xmrig | 0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 20:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
Size

1.9MB
MD5

b3e4a2e263013d5b14471e4a915df490
SHA1

6b09f7bcd5a3f07b19e4ed04f328bbd077642260
SHA256

0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c
SHA512

e4af26c7d9fc7d9f41db12cdb6d51caf7bab245b1f5514beb766b347b7daac0773ab7b6f2603dd3fb4728f850da2e3a229a0c0ab332689e30152351b7757e6d2
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NDcOzzZiBLv:GemTLkNdfE0pZaq

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b00000002341f-3.dat	xmrig
behavioral2/files/0x000700000002342d-7.dat	xmrig
behavioral2/files/0x000700000002342e-6.dat	xmrig
behavioral2/files/0x000700000002342f-17.dat	xmrig
behavioral2/files/0x0007000000023430-24.dat	xmrig
behavioral2/files/0x0007000000023431-29.dat	xmrig
behavioral2/files/0x0007000000023432-34.dat	xmrig
behavioral2/files/0x0007000000023433-40.dat	xmrig
behavioral2/files/0x0009000000023420-44.dat	xmrig
behavioral2/files/0x0007000000023434-50.dat	xmrig
behavioral2/files/0x0007000000023437-60.dat	xmrig
behavioral2/files/0x0007000000023436-66.dat	xmrig
behavioral2/files/0x0007000000023438-65.dat	xmrig
behavioral2/files/0x000700000002343a-75.dat	xmrig
behavioral2/files/0x000700000002343c-88.dat	xmrig
behavioral2/files/0x000700000002343e-100.dat	xmrig
behavioral2/files/0x000700000002343d-98.dat	xmrig
behavioral2/files/0x000700000002343b-94.dat	xmrig
behavioral2/files/0x0007000000023439-77.dat	xmrig
behavioral2/files/0x0007000000023435-61.dat	xmrig
behavioral2/files/0x000700000002343f-104.dat	xmrig
behavioral2/files/0x000d0000000006c1-109.dat	xmrig
behavioral2/files/0x000600000001e6e2-114.dat	xmrig
behavioral2/files/0x000700000001e6ec-124.dat	xmrig
behavioral2/files/0x000700000001e6e8-126.dat	xmrig
behavioral2/files/0x0006000000022937-133.dat	xmrig
behavioral2/files/0x0007000000023441-140.dat	xmrig
behavioral2/files/0x0007000000023442-150.dat	xmrig
behavioral2/files/0x0007000000023443-156.dat	xmrig
behavioral2/files/0x000300000001e83d-159.dat	xmrig
behavioral2/files/0x000400000001e844-165.dat	xmrig
behavioral2/files/0x000300000001e83c-164.dat	xmrig
behavioral2/files/0x0007000000023440-146.dat	xmrig
behavioral2/files/0x000200000002293d-143.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1056	VfNmfrE.exe
464	yFbhrJG.exe
4684	XSRHppZ.exe
4588	SUMVBoC.exe
2100	XnvPOyE.exe
4968	iNGGjpO.exe
4352	IwOXRGI.exe
4332	AwuypsI.exe
5116	NfkkdhV.exe
1040	eWOeKBG.exe
4068	cAFtaSh.exe
1528	KgqIQYx.exe
2388	KhvAjBm.exe
208	RCxQvoT.exe
656	ZzLhQSn.exe
4240	wyUQUMM.exe
1524	dNejnzL.exe
4740	ksXlhiC.exe
2664	TuCIJQy.exe
1344	tIccoBL.exe
696	rQXimqM.exe
1916	pUduuzA.exe
1636	OGicUDz.exe
3856	AuSEDRt.exe
4648	OwPuJbM.exe
2948	CFRTwyc.exe
2276	kZFrYCK.exe
2864	cdiRpcF.exe
812	RlaSZMe.exe
216	tCBiidS.exe
1148	RKRypmE.exe
5076	hVgdqAP.exe
668	FfpdOkR.exe
4412	icmijOl.exe
4936	grOIxiS.exe
3532	uyPqNbQ.exe
3996	mRSDMvt.exe
1616	yaGmDKr.exe
4996	FrSqhdo.exe
4492	vQrfCsp.exe
2124	LijFgja.exe
4628	BhrbrKk.exe
1188	QyiNikD.exe
2496	TundMwi.exe
3760	hwXpVFA.exe
3908	lBSRVQM.exe
2228	ijtHiED.exe
3400	rYqxGKL.exe
4060	UilyBBQ.exe
64	NpZjYBx.exe
1608	BNRcHnv.exe
4316	mlKLKRi.exe
2472	pMVHSPw.exe
3564	mjzTTxV.exe
996	OzDsvgq.exe
3360	wbXiOlt.exe
3328	tbpuBVV.exe
3272	rPzOyCN.exe
116	ZrYJWhq.exe
1628	yKYrmlF.exe
3500	GwPNLpI.exe
2904	YQitnku.exe
3848	aLtJHhM.exe
3592	msMLeuL.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mltaQXl.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\CFRTwyc.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\tCBiidS.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\ZNtYhWs.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\fmPUCZA.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\wTWqAga.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\XxBraGT.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\nyIhNXF.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\xrWBnhU.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\NuNaJxI.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\ddsfhjv.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\rPzOyCN.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\nRKucHr.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\bcLolQG.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\qibjpNW.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\qznrZQE.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\ViHQxsN.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\GWZWiGI.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\zuIDZzM.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\KMAKmqS.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\RHltsFW.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\iATEnwd.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\rkJjplO.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\xtkgASo.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\fZhBpsW.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\qWeWYUM.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\iJbqzPC.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\QzyXTJu.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\wzsoaaf.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\lzosNor.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\VIppszL.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\bxCQRpu.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\WKsCHaq.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\RfpRcqc.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\tVSXMnk.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\jdWBumW.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\qDoAZzb.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\sSkRjGk.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\HYFjCKq.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\ysJdPYC.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\zVkdLZI.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\yUAlBdB.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\syetvir.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\OeYiwyJ.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\ZZeghNM.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\icmijOl.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\vYMczLV.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\CgrkGWy.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\paVStXJ.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\upTSNeh.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\UYDHTVC.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\uWhGAFj.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\ThlpyCp.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\gQRdWGq.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\ebLweBt.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\qsgfSSx.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\zWQJIlj.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\gDSqyqq.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\lkHAzDh.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\JUyRlRv.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\iNGGjpO.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\lCYPKhh.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\SYrAGnq.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
File created	C:\Windows\System\pUduuzA.exe	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16672	dwm.exe
Token: SeChangeNotifyPrivilege	16672	dwm.exe
Token: 33	16672	dwm.exe
Token: SeIncBasePriorityPrivilege	16672	dwm.exe
Token: SeShutdownPrivilege	16672	dwm.exe
Token: SeCreatePagefilePrivilege	16672	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 1056	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	84
PID 3516 wrote to memory of 1056	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	84
PID 3516 wrote to memory of 464	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	85
PID 3516 wrote to memory of 464	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	85
PID 3516 wrote to memory of 4684	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	86
PID 3516 wrote to memory of 4684	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	86
PID 3516 wrote to memory of 4588	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	87
PID 3516 wrote to memory of 4588	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	87
PID 3516 wrote to memory of 2100	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	88
PID 3516 wrote to memory of 2100	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	88
PID 3516 wrote to memory of 4968	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	89
PID 3516 wrote to memory of 4968	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	89
PID 3516 wrote to memory of 4352	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	90
PID 3516 wrote to memory of 4352	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	90
PID 3516 wrote to memory of 4332	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	91
PID 3516 wrote to memory of 4332	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	91
PID 3516 wrote to memory of 5116	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	92
PID 3516 wrote to memory of 5116	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	92
PID 3516 wrote to memory of 1040	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	93
PID 3516 wrote to memory of 1040	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	93
PID 3516 wrote to memory of 4068	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	95
PID 3516 wrote to memory of 4068	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	95
PID 3516 wrote to memory of 1528	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	96
PID 3516 wrote to memory of 1528	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	96
PID 3516 wrote to memory of 2388	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	97
PID 3516 wrote to memory of 2388	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	97
PID 3516 wrote to memory of 208	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	98
PID 3516 wrote to memory of 208	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	98
PID 3516 wrote to memory of 656	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	99
PID 3516 wrote to memory of 656	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	99
PID 3516 wrote to memory of 4240	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	100
PID 3516 wrote to memory of 4240	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	100
PID 3516 wrote to memory of 4740	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	101
PID 3516 wrote to memory of 4740	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	101
PID 3516 wrote to memory of 1524	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	102
PID 3516 wrote to memory of 1524	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	102
PID 3516 wrote to memory of 2664	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	103
PID 3516 wrote to memory of 2664	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	103
PID 3516 wrote to memory of 1344	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	104
PID 3516 wrote to memory of 1344	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	104
PID 3516 wrote to memory of 696	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	105
PID 3516 wrote to memory of 696	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	105
PID 3516 wrote to memory of 1916	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	108
PID 3516 wrote to memory of 1916	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	108
PID 3516 wrote to memory of 1636	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	109
PID 3516 wrote to memory of 1636	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	109
PID 3516 wrote to memory of 3856	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	110
PID 3516 wrote to memory of 3856	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	110
PID 3516 wrote to memory of 4648	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	112
PID 3516 wrote to memory of 4648	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	112
PID 3516 wrote to memory of 2948	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	113
PID 3516 wrote to memory of 2948	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	113
PID 3516 wrote to memory of 2864	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	114
PID 3516 wrote to memory of 2864	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	114
PID 3516 wrote to memory of 2276	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	115
PID 3516 wrote to memory of 2276	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	115
PID 3516 wrote to memory of 812	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	116
PID 3516 wrote to memory of 812	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	116
PID 3516 wrote to memory of 216	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	117
PID 3516 wrote to memory of 216	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	117
PID 3516 wrote to memory of 1148	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	118
PID 3516 wrote to memory of 1148	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	118
PID 3516 wrote to memory of 5076	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	119
PID 3516 wrote to memory of 5076	3516	0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe	119

C:\Users\Admin\AppData\Local\Temp\0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0f7d13fc4b15c510552d0bd48a09dcebfb63f7f098b598a7c405bfed33ea474c_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\System\VfNmfrE.exe
  C:\Windows\System\VfNmfrE.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\yFbhrJG.exe
  C:\Windows\System\yFbhrJG.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\XSRHppZ.exe
  C:\Windows\System\XSRHppZ.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\SUMVBoC.exe
  C:\Windows\System\SUMVBoC.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\XnvPOyE.exe
  C:\Windows\System\XnvPOyE.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\iNGGjpO.exe
  C:\Windows\System\iNGGjpO.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\IwOXRGI.exe
  C:\Windows\System\IwOXRGI.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\AwuypsI.exe
  C:\Windows\System\AwuypsI.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\NfkkdhV.exe
  C:\Windows\System\NfkkdhV.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\eWOeKBG.exe
  C:\Windows\System\eWOeKBG.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\cAFtaSh.exe
  C:\Windows\System\cAFtaSh.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\KgqIQYx.exe
  C:\Windows\System\KgqIQYx.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\KhvAjBm.exe
  C:\Windows\System\KhvAjBm.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\RCxQvoT.exe
  C:\Windows\System\RCxQvoT.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\ZzLhQSn.exe
  C:\Windows\System\ZzLhQSn.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\wyUQUMM.exe
  C:\Windows\System\wyUQUMM.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\ksXlhiC.exe
  C:\Windows\System\ksXlhiC.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\dNejnzL.exe
  C:\Windows\System\dNejnzL.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\TuCIJQy.exe
  C:\Windows\System\TuCIJQy.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\tIccoBL.exe
  C:\Windows\System\tIccoBL.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\rQXimqM.exe
  C:\Windows\System\rQXimqM.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\pUduuzA.exe
  C:\Windows\System\pUduuzA.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\OGicUDz.exe
  C:\Windows\System\OGicUDz.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\AuSEDRt.exe
  C:\Windows\System\AuSEDRt.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\OwPuJbM.exe
  C:\Windows\System\OwPuJbM.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\CFRTwyc.exe
  C:\Windows\System\CFRTwyc.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\cdiRpcF.exe
  C:\Windows\System\cdiRpcF.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\kZFrYCK.exe
  C:\Windows\System\kZFrYCK.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\RlaSZMe.exe
  C:\Windows\System\RlaSZMe.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\tCBiidS.exe
  C:\Windows\System\tCBiidS.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\RKRypmE.exe
  C:\Windows\System\RKRypmE.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\hVgdqAP.exe
  C:\Windows\System\hVgdqAP.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\FfpdOkR.exe
  C:\Windows\System\FfpdOkR.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\icmijOl.exe
  C:\Windows\System\icmijOl.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\grOIxiS.exe
  C:\Windows\System\grOIxiS.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\uyPqNbQ.exe
  C:\Windows\System\uyPqNbQ.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\mRSDMvt.exe
  C:\Windows\System\mRSDMvt.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\yaGmDKr.exe
  C:\Windows\System\yaGmDKr.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\FrSqhdo.exe
  C:\Windows\System\FrSqhdo.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\vQrfCsp.exe
  C:\Windows\System\vQrfCsp.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\LijFgja.exe
  C:\Windows\System\LijFgja.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\BhrbrKk.exe
  C:\Windows\System\BhrbrKk.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\QyiNikD.exe
  C:\Windows\System\QyiNikD.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\TundMwi.exe
  C:\Windows\System\TundMwi.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\hwXpVFA.exe
  C:\Windows\System\hwXpVFA.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\lBSRVQM.exe
  C:\Windows\System\lBSRVQM.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\ijtHiED.exe
  C:\Windows\System\ijtHiED.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\rYqxGKL.exe
  C:\Windows\System\rYqxGKL.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\UilyBBQ.exe
  C:\Windows\System\UilyBBQ.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\NpZjYBx.exe
  C:\Windows\System\NpZjYBx.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\BNRcHnv.exe
  C:\Windows\System\BNRcHnv.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\mlKLKRi.exe
  C:\Windows\System\mlKLKRi.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\pMVHSPw.exe
  C:\Windows\System\pMVHSPw.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\mjzTTxV.exe
  C:\Windows\System\mjzTTxV.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\OzDsvgq.exe
  C:\Windows\System\OzDsvgq.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\wbXiOlt.exe
  C:\Windows\System\wbXiOlt.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\tbpuBVV.exe
  C:\Windows\System\tbpuBVV.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\rPzOyCN.exe
  C:\Windows\System\rPzOyCN.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\ZrYJWhq.exe
  C:\Windows\System\ZrYJWhq.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\yKYrmlF.exe
  C:\Windows\System\yKYrmlF.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\GwPNLpI.exe
  C:\Windows\System\GwPNLpI.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\YQitnku.exe
  C:\Windows\System\YQitnku.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\aLtJHhM.exe
  C:\Windows\System\aLtJHhM.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\msMLeuL.exe
  C:\Windows\System\msMLeuL.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\sAWrtSx.exe
  C:\Windows\System\sAWrtSx.exe
  2⤵
  PID:4252
- C:\Windows\System\VKKBbBq.exe
  C:\Windows\System\VKKBbBq.exe
  2⤵
  PID:3876
- C:\Windows\System\jESHBJK.exe
  C:\Windows\System\jESHBJK.exe
  2⤵
  PID:3988
- C:\Windows\System\rwECtkQ.exe
  C:\Windows\System\rwECtkQ.exe
  2⤵
  PID:4064
- C:\Windows\System\jOzcDRn.exe
  C:\Windows\System\jOzcDRn.exe
  2⤵
  PID:3060
- C:\Windows\System\tEUJbWZ.exe
  C:\Windows\System\tEUJbWZ.exe
  2⤵
  PID:3228
- C:\Windows\System\oVPqWjB.exe
  C:\Windows\System\oVPqWjB.exe
  2⤵
  PID:3612
- C:\Windows\System\GVLvFUn.exe
  C:\Windows\System\GVLvFUn.exe
  2⤵
  PID:4348
- C:\Windows\System\UDZOjaF.exe
  C:\Windows\System\UDZOjaF.exe
  2⤵
  PID:4208
- C:\Windows\System\dpjDvqa.exe
  C:\Windows\System\dpjDvqa.exe
  2⤵
  PID:1756
- C:\Windows\System\qTRRYHb.exe
  C:\Windows\System\qTRRYHb.exe
  2⤵
  PID:1508
- C:\Windows\System\ZfwgSOO.exe
  C:\Windows\System\ZfwgSOO.exe
  2⤵
  PID:3712
- C:\Windows\System\vFOYZHR.exe
  C:\Windows\System\vFOYZHR.exe
  2⤵
  PID:676
- C:\Windows\System\UCmqWtw.exe
  C:\Windows\System\UCmqWtw.exe
  2⤵
  PID:3916
- C:\Windows\System\nRKucHr.exe
  C:\Windows\System\nRKucHr.exe
  2⤵
  PID:4548
- C:\Windows\System\SHDIJSK.exe
  C:\Windows\System\SHDIJSK.exe
  2⤵
  PID:2120
- C:\Windows\System\SmzHreD.exe
  C:\Windows\System\SmzHreD.exe
  2⤵
  PID:3948
- C:\Windows\System\vPzKXTL.exe
  C:\Windows\System\vPzKXTL.exe
  2⤵
  PID:4860
- C:\Windows\System\sSDQrdk.exe
  C:\Windows\System\sSDQrdk.exe
  2⤵
  PID:4496
- C:\Windows\System\HMoSGbJ.exe
  C:\Windows\System\HMoSGbJ.exe
  2⤵
  PID:4832
- C:\Windows\System\SvNUybB.exe
  C:\Windows\System\SvNUybB.exe
  2⤵
  PID:4408
- C:\Windows\System\TxtmaAv.exe
  C:\Windows\System\TxtmaAv.exe
  2⤵
  PID:4508
- C:\Windows\System\qWHwKBU.exe
  C:\Windows\System\qWHwKBU.exe
  2⤵
  PID:884
- C:\Windows\System\qbCjLEr.exe
  C:\Windows\System\qbCjLEr.exe
  2⤵
  PID:5140
- C:\Windows\System\eCrEslk.exe
  C:\Windows\System\eCrEslk.exe
  2⤵
  PID:5168
- C:\Windows\System\FtWJKTV.exe
  C:\Windows\System\FtWJKTV.exe
  2⤵
  PID:5204
- C:\Windows\System\neekRRQ.exe
  C:\Windows\System\neekRRQ.exe
  2⤵
  PID:5220
- C:\Windows\System\YmqQDND.exe
  C:\Windows\System\YmqQDND.exe
  2⤵
  PID:5252
- C:\Windows\System\zRwczBB.exe
  C:\Windows\System\zRwczBB.exe
  2⤵
  PID:5288
- C:\Windows\System\MeFBGAb.exe
  C:\Windows\System\MeFBGAb.exe
  2⤵
  PID:5304
- C:\Windows\System\Cenrojn.exe
  C:\Windows\System\Cenrojn.exe
  2⤵
  PID:5344
- C:\Windows\System\mRNleAB.exe
  C:\Windows\System\mRNleAB.exe
  2⤵
  PID:5364
- C:\Windows\System\hBlpyGf.exe
  C:\Windows\System\hBlpyGf.exe
  2⤵
  PID:5400
- C:\Windows\System\KMAKmqS.exe
  C:\Windows\System\KMAKmqS.exe
  2⤵
  PID:5428
- C:\Windows\System\RcrvMKQ.exe
  C:\Windows\System\RcrvMKQ.exe
  2⤵
  PID:5456
- C:\Windows\System\bUehPpd.exe
  C:\Windows\System\bUehPpd.exe
  2⤵
  PID:5472
- C:\Windows\System\WJslBHT.exe
  C:\Windows\System\WJslBHT.exe
  2⤵
  PID:5500
- C:\Windows\System\qibjpNW.exe
  C:\Windows\System\qibjpNW.exe
  2⤵
  PID:5520
- C:\Windows\System\gERNCzy.exe
  C:\Windows\System\gERNCzy.exe
  2⤵
  PID:5556
- C:\Windows\System\roIbFvJ.exe
  C:\Windows\System\roIbFvJ.exe
  2⤵
  PID:5592
- C:\Windows\System\pBqiWUs.exe
  C:\Windows\System\pBqiWUs.exe
  2⤵
  PID:5616
- C:\Windows\System\AQSqMlU.exe
  C:\Windows\System\AQSqMlU.exe
  2⤵
  PID:5644
- C:\Windows\System\paVStXJ.exe
  C:\Windows\System\paVStXJ.exe
  2⤵
  PID:5672
- C:\Windows\System\gQRdWGq.exe
  C:\Windows\System\gQRdWGq.exe
  2⤵
  PID:5704
- C:\Windows\System\dWCoBfh.exe
  C:\Windows\System\dWCoBfh.exe
  2⤵
  PID:5728
- C:\Windows\System\OhMLITr.exe
  C:\Windows\System\OhMLITr.exe
  2⤵
  PID:5756
- C:\Windows\System\NOweAbk.exe
  C:\Windows\System\NOweAbk.exe
  2⤵
  PID:5772
- C:\Windows\System\xtrJMpt.exe
  C:\Windows\System\xtrJMpt.exe
  2⤵
  PID:5812
- C:\Windows\System\nyIhNXF.exe
  C:\Windows\System\nyIhNXF.exe
  2⤵
  PID:5844
- C:\Windows\System\hJiVvIu.exe
  C:\Windows\System\hJiVvIu.exe
  2⤵
  PID:5872
- C:\Windows\System\YoiXwwb.exe
  C:\Windows\System\YoiXwwb.exe
  2⤵
  PID:5896
- C:\Windows\System\djqzSCJ.exe
  C:\Windows\System\djqzSCJ.exe
  2⤵
  PID:5936
- C:\Windows\System\ovJrzph.exe
  C:\Windows\System\ovJrzph.exe
  2⤵
  PID:5952
- C:\Windows\System\hhepZQg.exe
  C:\Windows\System\hhepZQg.exe
  2⤵
  PID:5984
- C:\Windows\System\dXaEduh.exe
  C:\Windows\System\dXaEduh.exe
  2⤵
  PID:6012
- C:\Windows\System\szoodvZ.exe
  C:\Windows\System\szoodvZ.exe
  2⤵
  PID:6040
- C:\Windows\System\rkHkhAj.exe
  C:\Windows\System\rkHkhAj.exe
  2⤵
  PID:6064
- C:\Windows\System\yAekgFW.exe
  C:\Windows\System\yAekgFW.exe
  2⤵
  PID:6092
- C:\Windows\System\wpPazwd.exe
  C:\Windows\System\wpPazwd.exe
  2⤵
  PID:6120
- C:\Windows\System\sIbQIVo.exe
  C:\Windows\System\sIbQIVo.exe
  2⤵
  PID:5124
- C:\Windows\System\tXZHxeI.exe
  C:\Windows\System\tXZHxeI.exe
  2⤵
  PID:5176
- C:\Windows\System\WbwEbPZ.exe
  C:\Windows\System\WbwEbPZ.exe
  2⤵
  PID:5240
- C:\Windows\System\ZhTAplc.exe
  C:\Windows\System\ZhTAplc.exe
  2⤵
  PID:5316
- C:\Windows\System\TBzcbXs.exe
  C:\Windows\System\TBzcbXs.exe
  2⤵
  PID:2320
- C:\Windows\System\oguBWWr.exe
  C:\Windows\System\oguBWWr.exe
  2⤵
  PID:5452
- C:\Windows\System\CIlwIhN.exe
  C:\Windows\System\CIlwIhN.exe
  2⤵
  PID:5536
- C:\Windows\System\ebLweBt.exe
  C:\Windows\System\ebLweBt.exe
  2⤵
  PID:5600
- C:\Windows\System\WUqKwqR.exe
  C:\Windows\System\WUqKwqR.exe
  2⤵
  PID:5640
- C:\Windows\System\zLHPhrQ.exe
  C:\Windows\System\zLHPhrQ.exe
  2⤵
  PID:5696
- C:\Windows\System\xhEpKkJ.exe
  C:\Windows\System\xhEpKkJ.exe
  2⤵
  PID:5752
- C:\Windows\System\ZiAqbNN.exe
  C:\Windows\System\ZiAqbNN.exe
  2⤵
  PID:5852
- C:\Windows\System\AcJuyCg.exe
  C:\Windows\System\AcJuyCg.exe
  2⤵
  PID:5948
- C:\Windows\System\txxLBIN.exe
  C:\Windows\System\txxLBIN.exe
  2⤵
  PID:5992
- C:\Windows\System\PJQjFjB.exe
  C:\Windows\System\PJQjFjB.exe
  2⤵
  PID:6028
- C:\Windows\System\rEanYzd.exe
  C:\Windows\System\rEanYzd.exe
  2⤵
  PID:6108
- C:\Windows\System\dlDosgb.exe
  C:\Windows\System\dlDosgb.exe
  2⤵
  PID:5192
- C:\Windows\System\tKVmxAv.exe
  C:\Windows\System\tKVmxAv.exe
  2⤵
  PID:5372
- C:\Windows\System\MWFwtcN.exe
  C:\Windows\System\MWFwtcN.exe
  2⤵
  PID:5492
- C:\Windows\System\XqhzEVY.exe
  C:\Windows\System\XqhzEVY.exe
  2⤵
  PID:5612
- C:\Windows\System\EZyZrnU.exe
  C:\Windows\System\EZyZrnU.exe
  2⤵
  PID:5836
- C:\Windows\System\lUNNAyA.exe
  C:\Windows\System\lUNNAyA.exe
  2⤵
  PID:6048
- C:\Windows\System\UJajklp.exe
  C:\Windows\System\UJajklp.exe
  2⤵
  PID:6104
- C:\Windows\System\JoqCbqh.exe
  C:\Windows\System\JoqCbqh.exe
  2⤵
  PID:5424
- C:\Windows\System\XwjFHPY.exe
  C:\Windows\System\XwjFHPY.exe
  2⤵
  PID:5656
- C:\Windows\System\NbsYwmF.exe
  C:\Windows\System\NbsYwmF.exe
  2⤵
  PID:5148
- C:\Windows\System\ntYFpiq.exe
  C:\Windows\System\ntYFpiq.exe
  2⤵
  PID:5824
- C:\Windows\System\IeLQgEl.exe
  C:\Windows\System\IeLQgEl.exe
  2⤵
  PID:6164
- C:\Windows\System\oiPIZxc.exe
  C:\Windows\System\oiPIZxc.exe
  2⤵
  PID:6192
- C:\Windows\System\TrTfzMs.exe
  C:\Windows\System\TrTfzMs.exe
  2⤵
  PID:6220
- C:\Windows\System\ViHQxsN.exe
  C:\Windows\System\ViHQxsN.exe
  2⤵
  PID:6240
- C:\Windows\System\NgTeepG.exe
  C:\Windows\System\NgTeepG.exe
  2⤵
  PID:6268
- C:\Windows\System\hzWBOFV.exe
  C:\Windows\System\hzWBOFV.exe
  2⤵
  PID:6296
- C:\Windows\System\syetvir.exe
  C:\Windows\System\syetvir.exe
  2⤵
  PID:6324
- C:\Windows\System\RUzwSco.exe
  C:\Windows\System\RUzwSco.exe
  2⤵
  PID:6348
- C:\Windows\System\aRdEAVw.exe
  C:\Windows\System\aRdEAVw.exe
  2⤵
  PID:6388
- C:\Windows\System\eynArPx.exe
  C:\Windows\System\eynArPx.exe
  2⤵
  PID:6420
- C:\Windows\System\yjEQxVp.exe
  C:\Windows\System\yjEQxVp.exe
  2⤵
  PID:6444
- C:\Windows\System\WADUmdm.exe
  C:\Windows\System\WADUmdm.exe
  2⤵
  PID:6476
- C:\Windows\System\OeMbMGd.exe
  C:\Windows\System\OeMbMGd.exe
  2⤵
  PID:6500
- C:\Windows\System\XpfvUtb.exe
  C:\Windows\System\XpfvUtb.exe
  2⤵
  PID:6540
- C:\Windows\System\qLTNIPb.exe
  C:\Windows\System\qLTNIPb.exe
  2⤵
  PID:6556
- C:\Windows\System\jdWBumW.exe
  C:\Windows\System\jdWBumW.exe
  2⤵
  PID:6588
- C:\Windows\System\cwfwjNO.exe
  C:\Windows\System\cwfwjNO.exe
  2⤵
  PID:6612
- C:\Windows\System\SFCwdFg.exe
  C:\Windows\System\SFCwdFg.exe
  2⤵
  PID:6632
- C:\Windows\System\kTTUUXO.exe
  C:\Windows\System\kTTUUXO.exe
  2⤵
  PID:6668
- C:\Windows\System\KtyLron.exe
  C:\Windows\System\KtyLron.exe
  2⤵
  PID:6700
- C:\Windows\System\vDEJCVC.exe
  C:\Windows\System\vDEJCVC.exe
  2⤵
  PID:6732
- C:\Windows\System\sJWxLJm.exe
  C:\Windows\System\sJWxLJm.exe
  2⤵
  PID:6768
- C:\Windows\System\ciamkgN.exe
  C:\Windows\System\ciamkgN.exe
  2⤵
  PID:6784
- C:\Windows\System\dAEqWWy.exe
  C:\Windows\System\dAEqWWy.exe
  2⤵
  PID:6808
- C:\Windows\System\tVmVRgh.exe
  C:\Windows\System\tVmVRgh.exe
  2⤵
  PID:6840
- C:\Windows\System\DYRrLcG.exe
  C:\Windows\System\DYRrLcG.exe
  2⤵
  PID:6860
- C:\Windows\System\cxZVEmn.exe
  C:\Windows\System\cxZVEmn.exe
  2⤵
  PID:6896
- C:\Windows\System\kSdtviu.exe
  C:\Windows\System\kSdtviu.exe
  2⤵
  PID:6924
- C:\Windows\System\jUtUHkB.exe
  C:\Windows\System\jUtUHkB.exe
  2⤵
  PID:6956
- C:\Windows\System\KQUYhcg.exe
  C:\Windows\System\KQUYhcg.exe
  2⤵
  PID:6988
- C:\Windows\System\CvekWSU.exe
  C:\Windows\System\CvekWSU.exe
  2⤵
  PID:7016
- C:\Windows\System\mugGatX.exe
  C:\Windows\System\mugGatX.exe
  2⤵
  PID:7052
- C:\Windows\System\SCbkDGw.exe
  C:\Windows\System\SCbkDGw.exe
  2⤵
  PID:7068
- C:\Windows\System\nxlhKgf.exe
  C:\Windows\System\nxlhKgf.exe
  2⤵
  PID:7100
- C:\Windows\System\LJTbUYy.exe
  C:\Windows\System\LJTbUYy.exe
  2⤵
  PID:7136
- C:\Windows\System\tCSQBHN.exe
  C:\Windows\System\tCSQBHN.exe
  2⤵
  PID:7152
- C:\Windows\System\WvypJSe.exe
  C:\Windows\System\WvypJSe.exe
  2⤵
  PID:5440
- C:\Windows\System\kQDpHBo.exe
  C:\Windows\System\kQDpHBo.exe
  2⤵
  PID:6212
- C:\Windows\System\czAjzZr.exe
  C:\Windows\System\czAjzZr.exe
  2⤵
  PID:6208
- C:\Windows\System\ddILjww.exe
  C:\Windows\System\ddILjww.exe
  2⤵
  PID:6308
- C:\Windows\System\lCYPKhh.exe
  C:\Windows\System\lCYPKhh.exe
  2⤵
  PID:6344
- C:\Windows\System\QXXcNoD.exe
  C:\Windows\System\QXXcNoD.exe
  2⤵
  PID:6440
- C:\Windows\System\iSMfLbW.exe
  C:\Windows\System\iSMfLbW.exe
  2⤵
  PID:6484
- C:\Windows\System\Aswxnbq.exe
  C:\Windows\System\Aswxnbq.exe
  2⤵
  PID:6548
- C:\Windows\System\lzosNor.exe
  C:\Windows\System\lzosNor.exe
  2⤵
  PID:6604
- C:\Windows\System\WLnDPYs.exe
  C:\Windows\System\WLnDPYs.exe
  2⤵
  PID:6724
- C:\Windows\System\XJswJfQ.exe
  C:\Windows\System\XJswJfQ.exe
  2⤵
  PID:6692
- C:\Windows\System\rWaIZzC.exe
  C:\Windows\System\rWaIZzC.exe
  2⤵
  PID:6796
- C:\Windows\System\EqXVYwj.exe
  C:\Windows\System\EqXVYwj.exe
  2⤵
  PID:6892
- C:\Windows\System\ZDLSaMg.exe
  C:\Windows\System\ZDLSaMg.exe
  2⤵
  PID:6964
- C:\Windows\System\nKnZbDa.exe
  C:\Windows\System\nKnZbDa.exe
  2⤵
  PID:7032
- C:\Windows\System\RiCBBvP.exe
  C:\Windows\System\RiCBBvP.exe
  2⤵
  PID:7088
- C:\Windows\System\AxHEWTZ.exe
  C:\Windows\System\AxHEWTZ.exe
  2⤵
  PID:7160
- C:\Windows\System\LSWopoB.exe
  C:\Windows\System\LSWopoB.exe
  2⤵
  PID:6156
- C:\Windows\System\xIJPOhI.exe
  C:\Windows\System\xIJPOhI.exe
  2⤵
  PID:6468
- C:\Windows\System\VsfTEoD.exe
  C:\Windows\System\VsfTEoD.exe
  2⤵
  PID:6620
- C:\Windows\System\ADqgnUq.exe
  C:\Windows\System\ADqgnUq.exe
  2⤵
  PID:6780
- C:\Windows\System\FQGArAA.exe
  C:\Windows\System\FQGArAA.exe
  2⤵
  PID:6972
- C:\Windows\System\jsWKlkq.exe
  C:\Windows\System\jsWKlkq.exe
  2⤵
  PID:7024
- C:\Windows\System\KFEvAqa.exe
  C:\Windows\System\KFEvAqa.exe
  2⤵
  PID:6248
- C:\Windows\System\OeYiwyJ.exe
  C:\Windows\System\OeYiwyJ.exe
  2⤵
  PID:6552
- C:\Windows\System\NnNUwHM.exe
  C:\Windows\System\NnNUwHM.exe
  2⤵
  PID:6828
- C:\Windows\System\rUHWnFD.exe
  C:\Windows\System\rUHWnFD.exe
  2⤵
  PID:6936
- C:\Windows\System\xTVxPxt.exe
  C:\Windows\System\xTVxPxt.exe
  2⤵
  PID:7180
- C:\Windows\System\XcSsNcu.exe
  C:\Windows\System\XcSsNcu.exe
  2⤵
  PID:7196
- C:\Windows\System\RKwbpKg.exe
  C:\Windows\System\RKwbpKg.exe
  2⤵
  PID:7224
- C:\Windows\System\hPFNyRV.exe
  C:\Windows\System\hPFNyRV.exe
  2⤵
  PID:7256
- C:\Windows\System\kBVRvbb.exe
  C:\Windows\System\kBVRvbb.exe
  2⤵
  PID:7288
- C:\Windows\System\jPgylFD.exe
  C:\Windows\System\jPgylFD.exe
  2⤵
  PID:7308
- C:\Windows\System\LjQCAWf.exe
  C:\Windows\System\LjQCAWf.exe
  2⤵
  PID:7336
- C:\Windows\System\ZZeghNM.exe
  C:\Windows\System\ZZeghNM.exe
  2⤵
  PID:7376
- C:\Windows\System\DlBgNVe.exe
  C:\Windows\System\DlBgNVe.exe
  2⤵
  PID:7404
- C:\Windows\System\SHgVbEB.exe
  C:\Windows\System\SHgVbEB.exe
  2⤵
  PID:7432
- C:\Windows\System\HpxdGmr.exe
  C:\Windows\System\HpxdGmr.exe
  2⤵
  PID:7460
- C:\Windows\System\wzNoQVg.exe
  C:\Windows\System\wzNoQVg.exe
  2⤵
  PID:7480
- C:\Windows\System\BqfQcfB.exe
  C:\Windows\System\BqfQcfB.exe
  2⤵
  PID:7516
- C:\Windows\System\PcCqycY.exe
  C:\Windows\System\PcCqycY.exe
  2⤵
  PID:7544
- C:\Windows\System\QOMWlOu.exe
  C:\Windows\System\QOMWlOu.exe
  2⤵
  PID:7572
- C:\Windows\System\ZJnnpte.exe
  C:\Windows\System\ZJnnpte.exe
  2⤵
  PID:7612
- C:\Windows\System\eoYeyzD.exe
  C:\Windows\System\eoYeyzD.exe
  2⤵
  PID:7640
- C:\Windows\System\aHvkzdl.exe
  C:\Windows\System\aHvkzdl.exe
  2⤵
  PID:7676
- C:\Windows\System\RnYMPXd.exe
  C:\Windows\System\RnYMPXd.exe
  2⤵
  PID:7704
- C:\Windows\System\hQSVOLS.exe
  C:\Windows\System\hQSVOLS.exe
  2⤵
  PID:7724
- C:\Windows\System\MDGOsVg.exe
  C:\Windows\System\MDGOsVg.exe
  2⤵
  PID:7748
- C:\Windows\System\TCPfsSt.exe
  C:\Windows\System\TCPfsSt.exe
  2⤵
  PID:7772
- C:\Windows\System\dmSxgNW.exe
  C:\Windows\System\dmSxgNW.exe
  2⤵
  PID:7796
- C:\Windows\System\qaKdsov.exe
  C:\Windows\System\qaKdsov.exe
  2⤵
  PID:7824
- C:\Windows\System\VizARCi.exe
  C:\Windows\System\VizARCi.exe
  2⤵
  PID:7860
- C:\Windows\System\nLCMSdX.exe
  C:\Windows\System\nLCMSdX.exe
  2⤵
  PID:7880
- C:\Windows\System\MkLXPiV.exe
  C:\Windows\System\MkLXPiV.exe
  2⤵
  PID:7900
- C:\Windows\System\ifmBjWh.exe
  C:\Windows\System\ifmBjWh.exe
  2⤵
  PID:7936
- C:\Windows\System\owQoKPM.exe
  C:\Windows\System\owQoKPM.exe
  2⤵
  PID:7968
- C:\Windows\System\lZAszrO.exe
  C:\Windows\System\lZAszrO.exe
  2⤵
  PID:7992
- C:\Windows\System\owdtwUI.exe
  C:\Windows\System\owdtwUI.exe
  2⤵
  PID:8024
- C:\Windows\System\tFAfWaq.exe
  C:\Windows\System\tFAfWaq.exe
  2⤵
  PID:8044
- C:\Windows\System\oLJgqnX.exe
  C:\Windows\System\oLJgqnX.exe
  2⤵
  PID:8064
- C:\Windows\System\YErlobE.exe
  C:\Windows\System\YErlobE.exe
  2⤵
  PID:8080
- C:\Windows\System\yjafYdQ.exe
  C:\Windows\System\yjafYdQ.exe
  2⤵
  PID:8108
- C:\Windows\System\ZFLmixS.exe
  C:\Windows\System\ZFLmixS.exe
  2⤵
  PID:8140
- C:\Windows\System\cpWvXMT.exe
  C:\Windows\System\cpWvXMT.exe
  2⤵
  PID:8168
- C:\Windows\System\HiKehqe.exe
  C:\Windows\System\HiKehqe.exe
  2⤵
  PID:6528
- C:\Windows\System\iXHeNbB.exe
  C:\Windows\System\iXHeNbB.exe
  2⤵
  PID:7236
- C:\Windows\System\iovxAsB.exe
  C:\Windows\System\iovxAsB.exe
  2⤵
  PID:7364
- C:\Windows\System\iijSSlt.exe
  C:\Windows\System\iijSSlt.exe
  2⤵
  PID:7396
- C:\Windows\System\iJbqzPC.exe
  C:\Windows\System\iJbqzPC.exe
  2⤵
  PID:7444
- C:\Windows\System\ASwaJMJ.exe
  C:\Windows\System\ASwaJMJ.exe
  2⤵
  PID:7536
- C:\Windows\System\BQFFMRl.exe
  C:\Windows\System\BQFFMRl.exe
  2⤵
  PID:7592
- C:\Windows\System\lwcIkpe.exe
  C:\Windows\System\lwcIkpe.exe
  2⤵
  PID:7636
- C:\Windows\System\LleqyWD.exe
  C:\Windows\System\LleqyWD.exe
  2⤵
  PID:7716
- C:\Windows\System\glGkKLj.exe
  C:\Windows\System\glGkKLj.exe
  2⤵
  PID:7780
- C:\Windows\System\mTurjDK.exe
  C:\Windows\System\mTurjDK.exe
  2⤵
  PID:7848
- C:\Windows\System\nSwYXzj.exe
  C:\Windows\System\nSwYXzj.exe
  2⤵
  PID:7896
- C:\Windows\System\lZpQgUZ.exe
  C:\Windows\System\lZpQgUZ.exe
  2⤵
  PID:7976
- C:\Windows\System\eEKhuFr.exe
  C:\Windows\System\eEKhuFr.exe
  2⤵
  PID:8060
- C:\Windows\System\jPEupjo.exe
  C:\Windows\System\jPEupjo.exe
  2⤵
  PID:8164
- C:\Windows\System\rQlVbaI.exe
  C:\Windows\System\rQlVbaI.exe
  2⤵
  PID:7172
- C:\Windows\System\QkxapyD.exe
  C:\Windows\System\QkxapyD.exe
  2⤵
  PID:7276
- C:\Windows\System\fmPUCZA.exe
  C:\Windows\System\fmPUCZA.exe
  2⤵
  PID:7476
- C:\Windows\System\WIyxJxE.exe
  C:\Windows\System\WIyxJxE.exe
  2⤵
  PID:7584
- C:\Windows\System\BCblCBh.exe
  C:\Windows\System\BCblCBh.exe
  2⤵
  PID:7624
- C:\Windows\System\nzSBCox.exe
  C:\Windows\System\nzSBCox.exe
  2⤵
  PID:7840
- C:\Windows\System\mEvVkca.exe
  C:\Windows\System\mEvVkca.exe
  2⤵
  PID:8076
- C:\Windows\System\GUtEuOY.exe
  C:\Windows\System\GUtEuOY.exe
  2⤵
  PID:7280
- C:\Windows\System\LxEslPW.exe
  C:\Windows\System\LxEslPW.exe
  2⤵
  PID:7756
- C:\Windows\System\qWQYcgT.exe
  C:\Windows\System\qWQYcgT.exe
  2⤵
  PID:7760
- C:\Windows\System\EwRTUpE.exe
  C:\Windows\System\EwRTUpE.exe
  2⤵
  PID:8188
- C:\Windows\System\mKHHsjw.exe
  C:\Windows\System\mKHHsjw.exe
  2⤵
  PID:7944
- C:\Windows\System\wxVMyCm.exe
  C:\Windows\System\wxVMyCm.exe
  2⤵
  PID:8216
- C:\Windows\System\kSnlWmd.exe
  C:\Windows\System\kSnlWmd.exe
  2⤵
  PID:8240
- C:\Windows\System\WkCUihC.exe
  C:\Windows\System\WkCUihC.exe
  2⤵
  PID:8268
- C:\Windows\System\imtQsiL.exe
  C:\Windows\System\imtQsiL.exe
  2⤵
  PID:8292
- C:\Windows\System\aIsFiOk.exe
  C:\Windows\System\aIsFiOk.exe
  2⤵
  PID:8320
- C:\Windows\System\MPzIaDS.exe
  C:\Windows\System\MPzIaDS.exe
  2⤵
  PID:8356
- C:\Windows\System\PegLGcG.exe
  C:\Windows\System\PegLGcG.exe
  2⤵
  PID:8380
- C:\Windows\System\VIppszL.exe
  C:\Windows\System\VIppszL.exe
  2⤵
  PID:8408
- C:\Windows\System\CqBfpIY.exe
  C:\Windows\System\CqBfpIY.exe
  2⤵
  PID:8440
- C:\Windows\System\lIbDitq.exe
  C:\Windows\System\lIbDitq.exe
  2⤵
  PID:8468
- C:\Windows\System\vYMczLV.exe
  C:\Windows\System\vYMczLV.exe
  2⤵
  PID:8496
- C:\Windows\System\NiWAyNM.exe
  C:\Windows\System\NiWAyNM.exe
  2⤵
  PID:8524
- C:\Windows\System\ohQufla.exe
  C:\Windows\System\ohQufla.exe
  2⤵
  PID:8556
- C:\Windows\System\HYFjCKq.exe
  C:\Windows\System\HYFjCKq.exe
  2⤵
  PID:8576
- C:\Windows\System\uZXNxMi.exe
  C:\Windows\System\uZXNxMi.exe
  2⤵
  PID:8592
- C:\Windows\System\EovfTjk.exe
  C:\Windows\System\EovfTjk.exe
  2⤵
  PID:8620
- C:\Windows\System\jeRQzKR.exe
  C:\Windows\System\jeRQzKR.exe
  2⤵
  PID:8644
- C:\Windows\System\pSqffpS.exe
  C:\Windows\System\pSqffpS.exe
  2⤵
  PID:8668
- C:\Windows\System\UDAinjB.exe
  C:\Windows\System\UDAinjB.exe
  2⤵
  PID:8696
- C:\Windows\System\kYpPjES.exe
  C:\Windows\System\kYpPjES.exe
  2⤵
  PID:8736
- C:\Windows\System\WSvbmeH.exe
  C:\Windows\System\WSvbmeH.exe
  2⤵
  PID:8764
- C:\Windows\System\gxkSgCH.exe
  C:\Windows\System\gxkSgCH.exe
  2⤵
  PID:8800
- C:\Windows\System\rCdJtTn.exe
  C:\Windows\System\rCdJtTn.exe
  2⤵
  PID:8828
- C:\Windows\System\gkTbeHw.exe
  C:\Windows\System\gkTbeHw.exe
  2⤵
  PID:8844
- C:\Windows\System\vvpHXoz.exe
  C:\Windows\System\vvpHXoz.exe
  2⤵
  PID:8872
- C:\Windows\System\HcFMbcW.exe
  C:\Windows\System\HcFMbcW.exe
  2⤵
  PID:8900
- C:\Windows\System\JpamtsL.exe
  C:\Windows\System\JpamtsL.exe
  2⤵
  PID:8920
- C:\Windows\System\KwstdLY.exe
  C:\Windows\System\KwstdLY.exe
  2⤵
  PID:8948
- C:\Windows\System\SgnYZDF.exe
  C:\Windows\System\SgnYZDF.exe
  2⤵
  PID:8980
- C:\Windows\System\TAYVZCV.exe
  C:\Windows\System\TAYVZCV.exe
  2⤵
  PID:9008
- C:\Windows\System\MrBimkl.exe
  C:\Windows\System\MrBimkl.exe
  2⤵
  PID:9036
- C:\Windows\System\KgKxDSW.exe
  C:\Windows\System\KgKxDSW.exe
  2⤵
  PID:9068
- C:\Windows\System\sqkSSOw.exe
  C:\Windows\System\sqkSSOw.exe
  2⤵
  PID:9096
- C:\Windows\System\veSZxFA.exe
  C:\Windows\System\veSZxFA.exe
  2⤵
  PID:9136
- C:\Windows\System\sHVfcAb.exe
  C:\Windows\System\sHVfcAb.exe
  2⤵
  PID:9164
- C:\Windows\System\gQZooDC.exe
  C:\Windows\System\gQZooDC.exe
  2⤵
  PID:9196
- C:\Windows\System\TJLTrtL.exe
  C:\Windows\System\TJLTrtL.exe
  2⤵
  PID:8208
- C:\Windows\System\tXaNXiJ.exe
  C:\Windows\System\tXaNXiJ.exe
  2⤵
  PID:8260
- C:\Windows\System\lKlMCpC.exe
  C:\Windows\System\lKlMCpC.exe
  2⤵
  PID:8316
- C:\Windows\System\Uactumq.exe
  C:\Windows\System\Uactumq.exe
  2⤵
  PID:8376
- C:\Windows\System\gakOFgW.exe
  C:\Windows\System\gakOFgW.exe
  2⤵
  PID:8424
- C:\Windows\System\hYlGwek.exe
  C:\Windows\System\hYlGwek.exe
  2⤵
  PID:8492
- C:\Windows\System\EmlGPHm.exe
  C:\Windows\System\EmlGPHm.exe
  2⤵
  PID:8540
- C:\Windows\System\zdAjcBB.exe
  C:\Windows\System\zdAjcBB.exe
  2⤵
  PID:8636
- C:\Windows\System\FCFpaWE.exe
  C:\Windows\System\FCFpaWE.exe
  2⤵
  PID:8692
- C:\Windows\System\BXZKJbf.exe
  C:\Windows\System\BXZKJbf.exe
  2⤵
  PID:8788
- C:\Windows\System\vCQpoIG.exe
  C:\Windows\System\vCQpoIG.exe
  2⤵
  PID:8864
- C:\Windows\System\ljZEKnH.exe
  C:\Windows\System\ljZEKnH.exe
  2⤵
  PID:8856
- C:\Windows\System\RqIcNIg.exe
  C:\Windows\System\RqIcNIg.exe
  2⤵
  PID:8940
- C:\Windows\System\znFIcRI.exe
  C:\Windows\System\znFIcRI.exe
  2⤵
  PID:8992
- C:\Windows\System\vCRmdBs.exe
  C:\Windows\System\vCRmdBs.exe
  2⤵
  PID:9092
- C:\Windows\System\JiUMqQG.exe
  C:\Windows\System\JiUMqQG.exe
  2⤵
  PID:9156
- C:\Windows\System\YIADiAf.exe
  C:\Windows\System\YIADiAf.exe
  2⤵
  PID:8232
- C:\Windows\System\tEIvKzx.exe
  C:\Windows\System\tEIvKzx.exe
  2⤵
  PID:8532
- C:\Windows\System\VxXJirs.exe
  C:\Windows\System\VxXJirs.exe
  2⤵
  PID:8464
- C:\Windows\System\qMTCGXO.exe
  C:\Windows\System\qMTCGXO.exe
  2⤵
  PID:8684
- C:\Windows\System\VXWsQDA.exe
  C:\Windows\System\VXWsQDA.exe
  2⤵
  PID:8840
- C:\Windows\System\ANMzgVM.exe
  C:\Windows\System\ANMzgVM.exe
  2⤵
  PID:9020
- C:\Windows\System\nhMFjmo.exe
  C:\Windows\System\nhMFjmo.exe
  2⤵
  PID:7872
- C:\Windows\System\anrvaqb.exe
  C:\Windows\System\anrvaqb.exe
  2⤵
  PID:8404
- C:\Windows\System\PjYMzTg.exe
  C:\Windows\System\PjYMzTg.exe
  2⤵
  PID:8748
- C:\Windows\System\ujUNtKI.exe
  C:\Windows\System\ujUNtKI.exe
  2⤵
  PID:9132
- C:\Windows\System\ltcSVMh.exe
  C:\Windows\System\ltcSVMh.exe
  2⤵
  PID:8820
- C:\Windows\System\zCUOHoM.exe
  C:\Windows\System\zCUOHoM.exe
  2⤵
  PID:9240
- C:\Windows\System\lmjkszL.exe
  C:\Windows\System\lmjkszL.exe
  2⤵
  PID:9272
- C:\Windows\System\mfDFvAX.exe
  C:\Windows\System\mfDFvAX.exe
  2⤵
  PID:9292
- C:\Windows\System\GWdghMT.exe
  C:\Windows\System\GWdghMT.exe
  2⤵
  PID:9312
- C:\Windows\System\IJUfiJm.exe
  C:\Windows\System\IJUfiJm.exe
  2⤵
  PID:9328
- C:\Windows\System\RdLXuQc.exe
  C:\Windows\System\RdLXuQc.exe
  2⤵
  PID:9348
- C:\Windows\System\NklEgZE.exe
  C:\Windows\System\NklEgZE.exe
  2⤵
  PID:9368
- C:\Windows\System\RQsgHzO.exe
  C:\Windows\System\RQsgHzO.exe
  2⤵
  PID:9384
- C:\Windows\System\NVyUBVp.exe
  C:\Windows\System\NVyUBVp.exe
  2⤵
  PID:9412
- C:\Windows\System\MhgDjnY.exe
  C:\Windows\System\MhgDjnY.exe
  2⤵
  PID:9428
- C:\Windows\System\xtkgASo.exe
  C:\Windows\System\xtkgASo.exe
  2⤵
  PID:9464
- C:\Windows\System\mZDhdAk.exe
  C:\Windows\System\mZDhdAk.exe
  2⤵
  PID:9500
- C:\Windows\System\LlIohsM.exe
  C:\Windows\System\LlIohsM.exe
  2⤵
  PID:9540
- C:\Windows\System\CBliItK.exe
  C:\Windows\System\CBliItK.exe
  2⤵
  PID:9568
- C:\Windows\System\KtwiXyq.exe
  C:\Windows\System\KtwiXyq.exe
  2⤵
  PID:9604
- C:\Windows\System\jMIICHG.exe
  C:\Windows\System\jMIICHG.exe
  2⤵
  PID:9632
- C:\Windows\System\rZIljvk.exe
  C:\Windows\System\rZIljvk.exe
  2⤵
  PID:9668
- C:\Windows\System\pOYqLiP.exe
  C:\Windows\System\pOYqLiP.exe
  2⤵
  PID:9684
- C:\Windows\System\mowPqnn.exe
  C:\Windows\System\mowPqnn.exe
  2⤵
  PID:9716
- C:\Windows\System\GzrOsDv.exe
  C:\Windows\System\GzrOsDv.exe
  2⤵
  PID:9752
- C:\Windows\System\RHltsFW.exe
  C:\Windows\System\RHltsFW.exe
  2⤵
  PID:9780
- C:\Windows\System\LmoeCFS.exe
  C:\Windows\System\LmoeCFS.exe
  2⤵
  PID:9804
- C:\Windows\System\MOVEuJY.exe
  C:\Windows\System\MOVEuJY.exe
  2⤵
  PID:9820
- C:\Windows\System\rIGOdBp.exe
  C:\Windows\System\rIGOdBp.exe
  2⤵
  PID:9852
- C:\Windows\System\yjRSxJj.exe
  C:\Windows\System\yjRSxJj.exe
  2⤵
  PID:9872
- C:\Windows\System\XwFJUnE.exe
  C:\Windows\System\XwFJUnE.exe
  2⤵
  PID:9908
- C:\Windows\System\URLfTbi.exe
  C:\Windows\System\URLfTbi.exe
  2⤵
  PID:9940
- C:\Windows\System\lumCZAw.exe
  C:\Windows\System\lumCZAw.exe
  2⤵
  PID:9968
- C:\Windows\System\zoiVbCj.exe
  C:\Windows\System\zoiVbCj.exe
  2⤵
  PID:10004
- C:\Windows\System\pEMPbCg.exe
  C:\Windows\System\pEMPbCg.exe
  2⤵
  PID:10032
- C:\Windows\System\VbIJdzP.exe
  C:\Windows\System\VbIJdzP.exe
  2⤵
  PID:10056
- C:\Windows\System\aKzfstC.exe
  C:\Windows\System\aKzfstC.exe
  2⤵
  PID:10084
- C:\Windows\System\UsZNfMR.exe
  C:\Windows\System\UsZNfMR.exe
  2⤵
  PID:10112
- C:\Windows\System\uNeoSax.exe
  C:\Windows\System\uNeoSax.exe
  2⤵
  PID:10140
- C:\Windows\System\denGNAG.exe
  C:\Windows\System\denGNAG.exe
  2⤵
  PID:10168
- C:\Windows\System\bIkmiSV.exe
  C:\Windows\System\bIkmiSV.exe
  2⤵
  PID:10196
- C:\Windows\System\ByRLCiX.exe
  C:\Windows\System\ByRLCiX.exe
  2⤵
  PID:10216
- C:\Windows\System\BTdGYsO.exe
  C:\Windows\System\BTdGYsO.exe
  2⤵
  PID:10236
- C:\Windows\System\OBAqedm.exe
  C:\Windows\System\OBAqedm.exe
  2⤵
  PID:9260
- C:\Windows\System\xrWBnhU.exe
  C:\Windows\System\xrWBnhU.exe
  2⤵
  PID:9364
- C:\Windows\System\KFcLKjR.exe
  C:\Windows\System\KFcLKjR.exe
  2⤵
  PID:9356
- C:\Windows\System\wNEWncD.exe
  C:\Windows\System\wNEWncD.exe
  2⤵
  PID:9512
- C:\Windows\System\aehVAyr.exe
  C:\Windows\System\aehVAyr.exe
  2⤵
  PID:9560
- C:\Windows\System\XTDcudR.exe
  C:\Windows\System\XTDcudR.exe
  2⤵
  PID:9556
- C:\Windows\System\xdSNMFG.exe
  C:\Windows\System\xdSNMFG.exe
  2⤵
  PID:9704
- C:\Windows\System\CgrkGWy.exe
  C:\Windows\System\CgrkGWy.exe
  2⤵
  PID:9736
- C:\Windows\System\HjlcxbU.exe
  C:\Windows\System\HjlcxbU.exe
  2⤵
  PID:9796
- C:\Windows\System\IStWmSr.exe
  C:\Windows\System\IStWmSr.exe
  2⤵
  PID:9868
- C:\Windows\System\rRsfTtj.exe
  C:\Windows\System\rRsfTtj.exe
  2⤵
  PID:9976
- C:\Windows\System\YYWoriT.exe
  C:\Windows\System\YYWoriT.exe
  2⤵
  PID:10016
- C:\Windows\System\vsUUPEv.exe
  C:\Windows\System\vsUUPEv.exe
  2⤵
  PID:10048
- C:\Windows\System\jlehhsk.exe
  C:\Windows\System\jlehhsk.exe
  2⤵
  PID:10104
- C:\Windows\System\oxOCqzd.exe
  C:\Windows\System\oxOCqzd.exe
  2⤵
  PID:10192
- C:\Windows\System\FcYLztp.exe
  C:\Windows\System\FcYLztp.exe
  2⤵
  PID:10180
- C:\Windows\System\gVPFhoU.exe
  C:\Windows\System\gVPFhoU.exe
  2⤵
  PID:9404
- C:\Windows\System\kvxdyeM.exe
  C:\Windows\System\kvxdyeM.exe
  2⤵
  PID:9420
- C:\Windows\System\NmdFEhv.exe
  C:\Windows\System\NmdFEhv.exe
  2⤵
  PID:9680
- C:\Windows\System\sbPfdGI.exe
  C:\Windows\System\sbPfdGI.exe
  2⤵
  PID:9936
- C:\Windows\System\eXxgiLn.exe
  C:\Windows\System\eXxgiLn.exe
  2⤵
  PID:10152
- C:\Windows\System\LoOfnEz.exe
  C:\Windows\System\LoOfnEz.exe
  2⤵
  PID:10224
- C:\Windows\System\UdsNObX.exe
  C:\Windows\System\UdsNObX.exe
  2⤵
  PID:9460
- C:\Windows\System\vOMagOJ.exe
  C:\Windows\System\vOMagOJ.exe
  2⤵
  PID:9644
- C:\Windows\System\BdYcLvX.exe
  C:\Windows\System\BdYcLvX.exe
  2⤵
  PID:9964
- C:\Windows\System\fZhBpsW.exe
  C:\Windows\System\fZhBpsW.exe
  2⤵
  PID:10080
- C:\Windows\System\BWhCPYm.exe
  C:\Windows\System\BWhCPYm.exe
  2⤵
  PID:9220
- C:\Windows\System\riZcJmE.exe
  C:\Windows\System\riZcJmE.exe
  2⤵
  PID:10260
- C:\Windows\System\zTKaTYX.exe
  C:\Windows\System\zTKaTYX.exe
  2⤵
  PID:10284
- C:\Windows\System\ypISCiK.exe
  C:\Windows\System\ypISCiK.exe
  2⤵
  PID:10316
- C:\Windows\System\AOOCMFl.exe
  C:\Windows\System\AOOCMFl.exe
  2⤵
  PID:10412
- C:\Windows\System\rDzyMNS.exe
  C:\Windows\System\rDzyMNS.exe
  2⤵
  PID:10428
- C:\Windows\System\yWJqUpA.exe
  C:\Windows\System\yWJqUpA.exe
  2⤵
  PID:10444
- C:\Windows\System\JReysgG.exe
  C:\Windows\System\JReysgG.exe
  2⤵
  PID:10472
- C:\Windows\System\QbnOYyJ.exe
  C:\Windows\System\QbnOYyJ.exe
  2⤵
  PID:10512
- C:\Windows\System\CcJqGMw.exe
  C:\Windows\System\CcJqGMw.exe
  2⤵
  PID:10532
- C:\Windows\System\qIkqupT.exe
  C:\Windows\System\qIkqupT.exe
  2⤵
  PID:10556
- C:\Windows\System\qDoAZzb.exe
  C:\Windows\System\qDoAZzb.exe
  2⤵
  PID:10584
- C:\Windows\System\OrGZyjV.exe
  C:\Windows\System\OrGZyjV.exe
  2⤵
  PID:10608
- C:\Windows\System\InDobJM.exe
  C:\Windows\System\InDobJM.exe
  2⤵
  PID:10628
- C:\Windows\System\qsgfSSx.exe
  C:\Windows\System\qsgfSSx.exe
  2⤵
  PID:10656
- C:\Windows\System\BusMNoS.exe
  C:\Windows\System\BusMNoS.exe
  2⤵
  PID:10684
- C:\Windows\System\FrBBwvj.exe
  C:\Windows\System\FrBBwvj.exe
  2⤵
  PID:10724
- C:\Windows\System\ZyWEOrp.exe
  C:\Windows\System\ZyWEOrp.exe
  2⤵
  PID:10752
- C:\Windows\System\ZwQfiOZ.exe
  C:\Windows\System\ZwQfiOZ.exe
  2⤵
  PID:10780
- C:\Windows\System\oBIsrSJ.exe
  C:\Windows\System\oBIsrSJ.exe
  2⤵
  PID:10808
- C:\Windows\System\bppLAds.exe
  C:\Windows\System\bppLAds.exe
  2⤵
  PID:10836
- C:\Windows\System\PHKnwcv.exe
  C:\Windows\System\PHKnwcv.exe
  2⤵
  PID:10876
- C:\Windows\System\fjuHpAz.exe
  C:\Windows\System\fjuHpAz.exe
  2⤵
  PID:10904
- C:\Windows\System\NuNaJxI.exe
  C:\Windows\System\NuNaJxI.exe
  2⤵
  PID:10924
- C:\Windows\System\sznsibF.exe
  C:\Windows\System\sznsibF.exe
  2⤵
  PID:10948
- C:\Windows\System\wXgEGGe.exe
  C:\Windows\System\wXgEGGe.exe
  2⤵
  PID:10976
- C:\Windows\System\HQPHDQe.exe
  C:\Windows\System\HQPHDQe.exe
  2⤵
  PID:10992
- C:\Windows\System\RGqhWrf.exe
  C:\Windows\System\RGqhWrf.exe
  2⤵
  PID:11020
- C:\Windows\System\WcutBVX.exe
  C:\Windows\System\WcutBVX.exe
  2⤵
  PID:11048
- C:\Windows\System\rqVsWJi.exe
  C:\Windows\System\rqVsWJi.exe
  2⤵
  PID:11076
- C:\Windows\System\WglamQo.exe
  C:\Windows\System\WglamQo.exe
  2⤵
  PID:11104
- C:\Windows\System\NzflWgj.exe
  C:\Windows\System\NzflWgj.exe
  2⤵
  PID:11128
- C:\Windows\System\txEDIqH.exe
  C:\Windows\System\txEDIqH.exe
  2⤵
  PID:11156
- C:\Windows\System\RirWVrj.exe
  C:\Windows\System\RirWVrj.exe
  2⤵
  PID:11176
- C:\Windows\System\oCrvZsj.exe
  C:\Windows\System\oCrvZsj.exe
  2⤵
  PID:11192
- C:\Windows\System\pivDBoK.exe
  C:\Windows\System\pivDBoK.exe
  2⤵
  PID:11220
- C:\Windows\System\XnMKbuU.exe
  C:\Windows\System\XnMKbuU.exe
  2⤵
  PID:11248
- C:\Windows\System\WljjHXA.exe
  C:\Windows\System\WljjHXA.exe
  2⤵
  PID:10256
- C:\Windows\System\ysJdPYC.exe
  C:\Windows\System\ysJdPYC.exe
  2⤵
  PID:10304
- C:\Windows\System\rsJLkiT.exe
  C:\Windows\System\rsJLkiT.exe
  2⤵
  PID:10340
- C:\Windows\System\cGuDPgf.exe
  C:\Windows\System\cGuDPgf.exe
  2⤵
  PID:10436
- C:\Windows\System\KDWtmJR.exe
  C:\Windows\System\KDWtmJR.exe
  2⤵
  PID:10540
- C:\Windows\System\VbQZrrm.exe
  C:\Windows\System\VbQZrrm.exe
  2⤵
  PID:10568
- C:\Windows\System\iFlYfCf.exe
  C:\Windows\System\iFlYfCf.exe
  2⤵
  PID:10640
- C:\Windows\System\aNPzQPD.exe
  C:\Windows\System\aNPzQPD.exe
  2⤵
  PID:10764
- C:\Windows\System\ewVuLmN.exe
  C:\Windows\System\ewVuLmN.exe
  2⤵
  PID:10792
- C:\Windows\System\YghsOfB.exe
  C:\Windows\System\YghsOfB.exe
  2⤵
  PID:10864
- C:\Windows\System\niFIsBk.exe
  C:\Windows\System\niFIsBk.exe
  2⤵
  PID:10964
- C:\Windows\System\lHQQBql.exe
  C:\Windows\System\lHQQBql.exe
  2⤵
  PID:10984
- C:\Windows\System\wJXYQmG.exe
  C:\Windows\System\wJXYQmG.exe
  2⤵
  PID:11140
- C:\Windows\System\ggVcyTn.exe
  C:\Windows\System\ggVcyTn.exe
  2⤵
  PID:11116
- C:\Windows\System\remTXbe.exe
  C:\Windows\System\remTXbe.exe
  2⤵
  PID:11208
- C:\Windows\System\pXHoXjx.exe
  C:\Windows\System\pXHoXjx.exe
  2⤵
  PID:1688
- C:\Windows\System\yeICNOF.exe
  C:\Windows\System\yeICNOF.exe
  2⤵
  PID:9996
- C:\Windows\System\cMXmlYD.exe
  C:\Windows\System\cMXmlYD.exe
  2⤵
  PID:10456
- C:\Windows\System\oVaGqCh.exe
  C:\Windows\System\oVaGqCh.exe
  2⤵
  PID:10648
- C:\Windows\System\FEnqQSy.exe
  C:\Windows\System\FEnqQSy.exe
  2⤵
  PID:10716
- C:\Windows\System\UKMdKng.exe
  C:\Windows\System\UKMdKng.exe
  2⤵
  PID:10960
- C:\Windows\System\asJScbw.exe
  C:\Windows\System\asJScbw.exe
  2⤵
  PID:11152
- C:\Windows\System\rklyORq.exe
  C:\Windows\System\rklyORq.exe
  2⤵
  PID:10280
- C:\Windows\System\AmUrFpz.exe
  C:\Windows\System\AmUrFpz.exe
  2⤵
  PID:10800
- C:\Windows\System\nyxOVQs.exe
  C:\Windows\System\nyxOVQs.exe
  2⤵
  PID:10936
- C:\Windows\System\kUZdrEl.exe
  C:\Windows\System\kUZdrEl.exe
  2⤵
  PID:10312
- C:\Windows\System\YctlAJl.exe
  C:\Windows\System\YctlAJl.exe
  2⤵
  PID:10912
- C:\Windows\System\aILBZfn.exe
  C:\Windows\System\aILBZfn.exe
  2⤵
  PID:11292
- C:\Windows\System\zpUEfqm.exe
  C:\Windows\System\zpUEfqm.exe
  2⤵
  PID:11324
- C:\Windows\System\UmHnPxf.exe
  C:\Windows\System\UmHnPxf.exe
  2⤵
  PID:11348
- C:\Windows\System\GGcFAUA.exe
  C:\Windows\System\GGcFAUA.exe
  2⤵
  PID:11376
- C:\Windows\System\lvXBhSM.exe
  C:\Windows\System\lvXBhSM.exe
  2⤵
  PID:11412
- C:\Windows\System\smgoEFH.exe
  C:\Windows\System\smgoEFH.exe
  2⤵
  PID:11432
- C:\Windows\System\KCZmalD.exe
  C:\Windows\System\KCZmalD.exe
  2⤵
  PID:11460
- C:\Windows\System\CpurNpv.exe
  C:\Windows\System\CpurNpv.exe
  2⤵
  PID:11484
- C:\Windows\System\kWppMdc.exe
  C:\Windows\System\kWppMdc.exe
  2⤵
  PID:11500
- C:\Windows\System\PqtGzhc.exe
  C:\Windows\System\PqtGzhc.exe
  2⤵
  PID:11532
- C:\Windows\System\WPazQUn.exe
  C:\Windows\System\WPazQUn.exe
  2⤵
  PID:11560
- C:\Windows\System\sSkRjGk.exe
  C:\Windows\System\sSkRjGk.exe
  2⤵
  PID:11588
- C:\Windows\System\kbadwXP.exe
  C:\Windows\System\kbadwXP.exe
  2⤵
  PID:11608
- C:\Windows\System\iNldncR.exe
  C:\Windows\System\iNldncR.exe
  2⤵
  PID:11648
- C:\Windows\System\RTsbWJH.exe
  C:\Windows\System\RTsbWJH.exe
  2⤵
  PID:11688
- C:\Windows\System\IDLfRRf.exe
  C:\Windows\System\IDLfRRf.exe
  2⤵
  PID:11704
- C:\Windows\System\DxnYAuV.exe
  C:\Windows\System\DxnYAuV.exe
  2⤵
  PID:11744
- C:\Windows\System\WlaCZFZ.exe
  C:\Windows\System\WlaCZFZ.exe
  2⤵
  PID:11760
- C:\Windows\System\BkXDMuP.exe
  C:\Windows\System\BkXDMuP.exe
  2⤵
  PID:11796
- C:\Windows\System\ucpJEgo.exe
  C:\Windows\System\ucpJEgo.exe
  2⤵
  PID:11828
- C:\Windows\System\ifTRRJZ.exe
  C:\Windows\System\ifTRRJZ.exe
  2⤵
  PID:11856
- C:\Windows\System\AZZPPai.exe
  C:\Windows\System\AZZPPai.exe
  2⤵
  PID:11884
- C:\Windows\System\CuRFmFR.exe
  C:\Windows\System\CuRFmFR.exe
  2⤵
  PID:11920
- C:\Windows\System\RzAjxqT.exe
  C:\Windows\System\RzAjxqT.exe
  2⤵
  PID:11940
- C:\Windows\System\JougtIi.exe
  C:\Windows\System\JougtIi.exe
  2⤵
  PID:11972
- C:\Windows\System\PuqXejR.exe
  C:\Windows\System\PuqXejR.exe
  2⤵
  PID:11996
- C:\Windows\System\gDSqyqq.exe
  C:\Windows\System\gDSqyqq.exe
  2⤵
  PID:12012
- C:\Windows\System\hODuByV.exe
  C:\Windows\System\hODuByV.exe
  2⤵
  PID:12040
- C:\Windows\System\fKxOeys.exe
  C:\Windows\System\fKxOeys.exe
  2⤵
  PID:12080
- C:\Windows\System\oEyvmWD.exe
  C:\Windows\System\oEyvmWD.exe
  2⤵
  PID:12108
- C:\Windows\System\vRKGxHT.exe
  C:\Windows\System\vRKGxHT.exe
  2⤵
  PID:12136
- C:\Windows\System\KwbCrIa.exe
  C:\Windows\System\KwbCrIa.exe
  2⤵
  PID:12152
- C:\Windows\System\mrNfuXr.exe
  C:\Windows\System\mrNfuXr.exe
  2⤵
  PID:12188
- C:\Windows\System\qLKUhpJ.exe
  C:\Windows\System\qLKUhpJ.exe
  2⤵
  PID:12220
- C:\Windows\System\MghclNy.exe
  C:\Windows\System\MghclNy.exe
  2⤵
  PID:12248
- C:\Windows\System\yRPKKJp.exe
  C:\Windows\System\yRPKKJp.exe
  2⤵
  PID:12284
- C:\Windows\System\wTWqAga.exe
  C:\Windows\System\wTWqAga.exe
  2⤵
  PID:11276
- C:\Windows\System\QJyKkNM.exe
  C:\Windows\System\QJyKkNM.exe
  2⤵
  PID:11284
- C:\Windows\System\SYAWNxs.exe
  C:\Windows\System\SYAWNxs.exe
  2⤵
  PID:11360
- C:\Windows\System\bcLolQG.exe
  C:\Windows\System\bcLolQG.exe
  2⤵
  PID:11420
- C:\Windows\System\FHQmqLr.exe
  C:\Windows\System\FHQmqLr.exe
  2⤵
  PID:11496
- C:\Windows\System\BlwtLMs.exe
  C:\Windows\System\BlwtLMs.exe
  2⤵
  PID:11568
- C:\Windows\System\BwRJPtq.exe
  C:\Windows\System\BwRJPtq.exe
  2⤵
  PID:11672
- C:\Windows\System\ddsfhjv.exe
  C:\Windows\System\ddsfhjv.exe
  2⤵
  PID:11756
- C:\Windows\System\ILOaPOV.exe
  C:\Windows\System\ILOaPOV.exe
  2⤵
  PID:11784
- C:\Windows\System\FJfxOYo.exe
  C:\Windows\System\FJfxOYo.exe
  2⤵
  PID:11824
- C:\Windows\System\dSiXyNI.exe
  C:\Windows\System\dSiXyNI.exe
  2⤵
  PID:11928
- C:\Windows\System\PgPdlpN.exe
  C:\Windows\System\PgPdlpN.exe
  2⤵
  PID:11992
- C:\Windows\System\XmkslbO.exe
  C:\Windows\System\XmkslbO.exe
  2⤵
  PID:12024
- C:\Windows\System\DergBXB.exe
  C:\Windows\System\DergBXB.exe
  2⤵
  PID:12088
- C:\Windows\System\HMlcpIg.exe
  C:\Windows\System\HMlcpIg.exe
  2⤵
  PID:12172
- C:\Windows\System\aDUWusX.exe
  C:\Windows\System\aDUWusX.exe
  2⤵
  PID:12232
- C:\Windows\System\LASiiLd.exe
  C:\Windows\System\LASiiLd.exe
  2⤵
  PID:11088
- C:\Windows\System\mNpSBdU.exe
  C:\Windows\System\mNpSBdU.exe
  2⤵
  PID:11364
- C:\Windows\System\zfjVHHo.exe
  C:\Windows\System\zfjVHHo.exe
  2⤵
  PID:11604
- C:\Windows\System\bCyyWsa.exe
  C:\Windows\System\bCyyWsa.exe
  2⤵
  PID:11724
- C:\Windows\System\MYDBtfM.exe
  C:\Windows\System\MYDBtfM.exe
  2⤵
  PID:11896
- C:\Windows\System\iATEnwd.exe
  C:\Windows\System\iATEnwd.exe
  2⤵
  PID:11968
- C:\Windows\System\nwLoNrJ.exe
  C:\Windows\System\nwLoNrJ.exe
  2⤵
  PID:12148
- C:\Windows\System\PAYQxpL.exe
  C:\Windows\System\PAYQxpL.exe
  2⤵
  PID:11332
- C:\Windows\System\qWeWYUM.exe
  C:\Windows\System\qWeWYUM.exe
  2⤵
  PID:11556
- C:\Windows\System\GsPgZRW.exe
  C:\Windows\System\GsPgZRW.exe
  2⤵
  PID:12100
- C:\Windows\System\PsLflju.exe
  C:\Windows\System\PsLflju.exe
  2⤵
  PID:11512
- C:\Windows\System\RHggjXn.exe
  C:\Windows\System\RHggjXn.exe
  2⤵
  PID:12296
- C:\Windows\System\uWhGAFj.exe
  C:\Windows\System\uWhGAFj.exe
  2⤵
  PID:12316
- C:\Windows\System\lkHAzDh.exe
  C:\Windows\System\lkHAzDh.exe
  2⤵
  PID:12336
- C:\Windows\System\EkjcbeQ.exe
  C:\Windows\System\EkjcbeQ.exe
  2⤵
  PID:12360
- C:\Windows\System\VPRDXMB.exe
  C:\Windows\System\VPRDXMB.exe
  2⤵
  PID:12384
- C:\Windows\System\EfiQCst.exe
  C:\Windows\System\EfiQCst.exe
  2⤵
  PID:12416
- C:\Windows\System\xKFwNpD.exe
  C:\Windows\System\xKFwNpD.exe
  2⤵
  PID:12448
- C:\Windows\System\CCitNQt.exe
  C:\Windows\System\CCitNQt.exe
  2⤵
  PID:12484
- C:\Windows\System\csahtMQ.exe
  C:\Windows\System\csahtMQ.exe
  2⤵
  PID:12512
- C:\Windows\System\mGDyecu.exe
  C:\Windows\System\mGDyecu.exe
  2⤵
  PID:12544
- C:\Windows\System\xbneRgV.exe
  C:\Windows\System\xbneRgV.exe
  2⤵
  PID:12568
- C:\Windows\System\SpbpdtT.exe
  C:\Windows\System\SpbpdtT.exe
  2⤵
  PID:12584
- C:\Windows\System\reitKAo.exe
  C:\Windows\System\reitKAo.exe
  2⤵
  PID:12600
- C:\Windows\System\TTtWRdN.exe
  C:\Windows\System\TTtWRdN.exe
  2⤵
  PID:12620
- C:\Windows\System\TEYPlGJ.exe
  C:\Windows\System\TEYPlGJ.exe
  2⤵
  PID:12644
- C:\Windows\System\wIdQsbr.exe
  C:\Windows\System\wIdQsbr.exe
  2⤵
  PID:12668
- C:\Windows\System\VjoCIQF.exe
  C:\Windows\System\VjoCIQF.exe
  2⤵
  PID:12696
- C:\Windows\System\lNiYcsl.exe
  C:\Windows\System\lNiYcsl.exe
  2⤵
  PID:12732
- C:\Windows\System\KLZYsAI.exe
  C:\Windows\System\KLZYsAI.exe
  2⤵
  PID:12768
- C:\Windows\System\LTVHfnW.exe
  C:\Windows\System\LTVHfnW.exe
  2⤵
  PID:12784
- C:\Windows\System\PsjPWRz.exe
  C:\Windows\System\PsjPWRz.exe
  2⤵
  PID:12816
- C:\Windows\System\ErYrouE.exe
  C:\Windows\System\ErYrouE.exe
  2⤵
  PID:12852
- C:\Windows\System\AJwMQPJ.exe
  C:\Windows\System\AJwMQPJ.exe
  2⤵
  PID:12892
- C:\Windows\System\ZKTFdSZ.exe
  C:\Windows\System\ZKTFdSZ.exe
  2⤵
  PID:12912
- C:\Windows\System\SMAYgAO.exe
  C:\Windows\System\SMAYgAO.exe
  2⤵
  PID:12948
- C:\Windows\System\dPBOtzB.exe
  C:\Windows\System\dPBOtzB.exe
  2⤵
  PID:12976
- C:\Windows\System\QoCOHpo.exe
  C:\Windows\System\QoCOHpo.exe
  2⤵
  PID:13016
- C:\Windows\System\OwQSpdb.exe
  C:\Windows\System\OwQSpdb.exe
  2⤵
  PID:13048
- C:\Windows\System\cHAdKgB.exe
  C:\Windows\System\cHAdKgB.exe
  2⤵
  PID:13080
- C:\Windows\System\RASaXwx.exe
  C:\Windows\System\RASaXwx.exe
  2⤵
  PID:13108
- C:\Windows\System\OQQkhLS.exe
  C:\Windows\System\OQQkhLS.exe
  2⤵
  PID:13128
- C:\Windows\System\IIwQWup.exe
  C:\Windows\System\IIwQWup.exe
  2⤵
  PID:13152
- C:\Windows\System\pABzIth.exe
  C:\Windows\System\pABzIth.exe
  2⤵
  PID:13180
- C:\Windows\System\aaxxGXa.exe
  C:\Windows\System\aaxxGXa.exe
  2⤵
  PID:13216
- C:\Windows\System\xjzGXdB.exe
  C:\Windows\System\xjzGXdB.exe
  2⤵
  PID:13244
- C:\Windows\System\TKrpAoF.exe
  C:\Windows\System\TKrpAoF.exe
  2⤵
  PID:13272
- C:\Windows\System\LZIvIdj.exe
  C:\Windows\System\LZIvIdj.exe
  2⤵
  PID:13292
- C:\Windows\System\FSGthaN.exe
  C:\Windows\System\FSGthaN.exe
  2⤵
  PID:11988
- C:\Windows\System\NthzmVH.exe
  C:\Windows\System\NthzmVH.exe
  2⤵
  PID:12376
- C:\Windows\System\upTSNeh.exe
  C:\Windows\System\upTSNeh.exe
  2⤵
  PID:12444
- C:\Windows\System\FnbqBEm.exe
  C:\Windows\System\FnbqBEm.exe
  2⤵
  PID:12508
- C:\Windows\System\xWSrvya.exe
  C:\Windows\System\xWSrvya.exe
  2⤵
  PID:12556
- C:\Windows\System\WdjVpzj.exe
  C:\Windows\System\WdjVpzj.exe
  2⤵
  PID:12596
- C:\Windows\System\STWsapC.exe
  C:\Windows\System\STWsapC.exe
  2⤵
  PID:12680
- C:\Windows\System\HFsXVGa.exe
  C:\Windows\System\HFsXVGa.exe
  2⤵
  PID:12724
- C:\Windows\System\MhwoyGz.exe
  C:\Windows\System\MhwoyGz.exe
  2⤵
  PID:12796
- C:\Windows\System\UbjjjqF.exe
  C:\Windows\System\UbjjjqF.exe
  2⤵
  PID:12872
- C:\Windows\System\BJbTjHR.exe
  C:\Windows\System\BJbTjHR.exe
  2⤵
  PID:12900
- C:\Windows\System\xGTDBeL.exe
  C:\Windows\System\xGTDBeL.exe
  2⤵
  PID:13028
- C:\Windows\System\UzxqeKK.exe
  C:\Windows\System\UzxqeKK.exe
  2⤵
  PID:13072
- C:\Windows\System\XeNYyYK.exe
  C:\Windows\System\XeNYyYK.exe
  2⤵
  PID:13088
- C:\Windows\System\QywAThR.exe
  C:\Windows\System\QywAThR.exe
  2⤵
  PID:13148
- C:\Windows\System\VKGknZz.exe
  C:\Windows\System\VKGknZz.exe
  2⤵
  PID:13200
- C:\Windows\System\XwwBKRS.exe
  C:\Windows\System\XwwBKRS.exe
  2⤵
  PID:13256
- C:\Windows\System\iNXhfkB.exe
  C:\Windows\System\iNXhfkB.exe
  2⤵
  PID:12372
- C:\Windows\System\ejxaKeA.exe
  C:\Windows\System\ejxaKeA.exe
  2⤵
  PID:12396
- C:\Windows\System\HdgTNWo.exe
  C:\Windows\System\HdgTNWo.exe
  2⤵
  PID:12560
- C:\Windows\System\eBOGQeR.exe
  C:\Windows\System\eBOGQeR.exe
  2⤵
  PID:12632
- C:\Windows\System\dhIjXzn.exe
  C:\Windows\System\dhIjXzn.exe
  2⤵
  PID:12936
- C:\Windows\System\ufQJudu.exe
  C:\Windows\System\ufQJudu.exe
  2⤵
  PID:12924
- C:\Windows\System\uikkfNf.exe
  C:\Windows\System\uikkfNf.exe
  2⤵
  PID:13176
- C:\Windows\System\pNaMvMe.exe
  C:\Windows\System\pNaMvMe.exe
  2⤵
  PID:13308
- C:\Windows\System\WuyEKVj.exe
  C:\Windows\System\WuyEKVj.exe
  2⤵
  PID:12592
- C:\Windows\System\NJysghF.exe
  C:\Windows\System\NJysghF.exe
  2⤵
  PID:12708
- C:\Windows\System\dkJwCDv.exe
  C:\Windows\System\dkJwCDv.exe
  2⤵
  PID:12472
- C:\Windows\System\auBmhbd.exe
  C:\Windows\System\auBmhbd.exe
  2⤵
  PID:13316
- C:\Windows\System\MJkVkhs.exe
  C:\Windows\System\MJkVkhs.exe
  2⤵
  PID:13344
- C:\Windows\System\VOxJumR.exe
  C:\Windows\System\VOxJumR.exe
  2⤵
  PID:13388
- C:\Windows\System\EaiXpTI.exe
  C:\Windows\System\EaiXpTI.exe
  2⤵
  PID:13416
- C:\Windows\System\MCoQODO.exe
  C:\Windows\System\MCoQODO.exe
  2⤵
  PID:13444
- C:\Windows\System\qfvyQTF.exe
  C:\Windows\System\qfvyQTF.exe
  2⤵
  PID:13480
- C:\Windows\System\KEjhmCJ.exe
  C:\Windows\System\KEjhmCJ.exe
  2⤵
  PID:13504
- C:\Windows\System\lbErpIK.exe
  C:\Windows\System\lbErpIK.exe
  2⤵
  PID:13528
- C:\Windows\System\JTWuSae.exe
  C:\Windows\System\JTWuSae.exe
  2⤵
  PID:13560
- C:\Windows\System\RvIueAD.exe
  C:\Windows\System\RvIueAD.exe
  2⤵
  PID:13580
- C:\Windows\System\dqWLajn.exe
  C:\Windows\System\dqWLajn.exe
  2⤵
  PID:13604
- C:\Windows\System\xXoWvVK.exe
  C:\Windows\System\xXoWvVK.exe
  2⤵
  PID:13620
- C:\Windows\System\XmSuBTg.exe
  C:\Windows\System\XmSuBTg.exe
  2⤵
  PID:13648
- C:\Windows\System\MJkUYPP.exe
  C:\Windows\System\MJkUYPP.exe
  2⤵
  PID:13684
- C:\Windows\System\aFjokAa.exe
  C:\Windows\System\aFjokAa.exe
  2⤵
  PID:13728
- C:\Windows\System\gKcmSnI.exe
  C:\Windows\System\gKcmSnI.exe
  2⤵
  PID:13756
- C:\Windows\System\qmljLdk.exe
  C:\Windows\System\qmljLdk.exe
  2⤵
  PID:13780
- C:\Windows\System\qZjLiwB.exe
  C:\Windows\System\qZjLiwB.exe
  2⤵
  PID:13800
- C:\Windows\System\ClJzVqJ.exe
  C:\Windows\System\ClJzVqJ.exe
  2⤵
  PID:13832
- C:\Windows\System\IBdUaVk.exe
  C:\Windows\System\IBdUaVk.exe
  2⤵
  PID:13872
- C:\Windows\System\CDDWIJX.exe
  C:\Windows\System\CDDWIJX.exe
  2⤵
  PID:13900
- C:\Windows\System\QBkgeHi.exe
  C:\Windows\System\QBkgeHi.exe
  2⤵
  PID:13936
- C:\Windows\System\wnLPBGY.exe
  C:\Windows\System\wnLPBGY.exe
  2⤵
  PID:13964
- C:\Windows\System\JvERrvD.exe
  C:\Windows\System\JvERrvD.exe
  2⤵
  PID:13988
- C:\Windows\System\WiJPXeP.exe
  C:\Windows\System\WiJPXeP.exe
  2⤵
  PID:14012
- C:\Windows\System\uxhhLtY.exe
  C:\Windows\System\uxhhLtY.exe
  2⤵
  PID:14044
- C:\Windows\System\CVsSwGZ.exe
  C:\Windows\System\CVsSwGZ.exe
  2⤵
  PID:14068
- C:\Windows\System\nOveIUc.exe
  C:\Windows\System\nOveIUc.exe
  2⤵
  PID:14092
- C:\Windows\System\ZJWnoDn.exe
  C:\Windows\System\ZJWnoDn.exe
  2⤵
  PID:14124
- C:\Windows\System\yNPDBPM.exe
  C:\Windows\System\yNPDBPM.exe
  2⤵
  PID:14168
- C:\Windows\System\YEjcggG.exe
  C:\Windows\System\YEjcggG.exe
  2⤵
  PID:14192
- C:\Windows\System\RfpRcqc.exe
  C:\Windows\System\RfpRcqc.exe
  2⤵
  PID:14216
- C:\Windows\System\emLJMmw.exe
  C:\Windows\System\emLJMmw.exe
  2⤵
  PID:14240
- C:\Windows\System\lGchaew.exe
  C:\Windows\System\lGchaew.exe
  2⤵
  PID:14280
- C:\Windows\System\DDWOzLB.exe
  C:\Windows\System\DDWOzLB.exe
  2⤵
  PID:14304
- C:\Windows\System\YbaiVsM.exe
  C:\Windows\System\YbaiVsM.exe
  2⤵
  PID:13096
- C:\Windows\System\ZNtYhWs.exe
  C:\Windows\System\ZNtYhWs.exe
  2⤵
  PID:13400
- C:\Windows\System\hrhGyJd.exe
  C:\Windows\System\hrhGyJd.exe
  2⤵
  PID:13428
- C:\Windows\System\hXKjrdJ.exe
  C:\Windows\System\hXKjrdJ.exe
  2⤵
  PID:13436
- C:\Windows\System\QprsNMW.exe
  C:\Windows\System\QprsNMW.exe
  2⤵
  PID:13572
- C:\Windows\System\FNWpZvX.exe
  C:\Windows\System\FNWpZvX.exe
  2⤵
  PID:13668
- C:\Windows\System\lteSSvH.exe
  C:\Windows\System\lteSSvH.exe
  2⤵
  PID:13716
- C:\Windows\System\qGtIRJb.exe
  C:\Windows\System\qGtIRJb.exe
  2⤵
  PID:13852
- C:\Windows\System\BTgOntk.exe
  C:\Windows\System\BTgOntk.exe
  2⤵
  PID:13792
- C:\Windows\System\dpZHYLy.exe
  C:\Windows\System\dpZHYLy.exe
  2⤵
  PID:13928
- C:\Windows\System\rqTOtqk.exe
  C:\Windows\System\rqTOtqk.exe
  2⤵
  PID:13960
- C:\Windows\System\NpZWBsq.exe
  C:\Windows\System\NpZWBsq.exe
  2⤵
  PID:14024
- C:\Windows\System\Nrfousm.exe
  C:\Windows\System\Nrfousm.exe
  2⤵
  PID:14116
- C:\Windows\System\dIqhWJU.exe
  C:\Windows\System\dIqhWJU.exe
  2⤵
  PID:14104
- C:\Windows\System\EEKxGrX.exe
  C:\Windows\System\EEKxGrX.exe
  2⤵
  PID:14204
- C:\Windows\System\qweYhAj.exe
  C:\Windows\System\qweYhAj.exe
  2⤵
  PID:14272
- C:\Windows\System\QVMjupB.exe
  C:\Windows\System\QVMjupB.exe
  2⤵
  PID:13380
- C:\Windows\System\NvRvZsT.exe
  C:\Windows\System\NvRvZsT.exe
  2⤵
  PID:13496
- C:\Windows\System\xiBGSye.exe
  C:\Windows\System\xiBGSye.exe
  2⤵
  PID:13616
- C:\Windows\System\ARyVPne.exe
  C:\Windows\System\ARyVPne.exe
  2⤵
  PID:13696
- C:\Windows\System\wYxQHyj.exe
  C:\Windows\System\wYxQHyj.exe
  2⤵
  PID:13828
- C:\Windows\System\cXPRhgo.exe
  C:\Windows\System\cXPRhgo.exe
  2⤵
  PID:14004
- C:\Windows\System\mGYXDjR.exe
  C:\Windows\System\mGYXDjR.exe
  2⤵
  PID:14152
- C:\Windows\System\fOgPzkE.exe
  C:\Windows\System\fOgPzkE.exe
  2⤵
  PID:14268
- C:\Windows\System\VpUCuTl.exe
  C:\Windows\System\VpUCuTl.exe
  2⤵
  PID:13412
- C:\Windows\System\BUVnpys.exe
  C:\Windows\System\BUVnpys.exe
  2⤵
  PID:13956
- C:\Windows\System\ghJaBtm.exe
  C:\Windows\System\ghJaBtm.exe
  2⤵
  PID:14252
- C:\Windows\System\sAZElnr.exe
  C:\Windows\System\sAZElnr.exe
  2⤵
  PID:14352
- C:\Windows\System\GBdsIDm.exe
  C:\Windows\System\GBdsIDm.exe
  2⤵
  PID:14384
- C:\Windows\System\WnYfgXe.exe
  C:\Windows\System\WnYfgXe.exe
  2⤵
  PID:14404
- C:\Windows\System\FmYtQYk.exe
  C:\Windows\System\FmYtQYk.exe
  2⤵
  PID:14432
- C:\Windows\System\omGGxWv.exe
  C:\Windows\System\omGGxWv.exe
  2⤵
  PID:14468
- C:\Windows\System\nSwycCC.exe
  C:\Windows\System\nSwycCC.exe
  2⤵
  PID:14500
- C:\Windows\System\uQgPenD.exe
  C:\Windows\System\uQgPenD.exe
  2⤵
  PID:14536
- C:\Windows\System\aClDFlO.exe
  C:\Windows\System\aClDFlO.exe
  2⤵
  PID:14560
- C:\Windows\System\VPVUovI.exe
  C:\Windows\System\VPVUovI.exe
  2⤵
  PID:14588
- C:\Windows\System\nxEpApJ.exe
  C:\Windows\System\nxEpApJ.exe
  2⤵
  PID:14604
- C:\Windows\System\HthEbYx.exe
  C:\Windows\System\HthEbYx.exe
  2⤵
  PID:14632
- C:\Windows\System\myknXRV.exe
  C:\Windows\System\myknXRV.exe
  2⤵
  PID:14656
- C:\Windows\System\ZiYhqGN.exe
  C:\Windows\System\ZiYhqGN.exe
  2⤵
  PID:14672
- C:\Windows\System\DBeGhRP.exe
  C:\Windows\System\DBeGhRP.exe
  2⤵
  PID:14700
- C:\Windows\System\hlGTqzj.exe
  C:\Windows\System\hlGTqzj.exe
  2⤵
  PID:14728
- C:\Windows\System\dzALdrM.exe
  C:\Windows\System\dzALdrM.exe
  2⤵
  PID:14772
- C:\Windows\System\osNFGZY.exe
  C:\Windows\System\osNFGZY.exe
  2⤵
  PID:14808
- C:\Windows\System\AczGoAD.exe
  C:\Windows\System\AczGoAD.exe
  2⤵
  PID:14832
- C:\Windows\System\XJBkfCO.exe
  C:\Windows\System\XJBkfCO.exe
  2⤵
  PID:14852
- C:\Windows\System\txzxgim.exe
  C:\Windows\System\txzxgim.exe
  2⤵
  PID:14880
- C:\Windows\System\vrTHbhp.exe
  C:\Windows\System\vrTHbhp.exe
  2⤵
  PID:14912
- C:\Windows\System\UTICvkv.exe
  C:\Windows\System\UTICvkv.exe
  2⤵
  PID:14944
- C:\Windows\System\zeZkLwL.exe
  C:\Windows\System\zeZkLwL.exe
  2⤵
  PID:14968
- C:\Windows\System\zTZOyPh.exe
  C:\Windows\System\zTZOyPh.exe
  2⤵
  PID:14996
- C:\Windows\System\WxbgHJO.exe
  C:\Windows\System\WxbgHJO.exe
  2⤵
  PID:15032
- C:\Windows\System\JhyqpXs.exe
  C:\Windows\System\JhyqpXs.exe
  2⤵
  PID:15060
- C:\Windows\System\WjWxrUw.exe
  C:\Windows\System\WjWxrUw.exe
  2⤵
  PID:15092
- C:\Windows\System\adaYjdl.exe
  C:\Windows\System\adaYjdl.exe
  2⤵
  PID:15128
- C:\Windows\System\MpXOffE.exe
  C:\Windows\System\MpXOffE.exe
  2⤵
  PID:15144
- C:\Windows\System\ydtBYUe.exe
  C:\Windows\System\ydtBYUe.exe
  2⤵
  PID:15176
- C:\Windows\System\qFJgUrq.exe
  C:\Windows\System\qFJgUrq.exe
  2⤵
  PID:15200
- C:\Windows\System\jLqtuGx.exe
  C:\Windows\System\jLqtuGx.exe
  2⤵
  PID:15228
- C:\Windows\System\kBfnwRB.exe
  C:\Windows\System\kBfnwRB.exe
  2⤵
  PID:15260
- C:\Windows\System\TVxPtOR.exe
  C:\Windows\System\TVxPtOR.exe
  2⤵
  PID:15284
- C:\Windows\System\OMhLIYw.exe
  C:\Windows\System\OMhLIYw.exe
  2⤵
  PID:15300
- C:\Windows\System\WwbzDfh.exe
  C:\Windows\System\WwbzDfh.exe
  2⤵
  PID:15324
- C:\Windows\System\sjZjWQd.exe
  C:\Windows\System\sjZjWQd.exe
  2⤵
  PID:14180
- C:\Windows\System\MtUvimT.exe
  C:\Windows\System\MtUvimT.exe
  2⤵
  PID:14376
- C:\Windows\System\iGzIFvc.exe
  C:\Windows\System\iGzIFvc.exe
  2⤵
  PID:14428
- C:\Windows\System\pqCcbIZ.exe
  C:\Windows\System\pqCcbIZ.exe
  2⤵
  PID:14444
- C:\Windows\System\ozPXekf.exe
  C:\Windows\System\ozPXekf.exe
  2⤵
  PID:14528
- C:\Windows\System\RSkqMpn.exe
  C:\Windows\System\RSkqMpn.exe
  2⤵
  PID:14568
- C:\Windows\System\BCxixkM.exe
  C:\Windows\System\BCxixkM.exe
  2⤵
  PID:14664
- C:\Windows\System\tofWyNQ.exe
  C:\Windows\System\tofWyNQ.exe
  2⤵
  PID:14712
- C:\Windows\System\DrCMXjp.exe
  C:\Windows\System\DrCMXjp.exe
  2⤵
  PID:14828
- C:\Windows\System\GWZWiGI.exe
  C:\Windows\System\GWZWiGI.exe
  2⤵
  PID:14868
- C:\Windows\System\cBYOqqG.exe
  C:\Windows\System\cBYOqqG.exe
  2⤵
  PID:14940
- C:\Windows\System\lrnYpqD.exe
  C:\Windows\System\lrnYpqD.exe
  2⤵
  PID:15052
- C:\Windows\System\lGHHdgw.exe
  C:\Windows\System\lGHHdgw.exe
  2⤵
  PID:15120
- C:\Windows\System\yygymTO.exe
  C:\Windows\System\yygymTO.exe
  2⤵
  PID:15164
- C:\Windows\System\OjtzrrB.exe
  C:\Windows\System\OjtzrrB.exe
  2⤵
  PID:15216
- C:\Windows\System\PqulaHk.exe
  C:\Windows\System\PqulaHk.exe
  2⤵
  PID:15252
- C:\Windows\System\KJqICEB.exe
  C:\Windows\System\KJqICEB.exe
  2⤵
  PID:15352
- C:\Windows\System\qOHZyMK.exe
  C:\Windows\System\qOHZyMK.exe
  2⤵
  PID:15296
- C:\Windows\System\gqACAAJ.exe
  C:\Windows\System\gqACAAJ.exe
  2⤵
  PID:14460
- C:\Windows\System\UoQtPuE.exe
  C:\Windows\System\UoQtPuE.exe
  2⤵
  PID:14488
- C:\Windows\System\OglGmoT.exe
  C:\Windows\System\OglGmoT.exe
  2⤵
  PID:14748
- C:\Windows\System\vuQlhfC.exe
  C:\Windows\System\vuQlhfC.exe
  2⤵
  PID:14896
- C:\Windows\System\WKsCHaq.exe
  C:\Windows\System\WKsCHaq.exe
  2⤵
  PID:15084
- C:\Windows\System\htnayww.exe
  C:\Windows\System\htnayww.exe
  2⤵
  PID:15256
- C:\Windows\System\FPKlnbr.exe
  C:\Windows\System\FPKlnbr.exe
  2⤵
  PID:14652
- C:\Windows\System\fhZzaxe.exe
  C:\Windows\System\fhZzaxe.exe
  2⤵
  PID:15048
- C:\Windows\System\QFjCPIT.exe
  C:\Windows\System\QFjCPIT.exe
  2⤵
  PID:15196
- C:\Windows\System\zuIDZzM.exe
  C:\Windows\System\zuIDZzM.exe
  2⤵
  PID:15380
- C:\Windows\System\lHhRYrM.exe
  C:\Windows\System\lHhRYrM.exe
  2⤵
  PID:15412
- C:\Windows\System\wUkvaNT.exe
  C:\Windows\System\wUkvaNT.exe
  2⤵
  PID:15436
- C:\Windows\System\mltaQXl.exe
  C:\Windows\System\mltaQXl.exe
  2⤵
  PID:15456
- C:\Windows\System\EqGWIIF.exe
  C:\Windows\System\EqGWIIF.exe
  2⤵
  PID:15484
- C:\Windows\System\wCKobna.exe
  C:\Windows\System\wCKobna.exe
  2⤵
  PID:15508
- C:\Windows\System\FjKqcLD.exe
  C:\Windows\System\FjKqcLD.exe
  2⤵
  PID:15524
- C:\Windows\System\qxTLeVd.exe
  C:\Windows\System\qxTLeVd.exe
  2⤵
  PID:15548
- C:\Windows\System\uNkhLJG.exe
  C:\Windows\System\uNkhLJG.exe
  2⤵
  PID:15572
- C:\Windows\System\wLLZorW.exe
  C:\Windows\System\wLLZorW.exe
  2⤵
  PID:15596
- C:\Windows\System\mprTTDB.exe
  C:\Windows\System\mprTTDB.exe
  2⤵
  PID:15624
- C:\Windows\System\xVugVAP.exe
  C:\Windows\System\xVugVAP.exe
  2⤵
  PID:15656
- C:\Windows\System\tVSXMnk.exe
  C:\Windows\System\tVSXMnk.exe
  2⤵
  PID:15684
- C:\Windows\System\XxBraGT.exe
  C:\Windows\System\XxBraGT.exe
  2⤵
  PID:15700
- C:\Windows\System\ItBQlsP.exe
  C:\Windows\System\ItBQlsP.exe
  2⤵
  PID:15732
- C:\Windows\System\tawUyYL.exe
  C:\Windows\System\tawUyYL.exe
  2⤵
  PID:15756
- C:\Windows\System\hKRggCU.exe
  C:\Windows\System\hKRggCU.exe
  2⤵
  PID:15856
- C:\Windows\System\poEJJIs.exe
  C:\Windows\System\poEJJIs.exe
  2⤵
  PID:15872
- C:\Windows\System\umsCSSP.exe
  C:\Windows\System\umsCSSP.exe
  2⤵
  PID:15900
- C:\Windows\System\rkJjplO.exe
  C:\Windows\System\rkJjplO.exe
  2⤵
  PID:15916
- C:\Windows\System\FNyAeQQ.exe
  C:\Windows\System\FNyAeQQ.exe
  2⤵
  PID:15932
- C:\Windows\System\avBLQqy.exe
  C:\Windows\System\avBLQqy.exe
  2⤵
  PID:15960
- C:\Windows\System\wabnWXR.exe
  C:\Windows\System\wabnWXR.exe
  2⤵
  PID:16000
- C:\Windows\System\RgyvhJr.exe
  C:\Windows\System\RgyvhJr.exe
  2⤵
  PID:16040
- C:\Windows\System\KaWqEtT.exe
  C:\Windows\System\KaWqEtT.exe
  2⤵
  PID:16068
- C:\Windows\System\ckAGTTe.exe
  C:\Windows\System\ckAGTTe.exe
  2⤵
  PID:16084
- C:\Windows\System\jfvTfkt.exe
  C:\Windows\System\jfvTfkt.exe
  2⤵
  PID:16124
- C:\Windows\System\lJcFcxn.exe
  C:\Windows\System\lJcFcxn.exe
  2⤵
  PID:16144
- C:\Windows\System\fcyYSau.exe
  C:\Windows\System\fcyYSau.exe
  2⤵
  PID:16164
- C:\Windows\System\PsoiBhv.exe
  C:\Windows\System\PsoiBhv.exe
  2⤵
  PID:16184
- C:\Windows\System\YGxTFgi.exe
  C:\Windows\System\YGxTFgi.exe
  2⤵
  PID:16212
- C:\Windows\System\pkqZUAt.exe
  C:\Windows\System\pkqZUAt.exe
  2⤵
  PID:16252
- C:\Windows\System\nuWcJwA.exe
  C:\Windows\System\nuWcJwA.exe
  2⤵
  PID:16276
- C:\Windows\System\PnzPRlP.exe
  C:\Windows\System\PnzPRlP.exe
  2⤵
  PID:16300
- C:\Windows\System\iiWZsqK.exe
  C:\Windows\System\iiWZsqK.exe
  2⤵
  PID:16320
- C:\Windows\System\BWAktdD.exe
  C:\Windows\System\BWAktdD.exe
  2⤵
  PID:16348
- C:\Windows\System\OOciZme.exe
  C:\Windows\System\OOciZme.exe
  2⤵
  PID:16376
- C:\Windows\System\bOCVwai.exe
  C:\Windows\System\bOCVwai.exe
  2⤵
  PID:15044
- C:\Windows\System\ohPyKbl.exe
  C:\Windows\System\ohPyKbl.exe
  2⤵
  PID:14620
- C:\Windows\System\ITvjJBQ.exe
  C:\Windows\System\ITvjJBQ.exe
  2⤵
  PID:15400
- C:\Windows\System\FGfDGjY.exe
  C:\Windows\System\FGfDGjY.exe
  2⤵
  PID:15444
- C:\Windows\System\LfDpniU.exe
  C:\Windows\System\LfDpniU.exe
  2⤵
  PID:15560
- C:\Windows\System\TGFEbod.exe
  C:\Windows\System\TGFEbod.exe
  2⤵
  PID:15644
- C:\Windows\System\RYGtzMP.exe
  C:\Windows\System\RYGtzMP.exe
  2⤵
  PID:15692
- C:\Windows\System\nNHGfMB.exe
  C:\Windows\System\nNHGfMB.exe
  2⤵
  PID:15804
- C:\Windows\System\JUyRlRv.exe
  C:\Windows\System\JUyRlRv.exe
  2⤵
  PID:15868
- C:\Windows\System\kWzBDbH.exe
  C:\Windows\System\kWzBDbH.exe
  2⤵
  PID:15928
- C:\Windows\System\oQmRgxK.exe
  C:\Windows\System\oQmRgxK.exe
  2⤵
  PID:15984
- C:\Windows\System\PQQEnxY.exe
  C:\Windows\System\PQQEnxY.exe
  2⤵
  PID:16028
- C:\Windows\System\ZpPhfbq.exe
  C:\Windows\System\ZpPhfbq.exe
  2⤵
  PID:16080
- C:\Windows\System\VxZweIm.exe
  C:\Windows\System\VxZweIm.exe
  2⤵
  PID:16108
- C:\Windows\System\qznrZQE.exe
  C:\Windows\System\qznrZQE.exe
  2⤵
  PID:16160
- C:\Windows\System\Engapsa.exe
  C:\Windows\System\Engapsa.exe
  2⤵
  PID:16236
- C:\Windows\System\zVkdLZI.exe
  C:\Windows\System\zVkdLZI.exe
  2⤵
  PID:16368
- C:\Windows\System\QEDhQKh.exe
  C:\Windows\System\QEDhQKh.exe
  2⤵
  PID:14572
- C:\Windows\System\xPKYySg.exe
  C:\Windows\System\xPKYySg.exe
  2⤵
  PID:15612
- C:\Windows\System\LXTeZPq.exe
  C:\Windows\System\LXTeZPq.exe
  2⤵
  PID:15652
- C:\Windows\System\fHYyeru.exe
  C:\Windows\System\fHYyeru.exe
  2⤵
  PID:15912
- C:\Windows\System\QzyXTJu.exe
  C:\Windows\System\QzyXTJu.exe
  2⤵
  PID:3920
- C:\Windows\System\ESNKnuu.exe
  C:\Windows\System\ESNKnuu.exe
  2⤵
  PID:15752
- C:\Windows\System\dAklqOL.exe
  C:\Windows\System\dAklqOL.exe
  2⤵
  PID:15972
- C:\Windows\System\FACEPkP.exe
  C:\Windows\System\FACEPkP.exe
  2⤵
  PID:15368
- C:\Windows\System\BnfNhRu.exe
  C:\Windows\System\BnfNhRu.exe
  2⤵
  PID:16272
- C:\Windows\System\YGgFVYX.exe
  C:\Windows\System\YGgFVYX.exe
  2⤵
  PID:15476
- C:\Windows\System\IMJRfdR.exe
  C:\Windows\System\IMJRfdR.exe
  2⤵
  PID:15944
- C:\Windows\System\ystQcHX.exe
  C:\Windows\System\ystQcHX.exe
  2⤵
  PID:15680
- C:\Windows\System\xHZDokY.exe
  C:\Windows\System\xHZDokY.exe
  2⤵
  PID:16200
- C:\Windows\System\VIWUmqo.exe
  C:\Windows\System\VIWUmqo.exe
  2⤵
  PID:16400
- C:\Windows\System\UYDHTVC.exe
  C:\Windows\System\UYDHTVC.exe
  2⤵
  PID:16448
- C:\Windows\System\yUAlBdB.exe
  C:\Windows\System\yUAlBdB.exe
  2⤵
  PID:16476
- C:\Windows\System\qFhMHIO.exe
  C:\Windows\System\qFhMHIO.exe
  2⤵
  PID:16504
- C:\Windows\System\QtwSpHs.exe
  C:\Windows\System\QtwSpHs.exe
  2⤵
  PID:16528
- C:\Windows\System\OeMKrtI.exe
  C:\Windows\System\OeMKrtI.exe
  2⤵
  PID:16556
- C:\Windows\System\SYrAGnq.exe
  C:\Windows\System\SYrAGnq.exe
  2⤵
  PID:16572
- C:\Windows\System\ThlpyCp.exe
  C:\Windows\System\ThlpyCp.exe
  2⤵
  PID:16616
- C:\Windows\System\iJqeGjr.exe
  C:\Windows\System\iJqeGjr.exe
  2⤵
  PID:16644
- C:\Windows\System\uyXPgvU.exe
  C:\Windows\System\uyXPgvU.exe
  2⤵
  PID:16676
- C:\Windows\System\mEtxyEF.exe
  C:\Windows\System\mEtxyEF.exe
  2⤵
  PID:16700
- C:\Windows\System\BdVwLbN.exe
  C:\Windows\System\BdVwLbN.exe
  2⤵
  PID:16732
- C:\Windows\System\WCuBRuY.exe
  C:\Windows\System\WCuBRuY.exe
  2⤵
  PID:16756
- C:\Windows\System\RCGfIhq.exe
  C:\Windows\System\RCGfIhq.exe
  2⤵
  PID:16792
- C:\Windows\System\HNfrNjj.exe
  C:\Windows\System\HNfrNjj.exe
  2⤵
  PID:16812
- C:\Windows\System\WKUqAVD.exe
  C:\Windows\System\WKUqAVD.exe
  2⤵
  PID:16828
- C:\Windows\System\zgDgYIN.exe
  C:\Windows\System\zgDgYIN.exe
  2⤵
  PID:16848
- C:\Windows\System\mfMrLIq.exe
  C:\Windows\System\mfMrLIq.exe
  2⤵
  PID:16872
- C:\Windows\System\CzlcJzw.exe
  C:\Windows\System\CzlcJzw.exe
  2⤵
  PID:16916
- C:\Windows\System\AfgSvse.exe
  C:\Windows\System\AfgSvse.exe
  2⤵
  PID:16952
- C:\Windows\System\dJVSrbc.exe
  C:\Windows\System\dJVSrbc.exe
  2⤵
  PID:16976
- C:\Windows\System\khEAHfg.exe
  C:\Windows\System\khEAHfg.exe
  2⤵
  PID:17000
- C:\Windows\System\BJBSUUN.exe
  C:\Windows\System\BJBSUUN.exe
  2⤵
  PID:17028
- C:\Windows\System\zoOEtnT.exe
  C:\Windows\System\zoOEtnT.exe
  2⤵
  PID:17060
- C:\Windows\System\pnZEWVt.exe
  C:\Windows\System\pnZEWVt.exe
  2⤵
  PID:17080
- C:\Windows\System\SqhPFJk.exe
  C:\Windows\System\SqhPFJk.exe
  2⤵
  PID:17112
- C:\Windows\System\UyAeOJT.exe
  C:\Windows\System\UyAeOJT.exe
  2⤵
  PID:17144
- C:\Windows\System\eMJScyB.exe
  C:\Windows\System\eMJScyB.exe
  2⤵
  PID:17164
- C:\Windows\System\qCOObul.exe
  C:\Windows\System\qCOObul.exe
  2⤵
  PID:17188
- C:\Windows\System\jDvuWpS.exe
  C:\Windows\System\jDvuWpS.exe
  2⤵
  PID:17212
- C:\Windows\System\aOrlwtH.exe
  C:\Windows\System\aOrlwtH.exe
  2⤵
  PID:17244
- C:\Windows\System\TnnrQTj.exe
  C:\Windows\System\TnnrQTj.exe
  2⤵
  PID:17268
- C:\Windows\System\ouzKMdw.exe
  C:\Windows\System\ouzKMdw.exe
  2⤵
  PID:17292
- C:\Windows\System\vytguqr.exe
  C:\Windows\System\vytguqr.exe
  2⤵
  PID:17324
- C:\Windows\System\sFxeatb.exe
  C:\Windows\System\sFxeatb.exe
  2⤵
  PID:17356
- C:\Windows\System\UpSsbnq.exe
  C:\Windows\System\UpSsbnq.exe
  2⤵
  PID:17392
- C:\Windows\System\wDWXMQR.exe
  C:\Windows\System\wDWXMQR.exe
  2⤵
  PID:15852
- C:\Windows\System\VnxVfMt.exe
  C:\Windows\System\VnxVfMt.exe
  2⤵
  PID:16408
- C:\Windows\System\hpJRprU.exe
  C:\Windows\System\hpJRprU.exe
  2⤵
  PID:16484
- C:\Windows\System\TiwOeIX.exe
  C:\Windows\System\TiwOeIX.exe
  2⤵
  PID:16552
- C:\Windows\System\wXzGOTo.exe
  C:\Windows\System\wXzGOTo.exe
  2⤵
  PID:16632
- C:\Windows\System\THJPqkL.exe
  C:\Windows\System\THJPqkL.exe
  2⤵
  PID:16592
- C:\Windows\System\WMthalG.exe
  C:\Windows\System\WMthalG.exe
  2⤵
  PID:16656
- C:\Windows\System\cXJGdrN.exe
  C:\Windows\System\cXJGdrN.exe
  2⤵
  PID:2556
- C:\Windows\System\WiXcZFf.exe
  C:\Windows\System\WiXcZFf.exe
  2⤵
  PID:16768
- C:\Windows\System\VzimKXv.exe
  C:\Windows\System\VzimKXv.exe
  2⤵
  PID:16820
- C:\Windows\System\jYiGLtK.exe
  C:\Windows\System\jYiGLtK.exe
  2⤵
  PID:16844
- C:\Windows\System\GIQGhha.exe
  C:\Windows\System\GIQGhha.exe
  2⤵
  PID:16988
- C:\Windows\System\GsrRpMa.exe
  C:\Windows\System\GsrRpMa.exe
  2⤵
  PID:2760

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AuSEDRt.exe

Filesize
1.9MB

MD5
179fe3c0e8399f1a74f63412be6798e2

SHA1
d6890aff9f0f3a86b7a5966fc378bd68e274fe69

SHA256
d1d188e2f4491a3dc55b8fed6aa5f58c35ccbea28d937344b3b36fc452bd32f2

SHA512
4dea3e960e764c7bc2e1d539b5307059585cd99fd5d313fb3d70ab868de1d2d623587390b6f181bb0af4c292bd85d9ef5f82f7dc34e9346151eb7469f04b0d4b

Download Submit
C:\Windows\System\AwuypsI.exe

Filesize
1.9MB

MD5
8c2b13430fb087801999b9a5e6fadd4b

SHA1
e40728c72d665c0838470e1e51bc4aeb97f8b0c4

SHA256
3b64934bc2feea12e6919d5a6050337cfee05d5aa70ae771e0957c179d794d18

SHA512
aa7be35a1dce5a23d94d0cf20e97aff03e56a0086a20c0be239a5e08214391e922874f74a68f1887dc90ec499dff90c7491d44a34980fc47d39dd8cea2719ed5

Download Submit
C:\Windows\System\CFRTwyc.exe

Filesize
1.9MB

MD5
370d5aad6dee71ca01db0e04fcc07230

SHA1
15559f4d991882110ca17d30eeaf4f64ef7e8be6

SHA256
59b2b8dbf58125ed7b0fcc450f04cbf8d63bffd19bf9b371265de62e2bfe48fa

SHA512
3e135806fc6c37b84aa4e7a20516361842fa4bf36e5db4350b285130b4315d268bf0343e6500151de438b01988f5ed31c9397d4574782032cc5b8bf510d04ae3

Download Submit
C:\Windows\System\FfpdOkR.exe

Filesize
1.9MB

MD5
fb2c1b52cf55de78f1c42034a772e501

SHA1
f7d0410e7853df7acc1c6e69e99ec5c7c5fec6ed

SHA256
a9a67a3cba798b1eccc01d70fb2aa2512ba56cf64b7ababe447d734cd581f16b

SHA512
84765245f588ec9c08e637a44715c2dad14102bfaef14ce7a58cab0c639807aeadac3abd4bb8ec363736db635c651469cf5996b8f4d0827e25466f660352c1b2

Download Submit
C:\Windows\System\IwOXRGI.exe

Filesize
1.9MB

MD5
8c630d9b79f0ce1d71e5ee15f0d7da4e

SHA1
43178b630839ff31ede41196c363129b16d0efb5

SHA256
aafe73f27dcc1cb2a79617c5e9738d5df6846506f93a2d9346880b037d162cb8

SHA512
f389316ae0e74ceaaff439670a35bd5fe24e730e5e3244477254e1290af5eaa1527a2c2b9c8a1d33eabf9a62b487f026d53f0e4694bf22e1b58ac56356b38638

Download Submit
C:\Windows\System\KgqIQYx.exe

Filesize
1.9MB

MD5
04324d95f90c36e41afdbcaf1857948b

SHA1
9b4484ccfc4b2562662358fadeda58dd03dda447

SHA256
9850daa07ca68afdcf7d9d6d072771531cf0a4f1755c15689bd2abff2aedbb48

SHA512
21843bf0ca4589b2ebd7f9af21b2340b4a46f03951c8e7f1225d4f51541898b1c2cea88e6cb55dba28e67168c8754b30b9181d2fb52b9378d941d03bd74584ab

Download Submit
C:\Windows\System\KhvAjBm.exe

Filesize
1.9MB

MD5
2e932625663e3aa86625a1cd14477248

SHA1
c23c778a974d59a75e91dd4919b1485086bbf77f

SHA256
e3cecf7ae367a376936c209efd2c5f629bb837cd97bcd01590e1dab71a78f98b

SHA512
2e10008d0813ab6dfa74e020af07df91edce0745de66ccbeb3a4451cdc30a7e4bfb0cf137346913697268c87417c29a2b823a2d0a761bda10b244f535c367fb1

Download Submit
C:\Windows\System\NfkkdhV.exe

Filesize
1.9MB

MD5
6239f96d8b97ff8cae05e33ea557d485

SHA1
4374e63df4011e37776899e4b490cb550e90f69b

SHA256
2947a42046914ff4e4736dd83f895393e5c9aac571da7d1a51e6910f2384c20f

SHA512
c11e686a00505fd9301fa6e9999d9c00cd27e2c96b4249de806b99871942d26678a01f9ef6f2e541827543ee0ec576fe77b6cc8ecb1ce4ba22ef73bacf6963a5

Download Submit
C:\Windows\System\OGicUDz.exe

Filesize
1.9MB

MD5
f3d3cb75de299076f90805dc272c1eaf

SHA1
bb10f1d0b74cad6b3e053610547913f8ad53b1f9

SHA256
fbcea2bbfc96e0850d390e5adb74cf7785fa29b802a333602484b62d0f80b17f

SHA512
38d388602e2ccf0164df33186525684015a6ccaa22cf8504a46ee628b7c74d43f72f378e57ccf5e25bd80c67d1a1213097368eaeae76faad856c76b78134fea0

Download Submit
C:\Windows\System\OwPuJbM.exe

Filesize
1.9MB

MD5
afa017fb8da221da39a1eee7fcf142b8

SHA1
123fd7d1e07806f112e8c027d506d3583770f802

SHA256
554c246961b48b86ed6942ac560057f735c3e44a851eaf92b7bcfa3f7b21783a

SHA512
763883824cd994316e62ac7bff0779012016eec54dd10533694caa7ac55e3019f34ddfcf61cf0ac4a1157fd20b5117d030df22eba974e2b160fd376f559031cc

Download Submit
C:\Windows\System\RCxQvoT.exe

Filesize
1.9MB

MD5
268969b27c3d3b1bd83b4914fdf53b91

SHA1
c8c11891c765648e0302a989d722cacf96c12338

SHA256
9e384c8c26754fbb22b68bb72355295abfb1f38be65ee6f37f29ec5f02722b2d

SHA512
cc680e65ebe4516a47b7816b042b450249adb4deeb28a8df7bd7cf66c00762ecd6834301284f5b592eb4092b2d50062d1f00650859db09c756d5b1fa5d9fb213

Download Submit
C:\Windows\System\RKRypmE.exe

Filesize
1.9MB

MD5
2f5e0733195b7558b5dfe09f02b8441b

SHA1
3a721d2a955b56adcf4f405a739bbabd71f87d58

SHA256
6aebd1216c9d6905fa2e2ba2f4fc8a053fd70b4ac1bf6c0238124f5a764bcf19

SHA512
d84c8f0c2cac088049f329640775f44e6f0552acddd78bb160b6de8574dae0b095d238a3919007902b5f207541b8bf935e1b3a86e087e4856abcfcfaeb631374

Download Submit
C:\Windows\System\RlaSZMe.exe

Filesize
1.9MB

MD5
cbeb3f49d092ec949bd097b52a8e48f1

SHA1
3d2840eadeb5169b8a6697c5d3ae296612409ac1

SHA256
c9a63a77d9deb9255ac546c6c0d1feb4b430cebc40da0446306723c776c4ab3f

SHA512
cd706a08ddaabb4602450e2a64f26cb246a28be0f2377e53acd00dc956a5e1ab521974fea0cebacbda82680cefe3896e975b88a9c6a744c3ae0f46845ed07fc1

Download Submit
C:\Windows\System\SUMVBoC.exe

Filesize
1.9MB

MD5
93f5a88820288b4bbafe41559d633b8a

SHA1
337df4d7cec31a3df64ec9f0eced497860587a2f

SHA256
02f6435cc7864dc2c7d2915e1a8122be8c6be9e24cfbd220e35c78f6101b3950

SHA512
ca696b12979b425ed2b3579e10d11e1a7006ffe718bffee251e38b8cdc5a4cfc3de085baaf05a73d4177d233b7552080de0cb4f8e5fb50f3102b838ec708d5c5

Download Submit
C:\Windows\System\TuCIJQy.exe

Filesize
1.9MB

MD5
d398f574fb3b96533a357c8889259e49

SHA1
29c758d4abedde6515b44d27dcf6b3c641a10b1b

SHA256
89c64f50a45dab388267c1a320bdd04a2bf1717617527481f531dee5d3f21224

SHA512
6dd99f5f52b6c77411d9635388b4c4988bf7f1f759bd02dcb83667533552dd352a2b5738773dd7dd04c98e0003ef28850c7a2a36b0ae6eab8a209741d7ed81ff

Download Submit
C:\Windows\System\VfNmfrE.exe

Filesize
1.9MB

MD5
847f58eddd99b207c9044aa92c3e86e4

SHA1
2d32054774d1588a93ad1114ec581f8f9371142a

SHA256
eefcbe9d40da426b2dab9044c269cd66552534353bce82e6278672efbf952fa5

SHA512
379d550637fcf898ef881ded9350b0b5c08d66b4abf0fd142a4e826574cae26091a829534a0c388470abf25ae82aa6d6cd19b1f63f592f78cb52594cd9a63334

Download Submit
C:\Windows\System\XSRHppZ.exe

Filesize
1.9MB

MD5
d0faa34bda81371f967747fae6f73aba

SHA1
8caf90648a1a860d394e7bf70f2bad5aaa900c95

SHA256
11d29d933e24cd7b868a16fe6533e6519e94adcc753a319c586ed15ba183f623

SHA512
680807b4109589c585d91a9361835c6fd69e11e1e2e3ec8825a219a716a1c99fd38e9fd51f4aada271c9388043e694e9d1478d8b65d17ea93fbe6cc5c2812b35

Download Submit
C:\Windows\System\XnvPOyE.exe

Filesize
1.9MB

MD5
5ccf920645212c2aff5b29eee95e174a

SHA1
7b6031a292d567f6134a3d1c46bf40a46b9adeaa

SHA256
9b7b00fc719768894990ffd62c6a20a456419afa8f53f89d0173d6cfae23c9a0

SHA512
463b0296b9da3a26493f3417c30510104f184d3640c4079ac0e27765bf097c2e06773b82f709d59fbcfaf18635822a2529baae59d2c0d7fe97d09e2f367ff888

Download Submit
C:\Windows\System\ZzLhQSn.exe

Filesize
1.9MB

MD5
efffcac53c87eb77c7927f7e983ecaf4

SHA1
b474b1ec0aa7e3ff1d7b3657a42a66fde04d6ab9

SHA256
d01d6acc6abd394bd6351ab4eb19fd37b6821214d9a780d51e1ad1c64afa139d

SHA512
f932e511edb24999d4bf28dfd817f2ce1c5b66b3c593db1af72bd147d65fc7a01e2fb57e0c6b1835d46bfc9138c975b0fa6f2c2097fea36641dfd3670ac6c146

Download Submit
C:\Windows\System\cAFtaSh.exe

Filesize
1.9MB

MD5
1b444fe460bdeddfe27d91ca96629210

SHA1
9e6418d074c1f7dbe1414b372b818657dc6ab706

SHA256
211d317855726092af055ece6b6a6ee5bbcd51bab499eae807f39a017cec2cf7

SHA512
4d9fc6f77c4fcbf7e876b95c8abb9c2e579c9ad271bbbe58d8017fdf5bdaf973ba1df4f5c963851f3f65cc4fd79f64921e5c4aec918c8963ccbef8b4f93303d4

Download Submit
C:\Windows\System\cdiRpcF.exe

Filesize
1.9MB

MD5
627c43f2304027247258451f21e70bcc

SHA1
fd83b14b645ed42c6bd197e5deca25c8454fdefd

SHA256
d75ada3c2d0eb0b39d82c1f1d9815076eae7dabe2e9de71b626487b651f1b55d

SHA512
7f6f3a21c85a7e2b5cf5bb5c013ffa413344147dac23d1c76aa250b851b7b7b9b900e205fa19d425ecd0a5eb021313bc62ba496688cc2cf5e0764c9efa475c73

Download Submit
C:\Windows\System\dNejnzL.exe

Filesize
1.9MB

MD5
627604af86cea06b6c8a6f3852eb55cc

SHA1
f33d73cc94c4f85b769ccfd98c0100ab5b781238

SHA256
4023d12787af2aa65a209f7534416a0b2031547b720fa79bc16518af11e4964c

SHA512
afe7219089e3aa85e7e31388081bb1cfc04a7ff71918b296a1cf67e13611b1cbe1fbcbf0c4ca6ce33b933e5ed215d46b51a06666c485a62bdd87326234e8ce71

Download Submit
C:\Windows\System\eWOeKBG.exe

Filesize
1.9MB

MD5
820fe757e15b878c16e2c2aa48985220

SHA1
daff04db54239ecdc93ffa4a8f7cfb78792cbfd1

SHA256
cad84ca774598de4993f69a0ba91adb1aaf6b6247940b8d1ffd16aa11d5b38d4

SHA512
461dc267ab0d892461992303f032724412a38a3b88fc6b495dd865564f460b4882e09a91ccf092d546fc8139fa5d86e10169bbf1a5ecbe7e07694b8469d486b1

Download Submit
C:\Windows\System\hVgdqAP.exe

Filesize
1.9MB

MD5
62b0d594705d7378a08096f72bf69372

SHA1
608fec1b7cdf8f0c570d850858b70918aefea7d5

SHA256
f912b3a07e6a6bb9fdb8008fe234a4c563a8b5786b0fe1c1cf878143288a4449

SHA512
3a1111764e8987ca256464c1c95aa877d37ae85717ae2203a56a93b594c1d39785d2625de77e97a8df679a4cb93095a86e78c2a36c0923d223ebf300d1755769

Download Submit
C:\Windows\System\iNGGjpO.exe

Filesize
1.9MB

MD5
6c3c76350b01555c2320c19eb6e69503

SHA1
3828a1b03b8b6219700b30691a866698ed7856b8

SHA256
2fca39a9a902600fbb5cb0efce1bce207918baf3a1b710e476176f867990b592

SHA512
aae851f12515ecd7c826d97716108aa69987fd39f4beced1b517f7299f5762bf51bf86eed4b3e4d43c4d6e319f4277494b7b59a3e93e4bb09a0433d5ba4d935b

Download Submit
C:\Windows\System\icmijOl.exe

Filesize
1.9MB

MD5
c24179ab24ae87c39a72682b11bdc597

SHA1
3f7a9ef2edf42067f852e1e3080bb59134155a7e

SHA256
f074e373af03cc695f7b308d3044ed96032a418f8131597497f71840502ca03b

SHA512
85c7e5baf1c95c5228b2fcc79bb96294ef0b9c08405eba6de8f2b425dd7664446920bc088452e159e7879653836445b6761428bf938910e6b4d8855876326618

Download Submit
C:\Windows\System\kZFrYCK.exe

Filesize
1.9MB

MD5
f831a2dfa85e74035049d7d3348afafd

SHA1
e9ee9f5d0de503e97c7358cf1fa03880e1a1dbd1

SHA256
826a125cc09435dc2140004add289b299a9a6c3fcf2b580d4937a69b7ce9dad2

SHA512
848d54a4eb0662feb77ce693b70ae664d1c42579867e1091f0216df227f8009a61004f2d9ac654bfc3b7fe01087b3c7772a22f10e6b5fec65e5120345537b2aa

Download Submit
C:\Windows\System\ksXlhiC.exe

Filesize
1.9MB

MD5
ba7092e06975445b0b983514f3c89e3e

SHA1
f81ed349a1bbe08a6fed41591204dd9b4c3b101b

SHA256
3e1e6ffefe5479edfcb9e333efeedd30613e3c38c89f5a6eda79b4c73678ba7c

SHA512
04cfd6e63739f6ef24a537a69e0e0121d4e127c7eba8084239bdf8dc0ed035aa45d13a3366a6c441c0bbeca6faca965c066a02210da9c817687ec84d6b90b301

Download Submit
C:\Windows\System\pUduuzA.exe

Filesize
1.9MB

MD5
41a6039920ef326d9787297e5c617973

SHA1
df43dfdc20131bf8e70dc7409aa19739158e1ff6

SHA256
6d09bf72c8372be6bce48d8a062aaa0d9c9d4885b4edc4b23c2467f0f37c6fed

SHA512
23b47b23da3ae433adb9b28c93878b34ca86c06e79d3b02538e4fa73f75a198aad3d66be476d82209034850e565685c08611cc0302522ad958961cba2ef92a24

Download Submit
C:\Windows\System\rQXimqM.exe

Filesize
1.9MB

MD5
e870a0d8f6967bb77788578d8646392a

SHA1
30a301c99c670f300b74b42011670b022b954eaf

SHA256
55d6534b2b80f8406bca5d16b129ad21b8408d6ade28f8063694e832c17698da

SHA512
5037e9ae86b87d2be3615df6adb23c1b4855d106325e0f81ce52ccd5fc1ce70ef52810cf2ae4da1c40f41b6ef4e5fb74fbc79aafecb4d4d6a32a3e3b24322b31

Download Submit
C:\Windows\System\tCBiidS.exe

Filesize
1.9MB

MD5
36333fd1de0da44fa22cb0246a588296

SHA1
e8a5f5815cc4f07f59ff873e0473c7992edd1465

SHA256
cacd59ea48daa1e9b121e53ab065a5edb13f105405cc037108224d7523ced35a

SHA512
00e2eddd79684f9cdbcbfd8755afc9495d2456c780971a06ef5a71a002f83bbfddfc28718c235b095e19fee069aa54cb85378b39cd576bfa1926ad127b5c3146

Download Submit
C:\Windows\System\tIccoBL.exe

Filesize
1.9MB

MD5
14ff0d1d50a032504f2ddaab21335c49

SHA1
e1f66e90b13d5fc17bc74b083c7edeb9d8938e31

SHA256
fafdebcbef5c5e896c5ca3354d8bc75218b958bd8e2012d4ad26c9d62ed0adee

SHA512
86282a2a6e92cc906ef21983c44dcb2b9c3c906b558e6d056c3ba339bfe5bda9ac53fd0188e1da1c2936f666d952c05042ca822ed37828d7278c19d4240373d1

Download Submit
C:\Windows\System\wyUQUMM.exe

Filesize
1.9MB

MD5
297d464e51ad58941ddebb56821279a6

SHA1
5d819768aa20cae7034ded6c0c4d95878aeca4da

SHA256
f5a44d583e59fec5bbef907e8a613693c86f422684958b3b2a7d897123ff2d9e

SHA512
9694ac015a03d66ba0cf9d0c12240cb9e2ee0f2c23980a7acfcd90aa4e80ffa2706b430ab2d22fc576daba9e9f92619e2660989e61d247cc459f8df07b316d58

Download Submit
C:\Windows\System\yFbhrJG.exe

Filesize
1.9MB

MD5
259d2d6ce68bd581910141dadc8d1e27

SHA1
2152492ac6cc7d2b514041e90ed59863bd0a11d7

SHA256
b77a595a683ada25b7d7a031e24f6a217c158d03a781c3b9ae378b8a236007fb

SHA512
cdbe4f48aff74285e312e769315e65930dceadd57b3e7a492d7fa6ab4c6c43d3969ba7009ffd44b2eae4fe0106011227357400a80f0189344ea9e55116021d44

Download Submit
memory/3516-0-0x000001E20EC90000-0x000001E20ECA0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads