xmrig | cc3da40d57f0a1a4dfca375f1190c3caa501604c330c0a1c5f91d1d3e7bbad7d

Analysis

max time kernel
108s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
Size 1.7MB
Sample240613-2yz96axgrp
SHA256 cc3da40d57f0a1a4dfca375f1190c3caa501604c330c0a1c5f91d1d3e7bbad7d
MD5 8e1362f26dd8be2969de22cd3464be90
SHA1 78dd72cd819ceff543bb92b3191b02cc59a8ddd2
SHA512 50eba3d363fe4fd5342d6d428989ddf720fd147127dc82e02f2ea5249a8c0648eaa001619f2ad1ca70f50ee1b02e9754760f85efbd960ff9f68402e58d42cde8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ERO1:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x00090000000233f4-3.dat	xmrig
behavioral2/files/0x000700000002340c-9.dat	xmrig
behavioral2/files/0x000700000002340d-14.dat	xmrig
behavioral2/files/0x000700000002340e-19.dat	xmrig
behavioral2/files/0x0007000000023410-29.dat	xmrig
behavioral2/files/0x0007000000023411-35.dat	xmrig
behavioral2/files/0x0007000000023412-40.dat	xmrig
behavioral2/files/0x0007000000023413-42.dat	xmrig
behavioral2/files/0x0007000000023415-56.dat	xmrig
behavioral2/files/0x0007000000023417-64.dat	xmrig
behavioral2/files/0x0007000000023418-70.dat	xmrig
behavioral2/files/0x0007000000023416-65.dat	xmrig
behavioral2/files/0x0007000000023414-52.dat	xmrig
behavioral2/files/0x000700000002340f-24.dat	xmrig
behavioral2/files/0x0003000000022990-78.dat	xmrig
behavioral2/files/0x0007000000023419-75.dat	xmrig
behavioral2/files/0x0005000000022ac0-83.dat	xmrig
behavioral2/files/0x000b00000002336e-90.dat	xmrig
behavioral2/files/0x000a00000002336f-94.dat	xmrig
behavioral2/files/0x0008000000023409-100.dat	xmrig
behavioral2/files/0x000700000002341a-103.dat	xmrig
behavioral2/files/0x000700000002341b-109.dat	xmrig
behavioral2/files/0x000700000002341c-113.dat	xmrig
behavioral2/files/0x000700000002341d-119.dat	xmrig
behavioral2/files/0x000700000002341e-124.dat	xmrig
behavioral2/files/0x000700000002341f-129.dat	xmrig
behavioral2/files/0x0007000000023420-134.dat	xmrig
behavioral2/files/0x0007000000023421-139.dat	xmrig
behavioral2/files/0x0007000000023422-144.dat	xmrig
behavioral2/files/0x0007000000023423-147.dat	xmrig
behavioral2/files/0x0007000000023427-162.dat	xmrig
behavioral2/files/0x0007000000023426-159.dat	xmrig
behavioral2/files/0x0007000000023425-158.dat	xmrig
behavioral2/files/0x0007000000023424-154.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
940	NzdHaSe.exe
3740	DDiHglD.exe
1404	eauQhjd.exe
8	WEWsaZZ.exe
2804	FJAvNex.exe
2824	GCGPMkx.exe
4180	fPQJbJs.exe
3800	VyaNZjN.exe
1932	NzvxarP.exe
1464	zHGytJi.exe
2348	wAiOxoz.exe
4696	yzTLAks.exe
3420	EbDwQfz.exe
1612	HQYykCV.exe
1568	difiDTA.exe
2592	fLWTPoy.exe
3724	CgEAKSc.exe
1580	qCCLKvw.exe
624	zxQtAlH.exe
4248	PlfofHG.exe
2888	rOYwJOs.exe
4000	Ystakfm.exe
3940	KchylkH.exe
4888	RcfkxnO.exe
1212	NecROob.exe
1400	nmcMxnf.exe
3328	FGccxmw.exe
4976	sPZbZxo.exe
2960	WGPEJaB.exe
5004	YUAyITY.exe
4404	XrDKOAt.exe
4424	zoLrtkJ.exe
2476	JGxFEim.exe
3980	IYqavqi.exe
1752	VDKwTmh.exe
3924	NesapYh.exe
1272	winknpu.exe
3244	yyWUJmT.exe
1780	plDWWLl.exe
2468	takSqIZ.exe
4536	QVgxIeI.exe
2096	MzoiTAJ.exe
2972	bXyqVTG.exe
456	BugCiwo.exe
4520	FGwRBLV.exe
1128	RUUODtr.exe
1328	setPXvR.exe
4256	bdgZnyJ.exe
60	xMkzKId.exe
3112	aZvQKUt.exe
2104	RiyvMpO.exe
760	yNpDdOc.exe
3100	oXLkHQa.exe
2452	KUtQSod.exe
1700	DZQGrza.exe
1728	iRhekgQ.exe
920	pVjiItA.exe
3276	YSxVwTu.exe
2220	xEDNEGz.exe
764	xqZzEsw.exe
2328	akVmbfJ.exe
4468	tvFphrH.exe
2892	AiprkmW.exe
1440	MlCLNAH.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SBiINFW.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\BbOCiiE.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\cNJUOmI.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\orvpBXy.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\dlStcqe.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\CHwMFLt.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\sPZbZxo.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\UmpEQpa.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\YUBVTXT.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\IlbITEj.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\RUUODtr.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\mtKLLWP.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\LeHrJDJ.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\JULIEiX.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\AgokMON.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\XlGfREx.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\abmukSX.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\zuwmGlq.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\GqjxTKm.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\QwtLKdz.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\xPXwPgX.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\NDcvfuv.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\rymtUPa.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\xEDNEGz.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\AKpgYwO.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\yNpDdOc.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\zCKEBkb.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\NJoVTIu.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\DcgByUL.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\RJuWLRb.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\jsduSuB.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\QFPCMeQ.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\jXBowlV.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\FODViZY.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\pcXqiPM.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\iJAweep.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\wfuyRJc.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\MjtTkDm.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\vQfOFun.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\ZWAVOCW.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\GyDxtox.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\PotABiZ.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\MOHoRGR.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\auvxQww.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\PEqTRQv.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\AiprkmW.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\KRccEGJ.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\dJGnaaK.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\HJYoaAZ.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\OtdoPJn.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\EdVvuwp.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\fAUaUXf.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\VznOOua.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\cdcIzOe.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\bdgZnyJ.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\jjcdNFQ.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\UdoGUPV.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\KXFBKiX.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\dmPxusF.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\sxCZAsd.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\NecROob.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\UxrmRwF.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\goebMFx.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
File created	C:\Windows\System\uJeuhaI.exe	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16576	dwm.exe
Token: SeChangeNotifyPrivilege	16576	dwm.exe
Token: 33	16576	dwm.exe
Token: SeIncBasePriorityPrivilege	16576	dwm.exe
Token: SeShutdownPrivilege	16576	dwm.exe
Token: SeCreatePagefilePrivilege	16576	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 940	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	83
PID 3756 wrote to memory of 940	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	83
PID 3756 wrote to memory of 3740	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	84
PID 3756 wrote to memory of 3740	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	84
PID 3756 wrote to memory of 1404	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	85
PID 3756 wrote to memory of 1404	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	85
PID 3756 wrote to memory of 8	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	86
PID 3756 wrote to memory of 8	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	86
PID 3756 wrote to memory of 2804	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	87
PID 3756 wrote to memory of 2804	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	87
PID 3756 wrote to memory of 2824	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	89
PID 3756 wrote to memory of 2824	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	89
PID 3756 wrote to memory of 4180	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	90
PID 3756 wrote to memory of 4180	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	90
PID 3756 wrote to memory of 3800	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	92
PID 3756 wrote to memory of 3800	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	92
PID 3756 wrote to memory of 1932	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	93
PID 3756 wrote to memory of 1932	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	93
PID 3756 wrote to memory of 1464	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	94
PID 3756 wrote to memory of 1464	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	94
PID 3756 wrote to memory of 2348	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	95
PID 3756 wrote to memory of 2348	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	95
PID 3756 wrote to memory of 4696	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	96
PID 3756 wrote to memory of 4696	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	96
PID 3756 wrote to memory of 3420	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	97
PID 3756 wrote to memory of 3420	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	97
PID 3756 wrote to memory of 1612	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	98
PID 3756 wrote to memory of 1612	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	98
PID 3756 wrote to memory of 1568	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	99
PID 3756 wrote to memory of 1568	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	99
PID 3756 wrote to memory of 2592	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	101
PID 3756 wrote to memory of 2592	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	101
PID 3756 wrote to memory of 3724	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	102
PID 3756 wrote to memory of 3724	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	102
PID 3756 wrote to memory of 1580	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	103
PID 3756 wrote to memory of 1580	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	103
PID 3756 wrote to memory of 624	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	104
PID 3756 wrote to memory of 624	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	104
PID 3756 wrote to memory of 4248	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	105
PID 3756 wrote to memory of 4248	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	105
PID 3756 wrote to memory of 2888	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	106
PID 3756 wrote to memory of 2888	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	106
PID 3756 wrote to memory of 4000	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	107
PID 3756 wrote to memory of 4000	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	107
PID 3756 wrote to memory of 3940	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	108
PID 3756 wrote to memory of 3940	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	108
PID 3756 wrote to memory of 4888	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	109
PID 3756 wrote to memory of 4888	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	109
PID 3756 wrote to memory of 1212	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	110
PID 3756 wrote to memory of 1212	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	110
PID 3756 wrote to memory of 1400	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	111
PID 3756 wrote to memory of 1400	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	111
PID 3756 wrote to memory of 3328	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	112
PID 3756 wrote to memory of 3328	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	112
PID 3756 wrote to memory of 4976	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	113
PID 3756 wrote to memory of 4976	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	113
PID 3756 wrote to memory of 2960	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	114
PID 3756 wrote to memory of 2960	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	114
PID 3756 wrote to memory of 5004	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	115
PID 3756 wrote to memory of 5004	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	115
PID 3756 wrote to memory of 4404	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	116
PID 3756 wrote to memory of 4404	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	116
PID 3756 wrote to memory of 4424	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	117
PID 3756 wrote to memory of 4424	3756	8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8e1362f26dd8be2969de22cd3464be90_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\System\NzdHaSe.exe
  C:\Windows\System\NzdHaSe.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\DDiHglD.exe
  C:\Windows\System\DDiHglD.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\eauQhjd.exe
  C:\Windows\System\eauQhjd.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\WEWsaZZ.exe
  C:\Windows\System\WEWsaZZ.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\FJAvNex.exe
  C:\Windows\System\FJAvNex.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\GCGPMkx.exe
  C:\Windows\System\GCGPMkx.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\fPQJbJs.exe
  C:\Windows\System\fPQJbJs.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\VyaNZjN.exe
  C:\Windows\System\VyaNZjN.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\NzvxarP.exe
  C:\Windows\System\NzvxarP.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\zHGytJi.exe
  C:\Windows\System\zHGytJi.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\wAiOxoz.exe
  C:\Windows\System\wAiOxoz.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\yzTLAks.exe
  C:\Windows\System\yzTLAks.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\EbDwQfz.exe
  C:\Windows\System\EbDwQfz.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\HQYykCV.exe
  C:\Windows\System\HQYykCV.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\difiDTA.exe
  C:\Windows\System\difiDTA.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\fLWTPoy.exe
  C:\Windows\System\fLWTPoy.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\CgEAKSc.exe
  C:\Windows\System\CgEAKSc.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\qCCLKvw.exe
  C:\Windows\System\qCCLKvw.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\zxQtAlH.exe
  C:\Windows\System\zxQtAlH.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\PlfofHG.exe
  C:\Windows\System\PlfofHG.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\rOYwJOs.exe
  C:\Windows\System\rOYwJOs.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\Ystakfm.exe
  C:\Windows\System\Ystakfm.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\KchylkH.exe
  C:\Windows\System\KchylkH.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\RcfkxnO.exe
  C:\Windows\System\RcfkxnO.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\NecROob.exe
  C:\Windows\System\NecROob.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\nmcMxnf.exe
  C:\Windows\System\nmcMxnf.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\FGccxmw.exe
  C:\Windows\System\FGccxmw.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\sPZbZxo.exe
  C:\Windows\System\sPZbZxo.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\WGPEJaB.exe
  C:\Windows\System\WGPEJaB.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\YUAyITY.exe
  C:\Windows\System\YUAyITY.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\XrDKOAt.exe
  C:\Windows\System\XrDKOAt.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\zoLrtkJ.exe
  C:\Windows\System\zoLrtkJ.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\JGxFEim.exe
  C:\Windows\System\JGxFEim.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\IYqavqi.exe
  C:\Windows\System\IYqavqi.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\VDKwTmh.exe
  C:\Windows\System\VDKwTmh.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\NesapYh.exe
  C:\Windows\System\NesapYh.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\winknpu.exe
  C:\Windows\System\winknpu.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\yyWUJmT.exe
  C:\Windows\System\yyWUJmT.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\takSqIZ.exe
  C:\Windows\System\takSqIZ.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\plDWWLl.exe
  C:\Windows\System\plDWWLl.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\QVgxIeI.exe
  C:\Windows\System\QVgxIeI.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\MzoiTAJ.exe
  C:\Windows\System\MzoiTAJ.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\bXyqVTG.exe
  C:\Windows\System\bXyqVTG.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\BugCiwo.exe
  C:\Windows\System\BugCiwo.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\FGwRBLV.exe
  C:\Windows\System\FGwRBLV.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\RUUODtr.exe
  C:\Windows\System\RUUODtr.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\setPXvR.exe
  C:\Windows\System\setPXvR.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\bdgZnyJ.exe
  C:\Windows\System\bdgZnyJ.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\xMkzKId.exe
  C:\Windows\System\xMkzKId.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\aZvQKUt.exe
  C:\Windows\System\aZvQKUt.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\RiyvMpO.exe
  C:\Windows\System\RiyvMpO.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\yNpDdOc.exe
  C:\Windows\System\yNpDdOc.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\oXLkHQa.exe
  C:\Windows\System\oXLkHQa.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\KUtQSod.exe
  C:\Windows\System\KUtQSod.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\DZQGrza.exe
  C:\Windows\System\DZQGrza.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\iRhekgQ.exe
  C:\Windows\System\iRhekgQ.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\pVjiItA.exe
  C:\Windows\System\pVjiItA.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\YSxVwTu.exe
  C:\Windows\System\YSxVwTu.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\xEDNEGz.exe
  C:\Windows\System\xEDNEGz.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\xqZzEsw.exe
  C:\Windows\System\xqZzEsw.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\akVmbfJ.exe
  C:\Windows\System\akVmbfJ.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\tvFphrH.exe
  C:\Windows\System\tvFphrH.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\AiprkmW.exe
  C:\Windows\System\AiprkmW.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\MlCLNAH.exe
  C:\Windows\System\MlCLNAH.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\DTBdojZ.exe
  C:\Windows\System\DTBdojZ.exe
  2⤵
  PID:4620
- C:\Windows\System\DnSlkkK.exe
  C:\Windows\System\DnSlkkK.exe
  2⤵
  PID:1300
- C:\Windows\System\GfoXlPi.exe
  C:\Windows\System\GfoXlPi.exe
  2⤵
  PID:4608
- C:\Windows\System\bOqmlRI.exe
  C:\Windows\System\bOqmlRI.exe
  2⤵
  PID:4408
- C:\Windows\System\roLTWSb.exe
  C:\Windows\System\roLTWSb.exe
  2⤵
  PID:3084
- C:\Windows\System\gLmzayz.exe
  C:\Windows\System\gLmzayz.exe
  2⤵
  PID:1800
- C:\Windows\System\JNDwObE.exe
  C:\Windows\System\JNDwObE.exe
  2⤵
  PID:1748
- C:\Windows\System\zQYQNok.exe
  C:\Windows\System\zQYQNok.exe
  2⤵
  PID:1952
- C:\Windows\System\PBOgfMB.exe
  C:\Windows\System\PBOgfMB.exe
  2⤵
  PID:4908
- C:\Windows\System\ejtteGy.exe
  C:\Windows\System\ejtteGy.exe
  2⤵
  PID:4556
- C:\Windows\System\KyozygR.exe
  C:\Windows\System\KyozygR.exe
  2⤵
  PID:776
- C:\Windows\System\uhVvBdH.exe
  C:\Windows\System\uhVvBdH.exe
  2⤵
  PID:1452
- C:\Windows\System\XXlhRVs.exe
  C:\Windows\System\XXlhRVs.exe
  2⤵
  PID:2728
- C:\Windows\System\fyGBHzS.exe
  C:\Windows\System\fyGBHzS.exe
  2⤵
  PID:4052
- C:\Windows\System\kQCsPen.exe
  C:\Windows\System\kQCsPen.exe
  2⤵
  PID:5076
- C:\Windows\System\QhSavbP.exe
  C:\Windows\System\QhSavbP.exe
  2⤵
  PID:4280
- C:\Windows\System\feqyBpX.exe
  C:\Windows\System\feqyBpX.exe
  2⤵
  PID:2916
- C:\Windows\System\wAixqdm.exe
  C:\Windows\System\wAixqdm.exe
  2⤵
  PID:3816
- C:\Windows\System\zGxFJaZ.exe
  C:\Windows\System\zGxFJaZ.exe
  2⤵
  PID:3768
- C:\Windows\System\OQSDCUj.exe
  C:\Windows\System\OQSDCUj.exe
  2⤵
  PID:4676
- C:\Windows\System\ijSvBwP.exe
  C:\Windows\System\ijSvBwP.exe
  2⤵
  PID:2148
- C:\Windows\System\hLkRLAA.exe
  C:\Windows\System\hLkRLAA.exe
  2⤵
  PID:916
- C:\Windows\System\gVGOXtx.exe
  C:\Windows\System\gVGOXtx.exe
  2⤵
  PID:1436
- C:\Windows\System\wEKHunf.exe
  C:\Windows\System\wEKHunf.exe
  2⤵
  PID:4972
- C:\Windows\System\yHpoJYe.exe
  C:\Windows\System\yHpoJYe.exe
  2⤵
  PID:3960
- C:\Windows\System\AKpgYwO.exe
  C:\Windows\System\AKpgYwO.exe
  2⤵
  PID:4412
- C:\Windows\System\LMbyXCd.exe
  C:\Windows\System\LMbyXCd.exe
  2⤵
  PID:4340
- C:\Windows\System\woyTNCw.exe
  C:\Windows\System\woyTNCw.exe
  2⤵
  PID:1864
- C:\Windows\System\QVJVyoZ.exe
  C:\Windows\System\QVJVyoZ.exe
  2⤵
  PID:3996
- C:\Windows\System\YFNhCzd.exe
  C:\Windows\System\YFNhCzd.exe
  2⤵
  PID:644
- C:\Windows\System\NDcvfuv.exe
  C:\Windows\System\NDcvfuv.exe
  2⤵
  PID:3856
- C:\Windows\System\ZzOJEtI.exe
  C:\Windows\System\ZzOJEtI.exe
  2⤵
  PID:4304
- C:\Windows\System\PJeQAWP.exe
  C:\Windows\System\PJeQAWP.exe
  2⤵
  PID:3228
- C:\Windows\System\KYQnFFU.exe
  C:\Windows\System\KYQnFFU.exe
  2⤵
  PID:3692
- C:\Windows\System\wDmddKV.exe
  C:\Windows\System\wDmddKV.exe
  2⤵
  PID:5228
- C:\Windows\System\jrVsGoS.exe
  C:\Windows\System\jrVsGoS.exe
  2⤵
  PID:5252
- C:\Windows\System\aeKYkDZ.exe
  C:\Windows\System\aeKYkDZ.exe
  2⤵
  PID:5268
- C:\Windows\System\YlEoDLT.exe
  C:\Windows\System\YlEoDLT.exe
  2⤵
  PID:5288
- C:\Windows\System\dURgZyq.exe
  C:\Windows\System\dURgZyq.exe
  2⤵
  PID:5312
- C:\Windows\System\IyrSJtb.exe
  C:\Windows\System\IyrSJtb.exe
  2⤵
  PID:5328
- C:\Windows\System\sTOOIYn.exe
  C:\Windows\System\sTOOIYn.exe
  2⤵
  PID:5364
- C:\Windows\System\blrhBbC.exe
  C:\Windows\System\blrhBbC.exe
  2⤵
  PID:5388
- C:\Windows\System\BXkPWRE.exe
  C:\Windows\System\BXkPWRE.exe
  2⤵
  PID:5428
- C:\Windows\System\YUBVTXT.exe
  C:\Windows\System\YUBVTXT.exe
  2⤵
  PID:5460
- C:\Windows\System\WFgMpWt.exe
  C:\Windows\System\WFgMpWt.exe
  2⤵
  PID:5504
- C:\Windows\System\ratDNEs.exe
  C:\Windows\System\ratDNEs.exe
  2⤵
  PID:5524
- C:\Windows\System\kCNVdJZ.exe
  C:\Windows\System\kCNVdJZ.exe
  2⤵
  PID:5544
- C:\Windows\System\EHsbLLc.exe
  C:\Windows\System\EHsbLLc.exe
  2⤵
  PID:5580
- C:\Windows\System\DMnhgCi.exe
  C:\Windows\System\DMnhgCi.exe
  2⤵
  PID:5612
- C:\Windows\System\qvVwoqe.exe
  C:\Windows\System\qvVwoqe.exe
  2⤵
  PID:5636
- C:\Windows\System\vfchEuL.exe
  C:\Windows\System\vfchEuL.exe
  2⤵
  PID:5656
- C:\Windows\System\ByaDJmr.exe
  C:\Windows\System\ByaDJmr.exe
  2⤵
  PID:5676
- C:\Windows\System\CJGKbcb.exe
  C:\Windows\System\CJGKbcb.exe
  2⤵
  PID:5708
- C:\Windows\System\EdVvuwp.exe
  C:\Windows\System\EdVvuwp.exe
  2⤵
  PID:5728
- C:\Windows\System\LfAddWA.exe
  C:\Windows\System\LfAddWA.exe
  2⤵
  PID:5756
- C:\Windows\System\fNKOXdM.exe
  C:\Windows\System\fNKOXdM.exe
  2⤵
  PID:5772
- C:\Windows\System\hyjQTbf.exe
  C:\Windows\System\hyjQTbf.exe
  2⤵
  PID:5800
- C:\Windows\System\RPeNLiD.exe
  C:\Windows\System\RPeNLiD.exe
  2⤵
  PID:5836
- C:\Windows\System\KHCzroB.exe
  C:\Windows\System\KHCzroB.exe
  2⤵
  PID:5864
- C:\Windows\System\fAUaUXf.exe
  C:\Windows\System\fAUaUXf.exe
  2⤵
  PID:5896
- C:\Windows\System\dJJVbJs.exe
  C:\Windows\System\dJJVbJs.exe
  2⤵
  PID:5932
- C:\Windows\System\EIdjatF.exe
  C:\Windows\System\EIdjatF.exe
  2⤵
  PID:5964
- C:\Windows\System\HlvBLoT.exe
  C:\Windows\System\HlvBLoT.exe
  2⤵
  PID:6004
- C:\Windows\System\mJMwBUn.exe
  C:\Windows\System\mJMwBUn.exe
  2⤵
  PID:6056
- C:\Windows\System\CkIhFqs.exe
  C:\Windows\System\CkIhFqs.exe
  2⤵
  PID:6084
- C:\Windows\System\zCKEBkb.exe
  C:\Windows\System\zCKEBkb.exe
  2⤵
  PID:6112
- C:\Windows\System\GyDxtox.exe
  C:\Windows\System\GyDxtox.exe
  2⤵
  PID:6140
- C:\Windows\System\FhQBrYg.exe
  C:\Windows\System\FhQBrYg.exe
  2⤵
  PID:2536
- C:\Windows\System\hFXKNyP.exe
  C:\Windows\System\hFXKNyP.exe
  2⤵
  PID:1240
- C:\Windows\System\LAdQeOJ.exe
  C:\Windows\System\LAdQeOJ.exe
  2⤵
  PID:2588
- C:\Windows\System\rsodgrJ.exe
  C:\Windows\System\rsodgrJ.exe
  2⤵
  PID:5124
- C:\Windows\System\vEryaqZ.exe
  C:\Windows\System\vEryaqZ.exe
  2⤵
  PID:5144
- C:\Windows\System\FXzkXDA.exe
  C:\Windows\System\FXzkXDA.exe
  2⤵
  PID:5160
- C:\Windows\System\BlhQlkd.exe
  C:\Windows\System\BlhQlkd.exe
  2⤵
  PID:5192
- C:\Windows\System\kfCwMAI.exe
  C:\Windows\System\kfCwMAI.exe
  2⤵
  PID:3096
- C:\Windows\System\PotABiZ.exe
  C:\Windows\System\PotABiZ.exe
  2⤵
  PID:5220
- C:\Windows\System\epvJIEQ.exe
  C:\Windows\System\epvJIEQ.exe
  2⤵
  PID:5308
- C:\Windows\System\gEexdPm.exe
  C:\Windows\System\gEexdPm.exe
  2⤵
  PID:5400
- C:\Windows\System\EjnvVMJ.exe
  C:\Windows\System\EjnvVMJ.exe
  2⤵
  PID:5488
- C:\Windows\System\NNWoPjv.exe
  C:\Windows\System\NNWoPjv.exe
  2⤵
  PID:5512
- C:\Windows\System\CdKNErK.exe
  C:\Windows\System\CdKNErK.exe
  2⤵
  PID:5620
- C:\Windows\System\yGKAzgZ.exe
  C:\Windows\System\yGKAzgZ.exe
  2⤵
  PID:5644
- C:\Windows\System\jSZyobg.exe
  C:\Windows\System\jSZyobg.exe
  2⤵
  PID:5720
- C:\Windows\System\dPADEUw.exe
  C:\Windows\System\dPADEUw.exe
  2⤵
  PID:5764
- C:\Windows\System\ViRBWCp.exe
  C:\Windows\System\ViRBWCp.exe
  2⤵
  PID:5884
- C:\Windows\System\fXYShvm.exe
  C:\Windows\System\fXYShvm.exe
  2⤵
  PID:5920
- C:\Windows\System\yrNbcZT.exe
  C:\Windows\System\yrNbcZT.exe
  2⤵
  PID:5972
- C:\Windows\System\SvsVjRT.exe
  C:\Windows\System\SvsVjRT.exe
  2⤵
  PID:6104
- C:\Windows\System\xplVcTG.exe
  C:\Windows\System\xplVcTG.exe
  2⤵
  PID:6124
- C:\Windows\System\GsBgAmo.exe
  C:\Windows\System\GsBgAmo.exe
  2⤵
  PID:4136
- C:\Windows\System\vhacXiY.exe
  C:\Windows\System\vhacXiY.exe
  2⤵
  PID:5136
- C:\Windows\System\qWkEMmv.exe
  C:\Windows\System\qWkEMmv.exe
  2⤵
  PID:3976
- C:\Windows\System\YBvCtqX.exe
  C:\Windows\System\YBvCtqX.exe
  2⤵
  PID:5212
- C:\Windows\System\VjsmPbT.exe
  C:\Windows\System\VjsmPbT.exe
  2⤵
  PID:5440
- C:\Windows\System\cQeSQrm.exe
  C:\Windows\System\cQeSQrm.exe
  2⤵
  PID:5624
- C:\Windows\System\CctSAom.exe
  C:\Windows\System\CctSAom.exe
  2⤵
  PID:5600
- C:\Windows\System\vIGMToQ.exe
  C:\Windows\System\vIGMToQ.exe
  2⤵
  PID:5696
- C:\Windows\System\QhKXkVc.exe
  C:\Windows\System\QhKXkVc.exe
  2⤵
  PID:6064
- C:\Windows\System\BqfBFXb.exe
  C:\Windows\System\BqfBFXb.exe
  2⤵
  PID:1156
- C:\Windows\System\FlYcaOA.exe
  C:\Windows\System\FlYcaOA.exe
  2⤵
  PID:5280
- C:\Windows\System\MpOPjaO.exe
  C:\Windows\System\MpOPjaO.exe
  2⤵
  PID:5496
- C:\Windows\System\TBbClfH.exe
  C:\Windows\System\TBbClfH.exe
  2⤵
  PID:6012
- C:\Windows\System\uDdzrIa.exe
  C:\Windows\System\uDdzrIa.exe
  2⤵
  PID:5992
- C:\Windows\System\uKMGsYD.exe
  C:\Windows\System\uKMGsYD.exe
  2⤵
  PID:5412
- C:\Windows\System\OWhNTZG.exe
  C:\Windows\System\OWhNTZG.exe
  2⤵
  PID:6164
- C:\Windows\System\UJnclPy.exe
  C:\Windows\System\UJnclPy.exe
  2⤵
  PID:6204
- C:\Windows\System\XlGfREx.exe
  C:\Windows\System\XlGfREx.exe
  2⤵
  PID:6228
- C:\Windows\System\bTJMXtp.exe
  C:\Windows\System\bTJMXtp.exe
  2⤵
  PID:6260
- C:\Windows\System\HvomipA.exe
  C:\Windows\System\HvomipA.exe
  2⤵
  PID:6288
- C:\Windows\System\LhtvXFR.exe
  C:\Windows\System\LhtvXFR.exe
  2⤵
  PID:6316
- C:\Windows\System\orvpBXy.exe
  C:\Windows\System\orvpBXy.exe
  2⤵
  PID:6344
- C:\Windows\System\gpoRMiI.exe
  C:\Windows\System\gpoRMiI.exe
  2⤵
  PID:6364
- C:\Windows\System\utDFEDn.exe
  C:\Windows\System\utDFEDn.exe
  2⤵
  PID:6392
- C:\Windows\System\tAHIoZU.exe
  C:\Windows\System\tAHIoZU.exe
  2⤵
  PID:6428
- C:\Windows\System\RubIeYZ.exe
  C:\Windows\System\RubIeYZ.exe
  2⤵
  PID:6460
- C:\Windows\System\BrdQFBi.exe
  C:\Windows\System\BrdQFBi.exe
  2⤵
  PID:6496
- C:\Windows\System\UickBsi.exe
  C:\Windows\System\UickBsi.exe
  2⤵
  PID:6516
- C:\Windows\System\yTCBKSh.exe
  C:\Windows\System\yTCBKSh.exe
  2⤵
  PID:6540
- C:\Windows\System\ZdKdBLW.exe
  C:\Windows\System\ZdKdBLW.exe
  2⤵
  PID:6568
- C:\Windows\System\uHOWrvj.exe
  C:\Windows\System\uHOWrvj.exe
  2⤵
  PID:6600
- C:\Windows\System\HECzljP.exe
  C:\Windows\System\HECzljP.exe
  2⤵
  PID:6624
- C:\Windows\System\emaJnTy.exe
  C:\Windows\System\emaJnTy.exe
  2⤵
  PID:6640
- C:\Windows\System\SRdtfjK.exe
  C:\Windows\System\SRdtfjK.exe
  2⤵
  PID:6660
- C:\Windows\System\rqSuaQz.exe
  C:\Windows\System\rqSuaQz.exe
  2⤵
  PID:6696
- C:\Windows\System\LtRHUjK.exe
  C:\Windows\System\LtRHUjK.exe
  2⤵
  PID:6724
- C:\Windows\System\IOjTLJv.exe
  C:\Windows\System\IOjTLJv.exe
  2⤵
  PID:6752
- C:\Windows\System\PMyVyAT.exe
  C:\Windows\System\PMyVyAT.exe
  2⤵
  PID:6792
- C:\Windows\System\XgjNxUV.exe
  C:\Windows\System\XgjNxUV.exe
  2⤵
  PID:6820
- C:\Windows\System\CtIStMI.exe
  C:\Windows\System\CtIStMI.exe
  2⤵
  PID:6856
- C:\Windows\System\xfVdWUb.exe
  C:\Windows\System\xfVdWUb.exe
  2⤵
  PID:6876
- C:\Windows\System\VICMHxD.exe
  C:\Windows\System\VICMHxD.exe
  2⤵
  PID:6892
- C:\Windows\System\ARRNZaX.exe
  C:\Windows\System\ARRNZaX.exe
  2⤵
  PID:6924
- C:\Windows\System\SZPiAKK.exe
  C:\Windows\System\SZPiAKK.exe
  2⤵
  PID:6944
- C:\Windows\System\WDiaxhP.exe
  C:\Windows\System\WDiaxhP.exe
  2⤵
  PID:6976
- C:\Windows\System\PTCblBO.exe
  C:\Windows\System\PTCblBO.exe
  2⤵
  PID:7008
- C:\Windows\System\TPRUklo.exe
  C:\Windows\System\TPRUklo.exe
  2⤵
  PID:7044
- C:\Windows\System\BXyWyBI.exe
  C:\Windows\System\BXyWyBI.exe
  2⤵
  PID:7064
- C:\Windows\System\GbBjhmV.exe
  C:\Windows\System\GbBjhmV.exe
  2⤵
  PID:7092
- C:\Windows\System\BzUJwxG.exe
  C:\Windows\System\BzUJwxG.exe
  2⤵
  PID:7116
- C:\Windows\System\BToWdFw.exe
  C:\Windows\System\BToWdFw.exe
  2⤵
  PID:7152
- C:\Windows\System\YqFSHYa.exe
  C:\Windows\System\YqFSHYa.exe
  2⤵
  PID:5172
- C:\Windows\System\afVPSZH.exe
  C:\Windows\System\afVPSZH.exe
  2⤵
  PID:6188
- C:\Windows\System\taaQvZI.exe
  C:\Windows\System\taaQvZI.exe
  2⤵
  PID:6220
- C:\Windows\System\sftKZbh.exe
  C:\Windows\System\sftKZbh.exe
  2⤵
  PID:6312
- C:\Windows\System\KFgWuvq.exe
  C:\Windows\System\KFgWuvq.exe
  2⤵
  PID:6352
- C:\Windows\System\KxZZljP.exe
  C:\Windows\System\KxZZljP.exe
  2⤵
  PID:6468
- C:\Windows\System\NhmisKm.exe
  C:\Windows\System\NhmisKm.exe
  2⤵
  PID:6512
- C:\Windows\System\VTIxpyx.exe
  C:\Windows\System\VTIxpyx.exe
  2⤵
  PID:6584
- C:\Windows\System\OMgfhFJ.exe
  C:\Windows\System\OMgfhFJ.exe
  2⤵
  PID:6680
- C:\Windows\System\GnecaFs.exe
  C:\Windows\System\GnecaFs.exe
  2⤵
  PID:6760
- C:\Windows\System\OxeCkzB.exe
  C:\Windows\System\OxeCkzB.exe
  2⤵
  PID:6808
- C:\Windows\System\MVHzOPt.exe
  C:\Windows\System\MVHzOPt.exe
  2⤵
  PID:6888
- C:\Windows\System\hsuDakH.exe
  C:\Windows\System\hsuDakH.exe
  2⤵
  PID:6916
- C:\Windows\System\aZusVxY.exe
  C:\Windows\System\aZusVxY.exe
  2⤵
  PID:6992
- C:\Windows\System\PMNlbDq.exe
  C:\Windows\System\PMNlbDq.exe
  2⤵
  PID:7036
- C:\Windows\System\QwtLKdz.exe
  C:\Windows\System\QwtLKdz.exe
  2⤵
  PID:7080
- C:\Windows\System\sFdaNso.exe
  C:\Windows\System\sFdaNso.exe
  2⤵
  PID:7164
- C:\Windows\System\odxBzdV.exe
  C:\Windows\System\odxBzdV.exe
  2⤵
  PID:6284
- C:\Windows\System\QFPCMeQ.exe
  C:\Windows\System\QFPCMeQ.exe
  2⤵
  PID:6308
- C:\Windows\System\bhYnFKt.exe
  C:\Windows\System\bhYnFKt.exe
  2⤵
  PID:6484
- C:\Windows\System\sHXDYlu.exe
  C:\Windows\System\sHXDYlu.exe
  2⤵
  PID:6648
- C:\Windows\System\IigzYND.exe
  C:\Windows\System\IigzYND.exe
  2⤵
  PID:6848
- C:\Windows\System\VLAJlQw.exe
  C:\Windows\System\VLAJlQw.exe
  2⤵
  PID:7020
- C:\Windows\System\NbqxRrR.exe
  C:\Windows\System\NbqxRrR.exe
  2⤵
  PID:7136
- C:\Windows\System\QOCqfha.exe
  C:\Windows\System\QOCqfha.exe
  2⤵
  PID:6156
- C:\Windows\System\EddZqhb.exe
  C:\Windows\System\EddZqhb.exe
  2⤵
  PID:6524
- C:\Windows\System\xPXwPgX.exe
  C:\Windows\System\xPXwPgX.exe
  2⤵
  PID:7076
- C:\Windows\System\fcQWRPV.exe
  C:\Windows\System\fcQWRPV.exe
  2⤵
  PID:6844
- C:\Windows\System\gNzOeod.exe
  C:\Windows\System\gNzOeod.exe
  2⤵
  PID:6372
- C:\Windows\System\BHWWxUP.exe
  C:\Windows\System\BHWWxUP.exe
  2⤵
  PID:6668
- C:\Windows\System\jCIcxLA.exe
  C:\Windows\System\jCIcxLA.exe
  2⤵
  PID:7200
- C:\Windows\System\QKyWyRA.exe
  C:\Windows\System\QKyWyRA.exe
  2⤵
  PID:7240
- C:\Windows\System\aTUEcdd.exe
  C:\Windows\System\aTUEcdd.exe
  2⤵
  PID:7276
- C:\Windows\System\IYaQfkC.exe
  C:\Windows\System\IYaQfkC.exe
  2⤵
  PID:7308
- C:\Windows\System\uozzcPb.exe
  C:\Windows\System\uozzcPb.exe
  2⤵
  PID:7336
- C:\Windows\System\XsTzecn.exe
  C:\Windows\System\XsTzecn.exe
  2⤵
  PID:7368
- C:\Windows\System\eHufwvh.exe
  C:\Windows\System\eHufwvh.exe
  2⤵
  PID:7412
- C:\Windows\System\jXBowlV.exe
  C:\Windows\System\jXBowlV.exe
  2⤵
  PID:7440
- C:\Windows\System\hQmqcnO.exe
  C:\Windows\System\hQmqcnO.exe
  2⤵
  PID:7460
- C:\Windows\System\SCprgKe.exe
  C:\Windows\System\SCprgKe.exe
  2⤵
  PID:7476
- C:\Windows\System\eljmBZf.exe
  C:\Windows\System\eljmBZf.exe
  2⤵
  PID:7508
- C:\Windows\System\GeBcRXh.exe
  C:\Windows\System\GeBcRXh.exe
  2⤵
  PID:7548
- C:\Windows\System\vQfOFun.exe
  C:\Windows\System\vQfOFun.exe
  2⤵
  PID:7580
- C:\Windows\System\FAjqYhc.exe
  C:\Windows\System\FAjqYhc.exe
  2⤵
  PID:7600
- C:\Windows\System\xHiQSeg.exe
  C:\Windows\System\xHiQSeg.exe
  2⤵
  PID:7616
- C:\Windows\System\NQLYNAL.exe
  C:\Windows\System\NQLYNAL.exe
  2⤵
  PID:7644
- C:\Windows\System\WVkeMaU.exe
  C:\Windows\System\WVkeMaU.exe
  2⤵
  PID:7668
- C:\Windows\System\UYywoQb.exe
  C:\Windows\System\UYywoQb.exe
  2⤵
  PID:7700
- C:\Windows\System\sopZLKV.exe
  C:\Windows\System\sopZLKV.exe
  2⤵
  PID:7728
- C:\Windows\System\pYboqEF.exe
  C:\Windows\System\pYboqEF.exe
  2⤵
  PID:7756
- C:\Windows\System\oPoWbqo.exe
  C:\Windows\System\oPoWbqo.exe
  2⤵
  PID:7784
- C:\Windows\System\umOaWZN.exe
  C:\Windows\System\umOaWZN.exe
  2⤵
  PID:7820
- C:\Windows\System\YHTlIsn.exe
  C:\Windows\System\YHTlIsn.exe
  2⤵
  PID:7852
- C:\Windows\System\TrxLRoM.exe
  C:\Windows\System\TrxLRoM.exe
  2⤵
  PID:7880
- C:\Windows\System\jQJNCqm.exe
  C:\Windows\System\jQJNCqm.exe
  2⤵
  PID:7912
- C:\Windows\System\MpHsFSO.exe
  C:\Windows\System\MpHsFSO.exe
  2⤵
  PID:7936
- C:\Windows\System\uAfEwcm.exe
  C:\Windows\System\uAfEwcm.exe
  2⤵
  PID:7976
- C:\Windows\System\jFRbkfx.exe
  C:\Windows\System\jFRbkfx.exe
  2⤵
  PID:8004
- C:\Windows\System\AbfXSWn.exe
  C:\Windows\System\AbfXSWn.exe
  2⤵
  PID:8036
- C:\Windows\System\NJoVTIu.exe
  C:\Windows\System\NJoVTIu.exe
  2⤵
  PID:8060
- C:\Windows\System\imDVwNH.exe
  C:\Windows\System\imDVwNH.exe
  2⤵
  PID:8092
- C:\Windows\System\jjcdNFQ.exe
  C:\Windows\System\jjcdNFQ.exe
  2⤵
  PID:8116
- C:\Windows\System\dlStcqe.exe
  C:\Windows\System\dlStcqe.exe
  2⤵
  PID:8136
- C:\Windows\System\MWYLrSC.exe
  C:\Windows\System\MWYLrSC.exe
  2⤵
  PID:8172
- C:\Windows\System\hxXaYEW.exe
  C:\Windows\System\hxXaYEW.exe
  2⤵
  PID:6160
- C:\Windows\System\RvZXaCI.exe
  C:\Windows\System\RvZXaCI.exe
  2⤵
  PID:7228
- C:\Windows\System\HCHKsMC.exe
  C:\Windows\System\HCHKsMC.exe
  2⤵
  PID:7188
- C:\Windows\System\zgxwLZJ.exe
  C:\Windows\System\zgxwLZJ.exe
  2⤵
  PID:7344
- C:\Windows\System\KRccEGJ.exe
  C:\Windows\System\KRccEGJ.exe
  2⤵
  PID:7324
- C:\Windows\System\qIKLcnj.exe
  C:\Windows\System\qIKLcnj.exe
  2⤵
  PID:7432
- C:\Windows\System\jirumcG.exe
  C:\Windows\System\jirumcG.exe
  2⤵
  PID:7532
- C:\Windows\System\DsKNdOf.exe
  C:\Windows\System\DsKNdOf.exe
  2⤵
  PID:7612
- C:\Windows\System\XVHVRNH.exe
  C:\Windows\System\XVHVRNH.exe
  2⤵
  PID:7656
- C:\Windows\System\WojEyVb.exe
  C:\Windows\System\WojEyVb.exe
  2⤵
  PID:7696
- C:\Windows\System\csdiDgX.exe
  C:\Windows\System\csdiDgX.exe
  2⤵
  PID:7808
- C:\Windows\System\UpqYtBM.exe
  C:\Windows\System\UpqYtBM.exe
  2⤵
  PID:7816
- C:\Windows\System\jLCPbQj.exe
  C:\Windows\System\jLCPbQj.exe
  2⤵
  PID:7876
- C:\Windows\System\BVzzXQK.exe
  C:\Windows\System\BVzzXQK.exe
  2⤵
  PID:7984
- C:\Windows\System\yCMCVBl.exe
  C:\Windows\System\yCMCVBl.exe
  2⤵
  PID:8056
- C:\Windows\System\gnEIoiz.exe
  C:\Windows\System\gnEIoiz.exe
  2⤵
  PID:8044
- C:\Windows\System\zLfSmcm.exe
  C:\Windows\System\zLfSmcm.exe
  2⤵
  PID:8132
- C:\Windows\System\XQUVSpn.exe
  C:\Windows\System\XQUVSpn.exe
  2⤵
  PID:6904
- C:\Windows\System\SLiMjcX.exe
  C:\Windows\System\SLiMjcX.exe
  2⤵
  PID:7388
- C:\Windows\System\GQLXLem.exe
  C:\Windows\System\GQLXLem.exe
  2⤵
  PID:7488
- C:\Windows\System\SUzrRFr.exe
  C:\Windows\System\SUzrRFr.exe
  2⤵
  PID:7844
- C:\Windows\System\PxCGmaj.exe
  C:\Windows\System\PxCGmaj.exe
  2⤵
  PID:7868
- C:\Windows\System\BLxpuii.exe
  C:\Windows\System\BLxpuii.exe
  2⤵
  PID:7996
- C:\Windows\System\GJFJref.exe
  C:\Windows\System\GJFJref.exe
  2⤵
  PID:8112
- C:\Windows\System\TreYQMT.exe
  C:\Windows\System\TreYQMT.exe
  2⤵
  PID:7840
- C:\Windows\System\NHKHiDf.exe
  C:\Windows\System\NHKHiDf.exe
  2⤵
  PID:7664
- C:\Windows\System\EvnDjCs.exe
  C:\Windows\System\EvnDjCs.exe
  2⤵
  PID:8196
- C:\Windows\System\TBVlTuG.exe
  C:\Windows\System\TBVlTuG.exe
  2⤵
  PID:8228
- C:\Windows\System\nenkTRY.exe
  C:\Windows\System\nenkTRY.exe
  2⤵
  PID:8248
- C:\Windows\System\NdOAmNn.exe
  C:\Windows\System\NdOAmNn.exe
  2⤵
  PID:8284
- C:\Windows\System\LRagZTd.exe
  C:\Windows\System\LRagZTd.exe
  2⤵
  PID:8308
- C:\Windows\System\mGxdQQf.exe
  C:\Windows\System\mGxdQQf.exe
  2⤵
  PID:8344
- C:\Windows\System\Vuoirpo.exe
  C:\Windows\System\Vuoirpo.exe
  2⤵
  PID:8376
- C:\Windows\System\qsSiXCf.exe
  C:\Windows\System\qsSiXCf.exe
  2⤵
  PID:8396
- C:\Windows\System\xaKCfpH.exe
  C:\Windows\System\xaKCfpH.exe
  2⤵
  PID:8420
- C:\Windows\System\pjrQJUk.exe
  C:\Windows\System\pjrQJUk.exe
  2⤵
  PID:8460
- C:\Windows\System\zuwmGlq.exe
  C:\Windows\System\zuwmGlq.exe
  2⤵
  PID:8480
- C:\Windows\System\wpvrGRZ.exe
  C:\Windows\System\wpvrGRZ.exe
  2⤵
  PID:8512
- C:\Windows\System\QYdnoqJ.exe
  C:\Windows\System\QYdnoqJ.exe
  2⤵
  PID:8532
- C:\Windows\System\ElYsJSl.exe
  C:\Windows\System\ElYsJSl.exe
  2⤵
  PID:8560
- C:\Windows\System\GnSHxLu.exe
  C:\Windows\System\GnSHxLu.exe
  2⤵
  PID:8588
- C:\Windows\System\vRjkbbB.exe
  C:\Windows\System\vRjkbbB.exe
  2⤵
  PID:8616
- C:\Windows\System\LLdWUku.exe
  C:\Windows\System\LLdWUku.exe
  2⤵
  PID:8648
- C:\Windows\System\DcgByUL.exe
  C:\Windows\System\DcgByUL.exe
  2⤵
  PID:8680
- C:\Windows\System\ROtPPvI.exe
  C:\Windows\System\ROtPPvI.exe
  2⤵
  PID:8712
- C:\Windows\System\IRovQVe.exe
  C:\Windows\System\IRovQVe.exe
  2⤵
  PID:8744
- C:\Windows\System\YULKWqh.exe
  C:\Windows\System\YULKWqh.exe
  2⤵
  PID:8772
- C:\Windows\System\aTgzFne.exe
  C:\Windows\System\aTgzFne.exe
  2⤵
  PID:8808
- C:\Windows\System\oquPruP.exe
  C:\Windows\System\oquPruP.exe
  2⤵
  PID:8832
- C:\Windows\System\HfVjJiX.exe
  C:\Windows\System\HfVjJiX.exe
  2⤵
  PID:8856
- C:\Windows\System\SvQMXwl.exe
  C:\Windows\System\SvQMXwl.exe
  2⤵
  PID:8880
- C:\Windows\System\WWNeZbQ.exe
  C:\Windows\System\WWNeZbQ.exe
  2⤵
  PID:8908
- C:\Windows\System\qKbafvr.exe
  C:\Windows\System\qKbafvr.exe
  2⤵
  PID:8932
- C:\Windows\System\QVhEqyE.exe
  C:\Windows\System\QVhEqyE.exe
  2⤵
  PID:8968
- C:\Windows\System\czcPShU.exe
  C:\Windows\System\czcPShU.exe
  2⤵
  PID:8992
- C:\Windows\System\KOsUdcO.exe
  C:\Windows\System\KOsUdcO.exe
  2⤵
  PID:9020
- C:\Windows\System\xWbbCat.exe
  C:\Windows\System\xWbbCat.exe
  2⤵
  PID:9048
- C:\Windows\System\xpWNCAA.exe
  C:\Windows\System\xpWNCAA.exe
  2⤵
  PID:9072
- C:\Windows\System\OHqhdGU.exe
  C:\Windows\System\OHqhdGU.exe
  2⤵
  PID:9100
- C:\Windows\System\XtPyccx.exe
  C:\Windows\System\XtPyccx.exe
  2⤵
  PID:9136
- C:\Windows\System\IXCKZEm.exe
  C:\Windows\System\IXCKZEm.exe
  2⤵
  PID:9160
- C:\Windows\System\GNYLXZQ.exe
  C:\Windows\System\GNYLXZQ.exe
  2⤵
  PID:9188
- C:\Windows\System\luQMlJM.exe
  C:\Windows\System\luQMlJM.exe
  2⤵
  PID:8000
- C:\Windows\System\pvGJhLd.exe
  C:\Windows\System\pvGJhLd.exe
  2⤵
  PID:8224
- C:\Windows\System\hLFJKVU.exe
  C:\Windows\System\hLFJKVU.exe
  2⤵
  PID:8260
- C:\Windows\System\BvAhKBp.exe
  C:\Windows\System\BvAhKBp.exe
  2⤵
  PID:8336
- C:\Windows\System\zWvCpSZ.exe
  C:\Windows\System\zWvCpSZ.exe
  2⤵
  PID:8372
- C:\Windows\System\FYmBbOn.exe
  C:\Windows\System\FYmBbOn.exe
  2⤵
  PID:8412
- C:\Windows\System\wGCEsAZ.exe
  C:\Windows\System\wGCEsAZ.exe
  2⤵
  PID:8428
- C:\Windows\System\lJuAprh.exe
  C:\Windows\System\lJuAprh.exe
  2⤵
  PID:8556
- C:\Windows\System\wyQlosk.exe
  C:\Windows\System\wyQlosk.exe
  2⤵
  PID:8544
- C:\Windows\System\uJeuhaI.exe
  C:\Windows\System\uJeuhaI.exe
  2⤵
  PID:8632
- C:\Windows\System\roOKdtT.exe
  C:\Windows\System\roOKdtT.exe
  2⤵
  PID:8692
- C:\Windows\System\LmuhSoN.exe
  C:\Windows\System\LmuhSoN.exe
  2⤵
  PID:8760
- C:\Windows\System\qUbEWjJ.exe
  C:\Windows\System\qUbEWjJ.exe
  2⤵
  PID:8848
- C:\Windows\System\PMxNGIj.exe
  C:\Windows\System\PMxNGIj.exe
  2⤵
  PID:8924
- C:\Windows\System\ByPVGDn.exe
  C:\Windows\System\ByPVGDn.exe
  2⤵
  PID:9004
- C:\Windows\System\vncamXy.exe
  C:\Windows\System\vncamXy.exe
  2⤵
  PID:9064
- C:\Windows\System\oazjXjP.exe
  C:\Windows\System\oazjXjP.exe
  2⤵
  PID:9124
- C:\Windows\System\MihKkKy.exe
  C:\Windows\System\MihKkKy.exe
  2⤵
  PID:9200
- C:\Windows\System\FEpJcIL.exe
  C:\Windows\System\FEpJcIL.exe
  2⤵
  PID:8236
- C:\Windows\System\sDFjUst.exe
  C:\Windows\System\sDFjUst.exe
  2⤵
  PID:8368
- C:\Windows\System\NtLzpRC.exe
  C:\Windows\System\NtLzpRC.exe
  2⤵
  PID:8504
- C:\Windows\System\dJGnaaK.exe
  C:\Windows\System\dJGnaaK.exe
  2⤵
  PID:8628
- C:\Windows\System\FBIYZTh.exe
  C:\Windows\System\FBIYZTh.exe
  2⤵
  PID:8756
- C:\Windows\System\mrMdkcO.exe
  C:\Windows\System\mrMdkcO.exe
  2⤵
  PID:8984
- C:\Windows\System\QOWEllz.exe
  C:\Windows\System\QOWEllz.exe
  2⤵
  PID:9096
- C:\Windows\System\EpzRMIM.exe
  C:\Windows\System\EpzRMIM.exe
  2⤵
  PID:9152
- C:\Windows\System\alGjGwr.exe
  C:\Windows\System\alGjGwr.exe
  2⤵
  PID:8304
- C:\Windows\System\EMoZmWz.exe
  C:\Windows\System\EMoZmWz.exe
  2⤵
  PID:8740
- C:\Windows\System\JkRcLnJ.exe
  C:\Windows\System\JkRcLnJ.exe
  2⤵
  PID:8072
- C:\Windows\System\qsqoqTw.exe
  C:\Windows\System\qsqoqTw.exe
  2⤵
  PID:9244
- C:\Windows\System\gyCAUqs.exe
  C:\Windows\System\gyCAUqs.exe
  2⤵
  PID:9260
- C:\Windows\System\JIGCxjo.exe
  C:\Windows\System\JIGCxjo.exe
  2⤵
  PID:9296
- C:\Windows\System\mLsXPzk.exe
  C:\Windows\System\mLsXPzk.exe
  2⤵
  PID:9316
- C:\Windows\System\VznOOua.exe
  C:\Windows\System\VznOOua.exe
  2⤵
  PID:9344
- C:\Windows\System\OLFPYyV.exe
  C:\Windows\System\OLFPYyV.exe
  2⤵
  PID:9368
- C:\Windows\System\JAPKmnc.exe
  C:\Windows\System\JAPKmnc.exe
  2⤵
  PID:9456
- C:\Windows\System\RBOTZHE.exe
  C:\Windows\System\RBOTZHE.exe
  2⤵
  PID:9476
- C:\Windows\System\bMYBScb.exe
  C:\Windows\System\bMYBScb.exe
  2⤵
  PID:9504
- C:\Windows\System\OtnjcGg.exe
  C:\Windows\System\OtnjcGg.exe
  2⤵
  PID:9528
- C:\Windows\System\UNZitam.exe
  C:\Windows\System\UNZitam.exe
  2⤵
  PID:9552
- C:\Windows\System\DHgclmW.exe
  C:\Windows\System\DHgclmW.exe
  2⤵
  PID:9576
- C:\Windows\System\YgyyqJB.exe
  C:\Windows\System\YgyyqJB.exe
  2⤵
  PID:9600
- C:\Windows\System\ZTmFCRv.exe
  C:\Windows\System\ZTmFCRv.exe
  2⤵
  PID:9632
- C:\Windows\System\tNbyIxy.exe
  C:\Windows\System\tNbyIxy.exe
  2⤵
  PID:9652
- C:\Windows\System\wfuyRJc.exe
  C:\Windows\System\wfuyRJc.exe
  2⤵
  PID:9676
- C:\Windows\System\AGBwZfo.exe
  C:\Windows\System\AGBwZfo.exe
  2⤵
  PID:9704
- C:\Windows\System\aqVHaPI.exe
  C:\Windows\System\aqVHaPI.exe
  2⤵
  PID:9748
- C:\Windows\System\ypdiDHf.exe
  C:\Windows\System\ypdiDHf.exe
  2⤵
  PID:9768
- C:\Windows\System\GmjPFjX.exe
  C:\Windows\System\GmjPFjX.exe
  2⤵
  PID:9788
- C:\Windows\System\Zjohpwa.exe
  C:\Windows\System\Zjohpwa.exe
  2⤵
  PID:9820
- C:\Windows\System\EWaQzmu.exe
  C:\Windows\System\EWaQzmu.exe
  2⤵
  PID:9840
- C:\Windows\System\aHRkGnF.exe
  C:\Windows\System\aHRkGnF.exe
  2⤵
  PID:9864
- C:\Windows\System\pIiJPbG.exe
  C:\Windows\System\pIiJPbG.exe
  2⤵
  PID:9884
- C:\Windows\System\EtkOlJU.exe
  C:\Windows\System\EtkOlJU.exe
  2⤵
  PID:9912
- C:\Windows\System\SBiINFW.exe
  C:\Windows\System\SBiINFW.exe
  2⤵
  PID:9944
- C:\Windows\System\oWaJrol.exe
  C:\Windows\System\oWaJrol.exe
  2⤵
  PID:9972
- C:\Windows\System\IlbITEj.exe
  C:\Windows\System\IlbITEj.exe
  2⤵
  PID:9996
- C:\Windows\System\tketQhK.exe
  C:\Windows\System\tketQhK.exe
  2⤵
  PID:10028
- C:\Windows\System\PevckAi.exe
  C:\Windows\System\PevckAi.exe
  2⤵
  PID:10060
- C:\Windows\System\kduYqna.exe
  C:\Windows\System\kduYqna.exe
  2⤵
  PID:10088
- C:\Windows\System\RpHEYFh.exe
  C:\Windows\System\RpHEYFh.exe
  2⤵
  PID:10112
- C:\Windows\System\ccajeZz.exe
  C:\Windows\System\ccajeZz.exe
  2⤵
  PID:10132
- C:\Windows\System\rMXBVWZ.exe
  C:\Windows\System\rMXBVWZ.exe
  2⤵
  PID:10164
- C:\Windows\System\RuwwuNr.exe
  C:\Windows\System\RuwwuNr.exe
  2⤵
  PID:10196
- C:\Windows\System\fxOIwLE.exe
  C:\Windows\System\fxOIwLE.exe
  2⤵
  PID:10228
- C:\Windows\System\ucrUKlw.exe
  C:\Windows\System\ucrUKlw.exe
  2⤵
  PID:9088
- C:\Windows\System\sIMcZew.exe
  C:\Windows\System\sIMcZew.exe
  2⤵
  PID:9204
- C:\Windows\System\zAhwsvm.exe
  C:\Windows\System\zAhwsvm.exe
  2⤵
  PID:9308
- C:\Windows\System\TnUsMPY.exe
  C:\Windows\System\TnUsMPY.exe
  2⤵
  PID:9360
- C:\Windows\System\uzGOkNv.exe
  C:\Windows\System\uzGOkNv.exe
  2⤵
  PID:9448
- C:\Windows\System\LTWWzwQ.exe
  C:\Windows\System\LTWWzwQ.exe
  2⤵
  PID:9500
- C:\Windows\System\bJiZmoi.exe
  C:\Windows\System\bJiZmoi.exe
  2⤵
  PID:9524
- C:\Windows\System\UEVkDsc.exe
  C:\Windows\System\UEVkDsc.exe
  2⤵
  PID:9564
- C:\Windows\System\qOUJDkS.exe
  C:\Windows\System\qOUJDkS.exe
  2⤵
  PID:9616
- C:\Windows\System\NxZjvJF.exe
  C:\Windows\System\NxZjvJF.exe
  2⤵
  PID:9760
- C:\Windows\System\KoXEUuX.exe
  C:\Windows\System\KoXEUuX.exe
  2⤵
  PID:9800
- C:\Windows\System\toiIjVb.exe
  C:\Windows\System\toiIjVb.exe
  2⤵
  PID:9924
- C:\Windows\System\SdYlMkH.exe
  C:\Windows\System\SdYlMkH.exe
  2⤵
  PID:10072
- C:\Windows\System\sqLshUA.exe
  C:\Windows\System\sqLshUA.exe
  2⤵
  PID:10008
- C:\Windows\System\psNwHsM.exe
  C:\Windows\System\psNwHsM.exe
  2⤵
  PID:10160
- C:\Windows\System\FpvjHSW.exe
  C:\Windows\System\FpvjHSW.exe
  2⤵
  PID:10120
- C:\Windows\System\uesKIEa.exe
  C:\Windows\System\uesKIEa.exe
  2⤵
  PID:8088
- C:\Windows\System\WnYQsou.exe
  C:\Windows\System\WnYQsou.exe
  2⤵
  PID:9516
- C:\Windows\System\SDtONGf.exe
  C:\Windows\System\SDtONGf.exe
  2⤵
  PID:9536
- C:\Windows\System\UkSdiYp.exe
  C:\Windows\System\UkSdiYp.exe
  2⤵
  PID:9720
- C:\Windows\System\XdBbaGE.exe
  C:\Windows\System\XdBbaGE.exe
  2⤵
  PID:9832
- C:\Windows\System\CCMzxYz.exe
  C:\Windows\System\CCMzxYz.exe
  2⤵
  PID:9980
- C:\Windows\System\wfeQQer.exe
  C:\Windows\System\wfeQQer.exe
  2⤵
  PID:9332
- C:\Windows\System\VrDbNAt.exe
  C:\Windows\System\VrDbNAt.exe
  2⤵
  PID:9472
- C:\Windows\System\rtyIYhi.exe
  C:\Windows\System\rtyIYhi.exe
  2⤵
  PID:9784
- C:\Windows\System\krGodFx.exe
  C:\Windows\System\krGodFx.exe
  2⤵
  PID:9544
- C:\Windows\System\zLEewBc.exe
  C:\Windows\System\zLEewBc.exe
  2⤵
  PID:10260
- C:\Windows\System\KRNSNPf.exe
  C:\Windows\System\KRNSNPf.exe
  2⤵
  PID:10288
- C:\Windows\System\BTzqGAp.exe
  C:\Windows\System\BTzqGAp.exe
  2⤵
  PID:10320
- C:\Windows\System\OoyCgVv.exe
  C:\Windows\System\OoyCgVv.exe
  2⤵
  PID:10340
- C:\Windows\System\LfyLEyA.exe
  C:\Windows\System\LfyLEyA.exe
  2⤵
  PID:10372
- C:\Windows\System\QYTWbFR.exe
  C:\Windows\System\QYTWbFR.exe
  2⤵
  PID:10404
- C:\Windows\System\pwvMmWd.exe
  C:\Windows\System\pwvMmWd.exe
  2⤵
  PID:10440
- C:\Windows\System\TDJIZod.exe
  C:\Windows\System\TDJIZod.exe
  2⤵
  PID:10468
- C:\Windows\System\JqjswTN.exe
  C:\Windows\System\JqjswTN.exe
  2⤵
  PID:10496
- C:\Windows\System\KotmWiF.exe
  C:\Windows\System\KotmWiF.exe
  2⤵
  PID:10516
- C:\Windows\System\bMoeHxh.exe
  C:\Windows\System\bMoeHxh.exe
  2⤵
  PID:10540
- C:\Windows\System\pdwidCO.exe
  C:\Windows\System\pdwidCO.exe
  2⤵
  PID:10556
- C:\Windows\System\UEEYhvp.exe
  C:\Windows\System\UEEYhvp.exe
  2⤵
  PID:10572
- C:\Windows\System\MZbJvWO.exe
  C:\Windows\System\MZbJvWO.exe
  2⤵
  PID:10600
- C:\Windows\System\UARKbiZ.exe
  C:\Windows\System\UARKbiZ.exe
  2⤵
  PID:10632
- C:\Windows\System\wuRRhVS.exe
  C:\Windows\System\wuRRhVS.exe
  2⤵
  PID:10664
- C:\Windows\System\IKpOMey.exe
  C:\Windows\System\IKpOMey.exe
  2⤵
  PID:10716
- C:\Windows\System\assRLou.exe
  C:\Windows\System\assRLou.exe
  2⤵
  PID:10744
- C:\Windows\System\hnamizr.exe
  C:\Windows\System\hnamizr.exe
  2⤵
  PID:10776
- C:\Windows\System\cjIhlCx.exe
  C:\Windows\System\cjIhlCx.exe
  2⤵
  PID:10792
- C:\Windows\System\DHOYEeq.exe
  C:\Windows\System\DHOYEeq.exe
  2⤵
  PID:10824
- C:\Windows\System\aHCXegY.exe
  C:\Windows\System\aHCXegY.exe
  2⤵
  PID:10868
- C:\Windows\System\ybSHQEi.exe
  C:\Windows\System\ybSHQEi.exe
  2⤵
  PID:10896
- C:\Windows\System\ngjBdjA.exe
  C:\Windows\System\ngjBdjA.exe
  2⤵
  PID:10924
- C:\Windows\System\qwUOPWX.exe
  C:\Windows\System\qwUOPWX.exe
  2⤵
  PID:10952
- C:\Windows\System\iemvRSn.exe
  C:\Windows\System\iemvRSn.exe
  2⤵
  PID:10972
- C:\Windows\System\JCUGOwb.exe
  C:\Windows\System\JCUGOwb.exe
  2⤵
  PID:10996
- C:\Windows\System\PNbclNm.exe
  C:\Windows\System\PNbclNm.exe
  2⤵
  PID:11024
- C:\Windows\System\YOqNxOR.exe
  C:\Windows\System\YOqNxOR.exe
  2⤵
  PID:11048
- C:\Windows\System\LCipSTZ.exe
  C:\Windows\System\LCipSTZ.exe
  2⤵
  PID:11076
- C:\Windows\System\IKHdKpl.exe
  C:\Windows\System\IKHdKpl.exe
  2⤵
  PID:11104
- C:\Windows\System\YBfaQUA.exe
  C:\Windows\System\YBfaQUA.exe
  2⤵
  PID:11128
- C:\Windows\System\dmPxusF.exe
  C:\Windows\System\dmPxusF.exe
  2⤵
  PID:11160
- C:\Windows\System\NGeNCyC.exe
  C:\Windows\System\NGeNCyC.exe
  2⤵
  PID:11192
- C:\Windows\System\UVVLQyr.exe
  C:\Windows\System\UVVLQyr.exe
  2⤵
  PID:11212
- C:\Windows\System\jimqsSt.exe
  C:\Windows\System\jimqsSt.exe
  2⤵
  PID:11236
- C:\Windows\System\TCEZTyc.exe
  C:\Windows\System\TCEZTyc.exe
  2⤵
  PID:11260
- C:\Windows\System\MjtTkDm.exe
  C:\Windows\System\MjtTkDm.exe
  2⤵
  PID:10152
- C:\Windows\System\dlOBGXj.exe
  C:\Windows\System\dlOBGXj.exe
  2⤵
  PID:10296
- C:\Windows\System\jLanNIn.exe
  C:\Windows\System\jLanNIn.exe
  2⤵
  PID:10316
- C:\Windows\System\SRQcmgg.exe
  C:\Windows\System\SRQcmgg.exe
  2⤵
  PID:10432
- C:\Windows\System\tQgXieT.exe
  C:\Windows\System\tQgXieT.exe
  2⤵
  PID:10528
- C:\Windows\System\SMCaOwt.exe
  C:\Windows\System\SMCaOwt.exe
  2⤵
  PID:10548
- C:\Windows\System\gJRFqTU.exe
  C:\Windows\System\gJRFqTU.exe
  2⤵
  PID:10652
- C:\Windows\System\MXCJpWQ.exe
  C:\Windows\System\MXCJpWQ.exe
  2⤵
  PID:10708
- C:\Windows\System\HeyXMZb.exe
  C:\Windows\System\HeyXMZb.exe
  2⤵
  PID:10608
- C:\Windows\System\fdoypwg.exe
  C:\Windows\System\fdoypwg.exe
  2⤵
  PID:10844
- C:\Windows\System\cqlbGvm.exe
  C:\Windows\System\cqlbGvm.exe
  2⤵
  PID:10980
- C:\Windows\System\pHOEaKG.exe
  C:\Windows\System\pHOEaKG.exe
  2⤵
  PID:11036
- C:\Windows\System\OVwVwih.exe
  C:\Windows\System\OVwVwih.exe
  2⤵
  PID:10944
- C:\Windows\System\AmrtjAZ.exe
  C:\Windows\System\AmrtjAZ.exe
  2⤵
  PID:11040
- C:\Windows\System\ZfxtYEM.exe
  C:\Windows\System\ZfxtYEM.exe
  2⤵
  PID:11220
- C:\Windows\System\ijqOkxF.exe
  C:\Windows\System\ijqOkxF.exe
  2⤵
  PID:10308
- C:\Windows\System\VnOLYSk.exe
  C:\Windows\System\VnOLYSk.exe
  2⤵
  PID:10416
- C:\Windows\System\NLWUXVT.exe
  C:\Windows\System\NLWUXVT.exe
  2⤵
  PID:9780
- C:\Windows\System\WBCrkJf.exe
  C:\Windows\System\WBCrkJf.exe
  2⤵
  PID:10648
- C:\Windows\System\xgKrdmB.exe
  C:\Windows\System\xgKrdmB.exe
  2⤵
  PID:10948
- C:\Windows\System\RoDriyw.exe
  C:\Windows\System\RoDriyw.exe
  2⤵
  PID:10820
- C:\Windows\System\IcojTrT.exe
  C:\Windows\System\IcojTrT.exe
  2⤵
  PID:11012
- C:\Windows\System\bMSwLfJ.exe
  C:\Windows\System\bMSwLfJ.exe
  2⤵
  PID:11200
- C:\Windows\System\pWRuBBS.exe
  C:\Windows\System\pWRuBBS.exe
  2⤵
  PID:10336
- C:\Windows\System\OSgZqoa.exe
  C:\Windows\System\OSgZqoa.exe
  2⤵
  PID:10456
- C:\Windows\System\YVMkgwk.exe
  C:\Windows\System\YVMkgwk.exe
  2⤵
  PID:10804
- C:\Windows\System\IDbixzR.exe
  C:\Windows\System\IDbixzR.exe
  2⤵
  PID:11268
- C:\Windows\System\MOHoRGR.exe
  C:\Windows\System\MOHoRGR.exe
  2⤵
  PID:11296
- C:\Windows\System\pHPpyhI.exe
  C:\Windows\System\pHPpyhI.exe
  2⤵
  PID:11332
- C:\Windows\System\qrwUkho.exe
  C:\Windows\System\qrwUkho.exe
  2⤵
  PID:11352
- C:\Windows\System\wCQBbSL.exe
  C:\Windows\System\wCQBbSL.exe
  2⤵
  PID:11372
- C:\Windows\System\NYXARdK.exe
  C:\Windows\System\NYXARdK.exe
  2⤵
  PID:11388
- C:\Windows\System\dTpdLqQ.exe
  C:\Windows\System\dTpdLqQ.exe
  2⤵
  PID:11416
- C:\Windows\System\iedUihs.exe
  C:\Windows\System\iedUihs.exe
  2⤵
  PID:11436
- C:\Windows\System\rymtUPa.exe
  C:\Windows\System\rymtUPa.exe
  2⤵
  PID:11456
- C:\Windows\System\mrBkVRK.exe
  C:\Windows\System\mrBkVRK.exe
  2⤵
  PID:11488
- C:\Windows\System\UAaKaNS.exe
  C:\Windows\System\UAaKaNS.exe
  2⤵
  PID:11524
- C:\Windows\System\bGomWuw.exe
  C:\Windows\System\bGomWuw.exe
  2⤵
  PID:11548
- C:\Windows\System\ORwuBkw.exe
  C:\Windows\System\ORwuBkw.exe
  2⤵
  PID:11572
- C:\Windows\System\WaeymVf.exe
  C:\Windows\System\WaeymVf.exe
  2⤵
  PID:11600
- C:\Windows\System\ZGDWeTj.exe
  C:\Windows\System\ZGDWeTj.exe
  2⤵
  PID:11628
- C:\Windows\System\iNqvGOB.exe
  C:\Windows\System\iNqvGOB.exe
  2⤵
  PID:11660
- C:\Windows\System\tUIiYIY.exe
  C:\Windows\System\tUIiYIY.exe
  2⤵
  PID:11692
- C:\Windows\System\UPxDLif.exe
  C:\Windows\System\UPxDLif.exe
  2⤵
  PID:11716
- C:\Windows\System\VNtBjKw.exe
  C:\Windows\System\VNtBjKw.exe
  2⤵
  PID:11748
- C:\Windows\System\kWjEHoY.exe
  C:\Windows\System\kWjEHoY.exe
  2⤵
  PID:11776
- C:\Windows\System\ToVxmLe.exe
  C:\Windows\System\ToVxmLe.exe
  2⤵
  PID:11800
- C:\Windows\System\MEvCOFM.exe
  C:\Windows\System\MEvCOFM.exe
  2⤵
  PID:11840
- C:\Windows\System\mtKLLWP.exe
  C:\Windows\System\mtKLLWP.exe
  2⤵
  PID:11864
- C:\Windows\System\bdbcrOv.exe
  C:\Windows\System\bdbcrOv.exe
  2⤵
  PID:11888
- C:\Windows\System\sizykAw.exe
  C:\Windows\System\sizykAw.exe
  2⤵
  PID:11916
- C:\Windows\System\IVIKPDO.exe
  C:\Windows\System\IVIKPDO.exe
  2⤵
  PID:11952
- C:\Windows\System\nwNWnHQ.exe
  C:\Windows\System\nwNWnHQ.exe
  2⤵
  PID:11988
- C:\Windows\System\auvxQww.exe
  C:\Windows\System\auvxQww.exe
  2⤵
  PID:12016
- C:\Windows\System\lZauRsS.exe
  C:\Windows\System\lZauRsS.exe
  2⤵
  PID:12040
- C:\Windows\System\WATJMlT.exe
  C:\Windows\System\WATJMlT.exe
  2⤵
  PID:12064
- C:\Windows\System\SBVtZfV.exe
  C:\Windows\System\SBVtZfV.exe
  2⤵
  PID:12096
- C:\Windows\System\pZKRvYR.exe
  C:\Windows\System\pZKRvYR.exe
  2⤵
  PID:12112
- C:\Windows\System\waInxfV.exe
  C:\Windows\System\waInxfV.exe
  2⤵
  PID:12140
- C:\Windows\System\enLAlxX.exe
  C:\Windows\System\enLAlxX.exe
  2⤵
  PID:12160
- C:\Windows\System\vVkjPVk.exe
  C:\Windows\System\vVkjPVk.exe
  2⤵
  PID:12192
- C:\Windows\System\HFQHccQ.exe
  C:\Windows\System\HFQHccQ.exe
  2⤵
  PID:12220
- C:\Windows\System\dAYEzdN.exe
  C:\Windows\System\dAYEzdN.exe
  2⤵
  PID:12244
- C:\Windows\System\sRtuIrn.exe
  C:\Windows\System\sRtuIrn.exe
  2⤵
  PID:12276
- C:\Windows\System\lMkdwDr.exe
  C:\Windows\System\lMkdwDr.exe
  2⤵
  PID:10480
- C:\Windows\System\APLwRTG.exe
  C:\Windows\System\APLwRTG.exe
  2⤵
  PID:11364
- C:\Windows\System\sVplufj.exe
  C:\Windows\System\sVplufj.exe
  2⤵
  PID:11348
- C:\Windows\System\VQhGCIl.exe
  C:\Windows\System\VQhGCIl.exe
  2⤵
  PID:11508
- C:\Windows\System\MnGkMsH.exe
  C:\Windows\System\MnGkMsH.exe
  2⤵
  PID:11484
- C:\Windows\System\tbPWmMl.exe
  C:\Windows\System\tbPWmMl.exe
  2⤵
  PID:11536
- C:\Windows\System\xglWDZY.exe
  C:\Windows\System\xglWDZY.exe
  2⤵
  PID:11616
- C:\Windows\System\MADddQl.exe
  C:\Windows\System\MADddQl.exe
  2⤵
  PID:11648
- C:\Windows\System\RhIBySf.exe
  C:\Windows\System\RhIBySf.exe
  2⤵
  PID:11768
- C:\Windows\System\RcrAdnK.exe
  C:\Windows\System\RcrAdnK.exe
  2⤵
  PID:11760
- C:\Windows\System\ZFcEeBg.exe
  C:\Windows\System\ZFcEeBg.exe
  2⤵
  PID:11940
- C:\Windows\System\iibDvNN.exe
  C:\Windows\System\iibDvNN.exe
  2⤵
  PID:11928
- C:\Windows\System\sDgMPZw.exe
  C:\Windows\System\sDgMPZw.exe
  2⤵
  PID:12000
- C:\Windows\System\JYqBLtV.exe
  C:\Windows\System\JYqBLtV.exe
  2⤵
  PID:12092
- C:\Windows\System\WpdLNLx.exe
  C:\Windows\System\WpdLNLx.exe
  2⤵
  PID:12120
- C:\Windows\System\uFbwTvf.exe
  C:\Windows\System\uFbwTvf.exe
  2⤵
  PID:12152
- C:\Windows\System\BbOCiiE.exe
  C:\Windows\System\BbOCiiE.exe
  2⤵
  PID:10932
- C:\Windows\System\VMxbtlv.exe
  C:\Windows\System\VMxbtlv.exe
  2⤵
  PID:11380
- C:\Windows\System\petxOru.exe
  C:\Windows\System\petxOru.exe
  2⤵
  PID:11612
- C:\Windows\System\xJSiFxo.exe
  C:\Windows\System\xJSiFxo.exe
  2⤵
  PID:11684
- C:\Windows\System\vELYBCL.exe
  C:\Windows\System\vELYBCL.exe
  2⤵
  PID:11680
- C:\Windows\System\QBEyCVR.exe
  C:\Windows\System\QBEyCVR.exe
  2⤵
  PID:11884
- C:\Windows\System\abmukSX.exe
  C:\Windows\System\abmukSX.exe
  2⤵
  PID:12088
- C:\Windows\System\EYnYLwn.exe
  C:\Windows\System\EYnYLwn.exe
  2⤵
  PID:11412
- C:\Windows\System\aBiAoFZ.exe
  C:\Windows\System\aBiAoFZ.exe
  2⤵
  PID:11740
- C:\Windows\System\ZWAVOCW.exe
  C:\Windows\System\ZWAVOCW.exe
  2⤵
  PID:11832
- C:\Windows\System\gCvnbBn.exe
  C:\Windows\System\gCvnbBn.exe
  2⤵
  PID:12316
- C:\Windows\System\mtffipx.exe
  C:\Windows\System\mtffipx.exe
  2⤵
  PID:12340
- C:\Windows\System\lSgnbCi.exe
  C:\Windows\System\lSgnbCi.exe
  2⤵
  PID:12368
- C:\Windows\System\HbxSqDZ.exe
  C:\Windows\System\HbxSqDZ.exe
  2⤵
  PID:12392
- C:\Windows\System\UYxmxbr.exe
  C:\Windows\System\UYxmxbr.exe
  2⤵
  PID:12416
- C:\Windows\System\RwPgjpm.exe
  C:\Windows\System\RwPgjpm.exe
  2⤵
  PID:12452
- C:\Windows\System\RVELQRi.exe
  C:\Windows\System\RVELQRi.exe
  2⤵
  PID:12480
- C:\Windows\System\QBxKYiv.exe
  C:\Windows\System\QBxKYiv.exe
  2⤵
  PID:12500
- C:\Windows\System\ujnJUGu.exe
  C:\Windows\System\ujnJUGu.exe
  2⤵
  PID:12524
- C:\Windows\System\UqmZlRM.exe
  C:\Windows\System\UqmZlRM.exe
  2⤵
  PID:12548
- C:\Windows\System\kINUliU.exe
  C:\Windows\System\kINUliU.exe
  2⤵
  PID:12572
- C:\Windows\System\WDtOywh.exe
  C:\Windows\System\WDtOywh.exe
  2⤵
  PID:12600
- C:\Windows\System\UmpEQpa.exe
  C:\Windows\System\UmpEQpa.exe
  2⤵
  PID:12628
- C:\Windows\System\oWpMccK.exe
  C:\Windows\System\oWpMccK.exe
  2⤵
  PID:12656
- C:\Windows\System\RJuWLRb.exe
  C:\Windows\System\RJuWLRb.exe
  2⤵
  PID:12676
- C:\Windows\System\BSCuYoR.exe
  C:\Windows\System\BSCuYoR.exe
  2⤵
  PID:12716
- C:\Windows\System\GEYdtFH.exe
  C:\Windows\System\GEYdtFH.exe
  2⤵
  PID:12756
- C:\Windows\System\ZFrquss.exe
  C:\Windows\System\ZFrquss.exe
  2⤵
  PID:12784
- C:\Windows\System\lnkXefP.exe
  C:\Windows\System\lnkXefP.exe
  2⤵
  PID:12808
- C:\Windows\System\mMQFeFQ.exe
  C:\Windows\System\mMQFeFQ.exe
  2⤵
  PID:12828
- C:\Windows\System\nqAeHLu.exe
  C:\Windows\System\nqAeHLu.exe
  2⤵
  PID:12860
- C:\Windows\System\XfFrxpX.exe
  C:\Windows\System\XfFrxpX.exe
  2⤵
  PID:12880
- C:\Windows\System\ljuuORA.exe
  C:\Windows\System\ljuuORA.exe
  2⤵
  PID:12912
- C:\Windows\System\aqBCYTH.exe
  C:\Windows\System\aqBCYTH.exe
  2⤵
  PID:12928
- C:\Windows\System\FxYKEue.exe
  C:\Windows\System\FxYKEue.exe
  2⤵
  PID:12956
- C:\Windows\System\DyLPKgI.exe
  C:\Windows\System\DyLPKgI.exe
  2⤵
  PID:12972
- C:\Windows\System\GuBXYPZ.exe
  C:\Windows\System\GuBXYPZ.exe
  2⤵
  PID:13008
- C:\Windows\System\BtDorsX.exe
  C:\Windows\System\BtDorsX.exe
  2⤵
  PID:13028
- C:\Windows\System\kqTZspG.exe
  C:\Windows\System\kqTZspG.exe
  2⤵
  PID:13056
- C:\Windows\System\sVbNBBn.exe
  C:\Windows\System\sVbNBBn.exe
  2⤵
  PID:13080
- C:\Windows\System\sCxtyIv.exe
  C:\Windows\System\sCxtyIv.exe
  2⤵
  PID:13108
- C:\Windows\System\jRbEXld.exe
  C:\Windows\System\jRbEXld.exe
  2⤵
  PID:13136
- C:\Windows\System\oKEcHgp.exe
  C:\Windows\System\oKEcHgp.exe
  2⤵
  PID:13168
- C:\Windows\System\RJINMbG.exe
  C:\Windows\System\RJINMbG.exe
  2⤵
  PID:13204
- C:\Windows\System\VAvkbEt.exe
  C:\Windows\System\VAvkbEt.exe
  2⤵
  PID:13252
- C:\Windows\System\RYEWFzA.exe
  C:\Windows\System\RYEWFzA.exe
  2⤵
  PID:13272
- C:\Windows\System\XDYTpnh.exe
  C:\Windows\System\XDYTpnh.exe
  2⤵
  PID:13292
- C:\Windows\System\YuJLqGw.exe
  C:\Windows\System\YuJLqGw.exe
  2⤵
  PID:10788
- C:\Windows\System\pDyLyrl.exe
  C:\Windows\System\pDyLyrl.exe
  2⤵
  PID:12204
- C:\Windows\System\ZWSZHiK.exe
  C:\Windows\System\ZWSZHiK.exe
  2⤵
  PID:11996
- C:\Windows\System\xeYkRSG.exe
  C:\Windows\System\xeYkRSG.exe
  2⤵
  PID:12300
- C:\Windows\System\amAWaOn.exe
  C:\Windows\System\amAWaOn.exe
  2⤵
  PID:12376
- C:\Windows\System\wtaPRIu.exe
  C:\Windows\System\wtaPRIu.exe
  2⤵
  PID:12496
- C:\Windows\System\YuHSGgU.exe
  C:\Windows\System\YuHSGgU.exe
  2⤵
  PID:12516
- C:\Windows\System\PjUNwRo.exe
  C:\Windows\System\PjUNwRo.exe
  2⤵
  PID:12640
- C:\Windows\System\HkksRHL.exe
  C:\Windows\System\HkksRHL.exe
  2⤵
  PID:12708
- C:\Windows\System\jUlLJwy.exe
  C:\Windows\System\jUlLJwy.exe
  2⤵
  PID:12696
- C:\Windows\System\QULEBZE.exe
  C:\Windows\System\QULEBZE.exe
  2⤵
  PID:12772
- C:\Windows\System\NnYfgXl.exe
  C:\Windows\System\NnYfgXl.exe
  2⤵
  PID:12804
- C:\Windows\System\sGmbfDw.exe
  C:\Windows\System\sGmbfDw.exe
  2⤵
  PID:13000
- C:\Windows\System\eFytafq.exe
  C:\Windows\System\eFytafq.exe
  2⤵
  PID:13044
- C:\Windows\System\JSlxAXY.exe
  C:\Windows\System\JSlxAXY.exe
  2⤵
  PID:13144
- C:\Windows\System\tjDDlYi.exe
  C:\Windows\System\tjDDlYi.exe
  2⤵
  PID:13104
- C:\Windows\System\EqItitY.exe
  C:\Windows\System\EqItitY.exe
  2⤵
  PID:13152
- C:\Windows\System\PaaBSHm.exe
  C:\Windows\System\PaaBSHm.exe
  2⤵
  PID:13264
- C:\Windows\System\uyrYWsf.exe
  C:\Windows\System\uyrYWsf.exe
  2⤵
  PID:12432
- C:\Windows\System\cpojIyz.exe
  C:\Windows\System\cpojIyz.exe
  2⤵
  PID:12364
- C:\Windows\System\WvDCbnq.exe
  C:\Windows\System\WvDCbnq.exe
  2⤵
  PID:12336
- C:\Windows\System\ftsKMlb.exe
  C:\Windows\System\ftsKMlb.exe
  2⤵
  PID:12840
- C:\Windows\System\HJYoaAZ.exe
  C:\Windows\System\HJYoaAZ.exe
  2⤵
  PID:12672
- C:\Windows\System\lHMSpax.exe
  C:\Windows\System\lHMSpax.exe
  2⤵
  PID:13096
- C:\Windows\System\sUKpGMG.exe
  C:\Windows\System\sUKpGMG.exe
  2⤵
  PID:12968
- C:\Windows\System\GqjxTKm.exe
  C:\Windows\System\GqjxTKm.exe
  2⤵
  PID:13184
- C:\Windows\System\AsWtEqk.exe
  C:\Windows\System\AsWtEqk.exe
  2⤵
  PID:12744
- C:\Windows\System\jnYjGEr.exe
  C:\Windows\System\jnYjGEr.exe
  2⤵
  PID:13332
- C:\Windows\System\RqOZuDe.exe
  C:\Windows\System\RqOZuDe.exe
  2⤵
  PID:13360
- C:\Windows\System\aNemiaL.exe
  C:\Windows\System\aNemiaL.exe
  2⤵
  PID:13392
- C:\Windows\System\ztfzmKM.exe
  C:\Windows\System\ztfzmKM.exe
  2⤵
  PID:13420
- C:\Windows\System\NgYAKuP.exe
  C:\Windows\System\NgYAKuP.exe
  2⤵
  PID:13456
- C:\Windows\System\FODViZY.exe
  C:\Windows\System\FODViZY.exe
  2⤵
  PID:13484
- C:\Windows\System\slfFjYZ.exe
  C:\Windows\System\slfFjYZ.exe
  2⤵
  PID:13504
- C:\Windows\System\oQLhiqT.exe
  C:\Windows\System\oQLhiqT.exe
  2⤵
  PID:13532
- C:\Windows\System\UbYhRxQ.exe
  C:\Windows\System\UbYhRxQ.exe
  2⤵
  PID:13560
- C:\Windows\System\AZwrlNe.exe
  C:\Windows\System\AZwrlNe.exe
  2⤵
  PID:13588
- C:\Windows\System\AimDDmF.exe
  C:\Windows\System\AimDDmF.exe
  2⤵
  PID:13616
- C:\Windows\System\QnuuXPt.exe
  C:\Windows\System\QnuuXPt.exe
  2⤵
  PID:13648
- C:\Windows\System\LotDrYs.exe
  C:\Windows\System\LotDrYs.exe
  2⤵
  PID:13672
- C:\Windows\System\VpLqsjQ.exe
  C:\Windows\System\VpLqsjQ.exe
  2⤵
  PID:13700
- C:\Windows\System\YaWhgvk.exe
  C:\Windows\System\YaWhgvk.exe
  2⤵
  PID:13728
- C:\Windows\System\EQLHGNt.exe
  C:\Windows\System\EQLHGNt.exe
  2⤵
  PID:13756
- C:\Windows\System\irnpHlZ.exe
  C:\Windows\System\irnpHlZ.exe
  2⤵
  PID:13784
- C:\Windows\System\bvrrHxk.exe
  C:\Windows\System\bvrrHxk.exe
  2⤵
  PID:13804
- C:\Windows\System\rJpywKm.exe
  C:\Windows\System\rJpywKm.exe
  2⤵
  PID:13844
- C:\Windows\System\cpVnSri.exe
  C:\Windows\System\cpVnSri.exe
  2⤵
  PID:13872
- C:\Windows\System\hQNRHez.exe
  C:\Windows\System\hQNRHez.exe
  2⤵
  PID:13908
- C:\Windows\System\GVmkiuN.exe
  C:\Windows\System\GVmkiuN.exe
  2⤵
  PID:13932
- C:\Windows\System\fDulKEH.exe
  C:\Windows\System\fDulKEH.exe
  2⤵
  PID:13956
- C:\Windows\System\ukmVFLL.exe
  C:\Windows\System\ukmVFLL.exe
  2⤵
  PID:13996
- C:\Windows\System\NcNBmNz.exe
  C:\Windows\System\NcNBmNz.exe
  2⤵
  PID:14020
- C:\Windows\System\SoMCcPT.exe
  C:\Windows\System\SoMCcPT.exe
  2⤵
  PID:14052
- C:\Windows\System\aacisVn.exe
  C:\Windows\System\aacisVn.exe
  2⤵
  PID:14080
- C:\Windows\System\cqWSrRY.exe
  C:\Windows\System\cqWSrRY.exe
  2⤵
  PID:14112
- C:\Windows\System\swaaOBa.exe
  C:\Windows\System\swaaOBa.exe
  2⤵
  PID:14144
- C:\Windows\System\cdcIzOe.exe
  C:\Windows\System\cdcIzOe.exe
  2⤵
  PID:14172
- C:\Windows\System\kDIJXiT.exe
  C:\Windows\System\kDIJXiT.exe
  2⤵
  PID:14204
- C:\Windows\System\KJaQCZW.exe
  C:\Windows\System\KJaQCZW.exe
  2⤵
  PID:14224
- C:\Windows\System\HoptSJW.exe
  C:\Windows\System\HoptSJW.exe
  2⤵
  PID:14240
- C:\Windows\System\YnYrhFl.exe
  C:\Windows\System\YnYrhFl.exe
  2⤵
  PID:14264
- C:\Windows\System\xjVZyJP.exe
  C:\Windows\System\xjVZyJP.exe
  2⤵
  PID:14288
- C:\Windows\System\HJbmfWX.exe
  C:\Windows\System\HJbmfWX.exe
  2⤵
  PID:14320
- C:\Windows\System\nfFQxbV.exe
  C:\Windows\System\nfFQxbV.exe
  2⤵
  PID:12856
- C:\Windows\System\ntWjWcr.exe
  C:\Windows\System\ntWjWcr.exe
  2⤵
  PID:13268
- C:\Windows\System\QJNBpRi.exe
  C:\Windows\System\QJNBpRi.exe
  2⤵
  PID:12984
- C:\Windows\System\LeHrJDJ.exe
  C:\Windows\System\LeHrJDJ.exe
  2⤵
  PID:13344
- C:\Windows\System\VJTtoyH.exe
  C:\Windows\System\VJTtoyH.exe
  2⤵
  PID:13452
- C:\Windows\System\sCpMNaY.exe
  C:\Windows\System\sCpMNaY.exe
  2⤵
  PID:13520
- C:\Windows\System\RJEnljJ.exe
  C:\Windows\System\RJEnljJ.exe
  2⤵
  PID:13548
- C:\Windows\System\JKUtghp.exe
  C:\Windows\System\JKUtghp.exe
  2⤵
  PID:13576
- C:\Windows\System\DbsxsIg.exe
  C:\Windows\System\DbsxsIg.exe
  2⤵
  PID:13540
- C:\Windows\System\yacEbHs.exe
  C:\Windows\System\yacEbHs.exe
  2⤵
  PID:13656
- C:\Windows\System\vlPppjS.exe
  C:\Windows\System\vlPppjS.exe
  2⤵
  PID:13688
- C:\Windows\System\JcumwyS.exe
  C:\Windows\System\JcumwyS.exe
  2⤵
  PID:13768
- C:\Windows\System\cPnLWTw.exe
  C:\Windows\System\cPnLWTw.exe
  2⤵
  PID:13964
- C:\Windows\System\vTrUCze.exe
  C:\Windows\System\vTrUCze.exe
  2⤵
  PID:13992
- C:\Windows\System\GsKjAYp.exe
  C:\Windows\System\GsKjAYp.exe
  2⤵
  PID:13864
- C:\Windows\System\guBcrFJ.exe
  C:\Windows\System\guBcrFJ.exe
  2⤵
  PID:14104
- C:\Windows\System\BqDxxsT.exe
  C:\Windows\System\BqDxxsT.exe
  2⤵
  PID:14124
- C:\Windows\System\fhimPsj.exe
  C:\Windows\System\fhimPsj.exe
  2⤵
  PID:14196
- C:\Windows\System\tbZoqgW.exe
  C:\Windows\System\tbZoqgW.exe
  2⤵
  PID:14152
- C:\Windows\System\gtueyxk.exe
  C:\Windows\System\gtueyxk.exe
  2⤵
  PID:14284
- C:\Windows\System\lfDtMZe.exe
  C:\Windows\System\lfDtMZe.exe
  2⤵
  PID:11812
- C:\Windows\System\AWLsFDV.exe
  C:\Windows\System\AWLsFDV.exe
  2⤵
  PID:13496
- C:\Windows\System\zjgZNna.exe
  C:\Windows\System\zjgZNna.exe
  2⤵
  PID:13628
- C:\Windows\System\pcXqiPM.exe
  C:\Windows\System\pcXqiPM.exe
  2⤵
  PID:13952
- C:\Windows\System\ODgstWn.exe
  C:\Windows\System\ODgstWn.exe
  2⤵
  PID:13636
- C:\Windows\System\WDFuCtj.exe
  C:\Windows\System\WDFuCtj.exe
  2⤵
  PID:14212
- C:\Windows\System\YBlbvsZ.exe
  C:\Windows\System\YBlbvsZ.exe
  2⤵
  PID:14108
- C:\Windows\System\nfWWhtW.exe
  C:\Windows\System\nfWWhtW.exe
  2⤵
  PID:14352
- C:\Windows\System\CHwMFLt.exe
  C:\Windows\System\CHwMFLt.exe
  2⤵
  PID:14380
- C:\Windows\System\tuXXZsX.exe
  C:\Windows\System\tuXXZsX.exe
  2⤵
  PID:14412
- C:\Windows\System\UxrmRwF.exe
  C:\Windows\System\UxrmRwF.exe
  2⤵
  PID:14432
- C:\Windows\System\iJAweep.exe
  C:\Windows\System\iJAweep.exe
  2⤵
  PID:14456
- C:\Windows\System\QgcUqvv.exe
  C:\Windows\System\QgcUqvv.exe
  2⤵
  PID:14488
- C:\Windows\System\krAcmqV.exe
  C:\Windows\System\krAcmqV.exe
  2⤵
  PID:14516
- C:\Windows\System\nZuXivv.exe
  C:\Windows\System\nZuXivv.exe
  2⤵
  PID:14532
- C:\Windows\System\QIHqrBm.exe
  C:\Windows\System\QIHqrBm.exe
  2⤵
  PID:14556
- C:\Windows\System\OtdoPJn.exe
  C:\Windows\System\OtdoPJn.exe
  2⤵
  PID:14596
- C:\Windows\System\kxgcjOz.exe
  C:\Windows\System\kxgcjOz.exe
  2⤵
  PID:14616
- C:\Windows\System\eHZktob.exe
  C:\Windows\System\eHZktob.exe
  2⤵
  PID:14636
- C:\Windows\System\ppCVZGD.exe
  C:\Windows\System\ppCVZGD.exe
  2⤵
  PID:14664
- C:\Windows\System\zmLogCm.exe
  C:\Windows\System\zmLogCm.exe
  2⤵
  PID:14688
- C:\Windows\System\ZDeWEDE.exe
  C:\Windows\System\ZDeWEDE.exe
  2⤵
  PID:14716
- C:\Windows\System\SWNpCOA.exe
  C:\Windows\System\SWNpCOA.exe
  2⤵
  PID:14744
- C:\Windows\System\JvbReNJ.exe
  C:\Windows\System\JvbReNJ.exe
  2⤵
  PID:14780
- C:\Windows\System\NRXYOHV.exe
  C:\Windows\System\NRXYOHV.exe
  2⤵
  PID:14812
- C:\Windows\System\LyWNchW.exe
  C:\Windows\System\LyWNchW.exe
  2⤵
  PID:14844
- C:\Windows\System\VYcbqIo.exe
  C:\Windows\System\VYcbqIo.exe
  2⤵
  PID:14892
- C:\Windows\System\JEXTXaN.exe
  C:\Windows\System\JEXTXaN.exe
  2⤵
  PID:14912
- C:\Windows\System\XvNSOXc.exe
  C:\Windows\System\XvNSOXc.exe
  2⤵
  PID:14928
- C:\Windows\System\zuoZXHl.exe
  C:\Windows\System\zuoZXHl.exe
  2⤵
  PID:14956
- C:\Windows\System\pulbSYU.exe
  C:\Windows\System\pulbSYU.exe
  2⤵
  PID:14980
- C:\Windows\System\zLUjldE.exe
  C:\Windows\System\zLUjldE.exe
  2⤵
  PID:15012
- C:\Windows\System\sxCZAsd.exe
  C:\Windows\System\sxCZAsd.exe
  2⤵
  PID:15036
- C:\Windows\System\bDjPSUO.exe
  C:\Windows\System\bDjPSUO.exe
  2⤵
  PID:15052
- C:\Windows\System\iWEfHeE.exe
  C:\Windows\System\iWEfHeE.exe
  2⤵
  PID:15080
- C:\Windows\System\WyCQkqD.exe
  C:\Windows\System\WyCQkqD.exe
  2⤵
  PID:15108
- C:\Windows\System\yrvAoMD.exe
  C:\Windows\System\yrvAoMD.exe
  2⤵
  PID:15136
- C:\Windows\System\gvVvCLa.exe
  C:\Windows\System\gvVvCLa.exe
  2⤵
  PID:15164
- C:\Windows\System\cGQMKIJ.exe
  C:\Windows\System\cGQMKIJ.exe
  2⤵
  PID:15188
- C:\Windows\System\rmnGUfW.exe
  C:\Windows\System\rmnGUfW.exe
  2⤵
  PID:14076
- C:\Windows\System\UuitGrp.exe
  C:\Windows\System\UuitGrp.exe
  2⤵
  PID:14316
- C:\Windows\System\ZfGuRtU.exe
  C:\Windows\System\ZfGuRtU.exe
  2⤵
  PID:13404
- C:\Windows\System\dIkFcQJ.exe
  C:\Windows\System\dIkFcQJ.exe
  2⤵
  PID:13856
- C:\Windows\System\XtTofOr.exe
  C:\Windows\System\XtTofOr.exe
  2⤵
  PID:14504
- C:\Windows\System\QzVDhaN.exe
  C:\Windows\System\QzVDhaN.exe
  2⤵
  PID:14424
- C:\Windows\System\KgWKPUJ.exe
  C:\Windows\System\KgWKPUJ.exe
  2⤵
  PID:14548
- C:\Windows\System\alMzKXx.exe
  C:\Windows\System\alMzKXx.exe
  2⤵
  PID:14468
- C:\Windows\System\PiyGljl.exe
  C:\Windows\System\PiyGljl.exe
  2⤵
  PID:14528
- C:\Windows\System\QbmOtLO.exe
  C:\Windows\System\QbmOtLO.exe
  2⤵
  PID:14732
- C:\Windows\System\smRznhS.exe
  C:\Windows\System\smRznhS.exe
  2⤵
  PID:14680
- C:\Windows\System\rRMpbZp.exe
  C:\Windows\System\rRMpbZp.exe
  2⤵
  PID:14828
- C:\Windows\System\eOBEGjj.exe
  C:\Windows\System\eOBEGjj.exe
  2⤵
  PID:14972
- C:\Windows\System\XYfzzRN.exe
  C:\Windows\System\XYfzzRN.exe
  2⤵
  PID:14840
- C:\Windows\System\LrteTjf.exe
  C:\Windows\System\LrteTjf.exe
  2⤵
  PID:14940
- C:\Windows\System\jsduSuB.exe
  C:\Windows\System\jsduSuB.exe
  2⤵
  PID:15028
- C:\Windows\System\ahTRXNB.exe
  C:\Windows\System\ahTRXNB.exe
  2⤵
  PID:15048
- C:\Windows\System\TOnOKfB.exe
  C:\Windows\System\TOnOKfB.exe
  2⤵
  PID:15120
- C:\Windows\System\bsHDcKG.exe
  C:\Windows\System\bsHDcKG.exe
  2⤵
  PID:15160
- C:\Windows\System\bjgfBnE.exe
  C:\Windows\System\bjgfBnE.exe
  2⤵
  PID:15256
- C:\Windows\System\iUkSawn.exe
  C:\Windows\System\iUkSawn.exe
  2⤵
  PID:14216
- C:\Windows\System\mNWoYSY.exe
  C:\Windows\System\mNWoYSY.exe
  2⤵
  PID:13684
- C:\Windows\System\oHcilrk.exe
  C:\Windows\System\oHcilrk.exe
  2⤵
  PID:14400
- C:\Windows\System\CASqXqN.exe
  C:\Windows\System\CASqXqN.exe
  2⤵
  PID:14372
- C:\Windows\System\kAcaRoQ.exe
  C:\Windows\System\kAcaRoQ.exe
  2⤵
  PID:14700
- C:\Windows\System\SjGGxsg.exe
  C:\Windows\System\SjGGxsg.exe
  2⤵
  PID:14704
- C:\Windows\System\cNJUOmI.exe
  C:\Windows\System\cNJUOmI.exe
  2⤵
  PID:14944
- C:\Windows\System\QNKrKza.exe
  C:\Windows\System\QNKrKza.exe
  2⤵
  PID:15064
- C:\Windows\System\TBHUEDo.exe
  C:\Windows\System\TBHUEDo.exe
  2⤵
  PID:15184
- C:\Windows\System\YHfPrAt.exe
  C:\Windows\System\YHfPrAt.exe
  2⤵
  PID:13388
- C:\Windows\System\nBkbkeP.exe
  C:\Windows\System\nBkbkeP.exe
  2⤵
  PID:13836
- C:\Windows\System\JULIEiX.exe
  C:\Windows\System\JULIEiX.exe
  2⤵
  PID:15380
- C:\Windows\System\sutcVrt.exe
  C:\Windows\System\sutcVrt.exe
  2⤵
  PID:15420
- C:\Windows\System\HpJEuvS.exe
  C:\Windows\System\HpJEuvS.exe
  2⤵
  PID:15440
- C:\Windows\System\zMqoDAQ.exe
  C:\Windows\System\zMqoDAQ.exe
  2⤵
  PID:15468
- C:\Windows\System\sWhtDtT.exe
  C:\Windows\System\sWhtDtT.exe
  2⤵
  PID:15484
- C:\Windows\System\AteNAWQ.exe
  C:\Windows\System\AteNAWQ.exe
  2⤵
  PID:15508
- C:\Windows\System\zwTaijT.exe
  C:\Windows\System\zwTaijT.exe
  2⤵
  PID:15524
- C:\Windows\System\KXVEvYz.exe
  C:\Windows\System\KXVEvYz.exe
  2⤵
  PID:15548
- C:\Windows\System\IaFgTLr.exe
  C:\Windows\System\IaFgTLr.exe
  2⤵
  PID:15576
- C:\Windows\System\qslQHaK.exe
  C:\Windows\System\qslQHaK.exe
  2⤵
  PID:15604
- C:\Windows\System\CaOvyWd.exe
  C:\Windows\System\CaOvyWd.exe
  2⤵
  PID:15628
- C:\Windows\System\GhvmNfZ.exe
  C:\Windows\System\GhvmNfZ.exe
  2⤵
  PID:15660
- C:\Windows\System\EmufJhQ.exe
  C:\Windows\System\EmufJhQ.exe
  2⤵
  PID:15684
- C:\Windows\System\FafAQWH.exe
  C:\Windows\System\FafAQWH.exe
  2⤵
  PID:15708
- C:\Windows\System\wNbbpPs.exe
  C:\Windows\System\wNbbpPs.exe
  2⤵
  PID:15740
- C:\Windows\System\wHRTiDq.exe
  C:\Windows\System\wHRTiDq.exe
  2⤵
  PID:15780
- C:\Windows\System\HZdQyma.exe
  C:\Windows\System\HZdQyma.exe
  2⤵
  PID:15804
- C:\Windows\System\vKBFGod.exe
  C:\Windows\System\vKBFGod.exe
  2⤵
  PID:15828
- C:\Windows\System\nZXDepr.exe
  C:\Windows\System\nZXDepr.exe
  2⤵
  PID:15860
- C:\Windows\System\byWFoLX.exe
  C:\Windows\System\byWFoLX.exe
  2⤵
  PID:15880
- C:\Windows\System\hIKKrNj.exe
  C:\Windows\System\hIKKrNj.exe
  2⤵
  PID:15904
- C:\Windows\System\xKdcVNH.exe
  C:\Windows\System\xKdcVNH.exe
  2⤵
  PID:15928
- C:\Windows\System\bDOYhXt.exe
  C:\Windows\System\bDOYhXt.exe
  2⤵
  PID:15956
- C:\Windows\System\UtBliRj.exe
  C:\Windows\System\UtBliRj.exe
  2⤵
  PID:15992
- C:\Windows\System\BMydQwM.exe
  C:\Windows\System\BMydQwM.exe
  2⤵
  PID:16032
- C:\Windows\System\gLNRHup.exe
  C:\Windows\System\gLNRHup.exe
  2⤵
  PID:16064
- C:\Windows\System\LxjYnka.exe
  C:\Windows\System\LxjYnka.exe
  2⤵
  PID:16088
- C:\Windows\System\JjkCmRt.exe
  C:\Windows\System\JjkCmRt.exe
  2⤵
  PID:16112
- C:\Windows\System\saTRaOK.exe
  C:\Windows\System\saTRaOK.exe
  2⤵
  PID:16128
- C:\Windows\System\PESKfsZ.exe
  C:\Windows\System\PESKfsZ.exe
  2⤵
  PID:16156
- C:\Windows\System\gijggND.exe
  C:\Windows\System\gijggND.exe
  2⤵
  PID:16184
- C:\Windows\System\bMWChYl.exe
  C:\Windows\System\bMWChYl.exe
  2⤵
  PID:16204
- C:\Windows\System\zrEPSXK.exe
  C:\Windows\System\zrEPSXK.exe
  2⤵
  PID:16224
- C:\Windows\System\oDLRuwW.exe
  C:\Windows\System\oDLRuwW.exe
  2⤵
  PID:16244
- C:\Windows\System\xyfIYFD.exe
  C:\Windows\System\xyfIYFD.exe
  2⤵
  PID:16268
- C:\Windows\System\jyiYRIL.exe
  C:\Windows\System\jyiYRIL.exe
  2⤵
  PID:16296
- C:\Windows\System\bdeeGWz.exe
  C:\Windows\System\bdeeGWz.exe
  2⤵
  PID:16324
- C:\Windows\System\XcOrTml.exe
  C:\Windows\System\XcOrTml.exe
  2⤵
  PID:16360
- C:\Windows\System\awzAMfx.exe
  C:\Windows\System\awzAMfx.exe
  2⤵
  PID:14904
- C:\Windows\System\noTBFMI.exe
  C:\Windows\System\noTBFMI.exe
  2⤵
  PID:14328
- C:\Windows\System\HcbQnRe.exe
  C:\Windows\System\HcbQnRe.exe
  2⤵
  PID:15208
- C:\Windows\System\fmAgFmp.exe
  C:\Windows\System\fmAgFmp.exe
  2⤵
  PID:14632
- C:\Windows\System\qPpTjcf.exe
  C:\Windows\System\qPpTjcf.exe
  2⤵
  PID:15480
- C:\Windows\System\IWeIEDE.exe
  C:\Windows\System\IWeIEDE.exe
  2⤵
  PID:15540
- C:\Windows\System\GauRadR.exe
  C:\Windows\System\GauRadR.exe
  2⤵
  PID:15612
- C:\Windows\System\ewaTitk.exe
  C:\Windows\System\ewaTitk.exe
  2⤵
  PID:15588
- C:\Windows\System\ddAaJBp.exe
  C:\Windows\System\ddAaJBp.exe
  2⤵
  PID:15672
- C:\Windows\System\kauFrkM.exe
  C:\Windows\System\kauFrkM.exe
  2⤵
  PID:15844
- C:\Windows\System\iGvWUuK.exe
  C:\Windows\System\iGvWUuK.exe
  2⤵
  PID:15704
- C:\Windows\System\RCGSAGj.exe
  C:\Windows\System\RCGSAGj.exe
  2⤵
  PID:15788
- C:\Windows\System\xzfQqLw.exe
  C:\Windows\System\xzfQqLw.exe
  2⤵
  PID:15900
- C:\Windows\System\syIQaPB.exe
  C:\Windows\System\syIQaPB.exe
  2⤵
  PID:15976
- C:\Windows\System\tnpcSxX.exe
  C:\Windows\System\tnpcSxX.exe
  2⤵
  PID:15944
- C:\Windows\System\oCwFTEg.exe
  C:\Windows\System\oCwFTEg.exe
  2⤵
  PID:16100
- C:\Windows\System\MBmBJgx.exe
  C:\Windows\System\MBmBJgx.exe
  2⤵
  PID:16216
- C:\Windows\System\UcZyETH.exe
  C:\Windows\System\UcZyETH.exe
  2⤵
  PID:16252
- C:\Windows\System\KWKgCxV.exe
  C:\Windows\System\KWKgCxV.exe
  2⤵
  PID:16284
- C:\Windows\System\AgokMON.exe
  C:\Windows\System\AgokMON.exe
  2⤵
  PID:15044
- C:\Windows\System\SeFLrhH.exe
  C:\Windows\System\SeFLrhH.exe
  2⤵
  PID:14396
- C:\Windows\System\sllJSMT.exe
  C:\Windows\System\sllJSMT.exe
  2⤵
  PID:15596
- C:\Windows\System\HQxZqCG.exe
  C:\Windows\System\HQxZqCG.exe
  2⤵
  PID:15504
- C:\Windows\System\jpvqbnC.exe
  C:\Windows\System\jpvqbnC.exe
  2⤵
  PID:15888
- C:\Windows\System\nJfIhJo.exe
  C:\Windows\System\nJfIhJo.exe
  2⤵
  PID:15228
- C:\Windows\System\AxbLGsM.exe
  C:\Windows\System\AxbLGsM.exe
  2⤵
  PID:15652
- C:\Windows\System\eUxlzdu.exe
  C:\Windows\System\eUxlzdu.exe
  2⤵
  PID:15736
- C:\Windows\System\ClRMkvn.exe
  C:\Windows\System\ClRMkvn.exe
  2⤵
  PID:14452
- C:\Windows\System\TuSnMYM.exe
  C:\Windows\System\TuSnMYM.exe
  2⤵
  PID:16412
- C:\Windows\System\VSPSsyJ.exe
  C:\Windows\System\VSPSsyJ.exe
  2⤵
  PID:16436
- C:\Windows\System\APWwcwB.exe
  C:\Windows\System\APWwcwB.exe
  2⤵
  PID:16468
- C:\Windows\System\JrAJziy.exe
  C:\Windows\System\JrAJziy.exe
  2⤵
  PID:16496
- C:\Windows\System\fpYhNOj.exe
  C:\Windows\System\fpYhNOj.exe
  2⤵
  PID:16520
- C:\Windows\System\bxdfuOQ.exe
  C:\Windows\System\bxdfuOQ.exe
  2⤵
  PID:16548
- C:\Windows\System\RrkVhEh.exe
  C:\Windows\System\RrkVhEh.exe
  2⤵
  PID:16584
- C:\Windows\System\NlWAmqF.exe
  C:\Windows\System\NlWAmqF.exe
  2⤵
  PID:16612
- C:\Windows\System\SujKHcl.exe
  C:\Windows\System\SujKHcl.exe
  2⤵
  PID:16644
- C:\Windows\System\JiLBiyX.exe
  C:\Windows\System\JiLBiyX.exe
  2⤵
  PID:16668
- C:\Windows\System\kNdDNQe.exe
  C:\Windows\System\kNdDNQe.exe
  2⤵
  PID:16696
- C:\Windows\System\UdoGUPV.exe
  C:\Windows\System\UdoGUPV.exe
  2⤵
  PID:16720
- C:\Windows\System\GUlrNOj.exe
  C:\Windows\System\GUlrNOj.exe
  2⤵
  PID:16756
- C:\Windows\System\KSoLhoW.exe
  C:\Windows\System\KSoLhoW.exe
  2⤵
  PID:16776
- C:\Windows\System\TjNmTWK.exe
  C:\Windows\System\TjNmTWK.exe
  2⤵
  PID:16800
- C:\Windows\System\HOdDFxG.exe
  C:\Windows\System\HOdDFxG.exe
  2⤵
  PID:16820
- C:\Windows\System\ooHRnUL.exe
  C:\Windows\System\ooHRnUL.exe
  2⤵
  PID:16844
- C:\Windows\System\pydTWEw.exe
  C:\Windows\System\pydTWEw.exe
  2⤵
  PID:16864
- C:\Windows\System\xAtuaYC.exe
  C:\Windows\System\xAtuaYC.exe
  2⤵
  PID:16880
- C:\Windows\System\wvfEwNX.exe
  C:\Windows\System\wvfEwNX.exe
  2⤵
  PID:16912
- C:\Windows\System\XrWXGRr.exe
  C:\Windows\System\XrWXGRr.exe
  2⤵
  PID:16944
- C:\Windows\System\kPbNNTr.exe
  C:\Windows\System\kPbNNTr.exe
  2⤵
  PID:16960
- C:\Windows\System\goebMFx.exe
  C:\Windows\System\goebMFx.exe
  2⤵
  PID:16984
- C:\Windows\System\kPEChmN.exe
  C:\Windows\System\kPEChmN.exe
  2⤵
  PID:17008
- C:\Windows\System\cTBuEtg.exe
  C:\Windows\System\cTBuEtg.exe
  2⤵
  PID:17036
- C:\Windows\System\MjbFSDA.exe
  C:\Windows\System\MjbFSDA.exe
  2⤵
  PID:17064
- C:\Windows\System\nrANLUs.exe
  C:\Windows\System\nrANLUs.exe
  2⤵
  PID:17104
- C:\Windows\System\bmabeTo.exe
  C:\Windows\System\bmabeTo.exe
  2⤵
  PID:17120
- C:\Windows\System\IJFicNg.exe
  C:\Windows\System\IJFicNg.exe
  2⤵
  PID:17144
- C:\Windows\System\FrLMzjR.exe
  C:\Windows\System\FrLMzjR.exe
  2⤵
  PID:17160
- C:\Windows\System\lzYJvqk.exe
  C:\Windows\System\lzYJvqk.exe
  2⤵
  PID:17204
- C:\Windows\System\iZIqewT.exe
  C:\Windows\System\iZIqewT.exe
  2⤵
  PID:17228
- C:\Windows\System\BkkkeQK.exe
  C:\Windows\System\BkkkeQK.exe
  2⤵
  PID:17260
- C:\Windows\System\OHcTwBP.exe
  C:\Windows\System\OHcTwBP.exe
  2⤵
  PID:17284
- C:\Windows\System\SOSgajl.exe
  C:\Windows\System\SOSgajl.exe
  2⤵
  PID:17316
- C:\Windows\System\utiVArC.exe
  C:\Windows\System\utiVArC.exe
  2⤵
  PID:17340
- C:\Windows\System\pGUeSia.exe
  C:\Windows\System\pGUeSia.exe
  2⤵
  PID:15972
- C:\Windows\System\NlSyMWn.exe
  C:\Windows\System\NlSyMWn.exe
  2⤵
  PID:16540
- C:\Windows\System\wRDhjev.exe
  C:\Windows\System\wRDhjev.exe
  2⤵
  PID:17092
- C:\Windows\System\WtYmaMu.exe
  C:\Windows\System\WtYmaMu.exe
  2⤵
  PID:16180

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CgEAKSc.exe

Path C:\Windows\System\CgEAKSc.exe
Size 1.7MB
SHA256 6fa53bef0296fa51b02629ca25b5f8ca7abe5fc970e8b5c4891e925d0ad39019
MD5 a4546205e9648526cbec85cf8e271e3e
SHA1 d49c82e5912e9236e9ae1f4ce78e15743bcc1df9
SHA512 f9db6efb5d0f58bc8952b6520a31836ebb0b515d2b0e6e5541ac006066b3e8da2af5590a8e2d4996cc3dbb585f928be2b67ee080cf792b96ba8030d01744b33b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROF:GemTLkNdfE0pZat
MD5 SHA1 SHA512 SSDEEP

Submit Download

DDiHglD.exe

Path C:\Windows\System\DDiHglD.exe
Size 1.7MB
SHA256 ed897bbe408968f13bfc2f082f5e68593f911721fd8fc1c54768f6e3cc21270b
MD5 c134a6024017e5e29a90c21e40df804a
SHA1 5c177be9e9802201d308e36902907c561d4a87c3
SHA512 8bd031a38ae53b18226c3a8ca582ddb5558528ea8304bdd6b339ff34fe9f78bed8b969d82b45d5569af5d30632e74842f54eb3d35e0ccd5944778d5fa369b619
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROP:GemTLkNdfE0pZan
MD5 SHA1 SHA512 SSDEEP

Submit Download

EbDwQfz.exe

Path C:\Windows\System\EbDwQfz.exe
Size 1.7MB
SHA256 2b19d3bb1b07ce2483fcc9cbdbded9fe5c140d33a752ab922116640f0acb7505
MD5 48bed7181fc7b5c9fd6ecd4f1f154f10
SHA1 9f64a172f6c785510e2b586113bae68c286e322e
SHA512 e229957a06933eb09f3ed005239fe5cc0fe49cc016cb36a02216f32a62a9823bd933b0b88b97ee9eef669c7debea747e9a4a3cef511a0415b3b4d6d1853a46bb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROB:GemTLkNdfE0pZaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

FGccxmw.exe

Path C:\Windows\System\FGccxmw.exe
Size 1.7MB
SHA256 e437f079c78621122460031af1ba0f93d13ab03d100f92d322c197d4b8ddf334
MD5 a14567dde714b4df328aed377eb264b6
SHA1 8636a3c7fba84522ed71a717335b5772c6a1c1ac
SHA512 a3ac9be4e0579c2fa5554656fc4e8597f233fdf87456576264e4cfb778c214ed64eb95090387ca042cec8f7087fd7019b177529a3a358bb71f1908854c1780bb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROy:GemTLkNdfE0pZaK
MD5 SHA1 SHA512 SSDEEP

Submit Download

FJAvNex.exe

Path C:\Windows\System\FJAvNex.exe
Size 1.7MB
SHA256 e7447586beecf974a3e31a7612b026d7902abc62e8834698a4ff93667d31f21f
MD5 c0704529ca3718102884208c9849775d
SHA1 395d73b6c72d560d7399394d9c0e3669c36adca5
SHA512 30dec020771fbe22ca35a8af828574a779cbbd47a581eb95ac59d95c7b9678d6234950d3ffdde9fc51a6455ae608a0b03221b933d47220072cd5f373afda966a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROH:GemTLkNdfE0pZaP
MD5 SHA1 SHA512 SSDEEP

Submit Download

GCGPMkx.exe

Path C:\Windows\System\GCGPMkx.exe
Size 1.7MB
SHA256 d01fce70563acfb1c313422ecc5e9df1d719f06b558036ada89208af4d956888
MD5 f0d3c0b7e2c658bca488dc6d8f187b9a
SHA1 baea82056f77c981c50287cbad114fd5e520ae24
SHA512 9ff59f4c251fdaf0234b03706748fd5ba36e7651bed8d89f850d61be715b338de9b34623d9eab2401599b0626cbb75a0c459d3d89bcf384be85c91910d57d9c7
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROm:GemTLkNdfE0pZaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

HQYykCV.exe

Path C:\Windows\System\HQYykCV.exe
Size 1.7MB
SHA256 fa6bd427483aa8ead5199d3d038bd9df1a56d3466664695084653456702e34e6
MD5 f8cfc97c2e8021518962ffb507a15356
SHA1 1d7f266867d3171699da38eec43f2449b0d07566
SHA512 87308d3da12565bf4d6cbd9e65b84a0cd93380a00efeac1be4bc7075e89beb1609ce8d2ae79735f5190b488be0613808c0c8efdbac8d48a57e48169be56c3d4b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROU:GemTLkNdfE0pZaM
MD5 SHA1 SHA512 SSDEEP

Submit Download

IYqavqi.exe

Path C:\Windows\System\IYqavqi.exe
Size 1.7MB
SHA256 edee17056351bad688c2f9d435f2b109533cba82d6fafd8668a6b2e19a926187
MD5 d09bf40c08c28de17ed66a3e10342d14
SHA1 0d03e6eb977a299aecbd4e9c510a956a5c7e766c
SHA512 8330bff7535bc3cb7a4cbd4de3b962bf6e19a2406176bf9c2d2d6e6c743c8bf6b3435d1a863f8913401822da7cc5a863ca85fd55ee04d8338c64e147db8465e0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROx:GemTLkNdfE0pZap
MD5 SHA1 SHA512 SSDEEP

Submit Download

JGxFEim.exe

Path C:\Windows\System\JGxFEim.exe
Size 1.7MB
SHA256 51ee11e34093492f9212a41fde473d703cca1d68cf50bafe85959b3b39b92d43
MD5 3713722532388456d8231449948071c4
SHA1 03bedf4cc27c6993b5269daf1c279656f042edf7
SHA512 af1a9a1c5e8e696112423e3ad624236107b3fa35c61d46f52bf0ecf6118215093b0d53179d71eab32463fac7785d70700129f20deaf0e2fe509ca3710574d767
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROI:GemTLkNdfE0pZaw
MD5 SHA1 SHA512 SSDEEP

Submit Download

KchylkH.exe

Path C:\Windows\System\KchylkH.exe
Size 1.7MB
SHA256 1230d3f7d16770e689bc772e80d1fc28dde5ce06cc0133f7ceec5f16531121b4
MD5 df467b854d52769fe9493c286e373869
SHA1 e242d2eecc6d0d301115f9991e1a6654fe083147
SHA512 9fd25c713857429a7bb3514c1b701f3b774d4a858b3b6f42899e3c1b2d68cdd7f6935bd071f797528cf3ae309ed542d4280aa918365304662361e54d1b4d5cbb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ERO1:GemTLkNdfE0pZat
MD5 SHA1 SHA512 SSDEEP

Submit Download

NecROob.exe

Path C:\Windows\System\NecROob.exe
Size 1.7MB
SHA256 0e82a0100c8d62ef28c6ede4454d835546bac7ff0a336438c5a05372ff8a7045
MD5 4154913620e26efc7cfc6fbe050b3392
SHA1 c9caef91d58e0b4ddb80e4b957fa1bb8988be755
SHA512 64c231f231590090a6c9e5a42d213cf06fc516c61fbb5f3522960c4431cd9021e9929cb296349e1ca99ae84fb74078930f25d68d1195585190226eb2db53bef7
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ERO3:GemTLkNdfE0pZa/
MD5 SHA1 SHA512 SSDEEP

Submit Download

NzdHaSe.exe

Path C:\Windows\System\NzdHaSe.exe
Size 1.7MB
SHA256 5361731e69e97b73019f6edafb9cacdb5c87d60b27195399c2762907da00dc2b
MD5 32c5dddf45d3f6701e3f831b427ab1f9
SHA1 a57da865231ad18b838ad6189013841b747047e6
SHA512 57645a413c5f9e3a1d06681b704643a70032fc4b4dd549184e8a6ed866e8923baf3e98593027358e99e6b8ec324df6fc6c3b2fe9224e8b46c9727add64c37d5d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROd:GemTLkNdfE0pZa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

NzvxarP.exe

Path C:\Windows\System\NzvxarP.exe
Size 1.7MB
SHA256 d0fc755fd710416b9bc839243e115c50523c63e86150adb52dd1640596c5ff93
MD5 4f2585a2c96b3952d08997689d7a5b62
SHA1 90b65457d5da2d2ca616c97806fd28cee2b8b8d9
SHA512 ed76bbf3d60e2d847f60922062c29b5db3a26130291b2cae83a5ee846cc564fd33178919e9c90b97f8052dab95eee09c3fd508e5e75f47b1b3ddfb504b6b699d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROL:GemTLkNdfE0pZaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

PlfofHG.exe

Path C:\Windows\System\PlfofHG.exe
Size 1.7MB
SHA256 c6583dd4c5326172c2ef339788709d28d866849be62d8f96ed5a5f718ff3d99a
MD5 05f3eda3599b225c65b6f80dc6e77bcf
SHA1 0a23d9014e4a38b168963bf736302318cd46fcc3
SHA512 3b91e17b472cdd729b7c3a2113fb3f9fbecb1ce3503314e88aea72904f42f570c9370bef01071b0c6fbd2100174b9dcff4c4d4d0dfc520d900bbc0296b4db1ba
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ERO3:GemTLkNdfE0pZa/
MD5 SHA1 SHA512 SSDEEP

Submit Download

RcfkxnO.exe

Path C:\Windows\System\RcfkxnO.exe
Size 1.7MB
SHA256 652cb56950fe4d62c25a0718c21b0f7cef6fc46cab7050f7d230440079fb7392
MD5 d015a60b7f475966689ef8e187129c02
SHA1 f835f27cb4cbf4310c65f80b38b230fa31b43de3
SHA512 4709f3ab4dd7b19a04559d962363add6d8f26a8ee73fa087cce79922abdde966e4f268c9f5eaa7181e3a00228265e8b6596a5fcce87bb16283c9c91c71fe5071
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROf:GemTLkNdfE0pZan
MD5 SHA1 SHA512 SSDEEP

Submit Download

VyaNZjN.exe

Path C:\Windows\System\VyaNZjN.exe
Size 1.7MB
SHA256 cf13bebadbfcded7f755309f261a1a22671f06d93617c0257d5dc9f77f5bb92c
MD5 8d3eca8c20749610c2f64039c853d297
SHA1 3a2b700d4fbd7ea949b6823de3095302cfadb6f0
SHA512 9236142d4963992394c0a6ba384c586080d76c5610f77e180123ffcbd4465a0bc976e4cb75eecc931af9c315191abcf889e08da1933d596da0f1344a8179a89f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROZ:GemTLkNdfE0pZax
MD5 SHA1 SHA512 SSDEEP

Submit Download

WEWsaZZ.exe

Path C:\Windows\System\WEWsaZZ.exe
Size 1.7MB
SHA256 e2f6e119ab2ad120ab8567c8dd5dea237d2d075d231f899053902fb7361311fd
MD5 1da4a824cb88788248ccccacb78c75e1
SHA1 6f29aaa17f550c4f81bf93aaaf464132917dc8bb
SHA512 d31fd7406e969bd54cee9ab2dda47e8d620c45ab99a8fa966b64aa6f0ef90d4b54df237f55af35a3bfb34a12cdf95ca6d2a7f25b6e0bc1f7f9da9ecb54850414
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROG:GemTLkNdfE0pZae
MD5 SHA1 SHA512 SSDEEP

Submit Download

WGPEJaB.exe

Path C:\Windows\System\WGPEJaB.exe
Size 1.7MB
SHA256 caaf6ac526f3c0e7cc330f597f388e1c9cc3ddada5ed9ee741da3f9315c6f7df
MD5 8559644177faf88895c083544e4e489a
SHA1 7c1195c10e74abbfbaa8d0d7633861441d39b2e3
SHA512 53b9dba7d846b9615c9cf19fb46ee8e8973c0fefd610c4cc000df8b1c7e764f5d805e55f284086bce9d3fc1632448e0406fcc0e30f6f31fa4b6f0a6b78558ad4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROa:GemTLkNdfE0pZaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

XrDKOAt.exe

Path C:\Windows\System\XrDKOAt.exe
Size 1.7MB
SHA256 4138b10563e7e70ed4b9577a489fb49f54e924c8db8bfee761cc347e14cfb9aa
MD5 f6052aad7705d43ce6a1c96b98ebca24
SHA1 7c2a9fba3d38bca76665c547ef3d038c4bae9a6d
SHA512 164ae0627f01ca5d4e9af45584daa2cd5e65a5abba1ce04466a18c6edc9b336805b8404398cdcb15bf9b943d2077b3da07504c8507846c8d6a95865e526823ee
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROF:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Submit Download

YUAyITY.exe

Path C:\Windows\System\YUAyITY.exe
Size 1.7MB
SHA256 e067e57d824a4df2dd6dd0dbf390834a833d6ff4fc0b43dacbf8457b90ec1ec3
MD5 e903b9301d9fae8476888420e0f596c9
SHA1 8e7b9e4219d536fe044bc6eb1ad415557885224d
SHA512 89912430848a6d51c72938627347b9eb58e7dd37dafdb934d605c54967a58e30404d36e22223f2c73b35673cfd5058a1ce1d7d384b32867192b02e0d7279a0cb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROu:GemTLkNdfE0pZa2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ystakfm.exe

Path C:\Windows\System\Ystakfm.exe
Size 1.7MB
SHA256 c8bfcd197217839cec0f7996083b55d8322404a60013676485110039b15013c4
MD5 da512d498fae7c49ae06f64500e19455
SHA1 4f08b9c1002d3de3a6df055cfa02dc54c77b61db
SHA512 7a1307d83a14f829948c1b98b56420344f40e12c97cecc1d7a4caa8a17165fcee699b238ea5446ba9fec7056e017333146c96fcfe2779ed11d9638bb7f54b129
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROZ5:GemTLkNdfE0pZa7
MD5 SHA1 SHA512 SSDEEP

Submit Download

difiDTA.exe

Path C:\Windows\System\difiDTA.exe
Size 1.7MB
SHA256 6632940fe252cb3318b9c105b9ff2d4f11617525578f0164242494287452d983
MD5 8d36ecc276346a30b1ad0fb8b7058ffc
SHA1 18465010f5aa5402112195df391123753115393a
SHA512 761c42d4ef3a16157e0994083c984adf869ea809622036449574bd89962325ca4e8ecd47e8f694de0b2a5a65a1e3f709073d4b89412993672187495b2e50c5ff
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROZ:GemTLkNdfE0pZaR
MD5 SHA1 SHA512 SSDEEP

Submit Download

eauQhjd.exe

Path C:\Windows\System\eauQhjd.exe
Size 1.7MB
SHA256 031f7c01442d0ec1ae7f690669716df2968d7c8042d93cf18b0a82666eb40165
MD5 9a9ec5af0340253de8a5e3f7af0a974e
SHA1 f5169254b111206605347765cf25faef035d3a0a
SHA512 d76221c41b316777521ffee711b47b5930d903d59685b997fce2bb7e6b979eca10fef3699a371e34078abc6e4feb742a3a5b8a82c3519a9fcd2bcbde530c8f23
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROt:GemTLkNdfE0pZaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

fLWTPoy.exe

Path C:\Windows\System\fLWTPoy.exe
Size 1.7MB
SHA256 08e6c0c0a7923b6e3287f045254e56a06f1b15f3ec2a674315e3ac19da42adf1
MD5 5678418ba85c4c8e5323898c17cf295a
SHA1 ec8aed1808dc2b44f758d93c99a5c246b711f9a4
SHA512 62d0aaf2cd9c08062881caf4bce18fb13e1d5932f8c59d04e40287fb8cabc7ae40ff26b472e3ea6e65e7d016ae65775248d2d6f79e65ec4ebb5ef3fd276948d5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROr:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fPQJbJs.exe

Path C:\Windows\System\fPQJbJs.exe
Size 1.7MB
SHA256 a89bb6b6050262452158845c1d640b841746675c20dc497cdc88edea62d454ea
MD5 4ed420e24b97831afda4df391b53daa6
SHA1 e972dbf157f6b9498cc63cd13a5012192fc8431f
SHA512 4e587fe09601272755687d5f069108086162d94bec8a1018006f74776c4e2f4751e338e1d74069ca4d36c5c14e3ab9ecfa00b2628e7192e10c2b0569deb3871b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROs:GemTLkNdfE0pZaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

nmcMxnf.exe

Path C:\Windows\System\nmcMxnf.exe
Size 1.7MB
SHA256 12efc4360f041ce77e1f8a3ca1b7cdc129229b69afe4f132f76c2034772b978a
MD5 bbf633333d17723b02e180ab3cc1a2b0
SHA1 0ca2eff1f3aad42e2e853f3f3056e58c7ce8b5ea
SHA512 1edb7a75a5f24b0075cecedd8938742dd5eaddf60d8ab46c2f5859438766bca966cabdc0d73460d88210c7ef950a7451955f6bcbdf4040e483c8c7ef97d20273
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ERON:GemTLkNdfE0pZa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

qCCLKvw.exe

Path C:\Windows\System\qCCLKvw.exe
Size 1.7MB
SHA256 2edde543becc87ccebf047a03ca12622be4599b5258ff98909f58a0a012d07c1
MD5 88fc034bffd4e0c836b24ec76c775c46
SHA1 5b991b45da89e06285fd51f68e1dd0480caa9236
SHA512 90e65028f4bb5a760e4adaa3648551ab0b3b3f340eac44566a27f200fe03f0c8af45a7a3382ed0570d7d149150121b918ba05ab4594e8600042da06f50465c02
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROY:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

rOYwJOs.exe

Path C:\Windows\System\rOYwJOs.exe
Size 1.7MB
SHA256 7f7dcdd087ec5fa20d58b5ec8582a39e18445572897d9bd587f228e10113809f
MD5 25b328aa1bb2be83c885c21fbaa20254
SHA1 4403c11109cb07844541995a9d518a867e39a139
SHA512 c2908e5c6796a952b6a2c12d30742e98e604c0c7ba855d9bd4b25e68780a6d3a682f47124220a8b1a1485096fafe907a95530e15162a3ef22263787705f097ed
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ERON:GemTLkNdfE0pZaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

sPZbZxo.exe

Path C:\Windows\System\sPZbZxo.exe
Size 1.7MB
SHA256 77bb9718b64c665fcefebc2aa8ac729f4bce8738e70cd14cb8673184db7264d3
MD5 b55735e4268a20604644d7f051299ad2
SHA1 ad6e9309de570c8f6d70bd2e24c373739a47dc0d
SHA512 7a9cbe969c556df7d495b53d216e3e06b2efdef7ac4928ee44fa805c9b7c75c94160ac6a7df7cb2ac1f5e7fc434d065f3a45205b4563f661d17f7f5e044f1695
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROT:GemTLkNdfE0pZab
MD5 SHA1 SHA512 SSDEEP

Submit Download

wAiOxoz.exe

Path C:\Windows\System\wAiOxoz.exe
Size 1.7MB
SHA256 be8d0beb4ede5be0659cafc3e44ddead5de822544bc1a2209c3722dfa2b61f0f
MD5 7e37caa53892566b39fb2f871bd7b7ff
SHA1 99bb26cce2e47a745cfa6919bc1ad3feb1e7c7fd
SHA512 0b8ca1083aede98de6aaa6f2e012b4259fe6df5f6f98f7e2960f0014a0dcd5f55ab67b8a686f12d13af7c781d31e07be18020aca7a07403545fcaf34cace8eb0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROm:GemTLkNdfE0pZaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

yzTLAks.exe

Path C:\Windows\System\yzTLAks.exe
Size 1.7MB
SHA256 95fbf51ff1cfb09950c3e64edb1c85564cf8ed5e201ce72e7af099d30e4bc10c
MD5 de84dd7fd26fc8748e735b2ea2577024
SHA1 2377ed98157b2a6d860c859ec2dc2beb10b777f8
SHA512 29e963e918a655ba952f104973e7f54477aa447e62597b3adb126f6283c56682747ef69ba29090c7e5e0bebf74e671280ff5b96fae31e95e632ca82452611ab3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROO:GemTLkNdfE0pZam
MD5 SHA1 SHA512 SSDEEP

Submit Download

zHGytJi.exe

Path C:\Windows\System\zHGytJi.exe
Size 1.7MB
SHA256 86f54dfb656d70ec8a522f62af43b6d99a5c6bcb19151ac495e7c4d387bfdfb4
MD5 09d7d3c8bf580f6e90606ccc1dd0ccc5
SHA1 0761c561df8f71edb2732fe689c989f87fb1aebd
SHA512 9c85bdd171e28fa2f58fe6e62c09513a7ae6b5c10b0bc9e12c035497a9adb65fa2d5a6cc04b42f4efa1afde8c11bb400525c3c26ba62e7500894efc63379813a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROs:GemTLkNdfE0pZa0
MD5 SHA1 SHA512 SSDEEP

Submit Download

zoLrtkJ.exe

Path C:\Windows\System\zoLrtkJ.exe
Size 1.7MB
SHA256 5d41b97b7c1992bdf86af91421ef62a24bae83bdc95d7ed58247498a7ec1cb9c
MD5 14f852fdb6b6b2c5daa9eda4881fa0a2
SHA1 4724f4bd31a020a772d406883dacbc8ebb91c2f8
SHA512 137a8586a52d3693f38966c93c6ffb9cce9255edc15853c0fcf33b85eacbda591e67f013e21dc19883f2c6a2d3d37272ed5b60f589f38d57fc65e1bfefca8391
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ERON:GemTLkNdfE0pZaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

zxQtAlH.exe

Path C:\Windows\System\zxQtAlH.exe
Size 1.7MB
SHA256 ce66958deae2703c4a03026308d4463b40a04d08f1e3ea3ae1ca8e72c5ad0470
MD5 2c98b428977817e49f0121072ccd8db3
SHA1 25afe95e870026fc75d38897026c67c194e76e17
SHA512 501578a72e9fe7626b2c7aa1a4ad155364b4f42ea2fd6b0a00333c8983de7b3b363adc2746123b4c0252438d56a0d67e2a6789a3f2f296a85827ae61b8c867fa
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5EROW:GemTLkNdfE0pZaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3756-0-0x0000017B020A0000-0x0000017B020B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads