xmrig | 30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
Size

1.4MB
MD5

e0caff52f02a3ee100f47611cd250390
SHA1

a747d7f87376ef36adf5237eb11d8e22912b9dbe
SHA256

30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7
SHA512

beeaf4fe157c394bf52d9643667a881fdf4c80af4d32f71ce41f289adbddd3935d9fa51722f7819ed3e45a99b11f3dcf468f52eeb5c6910c4b47986088bc1501
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727vrNaT/6CFdDQC7FY5ANGrTQYkbb8RfSGggV/OJs:ROdWCCi7/rahW/zFdDEANWQYkberO6

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral2/memory/1268-76-0x00007FF6C2FF0000-0x00007FF6C3341000-memory.dmp	xmrig
behavioral2/memory/1972-99-0x00007FF7D4500000-0x00007FF7D4851000-memory.dmp	xmrig
behavioral2/memory/2628-77-0x00007FF6D3AA0000-0x00007FF6D3DF1000-memory.dmp	xmrig
behavioral2/memory/1696-71-0x00007FF671B30000-0x00007FF671E81000-memory.dmp	xmrig
behavioral2/memory/5028-569-0x00007FF631790000-0x00007FF631AE1000-memory.dmp	xmrig
behavioral2/memory/4940-568-0x00007FF6992B0000-0x00007FF699601000-memory.dmp	xmrig
behavioral2/memory/4540-572-0x00007FF625A80000-0x00007FF625DD1000-memory.dmp	xmrig
behavioral2/memory/2444-583-0x00007FF753300000-0x00007FF753651000-memory.dmp	xmrig
behavioral2/memory/1912-584-0x00007FF728BB0000-0x00007FF728F01000-memory.dmp	xmrig
behavioral2/memory/1148-620-0x00007FF6F2B60000-0x00007FF6F2EB1000-memory.dmp	xmrig
behavioral2/memory/4060-611-0x00007FF705240000-0x00007FF705591000-memory.dmp	xmrig
behavioral2/memory/4172-615-0x00007FF74E140000-0x00007FF74E491000-memory.dmp	xmrig
behavioral2/memory/1044-628-0x00007FF7FA8B0000-0x00007FF7FAC01000-memory.dmp	xmrig
behavioral2/memory/5060-634-0x00007FF7FEF80000-0x00007FF7FF2D1000-memory.dmp	xmrig
behavioral2/memory/5112-625-0x00007FF6531C0000-0x00007FF653511000-memory.dmp	xmrig
behavioral2/memory/3424-599-0x00007FF6395A0000-0x00007FF6398F1000-memory.dmp	xmrig
behavioral2/memory/5056-594-0x00007FF7E1180000-0x00007FF7E14D1000-memory.dmp	xmrig
behavioral2/memory/3000-637-0x00007FF7EBE70000-0x00007FF7EC1C1000-memory.dmp	xmrig
behavioral2/memory/2532-589-0x00007FF788200000-0x00007FF788551000-memory.dmp	xmrig
behavioral2/memory/3208-576-0x00007FF76FC00000-0x00007FF76FF51000-memory.dmp	xmrig
behavioral2/memory/3044-2036-0x00007FF698A50000-0x00007FF698DA1000-memory.dmp	xmrig
behavioral2/memory/1824-2255-0x00007FF74D6A0000-0x00007FF74D9F1000-memory.dmp	xmrig
behavioral2/memory/1324-2256-0x00007FF7BECC0000-0x00007FF7BF011000-memory.dmp	xmrig
behavioral2/memory/3232-2257-0x00007FF638C50000-0x00007FF638FA1000-memory.dmp	xmrig
behavioral2/memory/5072-2258-0x00007FF6A3A90000-0x00007FF6A3DE1000-memory.dmp	xmrig
behavioral2/memory/3868-2259-0x00007FF647490000-0x00007FF6477E1000-memory.dmp	xmrig
behavioral2/memory/4852-2292-0x00007FF683D80000-0x00007FF6840D1000-memory.dmp	xmrig
behavioral2/memory/1920-2293-0x00007FF6CE0D0000-0x00007FF6CE421000-memory.dmp	xmrig
behavioral2/memory/1224-2299-0x00007FF620F00000-0x00007FF621251000-memory.dmp	xmrig
behavioral2/memory/4188-2297-0x00007FF62E3F0000-0x00007FF62E741000-memory.dmp	xmrig
behavioral2/memory/1268-2301-0x00007FF6C2FF0000-0x00007FF6C3341000-memory.dmp	xmrig
behavioral2/memory/1972-2303-0x00007FF7D4500000-0x00007FF7D4851000-memory.dmp	xmrig
behavioral2/memory/2628-2305-0x00007FF6D3AA0000-0x00007FF6D3DF1000-memory.dmp	xmrig
behavioral2/memory/1148-2307-0x00007FF6F2B60000-0x00007FF6F2EB1000-memory.dmp	xmrig
behavioral2/memory/5112-2313-0x00007FF6531C0000-0x00007FF653511000-memory.dmp	xmrig
behavioral2/memory/1044-2311-0x00007FF7FA8B0000-0x00007FF7FAC01000-memory.dmp	xmrig
behavioral2/memory/3044-2309-0x00007FF698A50000-0x00007FF698DA1000-memory.dmp	xmrig
behavioral2/memory/4188-2327-0x00007FF62E3F0000-0x00007FF62E741000-memory.dmp	xmrig
behavioral2/memory/4852-2323-0x00007FF683D80000-0x00007FF6840D1000-memory.dmp	xmrig
behavioral2/memory/1920-2321-0x00007FF6CE0D0000-0x00007FF6CE421000-memory.dmp	xmrig
behavioral2/memory/3232-2319-0x00007FF638C50000-0x00007FF638FA1000-memory.dmp	xmrig
behavioral2/memory/1824-2317-0x00007FF74D6A0000-0x00007FF74D9F1000-memory.dmp	xmrig
behavioral2/memory/1324-2315-0x00007FF7BECC0000-0x00007FF7BF011000-memory.dmp	xmrig
behavioral2/memory/3868-2325-0x00007FF647490000-0x00007FF6477E1000-memory.dmp	xmrig
behavioral2/memory/1224-2331-0x00007FF620F00000-0x00007FF621251000-memory.dmp	xmrig
behavioral2/memory/4940-2333-0x00007FF6992B0000-0x00007FF699601000-memory.dmp	xmrig
behavioral2/memory/5028-2335-0x00007FF631790000-0x00007FF631AE1000-memory.dmp	xmrig
behavioral2/memory/5072-2329-0x00007FF6A3A90000-0x00007FF6A3DE1000-memory.dmp	xmrig
behavioral2/memory/5056-2351-0x00007FF7E1180000-0x00007FF7E14D1000-memory.dmp	xmrig
behavioral2/memory/3424-2358-0x00007FF6395A0000-0x00007FF6398F1000-memory.dmp	xmrig
behavioral2/memory/4060-2356-0x00007FF705240000-0x00007FF705591000-memory.dmp	xmrig
behavioral2/memory/4172-2353-0x00007FF74E140000-0x00007FF74E491000-memory.dmp	xmrig
behavioral2/memory/3208-2345-0x00007FF76FC00000-0x00007FF76FF51000-memory.dmp	xmrig
behavioral2/memory/2444-2343-0x00007FF753300000-0x00007FF753651000-memory.dmp	xmrig
behavioral2/memory/1912-2341-0x00007FF728BB0000-0x00007FF728F01000-memory.dmp	xmrig
behavioral2/memory/2532-2339-0x00007FF788200000-0x00007FF788551000-memory.dmp	xmrig
behavioral2/memory/3000-2349-0x00007FF7EBE70000-0x00007FF7EC1C1000-memory.dmp	xmrig
behavioral2/memory/4540-2347-0x00007FF625A80000-0x00007FF625DD1000-memory.dmp	xmrig
behavioral2/memory/5060-2337-0x00007FF7FEF80000-0x00007FF7FF2D1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1268	POqWYwr.exe
2628	MPELhLt.exe
1972	wIRhIUy.exe
1148	mmSRMps.exe
5112	upBZaVN.exe
3044	iMBQGHW.exe
1044	lqYPbst.exe
1824	VqpaaeI.exe
1324	dkWdZSR.exe
3232	wkErbAN.exe
5072	QHFgtwV.exe
3868	WgrJNkT.exe
4852	mSkKmQx.exe
1920	vGrSHdH.exe
4188	tWomVKX.exe
1224	UfGcQKs.exe
4940	hXpWicz.exe
5060	DIhOdRl.exe
5028	SnRzPCX.exe
3000	VmfyjBQ.exe
4540	oVcnyCy.exe
3208	JfFBHFS.exe
2444	mNARgCw.exe
1912	SnAKdHh.exe
2532	GVivsem.exe
5056	EEknIgL.exe
3424	hslGpEV.exe
4060	GAeUqcz.exe
4172	EXpOQdC.exe
2368	sDaDJGz.exe
1196	TTsRHEv.exe
2612	gdLzDuf.exe
4896	bgAOSax.exe
2040	HXmarlP.exe
4336	eSYnUih.exe
1588	cQFjrir.exe
844	EEdettH.exe
3828	dsaOggk.exe
3756	gPIyWrk.exe
2372	NYzwWWg.exe
4536	ppSPxxw.exe
2056	CaCrQzm.exe
4564	JGEEzXA.exe
4300	MqmcTOi.exe
2620	eASUcDT.exe
4828	POLaslw.exe
4304	fGSaeng.exe
4292	oIhcQFB.exe
232	KsjRUuf.exe
3360	OqUUycd.exe
100	glAvsVY.exe
1032	dEaoOQH.exe
4756	plTXpfJ.exe
2944	ezQdvft.exe
856	SWrPnPz.exe
1604	dwXjDpZ.exe
2576	wUKNTKX.exe
4700	MqhtDzY.exe
3348	EEesezJ.exe
3856	iwYvfvY.exe
1296	vMNkECM.exe
3964	pqUVDNP.exe
3780	ihrNwbW.exe
4692	vEjcyKV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1696-0-0x00007FF671B30000-0x00007FF671E81000-memory.dmp	upx
behavioral2/files/0x000900000002340c-4.dat	upx
behavioral2/memory/1268-7-0x00007FF6C2FF0000-0x00007FF6C3341000-memory.dmp	upx
behavioral2/files/0x000700000002341c-11.dat	upx
behavioral2/files/0x000700000002341d-10.dat	upx
behavioral2/files/0x0007000000023420-32.dat	upx
behavioral2/files/0x0007000000023422-44.dat	upx
behavioral2/files/0x0007000000023421-48.dat	upx
behavioral2/files/0x0007000000023423-56.dat	upx
behavioral2/files/0x0007000000023424-57.dat	upx
behavioral2/memory/1268-76-0x00007FF6C2FF0000-0x00007FF6C3341000-memory.dmp	upx
behavioral2/memory/4852-83-0x00007FF683D80000-0x00007FF6840D1000-memory.dmp	upx
behavioral2/files/0x000700000002342c-101.dat	upx
behavioral2/files/0x000700000002342a-109.dat	upx
behavioral2/files/0x0007000000023431-138.dat	upx
behavioral2/files/0x0007000000023434-153.dat	upx
behavioral2/files/0x0007000000023438-173.dat	upx
behavioral2/files/0x000700000002343a-183.dat	upx
behavioral2/files/0x0007000000023439-178.dat	upx
behavioral2/files/0x0007000000023437-176.dat	upx
behavioral2/files/0x0007000000023436-171.dat	upx
behavioral2/files/0x0007000000023435-166.dat	upx
behavioral2/files/0x0007000000023433-156.dat	upx
behavioral2/files/0x0007000000023432-151.dat	upx
behavioral2/files/0x0007000000023430-141.dat	upx
behavioral2/files/0x000700000002342f-133.dat	upx
behavioral2/files/0x000700000002342e-129.dat	upx
behavioral2/files/0x000700000002342d-124.dat	upx
behavioral2/files/0x0009000000023415-116.dat	upx
behavioral2/memory/1224-113-0x00007FF620F00000-0x00007FF621251000-memory.dmp	upx
behavioral2/files/0x000700000002342b-111.dat	upx
behavioral2/files/0x0007000000023429-107.dat	upx
behavioral2/files/0x0007000000023428-105.dat	upx
behavioral2/memory/4188-104-0x00007FF62E3F0000-0x00007FF62E741000-memory.dmp	upx
behavioral2/memory/1920-100-0x00007FF6CE0D0000-0x00007FF6CE421000-memory.dmp	upx
behavioral2/memory/1972-99-0x00007FF7D4500000-0x00007FF7D4851000-memory.dmp	upx
behavioral2/files/0x0007000000023427-94.dat	upx
behavioral2/files/0x0007000000023426-78.dat	upx
behavioral2/memory/2628-77-0x00007FF6D3AA0000-0x00007FF6D3DF1000-memory.dmp	upx
behavioral2/memory/3868-75-0x00007FF647490000-0x00007FF6477E1000-memory.dmp	upx
behavioral2/files/0x0007000000023425-72.dat	upx
behavioral2/memory/1696-71-0x00007FF671B30000-0x00007FF671E81000-memory.dmp	upx
behavioral2/memory/5072-65-0x00007FF6A3A90000-0x00007FF6A3DE1000-memory.dmp	upx
behavioral2/memory/3232-60-0x00007FF638C50000-0x00007FF638FA1000-memory.dmp	upx
behavioral2/memory/1324-55-0x00007FF7BECC0000-0x00007FF7BF011000-memory.dmp	upx
behavioral2/memory/1824-52-0x00007FF74D6A0000-0x00007FF74D9F1000-memory.dmp	upx
behavioral2/memory/1044-50-0x00007FF7FA8B0000-0x00007FF7FAC01000-memory.dmp	upx
behavioral2/memory/3044-41-0x00007FF698A50000-0x00007FF698DA1000-memory.dmp	upx
behavioral2/memory/5112-40-0x00007FF6531C0000-0x00007FF653511000-memory.dmp	upx
behavioral2/memory/1148-30-0x00007FF6F2B60000-0x00007FF6F2EB1000-memory.dmp	upx
behavioral2/files/0x000700000002341f-35.dat	upx
behavioral2/files/0x000700000002341e-27.dat	upx
behavioral2/memory/1972-19-0x00007FF7D4500000-0x00007FF7D4851000-memory.dmp	upx
behavioral2/memory/2628-18-0x00007FF6D3AA0000-0x00007FF6D3DF1000-memory.dmp	upx
behavioral2/memory/5028-569-0x00007FF631790000-0x00007FF631AE1000-memory.dmp	upx
behavioral2/memory/4940-568-0x00007FF6992B0000-0x00007FF699601000-memory.dmp	upx
behavioral2/memory/4540-572-0x00007FF625A80000-0x00007FF625DD1000-memory.dmp	upx
behavioral2/memory/2444-583-0x00007FF753300000-0x00007FF753651000-memory.dmp	upx
behavioral2/memory/1912-584-0x00007FF728BB0000-0x00007FF728F01000-memory.dmp	upx
behavioral2/memory/1148-620-0x00007FF6F2B60000-0x00007FF6F2EB1000-memory.dmp	upx
behavioral2/memory/4060-611-0x00007FF705240000-0x00007FF705591000-memory.dmp	upx
behavioral2/memory/4172-615-0x00007FF74E140000-0x00007FF74E491000-memory.dmp	upx
behavioral2/memory/1044-628-0x00007FF7FA8B0000-0x00007FF7FAC01000-memory.dmp	upx
behavioral2/memory/5060-634-0x00007FF7FEF80000-0x00007FF7FF2D1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hEGGCJF.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\HUhTzKi.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\CgmiPau.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\BAStbdi.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\kyeDJsY.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\GIypUQT.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\iCAKVGq.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\IxppSng.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\EEknIgL.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\ItdpTjo.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\YEzyDYq.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\qQVRinq.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\UGWLoCi.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\rPHvsJp.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\zZHteVF.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\XgKdGjQ.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\MqmcTOi.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\khFpPFF.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\rvepUET.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\ZSMWnjU.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\wUKNTKX.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\MggEcKd.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\VHGTkao.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\zgiaCRF.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\SvBZzlm.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\zOBvMTI.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\MAkjMZz.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\oIHinMG.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\OqUUycd.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\SbdXMUt.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\uCUZlqx.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\RNIZAYK.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\QWVnNVG.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\OLBaqbZ.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\wMgqasr.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\tajPvvV.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\fxKVyCP.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\HJDGpRM.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\yKDVdKo.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\xkxMgkQ.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\jHiiJdT.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\MPKJndv.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\IkQciIw.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\dwXjDpZ.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\XVOWrdN.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\iidhmZF.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\ZpjfrwT.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\wslAMyd.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\AmFgJTA.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\TurZRRT.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\EEdettH.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\sdSxTZK.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\NcRcYcI.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\hGdLNMG.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\DzTGXYU.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\wyKeJUm.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\ePeabnM.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\pNEZusz.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\yDrVwVR.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\YEEuxzJ.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\YdJODRo.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\ArjmWoL.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\iFGTFRf.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
File created	C:\Windows\System\vcrOuMi.exe	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1076	dwm.exe
Token: SeChangeNotifyPrivilege	1076	dwm.exe
Token: 33	1076	dwm.exe
Token: SeIncBasePriorityPrivilege	1076	dwm.exe
Token: SeShutdownPrivilege	1076	dwm.exe
Token: SeCreatePagefilePrivilege	1076	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1268	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	84
PID 1696 wrote to memory of 1268	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	84
PID 1696 wrote to memory of 2628	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	85
PID 1696 wrote to memory of 2628	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	85
PID 1696 wrote to memory of 1972	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	86
PID 1696 wrote to memory of 1972	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	86
PID 1696 wrote to memory of 1148	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	87
PID 1696 wrote to memory of 1148	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	87
PID 1696 wrote to memory of 5112	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	88
PID 1696 wrote to memory of 5112	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	88
PID 1696 wrote to memory of 3044	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	89
PID 1696 wrote to memory of 3044	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	89
PID 1696 wrote to memory of 1044	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	90
PID 1696 wrote to memory of 1044	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	90
PID 1696 wrote to memory of 1824	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	91
PID 1696 wrote to memory of 1824	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	91
PID 1696 wrote to memory of 1324	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	92
PID 1696 wrote to memory of 1324	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	92
PID 1696 wrote to memory of 3232	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	93
PID 1696 wrote to memory of 3232	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	93
PID 1696 wrote to memory of 5072	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	94
PID 1696 wrote to memory of 5072	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	94
PID 1696 wrote to memory of 3868	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	95
PID 1696 wrote to memory of 3868	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	95
PID 1696 wrote to memory of 4852	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	96
PID 1696 wrote to memory of 4852	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	96
PID 1696 wrote to memory of 1920	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	97
PID 1696 wrote to memory of 1920	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	97
PID 1696 wrote to memory of 5028	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	98
PID 1696 wrote to memory of 5028	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	98
PID 1696 wrote to memory of 4188	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	99
PID 1696 wrote to memory of 4188	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	99
PID 1696 wrote to memory of 1224	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	100
PID 1696 wrote to memory of 1224	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	100
PID 1696 wrote to memory of 4940	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	101
PID 1696 wrote to memory of 4940	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	101
PID 1696 wrote to memory of 5060	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	102
PID 1696 wrote to memory of 5060	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	102
PID 1696 wrote to memory of 3000	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	103
PID 1696 wrote to memory of 3000	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	103
PID 1696 wrote to memory of 4540	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	104
PID 1696 wrote to memory of 4540	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	104
PID 1696 wrote to memory of 3208	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	105
PID 1696 wrote to memory of 3208	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	105
PID 1696 wrote to memory of 2444	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	106
PID 1696 wrote to memory of 2444	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	106
PID 1696 wrote to memory of 1912	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	107
PID 1696 wrote to memory of 1912	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	107
PID 1696 wrote to memory of 2532	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	108
PID 1696 wrote to memory of 2532	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	108
PID 1696 wrote to memory of 5056	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	109
PID 1696 wrote to memory of 5056	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	109
PID 1696 wrote to memory of 3424	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	110
PID 1696 wrote to memory of 3424	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	110
PID 1696 wrote to memory of 4060	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	111
PID 1696 wrote to memory of 4060	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	111
PID 1696 wrote to memory of 4172	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	112
PID 1696 wrote to memory of 4172	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	112
PID 1696 wrote to memory of 2368	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	113
PID 1696 wrote to memory of 2368	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	113
PID 1696 wrote to memory of 1196	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	114
PID 1696 wrote to memory of 1196	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	114
PID 1696 wrote to memory of 2612	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	115
PID 1696 wrote to memory of 2612	1696	30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\30ddce6d358c3b8a44c4374ec9b9abe8f6ae6bc1d13c302263d4feb3e0af67d7_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\System\POqWYwr.exe
  C:\Windows\System\POqWYwr.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\MPELhLt.exe
  C:\Windows\System\MPELhLt.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\wIRhIUy.exe
  C:\Windows\System\wIRhIUy.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\mmSRMps.exe
  C:\Windows\System\mmSRMps.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\upBZaVN.exe
  C:\Windows\System\upBZaVN.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\iMBQGHW.exe
  C:\Windows\System\iMBQGHW.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\lqYPbst.exe
  C:\Windows\System\lqYPbst.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\VqpaaeI.exe
  C:\Windows\System\VqpaaeI.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\dkWdZSR.exe
  C:\Windows\System\dkWdZSR.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\wkErbAN.exe
  C:\Windows\System\wkErbAN.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\QHFgtwV.exe
  C:\Windows\System\QHFgtwV.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\WgrJNkT.exe
  C:\Windows\System\WgrJNkT.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\mSkKmQx.exe
  C:\Windows\System\mSkKmQx.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\vGrSHdH.exe
  C:\Windows\System\vGrSHdH.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\SnRzPCX.exe
  C:\Windows\System\SnRzPCX.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\tWomVKX.exe
  C:\Windows\System\tWomVKX.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\UfGcQKs.exe
  C:\Windows\System\UfGcQKs.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\hXpWicz.exe
  C:\Windows\System\hXpWicz.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\DIhOdRl.exe
  C:\Windows\System\DIhOdRl.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\VmfyjBQ.exe
  C:\Windows\System\VmfyjBQ.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\oVcnyCy.exe
  C:\Windows\System\oVcnyCy.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\JfFBHFS.exe
  C:\Windows\System\JfFBHFS.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\mNARgCw.exe
  C:\Windows\System\mNARgCw.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\SnAKdHh.exe
  C:\Windows\System\SnAKdHh.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\GVivsem.exe
  C:\Windows\System\GVivsem.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\EEknIgL.exe
  C:\Windows\System\EEknIgL.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\hslGpEV.exe
  C:\Windows\System\hslGpEV.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\GAeUqcz.exe
  C:\Windows\System\GAeUqcz.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\EXpOQdC.exe
  C:\Windows\System\EXpOQdC.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\sDaDJGz.exe
  C:\Windows\System\sDaDJGz.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\TTsRHEv.exe
  C:\Windows\System\TTsRHEv.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\gdLzDuf.exe
  C:\Windows\System\gdLzDuf.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\bgAOSax.exe
  C:\Windows\System\bgAOSax.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\HXmarlP.exe
  C:\Windows\System\HXmarlP.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\eSYnUih.exe
  C:\Windows\System\eSYnUih.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\cQFjrir.exe
  C:\Windows\System\cQFjrir.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\EEdettH.exe
  C:\Windows\System\EEdettH.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\dsaOggk.exe
  C:\Windows\System\dsaOggk.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\gPIyWrk.exe
  C:\Windows\System\gPIyWrk.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\NYzwWWg.exe
  C:\Windows\System\NYzwWWg.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\ppSPxxw.exe
  C:\Windows\System\ppSPxxw.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\CaCrQzm.exe
  C:\Windows\System\CaCrQzm.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\JGEEzXA.exe
  C:\Windows\System\JGEEzXA.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\MqmcTOi.exe
  C:\Windows\System\MqmcTOi.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\eASUcDT.exe
  C:\Windows\System\eASUcDT.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\POLaslw.exe
  C:\Windows\System\POLaslw.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\fGSaeng.exe
  C:\Windows\System\fGSaeng.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\oIhcQFB.exe
  C:\Windows\System\oIhcQFB.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\KsjRUuf.exe
  C:\Windows\System\KsjRUuf.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\OqUUycd.exe
  C:\Windows\System\OqUUycd.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\glAvsVY.exe
  C:\Windows\System\glAvsVY.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\dEaoOQH.exe
  C:\Windows\System\dEaoOQH.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\plTXpfJ.exe
  C:\Windows\System\plTXpfJ.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\ezQdvft.exe
  C:\Windows\System\ezQdvft.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\SWrPnPz.exe
  C:\Windows\System\SWrPnPz.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\dwXjDpZ.exe
  C:\Windows\System\dwXjDpZ.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\wUKNTKX.exe
  C:\Windows\System\wUKNTKX.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\MqhtDzY.exe
  C:\Windows\System\MqhtDzY.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\EEesezJ.exe
  C:\Windows\System\EEesezJ.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\iwYvfvY.exe
  C:\Windows\System\iwYvfvY.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\vMNkECM.exe
  C:\Windows\System\vMNkECM.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\pqUVDNP.exe
  C:\Windows\System\pqUVDNP.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\ihrNwbW.exe
  C:\Windows\System\ihrNwbW.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\vEjcyKV.exe
  C:\Windows\System\vEjcyKV.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\LACTtxq.exe
  C:\Windows\System\LACTtxq.exe
  2⤵
  PID:4432
- C:\Windows\System\nxHBzof.exe
  C:\Windows\System\nxHBzof.exe
  2⤵
  PID:4236
- C:\Windows\System\exYXmgl.exe
  C:\Windows\System\exYXmgl.exe
  2⤵
  PID:1348
- C:\Windows\System\WFjLUjz.exe
  C:\Windows\System\WFjLUjz.exe
  2⤵
  PID:3276
- C:\Windows\System\VbHthDc.exe
  C:\Windows\System\VbHthDc.exe
  2⤵
  PID:1216
- C:\Windows\System\BAStbdi.exe
  C:\Windows\System\BAStbdi.exe
  2⤵
  PID:4348
- C:\Windows\System\yDrVwVR.exe
  C:\Windows\System\yDrVwVR.exe
  2⤵
  PID:1204
- C:\Windows\System\QyaIOcb.exe
  C:\Windows\System\QyaIOcb.exe
  2⤵
  PID:1984
- C:\Windows\System\KOzGjys.exe
  C:\Windows\System\KOzGjys.exe
  2⤵
  PID:3240
- C:\Windows\System\JNuTrTE.exe
  C:\Windows\System\JNuTrTE.exe
  2⤵
  PID:1848
- C:\Windows\System\lCiTCBq.exe
  C:\Windows\System\lCiTCBq.exe
  2⤵
  PID:1888
- C:\Windows\System\Ruivwgb.exe
  C:\Windows\System\Ruivwgb.exe
  2⤵
  PID:3216
- C:\Windows\System\rJpGTim.exe
  C:\Windows\System\rJpGTim.exe
  2⤵
  PID:3592
- C:\Windows\System\JBLfcsm.exe
  C:\Windows\System\JBLfcsm.exe
  2⤵
  PID:3660
- C:\Windows\System\zWkQcYI.exe
  C:\Windows\System\zWkQcYI.exe
  2⤵
  PID:440
- C:\Windows\System\xPbPlcM.exe
  C:\Windows\System\xPbPlcM.exe
  2⤵
  PID:5140
- C:\Windows\System\tJvKTJg.exe
  C:\Windows\System\tJvKTJg.exe
  2⤵
  PID:5168
- C:\Windows\System\esdZOuL.exe
  C:\Windows\System\esdZOuL.exe
  2⤵
  PID:5196
- C:\Windows\System\NdsqPAj.exe
  C:\Windows\System\NdsqPAj.exe
  2⤵
  PID:5224
- C:\Windows\System\sCGQIrj.exe
  C:\Windows\System\sCGQIrj.exe
  2⤵
  PID:5248
- C:\Windows\System\MYqrCnd.exe
  C:\Windows\System\MYqrCnd.exe
  2⤵
  PID:5280
- C:\Windows\System\RXihFJP.exe
  C:\Windows\System\RXihFJP.exe
  2⤵
  PID:5308
- C:\Windows\System\mjuugOb.exe
  C:\Windows\System\mjuugOb.exe
  2⤵
  PID:5336
- C:\Windows\System\cGiwSmK.exe
  C:\Windows\System\cGiwSmK.exe
  2⤵
  PID:5364
- C:\Windows\System\BUZLaKm.exe
  C:\Windows\System\BUZLaKm.exe
  2⤵
  PID:5392
- C:\Windows\System\gMtBTpp.exe
  C:\Windows\System\gMtBTpp.exe
  2⤵
  PID:5420
- C:\Windows\System\OrEOScy.exe
  C:\Windows\System\OrEOScy.exe
  2⤵
  PID:5444
- C:\Windows\System\ILXlRMC.exe
  C:\Windows\System\ILXlRMC.exe
  2⤵
  PID:5476
- C:\Windows\System\wgjXgwB.exe
  C:\Windows\System\wgjXgwB.exe
  2⤵
  PID:5504
- C:\Windows\System\xDJfBNX.exe
  C:\Windows\System\xDJfBNX.exe
  2⤵
  PID:5532
- C:\Windows\System\tebrWXC.exe
  C:\Windows\System\tebrWXC.exe
  2⤵
  PID:5560
- C:\Windows\System\ufKUZcw.exe
  C:\Windows\System\ufKUZcw.exe
  2⤵
  PID:5588
- C:\Windows\System\PnIkhKg.exe
  C:\Windows\System\PnIkhKg.exe
  2⤵
  PID:5616
- C:\Windows\System\EQhAUyD.exe
  C:\Windows\System\EQhAUyD.exe
  2⤵
  PID:5644
- C:\Windows\System\LJAHNtd.exe
  C:\Windows\System\LJAHNtd.exe
  2⤵
  PID:5672
- C:\Windows\System\VEtHGuz.exe
  C:\Windows\System\VEtHGuz.exe
  2⤵
  PID:5700
- C:\Windows\System\vGsLlXp.exe
  C:\Windows\System\vGsLlXp.exe
  2⤵
  PID:5732
- C:\Windows\System\YOiKOgg.exe
  C:\Windows\System\YOiKOgg.exe
  2⤵
  PID:5756
- C:\Windows\System\csJMzUy.exe
  C:\Windows\System\csJMzUy.exe
  2⤵
  PID:5784
- C:\Windows\System\jnjdcwd.exe
  C:\Windows\System\jnjdcwd.exe
  2⤵
  PID:5812
- C:\Windows\System\MWJUQFx.exe
  C:\Windows\System\MWJUQFx.exe
  2⤵
  PID:5836
- C:\Windows\System\OLLglgl.exe
  C:\Windows\System\OLLglgl.exe
  2⤵
  PID:5864
- C:\Windows\System\yKDVdKo.exe
  C:\Windows\System\yKDVdKo.exe
  2⤵
  PID:5896
- C:\Windows\System\CYSOWvo.exe
  C:\Windows\System\CYSOWvo.exe
  2⤵
  PID:5924
- C:\Windows\System\aeEkrdZ.exe
  C:\Windows\System\aeEkrdZ.exe
  2⤵
  PID:5952
- C:\Windows\System\pgNbtCA.exe
  C:\Windows\System\pgNbtCA.exe
  2⤵
  PID:5980
- C:\Windows\System\hyYttTT.exe
  C:\Windows\System\hyYttTT.exe
  2⤵
  PID:6008
- C:\Windows\System\FBbnBUB.exe
  C:\Windows\System\FBbnBUB.exe
  2⤵
  PID:6036
- C:\Windows\System\TjPOpQI.exe
  C:\Windows\System\TjPOpQI.exe
  2⤵
  PID:6064
- C:\Windows\System\lJJbGJG.exe
  C:\Windows\System\lJJbGJG.exe
  2⤵
  PID:6092
- C:\Windows\System\VJrqZME.exe
  C:\Windows\System\VJrqZME.exe
  2⤵
  PID:6116
- C:\Windows\System\uikrspW.exe
  C:\Windows\System\uikrspW.exe
  2⤵
  PID:1416
- C:\Windows\System\pRqXdVT.exe
  C:\Windows\System\pRqXdVT.exe
  2⤵
  PID:1832
- C:\Windows\System\TAhjTOn.exe
  C:\Windows\System\TAhjTOn.exe
  2⤵
  PID:4396
- C:\Windows\System\onxDjPM.exe
  C:\Windows\System\onxDjPM.exe
  2⤵
  PID:2800
- C:\Windows\System\ItdpTjo.exe
  C:\Windows\System\ItdpTjo.exe
  2⤵
  PID:2296
- C:\Windows\System\SmyxwmN.exe
  C:\Windows\System\SmyxwmN.exe
  2⤵
  PID:5044
- C:\Windows\System\nHMAglK.exe
  C:\Windows\System\nHMAglK.exe
  2⤵
  PID:5156
- C:\Windows\System\tYDpoNE.exe
  C:\Windows\System\tYDpoNE.exe
  2⤵
  PID:5216
- C:\Windows\System\OWeIpTR.exe
  C:\Windows\System\OWeIpTR.exe
  2⤵
  PID:5292
- C:\Windows\System\IkQciIw.exe
  C:\Windows\System\IkQciIw.exe
  2⤵
  PID:5352
- C:\Windows\System\VxAebhC.exe
  C:\Windows\System\VxAebhC.exe
  2⤵
  PID:2632
- C:\Windows\System\NRyOlJK.exe
  C:\Windows\System\NRyOlJK.exe
  2⤵
  PID:5464
- C:\Windows\System\Baxuthm.exe
  C:\Windows\System\Baxuthm.exe
  2⤵
  PID:5524
- C:\Windows\System\cJpLGEu.exe
  C:\Windows\System\cJpLGEu.exe
  2⤵
  PID:5600
- C:\Windows\System\qITGTUA.exe
  C:\Windows\System\qITGTUA.exe
  2⤵
  PID:5636
- C:\Windows\System\IbxDBbi.exe
  C:\Windows\System\IbxDBbi.exe
  2⤵
  PID:5692
- C:\Windows\System\QzGAASY.exe
  C:\Windows\System\QzGAASY.exe
  2⤵
  PID:1612
- C:\Windows\System\xedvVHt.exe
  C:\Windows\System\xedvVHt.exe
  2⤵
  PID:5824
- C:\Windows\System\VrVXvIX.exe
  C:\Windows\System\VrVXvIX.exe
  2⤵
  PID:5884
- C:\Windows\System\dTuTRja.exe
  C:\Windows\System\dTuTRja.exe
  2⤵
  PID:5936
- C:\Windows\System\MYXMyBx.exe
  C:\Windows\System\MYXMyBx.exe
  2⤵
  PID:5996
- C:\Windows\System\gXfwmXv.exe
  C:\Windows\System\gXfwmXv.exe
  2⤵
  PID:6052
- C:\Windows\System\dEZWROL.exe
  C:\Windows\System\dEZWROL.exe
  2⤵
  PID:6104
- C:\Windows\System\vzHBsue.exe
  C:\Windows\System\vzHBsue.exe
  2⤵
  PID:4144
- C:\Windows\System\WLQJMdw.exe
  C:\Windows\System\WLQJMdw.exe
  2⤵
  PID:396
- C:\Windows\System\NZvdNXV.exe
  C:\Windows\System\NZvdNXV.exe
  2⤵
  PID:3416
- C:\Windows\System\GPnFtRI.exe
  C:\Windows\System\GPnFtRI.exe
  2⤵
  PID:5244
- C:\Windows\System\NnxRRWP.exe
  C:\Windows\System\NnxRRWP.exe
  2⤵
  PID:5404
- C:\Windows\System\CZnvAQH.exe
  C:\Windows\System\CZnvAQH.exe
  2⤵
  PID:2688
- C:\Windows\System\kCCZSuR.exe
  C:\Windows\System\kCCZSuR.exe
  2⤵
  PID:3456
- C:\Windows\System\qZiWhPd.exe
  C:\Windows\System\qZiWhPd.exe
  2⤵
  PID:5660
- C:\Windows\System\DjbIuar.exe
  C:\Windows\System\DjbIuar.exe
  2⤵
  PID:5776
- C:\Windows\System\xGkWkSC.exe
  C:\Windows\System\xGkWkSC.exe
  2⤵
  PID:5856
- C:\Windows\System\lwcMnYn.exe
  C:\Windows\System\lwcMnYn.exe
  2⤵
  PID:5912
- C:\Windows\System\XWWVzGZ.exe
  C:\Windows\System\XWWVzGZ.exe
  2⤵
  PID:5972
- C:\Windows\System\HLFjEnO.exe
  C:\Windows\System\HLFjEnO.exe
  2⤵
  PID:4112
- C:\Windows\System\dNAlmUe.exe
  C:\Windows\System\dNAlmUe.exe
  2⤵
  PID:3376
- C:\Windows\System\auyjjOT.exe
  C:\Windows\System\auyjjOT.exe
  2⤵
  PID:736
- C:\Windows\System\HyOFMJS.exe
  C:\Windows\System\HyOFMJS.exe
  2⤵
  PID:5188
- C:\Windows\System\uXXlsGE.exe
  C:\Windows\System\uXXlsGE.exe
  2⤵
  PID:4972
- C:\Windows\System\XVOWrdN.exe
  C:\Windows\System\XVOWrdN.exe
  2⤵
  PID:4440
- C:\Windows\System\rXWWEaS.exe
  C:\Windows\System\rXWWEaS.exe
  2⤵
  PID:1208
- C:\Windows\System\IdaoIBM.exe
  C:\Windows\System\IdaoIBM.exe
  2⤵
  PID:1648
- C:\Windows\System\lHhaIwO.exe
  C:\Windows\System\lHhaIwO.exe
  2⤵
  PID:5964
- C:\Windows\System\kyeDJsY.exe
  C:\Windows\System\kyeDJsY.exe
  2⤵
  PID:4848
- C:\Windows\System\JSljoDI.exe
  C:\Windows\System\JSljoDI.exe
  2⤵
  PID:5320
- C:\Windows\System\hehLjON.exe
  C:\Windows\System\hehLjON.exe
  2⤵
  PID:3048
- C:\Windows\System\TaBOjIL.exe
  C:\Windows\System\TaBOjIL.exe
  2⤵
  PID:5132
- C:\Windows\System\MozDkMM.exe
  C:\Windows\System\MozDkMM.exe
  2⤵
  PID:2860
- C:\Windows\System\elJempp.exe
  C:\Windows\System\elJempp.exe
  2⤵
  PID:4884
- C:\Windows\System\FLMyYyl.exe
  C:\Windows\System\FLMyYyl.exe
  2⤵
  PID:2192
- C:\Windows\System\OrNSAaS.exe
  C:\Windows\System\OrNSAaS.exe
  2⤵
  PID:2156
- C:\Windows\System\UrRpcFQ.exe
  C:\Windows\System\UrRpcFQ.exe
  2⤵
  PID:1800
- C:\Windows\System\GHGxeja.exe
  C:\Windows\System\GHGxeja.exe
  2⤵
  PID:6148
- C:\Windows\System\rSwgogb.exe
  C:\Windows\System\rSwgogb.exe
  2⤵
  PID:6164
- C:\Windows\System\HnifkNI.exe
  C:\Windows\System\HnifkNI.exe
  2⤵
  PID:6200
- C:\Windows\System\SItcZZs.exe
  C:\Windows\System\SItcZZs.exe
  2⤵
  PID:6240
- C:\Windows\System\RtCmZJC.exe
  C:\Windows\System\RtCmZJC.exe
  2⤵
  PID:6256
- C:\Windows\System\weFpOTG.exe
  C:\Windows\System\weFpOTG.exe
  2⤵
  PID:6280
- C:\Windows\System\giUrzNZ.exe
  C:\Windows\System\giUrzNZ.exe
  2⤵
  PID:6296
- C:\Windows\System\Fjdsgif.exe
  C:\Windows\System\Fjdsgif.exe
  2⤵
  PID:6320
- C:\Windows\System\mSujFTh.exe
  C:\Windows\System\mSujFTh.exe
  2⤵
  PID:6388
- C:\Windows\System\TVyrPKW.exe
  C:\Windows\System\TVyrPKW.exe
  2⤵
  PID:6408
- C:\Windows\System\ApawvBe.exe
  C:\Windows\System\ApawvBe.exe
  2⤵
  PID:6428
- C:\Windows\System\AXGPmzF.exe
  C:\Windows\System\AXGPmzF.exe
  2⤵
  PID:6452
- C:\Windows\System\lRPugDc.exe
  C:\Windows\System\lRPugDc.exe
  2⤵
  PID:6472
- C:\Windows\System\hpkFbyN.exe
  C:\Windows\System\hpkFbyN.exe
  2⤵
  PID:6500
- C:\Windows\System\UkGwfZx.exe
  C:\Windows\System\UkGwfZx.exe
  2⤵
  PID:6576
- C:\Windows\System\jnYVpFV.exe
  C:\Windows\System\jnYVpFV.exe
  2⤵
  PID:6636
- C:\Windows\System\OLBaqbZ.exe
  C:\Windows\System\OLBaqbZ.exe
  2⤵
  PID:6656
- C:\Windows\System\XlvdCnO.exe
  C:\Windows\System\XlvdCnO.exe
  2⤵
  PID:6688
- C:\Windows\System\lYJFmBi.exe
  C:\Windows\System\lYJFmBi.exe
  2⤵
  PID:6712
- C:\Windows\System\YEzyDYq.exe
  C:\Windows\System\YEzyDYq.exe
  2⤵
  PID:6776
- C:\Windows\System\dVTCqpW.exe
  C:\Windows\System\dVTCqpW.exe
  2⤵
  PID:6792
- C:\Windows\System\XEyKaOt.exe
  C:\Windows\System\XEyKaOt.exe
  2⤵
  PID:6808
- C:\Windows\System\RczrJhi.exe
  C:\Windows\System\RczrJhi.exe
  2⤵
  PID:6824
- C:\Windows\System\WSrLtrp.exe
  C:\Windows\System\WSrLtrp.exe
  2⤵
  PID:6852
- C:\Windows\System\LWKEeHW.exe
  C:\Windows\System\LWKEeHW.exe
  2⤵
  PID:6936
- C:\Windows\System\sYPUsrP.exe
  C:\Windows\System\sYPUsrP.exe
  2⤵
  PID:6952
- C:\Windows\System\iidhmZF.exe
  C:\Windows\System\iidhmZF.exe
  2⤵
  PID:6968
- C:\Windows\System\PgYWAHY.exe
  C:\Windows\System\PgYWAHY.exe
  2⤵
  PID:6992
- C:\Windows\System\rKQbHDJ.exe
  C:\Windows\System\rKQbHDJ.exe
  2⤵
  PID:7012
- C:\Windows\System\aGvFTEs.exe
  C:\Windows\System\aGvFTEs.exe
  2⤵
  PID:7120
- C:\Windows\System\WKaNCCc.exe
  C:\Windows\System\WKaNCCc.exe
  2⤵
  PID:7140
- C:\Windows\System\fuxXBmG.exe
  C:\Windows\System\fuxXBmG.exe
  2⤵
  PID:7164
- C:\Windows\System\pPtpkVe.exe
  C:\Windows\System\pPtpkVe.exe
  2⤵
  PID:3052
- C:\Windows\System\azRiFXk.exe
  C:\Windows\System\azRiFXk.exe
  2⤵
  PID:6184
- C:\Windows\System\MggEcKd.exe
  C:\Windows\System\MggEcKd.exe
  2⤵
  PID:6236
- C:\Windows\System\pklXnIm.exe
  C:\Windows\System\pklXnIm.exe
  2⤵
  PID:6276
- C:\Windows\System\WiSeRLP.exe
  C:\Windows\System\WiSeRLP.exe
  2⤵
  PID:6368
- C:\Windows\System\YZdzhzo.exe
  C:\Windows\System\YZdzhzo.exe
  2⤵
  PID:6560
- C:\Windows\System\RotBhee.exe
  C:\Windows\System\RotBhee.exe
  2⤵
  PID:6444
- C:\Windows\System\qEMNUQt.exe
  C:\Windows\System\qEMNUQt.exe
  2⤵
  PID:6488
- C:\Windows\System\giIrcTL.exe
  C:\Windows\System\giIrcTL.exe
  2⤵
  PID:6652
- C:\Windows\System\PoUpwTe.exe
  C:\Windows\System\PoUpwTe.exe
  2⤵
  PID:7052
- C:\Windows\System\hnDJITv.exe
  C:\Windows\System\hnDJITv.exe
  2⤵
  PID:7080
- C:\Windows\System\MFBovTW.exe
  C:\Windows\System\MFBovTW.exe
  2⤵
  PID:7028
- C:\Windows\System\whLkubT.exe
  C:\Windows\System\whLkubT.exe
  2⤵
  PID:7136
- C:\Windows\System\ytkMpAP.exe
  C:\Windows\System\ytkMpAP.exe
  2⤵
  PID:1396
- C:\Windows\System\WvsMEhG.exe
  C:\Windows\System\WvsMEhG.exe
  2⤵
  PID:6344
- C:\Windows\System\aOvMCJw.exe
  C:\Windows\System\aOvMCJw.exe
  2⤵
  PID:6512
- C:\Windows\System\daWAokF.exe
  C:\Windows\System\daWAokF.exe
  2⤵
  PID:4904
- C:\Windows\System\ycPofkm.exe
  C:\Windows\System\ycPofkm.exe
  2⤵
  PID:6192
- C:\Windows\System\GbjKHsy.exe
  C:\Windows\System\GbjKHsy.exe
  2⤵
  PID:6468
- C:\Windows\System\AusDFvN.exe
  C:\Windows\System\AusDFvN.exe
  2⤵
  PID:6768
- C:\Windows\System\WHmHTzN.exe
  C:\Windows\System\WHmHTzN.exe
  2⤵
  PID:6772
- C:\Windows\System\hTdRgSG.exe
  C:\Windows\System\hTdRgSG.exe
  2⤵
  PID:6516
- C:\Windows\System\qQVRinq.exe
  C:\Windows\System\qQVRinq.exe
  2⤵
  PID:7096
- C:\Windows\System\pKzZKgG.exe
  C:\Windows\System\pKzZKgG.exe
  2⤵
  PID:7000
- C:\Windows\System\hEGGCJF.exe
  C:\Windows\System\hEGGCJF.exe
  2⤵
  PID:7160
- C:\Windows\System\llONHNK.exe
  C:\Windows\System\llONHNK.exe
  2⤵
  PID:6160
- C:\Windows\System\OkKXuOk.exe
  C:\Windows\System\OkKXuOk.exe
  2⤵
  PID:4820
- C:\Windows\System\YLJvpjF.exe
  C:\Windows\System\YLJvpjF.exe
  2⤵
  PID:6784
- C:\Windows\System\BGWnUbo.exe
  C:\Windows\System\BGWnUbo.exe
  2⤵
  PID:6684
- C:\Windows\System\oHdOOon.exe
  C:\Windows\System\oHdOOon.exe
  2⤵
  PID:6948
- C:\Windows\System\tezUkqe.exe
  C:\Windows\System\tezUkqe.exe
  2⤵
  PID:7112
- C:\Windows\System\tsfCBEn.exe
  C:\Windows\System\tsfCBEn.exe
  2⤵
  PID:6704
- C:\Windows\System\VHGTkao.exe
  C:\Windows\System\VHGTkao.exe
  2⤵
  PID:6964
- C:\Windows\System\mySVsTD.exe
  C:\Windows\System\mySVsTD.exe
  2⤵
  PID:6404
- C:\Windows\System\oJuPNSO.exe
  C:\Windows\System\oJuPNSO.exe
  2⤵
  PID:6532
- C:\Windows\System\rsTCksw.exe
  C:\Windows\System\rsTCksw.exe
  2⤵
  PID:7188
- C:\Windows\System\khFpPFF.exe
  C:\Windows\System\khFpPFF.exe
  2⤵
  PID:7212
- C:\Windows\System\ZbRXaqc.exe
  C:\Windows\System\ZbRXaqc.exe
  2⤵
  PID:7228
- C:\Windows\System\YEEuxzJ.exe
  C:\Windows\System\YEEuxzJ.exe
  2⤵
  PID:7252
- C:\Windows\System\VbIblDB.exe
  C:\Windows\System\VbIblDB.exe
  2⤵
  PID:7272
- C:\Windows\System\vUzHOHf.exe
  C:\Windows\System\vUzHOHf.exe
  2⤵
  PID:7288
- C:\Windows\System\RKwBFuh.exe
  C:\Windows\System\RKwBFuh.exe
  2⤵
  PID:7328
- C:\Windows\System\UwzDnmG.exe
  C:\Windows\System\UwzDnmG.exe
  2⤵
  PID:7352
- C:\Windows\System\HUhTzKi.exe
  C:\Windows\System\HUhTzKi.exe
  2⤵
  PID:7372
- C:\Windows\System\lnkzcIk.exe
  C:\Windows\System\lnkzcIk.exe
  2⤵
  PID:7396
- C:\Windows\System\pdWTefQ.exe
  C:\Windows\System\pdWTefQ.exe
  2⤵
  PID:7416
- C:\Windows\System\qTuGSEc.exe
  C:\Windows\System\qTuGSEc.exe
  2⤵
  PID:7436
- C:\Windows\System\SDLPhdR.exe
  C:\Windows\System\SDLPhdR.exe
  2⤵
  PID:7476
- C:\Windows\System\zgiaCRF.exe
  C:\Windows\System\zgiaCRF.exe
  2⤵
  PID:7496
- C:\Windows\System\dUXVhwV.exe
  C:\Windows\System\dUXVhwV.exe
  2⤵
  PID:7516
- C:\Windows\System\ZpjfrwT.exe
  C:\Windows\System\ZpjfrwT.exe
  2⤵
  PID:7616
- C:\Windows\System\AJmDlrw.exe
  C:\Windows\System\AJmDlrw.exe
  2⤵
  PID:7640
- C:\Windows\System\SXHCrqn.exe
  C:\Windows\System\SXHCrqn.exe
  2⤵
  PID:7676
- C:\Windows\System\uVnnVXt.exe
  C:\Windows\System\uVnnVXt.exe
  2⤵
  PID:7692
- C:\Windows\System\DevUhpO.exe
  C:\Windows\System\DevUhpO.exe
  2⤵
  PID:7756
- C:\Windows\System\rvepUET.exe
  C:\Windows\System\rvepUET.exe
  2⤵
  PID:7800
- C:\Windows\System\rBShSDX.exe
  C:\Windows\System\rBShSDX.exe
  2⤵
  PID:7832
- C:\Windows\System\yagVPWl.exe
  C:\Windows\System\yagVPWl.exe
  2⤵
  PID:7860
- C:\Windows\System\XSTZIHL.exe
  C:\Windows\System\XSTZIHL.exe
  2⤵
  PID:7880
- C:\Windows\System\BoxMLsa.exe
  C:\Windows\System\BoxMLsa.exe
  2⤵
  PID:7900
- C:\Windows\System\ObDOOhH.exe
  C:\Windows\System\ObDOOhH.exe
  2⤵
  PID:7936
- C:\Windows\System\esXzyyu.exe
  C:\Windows\System\esXzyyu.exe
  2⤵
  PID:7956
- C:\Windows\System\oQWrKKj.exe
  C:\Windows\System\oQWrKKj.exe
  2⤵
  PID:7980
- C:\Windows\System\JqLzdxi.exe
  C:\Windows\System\JqLzdxi.exe
  2⤵
  PID:8008
- C:\Windows\System\OumPKhC.exe
  C:\Windows\System\OumPKhC.exe
  2⤵
  PID:8028
- C:\Windows\System\FvJNpMQ.exe
  C:\Windows\System\FvJNpMQ.exe
  2⤵
  PID:8060
- C:\Windows\System\sLXWWRW.exe
  C:\Windows\System\sLXWWRW.exe
  2⤵
  PID:8084
- C:\Windows\System\dLUNJso.exe
  C:\Windows\System\dLUNJso.exe
  2⤵
  PID:8108
- C:\Windows\System\rtpNTvU.exe
  C:\Windows\System\rtpNTvU.exe
  2⤵
  PID:8128
- C:\Windows\System\sFVwNGQ.exe
  C:\Windows\System\sFVwNGQ.exe
  2⤵
  PID:8164
- C:\Windows\System\KYIqBbm.exe
  C:\Windows\System\KYIqBbm.exe
  2⤵
  PID:7180
- C:\Windows\System\OExJxLi.exe
  C:\Windows\System\OExJxLi.exe
  2⤵
  PID:7116
- C:\Windows\System\RiAqaWh.exe
  C:\Windows\System\RiAqaWh.exe
  2⤵
  PID:7240
- C:\Windows\System\qQmeaaK.exe
  C:\Windows\System\qQmeaaK.exe
  2⤵
  PID:7336
- C:\Windows\System\mzkrurh.exe
  C:\Windows\System\mzkrurh.exe
  2⤵
  PID:7488
- C:\Windows\System\BrUCbIf.exe
  C:\Windows\System\BrUCbIf.exe
  2⤵
  PID:7532
- C:\Windows\System\ATLmzxy.exe
  C:\Windows\System\ATLmzxy.exe
  2⤵
  PID:7388
- C:\Windows\System\SyCBuwC.exe
  C:\Windows\System\SyCBuwC.exe
  2⤵
  PID:7552
- C:\Windows\System\SvBZzlm.exe
  C:\Windows\System\SvBZzlm.exe
  2⤵
  PID:7600
- C:\Windows\System\DsrlJNF.exe
  C:\Windows\System\DsrlJNF.exe
  2⤵
  PID:7720
- C:\Windows\System\NeRhVGs.exe
  C:\Windows\System\NeRhVGs.exe
  2⤵
  PID:7824
- C:\Windows\System\hUqEDTI.exe
  C:\Windows\System\hUqEDTI.exe
  2⤵
  PID:7852
- C:\Windows\System\ZhXZJFK.exe
  C:\Windows\System\ZhXZJFK.exe
  2⤵
  PID:7944
- C:\Windows\System\CzFVPGV.exe
  C:\Windows\System\CzFVPGV.exe
  2⤵
  PID:8024
- C:\Windows\System\xHTjrbj.exe
  C:\Windows\System\xHTjrbj.exe
  2⤵
  PID:8096
- C:\Windows\System\rJMxrpo.exe
  C:\Windows\System\rJMxrpo.exe
  2⤵
  PID:8120
- C:\Windows\System\NAJUMGL.exe
  C:\Windows\System\NAJUMGL.exe
  2⤵
  PID:8156
- C:\Windows\System\VEcgxzU.exe
  C:\Windows\System\VEcgxzU.exe
  2⤵
  PID:7260
- C:\Windows\System\OJRZAMW.exe
  C:\Windows\System\OJRZAMW.exe
  2⤵
  PID:7512
- C:\Windows\System\dxvxBnB.exe
  C:\Windows\System\dxvxBnB.exe
  2⤵
  PID:7412
- C:\Windows\System\ZSMWnjU.exe
  C:\Windows\System\ZSMWnjU.exe
  2⤵
  PID:7892
- C:\Windows\System\OdsfKuv.exe
  C:\Windows\System\OdsfKuv.exe
  2⤵
  PID:7284
- C:\Windows\System\PMDjgre.exe
  C:\Windows\System\PMDjgre.exe
  2⤵
  PID:8080
- C:\Windows\System\wPVunQF.exe
  C:\Windows\System\wPVunQF.exe
  2⤵
  PID:7684
- C:\Windows\System\OIYiIuL.exe
  C:\Windows\System\OIYiIuL.exe
  2⤵
  PID:7088
- C:\Windows\System\JftSMjj.exe
  C:\Windows\System\JftSMjj.exe
  2⤵
  PID:7704
- C:\Windows\System\BJMdhGG.exe
  C:\Windows\System\BJMdhGG.exe
  2⤵
  PID:8212
- C:\Windows\System\mPlVGFW.exe
  C:\Windows\System\mPlVGFW.exe
  2⤵
  PID:8260
- C:\Windows\System\dNzmAjr.exe
  C:\Windows\System\dNzmAjr.exe
  2⤵
  PID:8276
- C:\Windows\System\mPbsPUU.exe
  C:\Windows\System\mPbsPUU.exe
  2⤵
  PID:8304
- C:\Windows\System\KexfgcP.exe
  C:\Windows\System\KexfgcP.exe
  2⤵
  PID:8328
- C:\Windows\System\wfukmdy.exe
  C:\Windows\System\wfukmdy.exe
  2⤵
  PID:8348
- C:\Windows\System\PphZXjR.exe
  C:\Windows\System\PphZXjR.exe
  2⤵
  PID:8364
- C:\Windows\System\VIDobkQ.exe
  C:\Windows\System\VIDobkQ.exe
  2⤵
  PID:8384
- C:\Windows\System\yAfslUN.exe
  C:\Windows\System\yAfslUN.exe
  2⤵
  PID:8424
- C:\Windows\System\LFuNOIm.exe
  C:\Windows\System\LFuNOIm.exe
  2⤵
  PID:8444
- C:\Windows\System\nDwdpGm.exe
  C:\Windows\System\nDwdpGm.exe
  2⤵
  PID:8468
- C:\Windows\System\ZMsXNuz.exe
  C:\Windows\System\ZMsXNuz.exe
  2⤵
  PID:8496
- C:\Windows\System\wyKeJUm.exe
  C:\Windows\System\wyKeJUm.exe
  2⤵
  PID:8516
- C:\Windows\System\CobVNlX.exe
  C:\Windows\System\CobVNlX.exe
  2⤵
  PID:8532
- C:\Windows\System\hGdLNMG.exe
  C:\Windows\System\hGdLNMG.exe
  2⤵
  PID:8548
- C:\Windows\System\krPXWlr.exe
  C:\Windows\System\krPXWlr.exe
  2⤵
  PID:8568
- C:\Windows\System\iTqHHgx.exe
  C:\Windows\System\iTqHHgx.exe
  2⤵
  PID:8596
- C:\Windows\System\wMgqasr.exe
  C:\Windows\System\wMgqasr.exe
  2⤵
  PID:8612
- C:\Windows\System\UcJYlqS.exe
  C:\Windows\System\UcJYlqS.exe
  2⤵
  PID:8632
- C:\Windows\System\dBogeDP.exe
  C:\Windows\System\dBogeDP.exe
  2⤵
  PID:8656
- C:\Windows\System\vbEduNO.exe
  C:\Windows\System\vbEduNO.exe
  2⤵
  PID:8676
- C:\Windows\System\vKDoIqi.exe
  C:\Windows\System\vKDoIqi.exe
  2⤵
  PID:8756
- C:\Windows\System\HgCxEbP.exe
  C:\Windows\System\HgCxEbP.exe
  2⤵
  PID:8776
- C:\Windows\System\kNyqvog.exe
  C:\Windows\System\kNyqvog.exe
  2⤵
  PID:8800
- C:\Windows\System\VYASWdF.exe
  C:\Windows\System\VYASWdF.exe
  2⤵
  PID:8840
- C:\Windows\System\sdesYAK.exe
  C:\Windows\System\sdesYAK.exe
  2⤵
  PID:8872
- C:\Windows\System\AABbsXQ.exe
  C:\Windows\System\AABbsXQ.exe
  2⤵
  PID:8904
- C:\Windows\System\zcojCSk.exe
  C:\Windows\System\zcojCSk.exe
  2⤵
  PID:8940
- C:\Windows\System\UZnmDrg.exe
  C:\Windows\System\UZnmDrg.exe
  2⤵
  PID:8960
- C:\Windows\System\zAOpxso.exe
  C:\Windows\System\zAOpxso.exe
  2⤵
  PID:9036
- C:\Windows\System\TyMxqze.exe
  C:\Windows\System\TyMxqze.exe
  2⤵
  PID:9056
- C:\Windows\System\MbSGfDs.exe
  C:\Windows\System\MbSGfDs.exe
  2⤵
  PID:9072
- C:\Windows\System\aAOMnlP.exe
  C:\Windows\System\aAOMnlP.exe
  2⤵
  PID:9092
- C:\Windows\System\hhqSMfO.exe
  C:\Windows\System\hhqSMfO.exe
  2⤵
  PID:9112
- C:\Windows\System\JDaZeTK.exe
  C:\Windows\System\JDaZeTK.exe
  2⤵
  PID:9132
- C:\Windows\System\mOaogNj.exe
  C:\Windows\System\mOaogNj.exe
  2⤵
  PID:9176
- C:\Windows\System\bsRautD.exe
  C:\Windows\System\bsRautD.exe
  2⤵
  PID:9196
- C:\Windows\System\JYsCZTp.exe
  C:\Windows\System\JYsCZTp.exe
  2⤵
  PID:7848
- C:\Windows\System\eXxfAhm.exe
  C:\Windows\System\eXxfAhm.exe
  2⤵
  PID:8320
- C:\Windows\System\tVXLYRh.exe
  C:\Windows\System\tVXLYRh.exe
  2⤵
  PID:8340
- C:\Windows\System\VAslXqf.exe
  C:\Windows\System\VAslXqf.exe
  2⤵
  PID:8396
- C:\Windows\System\CFcGFxY.exe
  C:\Windows\System\CFcGFxY.exe
  2⤵
  PID:8476
- C:\Windows\System\jdpgXuV.exe
  C:\Windows\System\jdpgXuV.exe
  2⤵
  PID:8576
- C:\Windows\System\nJOEtLY.exe
  C:\Windows\System\nJOEtLY.exe
  2⤵
  PID:8560
- C:\Windows\System\PzHuVzQ.exe
  C:\Windows\System\PzHuVzQ.exe
  2⤵
  PID:8604
- C:\Windows\System\hjVVrly.exe
  C:\Windows\System\hjVVrly.exe
  2⤵
  PID:8672
- C:\Windows\System\NFZmdRw.exe
  C:\Windows\System\NFZmdRw.exe
  2⤵
  PID:8784
- C:\Windows\System\fXTUlkB.exe
  C:\Windows\System\fXTUlkB.exe
  2⤵
  PID:8916
- C:\Windows\System\TeehBOi.exe
  C:\Windows\System\TeehBOi.exe
  2⤵
  PID:8924
- C:\Windows\System\nFJmBAB.exe
  C:\Windows\System\nFJmBAB.exe
  2⤵
  PID:8932
- C:\Windows\System\YdJODRo.exe
  C:\Windows\System\YdJODRo.exe
  2⤵
  PID:9064
- C:\Windows\System\SqkqweW.exe
  C:\Windows\System\SqkqweW.exe
  2⤵
  PID:9204
- C:\Windows\System\LlwotqY.exe
  C:\Windows\System\LlwotqY.exe
  2⤵
  PID:9188
- C:\Windows\System\mRkKiIr.exe
  C:\Windows\System\mRkKiIr.exe
  2⤵
  PID:8292
- C:\Windows\System\iuGfCuE.exe
  C:\Windows\System\iuGfCuE.exe
  2⤵
  PID:8360
- C:\Windows\System\qOSiyVE.exe
  C:\Windows\System\qOSiyVE.exe
  2⤵
  PID:8480
- C:\Windows\System\QljkdIo.exe
  C:\Windows\System\QljkdIo.exe
  2⤵
  PID:8748
- C:\Windows\System\YaxzgQf.exe
  C:\Windows\System\YaxzgQf.exe
  2⤵
  PID:8764
- C:\Windows\System\oyyPKnC.exe
  C:\Windows\System\oyyPKnC.exe
  2⤵
  PID:8244
- C:\Windows\System\tajPvvV.exe
  C:\Windows\System\tajPvvV.exe
  2⤵
  PID:8464
- C:\Windows\System\pOqciSG.exe
  C:\Windows\System\pOqciSG.exe
  2⤵
  PID:8808
- C:\Windows\System\etoWARE.exe
  C:\Windows\System\etoWARE.exe
  2⤵
  PID:8296
- C:\Windows\System\kprsIIU.exe
  C:\Windows\System\kprsIIU.exe
  2⤵
  PID:8772
- C:\Windows\System\lmpPdln.exe
  C:\Windows\System\lmpPdln.exe
  2⤵
  PID:9228
- C:\Windows\System\YTBmzLh.exe
  C:\Windows\System\YTBmzLh.exe
  2⤵
  PID:9252
- C:\Windows\System\NBsHFyM.exe
  C:\Windows\System\NBsHFyM.exe
  2⤵
  PID:9316
- C:\Windows\System\FxoPQeS.exe
  C:\Windows\System\FxoPQeS.exe
  2⤵
  PID:9332
- C:\Windows\System\KOijZZy.exe
  C:\Windows\System\KOijZZy.exe
  2⤵
  PID:9352
- C:\Windows\System\EsJAKaf.exe
  C:\Windows\System\EsJAKaf.exe
  2⤵
  PID:9372
- C:\Windows\System\AGLSGqd.exe
  C:\Windows\System\AGLSGqd.exe
  2⤵
  PID:9396
- C:\Windows\System\raussjx.exe
  C:\Windows\System\raussjx.exe
  2⤵
  PID:9416
- C:\Windows\System\YpfrHcT.exe
  C:\Windows\System\YpfrHcT.exe
  2⤵
  PID:9440
- C:\Windows\System\GYKVJnw.exe
  C:\Windows\System\GYKVJnw.exe
  2⤵
  PID:9464
- C:\Windows\System\wslAMyd.exe
  C:\Windows\System\wslAMyd.exe
  2⤵
  PID:9488
- C:\Windows\System\eHFJIJk.exe
  C:\Windows\System\eHFJIJk.exe
  2⤵
  PID:9524
- C:\Windows\System\AmFgJTA.exe
  C:\Windows\System\AmFgJTA.exe
  2⤵
  PID:9544
- C:\Windows\System\zOBvMTI.exe
  C:\Windows\System\zOBvMTI.exe
  2⤵
  PID:9584
- C:\Windows\System\qumLEsH.exe
  C:\Windows\System\qumLEsH.exe
  2⤵
  PID:9620
- C:\Windows\System\CIqMANy.exe
  C:\Windows\System\CIqMANy.exe
  2⤵
  PID:9640
- C:\Windows\System\uxrJdEY.exe
  C:\Windows\System\uxrJdEY.exe
  2⤵
  PID:9676
- C:\Windows\System\LaNAnBb.exe
  C:\Windows\System\LaNAnBb.exe
  2⤵
  PID:9712
- C:\Windows\System\KuVmRzn.exe
  C:\Windows\System\KuVmRzn.exe
  2⤵
  PID:9744
- C:\Windows\System\zYJOMwo.exe
  C:\Windows\System\zYJOMwo.exe
  2⤵
  PID:9772
- C:\Windows\System\cnFmvXj.exe
  C:\Windows\System\cnFmvXj.exe
  2⤵
  PID:9792
- C:\Windows\System\vLROnkx.exe
  C:\Windows\System\vLROnkx.exe
  2⤵
  PID:9812
- C:\Windows\System\petJrXr.exe
  C:\Windows\System\petJrXr.exe
  2⤵
  PID:9832
- C:\Windows\System\MkTukql.exe
  C:\Windows\System\MkTukql.exe
  2⤵
  PID:9856
- C:\Windows\System\gciMREv.exe
  C:\Windows\System\gciMREv.exe
  2⤵
  PID:9872
- C:\Windows\System\IuBfhcz.exe
  C:\Windows\System\IuBfhcz.exe
  2⤵
  PID:9924
- C:\Windows\System\dIklKQh.exe
  C:\Windows\System\dIklKQh.exe
  2⤵
  PID:9940
- C:\Windows\System\FawHybM.exe
  C:\Windows\System\FawHybM.exe
  2⤵
  PID:9964
- C:\Windows\System\PSxZNar.exe
  C:\Windows\System\PSxZNar.exe
  2⤵
  PID:10012
- C:\Windows\System\GwAttIM.exe
  C:\Windows\System\GwAttIM.exe
  2⤵
  PID:10032
- C:\Windows\System\xEIgwPv.exe
  C:\Windows\System\xEIgwPv.exe
  2⤵
  PID:10052
- C:\Windows\System\RShHltJ.exe
  C:\Windows\System\RShHltJ.exe
  2⤵
  PID:10088
- C:\Windows\System\VNivuNN.exe
  C:\Windows\System\VNivuNN.exe
  2⤵
  PID:10112
- C:\Windows\System\bWYmoPp.exe
  C:\Windows\System\bWYmoPp.exe
  2⤵
  PID:10128
- C:\Windows\System\LkTtMSD.exe
  C:\Windows\System\LkTtMSD.exe
  2⤵
  PID:10148
- C:\Windows\System\AAFvzIN.exe
  C:\Windows\System\AAFvzIN.exe
  2⤵
  PID:10212
- C:\Windows\System\VXCKprj.exe
  C:\Windows\System\VXCKprj.exe
  2⤵
  PID:9272
- C:\Windows\System\vhVpvno.exe
  C:\Windows\System\vhVpvno.exe
  2⤵
  PID:9296
- C:\Windows\System\wvaQdwG.exe
  C:\Windows\System\wvaQdwG.exe
  2⤵
  PID:8544
- C:\Windows\System\GahcPIP.exe
  C:\Windows\System\GahcPIP.exe
  2⤵
  PID:9460
- C:\Windows\System\MgZDpLH.exe
  C:\Windows\System\MgZDpLH.exe
  2⤵
  PID:9576
- C:\Windows\System\yuJYBzz.exe
  C:\Windows\System\yuJYBzz.exe
  2⤵
  PID:9540
- C:\Windows\System\RbcIuqJ.exe
  C:\Windows\System\RbcIuqJ.exe
  2⤵
  PID:9652
- C:\Windows\System\vAHXhdI.exe
  C:\Windows\System\vAHXhdI.exe
  2⤵
  PID:9700
- C:\Windows\System\bpuOgbW.exe
  C:\Windows\System\bpuOgbW.exe
  2⤵
  PID:9820
- C:\Windows\System\ZvYcRYd.exe
  C:\Windows\System\ZvYcRYd.exe
  2⤵
  PID:9880
- C:\Windows\System\FywJAKu.exe
  C:\Windows\System\FywJAKu.exe
  2⤵
  PID:9844
- C:\Windows\System\cOzkgfJ.exe
  C:\Windows\System\cOzkgfJ.exe
  2⤵
  PID:9960
- C:\Windows\System\mgEZHLI.exe
  C:\Windows\System\mgEZHLI.exe
  2⤵
  PID:9900
- C:\Windows\System\WwWSlTO.exe
  C:\Windows\System\WwWSlTO.exe
  2⤵
  PID:10084
- C:\Windows\System\VPwXpNl.exe
  C:\Windows\System\VPwXpNl.exe
  2⤵
  PID:10176
- C:\Windows\System\PdSGAUu.exe
  C:\Windows\System\PdSGAUu.exe
  2⤵
  PID:10236
- C:\Windows\System\gdaopjQ.exe
  C:\Windows\System\gdaopjQ.exe
  2⤵
  PID:9436
- C:\Windows\System\xkxMgkQ.exe
  C:\Windows\System\xkxMgkQ.exe
  2⤵
  PID:9484
- C:\Windows\System\MAkjMZz.exe
  C:\Windows\System\MAkjMZz.exe
  2⤵
  PID:9784
- C:\Windows\System\oIHinMG.exe
  C:\Windows\System\oIHinMG.exe
  2⤵
  PID:9788
- C:\Windows\System\GyRmcWW.exe
  C:\Windows\System\GyRmcWW.exe
  2⤵
  PID:10004
- C:\Windows\System\BxwfCBu.exe
  C:\Windows\System\BxwfCBu.exe
  2⤵
  PID:10080
- C:\Windows\System\zMfjJUw.exe
  C:\Windows\System\zMfjJUw.exe
  2⤵
  PID:10200
- C:\Windows\System\bgpXfuv.exe
  C:\Windows\System\bgpXfuv.exe
  2⤵
  PID:9512
- C:\Windows\System\SmkgYWM.exe
  C:\Windows\System\SmkgYWM.exe
  2⤵
  PID:10192
- C:\Windows\System\aelABtJ.exe
  C:\Windows\System\aelABtJ.exe
  2⤵
  PID:9720
- C:\Windows\System\BeVWprv.exe
  C:\Windows\System\BeVWprv.exe
  2⤵
  PID:1084
- C:\Windows\System\gJBvfHi.exe
  C:\Windows\System\gJBvfHi.exe
  2⤵
  PID:10276
- C:\Windows\System\JTJfrSV.exe
  C:\Windows\System\JTJfrSV.exe
  2⤵
  PID:10300
- C:\Windows\System\LIQkXJJ.exe
  C:\Windows\System\LIQkXJJ.exe
  2⤵
  PID:10320
- C:\Windows\System\sIkYazU.exe
  C:\Windows\System\sIkYazU.exe
  2⤵
  PID:10344
- C:\Windows\System\oPSGaBc.exe
  C:\Windows\System\oPSGaBc.exe
  2⤵
  PID:10364
- C:\Windows\System\ULEyWko.exe
  C:\Windows\System\ULEyWko.exe
  2⤵
  PID:10392
- C:\Windows\System\CzqiyvW.exe
  C:\Windows\System\CzqiyvW.exe
  2⤵
  PID:10408
- C:\Windows\System\CcyNRsl.exe
  C:\Windows\System\CcyNRsl.exe
  2⤵
  PID:10436
- C:\Windows\System\kKRDdlj.exe
  C:\Windows\System\kKRDdlj.exe
  2⤵
  PID:10504
- C:\Windows\System\ngAUVKI.exe
  C:\Windows\System\ngAUVKI.exe
  2⤵
  PID:10552
- C:\Windows\System\ckbTsjD.exe
  C:\Windows\System\ckbTsjD.exe
  2⤵
  PID:10596
- C:\Windows\System\RZERDHI.exe
  C:\Windows\System\RZERDHI.exe
  2⤵
  PID:10624
- C:\Windows\System\EgnrpPc.exe
  C:\Windows\System\EgnrpPc.exe
  2⤵
  PID:10644
- C:\Windows\System\gcBMKyf.exe
  C:\Windows\System\gcBMKyf.exe
  2⤵
  PID:10728
- C:\Windows\System\qfcStRD.exe
  C:\Windows\System\qfcStRD.exe
  2⤵
  PID:10760
- C:\Windows\System\qbPSHYL.exe
  C:\Windows\System\qbPSHYL.exe
  2⤵
  PID:10800
- C:\Windows\System\QVZmWfC.exe
  C:\Windows\System\QVZmWfC.exe
  2⤵
  PID:10848
- C:\Windows\System\MYEZuqg.exe
  C:\Windows\System\MYEZuqg.exe
  2⤵
  PID:10880
- C:\Windows\System\VgihGyd.exe
  C:\Windows\System\VgihGyd.exe
  2⤵
  PID:10904
- C:\Windows\System\XAXDKle.exe
  C:\Windows\System\XAXDKle.exe
  2⤵
  PID:10920
- C:\Windows\System\JMFGyIp.exe
  C:\Windows\System\JMFGyIp.exe
  2⤵
  PID:10940
- C:\Windows\System\lGkLQJP.exe
  C:\Windows\System\lGkLQJP.exe
  2⤵
  PID:10996
- C:\Windows\System\iwXkhet.exe
  C:\Windows\System\iwXkhet.exe
  2⤵
  PID:11012
- C:\Windows\System\OcmeRUd.exe
  C:\Windows\System\OcmeRUd.exe
  2⤵
  PID:11036
- C:\Windows\System\LwDrPig.exe
  C:\Windows\System\LwDrPig.exe
  2⤵
  PID:11056
- C:\Windows\System\bcTFwuJ.exe
  C:\Windows\System\bcTFwuJ.exe
  2⤵
  PID:11080
- C:\Windows\System\mHFAEwJ.exe
  C:\Windows\System\mHFAEwJ.exe
  2⤵
  PID:11132
- C:\Windows\System\iVCpiAj.exe
  C:\Windows\System\iVCpiAj.exe
  2⤵
  PID:11156
- C:\Windows\System\tunCdNq.exe
  C:\Windows\System\tunCdNq.exe
  2⤵
  PID:11176
- C:\Windows\System\dAqnzzy.exe
  C:\Windows\System\dAqnzzy.exe
  2⤵
  PID:11212
- C:\Windows\System\LgRWlMW.exe
  C:\Windows\System\LgRWlMW.exe
  2⤵
  PID:11232
- C:\Windows\System\NPtuqAL.exe
  C:\Windows\System\NPtuqAL.exe
  2⤵
  PID:11260
- C:\Windows\System\UawCohK.exe
  C:\Windows\System\UawCohK.exe
  2⤵
  PID:10296
- C:\Windows\System\fIqdbOo.exe
  C:\Windows\System\fIqdbOo.exe
  2⤵
  PID:10372
- C:\Windows\System\FCJYlif.exe
  C:\Windows\System\FCJYlif.exe
  2⤵
  PID:10356
- C:\Windows\System\qfJuOEO.exe
  C:\Windows\System\qfJuOEO.exe
  2⤵
  PID:10404
- C:\Windows\System\QWVnNVG.exe
  C:\Windows\System\QWVnNVG.exe
  2⤵
  PID:10500
- C:\Windows\System\CUpdfej.exe
  C:\Windows\System\CUpdfej.exe
  2⤵
  PID:5032
- C:\Windows\System\irmumod.exe
  C:\Windows\System\irmumod.exe
  2⤵
  PID:10544
- C:\Windows\System\NRvvESk.exe
  C:\Windows\System\NRvvESk.exe
  2⤵
  PID:10620
- C:\Windows\System\VHTKOVd.exe
  C:\Windows\System\VHTKOVd.exe
  2⤵
  PID:10484
- C:\Windows\System\fXMqvzD.exe
  C:\Windows\System\fXMqvzD.exe
  2⤵
  PID:10680
- C:\Windows\System\YeCclda.exe
  C:\Windows\System\YeCclda.exe
  2⤵
  PID:10708
- C:\Windows\System\QaUnQzF.exe
  C:\Windows\System\QaUnQzF.exe
  2⤵
  PID:10736
- C:\Windows\System\QcycQea.exe
  C:\Windows\System\QcycQea.exe
  2⤵
  PID:10816
- C:\Windows\System\UNRhWUR.exe
  C:\Windows\System\UNRhWUR.exe
  2⤵
  PID:10876
- C:\Windows\System\EttpDIc.exe
  C:\Windows\System\EttpDIc.exe
  2⤵
  PID:10932
- C:\Windows\System\mdVpYln.exe
  C:\Windows\System\mdVpYln.exe
  2⤵
  PID:10988
- C:\Windows\System\OPUdCZs.exe
  C:\Windows\System\OPUdCZs.exe
  2⤵
  PID:11068
- C:\Windows\System\iptpikJ.exe
  C:\Windows\System\iptpikJ.exe
  2⤵
  PID:11152
- C:\Windows\System\zRcrsxq.exe
  C:\Windows\System\zRcrsxq.exe
  2⤵
  PID:11240
- C:\Windows\System\mCJamdH.exe
  C:\Windows\System\mCJamdH.exe
  2⤵
  PID:11256
- C:\Windows\System\xKNPyyS.exe
  C:\Windows\System\xKNPyyS.exe
  2⤵
  PID:10332
- C:\Windows\System\TurZRRT.exe
  C:\Windows\System\TurZRRT.exe
  2⤵
  PID:10468
- C:\Windows\System\fIzaVWy.exe
  C:\Windows\System\fIzaVWy.exe
  2⤵
  PID:10536
- C:\Windows\System\PridOTT.exe
  C:\Windows\System\PridOTT.exe
  2⤵
  PID:10532
- C:\Windows\System\EGGFTmZ.exe
  C:\Windows\System\EGGFTmZ.exe
  2⤵
  PID:10564
- C:\Windows\System\RrIbIqD.exe
  C:\Windows\System\RrIbIqD.exe
  2⤵
  PID:10668
- C:\Windows\System\jvHyHwl.exe
  C:\Windows\System\jvHyHwl.exe
  2⤵
  PID:1544
- C:\Windows\System\GIypUQT.exe
  C:\Windows\System\GIypUQT.exe
  2⤵
  PID:11092
- C:\Windows\System\JaNkdFe.exe
  C:\Windows\System\JaNkdFe.exe
  2⤵
  PID:11224
- C:\Windows\System\dhQcYxw.exe
  C:\Windows\System\dhQcYxw.exe
  2⤵
  PID:2904
- C:\Windows\System\oTEquif.exe
  C:\Windows\System\oTEquif.exe
  2⤵
  PID:10452
- C:\Windows\System\OnAHlan.exe
  C:\Windows\System\OnAHlan.exe
  2⤵
  PID:404
- C:\Windows\System\yQCdOrs.exe
  C:\Windows\System\yQCdOrs.exe
  2⤵
  PID:10968
- C:\Windows\System\scddKfK.exe
  C:\Windows\System\scddKfK.exe
  2⤵
  PID:10812
- C:\Windows\System\dQOSUNm.exe
  C:\Windows\System\dQOSUNm.exe
  2⤵
  PID:11272
- C:\Windows\System\yRoydKL.exe
  C:\Windows\System\yRoydKL.exe
  2⤵
  PID:11292
- C:\Windows\System\vlMLFzo.exe
  C:\Windows\System\vlMLFzo.exe
  2⤵
  PID:11316
- C:\Windows\System\MXkUcoO.exe
  C:\Windows\System\MXkUcoO.exe
  2⤵
  PID:11336
- C:\Windows\System\DzTGXYU.exe
  C:\Windows\System\DzTGXYU.exe
  2⤵
  PID:11380
- C:\Windows\System\ZFMnMHN.exe
  C:\Windows\System\ZFMnMHN.exe
  2⤵
  PID:11420
- C:\Windows\System\LRnHGwR.exe
  C:\Windows\System\LRnHGwR.exe
  2⤵
  PID:11440
- C:\Windows\System\NcRcYcI.exe
  C:\Windows\System\NcRcYcI.exe
  2⤵
  PID:11456
- C:\Windows\System\DuyQKnI.exe
  C:\Windows\System\DuyQKnI.exe
  2⤵
  PID:11516
- C:\Windows\System\SbdXMUt.exe
  C:\Windows\System\SbdXMUt.exe
  2⤵
  PID:11532
- C:\Windows\System\ODaDLEP.exe
  C:\Windows\System\ODaDLEP.exe
  2⤵
  PID:11572
- C:\Windows\System\yNnoCZV.exe
  C:\Windows\System\yNnoCZV.exe
  2⤵
  PID:11588
- C:\Windows\System\opfsjfW.exe
  C:\Windows\System\opfsjfW.exe
  2⤵
  PID:11604
- C:\Windows\System\REkAhud.exe
  C:\Windows\System\REkAhud.exe
  2⤵
  PID:11628
- C:\Windows\System\olsPLaz.exe
  C:\Windows\System\olsPLaz.exe
  2⤵
  PID:11644
- C:\Windows\System\RMqUsHm.exe
  C:\Windows\System\RMqUsHm.exe
  2⤵
  PID:11664
- C:\Windows\System\NUuiChP.exe
  C:\Windows\System\NUuiChP.exe
  2⤵
  PID:11684
- C:\Windows\System\xIuTYPM.exe
  C:\Windows\System\xIuTYPM.exe
  2⤵
  PID:11700
- C:\Windows\System\cGyFVUE.exe
  C:\Windows\System\cGyFVUE.exe
  2⤵
  PID:11728
- C:\Windows\System\DLudgUr.exe
  C:\Windows\System\DLudgUr.exe
  2⤵
  PID:11744
- C:\Windows\System\iXCdFnh.exe
  C:\Windows\System\iXCdFnh.exe
  2⤵
  PID:11788
- C:\Windows\System\ICZTfig.exe
  C:\Windows\System\ICZTfig.exe
  2⤵
  PID:11808
- C:\Windows\System\YyZolHr.exe
  C:\Windows\System\YyZolHr.exe
  2⤵
  PID:11852
- C:\Windows\System\zykwYUt.exe
  C:\Windows\System\zykwYUt.exe
  2⤵
  PID:11872
- C:\Windows\System\ELchmpx.exe
  C:\Windows\System\ELchmpx.exe
  2⤵
  PID:11892
- C:\Windows\System\ePeabnM.exe
  C:\Windows\System\ePeabnM.exe
  2⤵
  PID:11920
- C:\Windows\System\Frnuirv.exe
  C:\Windows\System\Frnuirv.exe
  2⤵
  PID:11952
- C:\Windows\System\ZxpipAq.exe
  C:\Windows\System\ZxpipAq.exe
  2⤵
  PID:11996
- C:\Windows\System\cOzJXff.exe
  C:\Windows\System\cOzJXff.exe
  2⤵
  PID:12020
- C:\Windows\System\rlcREyD.exe
  C:\Windows\System\rlcREyD.exe
  2⤵
  PID:12044
- C:\Windows\System\sdSxTZK.exe
  C:\Windows\System\sdSxTZK.exe
  2⤵
  PID:12068
- C:\Windows\System\EInmdNm.exe
  C:\Windows\System\EInmdNm.exe
  2⤵
  PID:12084
- C:\Windows\System\iCAKVGq.exe
  C:\Windows\System\iCAKVGq.exe
  2⤵
  PID:12120
- C:\Windows\System\EsUGehl.exe
  C:\Windows\System\EsUGehl.exe
  2⤵
  PID:12140
- C:\Windows\System\DpudOsK.exe
  C:\Windows\System\DpudOsK.exe
  2⤵
  PID:12168
- C:\Windows\System\ZMqoEik.exe
  C:\Windows\System\ZMqoEik.exe
  2⤵
  PID:12240
- C:\Windows\System\yGcOiLE.exe
  C:\Windows\System\yGcOiLE.exe
  2⤵
  PID:12260
- C:\Windows\System\fxKVyCP.exe
  C:\Windows\System\fxKVyCP.exe
  2⤵
  PID:12280
- C:\Windows\System\FoMXsaP.exe
  C:\Windows\System\FoMXsaP.exe
  2⤵
  PID:10788
- C:\Windows\System\ZYcqruC.exe
  C:\Windows\System\ZYcqruC.exe
  2⤵
  PID:11280
- C:\Windows\System\BiBbyBH.exe
  C:\Windows\System\BiBbyBH.exe
  2⤵
  PID:11364
- C:\Windows\System\CCgZEir.exe
  C:\Windows\System\CCgZEir.exe
  2⤵
  PID:11400
- C:\Windows\System\XRlXCXT.exe
  C:\Windows\System\XRlXCXT.exe
  2⤵
  PID:11452
- C:\Windows\System\TvXDAqA.exe
  C:\Windows\System\TvXDAqA.exe
  2⤵
  PID:11564
- C:\Windows\System\Rszjavt.exe
  C:\Windows\System\Rszjavt.exe
  2⤵
  PID:11620
- C:\Windows\System\VLoqYJM.exe
  C:\Windows\System\VLoqYJM.exe
  2⤵
  PID:11772
- C:\Windows\System\disjPZP.exe
  C:\Windows\System\disjPZP.exe
  2⤵
  PID:11904
- C:\Windows\System\dvDKrlY.exe
  C:\Windows\System\dvDKrlY.exe
  2⤵
  PID:11960
- C:\Windows\System\iGywPFX.exe
  C:\Windows\System\iGywPFX.exe
  2⤵
  PID:12028
- C:\Windows\System\rmybtXU.exe
  C:\Windows\System\rmybtXU.exe
  2⤵
  PID:12016
- C:\Windows\System\jNwPGbI.exe
  C:\Windows\System\jNwPGbI.exe
  2⤵
  PID:12160
- C:\Windows\System\MzGHFxi.exe
  C:\Windows\System\MzGHFxi.exe
  2⤵
  PID:12232
- C:\Windows\System\oFKCkqm.exe
  C:\Windows\System\oFKCkqm.exe
  2⤵
  PID:12252
- C:\Windows\System\gcPCXmM.exe
  C:\Windows\System\gcPCXmM.exe
  2⤵
  PID:11344
- C:\Windows\System\JSosgKk.exe
  C:\Windows\System\JSosgKk.exe
  2⤵
  PID:11372
- C:\Windows\System\Mtkflpr.exe
  C:\Windows\System\Mtkflpr.exe
  2⤵
  PID:11696
- C:\Windows\System\yVkannx.exe
  C:\Windows\System\yVkannx.exe
  2⤵
  PID:11756
- C:\Windows\System\gsOOQep.exe
  C:\Windows\System\gsOOQep.exe
  2⤵
  PID:11848
- C:\Windows\System\yhVMgas.exe
  C:\Windows\System\yhVMgas.exe
  2⤵
  PID:12132
- C:\Windows\System\JoKlTlI.exe
  C:\Windows\System\JoKlTlI.exe
  2⤵
  PID:11328
- C:\Windows\System\IpoOVbf.exe
  C:\Windows\System\IpoOVbf.exe
  2⤵
  PID:11524
- C:\Windows\System\sjvrMjc.exe
  C:\Windows\System\sjvrMjc.exe
  2⤵
  PID:11596
- C:\Windows\System\BrRMYUM.exe
  C:\Windows\System\BrRMYUM.exe
  2⤵
  PID:12228
- C:\Windows\System\LDedIOB.exe
  C:\Windows\System\LDedIOB.exe
  2⤵
  PID:11548
- C:\Windows\System\EIjsYhn.exe
  C:\Windows\System\EIjsYhn.exe
  2⤵
  PID:12300
- C:\Windows\System\kqBOxFQ.exe
  C:\Windows\System\kqBOxFQ.exe
  2⤵
  PID:12316
- C:\Windows\System\ClbKyIH.exe
  C:\Windows\System\ClbKyIH.exe
  2⤵
  PID:12336
- C:\Windows\System\RHnzAEV.exe
  C:\Windows\System\RHnzAEV.exe
  2⤵
  PID:12356
- C:\Windows\System\IxppSng.exe
  C:\Windows\System\IxppSng.exe
  2⤵
  PID:12408
- C:\Windows\System\aBkpanW.exe
  C:\Windows\System\aBkpanW.exe
  2⤵
  PID:12456
- C:\Windows\System\ArjmWoL.exe
  C:\Windows\System\ArjmWoL.exe
  2⤵
  PID:12480
- C:\Windows\System\DmvZhJy.exe
  C:\Windows\System\DmvZhJy.exe
  2⤵
  PID:12500
- C:\Windows\System\gbphMJU.exe
  C:\Windows\System\gbphMJU.exe
  2⤵
  PID:12524
- C:\Windows\System\iliwjXc.exe
  C:\Windows\System\iliwjXc.exe
  2⤵
  PID:12544
- C:\Windows\System\MbOVTsh.exe
  C:\Windows\System\MbOVTsh.exe
  2⤵
  PID:12592
- C:\Windows\System\uCUZlqx.exe
  C:\Windows\System\uCUZlqx.exe
  2⤵
  PID:12612
- C:\Windows\System\tpMfnLy.exe
  C:\Windows\System\tpMfnLy.exe
  2⤵
  PID:12640
- C:\Windows\System\pDzTiQi.exe
  C:\Windows\System\pDzTiQi.exe
  2⤵
  PID:12664
- C:\Windows\System\GElNpTo.exe
  C:\Windows\System\GElNpTo.exe
  2⤵
  PID:12712
- C:\Windows\System\edsUoDb.exe
  C:\Windows\System\edsUoDb.exe
  2⤵
  PID:12744
- C:\Windows\System\GswPRRO.exe
  C:\Windows\System\GswPRRO.exe
  2⤵
  PID:12760
- C:\Windows\System\WpdRvrY.exe
  C:\Windows\System\WpdRvrY.exe
  2⤵
  PID:12780
- C:\Windows\System\RtDBpzS.exe
  C:\Windows\System\RtDBpzS.exe
  2⤵
  PID:12808
- C:\Windows\System\ynnXMMR.exe
  C:\Windows\System\ynnXMMR.exe
  2⤵
  PID:12828
- C:\Windows\System\pbdEyTH.exe
  C:\Windows\System\pbdEyTH.exe
  2⤵
  PID:12848
- C:\Windows\System\HsLxwOj.exe
  C:\Windows\System\HsLxwOj.exe
  2⤵
  PID:12872
- C:\Windows\System\KcqWTKq.exe
  C:\Windows\System\KcqWTKq.exe
  2⤵
  PID:12908
- C:\Windows\System\qcidKJU.exe
  C:\Windows\System\qcidKJU.exe
  2⤵
  PID:12936
- C:\Windows\System\hqxbonx.exe
  C:\Windows\System\hqxbonx.exe
  2⤵
  PID:12960
- C:\Windows\System\CrSVGxn.exe
  C:\Windows\System\CrSVGxn.exe
  2⤵
  PID:12984
- C:\Windows\System\RNIZAYK.exe
  C:\Windows\System\RNIZAYK.exe
  2⤵
  PID:13004
- C:\Windows\System\ORGUXPL.exe
  C:\Windows\System\ORGUXPL.exe
  2⤵
  PID:13036
- C:\Windows\System\hRVWjmj.exe
  C:\Windows\System\hRVWjmj.exe
  2⤵
  PID:13088
- C:\Windows\System\mDNHSxE.exe
  C:\Windows\System\mDNHSxE.exe
  2⤵
  PID:13124
- C:\Windows\System\KPSLBro.exe
  C:\Windows\System\KPSLBro.exe
  2⤵
  PID:13164
- C:\Windows\System\pNEZusz.exe
  C:\Windows\System\pNEZusz.exe
  2⤵
  PID:13184
- C:\Windows\System\sJfhNbN.exe
  C:\Windows\System\sJfhNbN.exe
  2⤵
  PID:13204
- C:\Windows\System\ieHTfGZ.exe
  C:\Windows\System\ieHTfGZ.exe
  2⤵
  PID:13224
- C:\Windows\System\mNUtYjl.exe
  C:\Windows\System\mNUtYjl.exe
  2⤵
  PID:13248
- C:\Windows\System\FHbbRDe.exe
  C:\Windows\System\FHbbRDe.exe
  2⤵
  PID:13272
- C:\Windows\System\UGWLoCi.exe
  C:\Windows\System\UGWLoCi.exe
  2⤵
  PID:13304
- C:\Windows\System\zZnnsnG.exe
  C:\Windows\System\zZnnsnG.exe
  2⤵
  PID:10896
- C:\Windows\System\ObwgWFq.exe
  C:\Windows\System\ObwgWFq.exe
  2⤵
  PID:12328
- C:\Windows\System\fiIRRpU.exe
  C:\Windows\System\fiIRRpU.exe
  2⤵
  PID:12344
- C:\Windows\System\SxePSJU.exe
  C:\Windows\System\SxePSJU.exe
  2⤵
  PID:12448
- C:\Windows\System\sshtpRs.exe
  C:\Windows\System\sshtpRs.exe
  2⤵
  PID:12540
- C:\Windows\System\XTRIhHK.exe
  C:\Windows\System\XTRIhHK.exe
  2⤵
  PID:12608
- C:\Windows\System\HJDGpRM.exe
  C:\Windows\System\HJDGpRM.exe
  2⤵
  PID:12688
- C:\Windows\System\LMWIfJt.exe
  C:\Windows\System\LMWIfJt.exe
  2⤵
  PID:12740
- C:\Windows\System\qUfHvaG.exe
  C:\Windows\System\qUfHvaG.exe
  2⤵
  PID:12840
- C:\Windows\System\VlCBsui.exe
  C:\Windows\System\VlCBsui.exe
  2⤵
  PID:12824
- C:\Windows\System\jHiiJdT.exe
  C:\Windows\System\jHiiJdT.exe
  2⤵
  PID:12904
- C:\Windows\System\eFNWutF.exe
  C:\Windows\System\eFNWutF.exe
  2⤵
  PID:12968
- C:\Windows\System\cbTmGRD.exe
  C:\Windows\System\cbTmGRD.exe
  2⤵
  PID:12944
- C:\Windows\System\RQfBrMl.exe
  C:\Windows\System\RQfBrMl.exe
  2⤵
  PID:13080
- C:\Windows\System\aDYhBNx.exe
  C:\Windows\System\aDYhBNx.exe
  2⤵
  PID:13172
- C:\Windows\System\sseIsqK.exe
  C:\Windows\System\sseIsqK.exe
  2⤵
  PID:13232
- C:\Windows\System\uFuDQyt.exe
  C:\Windows\System\uFuDQyt.exe
  2⤵
  PID:13300
- C:\Windows\System\EFkozzw.exe
  C:\Windows\System\EFkozzw.exe
  2⤵
  PID:12392
- C:\Windows\System\nAUqYbN.exe
  C:\Windows\System\nAUqYbN.exe
  2⤵
  PID:12576
- C:\Windows\System\sCZhbsd.exe
  C:\Windows\System\sCZhbsd.exe
  2⤵
  PID:12956
- C:\Windows\System\qGGoase.exe
  C:\Windows\System\qGGoase.exe
  2⤵
  PID:13100
- C:\Windows\System\EeaiyDB.exe
  C:\Windows\System\EeaiyDB.exe
  2⤵
  PID:12864
- C:\Windows\System\HRrJfXx.exe
  C:\Windows\System\HRrJfXx.exe
  2⤵
  PID:13268
- C:\Windows\System\pgJIZPq.exe
  C:\Windows\System\pgJIZPq.exe
  2⤵
  PID:3328
- C:\Windows\System\pOfkAMF.exe
  C:\Windows\System\pOfkAMF.exe
  2⤵
  PID:4556
- C:\Windows\System\OQnXqef.exe
  C:\Windows\System\OQnXqef.exe
  2⤵
  PID:12508
- C:\Windows\System\JHMfnxb.exe
  C:\Windows\System\JHMfnxb.exe
  2⤵
  PID:12772
- C:\Windows\System\hGfXfXI.exe
  C:\Windows\System\hGfXfXI.exe
  2⤵
  PID:13148
- C:\Windows\System\ShTRXjA.exe
  C:\Windows\System\ShTRXjA.exe
  2⤵
  PID:3688
- C:\Windows\System\ByHHJZJ.exe
  C:\Windows\System\ByHHJZJ.exe
  2⤵
  PID:13000
- C:\Windows\System\slpOJed.exe
  C:\Windows\System\slpOJed.exe
  2⤵
  PID:13032
- C:\Windows\System\NAUtzRj.exe
  C:\Windows\System\NAUtzRj.exe
  2⤵
  PID:13324
- C:\Windows\System\FRzcsNo.exe
  C:\Windows\System\FRzcsNo.exe
  2⤵
  PID:13348
- C:\Windows\System\LoOymJe.exe
  C:\Windows\System\LoOymJe.exe
  2⤵
  PID:13380
- C:\Windows\System\FoWRzZP.exe
  C:\Windows\System\FoWRzZP.exe
  2⤵
  PID:13404
- C:\Windows\System\jkyTCEa.exe
  C:\Windows\System\jkyTCEa.exe
  2⤵
  PID:13428
- C:\Windows\System\CVnnTRP.exe
  C:\Windows\System\CVnnTRP.exe
  2⤵
  PID:13448
- C:\Windows\System\hgiRZrx.exe
  C:\Windows\System\hgiRZrx.exe
  2⤵
  PID:13488
- C:\Windows\System\fRAqYoh.exe
  C:\Windows\System\fRAqYoh.exe
  2⤵
  PID:13540
- C:\Windows\System\rxJVJLu.exe
  C:\Windows\System\rxJVJLu.exe
  2⤵
  PID:13572
- C:\Windows\System\OagGssd.exe
  C:\Windows\System\OagGssd.exe
  2⤵
  PID:13600
- C:\Windows\System\aqAHisu.exe
  C:\Windows\System\aqAHisu.exe
  2⤵
  PID:13616
- C:\Windows\System\KPvbBaT.exe
  C:\Windows\System\KPvbBaT.exe
  2⤵
  PID:13648
- C:\Windows\System\hsdkLua.exe
  C:\Windows\System\hsdkLua.exe
  2⤵
  PID:13676
- C:\Windows\System\yvpFpDL.exe
  C:\Windows\System\yvpFpDL.exe
  2⤵
  PID:13704
- C:\Windows\System\HSNEjte.exe
  C:\Windows\System\HSNEjte.exe
  2⤵
  PID:13724
- C:\Windows\System\MPKJndv.exe
  C:\Windows\System\MPKJndv.exe
  2⤵
  PID:13744
- C:\Windows\System\PodhVjj.exe
  C:\Windows\System\PodhVjj.exe
  2⤵
  PID:13788
- C:\Windows\System\ggomxiT.exe
  C:\Windows\System\ggomxiT.exe
  2⤵
  PID:13820
- C:\Windows\System\iFGTFRf.exe
  C:\Windows\System\iFGTFRf.exe
  2⤵
  PID:13844
- C:\Windows\System\BkxVKpy.exe
  C:\Windows\System\BkxVKpy.exe
  2⤵
  PID:13860
- C:\Windows\System\PwUcGeZ.exe
  C:\Windows\System\PwUcGeZ.exe
  2⤵
  PID:13880
- C:\Windows\System\KvHDTmV.exe
  C:\Windows\System\KvHDTmV.exe
  2⤵
  PID:13904
- C:\Windows\System\IYBOQNw.exe
  C:\Windows\System\IYBOQNw.exe
  2⤵
  PID:13924
- C:\Windows\System\lgvrEnQ.exe
  C:\Windows\System\lgvrEnQ.exe
  2⤵
  PID:13944
- C:\Windows\System\pQYhgbN.exe
  C:\Windows\System\pQYhgbN.exe
  2⤵
  PID:14000
- C:\Windows\System\PflyvlK.exe
  C:\Windows\System\PflyvlK.exe
  2⤵
  PID:14032
- C:\Windows\System\CgmiPau.exe
  C:\Windows\System\CgmiPau.exe
  2⤵
  PID:14052
- C:\Windows\System\ZESHnvW.exe
  C:\Windows\System\ZESHnvW.exe
  2⤵
  PID:14076
- C:\Windows\System\rPHvsJp.exe
  C:\Windows\System\rPHvsJp.exe
  2⤵
  PID:14116
- C:\Windows\System\LtPzNNx.exe
  C:\Windows\System\LtPzNNx.exe
  2⤵
  PID:14144
- C:\Windows\System\AvCAble.exe
  C:\Windows\System\AvCAble.exe
  2⤵
  PID:14196
- C:\Windows\System\bWdeBqw.exe
  C:\Windows\System\bWdeBqw.exe
  2⤵
  PID:14232
- C:\Windows\System\nvNvXMu.exe
  C:\Windows\System\nvNvXMu.exe
  2⤵
  PID:14248
- C:\Windows\System\cwYaKha.exe
  C:\Windows\System\cwYaKha.exe
  2⤵
  PID:14288
- C:\Windows\System\SuaOoUd.exe
  C:\Windows\System\SuaOoUd.exe
  2⤵
  PID:14324
- C:\Windows\System\VcVyYnI.exe
  C:\Windows\System\VcVyYnI.exe
  2⤵
  PID:12728
- C:\Windows\System\qHrelbi.exe
  C:\Windows\System\qHrelbi.exe
  2⤵
  PID:13316
- C:\Windows\System\qarbsrg.exe
  C:\Windows\System\qarbsrg.exe
  2⤵
  PID:13468
- C:\Windows\System\mnVHJef.exe
  C:\Windows\System\mnVHJef.exe
  2⤵
  PID:13396
- C:\Windows\System\iOydGyg.exe
  C:\Windows\System\iOydGyg.exe
  2⤵
  PID:13556
- C:\Windows\System\MRtGBSc.exe
  C:\Windows\System\MRtGBSc.exe
  2⤵
  PID:13608
- C:\Windows\System\hQQUfVp.exe
  C:\Windows\System\hQQUfVp.exe
  2⤵
  PID:13736
- C:\Windows\System\TDHrBoD.exe
  C:\Windows\System\TDHrBoD.exe
  2⤵
  PID:13716
- C:\Windows\System\ekdYSvz.exe
  C:\Windows\System\ekdYSvz.exe
  2⤵
  PID:13828
- C:\Windows\System\Aswzcaj.exe
  C:\Windows\System\Aswzcaj.exe
  2⤵
  PID:13796
- C:\Windows\System\oORDYLN.exe
  C:\Windows\System\oORDYLN.exe
  2⤵
  PID:13932
- C:\Windows\System\axDkWXt.exe
  C:\Windows\System\axDkWXt.exe
  2⤵
  PID:14064
- C:\Windows\System\fyMrcLF.exe
  C:\Windows\System\fyMrcLF.exe
  2⤵
  PID:14100
- C:\Windows\System\FTaAypU.exe
  C:\Windows\System\FTaAypU.exe
  2⤵
  PID:14156
- C:\Windows\System\SZkpVfD.exe
  C:\Windows\System\SZkpVfD.exe
  2⤵
  PID:14240
- C:\Windows\System\NEfkvhx.exe
  C:\Windows\System\NEfkvhx.exe
  2⤵
  PID:14284
- C:\Windows\System\GUdSFFy.exe
  C:\Windows\System\GUdSFFy.exe
  2⤵
  PID:14332
- C:\Windows\System\DdoxOGu.exe
  C:\Windows\System\DdoxOGu.exe
  2⤵
  PID:13640
- C:\Windows\System\zZHteVF.exe
  C:\Windows\System\zZHteVF.exe
  2⤵
  PID:13776
- C:\Windows\System\VjgupSs.exe
  C:\Windows\System\VjgupSs.exe
  2⤵
  PID:13768
- C:\Windows\System\NAZSSHK.exe
  C:\Windows\System\NAZSSHK.exe
  2⤵
  PID:14296

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DIhOdRl.exe

Filesize
1.4MB

MD5
199ec4655979718416220f365a1489cd

SHA1
595ccb7c1f507cb526f68c52a4f7473629c45ed2

SHA256
5f198653c3cd0551d9e83544cd42705e6bbc58fc3498ce402d88d97594ebbce3

SHA512
5f16b170fc202ef94ef020a4f299ad3f0ac7c644b11e577107b05aa9609e442681b86ccb7fc320fee07a3ad378f3b59b8a4d4e40ab9878023703d214b7342783

Download Submit
C:\Windows\System\EEknIgL.exe

Filesize
1.4MB

MD5
bbe1aa262e94b05a53ffecf098ee3f03

SHA1
386da09b2baa32de169d29db60d6801704e0b101

SHA256
2c6deae195d6df0519bebe87563a9a08baad2301569294b936701518f6c37c57

SHA512
f15d5a59a91f996168ce1babf08a55bbd49483716ea9e2b989145627899e62f1646afa54b2b5163a8e22960ee02e76e515ba276c89e8170ddab67cb53c61c560

Download Submit
C:\Windows\System\EXpOQdC.exe

Filesize
1.4MB

MD5
fc6bf9a6133280209dfb368086130825

SHA1
b199b4ddd47813624a5818b512d9582832444e52

SHA256
0059a27576949888b16015ee0f2ab9e6ad37841168412000973953984d68d0f9

SHA512
f2fa4b39c7972e94ccbe48e40c0bade0b9b81a54b0209fb6896c999e83a2bdf76c2fd24b89ace704351d94e692dd3d271e33b1c71587a58baa2efebac25fa5c6

Download Submit
C:\Windows\System\GAeUqcz.exe

Filesize
1.4MB

MD5
f3f403c4c580c92b5fe9916b929c23d4

SHA1
db9abbe9ca1738b0769208c0aaa786794ca83968

SHA256
9944deb52e6001127cfaa24d2f98879aaf0ed1d0d288daf7e14795d06d3b3a93

SHA512
1731f8f00c60ec3b74f8a0e899bdf220facc3fb1d5c85283a3cffbd0d252bb73bc08961230def3d46bb64c2431b7fb0a43842390d92b2b92ea87a379c55fde10

Download Submit
C:\Windows\System\GVivsem.exe

Filesize
1.4MB

MD5
dd27b03cad53620173b8c29df862f8b2

SHA1
3f24c3df1e4a2debdc798180aee6cd3d2be1625c

SHA256
ecc8058831043bcb38cf07476f42247e07ef8d02164b407b4e87f0f8a3f59e27

SHA512
46dbe811a82a36541fe563bce23a9b2e93d280651d5136b8b4dea949f8cd0c14da3ea877fe7e0a910e55f175277396ad5917626f249e868b4f122c2be27e4164

Download Submit
C:\Windows\System\JfFBHFS.exe

Filesize
1.4MB

MD5
6bd6f860d938df881c75e514c0a7461f

SHA1
d85012579ebaf434258c6d47dda35123da846a65

SHA256
27c62efdbfa6228baf5226b62b61a2b50cafdc09ccbf8ff92ec0c1777cadad42

SHA512
e7399ae28d487faef564abda0540d26cdba0fa4ae9a23523f80915aa248cdfb7c3c077b36ac3daf0fb3b7c043b52f75679f9f5bf133ccc1bfb01afcb8bb62793

Download Submit
C:\Windows\System\MPELhLt.exe

Filesize
1.4MB

MD5
af7254f7c8448623fa318a24db523016

SHA1
5f5dc711be4811ebee57d7c2a1129f62044a0bd4

SHA256
46da14b6b2c354a1d852017ab2f13c26e779a32fab5ea4e05cf338bcd8d01822

SHA512
ad5f7fbf3dd9a8a4c5fa295cd27cd494bea447f8b3ef40782bce471205206dedb1e69fccee5f3db9cc61173861f802bd0a9efec023f83b2ea23a9515703507ae

Download Submit
C:\Windows\System\POqWYwr.exe

Filesize
1.4MB

MD5
71fb7fdcb1877afc9749b74e637c0b4d

SHA1
627b650d5ee53eb461c663ef91430ef8451d61fd

SHA256
f328083ddc74032fe5144dffb933e2519d4dae4d136bd8cc3879ac20ecc7226a

SHA512
343530325918c78eb48cf5433e0364f35b656961ad46d34a300361c58e9da96e48f04ae11fea02a1f80411e38e84c67c64211e8af3ad607341833bf3b6ed068f

Download Submit
C:\Windows\System\QHFgtwV.exe

Filesize
1.4MB

MD5
76418f0dde5ce3e23c851c8114f2154b

SHA1
6a90f19a0ec421ed237f0a044d8f5ff12454b272

SHA256
e36062cb57894c1fb7ded34781cf44491f7703b6943a4a3cb41ab4d3caec79f2

SHA512
bbc972c7abf346a94f7e6a0871fbf7168883399d025b0a93380a7749016e3f4b973ce8b11738678a23b713fadf72fda25945d746cb3a25bfc99de956eaad64f4

Download Submit
C:\Windows\System\SnAKdHh.exe

Filesize
1.4MB

MD5
77b571fe8778072e350458e6ca64008f

SHA1
8233aa92b879dd0b6b15b626fd2b39780cd5d918

SHA256
580e7f48f9596428abce41f07c9b42d66aead9c4296fe806c11a37a3e696d7fe

SHA512
35b09fc47c0508bb5f0306bd7cec91d591b6ece3631248a06ebaa97bb1a167673ffd4f498fdfdcc20b07c1f3827e048daa6783d3e3418d3f1a8f2f6ed4f683be

Download Submit
C:\Windows\System\SnRzPCX.exe

Filesize
1.4MB

MD5
521c8322087d7442828b0fd24fe7b104

SHA1
a4aed38a4936c5c76ef6be1c4555dce4343a43b5

SHA256
84e9ed9d00e7f7f7f4d580bf32aab36dc357bf16e2b63ece08292b07f2df0107

SHA512
dc07928394423c98b1f32ab794b7ab74666510fab91c7798cad2a93cb8c2145ad6cd38d14b3ad82350cae5e8fe7a2ce4f1db234e3754e0de8c67d77f4b6d42db

Download Submit
C:\Windows\System\TTsRHEv.exe

Filesize
1.4MB

MD5
93b07462d43956d5fe14d92c0b8806f2

SHA1
3228c2ed60519e98fef83f1b967c439741a0d317

SHA256
5f1bbaf9b736d9c62dbfac2964fa963e896158f35d19292aa47ec8c7801b71b3

SHA512
c706a4fd59e12ea1aa17ae6343697c0ea0be72dfec0c8e0c9350d859b8a2da6887ee35afa916e71e60bb8903f38d14940508954f79d4775183143850b2514374

Download Submit
C:\Windows\System\UfGcQKs.exe

Filesize
1.4MB

MD5
f7e040ac36cbc4582a6f1d0ede05ec2d

SHA1
cbc20e9be5ec189d2f7184ca36f8d26175d435ff

SHA256
bd41670db06be2282d5e97822e779b45913cf87fdd1b89406825ba56b2b59917

SHA512
2d18cb8cf2713815f7ef0b649a74a3d93b3b04776d6dbeadab376f120c353eecbc7a300099b56c90b11e146efb1efad1a909e2eeaef811e22f5ace0654a75db4

Download Submit
C:\Windows\System\VmfyjBQ.exe

Filesize
1.4MB

MD5
52951d70790e6c449aedcf63fd68e6bb

SHA1
0d6cf097c48f3a59babf8f62a6dc8b7d37d45cf3

SHA256
463c51a3a015abcb5e553c11e25aabeb9e5ba35c5bf619001ad5ca0ab04289e4

SHA512
9416d5a78d31f2bb3ad1ee659cfafb42161192f88cc1a92db88c9de8167b2f0d5a3c2dbcf69885229aabfebb68471620ccd445307b73f1f9b5d2ba30a79efce1

Download Submit
C:\Windows\System\VqpaaeI.exe

Filesize
1.4MB

MD5
8674174d4c72f9e97efd487151858d22

SHA1
0a5f2caf662c71efec22dcc8d4d0fa5838a72a55

SHA256
580b471979d80679bbfbca1b8760cfdd707cd3042c53ae321d9807c9a019fa29

SHA512
0597d0aaaffd27d3a32bf2e3cfd21e97008c0b3b1256d7ac566907b91fd8dea1d0784450e3aedd0ceda749e322fb3bf5f3f5192860c93b9391b014a49fd54785

Download Submit
C:\Windows\System\WgrJNkT.exe

Filesize
1.4MB

MD5
48d28eb62da4bf2a5c5bf04a59a38c9c

SHA1
ac9a4d4d742d2a758cf45139a82f1a4cd2400e0f

SHA256
e1f9af3b3f55ed78a3c97a21b57db04e4a9199193541c716519281960fe71a04

SHA512
819b1155bd98e184a268e98fa5d2679686e24274d0ef5264d127dd46a552403184d65f5b7f3760ddb2d5222eaf2cf43b1a24177959f7c6fa8961c51e9b7898cb

Download Submit
C:\Windows\System\bgAOSax.exe

Filesize
1.4MB

MD5
fc610dc16fb95846b59c946c5cebebc9

SHA1
5cac60d9520c9b8c522344f669d51ce5ffb2f75b

SHA256
0e8a04e3fd26beb4255015559c2d59ac615fbfa4339c0d577e549b4b1e9954e8

SHA512
c44dea2265cac97d44946c40b8fd075130a95a65a3a53088a26ff0ecba3a96fbff149f4583eaee41304c078d204d8d9ac6dde32dc6eb1933a66e6443c4561c68

Download Submit
C:\Windows\System\dkWdZSR.exe

Filesize
1.4MB

MD5
b551a2a9a447388b9cf33b76383acdce

SHA1
c252b1cd936ffd9a0fe138246ab3e14f8b8fd15e

SHA256
2819208dc605d9ac06c4d1ca1eef2857138914bdc755f18a28bbd6f006081331

SHA512
25c975520f430cd3dcca7b68a7ee139969705374a2b39b43b6a2df32ce2fad15d277b2ba2dea0a14fc656aa287c0a6ab06e85bd2b5e6eea2c669bd30907d9593

Download Submit
C:\Windows\System\gdLzDuf.exe

Filesize
1.4MB

MD5
c009647484de612a3bdf3aa3ab804802

SHA1
8b91b638bccf4792fd8f49648717805f09900968

SHA256
4b0531b47f4e40e5f61d82114cf7d6e047794fcad3ef93e693fc5a5bfe49056f

SHA512
480c1956be28fcf66510721b4a21636a5a03079d8ccdcfcd21cc4bbb9b54728029c14260aaaa753296e152471df2afed1b69814f0ebc3c0bb4bd8a5cfe2781f2

Download Submit
C:\Windows\System\hXpWicz.exe

Filesize
1.4MB

MD5
46229cac1e37a597dfa21a2f3156472a

SHA1
5c169add654152fa328cbdceef19a510b0e2d921

SHA256
bdde80dac0f0923ab1766f63eb0432b02c92149a7f727b55271bffc26a0c9bb1

SHA512
2c30f2310ed91c528a5c3c5f4966ecce075aaed7f7fdee2825b8a30e19e06d90e0d1e9a5b249e1981fcf29c7aaeb6a525193c889d399f8de39f0e510fa69b3be

Download Submit
C:\Windows\System\hslGpEV.exe

Filesize
1.4MB

MD5
b636e1847deaf7469018af1183e82cc2

SHA1
b0b78034b603bd306493d220b64a3a80a05a407f

SHA256
2a2cf61fc314ca35d1c4480dc1089c9837230708905eeecbf8eee2d6c18ede77

SHA512
0dcca98321b01c862cd4441bce5d1551eff0c4bc3acebbb281c19c8c6ac57bfeebb0606e148b3cd33f0ac377d7021bb3f4a458f1ae3205f22adc5a49951526f8

Download Submit
C:\Windows\System\iMBQGHW.exe

Filesize
1.4MB

MD5
b7c4820eaca76d2b5b1ecbb79b21775d

SHA1
787f69127240bc8cd4614a62bce6e7b638d70b93

SHA256
3037cc8361264420b8fbf1b6f0ae69faa8b0f75c40753c176de2da2a38d7f9aa

SHA512
4a609163feb8c8aacde3e5b202e69329b45ad21588a88f81413d4a22f88e52144988f4437aa023c9742da4fb73935eca37f394a4691db06295bd3c854e911f61

Download Submit
C:\Windows\System\lqYPbst.exe

Filesize
1.4MB

MD5
3286073350d8ac6b288478aa4b72e18e

SHA1
544e667b9e9dc4a2736171c39706c6c2769cb8fa

SHA256
d2512df2b2b57c9af1e6ac13819536679faef511e29dfd9300cf77b0e16a705b

SHA512
3ca8b9ef655a8044d9f032c71868f5d209fdae20016b0451e6d5a8f695fc3c788d9f830151b33d07f9071d7a0e1a895c08067980c04f779151ae13e3c3e11a4d

Download Submit
C:\Windows\System\mNARgCw.exe

Filesize
1.4MB

MD5
3036a60e518b6dab1b086d79a91faa92

SHA1
8fc57f56889a27ec36739a2321234429a04ba962

SHA256
6adbb0b1045d1361ae32e89d06da9158a961450911f35022488e1a58abec05c3

SHA512
389cf2b6b758ce3f9120a0f26192ffa958b1bb00942534af23362efe23e4f52f91855b97e4a11c3615b480cd6bcf9defc8a76c214d5c179286955b478cae3a33

Download Submit
C:\Windows\System\mSkKmQx.exe

Filesize
1.4MB

MD5
49c27b1fc184b00f737bfe4a348415b7

SHA1
ea5c9be02ef6483ee154d69c74a3fc413718f1f9

SHA256
f90a1f77474259c0456ffda4c842a53c6490456a8c3a588e32b30d8131e95af3

SHA512
93be831fd3304ab3d05875d0d4a15e7fb48cb19d2293e0620f86ec3e95013287551b53617396769fd496c69952dc873128b40db4c0916273759a9a023c320b68

Download Submit
C:\Windows\System\mmSRMps.exe

Filesize
1.4MB

MD5
1913b7fb4654aa53175665b7eebd3d4e

SHA1
6b8a950cbec67077aaa73026ea7b2f8309e95b9a

SHA256
fddb56ec7a33794ce6c124e3426771ccb8f0848f6dec1041054314cb3d3f528b

SHA512
648afe184a9031427b397fa041193a194804d13f41cdd1966fc529111b3f126c6c4b6254a1dda6d0170484e6e320e0f1490b099845ffee810ec2de54605615ff

Download Submit
C:\Windows\System\oVcnyCy.exe

Filesize
1.4MB

MD5
74a3d7381aac2ae6df841ef51e3ed031

SHA1
a71222889ace95b69042d59aaa79c51d6db7efb6

SHA256
9ee863688fdeeb48d6e12afbac24602ca7b6fe064b208ac9f1e4fec94b0a4ec7

SHA512
88737332d0f2aea29261f50d181d6faac1a6a5d8d49243e2d7f6f0c8ba74f4a2b62f8978dff5d0587cee449bb20aa0703d51e69ce09ff0be916e45565a02293d

Download Submit
C:\Windows\System\sDaDJGz.exe

Filesize
1.4MB

MD5
c7c6eef2dcc674b12c1013f5550b5b3d

SHA1
347da4ad1ddc2ef7da7e8874caa99fa07ecf79a0

SHA256
a8ad6e5716e3bc0614218d27689a095ad379d95a4c7f3a8298f2130017781887

SHA512
78f7e8026541e23cc86b38a09040b8e0fdcde4379f0ce7add8c2cf909ce46242025e672c373215a5cd9692423a2d5629d3e916280085d393a132bea901b4d833

Download Submit
C:\Windows\System\tWomVKX.exe

Filesize
1.4MB

MD5
552b0d99b0c50b4ef685249119547699

SHA1
a31ba580e9a3bfaa2f9e1aebc50f123be3171cc4

SHA256
ef281ebef54798f62fdd97751977df4b5971546c84f5e57c639c4a2312291ea6

SHA512
59cc0e8affa52065d0005798c98589da164a86c77d0a60dd4abb1b0ed4d2b2de9a21547958f38485d21d31918153f62377809429237aac0ec8150350d592e20d

Download Submit
C:\Windows\System\upBZaVN.exe

Filesize
1.4MB

MD5
172259d1e9b9a5eb88d223afaa9b3f7e

SHA1
5a611661b7234e21a538781752ceb22502a3d8b7

SHA256
48fc7bfcc0c075204bd51873f6552c0a11a5d547ed651fb53551d91578495707

SHA512
80cda813fd64e397529ea5e36e569963458f13ea588dc2e77acbeb7c0d977f4f461d51142412a8ec98f3bb934762131c2520ed201d168f4a1658a3d1eca3145e

Download Submit
C:\Windows\System\vGrSHdH.exe

Filesize
1.4MB

MD5
254447ae908800cf6467be24be3bf76a

SHA1
bde2f3743cb9791073da56d2817f8297d59011e4

SHA256
15511a62770d526627b05a7aaae14f833534bcfc7217406a3b7cac1d76ed457b

SHA512
ce7e9d452de1dde9e0c72fc23444253e5d830045e05edde99c9559f3f613a5bf932b47bc4ce27fa35db8aa94c096aedab5180929066cc58ff1d61b3e39b74107

Download Submit
C:\Windows\System\wIRhIUy.exe

Filesize
1.4MB

MD5
3264be11baf829cec480b52a5520b2ff

SHA1
a1f9b4b6c922edc76fe0469e186bdf09400b5c6d

SHA256
8b9dadc8788a48f434af7c88bf08c6a39d78dd2a025c2d418828762ad09f9297

SHA512
8f8be398add6fd1e7bd20955062f8f7258ce8c17ca2a938ac5d5b88ca7356a1a04f2da4dd41ba3b902eadf252fbccc5a683a506cb7d121173cba280c7709993a

Download Submit
C:\Windows\System\wkErbAN.exe

Filesize
1.4MB

MD5
b1720b43f4ba7e10a64501c91478acfb

SHA1
bc470097c34a572985fea196781919e08856bd74

SHA256
018a98abaa5a6d4a685fe650b9c9d41b1121454764d82cfdc789d3b63b8e9cbb

SHA512
d9d9e0aafcec0d4596b331295efdd5b81b778046fb04cc49793197bf28f00cbaff3ff968c3c9f234a4caf668cafe42dd1336753491c5599deca467cd662e2f3c

Download Submit
memory/1044-50-0x00007FF7FA8B0000-0x00007FF7FAC01000-memory.dmp

Filesize
3.3MB

Download
memory/1044-2311-0x00007FF7FA8B0000-0x00007FF7FAC01000-memory.dmp

Filesize
3.3MB

Download
memory/1044-628-0x00007FF7FA8B0000-0x00007FF7FAC01000-memory.dmp

Filesize
3.3MB

Download
memory/1148-620-0x00007FF6F2B60000-0x00007FF6F2EB1000-memory.dmp

Filesize
3.3MB

Download
memory/1148-30-0x00007FF6F2B60000-0x00007FF6F2EB1000-memory.dmp

Filesize
3.3MB

Download
memory/1148-2307-0x00007FF6F2B60000-0x00007FF6F2EB1000-memory.dmp

Filesize
3.3MB

Download
memory/1224-113-0x00007FF620F00000-0x00007FF621251000-memory.dmp

Filesize
3.3MB

Download
memory/1224-2299-0x00007FF620F00000-0x00007FF621251000-memory.dmp

Filesize
3.3MB

Download
memory/1224-2331-0x00007FF620F00000-0x00007FF621251000-memory.dmp

Filesize
3.3MB

Download
memory/1268-7-0x00007FF6C2FF0000-0x00007FF6C3341000-memory.dmp

Filesize
3.3MB

Download
memory/1268-76-0x00007FF6C2FF0000-0x00007FF6C3341000-memory.dmp

Filesize
3.3MB

Download
memory/1268-2301-0x00007FF6C2FF0000-0x00007FF6C3341000-memory.dmp

Filesize
3.3MB

Download
memory/1324-55-0x00007FF7BECC0000-0x00007FF7BF011000-memory.dmp

Filesize
3.3MB

Download
memory/1324-2256-0x00007FF7BECC0000-0x00007FF7BF011000-memory.dmp

Filesize
3.3MB

Download
memory/1324-2315-0x00007FF7BECC0000-0x00007FF7BF011000-memory.dmp

Filesize
3.3MB

Download
memory/1696-71-0x00007FF671B30000-0x00007FF671E81000-memory.dmp

Filesize
3.3MB

Download
memory/1696-1-0x0000018601F40000-0x0000018601F50000-memory.dmp

Filesize
64KB

Download
memory/1696-0-0x00007FF671B30000-0x00007FF671E81000-memory.dmp

Filesize
3.3MB

Download
memory/1824-52-0x00007FF74D6A0000-0x00007FF74D9F1000-memory.dmp

Filesize
3.3MB

Download
memory/1824-2255-0x00007FF74D6A0000-0x00007FF74D9F1000-memory.dmp

Filesize
3.3MB

Download
memory/1824-2317-0x00007FF74D6A0000-0x00007FF74D9F1000-memory.dmp

Filesize
3.3MB

Download
memory/1912-584-0x00007FF728BB0000-0x00007FF728F01000-memory.dmp

Filesize
3.3MB

Download
memory/1912-2341-0x00007FF728BB0000-0x00007FF728F01000-memory.dmp

Filesize
3.3MB

Download
memory/1920-2293-0x00007FF6CE0D0000-0x00007FF6CE421000-memory.dmp

Filesize
3.3MB

Download
memory/1920-2321-0x00007FF6CE0D0000-0x00007FF6CE421000-memory.dmp

Filesize
3.3MB

Download
memory/1920-100-0x00007FF6CE0D0000-0x00007FF6CE421000-memory.dmp

Filesize
3.3MB

Download
memory/1972-2303-0x00007FF7D4500000-0x00007FF7D4851000-memory.dmp

Filesize
3.3MB

Download
memory/1972-99-0x00007FF7D4500000-0x00007FF7D4851000-memory.dmp

Filesize
3.3MB

Download
memory/1972-19-0x00007FF7D4500000-0x00007FF7D4851000-memory.dmp

Filesize
3.3MB

Download
memory/2444-2343-0x00007FF753300000-0x00007FF753651000-memory.dmp

Filesize
3.3MB

Download
memory/2444-583-0x00007FF753300000-0x00007FF753651000-memory.dmp

Filesize
3.3MB

Download
memory/2532-2339-0x00007FF788200000-0x00007FF788551000-memory.dmp

Filesize
3.3MB

Download
memory/2532-589-0x00007FF788200000-0x00007FF788551000-memory.dmp

Filesize
3.3MB

Download
memory/2628-18-0x00007FF6D3AA0000-0x00007FF6D3DF1000-memory.dmp

Filesize
3.3MB

Download
memory/2628-77-0x00007FF6D3AA0000-0x00007FF6D3DF1000-memory.dmp

Filesize
3.3MB

Download
memory/2628-2305-0x00007FF6D3AA0000-0x00007FF6D3DF1000-memory.dmp

Filesize
3.3MB

Download
memory/3000-637-0x00007FF7EBE70000-0x00007FF7EC1C1000-memory.dmp

Filesize
3.3MB

Download
memory/3000-2349-0x00007FF7EBE70000-0x00007FF7EC1C1000-memory.dmp

Filesize
3.3MB

Download
memory/3044-2036-0x00007FF698A50000-0x00007FF698DA1000-memory.dmp

Filesize
3.3MB

Download
memory/3044-2309-0x00007FF698A50000-0x00007FF698DA1000-memory.dmp

Filesize
3.3MB

Download
memory/3044-41-0x00007FF698A50000-0x00007FF698DA1000-memory.dmp

Filesize
3.3MB

Download
memory/3208-2345-0x00007FF76FC00000-0x00007FF76FF51000-memory.dmp

Filesize
3.3MB

Download
memory/3208-576-0x00007FF76FC00000-0x00007FF76FF51000-memory.dmp

Filesize
3.3MB

Download
memory/3232-2257-0x00007FF638C50000-0x00007FF638FA1000-memory.dmp

Filesize
3.3MB

Download
memory/3232-2319-0x00007FF638C50000-0x00007FF638FA1000-memory.dmp

Filesize
3.3MB

Download
memory/3232-60-0x00007FF638C50000-0x00007FF638FA1000-memory.dmp

Filesize
3.3MB

Download
memory/3424-2358-0x00007FF6395A0000-0x00007FF6398F1000-memory.dmp

Filesize
3.3MB

Download
memory/3424-599-0x00007FF6395A0000-0x00007FF6398F1000-memory.dmp

Filesize
3.3MB

Download
memory/3868-2325-0x00007FF647490000-0x00007FF6477E1000-memory.dmp

Filesize
3.3MB

Download
memory/3868-2259-0x00007FF647490000-0x00007FF6477E1000-memory.dmp

Filesize
3.3MB

Download
memory/3868-75-0x00007FF647490000-0x00007FF6477E1000-memory.dmp

Filesize
3.3MB

Download
memory/4060-2356-0x00007FF705240000-0x00007FF705591000-memory.dmp

Filesize
3.3MB

Download
memory/4060-611-0x00007FF705240000-0x00007FF705591000-memory.dmp

Filesize
3.3MB

Download
memory/4172-2353-0x00007FF74E140000-0x00007FF74E491000-memory.dmp

Filesize
3.3MB

Download
memory/4172-615-0x00007FF74E140000-0x00007FF74E491000-memory.dmp

Filesize
3.3MB

Download
memory/4188-2327-0x00007FF62E3F0000-0x00007FF62E741000-memory.dmp

Filesize
3.3MB

Download
memory/4188-2297-0x00007FF62E3F0000-0x00007FF62E741000-memory.dmp

Filesize
3.3MB

Download
memory/4188-104-0x00007FF62E3F0000-0x00007FF62E741000-memory.dmp

Filesize
3.3MB

Download
memory/4540-572-0x00007FF625A80000-0x00007FF625DD1000-memory.dmp

Filesize
3.3MB

Download
memory/4540-2347-0x00007FF625A80000-0x00007FF625DD1000-memory.dmp

Filesize
3.3MB

Download
memory/4852-83-0x00007FF683D80000-0x00007FF6840D1000-memory.dmp

Filesize
3.3MB

Download
memory/4852-2323-0x00007FF683D80000-0x00007FF6840D1000-memory.dmp

Filesize
3.3MB

Download
memory/4852-2292-0x00007FF683D80000-0x00007FF6840D1000-memory.dmp

Filesize
3.3MB

Download
memory/4940-568-0x00007FF6992B0000-0x00007FF699601000-memory.dmp

Filesize
3.3MB

Download
memory/4940-2333-0x00007FF6992B0000-0x00007FF699601000-memory.dmp

Filesize
3.3MB

Download
memory/5028-2335-0x00007FF631790000-0x00007FF631AE1000-memory.dmp

Filesize
3.3MB

Download
memory/5028-569-0x00007FF631790000-0x00007FF631AE1000-memory.dmp

Filesize
3.3MB

Download
memory/5056-594-0x00007FF7E1180000-0x00007FF7E14D1000-memory.dmp

Filesize
3.3MB

Download
memory/5056-2351-0x00007FF7E1180000-0x00007FF7E14D1000-memory.dmp

Filesize
3.3MB

Download
memory/5060-634-0x00007FF7FEF80000-0x00007FF7FF2D1000-memory.dmp

Filesize
3.3MB

Download
memory/5060-2337-0x00007FF7FEF80000-0x00007FF7FF2D1000-memory.dmp

Filesize
3.3MB

Download
memory/5072-65-0x00007FF6A3A90000-0x00007FF6A3DE1000-memory.dmp

Filesize
3.3MB

Download
memory/5072-2258-0x00007FF6A3A90000-0x00007FF6A3DE1000-memory.dmp

Filesize
3.3MB

Download
memory/5072-2329-0x00007FF6A3A90000-0x00007FF6A3DE1000-memory.dmp

Filesize
3.3MB

Download
memory/5112-2313-0x00007FF6531C0000-0x00007FF653511000-memory.dmp

Filesize
3.3MB

Download
memory/5112-40-0x00007FF6531C0000-0x00007FF653511000-memory.dmp

Filesize
3.3MB

Download
memory/5112-625-0x00007FF6531C0000-0x00007FF653511000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads