xmrig | 4bf921a804bebb05c5099064cc1ef21f6eb9df17bbfc7af13721e463718013c9

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
Size 1.6MB
Sample240603-qcaa3afd6s
SHA256 4bf921a804bebb05c5099064cc1ef21f6eb9df17bbfc7af13721e463718013c9
MD5 a463adca8b9573c84a76f065936568d0
SHA1 ae11bc68bee3a4be2252c68c5950d2aaabcbd768
SHA512 c65619fb23dd5da028ae446a5804d79f110d0c99e8e0db888cc549f1e6a3c935a026dacd7bf373fd8fcc05cfaa4b0f319913d0d389277acb47e05fe808757bff
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc4:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000600000002327c-4.dat	xmrig
behavioral2/files/0x000700000002340f-29.dat	xmrig
behavioral2/files/0x0007000000023410-31.dat	xmrig
behavioral2/files/0x0007000000023411-35.dat	xmrig
behavioral2/files/0x0007000000023414-47.dat	xmrig
behavioral2/files/0x000700000002340e-52.dat	xmrig
behavioral2/files/0x0007000000023413-66.dat	xmrig
behavioral2/files/0x0007000000023416-73.dat	xmrig
behavioral2/files/0x000700000002341b-86.dat	xmrig
behavioral2/files/0x000700000002341e-95.dat	xmrig
behavioral2/files/0x0007000000023420-110.dat	xmrig
behavioral2/files/0x000700000002341f-108.dat	xmrig
behavioral2/files/0x000700000002341d-104.dat	xmrig
behavioral2/files/0x000700000002341c-102.dat	xmrig
behavioral2/files/0x0007000000023419-96.dat	xmrig
behavioral2/files/0x0007000000023418-75.dat	xmrig
behavioral2/files/0x0007000000023417-71.dat	xmrig
behavioral2/files/0x0007000000023415-69.dat	xmrig
behavioral2/files/0x0007000000023412-48.dat	xmrig
behavioral2/files/0x0007000000023426-145.dat	xmrig
behavioral2/files/0x0007000000023427-149.dat	xmrig
behavioral2/files/0x0007000000023429-152.dat	xmrig
behavioral2/files/0x000700000002342a-159.dat	xmrig
behavioral2/files/0x0007000000023425-143.dat	xmrig
behavioral2/files/0x0007000000023424-139.dat	xmrig
behavioral2/files/0x0007000000023422-128.dat	xmrig
behavioral2/files/0x0007000000023423-129.dat	xmrig
behavioral2/files/0x0008000000023409-122.dat	xmrig
behavioral2/files/0x0007000000023421-115.dat	xmrig
behavioral2/files/0x000700000002340c-25.dat	xmrig
behavioral2/files/0x000800000002340b-22.dat	xmrig
behavioral2/files/0x000700000002340d-17.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4740	KctxLgd.exe
3080	PqcgOXN.exe
3136	TnxWoIF.exe
3348	DpCYnKb.exe
2164	fxilJeJ.exe
1016	HZZouJi.exe
3412	WnZCVRc.exe
3844	prOhQjA.exe
3620	dBPPDml.exe
3404	JUlXZSA.exe
2844	weYOxew.exe
4348	FfVBGiV.exe
1268	pVzukma.exe
2052	MyKKnrQ.exe
3400	GtlSiYe.exe
2044	UEoouRj.exe
6020	vrfBioa.exe
5032	ujlQGTz.exe
3984	mAAgiCp.exe
4076	teZDeft.exe
3508	DrKEsNM.exe
3932	UMSmSmo.exe
4452	ycrZcUe.exe
3532	TTswfsN.exe
3880	iiSNqug.exe
3464	TAmeXXj.exe
5068	RRHXkRU.exe
5464	rDXdLqT.exe
5304	IUjSQVz.exe
4636	BnieGXt.exe
6040	tNGtMtS.exe
3720	UmdymPh.exe
872	xqbcVIC.exe
3876	smpWUum.exe
5420	pWFzFRz.exe
3504	VuyAtux.exe
5236	bQpqGqb.exe
5576	iABCQOM.exe
5540	KWMECwy.exe
1888	sVecUKv.exe
1608	aBQVOuX.exe
1656	cIZkHZR.exe
1420	XVBXobz.exe
1216	iadWweB.exe
2096	QQBQqCg.exe
2112	oANtHKe.exe
1228	KPSqCIf.exe
1376	IzeZaxU.exe
4788	yWqOdlx.exe
2152	QIXbKMs.exe
1632	DhCLiSk.exe
5044	oxYSWJu.exe
5844	ldprObq.exe
2984	HDEmpQo.exe
4180	DRtYaWp.exe
4476	LSGwtkQ.exe
1904	xbnKxHB.exe
5192	OGDkOzH.exe
4812	saMtsoO.exe
5008	DXPodrn.exe
4556	sVCwkhB.exe
724	oRImHJE.exe
5684	EEhIhTn.exe
5768	hEBhPuB.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JkFGCzs.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\WgLwOGn.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\PJrTAPB.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\XcbsqOl.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\RogQreQ.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\BXNSWcP.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\eygLuWb.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\DkkUEwP.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\JAgjAGI.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\mTGIpze.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\prOhQjA.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\FRpBFMs.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\tcdUaJp.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\PBjuCnI.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\LDdOEqb.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\vwCJldO.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\iruOSNn.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\RvsJQCC.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\nZwapnj.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\zIpGjrg.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\OsOstZo.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\cxPRwsN.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\vClHXmC.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZaArYrA.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\vLCaRMc.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\QxDzZMf.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\UlVEKLz.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZePWbWh.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\cIerWOB.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\iSbbNMz.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\npAHhvB.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\REPrONc.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\AsvSgKF.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\sQpmMfI.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\qdayGyL.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\YGPgifw.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\VuyAtux.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\MGrClkK.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\ksDEiXj.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\CvhhuUd.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\matKKvG.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\YKhYEFp.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\ECygefE.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\IGKbXHV.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\WBSlKNl.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\gEQEFCs.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\AganrFa.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZgvReXT.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\vhjfZGZ.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\DHVZfrs.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\zWhbvev.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\bTrywid.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\dPwCMfF.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\UAVmFSN.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\FfVBGiV.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\sIVIGeZ.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\AsyEThN.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\EEhIhTn.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\KzpQWCP.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\BQVbNLZ.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\woHAPFH.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\MhlNYjc.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\JTxbWIf.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
File created	C:\Windows\System\FwxVJTI.exe	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16716	dwm.exe
Token: SeChangeNotifyPrivilege	16716	dwm.exe
Token: 33	16716	dwm.exe
Token: SeIncBasePriorityPrivilege	16716	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4740	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	82
PID 552 wrote to memory of 4740	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	82
PID 552 wrote to memory of 3080	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	83
PID 552 wrote to memory of 3080	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	83
PID 552 wrote to memory of 3136	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	84
PID 552 wrote to memory of 3136	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	84
PID 552 wrote to memory of 3348	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	85
PID 552 wrote to memory of 3348	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	85
PID 552 wrote to memory of 2164	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	86
PID 552 wrote to memory of 2164	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	86
PID 552 wrote to memory of 1016	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	87
PID 552 wrote to memory of 1016	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	87
PID 552 wrote to memory of 3412	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	88
PID 552 wrote to memory of 3412	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	88
PID 552 wrote to memory of 3844	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	89
PID 552 wrote to memory of 3844	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	89
PID 552 wrote to memory of 3620	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	90
PID 552 wrote to memory of 3620	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	90
PID 552 wrote to memory of 3404	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	91
PID 552 wrote to memory of 3404	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	91
PID 552 wrote to memory of 2844	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	92
PID 552 wrote to memory of 2844	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	92
PID 552 wrote to memory of 4348	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	93
PID 552 wrote to memory of 4348	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	93
PID 552 wrote to memory of 1268	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	94
PID 552 wrote to memory of 1268	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	94
PID 552 wrote to memory of 2052	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	95
PID 552 wrote to memory of 2052	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	95
PID 552 wrote to memory of 3400	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	96
PID 552 wrote to memory of 3400	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	96
PID 552 wrote to memory of 2044	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	97
PID 552 wrote to memory of 2044	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	97
PID 552 wrote to memory of 6020	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	98
PID 552 wrote to memory of 6020	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	98
PID 552 wrote to memory of 5032	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	99
PID 552 wrote to memory of 5032	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	99
PID 552 wrote to memory of 3984	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	100
PID 552 wrote to memory of 3984	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	100
PID 552 wrote to memory of 4076	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	101
PID 552 wrote to memory of 4076	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	101
PID 552 wrote to memory of 3508	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	102
PID 552 wrote to memory of 3508	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	102
PID 552 wrote to memory of 3932	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	103
PID 552 wrote to memory of 3932	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	103
PID 552 wrote to memory of 4452	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	104
PID 552 wrote to memory of 4452	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	104
PID 552 wrote to memory of 3532	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	105
PID 552 wrote to memory of 3532	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	105
PID 552 wrote to memory of 3880	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	106
PID 552 wrote to memory of 3880	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	106
PID 552 wrote to memory of 3464	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	107
PID 552 wrote to memory of 3464	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	107
PID 552 wrote to memory of 5068	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	108
PID 552 wrote to memory of 5068	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	108
PID 552 wrote to memory of 5464	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	109
PID 552 wrote to memory of 5464	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	109
PID 552 wrote to memory of 5304	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	110
PID 552 wrote to memory of 5304	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	110
PID 552 wrote to memory of 4636	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	111
PID 552 wrote to memory of 4636	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	111
PID 552 wrote to memory of 6040	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	112
PID 552 wrote to memory of 6040	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	112
PID 552 wrote to memory of 3720	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	113
PID 552 wrote to memory of 3720	552	a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a463adca8b9573c84a76f065936568d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\System\KctxLgd.exe
  C:\Windows\System\KctxLgd.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\PqcgOXN.exe
  C:\Windows\System\PqcgOXN.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\TnxWoIF.exe
  C:\Windows\System\TnxWoIF.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\DpCYnKb.exe
  C:\Windows\System\DpCYnKb.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\fxilJeJ.exe
  C:\Windows\System\fxilJeJ.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\HZZouJi.exe
  C:\Windows\System\HZZouJi.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\WnZCVRc.exe
  C:\Windows\System\WnZCVRc.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\prOhQjA.exe
  C:\Windows\System\prOhQjA.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\dBPPDml.exe
  C:\Windows\System\dBPPDml.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\JUlXZSA.exe
  C:\Windows\System\JUlXZSA.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\weYOxew.exe
  C:\Windows\System\weYOxew.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\FfVBGiV.exe
  C:\Windows\System\FfVBGiV.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\pVzukma.exe
  C:\Windows\System\pVzukma.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\MyKKnrQ.exe
  C:\Windows\System\MyKKnrQ.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\GtlSiYe.exe
  C:\Windows\System\GtlSiYe.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\UEoouRj.exe
  C:\Windows\System\UEoouRj.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\vrfBioa.exe
  C:\Windows\System\vrfBioa.exe
  2⤵
  - Executes dropped EXE
  PID:6020
- C:\Windows\System\ujlQGTz.exe
  C:\Windows\System\ujlQGTz.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\mAAgiCp.exe
  C:\Windows\System\mAAgiCp.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\teZDeft.exe
  C:\Windows\System\teZDeft.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\DrKEsNM.exe
  C:\Windows\System\DrKEsNM.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\UMSmSmo.exe
  C:\Windows\System\UMSmSmo.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\ycrZcUe.exe
  C:\Windows\System\ycrZcUe.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\TTswfsN.exe
  C:\Windows\System\TTswfsN.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\iiSNqug.exe
  C:\Windows\System\iiSNqug.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\TAmeXXj.exe
  C:\Windows\System\TAmeXXj.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\RRHXkRU.exe
  C:\Windows\System\RRHXkRU.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\rDXdLqT.exe
  C:\Windows\System\rDXdLqT.exe
  2⤵
  - Executes dropped EXE
  PID:5464
- C:\Windows\System\IUjSQVz.exe
  C:\Windows\System\IUjSQVz.exe
  2⤵
  - Executes dropped EXE
  PID:5304
- C:\Windows\System\BnieGXt.exe
  C:\Windows\System\BnieGXt.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\tNGtMtS.exe
  C:\Windows\System\tNGtMtS.exe
  2⤵
  - Executes dropped EXE
  PID:6040
- C:\Windows\System\UmdymPh.exe
  C:\Windows\System\UmdymPh.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\xqbcVIC.exe
  C:\Windows\System\xqbcVIC.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\smpWUum.exe
  C:\Windows\System\smpWUum.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\pWFzFRz.exe
  C:\Windows\System\pWFzFRz.exe
  2⤵
  - Executes dropped EXE
  PID:5420
- C:\Windows\System\VuyAtux.exe
  C:\Windows\System\VuyAtux.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\bQpqGqb.exe
  C:\Windows\System\bQpqGqb.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\iABCQOM.exe
  C:\Windows\System\iABCQOM.exe
  2⤵
  - Executes dropped EXE
  PID:5576
- C:\Windows\System\KWMECwy.exe
  C:\Windows\System\KWMECwy.exe
  2⤵
  - Executes dropped EXE
  PID:5540
- C:\Windows\System\sVecUKv.exe
  C:\Windows\System\sVecUKv.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\aBQVOuX.exe
  C:\Windows\System\aBQVOuX.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\cIZkHZR.exe
  C:\Windows\System\cIZkHZR.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\XVBXobz.exe
  C:\Windows\System\XVBXobz.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\iadWweB.exe
  C:\Windows\System\iadWweB.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\QQBQqCg.exe
  C:\Windows\System\QQBQqCg.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\oANtHKe.exe
  C:\Windows\System\oANtHKe.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\KPSqCIf.exe
  C:\Windows\System\KPSqCIf.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\IzeZaxU.exe
  C:\Windows\System\IzeZaxU.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\yWqOdlx.exe
  C:\Windows\System\yWqOdlx.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\QIXbKMs.exe
  C:\Windows\System\QIXbKMs.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\DhCLiSk.exe
  C:\Windows\System\DhCLiSk.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\oxYSWJu.exe
  C:\Windows\System\oxYSWJu.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\ldprObq.exe
  C:\Windows\System\ldprObq.exe
  2⤵
  - Executes dropped EXE
  PID:5844
- C:\Windows\System\HDEmpQo.exe
  C:\Windows\System\HDEmpQo.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\DRtYaWp.exe
  C:\Windows\System\DRtYaWp.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\LSGwtkQ.exe
  C:\Windows\System\LSGwtkQ.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\xbnKxHB.exe
  C:\Windows\System\xbnKxHB.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\OGDkOzH.exe
  C:\Windows\System\OGDkOzH.exe
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Windows\System\saMtsoO.exe
  C:\Windows\System\saMtsoO.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\DXPodrn.exe
  C:\Windows\System\DXPodrn.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\sVCwkhB.exe
  C:\Windows\System\sVCwkhB.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\oRImHJE.exe
  C:\Windows\System\oRImHJE.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\EEhIhTn.exe
  C:\Windows\System\EEhIhTn.exe
  2⤵
  - Executes dropped EXE
  PID:5684
- C:\Windows\System\hEBhPuB.exe
  C:\Windows\System\hEBhPuB.exe
  2⤵
  - Executes dropped EXE
  PID:5768
- C:\Windows\System\KzpQWCP.exe
  C:\Windows\System\KzpQWCP.exe
  2⤵
  PID:3060
- C:\Windows\System\diAmfEA.exe
  C:\Windows\System\diAmfEA.exe
  2⤵
  PID:3976
- C:\Windows\System\PxkaTiv.exe
  C:\Windows\System\PxkaTiv.exe
  2⤵
  PID:3964
- C:\Windows\System\vmnheWn.exe
  C:\Windows\System\vmnheWn.exe
  2⤵
  PID:5816
- C:\Windows\System\mBxgDTC.exe
  C:\Windows\System\mBxgDTC.exe
  2⤵
  PID:752
- C:\Windows\System\CCaZeqB.exe
  C:\Windows\System\CCaZeqB.exe
  2⤵
  PID:1384
- C:\Windows\System\SVLEQVi.exe
  C:\Windows\System\SVLEQVi.exe
  2⤵
  PID:1200
- C:\Windows\System\XlYIraF.exe
  C:\Windows\System\XlYIraF.exe
  2⤵
  PID:772
- C:\Windows\System\ctmqCZe.exe
  C:\Windows\System\ctmqCZe.exe
  2⤵
  PID:4964
- C:\Windows\System\itKAMYJ.exe
  C:\Windows\System\itKAMYJ.exe
  2⤵
  PID:5096
- C:\Windows\System\cyxeceK.exe
  C:\Windows\System\cyxeceK.exe
  2⤵
  PID:5656
- C:\Windows\System\vixcgwb.exe
  C:\Windows\System\vixcgwb.exe
  2⤵
  PID:3972
- C:\Windows\System\yabzdYo.exe
  C:\Windows\System\yabzdYo.exe
  2⤵
  PID:1320
- C:\Windows\System\RCNaCMF.exe
  C:\Windows\System\RCNaCMF.exe
  2⤵
  PID:664
- C:\Windows\System\fddSyuU.exe
  C:\Windows\System\fddSyuU.exe
  2⤵
  PID:5292
- C:\Windows\System\wKVBAVu.exe
  C:\Windows\System\wKVBAVu.exe
  2⤵
  PID:408
- C:\Windows\System\geQfVuF.exe
  C:\Windows\System\geQfVuF.exe
  2⤵
  PID:2016
- C:\Windows\System\DeVqqBZ.exe
  C:\Windows\System\DeVqqBZ.exe
  2⤵
  PID:4724
- C:\Windows\System\tLmGuLb.exe
  C:\Windows\System\tLmGuLb.exe
  2⤵
  PID:2160
- C:\Windows\System\xhKBgVV.exe
  C:\Windows\System\xhKBgVV.exe
  2⤵
  PID:4260
- C:\Windows\System\KmktjSH.exe
  C:\Windows\System\KmktjSH.exe
  2⤵
  PID:5972
- C:\Windows\System\JkFGCzs.exe
  C:\Windows\System\JkFGCzs.exe
  2⤵
  PID:1012
- C:\Windows\System\dWxGwIZ.exe
  C:\Windows\System\dWxGwIZ.exe
  2⤵
  PID:6072
- C:\Windows\System\ukbOwAo.exe
  C:\Windows\System\ukbOwAo.exe
  2⤵
  PID:5388
- C:\Windows\System\fOIsuuJ.exe
  C:\Windows\System\fOIsuuJ.exe
  2⤵
  PID:3008
- C:\Windows\System\CSxqdOL.exe
  C:\Windows\System\CSxqdOL.exe
  2⤵
  PID:5200
- C:\Windows\System\aChrHLb.exe
  C:\Windows\System\aChrHLb.exe
  2⤵
  PID:6080
- C:\Windows\System\cKtLCoD.exe
  C:\Windows\System\cKtLCoD.exe
  2⤵
  PID:4972
- C:\Windows\System\paCukfj.exe
  C:\Windows\System\paCukfj.exe
  2⤵
  PID:5016
- C:\Windows\System\wogmSpm.exe
  C:\Windows\System\wogmSpm.exe
  2⤵
  PID:3156
- C:\Windows\System\AtcgkUs.exe
  C:\Windows\System\AtcgkUs.exe
  2⤵
  PID:5536
- C:\Windows\System\HziRFzq.exe
  C:\Windows\System\HziRFzq.exe
  2⤵
  PID:3272
- C:\Windows\System\qKMvCnz.exe
  C:\Windows\System\qKMvCnz.exe
  2⤵
  PID:2488
- C:\Windows\System\wMTsgeg.exe
  C:\Windows\System\wMTsgeg.exe
  2⤵
  PID:2472
- C:\Windows\System\gWDEuSN.exe
  C:\Windows\System\gWDEuSN.exe
  2⤵
  PID:4148
- C:\Windows\System\KgJRCUd.exe
  C:\Windows\System\KgJRCUd.exe
  2⤵
  PID:5284
- C:\Windows\System\nZwapnj.exe
  C:\Windows\System\nZwapnj.exe
  2⤵
  PID:3188
- C:\Windows\System\uyYTbpi.exe
  C:\Windows\System\uyYTbpi.exe
  2⤵
  PID:4532
- C:\Windows\System\NeessvM.exe
  C:\Windows\System\NeessvM.exe
  2⤵
  PID:1568
- C:\Windows\System\IpjHOob.exe
  C:\Windows\System\IpjHOob.exe
  2⤵
  PID:688
- C:\Windows\System\PomZNIU.exe
  C:\Windows\System\PomZNIU.exe
  2⤵
  PID:5828
- C:\Windows\System\ZpkTzsX.exe
  C:\Windows\System\ZpkTzsX.exe
  2⤵
  PID:4040
- C:\Windows\System\KNXyYEz.exe
  C:\Windows\System\KNXyYEz.exe
  2⤵
  PID:1840
- C:\Windows\System\YoAjPLQ.exe
  C:\Windows\System\YoAjPLQ.exe
  2⤵
  PID:1752
- C:\Windows\System\rsXJuPR.exe
  C:\Windows\System\rsXJuPR.exe
  2⤵
  PID:368
- C:\Windows\System\jnziqHb.exe
  C:\Windows\System\jnziqHb.exe
  2⤵
  PID:976
- C:\Windows\System\LgbZEwj.exe
  C:\Windows\System\LgbZEwj.exe
  2⤵
  PID:5840
- C:\Windows\System\QxtwJmY.exe
  C:\Windows\System\QxtwJmY.exe
  2⤵
  PID:2776
- C:\Windows\System\JRNjaUu.exe
  C:\Windows\System\JRNjaUu.exe
  2⤵
  PID:1148
- C:\Windows\System\geNYBUi.exe
  C:\Windows\System\geNYBUi.exe
  2⤵
  PID:3016
- C:\Windows\System\PSbhpRO.exe
  C:\Windows\System\PSbhpRO.exe
  2⤵
  PID:6016
- C:\Windows\System\REPrONc.exe
  C:\Windows\System\REPrONc.exe
  2⤵
  PID:1176
- C:\Windows\System\TAraHYr.exe
  C:\Windows\System\TAraHYr.exe
  2⤵
  PID:1868
- C:\Windows\System\REVVjLu.exe
  C:\Windows\System\REVVjLu.exe
  2⤵
  PID:5744
- C:\Windows\System\oSGbiWR.exe
  C:\Windows\System\oSGbiWR.exe
  2⤵
  PID:1244
- C:\Windows\System\EOjTSnO.exe
  C:\Windows\System\EOjTSnO.exe
  2⤵
  PID:6056
- C:\Windows\System\RGsmADj.exe
  C:\Windows\System\RGsmADj.exe
  2⤵
  PID:3012
- C:\Windows\System\okuCdoA.exe
  C:\Windows\System\okuCdoA.exe
  2⤵
  PID:2020
- C:\Windows\System\EbywIPC.exe
  C:\Windows\System\EbywIPC.exe
  2⤵
  PID:4268
- C:\Windows\System\rNVEQuT.exe
  C:\Windows\System\rNVEQuT.exe
  2⤵
  PID:5620
- C:\Windows\System\PMQMLHh.exe
  C:\Windows\System\PMQMLHh.exe
  2⤵
  PID:4864
- C:\Windows\System\CgdfzTa.exe
  C:\Windows\System\CgdfzTa.exe
  2⤵
  PID:3544
- C:\Windows\System\oxLanPE.exe
  C:\Windows\System\oxLanPE.exe
  2⤵
  PID:4900
- C:\Windows\System\YdqmAqL.exe
  C:\Windows\System\YdqmAqL.exe
  2⤵
  PID:2672
- C:\Windows\System\EPUyNkH.exe
  C:\Windows\System\EPUyNkH.exe
  2⤵
  PID:4304
- C:\Windows\System\XRBFnLC.exe
  C:\Windows\System\XRBFnLC.exe
  2⤵
  PID:2860
- C:\Windows\System\nutkwus.exe
  C:\Windows\System\nutkwus.exe
  2⤵
  PID:3616
- C:\Windows\System\pIAehZt.exe
  C:\Windows\System\pIAehZt.exe
  2⤵
  PID:4524
- C:\Windows\System\pSVWnCs.exe
  C:\Windows\System\pSVWnCs.exe
  2⤵
  PID:4340
- C:\Windows\System\roHRCnG.exe
  C:\Windows\System\roHRCnG.exe
  2⤵
  PID:3952
- C:\Windows\System\YpVUiEV.exe
  C:\Windows\System\YpVUiEV.exe
  2⤵
  PID:5276
- C:\Windows\System\yqoTZQY.exe
  C:\Windows\System\yqoTZQY.exe
  2⤵
  PID:3420
- C:\Windows\System\MiDgAQn.exe
  C:\Windows\System\MiDgAQn.exe
  2⤵
  PID:452
- C:\Windows\System\wFxZYAY.exe
  C:\Windows\System\wFxZYAY.exe
  2⤵
  PID:5488
- C:\Windows\System\DlbbVlI.exe
  C:\Windows\System\DlbbVlI.exe
  2⤵
  PID:508
- C:\Windows\System\EGXurxr.exe
  C:\Windows\System\EGXurxr.exe
  2⤵
  PID:1600
- C:\Windows\System\cEbdAso.exe
  C:\Windows\System\cEbdAso.exe
  2⤵
  PID:2476
- C:\Windows\System\zQTxhhm.exe
  C:\Windows\System\zQTxhhm.exe
  2⤵
  PID:2388
- C:\Windows\System\ibrlaAv.exe
  C:\Windows\System\ibrlaAv.exe
  2⤵
  PID:4804
- C:\Windows\System\sPIeMbR.exe
  C:\Windows\System\sPIeMbR.exe
  2⤵
  PID:3172
- C:\Windows\System\EyJfQgp.exe
  C:\Windows\System\EyJfQgp.exe
  2⤵
  PID:3804
- C:\Windows\System\iWPPEZG.exe
  C:\Windows\System\iWPPEZG.exe
  2⤵
  PID:1584
- C:\Windows\System\DTBsTFJ.exe
  C:\Windows\System\DTBsTFJ.exe
  2⤵
  PID:620
- C:\Windows\System\jMSNRyx.exe
  C:\Windows\System\jMSNRyx.exe
  2⤵
  PID:5332
- C:\Windows\System\MGrClkK.exe
  C:\Windows\System\MGrClkK.exe
  2⤵
  PID:4248
- C:\Windows\System\bJwMKsZ.exe
  C:\Windows\System\bJwMKsZ.exe
  2⤵
  PID:5040
- C:\Windows\System\yGBTHMW.exe
  C:\Windows\System\yGBTHMW.exe
  2⤵
  PID:2576
- C:\Windows\System\tKORUuu.exe
  C:\Windows\System\tKORUuu.exe
  2⤵
  PID:2596
- C:\Windows\System\mjkdZJM.exe
  C:\Windows\System\mjkdZJM.exe
  2⤵
  PID:4300
- C:\Windows\System\xvREtEi.exe
  C:\Windows\System\xvREtEi.exe
  2⤵
  PID:2628
- C:\Windows\System\zjAEgTA.exe
  C:\Windows\System\zjAEgTA.exe
  2⤵
  PID:5048
- C:\Windows\System\nzDkCHL.exe
  C:\Windows\System\nzDkCHL.exe
  2⤵
  PID:3468
- C:\Windows\System\TrPHqsC.exe
  C:\Windows\System\TrPHqsC.exe
  2⤵
  PID:5476
- C:\Windows\System\liFdSuB.exe
  C:\Windows\System\liFdSuB.exe
  2⤵
  PID:4328
- C:\Windows\System\gWwBMBz.exe
  C:\Windows\System\gWwBMBz.exe
  2⤵
  PID:3416
- C:\Windows\System\moksTka.exe
  C:\Windows\System\moksTka.exe
  2⤵
  PID:5076
- C:\Windows\System\xzRELjt.exe
  C:\Windows\System\xzRELjt.exe
  2⤵
  PID:2084
- C:\Windows\System\QeOrLgi.exe
  C:\Windows\System\QeOrLgi.exe
  2⤵
  PID:5108
- C:\Windows\System\WBSlKNl.exe
  C:\Windows\System\WBSlKNl.exe
  2⤵
  PID:3536
- C:\Windows\System\pPfAARN.exe
  C:\Windows\System\pPfAARN.exe
  2⤵
  PID:5960
- C:\Windows\System\iRMwujB.exe
  C:\Windows\System\iRMwujB.exe
  2⤵
  PID:6172
- C:\Windows\System\ExKGBUF.exe
  C:\Windows\System\ExKGBUF.exe
  2⤵
  PID:6212
- C:\Windows\System\jdsyKKY.exe
  C:\Windows\System\jdsyKKY.exe
  2⤵
  PID:6232
- C:\Windows\System\NktbLYC.exe
  C:\Windows\System\NktbLYC.exe
  2⤵
  PID:6252
- C:\Windows\System\rrrJUPm.exe
  C:\Windows\System\rrrJUPm.exe
  2⤵
  PID:6288
- C:\Windows\System\jJbCUlk.exe
  C:\Windows\System\jJbCUlk.exe
  2⤵
  PID:6324
- C:\Windows\System\igFtjQO.exe
  C:\Windows\System\igFtjQO.exe
  2⤵
  PID:6356
- C:\Windows\System\vLCaRMc.exe
  C:\Windows\System\vLCaRMc.exe
  2⤵
  PID:6392
- C:\Windows\System\zTWzpyF.exe
  C:\Windows\System\zTWzpyF.exe
  2⤵
  PID:6420
- C:\Windows\System\BQVbNLZ.exe
  C:\Windows\System\BQVbNLZ.exe
  2⤵
  PID:6448
- C:\Windows\System\TPHXicF.exe
  C:\Windows\System\TPHXicF.exe
  2⤵
  PID:6476
- C:\Windows\System\oCsbSZE.exe
  C:\Windows\System\oCsbSZE.exe
  2⤵
  PID:6508
- C:\Windows\System\pGQTjcc.exe
  C:\Windows\System\pGQTjcc.exe
  2⤵
  PID:6536
- C:\Windows\System\wjleCvr.exe
  C:\Windows\System\wjleCvr.exe
  2⤵
  PID:6564
- C:\Windows\System\gEQEFCs.exe
  C:\Windows\System\gEQEFCs.exe
  2⤵
  PID:6592
- C:\Windows\System\UJNDJzD.exe
  C:\Windows\System\UJNDJzD.exe
  2⤵
  PID:6620
- C:\Windows\System\mTLFtXo.exe
  C:\Windows\System\mTLFtXo.exe
  2⤵
  PID:6648
- C:\Windows\System\tDNDhaZ.exe
  C:\Windows\System\tDNDhaZ.exe
  2⤵
  PID:6676
- C:\Windows\System\MRGZpGK.exe
  C:\Windows\System\MRGZpGK.exe
  2⤵
  PID:6704
- C:\Windows\System\FRpBFMs.exe
  C:\Windows\System\FRpBFMs.exe
  2⤵
  PID:6732
- C:\Windows\System\LiAtciu.exe
  C:\Windows\System\LiAtciu.exe
  2⤵
  PID:6764
- C:\Windows\System\PMnqWGN.exe
  C:\Windows\System\PMnqWGN.exe
  2⤵
  PID:6792
- C:\Windows\System\BzSgmYd.exe
  C:\Windows\System\BzSgmYd.exe
  2⤵
  PID:6820
- C:\Windows\System\NUGfYkM.exe
  C:\Windows\System\NUGfYkM.exe
  2⤵
  PID:6848
- C:\Windows\System\jbzmMGw.exe
  C:\Windows\System\jbzmMGw.exe
  2⤵
  PID:6876
- C:\Windows\System\GpVHTga.exe
  C:\Windows\System\GpVHTga.exe
  2⤵
  PID:6904
- C:\Windows\System\BftChTW.exe
  C:\Windows\System\BftChTW.exe
  2⤵
  PID:6932
- C:\Windows\System\DtdHmkt.exe
  C:\Windows\System\DtdHmkt.exe
  2⤵
  PID:6960
- C:\Windows\System\kdifUNX.exe
  C:\Windows\System\kdifUNX.exe
  2⤵
  PID:6988
- C:\Windows\System\hZTQEwA.exe
  C:\Windows\System\hZTQEwA.exe
  2⤵
  PID:7016
- C:\Windows\System\InaljjI.exe
  C:\Windows\System\InaljjI.exe
  2⤵
  PID:7044
- C:\Windows\System\SAPwJsB.exe
  C:\Windows\System\SAPwJsB.exe
  2⤵
  PID:7072
- C:\Windows\System\tRWuliY.exe
  C:\Windows\System\tRWuliY.exe
  2⤵
  PID:7100
- C:\Windows\System\SATUOsM.exe
  C:\Windows\System\SATUOsM.exe
  2⤵
  PID:7128
- C:\Windows\System\ZmWIdzF.exe
  C:\Windows\System\ZmWIdzF.exe
  2⤵
  PID:7156
- C:\Windows\System\RDcjYvf.exe
  C:\Windows\System\RDcjYvf.exe
  2⤵
  PID:6168
- C:\Windows\System\rUQIrah.exe
  C:\Windows\System\rUQIrah.exe
  2⤵
  PID:6244
- C:\Windows\System\qldiHyf.exe
  C:\Windows\System\qldiHyf.exe
  2⤵
  PID:6280
- C:\Windows\System\TtGBdxR.exe
  C:\Windows\System\TtGBdxR.exe
  2⤵
  PID:6380
- C:\Windows\System\OsVyayf.exe
  C:\Windows\System\OsVyayf.exe
  2⤵
  PID:6440
- C:\Windows\System\mNYjWCg.exe
  C:\Windows\System\mNYjWCg.exe
  2⤵
  PID:6532
- C:\Windows\System\cTBzAFZ.exe
  C:\Windows\System\cTBzAFZ.exe
  2⤵
  PID:6588
- C:\Windows\System\rHNaLBY.exe
  C:\Windows\System\rHNaLBY.exe
  2⤵
  PID:6660
- C:\Windows\System\YIUcKbW.exe
  C:\Windows\System\YIUcKbW.exe
  2⤵
  PID:6720
- C:\Windows\System\lfJenVt.exe
  C:\Windows\System\lfJenVt.exe
  2⤵
  PID:6788
- C:\Windows\System\kFNKMOv.exe
  C:\Windows\System\kFNKMOv.exe
  2⤵
  PID:6860
- C:\Windows\System\uFszvZm.exe
  C:\Windows\System\uFszvZm.exe
  2⤵
  PID:6920
- C:\Windows\System\XaeNnOW.exe
  C:\Windows\System\XaeNnOW.exe
  2⤵
  PID:6984
- C:\Windows\System\bIXftHg.exe
  C:\Windows\System\bIXftHg.exe
  2⤵
  PID:7056
- C:\Windows\System\EpdpaxX.exe
  C:\Windows\System\EpdpaxX.exe
  2⤵
  PID:7120
- C:\Windows\System\hrtevIf.exe
  C:\Windows\System\hrtevIf.exe
  2⤵
  PID:6156
- C:\Windows\System\gDzACRo.exe
  C:\Windows\System\gDzACRo.exe
  2⤵
  PID:6364
- C:\Windows\System\LiLllMD.exe
  C:\Windows\System\LiLllMD.exe
  2⤵
  PID:6504
- C:\Windows\System\gMbRrnd.exe
  C:\Windows\System\gMbRrnd.exe
  2⤵
  PID:6640
- C:\Windows\System\XnwCDkV.exe
  C:\Windows\System\XnwCDkV.exe
  2⤵
  PID:6816
- C:\Windows\System\MBzYalx.exe
  C:\Windows\System\MBzYalx.exe
  2⤵
  PID:6980
- C:\Windows\System\lAQUeeB.exe
  C:\Windows\System\lAQUeeB.exe
  2⤵
  PID:7112
- C:\Windows\System\EONCegt.exe
  C:\Windows\System\EONCegt.exe
  2⤵
  PID:6408
- C:\Windows\System\nWvphjc.exe
  C:\Windows\System\nWvphjc.exe
  2⤵
  PID:6776
- C:\Windows\System\dMDYevR.exe
  C:\Windows\System\dMDYevR.exe
  2⤵
  PID:7092
- C:\Windows\System\LGIjgSo.exe
  C:\Windows\System\LGIjgSo.exe
  2⤵
  PID:6952
- C:\Windows\System\xqDPHPH.exe
  C:\Windows\System\xqDPHPH.exe
  2⤵
  PID:1612
- C:\Windows\System\dIikshp.exe
  C:\Windows\System\dIikshp.exe
  2⤵
  PID:7196
- C:\Windows\System\DcMyNxL.exe
  C:\Windows\System\DcMyNxL.exe
  2⤵
  PID:7224
- C:\Windows\System\WMuhBnv.exe
  C:\Windows\System\WMuhBnv.exe
  2⤵
  PID:7252
- C:\Windows\System\hSsPPCu.exe
  C:\Windows\System\hSsPPCu.exe
  2⤵
  PID:7280
- C:\Windows\System\mddWBJt.exe
  C:\Windows\System\mddWBJt.exe
  2⤵
  PID:7308
- C:\Windows\System\qLoLZKU.exe
  C:\Windows\System\qLoLZKU.exe
  2⤵
  PID:7336
- C:\Windows\System\UtfLDVx.exe
  C:\Windows\System\UtfLDVx.exe
  2⤵
  PID:7364
- C:\Windows\System\FQAmAbk.exe
  C:\Windows\System\FQAmAbk.exe
  2⤵
  PID:7408
- C:\Windows\System\yDZtXok.exe
  C:\Windows\System\yDZtXok.exe
  2⤵
  PID:7424
- C:\Windows\System\lPsXclF.exe
  C:\Windows\System\lPsXclF.exe
  2⤵
  PID:7452
- C:\Windows\System\zuaaxmh.exe
  C:\Windows\System\zuaaxmh.exe
  2⤵
  PID:7468
- C:\Windows\System\BWGNQXx.exe
  C:\Windows\System\BWGNQXx.exe
  2⤵
  PID:7492
- C:\Windows\System\lfGMJDQ.exe
  C:\Windows\System\lfGMJDQ.exe
  2⤵
  PID:7516
- C:\Windows\System\wXoHhBL.exe
  C:\Windows\System\wXoHhBL.exe
  2⤵
  PID:7540
- C:\Windows\System\MhlNYjc.exe
  C:\Windows\System\MhlNYjc.exe
  2⤵
  PID:7576
- C:\Windows\System\kIKFmam.exe
  C:\Windows\System\kIKFmam.exe
  2⤵
  PID:7612
- C:\Windows\System\YUCbcho.exe
  C:\Windows\System\YUCbcho.exe
  2⤵
  PID:7644
- C:\Windows\System\tjmChKT.exe
  C:\Windows\System\tjmChKT.exe
  2⤵
  PID:7676
- C:\Windows\System\AycpyXb.exe
  C:\Windows\System\AycpyXb.exe
  2⤵
  PID:7708
- C:\Windows\System\mzgPgga.exe
  C:\Windows\System\mzgPgga.exe
  2⤵
  PID:7740
- C:\Windows\System\iRqNlVs.exe
  C:\Windows\System\iRqNlVs.exe
  2⤵
  PID:7768
- C:\Windows\System\ODtVmKh.exe
  C:\Windows\System\ODtVmKh.exe
  2⤵
  PID:7800
- C:\Windows\System\vAHagFC.exe
  C:\Windows\System\vAHagFC.exe
  2⤵
  PID:7832
- C:\Windows\System\KRFmVmR.exe
  C:\Windows\System\KRFmVmR.exe
  2⤵
  PID:7860
- C:\Windows\System\KjncmiT.exe
  C:\Windows\System\KjncmiT.exe
  2⤵
  PID:7904
- C:\Windows\System\BNGokpS.exe
  C:\Windows\System\BNGokpS.exe
  2⤵
  PID:7936
- C:\Windows\System\juLrnPq.exe
  C:\Windows\System\juLrnPq.exe
  2⤵
  PID:7964
- C:\Windows\System\ZcRundW.exe
  C:\Windows\System\ZcRundW.exe
  2⤵
  PID:7996
- C:\Windows\System\VfWOsOl.exe
  C:\Windows\System\VfWOsOl.exe
  2⤵
  PID:8020
- C:\Windows\System\WVUmfsN.exe
  C:\Windows\System\WVUmfsN.exe
  2⤵
  PID:8060
- C:\Windows\System\WVDuzqJ.exe
  C:\Windows\System\WVDuzqJ.exe
  2⤵
  PID:8096
- C:\Windows\System\fziIoKd.exe
  C:\Windows\System\fziIoKd.exe
  2⤵
  PID:8124
- C:\Windows\System\AgxcwCv.exe
  C:\Windows\System\AgxcwCv.exe
  2⤵
  PID:8160
- C:\Windows\System\YOulBap.exe
  C:\Windows\System\YOulBap.exe
  2⤵
  PID:7188
- C:\Windows\System\JZQSGgL.exe
  C:\Windows\System\JZQSGgL.exe
  2⤵
  PID:7248
- C:\Windows\System\AulxzgP.exe
  C:\Windows\System\AulxzgP.exe
  2⤵
  PID:7320
- C:\Windows\System\HZjmXdL.exe
  C:\Windows\System\HZjmXdL.exe
  2⤵
  PID:7420
- C:\Windows\System\oUWAKXt.exe
  C:\Windows\System\oUWAKXt.exe
  2⤵
  PID:7488
- C:\Windows\System\Lhskenp.exe
  C:\Windows\System\Lhskenp.exe
  2⤵
  PID:7552
- C:\Windows\System\gMmZEdg.exe
  C:\Windows\System\gMmZEdg.exe
  2⤵
  PID:7620
- C:\Windows\System\ffCbGaY.exe
  C:\Windows\System\ffCbGaY.exe
  2⤵
  PID:7688
- C:\Windows\System\jEiRpnl.exe
  C:\Windows\System\jEiRpnl.exe
  2⤵
  PID:7764
- C:\Windows\System\wBfaexz.exe
  C:\Windows\System\wBfaexz.exe
  2⤵
  PID:7828
- C:\Windows\System\zUxrrVd.exe
  C:\Windows\System\zUxrrVd.exe
  2⤵
  PID:7944
- C:\Windows\System\CwyWDCp.exe
  C:\Windows\System\CwyWDCp.exe
  2⤵
  PID:7980
- C:\Windows\System\MZZSicm.exe
  C:\Windows\System\MZZSicm.exe
  2⤵
  PID:8092
- C:\Windows\System\FqgUWGH.exe
  C:\Windows\System\FqgUWGH.exe
  2⤵
  PID:6700
- C:\Windows\System\WYoVvkC.exe
  C:\Windows\System\WYoVvkC.exe
  2⤵
  PID:7356
- C:\Windows\System\kkRzInO.exe
  C:\Windows\System\kkRzInO.exe
  2⤵
  PID:7596
- C:\Windows\System\tJILoTh.exe
  C:\Windows\System\tJILoTh.exe
  2⤵
  PID:7728
- C:\Windows\System\CvhhuUd.exe
  C:\Windows\System\CvhhuUd.exe
  2⤵
  PID:8016
- C:\Windows\System\DmyJbNG.exe
  C:\Windows\System\DmyJbNG.exe
  2⤵
  PID:8184
- C:\Windows\System\GbkDHXe.exe
  C:\Windows\System\GbkDHXe.exe
  2⤵
  PID:7664
- C:\Windows\System\HHFgHqY.exe
  C:\Windows\System\HHFgHqY.exe
  2⤵
  PID:7928
- C:\Windows\System\KjGEdLQ.exe
  C:\Windows\System\KjGEdLQ.exe
  2⤵
  PID:7820
- C:\Windows\System\nEpIMrq.exe
  C:\Windows\System\nEpIMrq.exe
  2⤵
  PID:8220
- C:\Windows\System\gvJNAvQ.exe
  C:\Windows\System\gvJNAvQ.exe
  2⤵
  PID:8260
- C:\Windows\System\zhDnaWQ.exe
  C:\Windows\System\zhDnaWQ.exe
  2⤵
  PID:8288
- C:\Windows\System\bhLKMtH.exe
  C:\Windows\System\bhLKMtH.exe
  2⤵
  PID:8308
- C:\Windows\System\ZfliTom.exe
  C:\Windows\System\ZfliTom.exe
  2⤵
  PID:8336
- C:\Windows\System\XyuUBkl.exe
  C:\Windows\System\XyuUBkl.exe
  2⤵
  PID:8352
- C:\Windows\System\VsUYATX.exe
  C:\Windows\System\VsUYATX.exe
  2⤵
  PID:8368
- C:\Windows\System\CDjyCZY.exe
  C:\Windows\System\CDjyCZY.exe
  2⤵
  PID:8384
- C:\Windows\System\JTxbWIf.exe
  C:\Windows\System\JTxbWIf.exe
  2⤵
  PID:8412
- C:\Windows\System\vKvetjE.exe
  C:\Windows\System\vKvetjE.exe
  2⤵
  PID:8436
- C:\Windows\System\vClHXmC.exe
  C:\Windows\System\vClHXmC.exe
  2⤵
  PID:8464
- C:\Windows\System\KLJMDOI.exe
  C:\Windows\System\KLJMDOI.exe
  2⤵
  PID:8492
- C:\Windows\System\fooUiIL.exe
  C:\Windows\System\fooUiIL.exe
  2⤵
  PID:8528
- C:\Windows\System\sOclQLX.exe
  C:\Windows\System\sOclQLX.exe
  2⤵
  PID:8552
- C:\Windows\System\TlUcGaN.exe
  C:\Windows\System\TlUcGaN.exe
  2⤵
  PID:8588
- C:\Windows\System\cIerWOB.exe
  C:\Windows\System\cIerWOB.exe
  2⤵
  PID:8628
- C:\Windows\System\LAhyebA.exe
  C:\Windows\System\LAhyebA.exe
  2⤵
  PID:8660
- C:\Windows\System\matKKvG.exe
  C:\Windows\System\matKKvG.exe
  2⤵
  PID:8708
- C:\Windows\System\hCsvzyf.exe
  C:\Windows\System\hCsvzyf.exe
  2⤵
  PID:8736
- C:\Windows\System\vsXtUYn.exe
  C:\Windows\System\vsXtUYn.exe
  2⤵
  PID:8764
- C:\Windows\System\POSrbjZ.exe
  C:\Windows\System\POSrbjZ.exe
  2⤵
  PID:8800
- C:\Windows\System\ltkHjeD.exe
  C:\Windows\System\ltkHjeD.exe
  2⤵
  PID:8816
- C:\Windows\System\AoGsarx.exe
  C:\Windows\System\AoGsarx.exe
  2⤵
  PID:8844
- C:\Windows\System\ltteZGQ.exe
  C:\Windows\System\ltteZGQ.exe
  2⤵
  PID:8864
- C:\Windows\System\NAoxroZ.exe
  C:\Windows\System\NAoxroZ.exe
  2⤵
  PID:8884
- C:\Windows\System\hlmHEBQ.exe
  C:\Windows\System\hlmHEBQ.exe
  2⤵
  PID:8912
- C:\Windows\System\oLintgU.exe
  C:\Windows\System\oLintgU.exe
  2⤵
  PID:8936
- C:\Windows\System\XsSVJRa.exe
  C:\Windows\System\XsSVJRa.exe
  2⤵
  PID:8964
- C:\Windows\System\atiKGWg.exe
  C:\Windows\System\atiKGWg.exe
  2⤵
  PID:8996
- C:\Windows\System\LzkkRQw.exe
  C:\Windows\System\LzkkRQw.exe
  2⤵
  PID:9016
- C:\Windows\System\nqdpxCB.exe
  C:\Windows\System\nqdpxCB.exe
  2⤵
  PID:9056
- C:\Windows\System\RvZHYvM.exe
  C:\Windows\System\RvZHYvM.exe
  2⤵
  PID:9084
- C:\Windows\System\hhoPiXY.exe
  C:\Windows\System\hhoPiXY.exe
  2⤵
  PID:9112
- C:\Windows\System\vmgAgBs.exe
  C:\Windows\System\vmgAgBs.exe
  2⤵
  PID:9132
- C:\Windows\System\XgVAYzu.exe
  C:\Windows\System\XgVAYzu.exe
  2⤵
  PID:9172
- C:\Windows\System\zUxaFZP.exe
  C:\Windows\System\zUxaFZP.exe
  2⤵
  PID:9208
- C:\Windows\System\JAgjAGI.exe
  C:\Windows\System\JAgjAGI.exe
  2⤵
  PID:8148
- C:\Windows\System\yITwGNZ.exe
  C:\Windows\System\yITwGNZ.exe
  2⤵
  PID:8348
- C:\Windows\System\tcdUaJp.exe
  C:\Windows\System\tcdUaJp.exe
  2⤵
  PID:8400
- C:\Windows\System\GHHIXbT.exe
  C:\Windows\System\GHHIXbT.exe
  2⤵
  PID:8408
- C:\Windows\System\yufMGyU.exe
  C:\Windows\System\yufMGyU.exe
  2⤵
  PID:8476
- C:\Windows\System\RoBXbbW.exe
  C:\Windows\System\RoBXbbW.exe
  2⤵
  PID:8540
- C:\Windows\System\ZhAVVkK.exe
  C:\Windows\System\ZhAVVkK.exe
  2⤵
  PID:8676
- C:\Windows\System\gsPXEXJ.exe
  C:\Windows\System\gsPXEXJ.exe
  2⤵
  PID:8620
- C:\Windows\System\TFjEfoT.exe
  C:\Windows\System\TFjEfoT.exe
  2⤵
  PID:8784
- C:\Windows\System\odOqSPZ.exe
  C:\Windows\System\odOqSPZ.exe
  2⤵
  PID:8808
- C:\Windows\System\HoQhllO.exe
  C:\Windows\System\HoQhllO.exe
  2⤵
  PID:8908
- C:\Windows\System\yzSdptF.exe
  C:\Windows\System\yzSdptF.exe
  2⤵
  PID:9048
- C:\Windows\System\qzUbGal.exe
  C:\Windows\System\qzUbGal.exe
  2⤵
  PID:9104
- C:\Windows\System\jOfSmVf.exe
  C:\Windows\System\jOfSmVf.exe
  2⤵
  PID:9196
- C:\Windows\System\KdaiAPI.exe
  C:\Windows\System\KdaiAPI.exe
  2⤵
  PID:9184
- C:\Windows\System\KKCmkqh.exe
  C:\Windows\System\KKCmkqh.exe
  2⤵
  PID:8424
- C:\Windows\System\UrdOTRx.exe
  C:\Windows\System\UrdOTRx.exe
  2⤵
  PID:8616
- C:\Windows\System\nrGlEzr.exe
  C:\Windows\System\nrGlEzr.exe
  2⤵
  PID:8728
- C:\Windows\System\BqTloKe.exe
  C:\Windows\System\BqTloKe.exe
  2⤵
  PID:8828
- C:\Windows\System\LbKgWym.exe
  C:\Windows\System\LbKgWym.exe
  2⤵
  PID:8928
- C:\Windows\System\sWVBztJ.exe
  C:\Windows\System\sWVBztJ.exe
  2⤵
  PID:9108
- C:\Windows\System\jiEjsid.exe
  C:\Windows\System\jiEjsid.exe
  2⤵
  PID:8072
- C:\Windows\System\RNOjqHQ.exe
  C:\Windows\System\RNOjqHQ.exe
  2⤵
  PID:8824
- C:\Windows\System\wBLYGvd.exe
  C:\Windows\System\wBLYGvd.exe
  2⤵
  PID:8900
- C:\Windows\System\AganrFa.exe
  C:\Windows\System\AganrFa.exe
  2⤵
  PID:8296
- C:\Windows\System\ZvuTjaa.exe
  C:\Windows\System\ZvuTjaa.exe
  2⤵
  PID:9240
- C:\Windows\System\WfIktxs.exe
  C:\Windows\System\WfIktxs.exe
  2⤵
  PID:9272
- C:\Windows\System\UVAWFBG.exe
  C:\Windows\System\UVAWFBG.exe
  2⤵
  PID:9296
- C:\Windows\System\SAUTGGP.exe
  C:\Windows\System\SAUTGGP.exe
  2⤵
  PID:9328
- C:\Windows\System\xKwwzwX.exe
  C:\Windows\System\xKwwzwX.exe
  2⤵
  PID:9356
- C:\Windows\System\ECygefE.exe
  C:\Windows\System\ECygefE.exe
  2⤵
  PID:9384
- C:\Windows\System\ZFfhkbj.exe
  C:\Windows\System\ZFfhkbj.exe
  2⤵
  PID:9416
- C:\Windows\System\xKvEDNk.exe
  C:\Windows\System\xKvEDNk.exe
  2⤵
  PID:9452
- C:\Windows\System\aUERGwM.exe
  C:\Windows\System\aUERGwM.exe
  2⤵
  PID:9472
- C:\Windows\System\gbRecSA.exe
  C:\Windows\System\gbRecSA.exe
  2⤵
  PID:9500
- C:\Windows\System\zZhHPHu.exe
  C:\Windows\System\zZhHPHu.exe
  2⤵
  PID:9528
- C:\Windows\System\BrcIjbH.exe
  C:\Windows\System\BrcIjbH.exe
  2⤵
  PID:9552
- C:\Windows\System\ewuCbje.exe
  C:\Windows\System\ewuCbje.exe
  2⤵
  PID:9580
- C:\Windows\System\kKAKhhe.exe
  C:\Windows\System\kKAKhhe.exe
  2⤵
  PID:9596
- C:\Windows\System\xGxbOKw.exe
  C:\Windows\System\xGxbOKw.exe
  2⤵
  PID:9632
- C:\Windows\System\YYTvYWS.exe
  C:\Windows\System\YYTvYWS.exe
  2⤵
  PID:9664
- C:\Windows\System\DpHLnlC.exe
  C:\Windows\System\DpHLnlC.exe
  2⤵
  PID:9692
- C:\Windows\System\YDSaVLO.exe
  C:\Windows\System\YDSaVLO.exe
  2⤵
  PID:9720
- C:\Windows\System\OxRmlrO.exe
  C:\Windows\System\OxRmlrO.exe
  2⤵
  PID:9748
- C:\Windows\System\ZLMgKRa.exe
  C:\Windows\System\ZLMgKRa.exe
  2⤵
  PID:9776
- C:\Windows\System\eIrTnzG.exe
  C:\Windows\System\eIrTnzG.exe
  2⤵
  PID:9804
- C:\Windows\System\Cywuyqz.exe
  C:\Windows\System\Cywuyqz.exe
  2⤵
  PID:9820
- C:\Windows\System\zKxBpQB.exe
  C:\Windows\System\zKxBpQB.exe
  2⤵
  PID:9848
- C:\Windows\System\jzZvieC.exe
  C:\Windows\System\jzZvieC.exe
  2⤵
  PID:9872
- C:\Windows\System\cFeNiAw.exe
  C:\Windows\System\cFeNiAw.exe
  2⤵
  PID:9900
- C:\Windows\System\pwpNViG.exe
  C:\Windows\System\pwpNViG.exe
  2⤵
  PID:9928
- C:\Windows\System\gmNmHkC.exe
  C:\Windows\System\gmNmHkC.exe
  2⤵
  PID:9952
- C:\Windows\System\ZgvReXT.exe
  C:\Windows\System\ZgvReXT.exe
  2⤵
  PID:9968
- C:\Windows\System\SRWwnLm.exe
  C:\Windows\System\SRWwnLm.exe
  2⤵
  PID:9988
- C:\Windows\System\BQdzlqm.exe
  C:\Windows\System\BQdzlqm.exe
  2⤵
  PID:10016
- C:\Windows\System\qGhKqlf.exe
  C:\Windows\System\qGhKqlf.exe
  2⤵
  PID:10040
- C:\Windows\System\oUsUlUr.exe
  C:\Windows\System\oUsUlUr.exe
  2⤵
  PID:10068
- C:\Windows\System\lTadIXw.exe
  C:\Windows\System\lTadIXw.exe
  2⤵
  PID:10088
- C:\Windows\System\UcHGKvI.exe
  C:\Windows\System\UcHGKvI.exe
  2⤵
  PID:10120
- C:\Windows\System\asyxURi.exe
  C:\Windows\System\asyxURi.exe
  2⤵
  PID:10156
- C:\Windows\System\xVsESSf.exe
  C:\Windows\System\xVsESSf.exe
  2⤵
  PID:10176
- C:\Windows\System\QZsahjp.exe
  C:\Windows\System\QZsahjp.exe
  2⤵
  PID:10204
- C:\Windows\System\ngEyAwL.exe
  C:\Windows\System\ngEyAwL.exe
  2⤵
  PID:10228
- C:\Windows\System\HWbZoRP.exe
  C:\Windows\System\HWbZoRP.exe
  2⤵
  PID:9232
- C:\Windows\System\QeaWIur.exe
  C:\Windows\System\QeaWIur.exe
  2⤵
  PID:9288
- C:\Windows\System\mTGIpze.exe
  C:\Windows\System\mTGIpze.exe
  2⤵
  PID:9368
- C:\Windows\System\NofgaMQ.exe
  C:\Windows\System\NofgaMQ.exe
  2⤵
  PID:9424
- C:\Windows\System\lqnImbb.exe
  C:\Windows\System\lqnImbb.exe
  2⤵
  PID:9540
- C:\Windows\System\oUcuuDr.exe
  C:\Windows\System\oUcuuDr.exe
  2⤵
  PID:9564
- C:\Windows\System\WAGDMxb.exe
  C:\Windows\System\WAGDMxb.exe
  2⤵
  PID:9588
- C:\Windows\System\YClgtCl.exe
  C:\Windows\System\YClgtCl.exe
  2⤵
  PID:9704
- C:\Windows\System\QrEApQv.exe
  C:\Windows\System\QrEApQv.exe
  2⤵
  PID:9764
- C:\Windows\System\ZaArYrA.exe
  C:\Windows\System\ZaArYrA.exe
  2⤵
  PID:9816
- C:\Windows\System\vLchRJR.exe
  C:\Windows\System\vLchRJR.exe
  2⤵
  PID:9912
- C:\Windows\System\awcHrZu.exe
  C:\Windows\System\awcHrZu.exe
  2⤵
  PID:10012
- C:\Windows\System\jmMiEGz.exe
  C:\Windows\System\jmMiEGz.exe
  2⤵
  PID:10104
- C:\Windows\System\QuIPDld.exe
  C:\Windows\System\QuIPDld.exe
  2⤵
  PID:10140
- C:\Windows\System\bQdxgWG.exe
  C:\Windows\System\bQdxgWG.exe
  2⤵
  PID:10220
- C:\Windows\System\zIpGjrg.exe
  C:\Windows\System\zIpGjrg.exe
  2⤵
  PID:9308
- C:\Windows\System\ginWkkG.exe
  C:\Windows\System\ginWkkG.exe
  2⤵
  PID:9488
- C:\Windows\System\TjUDuYs.exe
  C:\Windows\System\TjUDuYs.exe
  2⤵
  PID:9340
- C:\Windows\System\LLpeJvH.exe
  C:\Windows\System\LLpeJvH.exe
  2⤵
  PID:9736
- C:\Windows\System\xWmJRPQ.exe
  C:\Windows\System\xWmJRPQ.exe
  2⤵
  PID:9860
- C:\Windows\System\XqnvdWz.exe
  C:\Windows\System\XqnvdWz.exe
  2⤵
  PID:10128
- C:\Windows\System\jkLxlfW.exe
  C:\Windows\System\jkLxlfW.exe
  2⤵
  PID:10216
- C:\Windows\System\WgLwOGn.exe
  C:\Windows\System\WgLwOGn.exe
  2⤵
  PID:10196
- C:\Windows\System\AsvSgKF.exe
  C:\Windows\System\AsvSgKF.exe
  2⤵
  PID:9616
- C:\Windows\System\nGrEIHY.exe
  C:\Windows\System\nGrEIHY.exe
  2⤵
  PID:9732
- C:\Windows\System\vVAQQIQ.exe
  C:\Windows\System\vVAQQIQ.exe
  2⤵
  PID:10252
- C:\Windows\System\KiYaaUj.exe
  C:\Windows\System\KiYaaUj.exe
  2⤵
  PID:10284
- C:\Windows\System\JLQJJpT.exe
  C:\Windows\System\JLQJJpT.exe
  2⤵
  PID:10300
- C:\Windows\System\vpEWBfR.exe
  C:\Windows\System\vpEWBfR.exe
  2⤵
  PID:10344
- C:\Windows\System\JQNLDGz.exe
  C:\Windows\System\JQNLDGz.exe
  2⤵
  PID:10368
- C:\Windows\System\vhjfZGZ.exe
  C:\Windows\System\vhjfZGZ.exe
  2⤵
  PID:10396
- C:\Windows\System\wSDMqEt.exe
  C:\Windows\System\wSDMqEt.exe
  2⤵
  PID:10420
- C:\Windows\System\zxcAnRv.exe
  C:\Windows\System\zxcAnRv.exe
  2⤵
  PID:10448
- C:\Windows\System\OvVZXNj.exe
  C:\Windows\System\OvVZXNj.exe
  2⤵
  PID:10480
- C:\Windows\System\vsZNbJM.exe
  C:\Windows\System\vsZNbJM.exe
  2⤵
  PID:10496
- C:\Windows\System\ASEAyJt.exe
  C:\Windows\System\ASEAyJt.exe
  2⤵
  PID:10536
- C:\Windows\System\TZiTcpg.exe
  C:\Windows\System\TZiTcpg.exe
  2⤵
  PID:10556
- C:\Windows\System\iXchynt.exe
  C:\Windows\System\iXchynt.exe
  2⤵
  PID:10580
- C:\Windows\System\FWVSvYr.exe
  C:\Windows\System\FWVSvYr.exe
  2⤵
  PID:10612
- C:\Windows\System\woHAPFH.exe
  C:\Windows\System\woHAPFH.exe
  2⤵
  PID:10636
- C:\Windows\System\VdRqckf.exe
  C:\Windows\System\VdRqckf.exe
  2⤵
  PID:10660
- C:\Windows\System\CuSIbTp.exe
  C:\Windows\System\CuSIbTp.exe
  2⤵
  PID:10688
- C:\Windows\System\dShcOuO.exe
  C:\Windows\System\dShcOuO.exe
  2⤵
  PID:10716
- C:\Windows\System\JVQgCRp.exe
  C:\Windows\System\JVQgCRp.exe
  2⤵
  PID:10740
- C:\Windows\System\iXuoEwk.exe
  C:\Windows\System\iXuoEwk.exe
  2⤵
  PID:10776
- C:\Windows\System\QNwtkAs.exe
  C:\Windows\System\QNwtkAs.exe
  2⤵
  PID:10796
- C:\Windows\System\uaOpecu.exe
  C:\Windows\System\uaOpecu.exe
  2⤵
  PID:10832
- C:\Windows\System\mbmrWJz.exe
  C:\Windows\System\mbmrWJz.exe
  2⤵
  PID:10860
- C:\Windows\System\HsJBAJN.exe
  C:\Windows\System\HsJBAJN.exe
  2⤵
  PID:10880
- C:\Windows\System\lmMOulJ.exe
  C:\Windows\System\lmMOulJ.exe
  2⤵
  PID:10916
- C:\Windows\System\MWfmhHO.exe
  C:\Windows\System\MWfmhHO.exe
  2⤵
  PID:10936
- C:\Windows\System\RIEDjnS.exe
  C:\Windows\System\RIEDjnS.exe
  2⤵
  PID:10964
- C:\Windows\System\llgkkqB.exe
  C:\Windows\System\llgkkqB.exe
  2⤵
  PID:10992
- C:\Windows\System\yIItMwF.exe
  C:\Windows\System\yIItMwF.exe
  2⤵
  PID:11028
- C:\Windows\System\XAEtAzo.exe
  C:\Windows\System\XAEtAzo.exe
  2⤵
  PID:11052
- C:\Windows\System\BvLpVrl.exe
  C:\Windows\System\BvLpVrl.exe
  2⤵
  PID:11076
- C:\Windows\System\BfpYhaM.exe
  C:\Windows\System\BfpYhaM.exe
  2⤵
  PID:11108
- C:\Windows\System\kNUgIBO.exe
  C:\Windows\System\kNUgIBO.exe
  2⤵
  PID:11132
- C:\Windows\System\NwTWppF.exe
  C:\Windows\System\NwTWppF.exe
  2⤵
  PID:11156
- C:\Windows\System\BRNPCyX.exe
  C:\Windows\System\BRNPCyX.exe
  2⤵
  PID:11172
- C:\Windows\System\AbarhTW.exe
  C:\Windows\System\AbarhTW.exe
  2⤵
  PID:11200
- C:\Windows\System\sQpmMfI.exe
  C:\Windows\System\sQpmMfI.exe
  2⤵
  PID:11224
- C:\Windows\System\RogQreQ.exe
  C:\Windows\System\RogQreQ.exe
  2⤵
  PID:11252
- C:\Windows\System\GyhUZYQ.exe
  C:\Windows\System\GyhUZYQ.exe
  2⤵
  PID:10024
- C:\Windows\System\ksDEiXj.exe
  C:\Windows\System\ksDEiXj.exe
  2⤵
  PID:10276
- C:\Windows\System\kxLJdaf.exe
  C:\Windows\System\kxLJdaf.exe
  2⤵
  PID:10360
- C:\Windows\System\kIwgMdJ.exe
  C:\Windows\System\kIwgMdJ.exe
  2⤵
  PID:10432
- C:\Windows\System\cCWwNdm.exe
  C:\Windows\System\cCWwNdm.exe
  2⤵
  PID:10468
- C:\Windows\System\tSdrqXU.exe
  C:\Windows\System\tSdrqXU.exe
  2⤵
  PID:10548
- C:\Windows\System\PJrTAPB.exe
  C:\Windows\System\PJrTAPB.exe
  2⤵
  PID:10652
- C:\Windows\System\LPcrIVI.exe
  C:\Windows\System\LPcrIVI.exe
  2⤵
  PID:10648
- C:\Windows\System\FwxVJTI.exe
  C:\Windows\System\FwxVJTI.exe
  2⤵
  PID:10788
- C:\Windows\System\kxtmnaQ.exe
  C:\Windows\System\kxtmnaQ.exe
  2⤵
  PID:10868
- C:\Windows\System\AohwFCK.exe
  C:\Windows\System\AohwFCK.exe
  2⤵
  PID:10924
- C:\Windows\System\YTOvIiO.exe
  C:\Windows\System\YTOvIiO.exe
  2⤵
  PID:11048
- C:\Windows\System\GPBlnXd.exe
  C:\Windows\System\GPBlnXd.exe
  2⤵
  PID:11128
- C:\Windows\System\vfexkKS.exe
  C:\Windows\System\vfexkKS.exe
  2⤵
  PID:11168
- C:\Windows\System\bMsLTld.exe
  C:\Windows\System\bMsLTld.exe
  2⤵
  PID:11184
- C:\Windows\System\TuliAVL.exe
  C:\Windows\System\TuliAVL.exe
  2⤵
  PID:9984
- C:\Windows\System\yUbRWeZ.exe
  C:\Windows\System\yUbRWeZ.exe
  2⤵
  PID:10488
- C:\Windows\System\yhdDupu.exe
  C:\Windows\System\yhdDupu.exe
  2⤵
  PID:10852
- C:\Windows\System\ExVTWHr.exe
  C:\Windows\System\ExVTWHr.exe
  2⤵
  PID:10568
- C:\Windows\System\olDipPT.exe
  C:\Windows\System\olDipPT.exe
  2⤵
  PID:10948
- C:\Windows\System\eivBPJG.exe
  C:\Windows\System\eivBPJG.exe
  2⤵
  PID:11044
- C:\Windows\System\RqzZZiA.exe
  C:\Windows\System\RqzZZiA.exe
  2⤵
  PID:9920
- C:\Windows\System\qdayGyL.exe
  C:\Windows\System\qdayGyL.exe
  2⤵
  PID:10624
- C:\Windows\System\dVHmChN.exe
  C:\Windows\System\dVHmChN.exe
  2⤵
  PID:10828
- C:\Windows\System\wjvUONX.exe
  C:\Windows\System\wjvUONX.exe
  2⤵
  PID:11268
- C:\Windows\System\aAQcYJL.exe
  C:\Windows\System\aAQcYJL.exe
  2⤵
  PID:11292
- C:\Windows\System\oaicRfW.exe
  C:\Windows\System\oaicRfW.exe
  2⤵
  PID:11328
- C:\Windows\System\yKAUXTl.exe
  C:\Windows\System\yKAUXTl.exe
  2⤵
  PID:11352
- C:\Windows\System\EfGrAvB.exe
  C:\Windows\System\EfGrAvB.exe
  2⤵
  PID:11388
- C:\Windows\System\BOsoyoF.exe
  C:\Windows\System\BOsoyoF.exe
  2⤵
  PID:11408
- C:\Windows\System\BTbTtza.exe
  C:\Windows\System\BTbTtza.exe
  2⤵
  PID:11436
- C:\Windows\System\cfUMgqu.exe
  C:\Windows\System\cfUMgqu.exe
  2⤵
  PID:11456
- C:\Windows\System\NigOfEQ.exe
  C:\Windows\System\NigOfEQ.exe
  2⤵
  PID:11496
- C:\Windows\System\VIKQISG.exe
  C:\Windows\System\VIKQISG.exe
  2⤵
  PID:11524
- C:\Windows\System\yxlVkhs.exe
  C:\Windows\System\yxlVkhs.exe
  2⤵
  PID:11620
- C:\Windows\System\muVEcEt.exe
  C:\Windows\System\muVEcEt.exe
  2⤵
  PID:11640
- C:\Windows\System\PBjuCnI.exe
  C:\Windows\System\PBjuCnI.exe
  2⤵
  PID:11660
- C:\Windows\System\USahaHY.exe
  C:\Windows\System\USahaHY.exe
  2⤵
  PID:11684
- C:\Windows\System\jjZzLtj.exe
  C:\Windows\System\jjZzLtj.exe
  2⤵
  PID:11708
- C:\Windows\System\YHeiySP.exe
  C:\Windows\System\YHeiySP.exe
  2⤵
  PID:11728
- C:\Windows\System\ynEARcd.exe
  C:\Windows\System\ynEARcd.exe
  2⤵
  PID:11748
- C:\Windows\System\OfwPbjR.exe
  C:\Windows\System\OfwPbjR.exe
  2⤵
  PID:11780
- C:\Windows\System\XhQcOEu.exe
  C:\Windows\System\XhQcOEu.exe
  2⤵
  PID:11800
- C:\Windows\System\tJyfJrw.exe
  C:\Windows\System\tJyfJrw.exe
  2⤵
  PID:11824
- C:\Windows\System\nKgbBaI.exe
  C:\Windows\System\nKgbBaI.exe
  2⤵
  PID:11844
- C:\Windows\System\cjjUHEY.exe
  C:\Windows\System\cjjUHEY.exe
  2⤵
  PID:11876
- C:\Windows\System\CjNQwlk.exe
  C:\Windows\System\CjNQwlk.exe
  2⤵
  PID:11900
- C:\Windows\System\KnaTzfx.exe
  C:\Windows\System\KnaTzfx.exe
  2⤵
  PID:11932
- C:\Windows\System\gvQUBtF.exe
  C:\Windows\System\gvQUBtF.exe
  2⤵
  PID:11956
- C:\Windows\System\IhZClsN.exe
  C:\Windows\System\IhZClsN.exe
  2⤵
  PID:11988
- C:\Windows\System\lTtHeQV.exe
  C:\Windows\System\lTtHeQV.exe
  2⤵
  PID:12024
- C:\Windows\System\vlChzkO.exe
  C:\Windows\System\vlChzkO.exe
  2⤵
  PID:12052
- C:\Windows\System\WPhieKB.exe
  C:\Windows\System\WPhieKB.exe
  2⤵
  PID:12080
- C:\Windows\System\EiepOLM.exe
  C:\Windows\System\EiepOLM.exe
  2⤵
  PID:12112
- C:\Windows\System\CbtLwSl.exe
  C:\Windows\System\CbtLwSl.exe
  2⤵
  PID:12136
- C:\Windows\System\oDrjXkh.exe
  C:\Windows\System\oDrjXkh.exe
  2⤵
  PID:12168
- C:\Windows\System\bQVWZYG.exe
  C:\Windows\System\bQVWZYG.exe
  2⤵
  PID:12196
- C:\Windows\System\cArbahs.exe
  C:\Windows\System\cArbahs.exe
  2⤵
  PID:12232
- C:\Windows\System\bAcDXKw.exe
  C:\Windows\System\bAcDXKw.exe
  2⤵
  PID:12264
- C:\Windows\System\YzncpTg.exe
  C:\Windows\System\YzncpTg.exe
  2⤵
  PID:11148
- C:\Windows\System\DHVZfrs.exe
  C:\Windows\System\DHVZfrs.exe
  2⤵
  PID:11288
- C:\Windows\System\dzWXZkX.exe
  C:\Windows\System\dzWXZkX.exe
  2⤵
  PID:11344
- C:\Windows\System\PIfVTqU.exe
  C:\Windows\System\PIfVTqU.exe
  2⤵
  PID:11424
- C:\Windows\System\LDdOEqb.exe
  C:\Windows\System\LDdOEqb.exe
  2⤵
  PID:11396
- C:\Windows\System\eWSbxNX.exe
  C:\Windows\System\eWSbxNX.exe
  2⤵
  PID:11592
- C:\Windows\System\cpndVCm.exe
  C:\Windows\System\cpndVCm.exe
  2⤵
  PID:11632
- C:\Windows\System\DTnaJFk.exe
  C:\Windows\System\DTnaJFk.exe
  2⤵
  PID:11700
- C:\Windows\System\gOSFjLA.exe
  C:\Windows\System\gOSFjLA.exe
  2⤵
  PID:11772
- C:\Windows\System\YRfdbPn.exe
  C:\Windows\System\YRfdbPn.exe
  2⤵
  PID:11860
- C:\Windows\System\UFPVZKX.exe
  C:\Windows\System\UFPVZKX.exe
  2⤵
  PID:11872
- C:\Windows\System\JneCIrS.exe
  C:\Windows\System\JneCIrS.exe
  2⤵
  PID:11912
- C:\Windows\System\YGPgifw.exe
  C:\Windows\System\YGPgifw.exe
  2⤵
  PID:12068
- C:\Windows\System\QAgZtMN.exe
  C:\Windows\System\QAgZtMN.exe
  2⤵
  PID:12148
- C:\Windows\System\lLENAzD.exe
  C:\Windows\System\lLENAzD.exe
  2⤵
  PID:12192
- C:\Windows\System\eYEvexF.exe
  C:\Windows\System\eYEvexF.exe
  2⤵
  PID:10628
- C:\Windows\System\nwTLkfY.exe
  C:\Windows\System\nwTLkfY.exe
  2⤵
  PID:11304
- C:\Windows\System\JSftFyL.exe
  C:\Windows\System\JSftFyL.exe
  2⤵
  PID:11516
- C:\Windows\System\wSmSTKG.exe
  C:\Windows\System\wSmSTKG.exe
  2⤵
  PID:11736
- C:\Windows\System\xqmgMyj.exe
  C:\Windows\System\xqmgMyj.exe
  2⤵
  PID:11840
- C:\Windows\System\MfJGChv.exe
  C:\Windows\System\MfJGChv.exe
  2⤵
  PID:11948
- C:\Windows\System\rCNLSNf.exe
  C:\Windows\System\rCNLSNf.exe
  2⤵
  PID:12044
- C:\Windows\System\BQMQSKS.exe
  C:\Windows\System\BQMQSKS.exe
  2⤵
  PID:12256
- C:\Windows\System\vgyNtpr.exe
  C:\Windows\System\vgyNtpr.exe
  2⤵
  PID:11432
- C:\Windows\System\gVQgivt.exe
  C:\Windows\System\gVQgivt.exe
  2⤵
  PID:11832
- C:\Windows\System\udMOscv.exe
  C:\Windows\System\udMOscv.exe
  2⤵
  PID:11928
- C:\Windows\System\xnHdsti.exe
  C:\Windows\System\xnHdsti.exe
  2⤵
  PID:12180
- C:\Windows\System\sfGbtjz.exe
  C:\Windows\System\sfGbtjz.exe
  2⤵
  PID:11676
- C:\Windows\System\YKhYEFp.exe
  C:\Windows\System\YKhYEFp.exe
  2⤵
  PID:12316
- C:\Windows\System\HxWUMka.exe
  C:\Windows\System\HxWUMka.exe
  2⤵
  PID:12348
- C:\Windows\System\msqZvdo.exe
  C:\Windows\System\msqZvdo.exe
  2⤵
  PID:12368
- C:\Windows\System\kevmqqa.exe
  C:\Windows\System\kevmqqa.exe
  2⤵
  PID:12408
- C:\Windows\System\PQrAnQs.exe
  C:\Windows\System\PQrAnQs.exe
  2⤵
  PID:12436
- C:\Windows\System\sWUBoGG.exe
  C:\Windows\System\sWUBoGG.exe
  2⤵
  PID:12452
- C:\Windows\System\tdDieFP.exe
  C:\Windows\System\tdDieFP.exe
  2⤵
  PID:12484
- C:\Windows\System\MKuwuGI.exe
  C:\Windows\System\MKuwuGI.exe
  2⤵
  PID:12516
- C:\Windows\System\Niatiby.exe
  C:\Windows\System\Niatiby.exe
  2⤵
  PID:12552
- C:\Windows\System\hltbTxr.exe
  C:\Windows\System\hltbTxr.exe
  2⤵
  PID:12576
- C:\Windows\System\ALaZbcN.exe
  C:\Windows\System\ALaZbcN.exe
  2⤵
  PID:12592
- C:\Windows\System\YtlrRYt.exe
  C:\Windows\System\YtlrRYt.exe
  2⤵
  PID:12628
- C:\Windows\System\DhQFBYL.exe
  C:\Windows\System\DhQFBYL.exe
  2⤵
  PID:12660
- C:\Windows\System\XbQNMZz.exe
  C:\Windows\System\XbQNMZz.exe
  2⤵
  PID:12680
- C:\Windows\System\wNhWYcl.exe
  C:\Windows\System\wNhWYcl.exe
  2⤵
  PID:12708
- C:\Windows\System\zWjaWpf.exe
  C:\Windows\System\zWjaWpf.exe
  2⤵
  PID:12744
- C:\Windows\System\zQzQTXW.exe
  C:\Windows\System\zQzQTXW.exe
  2⤵
  PID:12776
- C:\Windows\System\zUVjvHk.exe
  C:\Windows\System\zUVjvHk.exe
  2⤵
  PID:12800
- C:\Windows\System\KRrYFoK.exe
  C:\Windows\System\KRrYFoK.exe
  2⤵
  PID:12824
- C:\Windows\System\GKVLFxE.exe
  C:\Windows\System\GKVLFxE.exe
  2⤵
  PID:12852
- C:\Windows\System\UljlIYC.exe
  C:\Windows\System\UljlIYC.exe
  2⤵
  PID:12880
- C:\Windows\System\MTYSCnm.exe
  C:\Windows\System\MTYSCnm.exe
  2⤵
  PID:12900
- C:\Windows\System\lQnTnoF.exe
  C:\Windows\System\lQnTnoF.exe
  2⤵
  PID:12916
- C:\Windows\System\dFHrKMA.exe
  C:\Windows\System\dFHrKMA.exe
  2⤵
  PID:12940
- C:\Windows\System\TwDCKEb.exe
  C:\Windows\System\TwDCKEb.exe
  2⤵
  PID:12968
- C:\Windows\System\JfRedcf.exe
  C:\Windows\System\JfRedcf.exe
  2⤵
  PID:12996
- C:\Windows\System\gOLQhss.exe
  C:\Windows\System\gOLQhss.exe
  2⤵
  PID:13028
- C:\Windows\System\HttHpuJ.exe
  C:\Windows\System\HttHpuJ.exe
  2⤵
  PID:13056
- C:\Windows\System\LhtjvKS.exe
  C:\Windows\System\LhtjvKS.exe
  2⤵
  PID:13088
- C:\Windows\System\jafpAOw.exe
  C:\Windows\System\jafpAOw.exe
  2⤵
  PID:13120
- C:\Windows\System\Jhehkhd.exe
  C:\Windows\System\Jhehkhd.exe
  2⤵
  PID:13156
- C:\Windows\System\DeDEqGl.exe
  C:\Windows\System\DeDEqGl.exe
  2⤵
  PID:13180
- C:\Windows\System\pOvlRHh.exe
  C:\Windows\System\pOvlRHh.exe
  2⤵
  PID:13196
- C:\Windows\System\uaJutdv.exe
  C:\Windows\System\uaJutdv.exe
  2⤵
  PID:13228
- C:\Windows\System\HxZOupj.exe
  C:\Windows\System\HxZOupj.exe
  2⤵
  PID:13244
- C:\Windows\System\XIqYyea.exe
  C:\Windows\System\XIqYyea.exe
  2⤵
  PID:13272
- C:\Windows\System\JPmaJJY.exe
  C:\Windows\System\JPmaJJY.exe
  2⤵
  PID:13304
- C:\Windows\System\IXOoPdJ.exe
  C:\Windows\System\IXOoPdJ.exe
  2⤵
  PID:12276
- C:\Windows\System\othNelZ.exe
  C:\Windows\System\othNelZ.exe
  2⤵
  PID:12308
- C:\Windows\System\reTUJik.exe
  C:\Windows\System\reTUJik.exe
  2⤵
  PID:12380
- C:\Windows\System\YVreTxY.exe
  C:\Windows\System\YVreTxY.exe
  2⤵
  PID:12512
- C:\Windows\System\BXNSWcP.exe
  C:\Windows\System\BXNSWcP.exe
  2⤵
  PID:12544
- C:\Windows\System\NeNpfbH.exe
  C:\Windows\System\NeNpfbH.exe
  2⤵
  PID:12584
- C:\Windows\System\IRyxWIC.exe
  C:\Windows\System\IRyxWIC.exe
  2⤵
  PID:12676
- C:\Windows\System\GquOOst.exe
  C:\Windows\System\GquOOst.exe
  2⤵
  PID:12732
- C:\Windows\System\crsGmvP.exe
  C:\Windows\System\crsGmvP.exe
  2⤵
  PID:12796
- C:\Windows\System\ZMIBdZG.exe
  C:\Windows\System\ZMIBdZG.exe
  2⤵
  PID:12908
- C:\Windows\System\wwvlKKm.exe
  C:\Windows\System\wwvlKKm.exe
  2⤵
  PID:12956
- C:\Windows\System\BJntNWa.exe
  C:\Windows\System\BJntNWa.exe
  2⤵
  PID:13036
- C:\Windows\System\iSbbNMz.exe
  C:\Windows\System\iSbbNMz.exe
  2⤵
  PID:13152
- C:\Windows\System\pVgcvxS.exe
  C:\Windows\System\pVgcvxS.exe
  2⤵
  PID:13216
- C:\Windows\System\aqKdvPa.exe
  C:\Windows\System\aqKdvPa.exe
  2⤵
  PID:13296
- C:\Windows\System\gziHfjT.exe
  C:\Windows\System\gziHfjT.exe
  2⤵
  PID:12312
- C:\Windows\System\hhDESTU.exe
  C:\Windows\System\hhDESTU.exe
  2⤵
  PID:12292
- C:\Windows\System\zWhbvev.exe
  C:\Windows\System\zWhbvev.exe
  2⤵
  PID:12700
- C:\Windows\System\wYVZTCM.exe
  C:\Windows\System\wYVZTCM.exe
  2⤵
  PID:12624
- C:\Windows\System\EADkfiv.exe
  C:\Windows\System\EADkfiv.exe
  2⤵
  PID:12768
- C:\Windows\System\COZzlsC.exe
  C:\Windows\System\COZzlsC.exe
  2⤵
  PID:12952
- C:\Windows\System\TbYeNeg.exe
  C:\Windows\System\TbYeNeg.exe
  2⤵
  PID:13288
- C:\Windows\System\ZWqXJnE.exe
  C:\Windows\System\ZWqXJnE.exe
  2⤵
  PID:12364
- C:\Windows\System\ludRAKM.exe
  C:\Windows\System\ludRAKM.exe
  2⤵
  PID:12420
- C:\Windows\System\XMvYrVT.exe
  C:\Windows\System\XMvYrVT.exe
  2⤵
  PID:12724
- C:\Windows\System\IntIssq.exe
  C:\Windows\System\IntIssq.exe
  2⤵
  PID:13292
- C:\Windows\System\DvPemSK.exe
  C:\Windows\System\DvPemSK.exe
  2⤵
  PID:13324
- C:\Windows\System\bTrywid.exe
  C:\Windows\System\bTrywid.exe
  2⤵
  PID:13360
- C:\Windows\System\cAkYfzm.exe
  C:\Windows\System\cAkYfzm.exe
  2⤵
  PID:13396
- C:\Windows\System\xNtCvqZ.exe
  C:\Windows\System\xNtCvqZ.exe
  2⤵
  PID:13424
- C:\Windows\System\VDkGvgv.exe
  C:\Windows\System\VDkGvgv.exe
  2⤵
  PID:13440
- C:\Windows\System\TzSyPCY.exe
  C:\Windows\System\TzSyPCY.exe
  2⤵
  PID:13464
- C:\Windows\System\rwEAXXC.exe
  C:\Windows\System\rwEAXXC.exe
  2⤵
  PID:13492
- C:\Windows\System\TCCaLCd.exe
  C:\Windows\System\TCCaLCd.exe
  2⤵
  PID:13520
- C:\Windows\System\UsGFljp.exe
  C:\Windows\System\UsGFljp.exe
  2⤵
  PID:13544
- C:\Windows\System\nrdWqWF.exe
  C:\Windows\System\nrdWqWF.exe
  2⤵
  PID:13576
- C:\Windows\System\LNsvson.exe
  C:\Windows\System\LNsvson.exe
  2⤵
  PID:13596
- C:\Windows\System\qWGGzAW.exe
  C:\Windows\System\qWGGzAW.exe
  2⤵
  PID:13620
- C:\Windows\System\IvksWzM.exe
  C:\Windows\System\IvksWzM.exe
  2⤵
  PID:13656
- C:\Windows\System\uiWNuTK.exe
  C:\Windows\System\uiWNuTK.exe
  2⤵
  PID:13688
- C:\Windows\System\nRCJQup.exe
  C:\Windows\System\nRCJQup.exe
  2⤵
  PID:13724
- C:\Windows\System\COTpSRi.exe
  C:\Windows\System\COTpSRi.exe
  2⤵
  PID:13752
- C:\Windows\System\AsOKgSH.exe
  C:\Windows\System\AsOKgSH.exe
  2⤵
  PID:13776
- C:\Windows\System\HhqNNJh.exe
  C:\Windows\System\HhqNNJh.exe
  2⤵
  PID:13808
- C:\Windows\System\BmFNqdF.exe
  C:\Windows\System\BmFNqdF.exe
  2⤵
  PID:13832
- C:\Windows\System\mWHFhbD.exe
  C:\Windows\System\mWHFhbD.exe
  2⤵
  PID:13856
- C:\Windows\System\vAJFEtH.exe
  C:\Windows\System\vAJFEtH.exe
  2⤵
  PID:13876
- C:\Windows\System\MDGpIUS.exe
  C:\Windows\System\MDGpIUS.exe
  2⤵
  PID:13908
- C:\Windows\System\eICahTT.exe
  C:\Windows\System\eICahTT.exe
  2⤵
  PID:13932
- C:\Windows\System\zYCpbQW.exe
  C:\Windows\System\zYCpbQW.exe
  2⤵
  PID:13960
- C:\Windows\System\PXurPcb.exe
  C:\Windows\System\PXurPcb.exe
  2⤵
  PID:13988
- C:\Windows\System\rNJCXHg.exe
  C:\Windows\System\rNJCXHg.exe
  2⤵
  PID:14004
- C:\Windows\System\PWBzkOz.exe
  C:\Windows\System\PWBzkOz.exe
  2⤵
  PID:14044
- C:\Windows\System\RTFmqCq.exe
  C:\Windows\System\RTFmqCq.exe
  2⤵
  PID:14072
- C:\Windows\System\EhJRtcj.exe
  C:\Windows\System\EhJRtcj.exe
  2⤵
  PID:14108
- C:\Windows\System\CErnaDr.exe
  C:\Windows\System\CErnaDr.exe
  2⤵
  PID:14132
- C:\Windows\System\cxPRwsN.exe
  C:\Windows\System\cxPRwsN.exe
  2⤵
  PID:14156
- C:\Windows\System\FVzPCts.exe
  C:\Windows\System\FVzPCts.exe
  2⤵
  PID:14184
- C:\Windows\System\QxDzZMf.exe
  C:\Windows\System\QxDzZMf.exe
  2⤵
  PID:14220
- C:\Windows\System\HJMsIjp.exe
  C:\Windows\System\HJMsIjp.exe
  2⤵
  PID:14236
- C:\Windows\System\YWtJyRO.exe
  C:\Windows\System\YWtJyRO.exe
  2⤵
  PID:14252
- C:\Windows\System\zthhnAm.exe
  C:\Windows\System\zthhnAm.exe
  2⤵
  PID:14284
- C:\Windows\System\aGkkhml.exe
  C:\Windows\System\aGkkhml.exe
  2⤵
  PID:14308
- C:\Windows\System\fuUORul.exe
  C:\Windows\System\fuUORul.exe
  2⤵
  PID:12820
- C:\Windows\System\eIIThdU.exe
  C:\Windows\System\eIIThdU.exe
  2⤵
  PID:13316
- C:\Windows\System\ltWDKdA.exe
  C:\Windows\System\ltWDKdA.exe
  2⤵
  PID:13408
- C:\Windows\System\XpzkRnL.exe
  C:\Windows\System\XpzkRnL.exe
  2⤵
  PID:13404
- C:\Windows\System\yOrCPVJ.exe
  C:\Windows\System\yOrCPVJ.exe
  2⤵
  PID:13552
- C:\Windows\System\KWQmawo.exe
  C:\Windows\System\KWQmawo.exe
  2⤵
  PID:13588
- C:\Windows\System\dXYHPmU.exe
  C:\Windows\System\dXYHPmU.exe
  2⤵
  PID:13672
- C:\Windows\System\XqhHfjZ.exe
  C:\Windows\System\XqhHfjZ.exe
  2⤵
  PID:13768
- C:\Windows\System\vwCJldO.exe
  C:\Windows\System\vwCJldO.exe
  2⤵
  PID:13796
- C:\Windows\System\QFOQTIn.exe
  C:\Windows\System\QFOQTIn.exe
  2⤵
  PID:13944
- C:\Windows\System\oucUVcm.exe
  C:\Windows\System\oucUVcm.exe
  2⤵
  PID:13904
- C:\Windows\System\zAtUXuK.exe
  C:\Windows\System\zAtUXuK.exe
  2⤵
  PID:13996
- C:\Windows\System\XodIXfI.exe
  C:\Windows\System\XodIXfI.exe
  2⤵
  PID:14144
- C:\Windows\System\lVEkulu.exe
  C:\Windows\System\lVEkulu.exe
  2⤵
  PID:14272
- C:\Windows\System\NOtIIok.exe
  C:\Windows\System\NOtIIok.exe
  2⤵
  PID:14228
- C:\Windows\System\QRAWwRQ.exe
  C:\Windows\System\QRAWwRQ.exe
  2⤵
  PID:14244
- C:\Windows\System\HHlESvX.exe
  C:\Windows\System\HHlESvX.exe
  2⤵
  PID:13592
- C:\Windows\System\MMvhMNd.exe
  C:\Windows\System\MMvhMNd.exe
  2⤵
  PID:13432
- C:\Windows\System\NcUqeta.exe
  C:\Windows\System\NcUqeta.exe
  2⤵
  PID:13644
- C:\Windows\System\npAHhvB.exe
  C:\Windows\System\npAHhvB.exe
  2⤵
  PID:13820
- C:\Windows\System\dUOuNyN.exe
  C:\Windows\System\dUOuNyN.exe
  2⤵
  PID:13744
- C:\Windows\System\PXpJZyC.exe
  C:\Windows\System\PXpJZyC.exe
  2⤵
  PID:14016
- C:\Windows\System\iteJtqy.exe
  C:\Windows\System\iteJtqy.exe
  2⤵
  PID:14100
- C:\Windows\System\wACbBBP.exe
  C:\Windows\System\wACbBBP.exe
  2⤵
  PID:14176
- C:\Windows\System\BpEJVZM.exe
  C:\Windows\System\BpEJVZM.exe
  2⤵
  PID:13504
- C:\Windows\System\YaPCUMe.exe
  C:\Windows\System\YaPCUMe.exe
  2⤵
  PID:13920
- C:\Windows\System\MwPeIfP.exe
  C:\Windows\System\MwPeIfP.exe
  2⤵
  PID:14264
- C:\Windows\System\GwhEZTE.exe
  C:\Windows\System\GwhEZTE.exe
  2⤵
  PID:14376
- C:\Windows\System\nDPiHqE.exe
  C:\Windows\System\nDPiHqE.exe
  2⤵
  PID:14408
- C:\Windows\System\jhlpRFH.exe
  C:\Windows\System\jhlpRFH.exe
  2⤵
  PID:14440
- C:\Windows\System\UBhQKVR.exe
  C:\Windows\System\UBhQKVR.exe
  2⤵
  PID:14472
- C:\Windows\System\ZqLuAOJ.exe
  C:\Windows\System\ZqLuAOJ.exe
  2⤵
  PID:14496
- C:\Windows\System\ZkwIIXd.exe
  C:\Windows\System\ZkwIIXd.exe
  2⤵
  PID:14532
- C:\Windows\System\PfIUIqx.exe
  C:\Windows\System\PfIUIqx.exe
  2⤵
  PID:14556
- C:\Windows\System\TJTMECR.exe
  C:\Windows\System\TJTMECR.exe
  2⤵
  PID:14592
- C:\Windows\System\gLrjOWR.exe
  C:\Windows\System\gLrjOWR.exe
  2⤵
  PID:14624
- C:\Windows\System\JdpsYXE.exe
  C:\Windows\System\JdpsYXE.exe
  2⤵
  PID:14652
- C:\Windows\System\LvaZBjV.exe
  C:\Windows\System\LvaZBjV.exe
  2⤵
  PID:14680
- C:\Windows\System\pQsMKZG.exe
  C:\Windows\System\pQsMKZG.exe
  2⤵
  PID:14700
- C:\Windows\System\OyWPHNA.exe
  C:\Windows\System\OyWPHNA.exe
  2⤵
  PID:14724
- C:\Windows\System\ogrbXma.exe
  C:\Windows\System\ogrbXma.exe
  2⤵
  PID:14748
- C:\Windows\System\budFPAJ.exe
  C:\Windows\System\budFPAJ.exe
  2⤵
  PID:14772
- C:\Windows\System\WstQIaZ.exe
  C:\Windows\System\WstQIaZ.exe
  2⤵
  PID:14800
- C:\Windows\System\VnjmLRG.exe
  C:\Windows\System\VnjmLRG.exe
  2⤵
  PID:14824
- C:\Windows\System\GJOUiZq.exe
  C:\Windows\System\GJOUiZq.exe
  2⤵
  PID:14856
- C:\Windows\System\FiUFsPe.exe
  C:\Windows\System\FiUFsPe.exe
  2⤵
  PID:14872
- C:\Windows\System\zvlTbfq.exe
  C:\Windows\System\zvlTbfq.exe
  2⤵
  PID:14892
- C:\Windows\System\KEcBjwP.exe
  C:\Windows\System\KEcBjwP.exe
  2⤵
  PID:14928
- C:\Windows\System\Oygkvcq.exe
  C:\Windows\System\Oygkvcq.exe
  2⤵
  PID:14952
- C:\Windows\System\cMdvDsH.exe
  C:\Windows\System\cMdvDsH.exe
  2⤵
  PID:14976
- C:\Windows\System\sUQJyDB.exe
  C:\Windows\System\sUQJyDB.exe
  2⤵
  PID:15016
- C:\Windows\System\esLLVOF.exe
  C:\Windows\System\esLLVOF.exe
  2⤵
  PID:15040
- C:\Windows\System\MVJrfLE.exe
  C:\Windows\System\MVJrfLE.exe
  2⤵
  PID:15096
- C:\Windows\System\zawPoAU.exe
  C:\Windows\System\zawPoAU.exe
  2⤵
  PID:15136
- C:\Windows\System\WTRpqWc.exe
  C:\Windows\System\WTRpqWc.exe
  2⤵
  PID:15168
- C:\Windows\System\ebACJKz.exe
  C:\Windows\System\ebACJKz.exe
  2⤵
  PID:15216
- C:\Windows\System\rLoOBfW.exe
  C:\Windows\System\rLoOBfW.exe
  2⤵
  PID:15244
- C:\Windows\System\ZkTiKkC.exe
  C:\Windows\System\ZkTiKkC.exe
  2⤵
  PID:15272
- C:\Windows\System\yjCIsOf.exe
  C:\Windows\System\yjCIsOf.exe
  2⤵
  PID:15292
- C:\Windows\System\dPwCMfF.exe
  C:\Windows\System\dPwCMfF.exe
  2⤵
  PID:15316
- C:\Windows\System\IbHIpRP.exe
  C:\Windows\System\IbHIpRP.exe
  2⤵
  PID:15348
- C:\Windows\System\QcEmSVS.exe
  C:\Windows\System\QcEmSVS.exe
  2⤵
  PID:14304
- C:\Windows\System\iJCajbD.exe
  C:\Windows\System\iJCajbD.exe
  2⤵
  PID:14420
- C:\Windows\System\aqRLgCO.exe
  C:\Windows\System\aqRLgCO.exe
  2⤵
  PID:14388
- C:\Windows\System\UlVEKLz.exe
  C:\Windows\System\UlVEKLz.exe
  2⤵
  PID:14520
- C:\Windows\System\kcPPJbz.exe
  C:\Windows\System\kcPPJbz.exe
  2⤵
  PID:14672
- C:\Windows\System\AKzvjNo.exe
  C:\Windows\System\AKzvjNo.exe
  2⤵
  PID:14716
- C:\Windows\System\HORIXah.exe
  C:\Windows\System\HORIXah.exe
  2⤵
  PID:14740
- C:\Windows\System\zoIKiCR.exe
  C:\Windows\System\zoIKiCR.exe
  2⤵
  PID:14744
- C:\Windows\System\xnOGLPG.exe
  C:\Windows\System\xnOGLPG.exe
  2⤵
  PID:14848
- C:\Windows\System\efAxJGU.exe
  C:\Windows\System\efAxJGU.exe
  2⤵
  PID:14988
- C:\Windows\System\gAaQAit.exe
  C:\Windows\System\gAaQAit.exe
  2⤵
  PID:14864
- C:\Windows\System\JbFXEph.exe
  C:\Windows\System\JbFXEph.exe
  2⤵
  PID:14888
- C:\Windows\System\IGKbXHV.exe
  C:\Windows\System\IGKbXHV.exe
  2⤵
  PID:15144
- C:\Windows\System\RJbVpGI.exe
  C:\Windows\System\RJbVpGI.exe
  2⤵
  PID:13976
- C:\Windows\System\yUIxSoU.exe
  C:\Windows\System\yUIxSoU.exe
  2⤵
  PID:15232
- C:\Windows\System\IVjnjNi.exe
  C:\Windows\System\IVjnjNi.exe
  2⤵
  PID:15328
- C:\Windows\System\mupoeAS.exe
  C:\Windows\System\mupoeAS.exe
  2⤵
  PID:15240
- C:\Windows\System\OnHIzRN.exe
  C:\Windows\System\OnHIzRN.exe
  2⤵
  PID:14524
- C:\Windows\System\wqFZlrC.exe
  C:\Windows\System\wqFZlrC.exe
  2⤵
  PID:14392
- C:\Windows\System\pCrZGrE.exe
  C:\Windows\System\pCrZGrE.exe
  2⤵
  PID:14840
- C:\Windows\System\wypGxNE.exe
  C:\Windows\System\wypGxNE.exe
  2⤵
  PID:14760
- C:\Windows\System\ggVvKgJ.exe
  C:\Windows\System\ggVvKgJ.exe
  2⤵
  PID:15092
- C:\Windows\System\SShGIFw.exe
  C:\Windows\System\SShGIFw.exe
  2⤵
  PID:15280
- C:\Windows\System\eJicFeX.exe
  C:\Windows\System\eJicFeX.exe
  2⤵
  PID:15376
- C:\Windows\System\vaUyZws.exe
  C:\Windows\System\vaUyZws.exe
  2⤵
  PID:15400
- C:\Windows\System\BHwMkRv.exe
  C:\Windows\System\BHwMkRv.exe
  2⤵
  PID:15432
- C:\Windows\System\qpIJxWm.exe
  C:\Windows\System\qpIJxWm.exe
  2⤵
  PID:15460
- C:\Windows\System\HWbHmvN.exe
  C:\Windows\System\HWbHmvN.exe
  2⤵
  PID:15492
- C:\Windows\System\ZNwJDoE.exe
  C:\Windows\System\ZNwJDoE.exe
  2⤵
  PID:15508
- C:\Windows\System\nyYOghg.exe
  C:\Windows\System\nyYOghg.exe
  2⤵
  PID:15528
- C:\Windows\System\BYscKRl.exe
  C:\Windows\System\BYscKRl.exe
  2⤵
  PID:15548
- C:\Windows\System\eLwmjaW.exe
  C:\Windows\System\eLwmjaW.exe
  2⤵
  PID:15584
- C:\Windows\System\QHeGcWe.exe
  C:\Windows\System\QHeGcWe.exe
  2⤵
  PID:15644
- C:\Windows\System\YZKTmaY.exe
  C:\Windows\System\YZKTmaY.exe
  2⤵
  PID:15704
- C:\Windows\System\eWSMBPQ.exe
  C:\Windows\System\eWSMBPQ.exe
  2⤵
  PID:15736
- C:\Windows\System\lGMsgrQ.exe
  C:\Windows\System\lGMsgrQ.exe
  2⤵
  PID:15756
- C:\Windows\System\fcOAbqD.exe
  C:\Windows\System\fcOAbqD.exe
  2⤵
  PID:15796
- C:\Windows\System\RpDOQaN.exe
  C:\Windows\System\RpDOQaN.exe
  2⤵
  PID:15816
- C:\Windows\System\UAVmFSN.exe
  C:\Windows\System\UAVmFSN.exe
  2⤵
  PID:15836
- C:\Windows\System\yWafwVJ.exe
  C:\Windows\System\yWafwVJ.exe
  2⤵
  PID:15864
- C:\Windows\System\pKYyxOg.exe
  C:\Windows\System\pKYyxOg.exe
  2⤵
  PID:15888
- C:\Windows\System\kOSuIcS.exe
  C:\Windows\System\kOSuIcS.exe
  2⤵
  PID:15920
- C:\Windows\System\qHryQMx.exe
  C:\Windows\System\qHryQMx.exe
  2⤵
  PID:15956
- C:\Windows\System\PgkUcAA.exe
  C:\Windows\System\PgkUcAA.exe
  2⤵
  PID:15980
- C:\Windows\System\bXZSXMS.exe
  C:\Windows\System\bXZSXMS.exe
  2⤵
  PID:16020
- C:\Windows\System\sIVIGeZ.exe
  C:\Windows\System\sIVIGeZ.exe
  2⤵
  PID:16052
- C:\Windows\System\LxZytNo.exe
  C:\Windows\System\LxZytNo.exe
  2⤵
  PID:16072
- C:\Windows\System\ShPTaCH.exe
  C:\Windows\System\ShPTaCH.exe
  2⤵
  PID:16096
- C:\Windows\System\AsyEThN.exe
  C:\Windows\System\AsyEThN.exe
  2⤵
  PID:16128
- C:\Windows\System\PMPqPJt.exe
  C:\Windows\System\PMPqPJt.exe
  2⤵
  PID:16152
- C:\Windows\System\XeaoXoN.exe
  C:\Windows\System\XeaoXoN.exe
  2⤵
  PID:16180
- C:\Windows\System\ffSKrMo.exe
  C:\Windows\System\ffSKrMo.exe
  2⤵
  PID:16200
- C:\Windows\System\mgtsybm.exe
  C:\Windows\System\mgtsybm.exe
  2⤵
  PID:16224
- C:\Windows\System\azZUeyN.exe
  C:\Windows\System\azZUeyN.exe
  2⤵
  PID:16260
- C:\Windows\System\pcIoqFG.exe
  C:\Windows\System\pcIoqFG.exe
  2⤵
  PID:16292
- C:\Windows\System\pJtzpJr.exe
  C:\Windows\System\pJtzpJr.exe
  2⤵
  PID:16320
- C:\Windows\System\KUXyQWi.exe
  C:\Windows\System\KUXyQWi.exe
  2⤵
  PID:16348
- C:\Windows\System\TbiBjfY.exe
  C:\Windows\System\TbiBjfY.exe
  2⤵
  PID:16380
- C:\Windows\System\rmCuFnP.exe
  C:\Windows\System\rmCuFnP.exe
  2⤵
  PID:14968
- C:\Windows\System\upNkosK.exe
  C:\Windows\System\upNkosK.exe
  2⤵
  PID:13104
- C:\Windows\System\iqIrata.exe
  C:\Windows\System\iqIrata.exe
  2⤵
  PID:15312
- C:\Windows\System\eygLuWb.exe
  C:\Windows\System\eygLuWb.exe
  2⤵
  PID:15448
- C:\Windows\System\CFGeMES.exe
  C:\Windows\System\CFGeMES.exe
  2⤵
  PID:15516
- C:\Windows\System\OsOstZo.exe
  C:\Windows\System\OsOstZo.exe
  2⤵
  PID:15540
- C:\Windows\System\WzGhPxz.exe
  C:\Windows\System\WzGhPxz.exe
  2⤵
  PID:15524
- C:\Windows\System\CMDToJc.exe
  C:\Windows\System\CMDToJc.exe
  2⤵
  PID:15720
- C:\Windows\System\FPhcYlP.exe
  C:\Windows\System\FPhcYlP.exe
  2⤵
  PID:15808
- C:\Windows\System\bHyyncG.exe
  C:\Windows\System\bHyyncG.exe
  2⤵
  PID:15852
- C:\Windows\System\dEsDHmp.exe
  C:\Windows\System\dEsDHmp.exe
  2⤵
  PID:15968
- C:\Windows\System\dhnJsBF.exe
  C:\Windows\System\dhnJsBF.exe
  2⤵
  PID:15880
- C:\Windows\System\jEwpjDK.exe
  C:\Windows\System\jEwpjDK.exe
  2⤵
  PID:15996
- C:\Windows\System\ZkxvcBk.exe
  C:\Windows\System\ZkxvcBk.exe
  2⤵
  PID:16060
- C:\Windows\System\elLYsyW.exe
  C:\Windows\System\elLYsyW.exe
  2⤵
  PID:16188
- C:\Windows\System\DWaQCIX.exe
  C:\Windows\System\DWaQCIX.exe
  2⤵
  PID:16232
- C:\Windows\System\YjrgtEj.exe
  C:\Windows\System\YjrgtEj.exe
  2⤵
  PID:16276
- C:\Windows\System\WgHPsaV.exe
  C:\Windows\System\WgHPsaV.exe
  2⤵
  PID:16332
- C:\Windows\System\QvrKUkr.exe
  C:\Windows\System\QvrKUkr.exe
  2⤵
  PID:16368
- C:\Windows\System\QyJlxEi.exe
  C:\Windows\System\QyJlxEi.exe
  2⤵
  PID:15604
- C:\Windows\System\WMYCqDy.exe
  C:\Windows\System\WMYCqDy.exe
  2⤵
  PID:15596
- C:\Windows\System\iHjCdqi.exe
  C:\Windows\System\iHjCdqi.exe
  2⤵
  PID:15504
- C:\Windows\System\KRwqfEn.exe
  C:\Windows\System\KRwqfEn.exe
  2⤵
  PID:15912
- C:\Windows\System\PjqlgMG.exe
  C:\Windows\System\PjqlgMG.exe
  2⤵
  PID:16044
- C:\Windows\System\jhcHXUO.exe
  C:\Windows\System\jhcHXUO.exe
  2⤵
  PID:15944
- C:\Windows\System\UxpHWqi.exe
  C:\Windows\System\UxpHWqi.exe
  2⤵
  PID:15384
- C:\Windows\System\APvbvuP.exe
  C:\Windows\System\APvbvuP.exe
  2⤵
  PID:15940
- C:\Windows\System\yNazmzV.exe
  C:\Windows\System\yNazmzV.exe
  2⤵
  PID:15624
- C:\Windows\System\hmLdmSj.exe
  C:\Windows\System\hmLdmSj.exe
  2⤵
  PID:15784
- C:\Windows\System\LgDMUlA.exe
  C:\Windows\System\LgDMUlA.exe
  2⤵
  PID:16372
- C:\Windows\System\Fnhqheb.exe
  C:\Windows\System\Fnhqheb.exe
  2⤵
  PID:16396
- C:\Windows\System\wdsAlpj.exe
  C:\Windows\System\wdsAlpj.exe
  2⤵
  PID:16420
- C:\Windows\System\uHBmmHf.exe
  C:\Windows\System\uHBmmHf.exe
  2⤵
  PID:16444
- C:\Windows\System\vMxIMpA.exe
  C:\Windows\System\vMxIMpA.exe
  2⤵
  PID:16480
- C:\Windows\System\nmCccGS.exe
  C:\Windows\System\nmCccGS.exe
  2⤵
  PID:16516
- C:\Windows\System\AqgRRvL.exe
  C:\Windows\System\AqgRRvL.exe
  2⤵
  PID:16540
- C:\Windows\System\NfRwdJW.exe
  C:\Windows\System\NfRwdJW.exe
  2⤵
  PID:16564
- C:\Windows\System\iruOSNn.exe
  C:\Windows\System\iruOSNn.exe
  2⤵
  PID:16584
- C:\Windows\System\zvhcfoB.exe
  C:\Windows\System\zvhcfoB.exe
  2⤵
  PID:16612
- C:\Windows\System\EUdCxIO.exe
  C:\Windows\System\EUdCxIO.exe
  2⤵
  PID:16648
- C:\Windows\System\KYDtHgg.exe
  C:\Windows\System\KYDtHgg.exe
  2⤵
  PID:16684
- C:\Windows\System\regelkQ.exe
  C:\Windows\System\regelkQ.exe
  2⤵
  PID:16700
- C:\Windows\System\juxEkAN.exe
  C:\Windows\System\juxEkAN.exe
  2⤵
  PID:16724
- C:\Windows\System\FOXxJSn.exe
  C:\Windows\System\FOXxJSn.exe
  2⤵
  PID:16756
- C:\Windows\System\QGMCmLL.exe
  C:\Windows\System\QGMCmLL.exe
  2⤵
  PID:16780
- C:\Windows\System\wrdXaVG.exe
  C:\Windows\System\wrdXaVG.exe
  2⤵
  PID:16804
- C:\Windows\System\BThRqtc.exe
  C:\Windows\System\BThRqtc.exe
  2⤵
  PID:16836
- C:\Windows\System\XAGlzBN.exe
  C:\Windows\System\XAGlzBN.exe
  2⤵
  PID:16856
- C:\Windows\System\xRnathv.exe
  C:\Windows\System\xRnathv.exe
  2⤵
  PID:16888
- C:\Windows\System\xKjkOqy.exe
  C:\Windows\System\xKjkOqy.exe
  2⤵
  PID:16916
- C:\Windows\System\XcbsqOl.exe
  C:\Windows\System\XcbsqOl.exe
  2⤵
  PID:16936
- C:\Windows\System\tWlsgBL.exe
  C:\Windows\System\tWlsgBL.exe
  2⤵
  PID:16964
- C:\Windows\System\AuHXxgl.exe
  C:\Windows\System\AuHXxgl.exe
  2⤵
  PID:17020
- C:\Windows\System\homDjFX.exe
  C:\Windows\System\homDjFX.exe
  2⤵
  PID:17052
- C:\Windows\System\VMnKKGh.exe
  C:\Windows\System\VMnKKGh.exe
  2⤵
  PID:17084
- C:\Windows\System\gAnZulr.exe
  C:\Windows\System\gAnZulr.exe
  2⤵
  PID:17116
- C:\Windows\System\zhwBeHj.exe
  C:\Windows\System\zhwBeHj.exe
  2⤵
  PID:17140
- C:\Windows\System\xdTqXLr.exe
  C:\Windows\System\xdTqXLr.exe
  2⤵
  PID:17180
- C:\Windows\System\gnmmQjM.exe
  C:\Windows\System\gnmmQjM.exe
  2⤵
  PID:17212
- C:\Windows\System\XPBeWQS.exe
  C:\Windows\System\XPBeWQS.exe
  2⤵
  PID:17240
- C:\Windows\System\AELFhKv.exe
  C:\Windows\System\AELFhKv.exe
  2⤵
  PID:17264
- C:\Windows\System\uFTRQYi.exe
  C:\Windows\System\uFTRQYi.exe
  2⤵
  PID:17296
- C:\Windows\System\PHQXIMp.exe
  C:\Windows\System\PHQXIMp.exe
  2⤵
  PID:17336
- C:\Windows\System\YCoJbij.exe
  C:\Windows\System\YCoJbij.exe
  2⤵
  PID:17356
- C:\Windows\System\KrXJqHQ.exe
  C:\Windows\System\KrXJqHQ.exe
  2⤵
  PID:17384
- C:\Windows\System\DkkUEwP.exe
  C:\Windows\System\DkkUEwP.exe
  2⤵
  PID:15124
- C:\Windows\System\LrLlUgZ.exe
  C:\Windows\System\LrLlUgZ.exe
  2⤵
  PID:13952
- C:\Windows\System\onmRcdB.exe
  C:\Windows\System\onmRcdB.exe
  2⤵
  PID:16108
- C:\Windows\System\IfpmKPS.exe
  C:\Windows\System\IfpmKPS.exe
  2⤵
  PID:16464
- C:\Windows\System\PSPRjqN.exe
  C:\Windows\System\PSPRjqN.exe
  2⤵
  PID:16392
- C:\Windows\System\ukXzEQt.exe
  C:\Windows\System\ukXzEQt.exe
  2⤵
  PID:16440
- C:\Windows\System\WEKsgAD.exe
  C:\Windows\System\WEKsgAD.exe
  2⤵
  PID:16500
- C:\Windows\System\uisADAe.exe
  C:\Windows\System\uisADAe.exe
  2⤵
  PID:15256
- C:\Windows\System\MiJabUa.exe
  C:\Windows\System\MiJabUa.exe
  2⤵
  PID:16436
- C:\Windows\System\IzBonjy.exe
  C:\Windows\System\IzBonjy.exe
  2⤵
  PID:16832
- C:\Windows\System\VJWmBRH.exe
  C:\Windows\System\VJWmBRH.exe
  2⤵
  PID:16952
- C:\Windows\System\zdTzGqS.exe
  C:\Windows\System\zdTzGqS.exe
  2⤵
  PID:16696
- C:\Windows\System\LBodnef.exe
  C:\Windows\System\LBodnef.exe
  2⤵
  PID:17072
- C:\Windows\System\ZBYppoe.exe
  C:\Windows\System\ZBYppoe.exe
  2⤵
  PID:16928
- C:\Windows\System\YWwbwni.exe
  C:\Windows\System\YWwbwni.exe
  2⤵
  PID:17232
- C:\Windows\System\dgPOzhZ.exe
  C:\Windows\System\dgPOzhZ.exe
  2⤵
  PID:17260
- C:\Windows\System\gicezxC.exe
  C:\Windows\System\gicezxC.exe
  2⤵
  PID:17328

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BnieGXt.exe

Path C:\Windows\System\BnieGXt.exe
Size 1.6MB
SHA256 50dad7ab0a623ab29d943dd55ae5e1d6c59e2b96aec1723049b6ad8b2d1d0894
MD5 627dc2c4923e54723599276dce6c24e4
SHA1 187cefdb9ab9c872b62a4afd6c77b453b1fe8fda
SHA512 9b06a60d1f06e45a1e3a88c164a99a0ba85fed270fd07e0ff8c8ecbe526df6cd7a40c098948f7e88271a2c16e764cb166e874a37f04f669aac6c359a054e5b85
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqco:GemTLkNdfE0pZaw
MD5 SHA1 SHA512 SSDEEP

Submit Download

DpCYnKb.exe

Path C:\Windows\System\DpCYnKb.exe
Size 1.6MB
SHA256 dfed3c0545caf5efb0cca8780f18a4de9629c8ea1e44e7ede2e991d51d881c39
MD5 bcf92e544d03fd74eff9f30cc3eec26e
SHA1 8044daf805c3962e29ec674084669331cf5bc22d
SHA512 bbb1a59c3bda14083f7bd1b5d8cca2200bec53439a0171515739cbaee7cc93560a1f111f490be9e06e1fe7aaf4b17b69e94da43f718c2e5136e100238fb303ed
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqcz:GemTLkNdfE0pZab
MD5 SHA1 SHA512 SSDEEP

Submit Download

DrKEsNM.exe

Path C:\Windows\System\DrKEsNM.exe
Size 1.6MB
SHA256 af61411d1ff9c81586582ff52bdd20eec34f4ea6d9b412f9f82173f826ccd505
MD5 9166fcef02895fde116924fc4370a184
SHA1 4eb76ded663084e44514b574a603a127844df3df
SHA512 5a42b0512b9a082222d71a86149de93f325a1b2ccdc17a77ac8e9ce37cc581707d81f4c72537d57c29d4d9d7efc1b76900a8528129725cdddf5ba9ff015aaa8b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NqcJ:GemTLkNdfE0pZax
MD5 SHA1 SHA512 SSDEEP

Submit Download

FfVBGiV.exe

Path C:\Windows\System\FfVBGiV.exe
Size 1.6MB
SHA256 d52e42bf3345ae87b1a050c613350bd5f1829eedd8a6481865294bc08dd04bac
MD5 a0a2fc357c0f4c15d0ba76bce3765734
SHA1 b13631f31a0912c090ad4832d58a52b42fb20172
SHA512 3a2107413baa9725935d48771d60a84ad1f2931faff1b360aad05a545c00f66bc82a4a307c333552287cd7c72e4eb2a38803effd75ea4f32a76d05a7d646bde2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqcl:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Submit Download

GtlSiYe.exe

Path C:\Windows\System\GtlSiYe.exe
Size 1.6MB
SHA256 908afb246c566e74f3c88444fe9fe071f8ea4dea299473633ad63e2cb5a47eca
MD5 c1fc707e2ddbe1f4db35d294df499b10
SHA1 339b7af1b0f69d038fe66db7256dc0ccfc9a2902
SHA512 62a8cf870608b1a56b9d7ed9e90ba89f350eb9c15b2b1f116e16f76dc450501197023884ea928a69a062640f8c63cab5b645ae57056161fdecef4c6495f8eeaa
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqcb:GemTLkNdfE0pZaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

HZZouJi.exe

Path C:\Windows\System\HZZouJi.exe
Size 1.6MB
SHA256 0cf1a0ca46e9550de24f51d83a0cff181051264586378196be6b6c57d4ad1a5a
MD5 3e9deefaf59467533ff644fb03bc048a
SHA1 cff2ae94e9ce13dcb653ad97098bb54372e9de8f
SHA512 369a9bb97e8d56cd3147fa781f1066ec0a5807f4a3b024ffbacc5f174741c2125e5a482b53c24b3219a49b1302a5a5a75fd5ab6447187d4c73f1ec069614ea89
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqci:GemTLkNdfE0pZaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

IUjSQVz.exe

Path C:\Windows\System\IUjSQVz.exe
Size 1.6MB
SHA256 fb287ae4c9a8bb2378e20ab7c58a5813b41da6c2a583b8bca712f6aa143b5c96
MD5 f6a3f0291ec0788b8e4f35b9f5db4be9
SHA1 142198066a9e963a12af0b3010e9ca5d62a645e0
SHA512 ec4850ddf68f9f8fa765c2ad72c25f8034200c0db57ffe3d349704f251386b1aaa4bc9d0d0ac80a18b71c920384fa0a4a99b62653168f0ffc34376b683ccaf97
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqcg:GemTLkNdfE0pZa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

JUlXZSA.exe

Path C:\Windows\System\JUlXZSA.exe
Size 1.6MB
SHA256 281c07f2ee1479791c446132a0819375bc2f21464b775ff9bb0574008becf63c
MD5 a348daa9b60aa8983f55b389ae986d68
SHA1 6c7e8bdbd12002d5a62b65dda34762f055c8f243
SHA512 25797bf89695ed3fe8ee272977bfa15584c87222aa8372a04853153c9a652df26b035f9404bf81d076c476eca3173fefd7f4faf818cdd9358314c0892cf0e3a7
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqcr:GemTLkNdfE0pZaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

KctxLgd.exe

Path C:\Windows\System\KctxLgd.exe
Size 1.6MB
SHA256 087de53ba0691019275bbce7fed77ee56146553d17483a727c37e54151d1a7aa
MD5 09db249609e51ff092883c10eacf577c
SHA1 640d53d139cf35a2946efcdac81f080e1177fa4f
SHA512 402d961bd702efe0704a04f7601eadecc66907d20fb2069e116e457f7d5473ef981dcf122ad972763e10ddcd3641c0ccc1ab5fc44b57be5d3205cebdaa56be38
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqcb:GemTLkNdfE0pZaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

MyKKnrQ.exe

Path C:\Windows\System\MyKKnrQ.exe
Size 1.6MB
SHA256 cfadba7a5b25fde92692d727dd0240dda841e4f37d000f352ce78f7f02e34889
MD5 b3bb00d3713e6df67c9c509d5f0424fb
SHA1 0b0a2a81e549ab40f910c2d7dc7e72d9645918d6
SHA512 d7612137abd41628ff8c008c1b4bd3eb1fc315282e301b402d4be023a13b6d579ec081d02d49430d8a1718100a5edd00dc7c0fa83eb452ddb8ae2d2f7b777277
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NqcW:GemTLkNdfE0pZaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

PqcgOXN.exe

Path C:\Windows\System\PqcgOXN.exe
Size 1.6MB
SHA256 532b5e2a17aa6e5fd10212707940e30cd71d5a96a3c0dbea65fead666b7dfe13
MD5 d56840eae484a994f30e6336b9ff367a
SHA1 45c96739c2a3cb2948c109c949ac7206051e015d
SHA512 75c1db31eb99391a38223e6d76268513ed4adea1e00c066d8f894d39b06d10f6bfdbc65d9a57ea32d2c765ba9c750431b63c5539feb3426748f2f03c04e19b59
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqck:GemTLkNdfE0pZas
MD5 SHA1 SHA512 SSDEEP

Submit Download

RRHXkRU.exe

Path C:\Windows\System\RRHXkRU.exe
Size 1.6MB
SHA256 08b2376aa8652ef838bae42bb8c87500ce4e85a71ad5770220fe1c2a93a963d1
MD5 94afc224ad0be89ccdd8dac315ef999a
SHA1 718a51ea2961c1dc7e3b7e1d3afa5ec8752b7f6f
SHA512 5d359eb2b8b731db953a8503cde15fea79b1a83adf6fecb2d19c60bc04e747109236edec33794e3d8935fdf4de87a1070f05654b67f5a9eccd1972db9775f792
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NqcS:GemTLkNdfE0pZaq
MD5 SHA1 SHA512 SSDEEP

Submit Download

TAmeXXj.exe

Path C:\Windows\System\TAmeXXj.exe
Size 1.6MB
SHA256 94537708bdeff98af58c4fbaf97e4208accd8a2d51cd9c1aedb8337807bb568a
MD5 34a4675b2665f139c3a1fe2abe41f148
SHA1 6b7375cc2c6862a9292184ce54210ec323e94574
SHA512 ea06644d2978a4b99ef88f11d6b621567d66d5ac38025d641138fbf5ca2d4296da8ba809647c88a47e53736984068af5deec5bfa6c3ce7d2029719034f45ba1c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NqcF:GemTLkNdfE0pZa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

TTswfsN.exe

Path C:\Windows\System\TTswfsN.exe
Size 1.6MB
SHA256 bf332b92420893f53c10f1f53f2aba08e62ebbf8073bd59d21d7e9783c8b5fc5
MD5 693853e7cbfccd916da0d77f777cd99e
SHA1 8796bdac36f1dc16757d42fa9325536e05539a85
SHA512 a095fd002355375a2e45377b2a757bddc6f41425d592030caf4c2eb57207e015004a864d3f1e5571b55dffc1614c6ef9e331f377858b61ad3374777506990b03
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqcbj:GemTLkNdfE0pZan
MD5 SHA1 SHA512 SSDEEP

Submit Download

TnxWoIF.exe

Path C:\Windows\System\TnxWoIF.exe
Size 1.6MB
SHA256 64d96c69399a491375584242708871bf484dd64ddde39ca0aeb22603b2af3aef
MD5 77e2bce070167e89fb4504c56dfaf061
SHA1 ef8ba93896154131243dd01f535a3458346c6950
SHA512 0ca49115e82bed373d3e7011041efb9053495df826b025428362d10edb61b7bc9042ab592e54608afa29036e386b6d6daaf7056941332f6229d2deb0b28f4121
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NqcF:GemTLkNdfE0pZat
MD5 SHA1 SHA512 SSDEEP

Submit Download

UEoouRj.exe

Path C:\Windows\System\UEoouRj.exe
Size 1.6MB
SHA256 96b1b89e8aba841748600b2f24b56249a1a486b86ead5887443fc727233b36b3
MD5 7328be0ccf72cfe24eaff7b2f3111a6c
SHA1 3e6efd317d09944f2dc9cb8d97478205f15c64bf
SHA512 5afcc3e8927cf0e4d86e824ac70e269c7112b4aaea44d39e06d3dd56861f275a2bc3b75f169d76d37fe76d8a135c7f61aba531085b94b25ec654b884dbae5a16
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NqcA:GemTLkNdfE0pZa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

UMSmSmo.exe

Path C:\Windows\System\UMSmSmo.exe
Size 1.6MB
SHA256 d2c9429b850554fde47df4d27d321f1a0290ed6b546251d3a8c0f3cb90735ef6
MD5 914eedd83cf1edcb97877d01259b17a6
SHA1 8130ec2cf69ee9221bcac37db0507d2abd3f9670
SHA512 9132fe2aa9a068ac7bb7b8e79bee74829bea12a2ca598d89f0f63641b661cb71c7b1352255968bf68c3a06bcd200e6fed42952cd4a1c55fb9be512114864535d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqcx:GemTLkNdfE0pZap
MD5 SHA1 SHA512 SSDEEP

Submit Download

UmdymPh.exe

Path C:\Windows\System\UmdymPh.exe
Size 1.6MB
SHA256 509c2b2a78f5df11ebec4f868865cac65a35c77357cdf78265ea22259f7b9c3f
MD5 0fed750842d8dba2cd46b66522db4590
SHA1 ac65fc53ffbd4f8bd8c496eb5280f5756f3f8f9a
SHA512 e83b57312f57fe1ab4b62c13df44cb88183f39078ff808ff65f8f897a721cd38858d5cf1734fab8c08f4975f43813b0af737d1c696e4217182b5de0e642d6b65
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqcq:GemTLkNdfE0pZai
MD5 SHA1 SHA512 SSDEEP

Submit Download

WnZCVRc.exe

Path C:\Windows\System\WnZCVRc.exe
Size 1.6MB
SHA256 aa7d56ad507bb5a279ce9d1c92f22f4a44a915eb8d5f064dfd76d5450d5b8b63
MD5 103be3e2e06110501ab94f7ee5fbe860
SHA1 70252ecb63cb28260cc53149010b19153c796115
SHA512 358f69014eeef67c9ff2ae62ead15783d300059ec70d7cdb221dfe15db5d7594f24e2202647b7678a52840d8d392019eb94b392cf267ea407e5bb15af96221b5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NqcC:GemTLkNdfE0pZaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

dBPPDml.exe

Path C:\Windows\System\dBPPDml.exe
Size 1.6MB
SHA256 c7fe7d4a45af27dbe9ecd96578c7e8d509acde655b3a66cb171ddff13a12d6a6
MD5 19e31347cf50e63339412b32d5846128
SHA1 be3c2bfaf2bacdf7f2051f6f1f66516056056725
SHA512 0d1ebf63f0206fb1357582b2913d23e5a24b246ad0098f61cbde63b02e37cd9801c6ae8624f5c1fcaa73f5b585ace6cb8b46b89614da9d89fb4091c448894b1a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqcm:GemTLkNdfE0pZa+
MD5 SHA1 SHA512 SSDEEP

Submit Download

fxilJeJ.exe

Path C:\Windows\System\fxilJeJ.exe
Size 1.6MB
SHA256 5087b70eecfb97d23176416c90dfbbd0f758852b7dd6f066c1fb3a8173308ff3
MD5 2e6c9b4ae6df050c01b1577e8e5d3829
SHA1 840c6e00d0fb1aa6848d4d7f9c7c425f199dbcd4
SHA512 389f477431e2c89471ed0d901c97f461164963aef5efc47726ce9a64df2ac4f705fd93942534ae5b47afb0d2d0ed31b3472c6c651d6bb7f9df56e66b91c26b6b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc1:GemTLkNdfE0pZat
MD5 SHA1 SHA512 SSDEEP

Submit Download

iiSNqug.exe

Path C:\Windows\System\iiSNqug.exe
Size 1.6MB
SHA256 09d57266f6b031e94b66c4167d7c70b0fbfff6f4639b11846fa9a1e4283cd863
MD5 cba1e9cc5eb2c30066a74399030f9584
SHA1 2f1d8a7426e415b1ddd550f545ce2db0e95b0d58
SHA512 9d846f3462e2df044bfdb9c555d6ab464cf783a530ef399300a8394ab4935a565f76542bd42dbed0f5b1e652d500bd74ac869409e1310127cb7a0c18ee004f7f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc/:GemTLkNdfE0pZaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

mAAgiCp.exe

Path C:\Windows\System\mAAgiCp.exe
Size 1.6MB
SHA256 3ac94694a8336b92bf334bd7797b97fc5a4148473b67b6f6fb030eacbbc2f57d
MD5 8488e66a07ad69488cc13d83704250fa
SHA1 1d2228cb6df7ac1659586c8eb8d7442ebed4fb60
SHA512 0c7fb2d2250bbb2c4e8832ed8a95f05f3fcb8877b9ff4b6d3e6ab5d4d2e04435aba113c00a3583e492c202edc98b270bc064f6c5c133f8cbe27cea62ed9b10ea
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NqcN:GemTLkNdfE0pZal
MD5 SHA1 SHA512 SSDEEP

Submit Download

pVzukma.exe

Path C:\Windows\System\pVzukma.exe
Size 1.6MB
SHA256 9644e40c3efdbe25207a042cc26e170aa9d637b78b0e7f936dcb410fb0c6256a
MD5 cf1726d68c17e0bebc4a89067a35acdd
SHA1 affebf389098a295ba207c2795deaef3d6b3f9a5
SHA512 b78f116707e63e8814f433ebb45701f11ce21e6de2b3d245efbea9bdba4e7db46160f5639c2c1c78b42cbaa5ff483591b78d580f1ab5374998664a403dbb1e73
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NqcM:GemTLkNdfE0pZaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

prOhQjA.exe

Path C:\Windows\System\prOhQjA.exe
Size 1.6MB
SHA256 491e8a60ea468875ab6384cf29be4f8f1cab614ade49bfb5afbaeb75bbef145a
MD5 726a1a363da8da9b96202eef1127186d
SHA1 ac4fa7e7fbbc9f039b1a5bb48b39b91175356f82
SHA512 0ace64811e081e2d504e8642e57a4dd214006e7f3697a8f3e52041718805a9d7ca28728a27e1698fc8e0bfff85b58ed5243d6ccd905b50bb59f90da3eb2f0f81
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NqcR:GemTLkNdfE0pZa5
MD5 SHA1 SHA512 SSDEEP

Submit Download

rDXdLqT.exe

Path C:\Windows\System\rDXdLqT.exe
Size 1.6MB
SHA256 def079bf09beb02c5a2236daa53a790f4d068b62977b6b2a5dc8015bd82f3ac7
MD5 62acfbaa8f2e268cdff016361f5fc97c
SHA1 6dbff8e243eeb49095e040cd379190b9408267f8
SHA512 b04a632f6eb30fbf3b55c58663b02a68bc6ab11a4b004cc09bbf5c6a3d9b383d93893bcd71a73327a2f4b1f2f76194aca3cb309279c084395251fc40c6f1c7a2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqck:GemTLkNdfE0pZa8
MD5 SHA1 SHA512 SSDEEP

Submit Download

tNGtMtS.exe

Path C:\Windows\System\tNGtMtS.exe
Size 1.6MB
SHA256 28b7aedd2a2d0bdcac0f6ef30417488d9f5562518837baa28abc3c88ee6f83fb
MD5 ff269ca6ce22aca4de6514392fa9f245
SHA1 36574e575ce1e810b89b5e7bacf1a26fde3b9403
SHA512 1a41a6a496f9358112eedc6820eaf97f06fc5d9d961504d74c5ab1274e73aa4eb44eba4224549f5004a924ba5139a0d93bae2a846f7520b719d48f89abc40d11
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqcz:GemTLkNdfE0pZar
MD5 SHA1 SHA512 SSDEEP

Submit Download

teZDeft.exe

Path C:\Windows\System\teZDeft.exe
Size 1.6MB
SHA256 2a9ee66f54db7e3596d3d6aeae29b0b3f25c8b7a3fcf4b28854b61f0ec8d5343
MD5 46020cdce18ae242c12e210b30717585
SHA1 d9f7f15fa95dc51e1a0a4e83976e27ccb26dcc17
SHA512 bc73f6f51feb75c95b80ba48b92fbe9601a6ba051fac9f93a5452061de32fba8ed2ce5c5044065ce1fb592082ac20af97b1752745bfb094f584ea4f15868055e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqco:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ujlQGTz.exe

Path C:\Windows\System\ujlQGTz.exe
Size 1.6MB
SHA256 32edaf103e21a5737d20974392945022e2670dfebfe0787ffe3f4fbf34f1820e
MD5 3b1300b8cce70ab3d9a9af6839738be5
SHA1 7f65354c54631d90c48b1075b88ebdb709840ff9
SHA512 07313f518211e42114632c02f90b1e987bc7f3489ded9770c4622d32aa9f672c57c0134f71bf3e9b0114f573d09dea9dbfc20771e90f56f4494d6f962f5f3132
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc5:GemTLkNdfE0pZax
MD5 SHA1 SHA512 SSDEEP

Submit Download

vrfBioa.exe

Path C:\Windows\System\vrfBioa.exe
Size 1.6MB
SHA256 9e0cdb3df573380224d864a88658023484d246717c4b15ec1a95e69335152ea9
MD5 ce67e50f847f53fe9601c814254ff23a
SHA1 74e49f77b5c5659386bfb8f01c7c726daa3a0aac
SHA512 b052926571248b7994c924449d7b74f0ee77933f73100271ece2ff9ae2058fd7ecaf45c6d004bcdf4323685ae9205efefd6ae816e3bc91d7ff450117253f429b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NqcA:GemTLkNdfE0pZaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

weYOxew.exe

Path C:\Windows\System\weYOxew.exe
Size 1.6MB
SHA256 94ed51abe52f6f4668c6383c6c9ba7527c9ed59955e4c47ce687562376470193
MD5 4962aaf3dc494120537c7b922b2cddf8
SHA1 3374d56cda311b9e32b7972ec06cb989b913bdcd
SHA512 7a35ce34a65005afe2b516c06cfa19e3de26ca913ea594e5ca1e60e49991ae89d83db054a4e645f78c060ef6904efbf71185f8b83b990b84a9836ef8c052112c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc7:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ycrZcUe.exe

Path C:\Windows\System\ycrZcUe.exe
Size 1.6MB
SHA256 3ce00383582f6e780d5cbad4d5b84577a57b032acf6a3fe2b5a528bbb1b9c404
MD5 58d3fbfc9de42090f4f2085e5fdcdc38
SHA1 dda59a9e582e5f1239cb2ad839a9867a2166a199
SHA512 0a8742e08ac323371ddbc8eb8680b232dd56d48c4061fad01053bd90ee7897cebe7f964c604774647701c80f4a102b133499f5da6dd9f704d92bbb2bd7248b1e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc1:GemTLkNdfE0pZat
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/552-0-0x000001BF8A0A0000-0x000001BF8A0B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads