e291080d7e6515d

SHA1
bcef54b021187a4435ad3ddb5e10877d46ea7cfc

SHA256
2943c4b58c694b6de715e25db43ffbf3a50c486f78f50bfe6463960829e3e6ca

SHA512
9c8d4a67eac43ffcd2fc9a2c298f589c98066dcb4a2c556dce04a6d231abf61b98046ae8219531c4dd7a60f4195433781098753b1e018660ae06f0d0ed23f7b2

Download Submit
C:\Windows\System\LykMcZn.exe

Filesize
1.8MB

MD5
1098799045e9642acc0d9f6878184b41

SHA1
b11b14e65825b583965258b17143c67c6a0172d2

SHA256
b8237a94d4a755cb7a7028768dbe4670516a03d89516ff22a9b8465251270b93

SHA512
4b39bea0f470b8e1d31b18bffe6fc5770c35ed6e590a64e8ddf00843bec8bccb602e7aa6c1785c285ad0476718093753a3e0ffa40f8bddc26472c31207b358da

Download Submit
C:\Windows\System\MnVWpOM.exe

Filesize
1.8MB

MD5
075218713f48c7d2a4669e37b5624f7e

SHA1
cff117faa20c5d18fe2cfee707f5144695346409

SHA256
322e5d400fc243f0f6b09d857b5e5fab96f8ce984ad33170b31d77a4025711dc

SHA512
936a11bcd996c8205fc19822ca6ea9099b72423a32008347aaa0139cce1803c4f244f7cfc222fccbc88b4a58b87680440b80ba0e232c4cc2d6386d3527d8b5d5

Download Submit
C:\Windows\System\MryBvNu.exe

Filesize
1.8MB

MD5
0d172f60bbbf69e1591ecf9e520a720e

SHA1
529570b7a820e220bdd3646664369271ee0b17bb

SHA256
67d6c2f4c232d03e7f2850b9142d64e23a2bafa6122ee6c74d59968905617fc5

SHA512
c30398302195c3eeb715a6812a591f106f403cde7a77197d4eaec41d5dfff07f891651cb84c64140e5a0ea660b5b5aca729da1527f6c4ac37faea8461d6c4b7c

Download Submit
C:\Windows\System\PUMubKO.exe

Filesize
1.8MB

MD5
1c562782f39b2fed24baa72d15969eb9

SHA1
61dab5a4f2cc882407166fca1314d207b80266dc

SHA256
81759fd5180767b7436cd69b4c907bd49d11435daa6c27a927dd645e150057d4

SHA512
b2f3c97321980e554ccd75e4805d5d299e78c33c3f3aeb88374d7742a845b681050289c3c393ec52f424fd422b35b8b111da9be9c7a624e0a4f91077ecb65b7e

Download Submit
C:\Windows\System\QkVliFa.exe

Filesize
1.8MB

MD5
ffb833b1977c698c9729b46cfc158a19

SHA1
304691fd06186f68642554b77e6e242fc24a5ae4

SHA256
e9e697c71d96cab1d3c51f844ceffdc818c9b5d3d7f1ece3ec834697fdf75e3d

SHA512
bb83b63b70703f61ccbbce943d68b90249a335af89dc65831353550d19905ab1115239960caae493c99cc849cf12169541aeb86ec1039eb7a14a9dbea813cb69

Download Submit
C:\Windows\System\RinnlYB.exe

Filesize
1.8MB

MD5
60d91340bbea8c728b153514387b4ee3

SHA1
91846e2330b79d332e6a29f6c26c9c6541a04100

SHA256
58b367ebd36a5429cde5ccb5b85c383a363c8c92caae72e7268507d7351c1c16

SHA512
e95cfb080a8adf631e6bce91566553b8c8228dfe1a73ba66fb41c7bc0510e1015d13e1116d82d8ee06668fea31b96897abaad079e76f1fcd78880c1ad9e25df8

Download Submit
C:\Windows\System\SAocsYE.exe

Filesize
1.8MB

MD5
335fb070a6cbcc80cdf54362c60e12ab

SHA1
507d359f67c8503f7540edaedcfb2a6801db7a0e

SHA256
9b5847f6cad13693c59ef803005e2100539ae40e1ce77df424910dcd5afc3ac7

SHA512
b7db1ddf71d01d4685d1ce3ae81ceda3913e6a4f1420cac06b6c17309db0220e6d0a3ff345497cbdebca877302fcb12c1f8e1cdc495a4d703e7a3fd36de67af4

Download Submit
C:\Windows\System\TKlbtmc.exe

Filesize
1.8MB

MD5
24599a0ff7e1d79144e6691118830b4b

SHA1
b2083cd4d8edd4607ec347908207c3bdd33b5084

SHA256
e7af57df9d1d623e6db88473d4a0861624ca822d2373518167260340b9dad7b4

SHA512
9aa491e20486db9d7654c8a0a334ef444f8bb1effceebc905862630806fa5db38a2168167935e0d4a2e6bc95f85e5c57b09512ba65c36858281a90206053dc29

Download Submit
C:\Windows\System\TSbJVFw.exe

Filesize
1.8MB

MD5
fe8845746e1dec7718b1c7853215da32

SHA1
6f9a207ab527a2e88d2c14a7b564949e345f1f61

SHA256
e934ff7fca0f300be83f23e9def297d5397c0bd053f65598a0100445235bb4c8

SHA512
9a377a7a0434cb11121af9f037873384cbefaa238910e6e938d061d8aac2154d7fc6529c3df9fd799887bf367e3f4293ce7039d2faa59e992ec9c143c439c7cf

Download Submit
C:\Windows\System\UhzClYc.exe

Filesize
1.8MB

MD5
37976f03a066b1d3ca0d6e9101e05998

SHA1
c48695b358463337afe24894b3b5af5c8b6a1ffa

SHA256
2504dc79cfa9d140cb372605b2aa1f82354061bc2926581d42b6c3980c820682

SHA512
a561e5eb1d023e4d75abb6f72656dd1f80378e5dfab2f47528b94f9b8398c7a202b61b355eefec13e2eb076896cb491d0264b54d564ccd96e6f4087088889fe9

Download Submit
C:\Windows\System\XkqsBNO.exe

Filesize
1.8MB

MD5
d528b491e6515aeea6974cf4507216a5

SHA1
e28ec6a1ff4aa47ebfe211738b939f99cdcb7019

SHA256
c885920fc6a59202b6c774b1370d54f5a9348c9a640e05e9dd931a95305ce228

SHA512
0c5e37e8a5eb4a1e800e06d13bd4d7b4b65def70fc9733b878a43a9e9828ae45a14ff416e323bd1df128628932d1258c4ca74814397df4e70e039f83ccccf79b

Download Submit
C:\Windows\System\avnbyxW.exe

Filesize
1.8MB

MD5
f1f9f392477b07d6d0a6c9000e2966e0

SHA1
afd42bf3656b26e1d9715364b4df416a8eec0c5e

SHA256
61735a7c394526e0577d73cd329506825deb401ee2e7dfcb38950eca0642e58a

SHA512
57f54968a0455649c6f23d53105617221ff93fd6ad1225b7b654809589dca5ad26c5b983285c159c268243c0b29f03d6d5b08bc8e11a7007d777b625288af51e

Download Submit
C:\Windows\System\cVKPWzO.exe

Filesize
1.8MB

MD5
41b5bf6b0bf73aea0c2f210964d3fd09

SHA1
557335fe0c42b2a77cec72b98d8c3112370e0c2b

SHA256
0259886d15d7314196730e463d6b67fe8b7c56618ce3cbabac09d737ee8656d0

SHA512
cf039fa749b7be6801dc4ac9f3539548ad9f6abae44eb98d570ed46334d11d11aa6acec146b56d75c46c1e76ba45cfe56d858927a52e6e39a068e55788ed1593

Download Submit
C:\Windows\System\gTtoNWE.exe

Filesize
1.8MB

MD5
6a6df8d3efd5e1e964c2aeac5c4b783d

SHA1
222c6f04b084743b5683c2b36938ed6da28df74c

SHA256
10906358673343a3507fc79a0c168ad1329c512cbbd5d47897925223e03409fd

SHA512
17e0ef553b1a80d20676f76e91c1c2bf8c372bd98c2a692cea4b0001dc77be5dfd8e8c18db2135dec11a663c4e69b7e430b7f656500c0f3b65fad5b88993ad23

Download Submit
C:\Windows\System\iURGAgE.exe

Filesize
1.8MB

MD5
d4bb1f11411704bf1f098f672a7a98ec

SHA1
04b94fd4c8eb855cc6e73a92185b4fb0a4df2121

SHA256
7e32a5cc85b8c89d8230f840816d84c4238a26da319b2ef6edde4ad5e0eade32

SHA512
78385c6a4a4d8643fd27e0792e26c097f56638f75ef6f5b0ebef05bb68e85ddcd7e294203dd518229ebba848851a1a653828ccdb1342a38d8453d6346fd2ebc2

Download Submit
C:\Windows\System\iyNPSmK.exe

Filesize
1.8MB

MD5
69520b54f0e36397bb63c2c27efc1e70

SHA1
89e0e4d91f8bd886d4cab1e410d5c9f9ccd7c74e

SHA256
aefa21c576333c3b8bb5d881d7e29b6a87b7f4538fb18d852ecc0737c1e07702

SHA512
f2424e9f99dc4d27df4ad285559d73f343bfce27036da9493096eee2a887fc01e62b71cb3d35a754aa57eff95f2e728236bb60eeb37b69a621db1951fcd19063

Download Submit
C:\Windows\System\jKkisfs.exe

Filesize
1.8MB

MD5
fde245f99e18b5d7109306a8f8c215ad

SHA1
11c2f16e1ff44b69b27be93c88cd6f601228a686

SHA256
84010d952e4d9265d6e05e5fd33d6f2d57859da9b3e0911c458e11cbea3ac6f9

SHA512
674597a219ccab0a85273957b33dcc622b22a1dac7797dd2d3249b56e18cd26a5c2fb6b2a2426431401b9fae36da0d670af77ad83010681727b845daa5092fcb

Download Submit
C:\Windows\System\jTiIjtL.exe

Filesize
1.8MB

MD5
138ad242e705fa1982f79a884ff623b0

SHA1
faa698a7aaed5b2d5b24de6292659077c8e7e013

SHA256
150f26c1536209d2faba656432cc8195a686b9933b876f4b3921cead63a3dceb

SHA512
3f1a33842874df7ffdba7a2dae4514485cb8cfadc25b35da12609df37404bff3f1a0c902da8f1df12729d916dd3276724c73bc9160ebea72aafa0b385714e22d

Download Submit
C:\Windows\System\lZUyTdz.exe

Filesize
1.8MB

MD5
68cd784ccc20ba2ffa1d75954fe67c9f

SHA1
ffbdd4dadd45c136e2b3a56002101f8a61a56796

SHA256
b2a677ef45b53fa5daf45e98a23dec3a527be4a739da40b0350b5802c829b3db

SHA512
33334008a4e22282ec954997db14718370c237a1cd241c1c3c4808be2b261f6f18536de72abb583dcca507cca6ae39b9f4bf828e48b753dcfb5a1aae5245e9ba

Download Submit
C:\Windows\System\lkuHMpO.exe

Filesize
1.8MB

MD5
e5b2501522a49e2d6c09aaa22e04495d

SHA1
08ecc805f6a2818ecf4645eeaee1e41c85dd768d

SHA256
bb6dfad750a8187a1396c2c4b039bae72e8cf55f5de486a31e05c49d8def1037

SHA512
65efd8bd1c97bcd67795465ed2ba4a256b5e5312347d4e9600a6012d90cfc29ad08841f9310a8cc4050bee604e52a35b8d4edddd0c76b87aadd9bcd15d084ae2

Download Submit
C:\Windows\System\mOeFmGa.exe

Filesize
1.8MB

MD5
1a6c669b8838664e8673d38fd7f888ec

SHA1
4a275b3dfc1769abcb24f3dd6066ee2fe129dfcd

SHA256
de1304c73de345990cad72b861c3f6a0863c2059228caf7f17fd1d59a6bf6bde

SHA512
57133feab82b4ba42f18f982bccf5abebca85e320b7ffc11ee8578e74b6530b7ed5235e7e13c46f966e225c8fe3ebf2970ae62789a9ee71aba999f3cf7efa0b2

Download Submit
C:\Windows\System\nPsaOKL.exe

Filesize
1.8MB

MD5
516d84ded892beb19bd5ecf1daec6eb4

SHA1
4aa2bcc7f380b909528c0c8a4e8dcb522daef1b3

SHA256
b6247190c8b1bf170572221fac2c804d1bf93a743934c9e2418b2ec34b4fdcbd

SHA512
9c9aeb0e1a1368ca3308d6dc4dbc9fcb0886ea2840a296c6aac59ee08169db20182112449dcbc720a8baa4c2fffb878d119d28a9cfdd4701d704bfa71e07750f

Download Submit
C:\Windows\System\qQVbINI.exe

Filesize
1.8MB

MD5
326e519899f352b51fcd5e6c3cb3fe7a

SHA1
e6d7f7ee6ce940ac532decba36937a3711f5ba99

SHA256
a31554e41ad330ad2a3b1ac6e1e67df0f36beb75e01320b61fc33dce9e90f360

SHA512
cb151ef7c354504879cea9f2b63772b8f59debb2e8eeb66486363df94e35157ace746efefaaf3d6456e3777684eae0a8dfee3f30fe41fb5e1cd1afa2515b4473

Download Submit
C:\Windows\System\rtjmTFT.exe

Filesize
1.8MB

MD5
80c5c74cfa295da054471ef737ea19da

SHA1
b7afb128cdddd6d1255aee66aa092bc80dc9fced

SHA256
9476dd1268aea3efa48ad7d8a434d695fa719dfe3efae3c3c28dc24b7fdd0c26

SHA512
c74ba44b81c6f4e623388144a7e9df93672e5fea33e65412f8e4e49a6997c85ad3fcb24910efb23ca8af6111e51804cad189fafeccd2469b42ae0acfc06c688e

Download Submit
C:\Windows\System\uKWbQsu.exe

Filesize
1.8MB

MD5
2e3c6384e51c01e2142ac47359331592

SHA1
19d9e01cfc4cc1ad4cb626464160ddf4ad854d11

SHA256
0faa91dc657a55e475278e7e57979168e44bfadbc4c5da901ece2e288dc6621e

SHA512
27f4acd5bb86ff6cd190c56bf330908a816425198feb53382d66101fc16074482b893d822d62ab2374df1429872d8f5193431e6785d87b9cf9a7458b5416b61b

Download Submit
C:\Windows\System\uiNurLc.exe

Filesize
1.8MB

MD5
13a64f6664125ecf68f99bcc3a4ec190

SHA1
b6f4871b3fe34454a4a2907c77737d32d5a2255c

SHA256
71a4a91dc8bacb8d934c04c70fa736d0c000b228943be95399b5d786935a5e86

SHA512
dbf5991723bba39e8704ffec933e98ac84f8b9a78813d62a0254b76a1f10f2c2e763642ef300c6b6931d44c1014aa8462088b09747f97bc1c53fcc5272242108

Download Submit
C:\Windows\System\wSQuFqu.exe

Filesize
1.8MB

MD5
ce4cc26210ef7e172b3555adab5481a2

SHA1
9fe2b2bcceaa1dd7c8fdd0eebe92e321e51df40d

SHA256
a31f215d30b882736dafc176de26db0b75c68d0d53b3acaa9bcb77fad7511eac

SHA512
eddcb5889515d8f8deb3b97f4f28ad4aa4b8b35a291d1c1f6e13060f91e9e511ae48a0bbd59ae92a936f9a46e27bd946e13d5a0e07a6cfb9535878b75355b4bd

Download Submit
C:\Windows\System\wbBUnlg.exe

Filesize
1.8MB

MD5
cf4d2d283b7096c8798309f01f01417d

SHA1
c10fc47dc25b41e417e649a8cc27589be6a49a4f

SHA256
380198fa1f3360878878b0912b82f1a26d662b5371a0df47c2317fd9c70c6b60

SHA512
56204ae735d5643844cdfe19df93358b8aa86c39a4429fb7a1ee88ec26627c29000cc75dba3cc6b113a6320350bdf2db51dfc6a24d3a7a2887f64f875b4ce6ad

Download Submit
C:\Windows\System\xJyKZgK.exe

Filesize
1.8MB

MD5
ee196c1bcf9e7e3c590a1a864843039a

SHA1
1618941b8f97ed3a5ba563f75bdb62ace4f7d2f3

SHA256
cb172395fcbcc33831d381b6c5b6bdad0d4533c1496d6e64c1770c98f75cbee6

SHA512
abc96307b9079b23bb830339a73dfcd628da79114037e1296fe793d1770135dd75a8b144be647fd7b732ca737ec9de140a64010f402a4c5baaa5a0dbde97eac0

Download Submit
C:\Windows\System\zMpUEye.exe

Filesize
1.8MB

MD5
001b15d66ba31287a39ccd72a2b207bb

SHA1
edd29354dd271831ea3c8aec7e224ddac27c540c

SHA256
4b5c93c673ab2cfcf8b95b62217f7f6b86bc6f040945d74c4d46044a4f43fbff

SHA512
f29e48a5558038087ccdbfea2c83e72936b18658311716f66263576af02a6945492a4f414e719b5c72efb2ded238a096671ca6a942ae6e76657b76488bba3b48

Download Submit
C:\Windows\System\zZylAYy.exe

Filesize
1.8MB

MD5
18a187e242033d7dcb570666aec0bbcd

SHA1
b9cf10d2058f054a4843a995b1af3005c1359a8c

SHA256
87878deca5b246f6261eaffca425ae618a107c7e83a73dcf3da33221df5f77f5

SHA512
e99752d42ab4666f2cd13e7ed6878c9e82669829914a8ccb944d5b480f66bfaa4b5be078705667f6c0d207728fb4745a10b1822d8b1f569533f82e883751a43b

Download Submit
memory/4476-0-0x00000207E8B50000-0x00000207E8B60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads