kpot | 33f0927ca18a730f2214a7087ec278e851f58c5649fd0180de414fdb423777ac

Analysis

max time kernel
106s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
Size

1.9MB
MD5

2f800cbfeabf2172d86df079092fc830
SHA1

3074801e1b4c1e9573909fdff5383d785cf15c9b
SHA256

33f0927ca18a730f2214a7087ec278e851f58c5649fd0180de414fdb423777ac
SHA512

47d0be2bbb9955d1bbf8cb2a5e98926f9a2ac3c94e69cb1341f685f89b18c846b963102c6cb63eed4f44b0febc83205cd7aec12b3ed574932687b2c898e38b34
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIi5aIwC+Agr6S/FFC+Ou:GemTLkNdfE0pZaQe

Score

10^/10

kpot xmrig miner stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 38 IoCs

resource	yara_rule
behavioral2/files/0x000d0000000233cb-4.dat	family_kpot
behavioral2/files/0x000800000002341d-9.dat	family_kpot
behavioral2/files/0x000700000002341e-8.dat	family_kpot
behavioral2/files/0x000700000002341f-18.dat	family_kpot
behavioral2/files/0x0007000000023421-22.dat	family_kpot
behavioral2/files/0x0007000000023423-31.dat	family_kpot
behavioral2/files/0x0007000000023424-44.dat	family_kpot
behavioral2/files/0x0007000000023425-47.dat	family_kpot
behavioral2/files/0x0007000000023426-50.dat	family_kpot
behavioral2/files/0x0007000000023422-46.dat	family_kpot
behavioral2/files/0x0007000000023427-54.dat	family_kpot
behavioral2/files/0x000800000002341b-58.dat	family_kpot
behavioral2/files/0x0007000000023428-64.dat	family_kpot
behavioral2/files/0x0007000000023429-69.dat	family_kpot
behavioral2/files/0x000700000002342a-74.dat	family_kpot
behavioral2/files/0x000700000002342b-79.dat	family_kpot
behavioral2/files/0x000700000002342d-84.dat	family_kpot
behavioral2/files/0x000700000002342f-92.dat	family_kpot
behavioral2/files/0x0007000000023430-97.dat	family_kpot
behavioral2/files/0x0007000000023431-101.dat	family_kpot
behavioral2/files/0x0007000000023433-109.dat	family_kpot
behavioral2/files/0x0007000000023435-120.dat	family_kpot
behavioral2/files/0x0007000000023436-129.dat	family_kpot
behavioral2/files/0x0007000000023441-162.dat	family_kpot
behavioral2/files/0x0007000000023442-167.dat	family_kpot
behavioral2/files/0x0007000000023440-161.dat	family_kpot
behavioral2/files/0x000700000002343f-159.dat	family_kpot
behavioral2/files/0x000700000002343e-157.dat	family_kpot
behavioral2/files/0x000700000002343d-154.dat	family_kpot
behavioral2/files/0x000700000002343c-149.dat	family_kpot
behavioral2/files/0x000700000002343b-144.dat	family_kpot
behavioral2/files/0x000700000002343a-141.dat	family_kpot
behavioral2/files/0x0007000000023439-138.dat	family_kpot
behavioral2/files/0x0007000000023438-135.dat	family_kpot
behavioral2/files/0x0007000000023437-132.dat	family_kpot
behavioral2/files/0x0007000000023434-123.dat	family_kpot
behavioral2/files/0x0007000000023432-121.dat	family_kpot
behavioral2/files/0x000700000002342e-91.dat	family_kpot

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d0000000233cb-4.dat	xmrig
behavioral2/files/0x000800000002341d-9.dat	xmrig
behavioral2/files/0x000700000002341e-8.dat	xmrig
behavioral2/files/0x000700000002341f-18.dat	xmrig
behavioral2/files/0x0007000000023421-22.dat	xmrig
behavioral2/files/0x0007000000023423-31.dat	xmrig
behavioral2/files/0x0007000000023424-44.dat	xmrig
behavioral2/files/0x0007000000023425-47.dat	xmrig
behavioral2/files/0x0007000000023426-50.dat	xmrig
behavioral2/files/0x0007000000023422-46.dat	xmrig
behavioral2/files/0x0007000000023427-54.dat	xmrig
behavioral2/files/0x000800000002341b-58.dat	xmrig
behavioral2/files/0x0007000000023428-64.dat	xmrig
behavioral2/files/0x0007000000023429-69.dat	xmrig
behavioral2/files/0x000700000002342a-74.dat	xmrig
behavioral2/files/0x000700000002342b-79.dat	xmrig
behavioral2/files/0x000700000002342d-84.dat	xmrig
behavioral2/files/0x000700000002342f-92.dat	xmrig
behavioral2/files/0x0007000000023430-97.dat	xmrig
behavioral2/files/0x0007000000023431-101.dat	xmrig
behavioral2/files/0x0007000000023433-109.dat	xmrig
behavioral2/files/0x0007000000023435-120.dat	xmrig
behavioral2/files/0x0007000000023436-129.dat	xmrig
behavioral2/files/0x0007000000023441-162.dat	xmrig
behavioral2/files/0x0007000000023442-167.dat	xmrig
behavioral2/files/0x0007000000023440-161.dat	xmrig
behavioral2/files/0x000700000002343f-159.dat	xmrig
behavioral2/files/0x000700000002343e-157.dat	xmrig
behavioral2/files/0x000700000002343d-154.dat	xmrig
behavioral2/files/0x000700000002343c-149.dat	xmrig
behavioral2/files/0x000700000002343b-144.dat	xmrig
behavioral2/files/0x000700000002343a-141.dat	xmrig
behavioral2/files/0x0007000000023439-138.dat	xmrig
behavioral2/files/0x0007000000023438-135.dat	xmrig
behavioral2/files/0x0007000000023437-132.dat	xmrig
behavioral2/files/0x0007000000023434-123.dat	xmrig
behavioral2/files/0x0007000000023432-121.dat	xmrig
behavioral2/files/0x000700000002342e-91.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1372	VaoeWbK.exe
3596	HCPCGin.exe
2548	KGGbwii.exe
4596	TkNOHeQ.exe
748	EbdUsGT.exe
2900	RwCRFHW.exe
2168	OaYIUFI.exe
4036	RKLauUq.exe
3748	KALsIuz.exe
4128	BGIMGCs.exe
228	QxnXUgx.exe
5040	jAlpXZE.exe
1972	BwvxrOv.exe
1108	JoYfSCw.exe
4688	eaAaFZi.exe
4808	WfTSfEq.exe
3236	QeZFKqD.exe
8	VSuvyBS.exe
532	SnKsaRY.exe
3452	mhfcVfO.exe
3624	OIprpHJ.exe
2028	wLcyQsf.exe
4844	rzZsOtO.exe
3736	aPolFYO.exe
2420	pNxbbPt.exe
3292	aDDZOan.exe
4268	cidEHZr.exe
1744	tkdxqLo.exe
1552	QXmflEv.exe
2216	KhyxNYg.exe
4992	nDJiYsb.exe
4824	vdrpaWG.exe
1200	pfcwMHu.exe
688	CsrYmUo.exe
3608	YBKRTTo.exe
1612	wfqjpqd.exe
1932	RvGkInj.exe
3488	ZcAeToC.exe
3620	walubcC.exe
4772	ZNhEuhj.exe
1928	vKvzsAM.exe
4412	nzdroMo.exe
5052	jDLGEfO.exe
3544	UUNBRJR.exe
920	jPAUZEJ.exe
944	nrTnyKk.exe
764	YANwBcC.exe
2612	QSHANUe.exe
3136	Syibedy.exe
4492	GXCnifa.exe
4648	HVKmCjp.exe
4400	GXxSvPH.exe
4604	VwkQIVI.exe
3240	JkwhrVJ.exe
4952	MqoXgPy.exe
4956	XPcytXD.exe
4376	damEvlq.exe
5068	ODhnogt.exe
1944	DCjIvhK.exe
5012	dejfphi.exe
1532	RxVCqkE.exe
5116	nuQvscp.exe
3708	hjMQcEo.exe
4184	UCTLYPI.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bTqggvb.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\jLPhxyc.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\RaBOari.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\MuzkSZs.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\zxqaIok.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\DmJrkwj.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\SYLvVju.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\kkZnzyi.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\qrBzDqu.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\dOpTTyX.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\cigwUgC.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\TflFSdR.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\BYHkfbM.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\kugVTBi.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\eFLqUoZ.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\ZCIQVeF.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\PvwcyCr.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\BGIMGCs.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\PqwcdGd.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\gMdpzXW.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\HWGCGYE.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\RsXhfPW.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\DvfIsHB.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\nvaCkXx.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\fUVDgSr.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\OJEvzen.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\JjnTSsT.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\DcuSkfu.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\DakmSXZ.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\OFNwiWP.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\mjoCJFh.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\LomAxeo.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\PfzZWdm.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\OIprpHJ.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\kNQKlcf.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\IpczCgX.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\lwpZMHj.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\zKZLyKM.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\EGyNIbw.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\KzDsdoe.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\kxUcCBk.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\qFNzOgH.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\YQJsfrP.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\QHOaYTs.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\JNGkikX.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\wzHIEOi.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\bHpbubF.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\zbaNyza.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\wmUunpN.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\vXcWRtz.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\PKaPhRM.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\jplKMTo.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\divjoLr.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\idnHWxi.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\euuMEmn.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\KALsIuz.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\hFUkukO.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\HkjZiif.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\Syibedy.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\thyvXVb.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\aTGHcyo.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\bruvpSP.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\xkUNXbL.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
File created	C:\Windows\System\mRcvDcS.exe	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18128	dwm.exe
Token: SeChangeNotifyPrivilege	18128	dwm.exe
Token: 33	18128	dwm.exe
Token: SeIncBasePriorityPrivilege	18128	dwm.exe
Token: SeShutdownPrivilege	18128	dwm.exe
Token: SeCreatePagefilePrivilege	18128	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1372	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	82
PID 2248 wrote to memory of 1372	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	82
PID 2248 wrote to memory of 3596	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	83
PID 2248 wrote to memory of 3596	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	83
PID 2248 wrote to memory of 2548	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	84
PID 2248 wrote to memory of 2548	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	84
PID 2248 wrote to memory of 4596	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	85
PID 2248 wrote to memory of 4596	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	85
PID 2248 wrote to memory of 748	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	87
PID 2248 wrote to memory of 748	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	87
PID 2248 wrote to memory of 2168	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	88
PID 2248 wrote to memory of 2168	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	88
PID 2248 wrote to memory of 2900	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	89
PID 2248 wrote to memory of 2900	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	89
PID 2248 wrote to memory of 4036	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	90
PID 2248 wrote to memory of 4036	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	90
PID 2248 wrote to memory of 3748	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	91
PID 2248 wrote to memory of 3748	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	91
PID 2248 wrote to memory of 4128	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	92
PID 2248 wrote to memory of 4128	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	92
PID 2248 wrote to memory of 228	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	93
PID 2248 wrote to memory of 228	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	93
PID 2248 wrote to memory of 5040	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	97
PID 2248 wrote to memory of 5040	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	97
PID 2248 wrote to memory of 1972	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	98
PID 2248 wrote to memory of 1972	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	98
PID 2248 wrote to memory of 1108	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	99
PID 2248 wrote to memory of 1108	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	99
PID 2248 wrote to memory of 4688	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	100
PID 2248 wrote to memory of 4688	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	100
PID 2248 wrote to memory of 4808	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	101
PID 2248 wrote to memory of 4808	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	101
PID 2248 wrote to memory of 3236	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	102
PID 2248 wrote to memory of 3236	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	102
PID 2248 wrote to memory of 8	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	103
PID 2248 wrote to memory of 8	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	103
PID 2248 wrote to memory of 532	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	104
PID 2248 wrote to memory of 532	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	104
PID 2248 wrote to memory of 3452	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	105
PID 2248 wrote to memory of 3452	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	105
PID 2248 wrote to memory of 3624	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	106
PID 2248 wrote to memory of 3624	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	106
PID 2248 wrote to memory of 2028	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	107
PID 2248 wrote to memory of 2028	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	107
PID 2248 wrote to memory of 4844	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	108
PID 2248 wrote to memory of 4844	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	108
PID 2248 wrote to memory of 3736	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	109
PID 2248 wrote to memory of 3736	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	109
PID 2248 wrote to memory of 2420	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	110
PID 2248 wrote to memory of 2420	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	110
PID 2248 wrote to memory of 3292	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	111
PID 2248 wrote to memory of 3292	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	111
PID 2248 wrote to memory of 4268	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	112
PID 2248 wrote to memory of 4268	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	112
PID 2248 wrote to memory of 1744	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	113
PID 2248 wrote to memory of 1744	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	113
PID 2248 wrote to memory of 1552	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	114
PID 2248 wrote to memory of 1552	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	114
PID 2248 wrote to memory of 2216	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	115
PID 2248 wrote to memory of 2216	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	115
PID 2248 wrote to memory of 4992	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	116
PID 2248 wrote to memory of 4992	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	116
PID 2248 wrote to memory of 4824	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	117
PID 2248 wrote to memory of 4824	2248	2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2f800cbfeabf2172d86df079092fc830_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\System\VaoeWbK.exe
  C:\Windows\System\VaoeWbK.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\HCPCGin.exe
  C:\Windows\System\HCPCGin.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\KGGbwii.exe
  C:\Windows\System\KGGbwii.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\TkNOHeQ.exe
  C:\Windows\System\TkNOHeQ.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\EbdUsGT.exe
  C:\Windows\System\EbdUsGT.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\OaYIUFI.exe
  C:\Windows\System\OaYIUFI.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\RwCRFHW.exe
  C:\Windows\System\RwCRFHW.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\RKLauUq.exe
  C:\Windows\System\RKLauUq.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\KALsIuz.exe
  C:\Windows\System\KALsIuz.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\BGIMGCs.exe
  C:\Windows\System\BGIMGCs.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\QxnXUgx.exe
  C:\Windows\System\QxnXUgx.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\jAlpXZE.exe
  C:\Windows\System\jAlpXZE.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\BwvxrOv.exe
  C:\Windows\System\BwvxrOv.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\JoYfSCw.exe
  C:\Windows\System\JoYfSCw.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\eaAaFZi.exe
  C:\Windows\System\eaAaFZi.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\WfTSfEq.exe
  C:\Windows\System\WfTSfEq.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\QeZFKqD.exe
  C:\Windows\System\QeZFKqD.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\VSuvyBS.exe
  C:\Windows\System\VSuvyBS.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\SnKsaRY.exe
  C:\Windows\System\SnKsaRY.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\mhfcVfO.exe
  C:\Windows\System\mhfcVfO.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\OIprpHJ.exe
  C:\Windows\System\OIprpHJ.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\wLcyQsf.exe
  C:\Windows\System\wLcyQsf.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\rzZsOtO.exe
  C:\Windows\System\rzZsOtO.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\aPolFYO.exe
  C:\Windows\System\aPolFYO.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\pNxbbPt.exe
  C:\Windows\System\pNxbbPt.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\aDDZOan.exe
  C:\Windows\System\aDDZOan.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\cidEHZr.exe
  C:\Windows\System\cidEHZr.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\tkdxqLo.exe
  C:\Windows\System\tkdxqLo.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\QXmflEv.exe
  C:\Windows\System\QXmflEv.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\KhyxNYg.exe
  C:\Windows\System\KhyxNYg.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\nDJiYsb.exe
  C:\Windows\System\nDJiYsb.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\vdrpaWG.exe
  C:\Windows\System\vdrpaWG.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\pfcwMHu.exe
  C:\Windows\System\pfcwMHu.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\CsrYmUo.exe
  C:\Windows\System\CsrYmUo.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\YBKRTTo.exe
  C:\Windows\System\YBKRTTo.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\wfqjpqd.exe
  C:\Windows\System\wfqjpqd.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\RvGkInj.exe
  C:\Windows\System\RvGkInj.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\ZcAeToC.exe
  C:\Windows\System\ZcAeToC.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\walubcC.exe
  C:\Windows\System\walubcC.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\jPAUZEJ.exe
  C:\Windows\System\jPAUZEJ.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\ZNhEuhj.exe
  C:\Windows\System\ZNhEuhj.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\vKvzsAM.exe
  C:\Windows\System\vKvzsAM.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\QSHANUe.exe
  C:\Windows\System\QSHANUe.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\nzdroMo.exe
  C:\Windows\System\nzdroMo.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\jDLGEfO.exe
  C:\Windows\System\jDLGEfO.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\UUNBRJR.exe
  C:\Windows\System\UUNBRJR.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\nrTnyKk.exe
  C:\Windows\System\nrTnyKk.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\YANwBcC.exe
  C:\Windows\System\YANwBcC.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\Syibedy.exe
  C:\Windows\System\Syibedy.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\GXCnifa.exe
  C:\Windows\System\GXCnifa.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\HVKmCjp.exe
  C:\Windows\System\HVKmCjp.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\GXxSvPH.exe
  C:\Windows\System\GXxSvPH.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\VwkQIVI.exe
  C:\Windows\System\VwkQIVI.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\JkwhrVJ.exe
  C:\Windows\System\JkwhrVJ.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\MqoXgPy.exe
  C:\Windows\System\MqoXgPy.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\XPcytXD.exe
  C:\Windows\System\XPcytXD.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\damEvlq.exe
  C:\Windows\System\damEvlq.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\ODhnogt.exe
  C:\Windows\System\ODhnogt.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\DCjIvhK.exe
  C:\Windows\System\DCjIvhK.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\dejfphi.exe
  C:\Windows\System\dejfphi.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\RxVCqkE.exe
  C:\Windows\System\RxVCqkE.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\nuQvscp.exe
  C:\Windows\System\nuQvscp.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\hjMQcEo.exe
  C:\Windows\System\hjMQcEo.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\UCTLYPI.exe
  C:\Windows\System\UCTLYPI.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\lHKfZaZ.exe
  C:\Windows\System\lHKfZaZ.exe
  2⤵
  PID:440
- C:\Windows\System\XVTzLjY.exe
  C:\Windows\System\XVTzLjY.exe
  2⤵
  PID:4404
- C:\Windows\System\wKJFMxz.exe
  C:\Windows\System\wKJFMxz.exe
  2⤵
  PID:1676
- C:\Windows\System\WrkSWFM.exe
  C:\Windows\System\WrkSWFM.exe
  2⤵
  PID:1224
- C:\Windows\System\vMROtTp.exe
  C:\Windows\System\vMROtTp.exe
  2⤵
  PID:4680
- C:\Windows\System\WBBnRpc.exe
  C:\Windows\System\WBBnRpc.exe
  2⤵
  PID:1708
- C:\Windows\System\OaUXsaR.exe
  C:\Windows\System\OaUXsaR.exe
  2⤵
  PID:1420
- C:\Windows\System\alCOdqI.exe
  C:\Windows\System\alCOdqI.exe
  2⤵
  PID:2176
- C:\Windows\System\bvZbAsu.exe
  C:\Windows\System\bvZbAsu.exe
  2⤵
  PID:1000
- C:\Windows\System\GrYGRys.exe
  C:\Windows\System\GrYGRys.exe
  2⤵
  PID:1444
- C:\Windows\System\Tslabvk.exe
  C:\Windows\System\Tslabvk.exe
  2⤵
  PID:1588
- C:\Windows\System\nzYNMoj.exe
  C:\Windows\System\nzYNMoj.exe
  2⤵
  PID:4900
- C:\Windows\System\QkWNtzT.exe
  C:\Windows\System\QkWNtzT.exe
  2⤵
  PID:1412
- C:\Windows\System\dPsjEUn.exe
  C:\Windows\System\dPsjEUn.exe
  2⤵
  PID:4692
- C:\Windows\System\CtUEjUA.exe
  C:\Windows\System\CtUEjUA.exe
  2⤵
  PID:1056
- C:\Windows\System\CEXaKkF.exe
  C:\Windows\System\CEXaKkF.exe
  2⤵
  PID:4752
- C:\Windows\System\fOVZwlf.exe
  C:\Windows\System\fOVZwlf.exe
  2⤵
  PID:3776
- C:\Windows\System\REvLVyC.exe
  C:\Windows\System\REvLVyC.exe
  2⤵
  PID:3628
- C:\Windows\System\GkHvaep.exe
  C:\Windows\System\GkHvaep.exe
  2⤵
  PID:3164
- C:\Windows\System\NxSUawE.exe
  C:\Windows\System\NxSUawE.exe
  2⤵
  PID:4172
- C:\Windows\System\cEoQjPx.exe
  C:\Windows\System\cEoQjPx.exe
  2⤵
  PID:1356
- C:\Windows\System\JNGkikX.exe
  C:\Windows\System\JNGkikX.exe
  2⤵
  PID:4768
- C:\Windows\System\zdJWFtv.exe
  C:\Windows\System\zdJWFtv.exe
  2⤵
  PID:3920
- C:\Windows\System\DKHlqWb.exe
  C:\Windows\System\DKHlqWb.exe
  2⤵
  PID:4704
- C:\Windows\System\ANzaoFx.exe
  C:\Windows\System\ANzaoFx.exe
  2⤵
  PID:2032
- C:\Windows\System\kNQKlcf.exe
  C:\Windows\System\kNQKlcf.exe
  2⤵
  PID:3576
- C:\Windows\System\ZmJzFmC.exe
  C:\Windows\System\ZmJzFmC.exe
  2⤵
  PID:2080
- C:\Windows\System\DvfIsHB.exe
  C:\Windows\System\DvfIsHB.exe
  2⤵
  PID:3904
- C:\Windows\System\LstOGlJ.exe
  C:\Windows\System\LstOGlJ.exe
  2⤵
  PID:2144
- C:\Windows\System\gZdlFrY.exe
  C:\Windows\System\gZdlFrY.exe
  2⤵
  PID:872
- C:\Windows\System\MNjvePB.exe
  C:\Windows\System\MNjvePB.exe
  2⤵
  PID:2344
- C:\Windows\System\SteTfCS.exe
  C:\Windows\System\SteTfCS.exe
  2⤵
  PID:668
- C:\Windows\System\KBUcpAM.exe
  C:\Windows\System\KBUcpAM.exe
  2⤵
  PID:3956
- C:\Windows\System\rMSFRgh.exe
  C:\Windows\System\rMSFRgh.exe
  2⤵
  PID:1416
- C:\Windows\System\sCYbiJI.exe
  C:\Windows\System\sCYbiJI.exe
  2⤵
  PID:5128
- C:\Windows\System\RKziXCL.exe
  C:\Windows\System\RKziXCL.exe
  2⤵
  PID:5156
- C:\Windows\System\kgDVOlr.exe
  C:\Windows\System\kgDVOlr.exe
  2⤵
  PID:5176
- C:\Windows\System\qDndXVV.exe
  C:\Windows\System\qDndXVV.exe
  2⤵
  PID:5208
- C:\Windows\System\MkKxiCf.exe
  C:\Windows\System\MkKxiCf.exe
  2⤵
  PID:5244
- C:\Windows\System\aXNxzlr.exe
  C:\Windows\System\aXNxzlr.exe
  2⤵
  PID:5264
- C:\Windows\System\OsrAHfD.exe
  C:\Windows\System\OsrAHfD.exe
  2⤵
  PID:5284
- C:\Windows\System\VDkXMMe.exe
  C:\Windows\System\VDkXMMe.exe
  2⤵
  PID:5316
- C:\Windows\System\ItuSBwP.exe
  C:\Windows\System\ItuSBwP.exe
  2⤵
  PID:5356
- C:\Windows\System\Cccolfo.exe
  C:\Windows\System\Cccolfo.exe
  2⤵
  PID:5372
- C:\Windows\System\UhwudKF.exe
  C:\Windows\System\UhwudKF.exe
  2⤵
  PID:5400
- C:\Windows\System\bidngqs.exe
  C:\Windows\System\bidngqs.exe
  2⤵
  PID:5444
- C:\Windows\System\kHpcykZ.exe
  C:\Windows\System\kHpcykZ.exe
  2⤵
  PID:5468
- C:\Windows\System\EhSTtVK.exe
  C:\Windows\System\EhSTtVK.exe
  2⤵
  PID:5484
- C:\Windows\System\JjjCPmh.exe
  C:\Windows\System\JjjCPmh.exe
  2⤵
  PID:5524
- C:\Windows\System\kLlTYHZ.exe
  C:\Windows\System\kLlTYHZ.exe
  2⤵
  PID:5556
- C:\Windows\System\SECFibe.exe
  C:\Windows\System\SECFibe.exe
  2⤵
  PID:5580
- C:\Windows\System\iUyubVf.exe
  C:\Windows\System\iUyubVf.exe
  2⤵
  PID:5616
- C:\Windows\System\fUgzEKR.exe
  C:\Windows\System\fUgzEKR.exe
  2⤵
  PID:5636
- C:\Windows\System\EywWDjb.exe
  C:\Windows\System\EywWDjb.exe
  2⤵
  PID:5652
- C:\Windows\System\XUcSvLf.exe
  C:\Windows\System\XUcSvLf.exe
  2⤵
  PID:5684
- C:\Windows\System\ywqaZIU.exe
  C:\Windows\System\ywqaZIU.exe
  2⤵
  PID:5708
- C:\Windows\System\bBDwcXf.exe
  C:\Windows\System\bBDwcXf.exe
  2⤵
  PID:5736
- C:\Windows\System\ZxXrPOS.exe
  C:\Windows\System\ZxXrPOS.exe
  2⤵
  PID:5764
- C:\Windows\System\wGvCePa.exe
  C:\Windows\System\wGvCePa.exe
  2⤵
  PID:5792
- C:\Windows\System\LwFsnpj.exe
  C:\Windows\System\LwFsnpj.exe
  2⤵
  PID:5828
- C:\Windows\System\agOlFPS.exe
  C:\Windows\System\agOlFPS.exe
  2⤵
  PID:5864
- C:\Windows\System\wJKAwTq.exe
  C:\Windows\System\wJKAwTq.exe
  2⤵
  PID:5892
- C:\Windows\System\caLcgFV.exe
  C:\Windows\System\caLcgFV.exe
  2⤵
  PID:5920
- C:\Windows\System\LGcQKXe.exe
  C:\Windows\System\LGcQKXe.exe
  2⤵
  PID:5948
- C:\Windows\System\whTWfBS.exe
  C:\Windows\System\whTWfBS.exe
  2⤵
  PID:5976
- C:\Windows\System\DXcJtZP.exe
  C:\Windows\System\DXcJtZP.exe
  2⤵
  PID:5992
- C:\Windows\System\XMuHixj.exe
  C:\Windows\System\XMuHixj.exe
  2⤵
  PID:6020
- C:\Windows\System\UkGNiHV.exe
  C:\Windows\System\UkGNiHV.exe
  2⤵
  PID:6056
- C:\Windows\System\LKqmHhC.exe
  C:\Windows\System\LKqmHhC.exe
  2⤵
  PID:6092
- C:\Windows\System\vVhpjYB.exe
  C:\Windows\System\vVhpjYB.exe
  2⤵
  PID:6120
- C:\Windows\System\tyxImJW.exe
  C:\Windows\System\tyxImJW.exe
  2⤵
  PID:5124
- C:\Windows\System\jLWHRZi.exe
  C:\Windows\System\jLWHRZi.exe
  2⤵
  PID:5172
- C:\Windows\System\qYHoVRr.exe
  C:\Windows\System\qYHoVRr.exe
  2⤵
  PID:5224
- C:\Windows\System\YzxkCnb.exe
  C:\Windows\System\YzxkCnb.exe
  2⤵
  PID:5272
- C:\Windows\System\DzBODAb.exe
  C:\Windows\System\DzBODAb.exe
  2⤵
  PID:5352
- C:\Windows\System\lXvvhfv.exe
  C:\Windows\System\lXvvhfv.exe
  2⤵
  PID:5432
- C:\Windows\System\DhdFygu.exe
  C:\Windows\System\DhdFygu.exe
  2⤵
  PID:5496
- C:\Windows\System\mxoOHdX.exe
  C:\Windows\System\mxoOHdX.exe
  2⤵
  PID:5564
- C:\Windows\System\ElYVOYP.exe
  C:\Windows\System\ElYVOYP.exe
  2⤵
  PID:5632
- C:\Windows\System\GxNHjGb.exe
  C:\Windows\System\GxNHjGb.exe
  2⤵
  PID:5696
- C:\Windows\System\nMAnDvY.exe
  C:\Windows\System\nMAnDvY.exe
  2⤵
  PID:5720
- C:\Windows\System\MyAsKpQ.exe
  C:\Windows\System\MyAsKpQ.exe
  2⤵
  PID:5820
- C:\Windows\System\TJWaBtS.exe
  C:\Windows\System\TJWaBtS.exe
  2⤵
  PID:5888
- C:\Windows\System\ajwPQEH.exe
  C:\Windows\System\ajwPQEH.exe
  2⤵
  PID:5964
- C:\Windows\System\aUIZLlc.exe
  C:\Windows\System\aUIZLlc.exe
  2⤵
  PID:5984
- C:\Windows\System\sookgzl.exe
  C:\Windows\System\sookgzl.exe
  2⤵
  PID:6064
- C:\Windows\System\luZCBsl.exe
  C:\Windows\System\luZCBsl.exe
  2⤵
  PID:5152
- C:\Windows\System\cpMNJGH.exe
  C:\Windows\System\cpMNJGH.exe
  2⤵
  PID:5236
- C:\Windows\System\yqrfKrv.exe
  C:\Windows\System\yqrfKrv.exe
  2⤵
  PID:5420
- C:\Windows\System\HCLRyvZ.exe
  C:\Windows\System\HCLRyvZ.exe
  2⤵
  PID:5604
- C:\Windows\System\SeaMxIF.exe
  C:\Windows\System\SeaMxIF.exe
  2⤵
  PID:5748
- C:\Windows\System\cwguWSK.exe
  C:\Windows\System\cwguWSK.exe
  2⤵
  PID:5932
- C:\Windows\System\qMAVsrj.exe
  C:\Windows\System\qMAVsrj.exe
  2⤵
  PID:6052
- C:\Windows\System\sKPsBxp.exe
  C:\Windows\System\sKPsBxp.exe
  2⤵
  PID:5204
- C:\Windows\System\Qtkqlqg.exe
  C:\Windows\System\Qtkqlqg.exe
  2⤵
  PID:5672
- C:\Windows\System\qZnuKfe.exe
  C:\Windows\System\qZnuKfe.exe
  2⤵
  PID:6032
- C:\Windows\System\yAiepgT.exe
  C:\Windows\System\yAiepgT.exe
  2⤵
  PID:5876
- C:\Windows\System\NYWTyiQ.exe
  C:\Windows\System\NYWTyiQ.exe
  2⤵
  PID:5592
- C:\Windows\System\tmeVPcf.exe
  C:\Windows\System\tmeVPcf.exe
  2⤵
  PID:6176
- C:\Windows\System\wzHIEOi.exe
  C:\Windows\System\wzHIEOi.exe
  2⤵
  PID:6208
- C:\Windows\System\bZkPZMW.exe
  C:\Windows\System\bZkPZMW.exe
  2⤵
  PID:6236
- C:\Windows\System\ZwEqLns.exe
  C:\Windows\System\ZwEqLns.exe
  2⤵
  PID:6260
- C:\Windows\System\DqfTlJU.exe
  C:\Windows\System\DqfTlJU.exe
  2⤵
  PID:6292
- C:\Windows\System\FcsabTA.exe
  C:\Windows\System\FcsabTA.exe
  2⤵
  PID:6324
- C:\Windows\System\cLoznEA.exe
  C:\Windows\System\cLoznEA.exe
  2⤵
  PID:6348
- C:\Windows\System\PYaADTa.exe
  C:\Windows\System\PYaADTa.exe
  2⤵
  PID:6364
- C:\Windows\System\AkasDCn.exe
  C:\Windows\System\AkasDCn.exe
  2⤵
  PID:6392
- C:\Windows\System\bzajeBk.exe
  C:\Windows\System\bzajeBk.exe
  2⤵
  PID:6420
- C:\Windows\System\qfOWIDU.exe
  C:\Windows\System\qfOWIDU.exe
  2⤵
  PID:6444
- C:\Windows\System\nTMrTzp.exe
  C:\Windows\System\nTMrTzp.exe
  2⤵
  PID:6484
- C:\Windows\System\TUmgKBa.exe
  C:\Windows\System\TUmgKBa.exe
  2⤵
  PID:6504
- C:\Windows\System\IZIOvDq.exe
  C:\Windows\System\IZIOvDq.exe
  2⤵
  PID:6532
- C:\Windows\System\vtTrwiE.exe
  C:\Windows\System\vtTrwiE.exe
  2⤵
  PID:6548
- C:\Windows\System\iLhVjpb.exe
  C:\Windows\System\iLhVjpb.exe
  2⤵
  PID:6572
- C:\Windows\System\daXsUMi.exe
  C:\Windows\System\daXsUMi.exe
  2⤵
  PID:6608
- C:\Windows\System\IyhJWHh.exe
  C:\Windows\System\IyhJWHh.exe
  2⤵
  PID:6640
- C:\Windows\System\hsxHNgO.exe
  C:\Windows\System\hsxHNgO.exe
  2⤵
  PID:6672
- C:\Windows\System\wGfWLoD.exe
  C:\Windows\System\wGfWLoD.exe
  2⤵
  PID:6700
- C:\Windows\System\AHnIHGq.exe
  C:\Windows\System\AHnIHGq.exe
  2⤵
  PID:6728
- C:\Windows\System\FkJiDvz.exe
  C:\Windows\System\FkJiDvz.exe
  2⤵
  PID:6756
- C:\Windows\System\MZriNdx.exe
  C:\Windows\System\MZriNdx.exe
  2⤵
  PID:6784
- C:\Windows\System\vWirVeO.exe
  C:\Windows\System\vWirVeO.exe
  2⤵
  PID:6800
- C:\Windows\System\NOBkrWG.exe
  C:\Windows\System\NOBkrWG.exe
  2⤵
  PID:6832
- C:\Windows\System\mLezxcx.exe
  C:\Windows\System\mLezxcx.exe
  2⤵
  PID:6872
- C:\Windows\System\UKoxrkf.exe
  C:\Windows\System\UKoxrkf.exe
  2⤵
  PID:6896
- C:\Windows\System\HBcMIpb.exe
  C:\Windows\System\HBcMIpb.exe
  2⤵
  PID:6928
- C:\Windows\System\syqfIOS.exe
  C:\Windows\System\syqfIOS.exe
  2⤵
  PID:6964
- C:\Windows\System\fJNxSdD.exe
  C:\Windows\System\fJNxSdD.exe
  2⤵
  PID:6992
- C:\Windows\System\lOzEODD.exe
  C:\Windows\System\lOzEODD.exe
  2⤵
  PID:7020
- C:\Windows\System\DpGjtZO.exe
  C:\Windows\System\DpGjtZO.exe
  2⤵
  PID:7048
- C:\Windows\System\uPvVivB.exe
  C:\Windows\System\uPvVivB.exe
  2⤵
  PID:7076
- C:\Windows\System\QKASqJL.exe
  C:\Windows\System\QKASqJL.exe
  2⤵
  PID:7092
- C:\Windows\System\audFIFi.exe
  C:\Windows\System\audFIFi.exe
  2⤵
  PID:7120
- C:\Windows\System\nKIVWUD.exe
  C:\Windows\System\nKIVWUD.exe
  2⤵
  PID:7156
- C:\Windows\System\TgwjdrU.exe
  C:\Windows\System\TgwjdrU.exe
  2⤵
  PID:6192
- C:\Windows\System\MVfVYCW.exe
  C:\Windows\System\MVfVYCW.exe
  2⤵
  PID:6252
- C:\Windows\System\PqwcdGd.exe
  C:\Windows\System\PqwcdGd.exe
  2⤵
  PID:6316
- C:\Windows\System\VMHammo.exe
  C:\Windows\System\VMHammo.exe
  2⤵
  PID:6356
- C:\Windows\System\zKZLyKM.exe
  C:\Windows\System\zKZLyKM.exe
  2⤵
  PID:6360
- C:\Windows\System\kxUcCBk.exe
  C:\Windows\System\kxUcCBk.exe
  2⤵
  PID:6440
- C:\Windows\System\zxqaIok.exe
  C:\Windows\System\zxqaIok.exe
  2⤵
  PID:6460
- C:\Windows\System\aUijyWU.exe
  C:\Windows\System\aUijyWU.exe
  2⤵
  PID:6496
- C:\Windows\System\xTmQYja.exe
  C:\Windows\System\xTmQYja.exe
  2⤵
  PID:6564
- C:\Windows\System\GJMwSpc.exe
  C:\Windows\System\GJMwSpc.exe
  2⤵
  PID:6696
- C:\Windows\System\hTavdZq.exe
  C:\Windows\System\hTavdZq.exe
  2⤵
  PID:6740
- C:\Windows\System\QMbBlCG.exe
  C:\Windows\System\QMbBlCG.exe
  2⤵
  PID:6840
- C:\Windows\System\UthyCpW.exe
  C:\Windows\System\UthyCpW.exe
  2⤵
  PID:6908
- C:\Windows\System\ZudteEQ.exe
  C:\Windows\System\ZudteEQ.exe
  2⤵
  PID:7004
- C:\Windows\System\gUWXZIS.exe
  C:\Windows\System\gUWXZIS.exe
  2⤵
  PID:7068
- C:\Windows\System\OFNwiWP.exe
  C:\Windows\System\OFNwiWP.exe
  2⤵
  PID:7116
- C:\Windows\System\JYzBNHw.exe
  C:\Windows\System\JYzBNHw.exe
  2⤵
  PID:7152
- C:\Windows\System\xDNCHXq.exe
  C:\Windows\System\xDNCHXq.exe
  2⤵
  PID:6244
- C:\Windows\System\utzebNe.exe
  C:\Windows\System\utzebNe.exe
  2⤵
  PID:6312
- C:\Windows\System\OYmHVzb.exe
  C:\Windows\System\OYmHVzb.exe
  2⤵
  PID:6432
- C:\Windows\System\PVcIjUG.exe
  C:\Windows\System\PVcIjUG.exe
  2⤵
  PID:6492
- C:\Windows\System\GuxngNZ.exe
  C:\Windows\System\GuxngNZ.exe
  2⤵
  PID:6720
- C:\Windows\System\OgNVZPP.exe
  C:\Windows\System\OgNVZPP.exe
  2⤵
  PID:6920
- C:\Windows\System\mKRVwvo.exe
  C:\Windows\System\mKRVwvo.exe
  2⤵
  PID:6184
- C:\Windows\System\RysAHlE.exe
  C:\Windows\System\RysAHlE.exe
  2⤵
  PID:6712
- C:\Windows\System\BItCaKV.exe
  C:\Windows\System\BItCaKV.exe
  2⤵
  PID:6852
- C:\Windows\System\IpczCgX.exe
  C:\Windows\System\IpczCgX.exe
  2⤵
  PID:6544
- C:\Windows\System\XgHSeFK.exe
  C:\Windows\System\XgHSeFK.exe
  2⤵
  PID:7172
- C:\Windows\System\euCweFG.exe
  C:\Windows\System\euCweFG.exe
  2⤵
  PID:7196
- C:\Windows\System\IWSRmeX.exe
  C:\Windows\System\IWSRmeX.exe
  2⤵
  PID:7232
- C:\Windows\System\WOLBPZE.exe
  C:\Windows\System\WOLBPZE.exe
  2⤵
  PID:7256
- C:\Windows\System\ieFefkZ.exe
  C:\Windows\System\ieFefkZ.exe
  2⤵
  PID:7272
- C:\Windows\System\bTqggvb.exe
  C:\Windows\System\bTqggvb.exe
  2⤵
  PID:7312
- C:\Windows\System\AEUoNXQ.exe
  C:\Windows\System\AEUoNXQ.exe
  2⤵
  PID:7340
- C:\Windows\System\AhVMMFK.exe
  C:\Windows\System\AhVMMFK.exe
  2⤵
  PID:7360
- C:\Windows\System\gMdpzXW.exe
  C:\Windows\System\gMdpzXW.exe
  2⤵
  PID:7396
- C:\Windows\System\gKTvulu.exe
  C:\Windows\System\gKTvulu.exe
  2⤵
  PID:7424
- C:\Windows\System\qwThYXG.exe
  C:\Windows\System\qwThYXG.exe
  2⤵
  PID:7452
- C:\Windows\System\ntNXpFx.exe
  C:\Windows\System\ntNXpFx.exe
  2⤵
  PID:7480
- C:\Windows\System\SIKStEO.exe
  C:\Windows\System\SIKStEO.exe
  2⤵
  PID:7508
- C:\Windows\System\sjqrnBU.exe
  C:\Windows\System\sjqrnBU.exe
  2⤵
  PID:7536
- C:\Windows\System\hRvVQgl.exe
  C:\Windows\System\hRvVQgl.exe
  2⤵
  PID:7552
- C:\Windows\System\umvjEWQ.exe
  C:\Windows\System\umvjEWQ.exe
  2⤵
  PID:7584
- C:\Windows\System\MGWSJwc.exe
  C:\Windows\System\MGWSJwc.exe
  2⤵
  PID:7620
- C:\Windows\System\jtpkDrZ.exe
  C:\Windows\System\jtpkDrZ.exe
  2⤵
  PID:7648
- C:\Windows\System\ZjQeCVw.exe
  C:\Windows\System\ZjQeCVw.exe
  2⤵
  PID:7692
- C:\Windows\System\vQXfght.exe
  C:\Windows\System\vQXfght.exe
  2⤵
  PID:7708
- C:\Windows\System\DcpRvFY.exe
  C:\Windows\System\DcpRvFY.exe
  2⤵
  PID:7736
- C:\Windows\System\rgBcvxe.exe
  C:\Windows\System\rgBcvxe.exe
  2⤵
  PID:7776
- C:\Windows\System\coNbYLu.exe
  C:\Windows\System\coNbYLu.exe
  2⤵
  PID:7796
- C:\Windows\System\vfiLDTZ.exe
  C:\Windows\System\vfiLDTZ.exe
  2⤵
  PID:7824
- C:\Windows\System\iLilBnJ.exe
  C:\Windows\System\iLilBnJ.exe
  2⤵
  PID:7868
- C:\Windows\System\SNjXmyh.exe
  C:\Windows\System\SNjXmyh.exe
  2⤵
  PID:7892
- C:\Windows\System\nBeRrHU.exe
  C:\Windows\System\nBeRrHU.exe
  2⤵
  PID:7924
- C:\Windows\System\xkUNXbL.exe
  C:\Windows\System\xkUNXbL.exe
  2⤵
  PID:7956
- C:\Windows\System\kkZnzyi.exe
  C:\Windows\System\kkZnzyi.exe
  2⤵
  PID:7988
- C:\Windows\System\jVbUNLl.exe
  C:\Windows\System\jVbUNLl.exe
  2⤵
  PID:8024
- C:\Windows\System\iMkfAtY.exe
  C:\Windows\System\iMkfAtY.exe
  2⤵
  PID:8056
- C:\Windows\System\UDydRtq.exe
  C:\Windows\System\UDydRtq.exe
  2⤵
  PID:8084
- C:\Windows\System\zyiOgzY.exe
  C:\Windows\System\zyiOgzY.exe
  2⤵
  PID:8116
- C:\Windows\System\dFRVsGv.exe
  C:\Windows\System\dFRVsGv.exe
  2⤵
  PID:8136
- C:\Windows\System\aJQiieu.exe
  C:\Windows\System\aJQiieu.exe
  2⤵
  PID:8164
- C:\Windows\System\JLsubTy.exe
  C:\Windows\System\JLsubTy.exe
  2⤵
  PID:8188
- C:\Windows\System\iZmQMWm.exe
  C:\Windows\System\iZmQMWm.exe
  2⤵
  PID:7224
- C:\Windows\System\LnflgVj.exe
  C:\Windows\System\LnflgVj.exe
  2⤵
  PID:7304
- C:\Windows\System\lPevBde.exe
  C:\Windows\System\lPevBde.exe
  2⤵
  PID:7348
- C:\Windows\System\HjoTafb.exe
  C:\Windows\System\HjoTafb.exe
  2⤵
  PID:7436
- C:\Windows\System\DMyKHXq.exe
  C:\Windows\System\DMyKHXq.exe
  2⤵
  PID:7504
- C:\Windows\System\LUTQHGd.exe
  C:\Windows\System\LUTQHGd.exe
  2⤵
  PID:7592
- C:\Windows\System\addTvij.exe
  C:\Windows\System\addTvij.exe
  2⤵
  PID:7632
- C:\Windows\System\WAszINx.exe
  C:\Windows\System\WAszINx.exe
  2⤵
  PID:7720
- C:\Windows\System\zQwLdey.exe
  C:\Windows\System\zQwLdey.exe
  2⤵
  PID:7792
- C:\Windows\System\LjoOXJP.exe
  C:\Windows\System\LjoOXJP.exe
  2⤵
  PID:7848
- C:\Windows\System\nhDGsiU.exe
  C:\Windows\System\nhDGsiU.exe
  2⤵
  PID:6164
- C:\Windows\System\tlPOIHB.exe
  C:\Windows\System\tlPOIHB.exe
  2⤵
  PID:8020
- C:\Windows\System\JBzIyIK.exe
  C:\Windows\System\JBzIyIK.exe
  2⤵
  PID:8096
- C:\Windows\System\YVqHlXI.exe
  C:\Windows\System\YVqHlXI.exe
  2⤵
  PID:8152
- C:\Windows\System\nvaCkXx.exe
  C:\Windows\System\nvaCkXx.exe
  2⤵
  PID:7208
- C:\Windows\System\TzhaWlz.exe
  C:\Windows\System\TzhaWlz.exe
  2⤵
  PID:7392
- C:\Windows\System\WjppRVC.exe
  C:\Windows\System\WjppRVC.exe
  2⤵
  PID:7500
- C:\Windows\System\fXhedmo.exe
  C:\Windows\System\fXhedmo.exe
  2⤵
  PID:7704
- C:\Windows\System\GgczmLg.exe
  C:\Windows\System\GgczmLg.exe
  2⤵
  PID:7888
- C:\Windows\System\QCmFlLS.exe
  C:\Windows\System\QCmFlLS.exe
  2⤵
  PID:8076
- C:\Windows\System\IVHjSpc.exe
  C:\Windows\System\IVHjSpc.exe
  2⤵
  PID:7180
- C:\Windows\System\EdzKQxS.exe
  C:\Windows\System\EdzKQxS.exe
  2⤵
  PID:7644
- C:\Windows\System\eqIKHgU.exe
  C:\Windows\System\eqIKHgU.exe
  2⤵
  PID:7812
- C:\Windows\System\NIzJMMv.exe
  C:\Windows\System\NIzJMMv.exe
  2⤵
  PID:7548
- C:\Windows\System\KbdFBwP.exe
  C:\Windows\System\KbdFBwP.exe
  2⤵
  PID:7996
- C:\Windows\System\NpEduYR.exe
  C:\Windows\System\NpEduYR.exe
  2⤵
  PID:8220
- C:\Windows\System\FXMuBbT.exe
  C:\Windows\System\FXMuBbT.exe
  2⤵
  PID:8248
- C:\Windows\System\QsJPjAp.exe
  C:\Windows\System\QsJPjAp.exe
  2⤵
  PID:8272
- C:\Windows\System\RbhxbhE.exe
  C:\Windows\System\RbhxbhE.exe
  2⤵
  PID:8304
- C:\Windows\System\jmbMYLD.exe
  C:\Windows\System\jmbMYLD.exe
  2⤵
  PID:8332
- C:\Windows\System\fDsUwNQ.exe
  C:\Windows\System\fDsUwNQ.exe
  2⤵
  PID:8360
- C:\Windows\System\eujAHch.exe
  C:\Windows\System\eujAHch.exe
  2⤵
  PID:8388
- C:\Windows\System\NKIcEQT.exe
  C:\Windows\System\NKIcEQT.exe
  2⤵
  PID:8420
- C:\Windows\System\mRcvDcS.exe
  C:\Windows\System\mRcvDcS.exe
  2⤵
  PID:8436
- C:\Windows\System\IbdWBcP.exe
  C:\Windows\System\IbdWBcP.exe
  2⤵
  PID:8480
- C:\Windows\System\HUQIEJR.exe
  C:\Windows\System\HUQIEJR.exe
  2⤵
  PID:8504
- C:\Windows\System\OogqKAE.exe
  C:\Windows\System\OogqKAE.exe
  2⤵
  PID:8528
- C:\Windows\System\EsVeAak.exe
  C:\Windows\System\EsVeAak.exe
  2⤵
  PID:8556
- C:\Windows\System\XDvCJsB.exe
  C:\Windows\System\XDvCJsB.exe
  2⤵
  PID:8588
- C:\Windows\System\RehBRVW.exe
  C:\Windows\System\RehBRVW.exe
  2⤵
  PID:8604
- C:\Windows\System\KocgBsV.exe
  C:\Windows\System\KocgBsV.exe
  2⤵
  PID:8648
- C:\Windows\System\QDNUceY.exe
  C:\Windows\System\QDNUceY.exe
  2⤵
  PID:8668
- C:\Windows\System\dVoiapq.exe
  C:\Windows\System\dVoiapq.exe
  2⤵
  PID:8704
- C:\Windows\System\AUdOpFu.exe
  C:\Windows\System\AUdOpFu.exe
  2⤵
  PID:8744
- C:\Windows\System\WVURyVs.exe
  C:\Windows\System\WVURyVs.exe
  2⤵
  PID:8792
- C:\Windows\System\WKkhJon.exe
  C:\Windows\System\WKkhJon.exe
  2⤵
  PID:8812
- C:\Windows\System\vhqOLSH.exe
  C:\Windows\System\vhqOLSH.exe
  2⤵
  PID:8844
- C:\Windows\System\anyQGeQ.exe
  C:\Windows\System\anyQGeQ.exe
  2⤵
  PID:8864
- C:\Windows\System\HXPmPRW.exe
  C:\Windows\System\HXPmPRW.exe
  2⤵
  PID:8888
- C:\Windows\System\xamzrDj.exe
  C:\Windows\System\xamzrDj.exe
  2⤵
  PID:8924
- C:\Windows\System\HLulidg.exe
  C:\Windows\System\HLulidg.exe
  2⤵
  PID:8952
- C:\Windows\System\Amlblsp.exe
  C:\Windows\System\Amlblsp.exe
  2⤵
  PID:8984
- C:\Windows\System\pgTibWT.exe
  C:\Windows\System\pgTibWT.exe
  2⤵
  PID:9016
- C:\Windows\System\zYPfcwC.exe
  C:\Windows\System\zYPfcwC.exe
  2⤵
  PID:9060
- C:\Windows\System\TflFSdR.exe
  C:\Windows\System\TflFSdR.exe
  2⤵
  PID:9088
- C:\Windows\System\LVsyxPj.exe
  C:\Windows\System\LVsyxPj.exe
  2⤵
  PID:9128
- C:\Windows\System\PLxEgnK.exe
  C:\Windows\System\PLxEgnK.exe
  2⤵
  PID:9156
- C:\Windows\System\ohcgaDd.exe
  C:\Windows\System\ohcgaDd.exe
  2⤵
  PID:9184
- C:\Windows\System\OnHywSj.exe
  C:\Windows\System\OnHywSj.exe
  2⤵
  PID:8208
- C:\Windows\System\JLlQECu.exe
  C:\Windows\System\JLlQECu.exe
  2⤵
  PID:8260
- C:\Windows\System\rHTuZLR.exe
  C:\Windows\System\rHTuZLR.exe
  2⤵
  PID:8344
- C:\Windows\System\LrxVJLE.exe
  C:\Windows\System\LrxVJLE.exe
  2⤵
  PID:8448
- C:\Windows\System\WuwAufK.exe
  C:\Windows\System\WuwAufK.exe
  2⤵
  PID:8520
- C:\Windows\System\hPUvkKQ.exe
  C:\Windows\System\hPUvkKQ.exe
  2⤵
  PID:8596
- C:\Windows\System\aazqSdf.exe
  C:\Windows\System\aazqSdf.exe
  2⤵
  PID:8656
- C:\Windows\System\lcpCXOv.exe
  C:\Windows\System\lcpCXOv.exe
  2⤵
  PID:8740
- C:\Windows\System\LAdWgdo.exe
  C:\Windows\System\LAdWgdo.exe
  2⤵
  PID:8804
- C:\Windows\System\MEXoHPL.exe
  C:\Windows\System\MEXoHPL.exe
  2⤵
  PID:8112
- C:\Windows\System\VgvqzmG.exe
  C:\Windows\System\VgvqzmG.exe
  2⤵
  PID:8948
- C:\Windows\System\HWGCGYE.exe
  C:\Windows\System\HWGCGYE.exe
  2⤵
  PID:9084
- C:\Windows\System\PeZxxEe.exe
  C:\Windows\System\PeZxxEe.exe
  2⤵
  PID:9152
- C:\Windows\System\qsqhLcd.exe
  C:\Windows\System\qsqhLcd.exe
  2⤵
  PID:8236
- C:\Windows\System\fHFeIep.exe
  C:\Windows\System\fHFeIep.exe
  2⤵
  PID:8524
- C:\Windows\System\DwAGWTN.exe
  C:\Windows\System\DwAGWTN.exe
  2⤵
  PID:8568
- C:\Windows\System\sEMRHxL.exe
  C:\Windows\System\sEMRHxL.exe
  2⤵
  PID:8876
- C:\Windows\System\sLfQzdx.exe
  C:\Windows\System\sLfQzdx.exe
  2⤵
  PID:9040
- C:\Windows\System\BeIeFsO.exe
  C:\Windows\System\BeIeFsO.exe
  2⤵
  PID:8412
- C:\Windows\System\NZgcqHy.exe
  C:\Windows\System\NZgcqHy.exe
  2⤵
  PID:8996
- C:\Windows\System\OORlGyn.exe
  C:\Windows\System\OORlGyn.exe
  2⤵
  PID:8684
- C:\Windows\System\teoRwEI.exe
  C:\Windows\System\teoRwEI.exe
  2⤵
  PID:9240
- C:\Windows\System\bTEWTPz.exe
  C:\Windows\System\bTEWTPz.exe
  2⤵
  PID:9268
- C:\Windows\System\ExympoG.exe
  C:\Windows\System\ExympoG.exe
  2⤵
  PID:9296
- C:\Windows\System\oVgVoDq.exe
  C:\Windows\System\oVgVoDq.exe
  2⤵
  PID:9324
- C:\Windows\System\AQTiLcD.exe
  C:\Windows\System\AQTiLcD.exe
  2⤵
  PID:9344
- C:\Windows\System\LlJvFxw.exe
  C:\Windows\System\LlJvFxw.exe
  2⤵
  PID:9360
- C:\Windows\System\RnfMOQe.exe
  C:\Windows\System\RnfMOQe.exe
  2⤵
  PID:9392
- C:\Windows\System\ZoXfVeR.exe
  C:\Windows\System\ZoXfVeR.exe
  2⤵
  PID:9428
- C:\Windows\System\pHGLRzG.exe
  C:\Windows\System\pHGLRzG.exe
  2⤵
  PID:9448
- C:\Windows\System\cNFrNpg.exe
  C:\Windows\System\cNFrNpg.exe
  2⤵
  PID:9472
- C:\Windows\System\jOOwJCw.exe
  C:\Windows\System\jOOwJCw.exe
  2⤵
  PID:9504
- C:\Windows\System\pdNvjNg.exe
  C:\Windows\System\pdNvjNg.exe
  2⤵
  PID:9520
- C:\Windows\System\SItCgHL.exe
  C:\Windows\System\SItCgHL.exe
  2⤵
  PID:9540
- C:\Windows\System\AyoxjEE.exe
  C:\Windows\System\AyoxjEE.exe
  2⤵
  PID:9568
- C:\Windows\System\AeVoHbU.exe
  C:\Windows\System\AeVoHbU.exe
  2⤵
  PID:9596
- C:\Windows\System\VpdWjsT.exe
  C:\Windows\System\VpdWjsT.exe
  2⤵
  PID:9628
- C:\Windows\System\NuYjRIB.exe
  C:\Windows\System\NuYjRIB.exe
  2⤵
  PID:9648
- C:\Windows\System\LozZAUK.exe
  C:\Windows\System\LozZAUK.exe
  2⤵
  PID:9680
- C:\Windows\System\XAqdWGv.exe
  C:\Windows\System\XAqdWGv.exe
  2⤵
  PID:9708
- C:\Windows\System\DKbqjzN.exe
  C:\Windows\System\DKbqjzN.exe
  2⤵
  PID:9744
- C:\Windows\System\XQfnpNh.exe
  C:\Windows\System\XQfnpNh.exe
  2⤵
  PID:9772
- C:\Windows\System\EDewHcy.exe
  C:\Windows\System\EDewHcy.exe
  2⤵
  PID:9800
- C:\Windows\System\EmNGsUB.exe
  C:\Windows\System\EmNGsUB.exe
  2⤵
  PID:9828
- C:\Windows\System\mXCVixp.exe
  C:\Windows\System\mXCVixp.exe
  2⤵
  PID:9868
- C:\Windows\System\DXXDDau.exe
  C:\Windows\System\DXXDDau.exe
  2⤵
  PID:9892
- C:\Windows\System\ZVEckUd.exe
  C:\Windows\System\ZVEckUd.exe
  2⤵
  PID:9928
- C:\Windows\System\dSzQdKo.exe
  C:\Windows\System\dSzQdKo.exe
  2⤵
  PID:9956
- C:\Windows\System\ecZLrRL.exe
  C:\Windows\System\ecZLrRL.exe
  2⤵
  PID:9992
- C:\Windows\System\zDTPilJ.exe
  C:\Windows\System\zDTPilJ.exe
  2⤵
  PID:10008
- C:\Windows\System\MwMkQAk.exe
  C:\Windows\System\MwMkQAk.exe
  2⤵
  PID:10040
- C:\Windows\System\xkJbhCl.exe
  C:\Windows\System\xkJbhCl.exe
  2⤵
  PID:10064
- C:\Windows\System\Ywzkbbc.exe
  C:\Windows\System\Ywzkbbc.exe
  2⤵
  PID:10088
- C:\Windows\System\gizmiCS.exe
  C:\Windows\System\gizmiCS.exe
  2⤵
  PID:10132
- C:\Windows\System\OgkBMVF.exe
  C:\Windows\System\OgkBMVF.exe
  2⤵
  PID:10156
- C:\Windows\System\AKPIXVB.exe
  C:\Windows\System\AKPIXVB.exe
  2⤵
  PID:10172
- C:\Windows\System\Xytjbdt.exe
  C:\Windows\System\Xytjbdt.exe
  2⤵
  PID:10208
- C:\Windows\System\fLOxfxT.exe
  C:\Windows\System\fLOxfxT.exe
  2⤵
  PID:9228
- C:\Windows\System\skdJQrZ.exe
  C:\Windows\System\skdJQrZ.exe
  2⤵
  PID:9292
- C:\Windows\System\cbPHvMw.exe
  C:\Windows\System\cbPHvMw.exe
  2⤵
  PID:9384
- C:\Windows\System\VIrMgHa.exe
  C:\Windows\System\VIrMgHa.exe
  2⤵
  PID:9488
- C:\Windows\System\lGaTpdl.exe
  C:\Windows\System\lGaTpdl.exe
  2⤵
  PID:9536
- C:\Windows\System\BVZUUIX.exe
  C:\Windows\System\BVZUUIX.exe
  2⤵
  PID:9640
- C:\Windows\System\HaQCDze.exe
  C:\Windows\System\HaQCDze.exe
  2⤵
  PID:9740
- C:\Windows\System\xZgNmle.exe
  C:\Windows\System\xZgNmle.exe
  2⤵
  PID:9780
- C:\Windows\System\EUGVDXH.exe
  C:\Windows\System\EUGVDXH.exe
  2⤵
  PID:9836
- C:\Windows\System\nbcynAt.exe
  C:\Windows\System\nbcynAt.exe
  2⤵
  PID:9880
- C:\Windows\System\zodlrKJ.exe
  C:\Windows\System\zodlrKJ.exe
  2⤵
  PID:9948
- C:\Windows\System\MNzBGUD.exe
  C:\Windows\System\MNzBGUD.exe
  2⤵
  PID:10004
- C:\Windows\System\ouKVjrm.exe
  C:\Windows\System\ouKVjrm.exe
  2⤵
  PID:10084
- C:\Windows\System\gQkyxbI.exe
  C:\Windows\System\gQkyxbI.exe
  2⤵
  PID:10124
- C:\Windows\System\xqShOTB.exe
  C:\Windows\System\xqShOTB.exe
  2⤵
  PID:10236
- C:\Windows\System\wZOlRXy.exe
  C:\Windows\System\wZOlRXy.exe
  2⤵
  PID:9352
- C:\Windows\System\YcdoYTM.exe
  C:\Windows\System\YcdoYTM.exe
  2⤵
  PID:9484
- C:\Windows\System\fnZGZqh.exe
  C:\Windows\System\fnZGZqh.exe
  2⤵
  PID:9660
- C:\Windows\System\YDucfzX.exe
  C:\Windows\System\YDucfzX.exe
  2⤵
  PID:9764
- C:\Windows\System\htgGGhn.exe
  C:\Windows\System\htgGGhn.exe
  2⤵
  PID:9852
- C:\Windows\System\SmOoEMM.exe
  C:\Windows\System\SmOoEMM.exe
  2⤵
  PID:10116
- C:\Windows\System\NKtMjWt.exe
  C:\Windows\System\NKtMjWt.exe
  2⤵
  PID:10216
- C:\Windows\System\mjoCJFh.exe
  C:\Windows\System\mjoCJFh.exe
  2⤵
  PID:9584
- C:\Windows\System\EQGcdRy.exe
  C:\Windows\System\EQGcdRy.exe
  2⤵
  PID:9940
- C:\Windows\System\lkKFraq.exe
  C:\Windows\System\lkKFraq.exe
  2⤵
  PID:8496
- C:\Windows\System\pniWeGd.exe
  C:\Windows\System\pniWeGd.exe
  2⤵
  PID:10192
- C:\Windows\System\OUbKNov.exe
  C:\Windows\System\OUbKNov.exe
  2⤵
  PID:10264
- C:\Windows\System\AKInEFz.exe
  C:\Windows\System\AKInEFz.exe
  2⤵
  PID:10288
- C:\Windows\System\QtFBhwr.exe
  C:\Windows\System\QtFBhwr.exe
  2⤵
  PID:10316
- C:\Windows\System\TJGZxRV.exe
  C:\Windows\System\TJGZxRV.exe
  2⤵
  PID:10344
- C:\Windows\System\egaNJWw.exe
  C:\Windows\System\egaNJWw.exe
  2⤵
  PID:10380
- C:\Windows\System\ViJIAlG.exe
  C:\Windows\System\ViJIAlG.exe
  2⤵
  PID:10412
- C:\Windows\System\iEEpxBh.exe
  C:\Windows\System\iEEpxBh.exe
  2⤵
  PID:10436
- C:\Windows\System\HtIMPPn.exe
  C:\Windows\System\HtIMPPn.exe
  2⤵
  PID:10464
- C:\Windows\System\vSsarto.exe
  C:\Windows\System\vSsarto.exe
  2⤵
  PID:10492
- C:\Windows\System\OjxUQkz.exe
  C:\Windows\System\OjxUQkz.exe
  2⤵
  PID:10520
- C:\Windows\System\dSvABQQ.exe
  C:\Windows\System\dSvABQQ.exe
  2⤵
  PID:10548
- C:\Windows\System\ZCIQVeF.exe
  C:\Windows\System\ZCIQVeF.exe
  2⤵
  PID:10576
- C:\Windows\System\PsYKYvb.exe
  C:\Windows\System\PsYKYvb.exe
  2⤵
  PID:10604
- C:\Windows\System\sreoCsc.exe
  C:\Windows\System\sreoCsc.exe
  2⤵
  PID:10632
- C:\Windows\System\iOgblav.exe
  C:\Windows\System\iOgblav.exe
  2⤵
  PID:10652
- C:\Windows\System\igopRoE.exe
  C:\Windows\System\igopRoE.exe
  2⤵
  PID:10676
- C:\Windows\System\lZQdRND.exe
  C:\Windows\System\lZQdRND.exe
  2⤵
  PID:10716
- C:\Windows\System\wUGWtnb.exe
  C:\Windows\System\wUGWtnb.exe
  2⤵
  PID:10740
- C:\Windows\System\ZpqwCJY.exe
  C:\Windows\System\ZpqwCJY.exe
  2⤵
  PID:10772
- C:\Windows\System\SPlNwcy.exe
  C:\Windows\System\SPlNwcy.exe
  2⤵
  PID:10800
- C:\Windows\System\iGnpZeJ.exe
  C:\Windows\System\iGnpZeJ.exe
  2⤵
  PID:10828
- C:\Windows\System\btiRnkP.exe
  C:\Windows\System\btiRnkP.exe
  2⤵
  PID:10856
- C:\Windows\System\GbdIeRb.exe
  C:\Windows\System\GbdIeRb.exe
  2⤵
  PID:10884
- C:\Windows\System\auwrekf.exe
  C:\Windows\System\auwrekf.exe
  2⤵
  PID:10912
- C:\Windows\System\ZHGfiYa.exe
  C:\Windows\System\ZHGfiYa.exe
  2⤵
  PID:10940
- C:\Windows\System\fUVDgSr.exe
  C:\Windows\System\fUVDgSr.exe
  2⤵
  PID:10964
- C:\Windows\System\BEFOGWh.exe
  C:\Windows\System\BEFOGWh.exe
  2⤵
  PID:10996
- C:\Windows\System\ufkyLQG.exe
  C:\Windows\System\ufkyLQG.exe
  2⤵
  PID:11024
- C:\Windows\System\dNITadu.exe
  C:\Windows\System\dNITadu.exe
  2⤵
  PID:11056
- C:\Windows\System\PvwcyCr.exe
  C:\Windows\System\PvwcyCr.exe
  2⤵
  PID:11080
- C:\Windows\System\BcQuwot.exe
  C:\Windows\System\BcQuwot.exe
  2⤵
  PID:11108
- C:\Windows\System\XatcAUO.exe
  C:\Windows\System\XatcAUO.exe
  2⤵
  PID:11136
- C:\Windows\System\dFulcyh.exe
  C:\Windows\System\dFulcyh.exe
  2⤵
  PID:11164
- C:\Windows\System\Hhrhrjb.exe
  C:\Windows\System\Hhrhrjb.exe
  2⤵
  PID:11192
- C:\Windows\System\bEkkbHj.exe
  C:\Windows\System\bEkkbHj.exe
  2⤵
  PID:11220
- C:\Windows\System\fXLsQlF.exe
  C:\Windows\System\fXLsQlF.exe
  2⤵
  PID:11248
- C:\Windows\System\iUaNjDk.exe
  C:\Windows\System\iUaNjDk.exe
  2⤵
  PID:10284
- C:\Windows\System\yVkSeOl.exe
  C:\Windows\System\yVkSeOl.exe
  2⤵
  PID:10324
- C:\Windows\System\lSTaRWK.exe
  C:\Windows\System\lSTaRWK.exe
  2⤵
  PID:10376
- C:\Windows\System\HYpISFe.exe
  C:\Windows\System\HYpISFe.exe
  2⤵
  PID:10476
- C:\Windows\System\dpBEBmk.exe
  C:\Windows\System\dpBEBmk.exe
  2⤵
  PID:10512
- C:\Windows\System\wmUunpN.exe
  C:\Windows\System\wmUunpN.exe
  2⤵
  PID:10596
- C:\Windows\System\XeFVkJb.exe
  C:\Windows\System\XeFVkJb.exe
  2⤵
  PID:10628
- C:\Windows\System\QQXuoBB.exe
  C:\Windows\System\QQXuoBB.exe
  2⤵
  PID:10704
- C:\Windows\System\QtfTIqg.exe
  C:\Windows\System\QtfTIqg.exe
  2⤵
  PID:10768
- C:\Windows\System\dbeoumw.exe
  C:\Windows\System\dbeoumw.exe
  2⤵
  PID:10824
- C:\Windows\System\RiHyGgV.exe
  C:\Windows\System\RiHyGgV.exe
  2⤵
  PID:10904
- C:\Windows\System\cIDXgPR.exe
  C:\Windows\System\cIDXgPR.exe
  2⤵
  PID:10988
- C:\Windows\System\KpXLAzI.exe
  C:\Windows\System\KpXLAzI.exe
  2⤵
  PID:11044
- C:\Windows\System\UOthfwG.exe
  C:\Windows\System\UOthfwG.exe
  2⤵
  PID:11128
- C:\Windows\System\siZHpOH.exe
  C:\Windows\System\siZHpOH.exe
  2⤵
  PID:11176
- C:\Windows\System\tsTFzwv.exe
  C:\Windows\System\tsTFzwv.exe
  2⤵
  PID:11212
- C:\Windows\System\rWDjVgT.exe
  C:\Windows\System\rWDjVgT.exe
  2⤵
  PID:9416
- C:\Windows\System\iiQJhaj.exe
  C:\Windows\System\iiQJhaj.exe
  2⤵
  PID:10352
- C:\Windows\System\etmqxHe.exe
  C:\Windows\System\etmqxHe.exe
  2⤵
  PID:10660
- C:\Windows\System\NqDnxTs.exe
  C:\Windows\System\NqDnxTs.exe
  2⤵
  PID:10852
- C:\Windows\System\QlvTuwJ.exe
  C:\Windows\System\QlvTuwJ.exe
  2⤵
  PID:11104
- C:\Windows\System\xhuBspp.exe
  C:\Windows\System\xhuBspp.exe
  2⤵
  PID:11240
- C:\Windows\System\OJEvzen.exe
  C:\Windows\System\OJEvzen.exe
  2⤵
  PID:11204
- C:\Windows\System\NwUUHxH.exe
  C:\Windows\System\NwUUHxH.exe
  2⤵
  PID:10308
- C:\Windows\System\ywzcIeF.exe
  C:\Windows\System\ywzcIeF.exe
  2⤵
  PID:10616
- C:\Windows\System\BaCIxzX.exe
  C:\Windows\System\BaCIxzX.exe
  2⤵
  PID:11020
- C:\Windows\System\AWBsqGR.exe
  C:\Windows\System\AWBsqGR.exe
  2⤵
  PID:11132
- C:\Windows\System\iHtmaBj.exe
  C:\Windows\System\iHtmaBj.exe
  2⤵
  PID:10796
- C:\Windows\System\wTrgOar.exe
  C:\Windows\System\wTrgOar.exe
  2⤵
  PID:11296
- C:\Windows\System\wAeznLk.exe
  C:\Windows\System\wAeznLk.exe
  2⤵
  PID:11332
- C:\Windows\System\izHCIeO.exe
  C:\Windows\System\izHCIeO.exe
  2⤵
  PID:11376
- C:\Windows\System\pFTuwWE.exe
  C:\Windows\System\pFTuwWE.exe
  2⤵
  PID:11408
- C:\Windows\System\rkNzhUs.exe
  C:\Windows\System\rkNzhUs.exe
  2⤵
  PID:11448
- C:\Windows\System\XLXXBZq.exe
  C:\Windows\System\XLXXBZq.exe
  2⤵
  PID:11476
- C:\Windows\System\eptjnph.exe
  C:\Windows\System\eptjnph.exe
  2⤵
  PID:11516
- C:\Windows\System\SVIhyel.exe
  C:\Windows\System\SVIhyel.exe
  2⤵
  PID:11544
- C:\Windows\System\IgXyufi.exe
  C:\Windows\System\IgXyufi.exe
  2⤵
  PID:11588
- C:\Windows\System\RUhbqtm.exe
  C:\Windows\System\RUhbqtm.exe
  2⤵
  PID:11612
- C:\Windows\System\NQgbCfG.exe
  C:\Windows\System\NQgbCfG.exe
  2⤵
  PID:11644
- C:\Windows\System\LomAxeo.exe
  C:\Windows\System\LomAxeo.exe
  2⤵
  PID:11676
- C:\Windows\System\BgYKDhQ.exe
  C:\Windows\System\BgYKDhQ.exe
  2⤵
  PID:11696
- C:\Windows\System\gNYmXiQ.exe
  C:\Windows\System\gNYmXiQ.exe
  2⤵
  PID:11720
- C:\Windows\System\thyvXVb.exe
  C:\Windows\System\thyvXVb.exe
  2⤵
  PID:11736
- C:\Windows\System\RqyHxBr.exe
  C:\Windows\System\RqyHxBr.exe
  2⤵
  PID:11760
- C:\Windows\System\eYNflci.exe
  C:\Windows\System\eYNflci.exe
  2⤵
  PID:11796
- C:\Windows\System\RWFFTxM.exe
  C:\Windows\System\RWFFTxM.exe
  2⤵
  PID:11828
- C:\Windows\System\VEqMMJW.exe
  C:\Windows\System\VEqMMJW.exe
  2⤵
  PID:11852
- C:\Windows\System\EoyzJcz.exe
  C:\Windows\System\EoyzJcz.exe
  2⤵
  PID:11888
- C:\Windows\System\vZyQMro.exe
  C:\Windows\System\vZyQMro.exe
  2⤵
  PID:11920
- C:\Windows\System\WLXWGCj.exe
  C:\Windows\System\WLXWGCj.exe
  2⤵
  PID:11948
- C:\Windows\System\TeqAXMC.exe
  C:\Windows\System\TeqAXMC.exe
  2⤵
  PID:11972
- C:\Windows\System\RpXLnjD.exe
  C:\Windows\System\RpXLnjD.exe
  2⤵
  PID:12000
- C:\Windows\System\lsLprmt.exe
  C:\Windows\System\lsLprmt.exe
  2⤵
  PID:12032
- C:\Windows\System\boPQiSZ.exe
  C:\Windows\System\boPQiSZ.exe
  2⤵
  PID:12060
- C:\Windows\System\PUZSMOD.exe
  C:\Windows\System\PUZSMOD.exe
  2⤵
  PID:12088
- C:\Windows\System\BYHkfbM.exe
  C:\Windows\System\BYHkfbM.exe
  2⤵
  PID:12108
- C:\Windows\System\vfhUzwR.exe
  C:\Windows\System\vfhUzwR.exe
  2⤵
  PID:12124
- C:\Windows\System\IicHLFm.exe
  C:\Windows\System\IicHLFm.exe
  2⤵
  PID:12152
- C:\Windows\System\VrElBSC.exe
  C:\Windows\System\VrElBSC.exe
  2⤵
  PID:12188
- C:\Windows\System\pseoPKw.exe
  C:\Windows\System\pseoPKw.exe
  2⤵
  PID:12220
- C:\Windows\System\AxZoUwl.exe
  C:\Windows\System\AxZoUwl.exe
  2⤵
  PID:12252
- C:\Windows\System\YofBoHG.exe
  C:\Windows\System\YofBoHG.exe
  2⤵
  PID:12268
- C:\Windows\System\yynPTSL.exe
  C:\Windows\System\yynPTSL.exe
  2⤵
  PID:10980
- C:\Windows\System\qLmFJJT.exe
  C:\Windows\System\qLmFJJT.exe
  2⤵
  PID:11280
- C:\Windows\System\SzlXIhk.exe
  C:\Windows\System\SzlXIhk.exe
  2⤵
  PID:11396
- C:\Windows\System\OjdybwB.exe
  C:\Windows\System\OjdybwB.exe
  2⤵
  PID:11436
- C:\Windows\System\EayRHOm.exe
  C:\Windows\System\EayRHOm.exe
  2⤵
  PID:11492
- C:\Windows\System\iIFDHRt.exe
  C:\Windows\System\iIFDHRt.exe
  2⤵
  PID:11600
- C:\Windows\System\vXcWRtz.exe
  C:\Windows\System\vXcWRtz.exe
  2⤵
  PID:11668
- C:\Windows\System\qyNmWGs.exe
  C:\Windows\System\qyNmWGs.exe
  2⤵
  PID:11748
- C:\Windows\System\hbZIgms.exe
  C:\Windows\System\hbZIgms.exe
  2⤵
  PID:11780
- C:\Windows\System\mNtPNlJ.exe
  C:\Windows\System\mNtPNlJ.exe
  2⤵
  PID:11820
- C:\Windows\System\DWinVmz.exe
  C:\Windows\System\DWinVmz.exe
  2⤵
  PID:11880
- C:\Windows\System\ZUNdtAx.exe
  C:\Windows\System\ZUNdtAx.exe
  2⤵
  PID:11940
- C:\Windows\System\ZSbhiId.exe
  C:\Windows\System\ZSbhiId.exe
  2⤵
  PID:11964
- C:\Windows\System\EDPYrDP.exe
  C:\Windows\System\EDPYrDP.exe
  2⤵
  PID:12080
- C:\Windows\System\tJaBbpy.exe
  C:\Windows\System\tJaBbpy.exe
  2⤵
  PID:12168
- C:\Windows\System\XQWvfQN.exe
  C:\Windows\System\XQWvfQN.exe
  2⤵
  PID:12200
- C:\Windows\System\gNNysST.exe
  C:\Windows\System\gNNysST.exe
  2⤵
  PID:12284
- C:\Windows\System\HuereGG.exe
  C:\Windows\System\HuereGG.exe
  2⤵
  PID:11340
- C:\Windows\System\LEardYr.exe
  C:\Windows\System\LEardYr.exe
  2⤵
  PID:11472
- C:\Windows\System\YKbKyUb.exe
  C:\Windows\System\YKbKyUb.exe
  2⤵
  PID:11568
- C:\Windows\System\GPPrWqV.exe
  C:\Windows\System\GPPrWqV.exe
  2⤵
  PID:11896
- C:\Windows\System\QIzRjLV.exe
  C:\Windows\System\QIzRjLV.exe
  2⤵
  PID:11908
- C:\Windows\System\RpFrQmK.exe
  C:\Windows\System\RpFrQmK.exe
  2⤵
  PID:12016
- C:\Windows\System\ITXfqVc.exe
  C:\Windows\System\ITXfqVc.exe
  2⤵
  PID:12116
- C:\Windows\System\aTGHcyo.exe
  C:\Windows\System\aTGHcyo.exe
  2⤵
  PID:11384
- C:\Windows\System\zbXSukx.exe
  C:\Windows\System\zbXSukx.exe
  2⤵
  PID:11756
- C:\Windows\System\FmtYfbS.exe
  C:\Windows\System\FmtYfbS.exe
  2⤵
  PID:11788
- C:\Windows\System\SVmgPLY.exe
  C:\Windows\System\SVmgPLY.exe
  2⤵
  PID:12308
- C:\Windows\System\lNyVlPU.exe
  C:\Windows\System\lNyVlPU.exe
  2⤵
  PID:12336
- C:\Windows\System\eXtOLlp.exe
  C:\Windows\System\eXtOLlp.exe
  2⤵
  PID:12368
- C:\Windows\System\JlEDlzW.exe
  C:\Windows\System\JlEDlzW.exe
  2⤵
  PID:12388
- C:\Windows\System\acumJNN.exe
  C:\Windows\System\acumJNN.exe
  2⤵
  PID:12416
- C:\Windows\System\hFyTxqo.exe
  C:\Windows\System\hFyTxqo.exe
  2⤵
  PID:12448
- C:\Windows\System\aqgKLkv.exe
  C:\Windows\System\aqgKLkv.exe
  2⤵
  PID:12480
- C:\Windows\System\mWrbSZZ.exe
  C:\Windows\System\mWrbSZZ.exe
  2⤵
  PID:12504
- C:\Windows\System\VvGfRrB.exe
  C:\Windows\System\VvGfRrB.exe
  2⤵
  PID:12536
- C:\Windows\System\JZUYdlx.exe
  C:\Windows\System\JZUYdlx.exe
  2⤵
  PID:12568
- C:\Windows\System\JpNTADr.exe
  C:\Windows\System\JpNTADr.exe
  2⤵
  PID:12596
- C:\Windows\System\OdWJPfz.exe
  C:\Windows\System\OdWJPfz.exe
  2⤵
  PID:12620
- C:\Windows\System\qHlAROb.exe
  C:\Windows\System\qHlAROb.exe
  2⤵
  PID:12644
- C:\Windows\System\FWbKJTm.exe
  C:\Windows\System\FWbKJTm.exe
  2⤵
  PID:12672
- C:\Windows\System\EvzGumE.exe
  C:\Windows\System\EvzGumE.exe
  2⤵
  PID:12708
- C:\Windows\System\iugCSRl.exe
  C:\Windows\System\iugCSRl.exe
  2⤵
  PID:12736
- C:\Windows\System\kugVTBi.exe
  C:\Windows\System\kugVTBi.exe
  2⤵
  PID:12764
- C:\Windows\System\JWwFYDx.exe
  C:\Windows\System\JWwFYDx.exe
  2⤵
  PID:12796
- C:\Windows\System\PEQEXEx.exe
  C:\Windows\System\PEQEXEx.exe
  2⤵
  PID:12828
- C:\Windows\System\jWWtfRM.exe
  C:\Windows\System\jWWtfRM.exe
  2⤵
  PID:12856
- C:\Windows\System\VxIDyfG.exe
  C:\Windows\System\VxIDyfG.exe
  2⤵
  PID:12884
- C:\Windows\System\dDKGxeY.exe
  C:\Windows\System\dDKGxeY.exe
  2⤵
  PID:12916
- C:\Windows\System\PeSUebt.exe
  C:\Windows\System\PeSUebt.exe
  2⤵
  PID:12944
- C:\Windows\System\jplKMTo.exe
  C:\Windows\System\jplKMTo.exe
  2⤵
  PID:12976
- C:\Windows\System\uZYrqmD.exe
  C:\Windows\System\uZYrqmD.exe
  2⤵
  PID:13004
- C:\Windows\System\CMiKgvd.exe
  C:\Windows\System\CMiKgvd.exe
  2⤵
  PID:13036
- C:\Windows\System\njYPajq.exe
  C:\Windows\System\njYPajq.exe
  2⤵
  PID:13060
- C:\Windows\System\WsKXlpU.exe
  C:\Windows\System\WsKXlpU.exe
  2⤵
  PID:13080
- C:\Windows\System\ExHDQit.exe
  C:\Windows\System\ExHDQit.exe
  2⤵
  PID:13120
- C:\Windows\System\xQmmUtA.exe
  C:\Windows\System\xQmmUtA.exe
  2⤵
  PID:13144
- C:\Windows\System\aCsMuSL.exe
  C:\Windows\System\aCsMuSL.exe
  2⤵
  PID:13160
- C:\Windows\System\OqskYrV.exe
  C:\Windows\System\OqskYrV.exe
  2⤵
  PID:13184
- C:\Windows\System\psJtOxF.exe
  C:\Windows\System\psJtOxF.exe
  2⤵
  PID:13212
- C:\Windows\System\rYbaSYE.exe
  C:\Windows\System\rYbaSYE.exe
  2⤵
  PID:13240
- C:\Windows\System\ciNJbqB.exe
  C:\Windows\System\ciNJbqB.exe
  2⤵
  PID:13264
- C:\Windows\System\TKMDKLA.exe
  C:\Windows\System\TKMDKLA.exe
  2⤵
  PID:13296
- C:\Windows\System\fsFbsnW.exe
  C:\Windows\System\fsFbsnW.exe
  2⤵
  PID:9704
- C:\Windows\System\lQuypWD.exe
  C:\Windows\System\lQuypWD.exe
  2⤵
  PID:11640
- C:\Windows\System\PBoEKkF.exe
  C:\Windows\System\PBoEKkF.exe
  2⤵
  PID:12304
- C:\Windows\System\nMjxcmm.exe
  C:\Windows\System\nMjxcmm.exe
  2⤵
  PID:12352
- C:\Windows\System\OxraedL.exe
  C:\Windows\System\OxraedL.exe
  2⤵
  PID:12476
- C:\Windows\System\dIpDZmr.exe
  C:\Windows\System\dIpDZmr.exe
  2⤵
  PID:12556
- C:\Windows\System\KXHMxbM.exe
  C:\Windows\System\KXHMxbM.exe
  2⤵
  PID:12632
- C:\Windows\System\tcocfCB.exe
  C:\Windows\System\tcocfCB.exe
  2⤵
  PID:12668
- C:\Windows\System\SHEVNHR.exe
  C:\Windows\System\SHEVNHR.exe
  2⤵
  PID:12732
- C:\Windows\System\rWOYWtc.exe
  C:\Windows\System\rWOYWtc.exe
  2⤵
  PID:12836
- C:\Windows\System\hzRjJEN.exe
  C:\Windows\System\hzRjJEN.exe
  2⤵
  PID:12912
- C:\Windows\System\dMzmyMX.exe
  C:\Windows\System\dMzmyMX.exe
  2⤵
  PID:12988
- C:\Windows\System\xOpqxwN.exe
  C:\Windows\System\xOpqxwN.exe
  2⤵
  PID:13092
- C:\Windows\System\eQKfhUN.exe
  C:\Windows\System\eQKfhUN.exe
  2⤵
  PID:13128
- C:\Windows\System\hzUThpx.exe
  C:\Windows\System\hzUThpx.exe
  2⤵
  PID:13200
- C:\Windows\System\BRWrsUU.exe
  C:\Windows\System\BRWrsUU.exe
  2⤵
  PID:13272
- C:\Windows\System\jQuUUsq.exe
  C:\Windows\System\jQuUUsq.exe
  2⤵
  PID:12400
- C:\Windows\System\sDOOuUK.exe
  C:\Windows\System\sDOOuUK.exe
  2⤵
  PID:10820
- C:\Windows\System\wtQHRjn.exe
  C:\Windows\System\wtQHRjn.exe
  2⤵
  PID:12532
- C:\Windows\System\ifEGosT.exe
  C:\Windows\System\ifEGosT.exe
  2⤵
  PID:12788
- C:\Windows\System\qiTTqiu.exe
  C:\Windows\System\qiTTqiu.exe
  2⤵
  PID:12704
- C:\Windows\System\cYiDDsu.exe
  C:\Windows\System\cYiDDsu.exe
  2⤵
  PID:13052
- C:\Windows\System\yiEIXIW.exe
  C:\Windows\System\yiEIXIW.exe
  2⤵
  PID:13176
- C:\Windows\System\VeRHDir.exe
  C:\Windows\System\VeRHDir.exe
  2⤵
  PID:12456
- C:\Windows\System\QnfoMtY.exe
  C:\Windows\System\QnfoMtY.exe
  2⤵
  PID:12608
- C:\Windows\System\yVdvjLh.exe
  C:\Windows\System\yVdvjLh.exe
  2⤵
  PID:12784
- C:\Windows\System\rgwEuvl.exe
  C:\Windows\System\rgwEuvl.exe
  2⤵
  PID:12380
- C:\Windows\System\SGWvest.exe
  C:\Windows\System\SGWvest.exe
  2⤵
  PID:12528
- C:\Windows\System\HzbNHwk.exe
  C:\Windows\System\HzbNHwk.exe
  2⤵
  PID:13328
- C:\Windows\System\oXbyNnF.exe
  C:\Windows\System\oXbyNnF.exe
  2⤵
  PID:13356
- C:\Windows\System\vOGAXAN.exe
  C:\Windows\System\vOGAXAN.exe
  2⤵
  PID:13380
- C:\Windows\System\TLCvfBp.exe
  C:\Windows\System\TLCvfBp.exe
  2⤵
  PID:13404
- C:\Windows\System\eBCgEqQ.exe
  C:\Windows\System\eBCgEqQ.exe
  2⤵
  PID:13472
- C:\Windows\System\EGyNIbw.exe
  C:\Windows\System\EGyNIbw.exe
  2⤵
  PID:13500
- C:\Windows\System\EAvJOsp.exe
  C:\Windows\System\EAvJOsp.exe
  2⤵
  PID:13536
- C:\Windows\System\XmAVaGT.exe
  C:\Windows\System\XmAVaGT.exe
  2⤵
  PID:13584
- C:\Windows\System\KSqnUyz.exe
  C:\Windows\System\KSqnUyz.exe
  2⤵
  PID:13628
- C:\Windows\System\epiEvlb.exe
  C:\Windows\System\epiEvlb.exe
  2⤵
  PID:13644
- C:\Windows\System\dUXyvJr.exe
  C:\Windows\System\dUXyvJr.exe
  2⤵
  PID:13680
- C:\Windows\System\sbPyCAn.exe
  C:\Windows\System\sbPyCAn.exe
  2⤵
  PID:13708
- C:\Windows\System\prloIXc.exe
  C:\Windows\System\prloIXc.exe
  2⤵
  PID:13740
- C:\Windows\System\icmlLYS.exe
  C:\Windows\System\icmlLYS.exe
  2⤵
  PID:13772
- C:\Windows\System\nEbPPJR.exe
  C:\Windows\System\nEbPPJR.exe
  2⤵
  PID:13804
- C:\Windows\System\kFrTpWA.exe
  C:\Windows\System\kFrTpWA.exe
  2⤵
  PID:13832
- C:\Windows\System\NjpgoBY.exe
  C:\Windows\System\NjpgoBY.exe
  2⤵
  PID:13856
- C:\Windows\System\gJASGVc.exe
  C:\Windows\System\gJASGVc.exe
  2⤵
  PID:13880
- C:\Windows\System\udMHDxq.exe
  C:\Windows\System\udMHDxq.exe
  2⤵
  PID:13920
- C:\Windows\System\dwpwvnp.exe
  C:\Windows\System\dwpwvnp.exe
  2⤵
  PID:13948
- C:\Windows\System\qllDRoh.exe
  C:\Windows\System\qllDRoh.exe
  2⤵
  PID:13972
- C:\Windows\System\phLkrsN.exe
  C:\Windows\System\phLkrsN.exe
  2⤵
  PID:13992
- C:\Windows\System\BmWgTps.exe
  C:\Windows\System\BmWgTps.exe
  2⤵
  PID:14020
- C:\Windows\System\UXTGDvV.exe
  C:\Windows\System\UXTGDvV.exe
  2⤵
  PID:14048
- C:\Windows\System\KzDsdoe.exe
  C:\Windows\System\KzDsdoe.exe
  2⤵
  PID:14068
- C:\Windows\System\TzNPyie.exe
  C:\Windows\System\TzNPyie.exe
  2⤵
  PID:14104
- C:\Windows\System\CxRgTtU.exe
  C:\Windows\System\CxRgTtU.exe
  2⤵
  PID:14132
- C:\Windows\System\rxWJqKO.exe
  C:\Windows\System\rxWJqKO.exe
  2⤵
  PID:14160
- C:\Windows\System\ILXlmKB.exe
  C:\Windows\System\ILXlmKB.exe
  2⤵
  PID:14184
- C:\Windows\System\fkEfyFU.exe
  C:\Windows\System\fkEfyFU.exe
  2⤵
  PID:14216
- C:\Windows\System\CNNKWMz.exe
  C:\Windows\System\CNNKWMz.exe
  2⤵
  PID:14240
- C:\Windows\System\EKnGRKW.exe
  C:\Windows\System\EKnGRKW.exe
  2⤵
  PID:14264
- C:\Windows\System\SeHBjrG.exe
  C:\Windows\System\SeHBjrG.exe
  2⤵
  PID:14292
- C:\Windows\System\fCKhwyn.exe
  C:\Windows\System\fCKhwyn.exe
  2⤵
  PID:14316
- C:\Windows\System\bHpbubF.exe
  C:\Windows\System\bHpbubF.exe
  2⤵
  PID:12760
- C:\Windows\System\LtlzHwG.exe
  C:\Windows\System\LtlzHwG.exe
  2⤵
  PID:13396
- C:\Windows\System\giXAFPU.exe
  C:\Windows\System\giXAFPU.exe
  2⤵
  PID:13452
- C:\Windows\System\khXnpop.exe
  C:\Windows\System\khXnpop.exe
  2⤵
  PID:12492
- C:\Windows\System\TIxenCJ.exe
  C:\Windows\System\TIxenCJ.exe
  2⤵
  PID:13672
- C:\Windows\System\jLPhxyc.exe
  C:\Windows\System\jLPhxyc.exe
  2⤵
  PID:13720
- C:\Windows\System\SjpjPHI.exe
  C:\Windows\System\SjpjPHI.exe
  2⤵
  PID:13784
- C:\Windows\System\pYboPdZ.exe
  C:\Windows\System\pYboPdZ.exe
  2⤵
  PID:13800
- C:\Windows\System\FyuNSOa.exe
  C:\Windows\System\FyuNSOa.exe
  2⤵
  PID:13908
- C:\Windows\System\DxuPDsv.exe
  C:\Windows\System\DxuPDsv.exe
  2⤵
  PID:13932
- C:\Windows\System\divjoLr.exe
  C:\Windows\System\divjoLr.exe
  2⤵
  PID:14064
- C:\Windows\System\NqszjhD.exe
  C:\Windows\System\NqszjhD.exe
  2⤵
  PID:14100
- C:\Windows\System\TrZdaMP.exe
  C:\Windows\System\TrZdaMP.exe
  2⤵
  PID:14172
- C:\Windows\System\QIgPLLN.exe
  C:\Windows\System\QIgPLLN.exe
  2⤵
  PID:14260
- C:\Windows\System\aGfHItM.exe
  C:\Windows\System\aGfHItM.exe
  2⤵
  PID:14272
- C:\Windows\System\CoQzdkD.exe
  C:\Windows\System\CoQzdkD.exe
  2⤵
  PID:14276
- C:\Windows\System\SirNUBh.exe
  C:\Windows\System\SirNUBh.exe
  2⤵
  PID:13388
- C:\Windows\System\cVvaDtV.exe
  C:\Windows\System\cVvaDtV.exe
  2⤵
  PID:13496
- C:\Windows\System\SVpUFbM.exe
  C:\Windows\System\SVpUFbM.exe
  2⤵
  PID:13532
- C:\Windows\System\IVUqVXQ.exe
  C:\Windows\System\IVUqVXQ.exe
  2⤵
  PID:14016
- C:\Windows\System\LeIqwfJ.exe
  C:\Windows\System\LeIqwfJ.exe
  2⤵
  PID:13760
- C:\Windows\System\CEaDcMp.exe
  C:\Windows\System\CEaDcMp.exe
  2⤵
  PID:14032
- C:\Windows\System\YREVXnx.exe
  C:\Windows\System\YREVXnx.exe
  2⤵
  PID:13960
- C:\Windows\System\UClmMXj.exe
  C:\Windows\System\UClmMXj.exe
  2⤵
  PID:13432
- C:\Windows\System\FUmbZaK.exe
  C:\Windows\System\FUmbZaK.exe
  2⤵
  PID:14356
- C:\Windows\System\iaNINku.exe
  C:\Windows\System\iaNINku.exe
  2⤵
  PID:14388
- C:\Windows\System\vQjnqpV.exe
  C:\Windows\System\vQjnqpV.exe
  2⤵
  PID:14416
- C:\Windows\System\POuEAil.exe
  C:\Windows\System\POuEAil.exe
  2⤵
  PID:14436
- C:\Windows\System\qWMUWNW.exe
  C:\Windows\System\qWMUWNW.exe
  2⤵
  PID:14460
- C:\Windows\System\xzSBVoV.exe
  C:\Windows\System\xzSBVoV.exe
  2⤵
  PID:14484
- C:\Windows\System\hcKXJDf.exe
  C:\Windows\System\hcKXJDf.exe
  2⤵
  PID:14512
- C:\Windows\System\tVPxsqj.exe
  C:\Windows\System\tVPxsqj.exe
  2⤵
  PID:14548
- C:\Windows\System\kJRSBkc.exe
  C:\Windows\System\kJRSBkc.exe
  2⤵
  PID:14572
- C:\Windows\System\EBCLSNu.exe
  C:\Windows\System\EBCLSNu.exe
  2⤵
  PID:14596
- C:\Windows\System\gEtATQw.exe
  C:\Windows\System\gEtATQw.exe
  2⤵
  PID:14628
- C:\Windows\System\kPYzNGw.exe
  C:\Windows\System\kPYzNGw.exe
  2⤵
  PID:14660
- C:\Windows\System\sFyDhlT.exe
  C:\Windows\System\sFyDhlT.exe
  2⤵
  PID:14684
- C:\Windows\System\qrBzDqu.exe
  C:\Windows\System\qrBzDqu.exe
  2⤵
  PID:14708
- C:\Windows\System\FSUAIzs.exe
  C:\Windows\System\FSUAIzs.exe
  2⤵
  PID:14736
- C:\Windows\System\sUwmWEN.exe
  C:\Windows\System\sUwmWEN.exe
  2⤵
  PID:14772
- C:\Windows\System\sCfhJRD.exe
  C:\Windows\System\sCfhJRD.exe
  2⤵
  PID:14808
- C:\Windows\System\pslnfQy.exe
  C:\Windows\System\pslnfQy.exe
  2⤵
  PID:14832
- C:\Windows\System\GYXfvom.exe
  C:\Windows\System\GYXfvom.exe
  2⤵
  PID:14876
- C:\Windows\System\GNDSfMA.exe
  C:\Windows\System\GNDSfMA.exe
  2⤵
  PID:14900
- C:\Windows\System\oXOPncv.exe
  C:\Windows\System\oXOPncv.exe
  2⤵
  PID:14928
- C:\Windows\System\deJstmw.exe
  C:\Windows\System\deJstmw.exe
  2⤵
  PID:14956
- C:\Windows\System\dIboAkp.exe
  C:\Windows\System\dIboAkp.exe
  2⤵
  PID:14980
- C:\Windows\System\chgSneA.exe
  C:\Windows\System\chgSneA.exe
  2⤵
  PID:15008
- C:\Windows\System\RaBOari.exe
  C:\Windows\System\RaBOari.exe
  2⤵
  PID:15040
- C:\Windows\System\eCYndPK.exe
  C:\Windows\System\eCYndPK.exe
  2⤵
  PID:15064
- C:\Windows\System\iYyKnFG.exe
  C:\Windows\System\iYyKnFG.exe
  2⤵
  PID:15092
- C:\Windows\System\hDuaoNQ.exe
  C:\Windows\System\hDuaoNQ.exe
  2⤵
  PID:15120
- C:\Windows\System\pQcmAkR.exe
  C:\Windows\System\pQcmAkR.exe
  2⤵
  PID:15156
- C:\Windows\System\QrhlLqc.exe
  C:\Windows\System\QrhlLqc.exe
  2⤵
  PID:15180
- C:\Windows\System\GsiLOfs.exe
  C:\Windows\System\GsiLOfs.exe
  2⤵
  PID:15216
- C:\Windows\System\CIfzDIQ.exe
  C:\Windows\System\CIfzDIQ.exe
  2⤵
  PID:15240
- C:\Windows\System\IvIVGIK.exe
  C:\Windows\System\IvIVGIK.exe
  2⤵
  PID:15272
- C:\Windows\System\QgXhUkH.exe
  C:\Windows\System\QgXhUkH.exe
  2⤵
  PID:15308
- C:\Windows\System\avKZINv.exe
  C:\Windows\System\avKZINv.exe
  2⤵
  PID:15332
- C:\Windows\System\CTzYrjv.exe
  C:\Windows\System\CTzYrjv.exe
  2⤵
  PID:15356
- C:\Windows\System\TClAaaZ.exe
  C:\Windows\System\TClAaaZ.exe
  2⤵
  PID:14076
- C:\Windows\System\oMdjrMR.exe
  C:\Windows\System\oMdjrMR.exe
  2⤵
  PID:14408
- C:\Windows\System\zbaNyza.exe
  C:\Windows\System\zbaNyza.exe
  2⤵
  PID:13524
- C:\Windows\System\xtXkqnI.exe
  C:\Windows\System\xtXkqnI.exe
  2⤵
  PID:13764
- C:\Windows\System\mAqVTeQ.exe
  C:\Windows\System\mAqVTeQ.exe
  2⤵
  PID:14432
- C:\Windows\System\apzYpDD.exe
  C:\Windows\System\apzYpDD.exe
  2⤵
  PID:14468
- C:\Windows\System\LiHnCRm.exe
  C:\Windows\System\LiHnCRm.exe
  2⤵
  PID:14608
- C:\Windows\System\DmJrkwj.exe
  C:\Windows\System\DmJrkwj.exe
  2⤵
  PID:14520
- C:\Windows\System\sNBfIse.exe
  C:\Windows\System\sNBfIse.exe
  2⤵
  PID:14720
- C:\Windows\System\djrLxjg.exe
  C:\Windows\System\djrLxjg.exe
  2⤵
  PID:14792
- C:\Windows\System\ewNUWOJ.exe
  C:\Windows\System\ewNUWOJ.exe
  2⤵
  PID:14816
- C:\Windows\System\PFkceoM.exe
  C:\Windows\System\PFkceoM.exe
  2⤵
  PID:14952
- C:\Windows\System\ZVWGVPo.exe
  C:\Windows\System\ZVWGVPo.exe
  2⤵
  PID:3280
- C:\Windows\System\keMCVco.exe
  C:\Windows\System\keMCVco.exe
  2⤵
  PID:15056
- C:\Windows\System\VGFffAK.exe
  C:\Windows\System\VGFffAK.exe
  2⤵
  PID:14992
- C:\Windows\System\IxrMmnF.exe
  C:\Windows\System\IxrMmnF.exe
  2⤵
  PID:15148
- C:\Windows\System\DEUeLTd.exe
  C:\Windows\System\DEUeLTd.exe
  2⤵
  PID:15108
- C:\Windows\System\WGjiFBn.exe
  C:\Windows\System\WGjiFBn.exe
  2⤵
  PID:15292
- C:\Windows\System\unhehsm.exe
  C:\Windows\System\unhehsm.exe
  2⤵
  PID:15204
- C:\Windows\System\YJZedrJ.exe
  C:\Windows\System\YJZedrJ.exe
  2⤵
  PID:15320
- C:\Windows\System\DhaRxKJ.exe
  C:\Windows\System\DhaRxKJ.exe
  2⤵
  PID:15236
- C:\Windows\System\MRleUsM.exe
  C:\Windows\System\MRleUsM.exe
  2⤵
  PID:14412
- C:\Windows\System\nQMCZeb.exe
  C:\Windows\System\nQMCZeb.exe
  2⤵
  PID:13828
- C:\Windows\System\InTnHgt.exe
  C:\Windows\System\InTnHgt.exe
  2⤵
  PID:14692
- C:\Windows\System\wJwLDLw.exe
  C:\Windows\System\wJwLDLw.exe
  2⤵
  PID:14840
- C:\Windows\System\lDXUAnk.exe
  C:\Windows\System\lDXUAnk.exe
  2⤵
  PID:14888
- C:\Windows\System\uAysnRC.exe
  C:\Windows\System\uAysnRC.exe
  2⤵
  PID:15144
- C:\Windows\System\idnHWxi.exe
  C:\Windows\System\idnHWxi.exe
  2⤵
  PID:15368
- C:\Windows\System\kKeeKql.exe
  C:\Windows\System\kKeeKql.exe
  2⤵
  PID:15384
- C:\Windows\System\DRjOkng.exe
  C:\Windows\System\DRjOkng.exe
  2⤵
  PID:15412
- C:\Windows\System\kjplIIL.exe
  C:\Windows\System\kjplIIL.exe
  2⤵
  PID:15440
- C:\Windows\System\LzvmrvI.exe
  C:\Windows\System\LzvmrvI.exe
  2⤵
  PID:15464
- C:\Windows\System\ueMSurU.exe
  C:\Windows\System\ueMSurU.exe
  2⤵
  PID:15480
- C:\Windows\System\CmGNpUu.exe
  C:\Windows\System\CmGNpUu.exe
  2⤵
  PID:15508
- C:\Windows\System\CuOyxXd.exe
  C:\Windows\System\CuOyxXd.exe
  2⤵
  PID:15532
- C:\Windows\System\oueGEJu.exe
  C:\Windows\System\oueGEJu.exe
  2⤵
  PID:15568
- C:\Windows\System\JzlwlVP.exe
  C:\Windows\System\JzlwlVP.exe
  2⤵
  PID:15584
- C:\Windows\System\euuMEmn.exe
  C:\Windows\System\euuMEmn.exe
  2⤵
  PID:15624
- C:\Windows\System\tcsHeEu.exe
  C:\Windows\System\tcsHeEu.exe
  2⤵
  PID:15652
- C:\Windows\System\rAGuNWD.exe
  C:\Windows\System\rAGuNWD.exe
  2⤵
  PID:15684
- C:\Windows\System\DWYPsty.exe
  C:\Windows\System\DWYPsty.exe
  2⤵
  PID:15708
- C:\Windows\System\vKceIyK.exe
  C:\Windows\System\vKceIyK.exe
  2⤵
  PID:15732
- C:\Windows\System\zFyqqdE.exe
  C:\Windows\System\zFyqqdE.exe
  2⤵
  PID:15768
- C:\Windows\System\tUIqYjx.exe
  C:\Windows\System\tUIqYjx.exe
  2⤵
  PID:15808
- C:\Windows\System\oBfZNSB.exe
  C:\Windows\System\oBfZNSB.exe
  2⤵
  PID:15836
- C:\Windows\System\LAEJeYM.exe
  C:\Windows\System\LAEJeYM.exe
  2⤵
  PID:15864
- C:\Windows\System\BYQtmTu.exe
  C:\Windows\System\BYQtmTu.exe
  2⤵
  PID:15892
- C:\Windows\System\fKhjxVm.exe
  C:\Windows\System\fKhjxVm.exe
  2⤵
  PID:15916
- C:\Windows\System\nXhdArC.exe
  C:\Windows\System\nXhdArC.exe
  2⤵
  PID:15952
- C:\Windows\System\zgCzwih.exe
  C:\Windows\System\zgCzwih.exe
  2⤵
  PID:15984
- C:\Windows\System\pAOgusk.exe
  C:\Windows\System\pAOgusk.exe
  2⤵
  PID:16004
- C:\Windows\System\bHHwVHO.exe
  C:\Windows\System\bHHwVHO.exe
  2⤵
  PID:16024
- C:\Windows\System\suzauYG.exe
  C:\Windows\System\suzauYG.exe
  2⤵
  PID:16052
- C:\Windows\System\UrlfFxR.exe
  C:\Windows\System\UrlfFxR.exe
  2⤵
  PID:16100
- C:\Windows\System\IbCHiWj.exe
  C:\Windows\System\IbCHiWj.exe
  2⤵
  PID:16116
- C:\Windows\System\hJeRzqL.exe
  C:\Windows\System\hJeRzqL.exe
  2⤵
  PID:16144
- C:\Windows\System\bruvpSP.exe
  C:\Windows\System\bruvpSP.exe
  2⤵
  PID:16176
- C:\Windows\System\hYpTvZz.exe
  C:\Windows\System\hYpTvZz.exe
  2⤵
  PID:16200
- C:\Windows\System\qJPhAAV.exe
  C:\Windows\System\qJPhAAV.exe
  2⤵
  PID:16236
- C:\Windows\System\cCsVhiD.exe
  C:\Windows\System\cCsVhiD.exe
  2⤵
  PID:16256
- C:\Windows\System\XoEfMNa.exe
  C:\Windows\System\XoEfMNa.exe
  2⤵
  PID:16280
- C:\Windows\System\lUdFVlj.exe
  C:\Windows\System\lUdFVlj.exe
  2⤵
  PID:16308
- C:\Windows\System\hFUkukO.exe
  C:\Windows\System\hFUkukO.exe
  2⤵
  PID:16332
- C:\Windows\System\saTWByS.exe
  C:\Windows\System\saTWByS.exe
  2⤵
  PID:16348
- C:\Windows\System\HBNnCYb.exe
  C:\Windows\System\HBNnCYb.exe
  2⤵
  PID:16364
- C:\Windows\System\ToqvElg.exe
  C:\Windows\System\ToqvElg.exe
  2⤵
  PID:14652
- C:\Windows\System\dUmWjMS.exe
  C:\Windows\System\dUmWjMS.exe
  2⤵
  PID:14384
- C:\Windows\System\KbkxkQt.exe
  C:\Windows\System\KbkxkQt.exe
  2⤵
  PID:14612
- C:\Windows\System\ZIAIeyS.exe
  C:\Windows\System\ZIAIeyS.exe
  2⤵
  PID:15456
- C:\Windows\System\OkKVWTL.exe
  C:\Windows\System\OkKVWTL.exe
  2⤵
  PID:15376
- C:\Windows\System\RLHWbgG.exe
  C:\Windows\System\RLHWbgG.exe
  2⤵
  PID:15544
- C:\Windows\System\XCwBQlr.exe
  C:\Windows\System\XCwBQlr.exe
  2⤵
  PID:15472
- C:\Windows\System\AYxuVeo.exe
  C:\Windows\System\AYxuVeo.exe
  2⤵
  PID:15396
- C:\Windows\System\GdPYeOR.exe
  C:\Windows\System\GdPYeOR.exe
  2⤵
  PID:15704
- C:\Windows\System\eFLqUoZ.exe
  C:\Windows\System\eFLqUoZ.exe
  2⤵
  PID:15720
- C:\Windows\System\TksKMvF.exe
  C:\Windows\System\TksKMvF.exe
  2⤵
  PID:15752
- C:\Windows\System\ZDbsGRI.exe
  C:\Windows\System\ZDbsGRI.exe
  2⤵
  PID:15824
- C:\Windows\System\KGvSZxX.exe
  C:\Windows\System\KGvSZxX.exe
  2⤵
  PID:15848
- C:\Windows\System\PlRByfG.exe
  C:\Windows\System\PlRByfG.exe
  2⤵
  PID:15944
- C:\Windows\System\eoQpzDr.exe
  C:\Windows\System\eoQpzDr.exe
  2⤵
  PID:15964
- C:\Windows\System\pDmNQBV.exe
  C:\Windows\System\pDmNQBV.exe
  2⤵
  PID:16000
- C:\Windows\System\uJylnur.exe
  C:\Windows\System\uJylnur.exe
  2⤵
  PID:15232
- C:\Windows\System\TLdYMJH.exe
  C:\Windows\System\TLdYMJH.exe
  2⤵
  PID:16192
- C:\Windows\System\MUBnwOt.exe
  C:\Windows\System\MUBnwOt.exe
  2⤵
  PID:14480
- C:\Windows\System\UTLVhdk.exe
  C:\Windows\System\UTLVhdk.exe
  2⤵
  PID:15380
- C:\Windows\System\YUBWTxb.exe
  C:\Windows\System\YUBWTxb.exe
  2⤵
  PID:15176
- C:\Windows\System\qFNzOgH.exe
  C:\Windows\System\qFNzOgH.exe
  2⤵
  PID:14732
- C:\Windows\System\RsXhfPW.exe
  C:\Windows\System\RsXhfPW.exe
  2⤵
  PID:16392
- C:\Windows\System\rFkrCbI.exe
  C:\Windows\System\rFkrCbI.exe
  2⤵
  PID:16408
- C:\Windows\System\BnjPEug.exe
  C:\Windows\System\BnjPEug.exe
  2⤵
  PID:16440
- C:\Windows\System\UXGHBMD.exe
  C:\Windows\System\UXGHBMD.exe
  2⤵
  PID:16460
- C:\Windows\System\fqYWMOJ.exe
  C:\Windows\System\fqYWMOJ.exe
  2⤵
  PID:16484
- C:\Windows\System\CbWbkML.exe
  C:\Windows\System\CbWbkML.exe
  2⤵
  PID:16528
- C:\Windows\System\QEusWsa.exe
  C:\Windows\System\QEusWsa.exe
  2⤵
  PID:16556
- C:\Windows\System\HkjZiif.exe
  C:\Windows\System\HkjZiif.exe
  2⤵
  PID:16576
- C:\Windows\System\MAqYhlC.exe
  C:\Windows\System\MAqYhlC.exe
  2⤵
  PID:16620
- C:\Windows\System\JjnTSsT.exe
  C:\Windows\System\JjnTSsT.exe
  2⤵
  PID:16648
- C:\Windows\System\KPYYpQs.exe
  C:\Windows\System\KPYYpQs.exe
  2⤵
  PID:16676
- C:\Windows\System\QTbNkiu.exe
  C:\Windows\System\QTbNkiu.exe
  2⤵
  PID:16696
- C:\Windows\System\SEsnEMS.exe
  C:\Windows\System\SEsnEMS.exe
  2⤵
  PID:16724
- C:\Windows\System\uWtLHdd.exe
  C:\Windows\System\uWtLHdd.exe
  2⤵
  PID:16752
- C:\Windows\System\MTUusNH.exe
  C:\Windows\System\MTUusNH.exe
  2⤵
  PID:16784
- C:\Windows\System\fipsRRg.exe
  C:\Windows\System\fipsRRg.exe
  2⤵
  PID:16824
- C:\Windows\System\ucyKygK.exe
  C:\Windows\System\ucyKygK.exe
  2⤵
  PID:16852
- C:\Windows\System\DOtqvhD.exe
  C:\Windows\System\DOtqvhD.exe
  2⤵
  PID:16880
- C:\Windows\System\KnPNhiY.exe
  C:\Windows\System\KnPNhiY.exe
  2⤵
  PID:16912
- C:\Windows\System\ZzOgTBj.exe
  C:\Windows\System\ZzOgTBj.exe
  2⤵
  PID:16940
- C:\Windows\System\cZQZTlu.exe
  C:\Windows\System\cZQZTlu.exe
  2⤵
  PID:16968
- C:\Windows\System\IHhVTSH.exe
  C:\Windows\System\IHhVTSH.exe
  2⤵
  PID:17000
- C:\Windows\System\qwkLDrK.exe
  C:\Windows\System\qwkLDrK.exe
  2⤵
  PID:17036
- C:\Windows\System\vBldWzn.exe
  C:\Windows\System\vBldWzn.exe
  2⤵
  PID:17124
- C:\Windows\System\rewcVvH.exe
  C:\Windows\System\rewcVvH.exe
  2⤵
  PID:17152
- C:\Windows\System\MxGelBe.exe
  C:\Windows\System\MxGelBe.exe
  2⤵
  PID:17192
- C:\Windows\System\kwWwoNs.exe
  C:\Windows\System\kwWwoNs.exe
  2⤵
  PID:17232
- C:\Windows\System\ajOCWNH.exe
  C:\Windows\System\ajOCWNH.exe
  2⤵
  PID:17256
- C:\Windows\System\oLxNHAs.exe
  C:\Windows\System\oLxNHAs.exe
  2⤵
  PID:17312
- C:\Windows\System\zbSilVs.exe
  C:\Windows\System\zbSilVs.exe
  2⤵
  PID:17340
- C:\Windows\System\OofATAs.exe
  C:\Windows\System\OofATAs.exe
  2⤵
  PID:17364
- C:\Windows\System\EdFwZGa.exe
  C:\Windows\System\EdFwZGa.exe
  2⤵
  PID:17380
- C:\Windows\System\CqzRIWl.exe
  C:\Windows\System\CqzRIWl.exe
  2⤵
  PID:17404
- C:\Windows\System\TUemyXd.exe
  C:\Windows\System\TUemyXd.exe
  2⤵
  PID:14972
- C:\Windows\System\dHYbTAU.exe
  C:\Windows\System\dHYbTAU.exe
  2⤵
  PID:15744
- C:\Windows\System\vuNhBKt.exe
  C:\Windows\System\vuNhBKt.exe
  2⤵
  PID:15672
- C:\Windows\System\buluGfo.exe
  C:\Windows\System\buluGfo.exe
  2⤵
  PID:16080
- C:\Windows\System\ilxWvEa.exe
  C:\Windows\System\ilxWvEa.exe
  2⤵
  PID:16208
- C:\Windows\System\KfplMKG.exe
  C:\Windows\System\KfplMKG.exe
  2⤵
  PID:16140
- C:\Windows\System\DcuSkfu.exe
  C:\Windows\System\DcuSkfu.exe
  2⤵
  PID:16476
- C:\Windows\System\TAERGXE.exe
  C:\Windows\System\TAERGXE.exe
  2⤵
  PID:16448
- C:\Windows\System\JhHeqxb.exe
  C:\Windows\System\JhHeqxb.exe
  2⤵
  PID:16504
- C:\Windows\System\DyaZyfc.exe
  C:\Windows\System\DyaZyfc.exe
  2⤵
  PID:16540
- C:\Windows\System\TpnXLXJ.exe
  C:\Windows\System\TpnXLXJ.exe
  2⤵
  PID:16588
- C:\Windows\System\MuzkSZs.exe
  C:\Windows\System\MuzkSZs.exe
  2⤵
  PID:16796
- C:\Windows\System\sswDvgn.exe
  C:\Windows\System\sswDvgn.exe
  2⤵
  PID:16868
- C:\Windows\System\WDSvVsK.exe
  C:\Windows\System\WDSvVsK.exe
  2⤵
  PID:16956
- C:\Windows\System\gWSuYSz.exe
  C:\Windows\System\gWSuYSz.exe
  2⤵
  PID:16996
- C:\Windows\System\OqQPrgL.exe
  C:\Windows\System\OqQPrgL.exe
  2⤵
  PID:16820
- C:\Windows\System\WwLtOsT.exe
  C:\Windows\System\WwLtOsT.exe
  2⤵
  PID:16872
- C:\Windows\System\cIhEvqL.exe
  C:\Windows\System\cIhEvqL.exe
  2⤵
  PID:17084
- C:\Windows\System\HBVxvzU.exe
  C:\Windows\System\HBVxvzU.exe
  2⤵
  PID:17216
- C:\Windows\System\VkDurlO.exe
  C:\Windows\System\VkDurlO.exe
  2⤵
  PID:1824
- C:\Windows\System\FYJXZhj.exe
  C:\Windows\System\FYJXZhj.exe
  2⤵
  PID:17324
- C:\Windows\System\FKwHoRu.exe
  C:\Windows\System\FKwHoRu.exe
  2⤵
  PID:17376
- C:\Windows\System\UMljBXQ.exe
  C:\Windows\System\UMljBXQ.exe
  2⤵
  PID:15820
- C:\Windows\System\RaVvycf.exe
  C:\Windows\System\RaVvycf.exe
  2⤵
  PID:15404
- C:\Windows\System\SYLvVju.exe
  C:\Windows\System\SYLvVju.exe
  2⤵
  PID:14672
- C:\Windows\System\bekKsTg.exe
  C:\Windows\System\bekKsTg.exe
  2⤵
  PID:16792
- C:\Windows\System\jCRYhnA.exe
  C:\Windows\System\jCRYhnA.exe
  2⤵
  PID:16764
- C:\Windows\System\SoFwMdS.exe
  C:\Windows\System\SoFwMdS.exe
  2⤵
  PID:17140
- C:\Windows\System\NFMRuNm.exe
  C:\Windows\System\NFMRuNm.exe
  2⤵
  PID:3484
- C:\Windows\System\wCRXBXl.exe
  C:\Windows\System\wCRXBXl.exe
  2⤵
  PID:17396
- C:\Windows\System\bnyeUrw.exe
  C:\Windows\System\bnyeUrw.exe
  2⤵
  PID:17264
- C:\Windows\System\hpFTJfN.exe
  C:\Windows\System\hpFTJfN.exe
  2⤵
  PID:16744
- C:\Windows\System\wSyCKKK.exe
  C:\Windows\System\wSyCKKK.exe
  2⤵
  PID:16656
- C:\Windows\System\MFiQkoy.exe
  C:\Windows\System\MFiQkoy.exe
  2⤵
  PID:5020
- C:\Windows\System\YAcagHU.exe
  C:\Windows\System\YAcagHU.exe
  2⤵
  PID:17516
- C:\Windows\System\kVfzGId.exe
  C:\Windows\System\kVfzGId.exe
  2⤵
  PID:17708

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BGIMGCs.exe

Filesize
1.9MB

MD5
9e2ab449a9b157be56ee97dd9bf80bfc

SHA1
9fa328fa8d7d92eceed04d70f708503f46f797de

SHA256
4f488b575bb15203a03d420a7d5b34c547e9050344e6b63444871cd264a03ea4

SHA512
987d32324617a7fd6dfafbaade2684537d17ab0bda8d5d258fa71491f4682eae90d2be2c0a989ed1c3ee4bea2a38f84e9fd69069e3ba2f91785b93f5639e65cb

Download Submit
C:\Windows\System\BwvxrOv.exe

Filesize
1.9MB

MD5
5e70fbe8808fc5c5cf5f5257b40015ab

SHA1
caefc6053dd8a999581df2cf42e2de2c77d6a685

SHA256
5583897b0cecfc3ca89c887aa039725e69d4fcec31f25ccdf9ff2bbc20946294

SHA512
87ffc06738795b17e555bc4166922e1690c883c42ecc5995b520b06d8ed18bed141b2d3797ffc727bb48293fdc0d15738400116893b64923383de9a84cf33237

Download Submit
C:\Windows\System\CsrYmUo.exe

Filesize
1.9MB

MD5
104df271b2e26749329bf2100090c221

SHA1
29cad09e60027341dbe831debc70f579cda551ee

SHA256
22cc4db8bf9761ba589580419cf632d38475f6c58331b5348bf82027624bd947

SHA512
ecdfc0d2cac1ddc6f7f454014b0f5c8f1c1c67747965b58456022dba6f39b34ba0b7c62e239ee0399a9b17c790c749997e4178d0e958ba6d73cc5085cc7d0bfa

Download Submit
C:\Windows\System\EbdUsGT.exe

Filesize
1.9MB

MD5
858dbc80e99988117ef3fff94986f1b7

SHA1
13cebe16c3a6893e47c9606e25b7c45164e28638

SHA256
0a21d9e8b4a963caadfe7584d602fa33a12518d0a7d7abf66bb34e097998ced6

SHA512
f126f5721b6f74102a17d1de853b176f52084738c8c2edeaf1f2707e3a6ea9e5939f6328ad26e927bc83a325ba0b4f935d66035b9d80d5160cd69a05a3519346

Download Submit
C:\Windows\System\HCPCGin.exe

Filesize
1.9MB

MD5
2a4ddd9eab1ccff92abbc57415168b4e

SHA1
e118cb0546afa86abf1128cd3a3d998629a6dd02

SHA256
fa093b97adc708e01ebd4063cc42a763901441942c50e53eb0bc5bca985240b6

SHA512
16d2a8bd758672d06cc7ba857cadb19231e05e605634027955f792d0f1c9701102dae405f10c0be37131fd88716c5b6573626e12a229148368bf6e8c2278f7ca

Download Submit
C:\Windows\System\JoYfSCw.exe

Filesize
1.9MB

MD5
417cba1579d91336ebcc9c647c45c7b8

SHA1
ab424362a58fd8e5404cf4909f66e9967ecf18b3

SHA256
15275a0436f2e62fccb2db307f88f5306fef54f9ec5c887917bc6e0d7a538a62

SHA512
a121bb5ad7dbb218c64afc65bfbf73d091191d39c36244a098538c49a8e3efac4d28a413e5ad45f6529e906d6d54355d5103346add31ec3682cfc8f4d36ff4d1

Download Submit
C:\Windows\System\KALsIuz.exe

Filesize
1.9MB

MD5
acb3897a72710f3dc05c970b9cbad8ad

SHA1
c2f692e4146f31b7ad48c8526e759f743e6f501a

SHA256
ed87c0d93419a0b535252c1c2da6d3d75ac2e65891e81716929b5cafb62e9cb5

SHA512
6e80374762fd8f39d0944f62201e8ad57e1b12fad97603b0506792f6fc9271e95d147620ddd787b8b74345a2be4da6216dd73783d207c10a2c844de05686ce8b

Download Submit
C:\Windows\System\KGGbwii.exe

Filesize
1.9MB

MD5
d9ba2cd8141e97ca2265fe5fe6f95d06

SHA1
94ddebecbac8fb4ead4b7e7b46ba0cf92b836e4c

SHA256
2df2b51d4eb512840265f336df2bef3bfe475560b14b2321b19939d773160837

SHA512
36cdb90665465e33a857e5e9f578d77134889c1d697f6f0c62249711b42ba3d5cd93256b3e355ee1390b380b3e9fe50c3e93b968fe21c91eda3c6b3ed1206288

Download Submit
C:\Windows\System\KhyxNYg.exe

Filesize
1.9MB

MD5
a4083f73ca103aaf4fa23c3543cfd8f5

SHA1
6a5d32020ba1fa3ca9cae3250b3c579cf583ca90

SHA256
9e0400849e197a3f4ab744f7358332b3cfa017c6c8a87e4e182ea86a91feafde

SHA512
0460eeebc885574aa03ecf0f9dfd43e872222a664677137ff6fb22f6977e0a8a16d9965f60c1a1b5bfa554c45e08680627d868f3c4b5c398326247dca63671f7

Download Submit
C:\Windows\System\OIprpHJ.exe

Filesize
1.9MB

MD5
284f6a5195658bb44bb906116f812da3

SHA1
a660801bfd4b3cdfc374c84b0b7cd8df3b420664

SHA256
b7090c60fa66e0297a9c8803499185babd6a7566de5320b6e8e78d6a414ae054

SHA512
28d46ac3efb7afdbebbbde8c842b33f53a82dd0625772755bca2aea039bf2c336f0a4f29fc22ed65a6553b8f0cacce66187c172cbcdc4b0bde7db7c801110177

Download Submit
C:\Windows\System\OaYIUFI.exe

Filesize
1.9MB

MD5
2d668805be36c5002f9e163c0ce4cf00

SHA1
74aa02dbbf3a5d82746b417cb0bb94920445ecbe

SHA256
78d9c152a6e7f5de4461e89dbde07e80fd063e5a9da8f39854df04ec84498830

SHA512
486811ed1cfc157be1586513a695da5d776a33d72d55f570c80ee8724edcbb639fb8281181894259914d4c165bae69a164aba32e7d31f5dbccd00643c11fe8e6

Download Submit
C:\Windows\System\QXmflEv.exe

Filesize
1.9MB

MD5
412e81673f769479081ec500c49e795c

SHA1
32cac440b041f2b98e12f6a21286e7d2e263c466

SHA256
7ef1ced36a83024a50a19055ce172d703141555b26c6bce13dc948312840db9b

SHA512
8b9275aec32b86c23150458b4b2620f58870453932044048e0ddd6695c99a827a4d2ad62300bb787d161919a4a4976ffdc402270d1ccb897e120b45873e4a6e9

Download Submit
C:\Windows\System\QeZFKqD.exe

Filesize
1.9MB

MD5
0bbc9c43f7c1ba713913838c051c5404

SHA1
5ea0c875db2404db0a3291505d3285f60937df48

SHA256
1b00ad5accca09bf9a76246cb87aa2b69907c7dd01b89cd0413eb38217d1ae4a

SHA512
7820c1dacd2a9e078d6110f6d78abaaeade653f9f728bdd4ea1a0cfeaafa001484910ec032b49b06e4544bc617a3468a4c01f7bb64157259f067eae2194b9192

Download Submit
C:\Windows\System\QxnXUgx.exe

Filesize
1.9MB

MD5
0cb6c3c9365b0bff9b323f64eddd748b

SHA1
e253922953decd407fc58bc4cf8144a393a6fbb6

SHA256
bbaad23d6046a9167f0598974f06808b04d97cc1d122da145936274f2d0667ca

SHA512
5517ab82dfa1705ba1cb7396bb29ea9dc2531027c6c8e268b19f81672ba5e81e790fcd72b4a3877375829b72dc37e16d853605cfb6540d54c9224a02394a161e

Download Submit
C:\Windows\System\RKLauUq.exe

Filesize
1.9MB

MD5
3164181e07bf48a857f1499526b4afbe

SHA1
69d30c7daeeeccf2e704b2cc8226c13859b1b5b1

SHA256
6d6e3d2501cc37525a8910c54166b7aae288fc7773a074ec9447206f62d45fa9

SHA512
966e7569629e15ae07b49f4a1c0c96013e55d77026d5241b6b733e5ab681204fe4d0c45a0eca3cce45e674fb5b1c14cb08b310c218847fc5ceaca2ebb4d3215b

Download Submit
C:\Windows\System\RvGkInj.exe

Filesize
1.9MB

MD5
75d1f4053a54cbf78bcaf40da8f2b8c4

SHA1
87a2b6f20fd14aced7cd1b36315516e5c63315f9

SHA256
5229d6f21300b9005240387ed9ac6c8d78c6554b9b487dbdb7538f34da805532

SHA512
31a457f7709d939409c054c26050399b8670bf5b44879f1a8bbc24fd173262b381e0e6c065c9699a0406932b146727c7742c11550e4b9e8d968047838e8c3fcf

Download Submit
C:\Windows\System\RwCRFHW.exe

Filesize
1.9MB

MD5
65536792230be367158ae16db10f6d9c

SHA1
933508b44926060130e1553a2857609e531f9e4a

SHA256
389681c197b53b4e0438e015aa29c51d3c4d4032541c7a6b96f5e5d997930a55

SHA512
549c1bc94e24c300166a3f71c1d3484fc893444de678597e7e4b9613c0cb6321a7ee43604cd4bba807fd5e98363a190d68c0c79546263aa32958579d57213f58

Download Submit
C:\Windows\System\SnKsaRY.exe

Filesize
1.9MB

MD5
ee922800415db172a6b70f9aa23a3d24

SHA1
ced0a47c5a8c29d6241c46ab7d6604bd1bc66354

SHA256
6ec377afb81a3a5c35324d26a055f7181a98507d3b224703df0f4c43e76f60d0

SHA512
3f003f990bd38550bd4638a5aac170a727b035e2401be87fae9ea529b2929d064897b637604dba4cbbc14e0af82c9d857342affa25bb67022dcb081968f6872c

Download Submit
C:\Windows\System\TkNOHeQ.exe

Filesize
1.9MB

MD5
0ea930d7e30d8f8ff482daa2124be442

SHA1
c8cf0f569f872136a3b369169f05010468d7ad33

SHA256
3da5fc449fa28624545d8cd0f89b26ff322471a68b155a377912b6b9c9b50943

SHA512
c17b3b879c6f438478915782923c1b5a18702a57c3a5f0617215a8fdc1d4b9cc087fefa7890c863db25ae069490f028f729e9e73e8027055748e7638200c1572

Download Submit
C:\Windows\System\VSuvyBS.exe

Filesize
1.9MB

MD5
11e3e7accba8acaa490e2d4cc43cd3fc

SHA1
79e96851e3001406273fa16f7a4ad94fb7186da4

SHA256
9263c4622d38b52abed9804b42091d54044d26e12fd75385b45a3efdfa50bd77

SHA512
c7814914022316e2d0a48696311a8209340868558575875b75931c9a45a9f3ff228c3773d225c3aaa309bd092faa36edc04d908e9e9c3394c0128565dcdb704d

Download Submit
C:\Windows\System\VaoeWbK.exe

Filesize
1.9MB

MD5
27a887603ea5c565b1d1387511056ec3

SHA1
a17cd78c58845b9729d573d0ea8ee5249b2275e3

SHA256
37d2ba885d52535399e30d91a5adaf21e55dee8dfa4041f860adc105678dc286

SHA512
038d8a1c53afae7888e6b8761c2e344596d2bc026f2fa12d073e254cbfe93ef1874658d772f5b81530f19aa1192f7e3dbcaff532aebaeb2100f4306a67fcf33b

Download Submit
C:\Windows\System\WfTSfEq.exe

Filesize
1.9MB

MD5
23d52f08837f82d133762a0acf242544

SHA1
1e00440b7ed669acd59efdec56740f72451a900f

SHA256
ce3073f43c02fc949ac78ab0f297d4b04d864703c5ed7c35e86f5839bbf18eff

SHA512
afc85809db1158cebf48d6253592d3073b60bdc8241277cb55cb6d21a4f9eac3bbaf6f2a8be694c938ab25545d792fe2514ec9e81b3b6840be8eaceee6ed0cf9

Download Submit
C:\Windows\System\YBKRTTo.exe

Filesize
1.9MB

MD5
3dbf45c9111f6b0a0f76b527e2896ded

SHA1
72d2fdfa3590bc3ee2ba8480de56e46461326f55

SHA256
233b9a3fd804e9307742863ca6ae94a1e031112502ebf0fbb534c0b075457b07

SHA512
b019fea3811b4764c5a86f8d1d59f9e3d2f4e4d0ed21b29063cabdb18a1cbb4c1f2c3c6515762bc2ef58637e6b91106d45dac814a5653bc77f625046a4c5cf55

Download Submit
C:\Windows\System\ZcAeToC.exe

Filesize
1.9MB

MD5
ba9f746f8db5aff9cd06598485e6b1e4

SHA1
ada0017ccef1821bb2c5045963a040c1c689fa2c

SHA256
ca36d3f991be87b26b33a0a82d71ecdd85a9c79e55e741ffd53bf1149db8ba1c

SHA512
3c8c8ac21778656b5c65b4b957b08a07f767430b997a0d44fdc54bb0c922295039de86a4c7d741ef662525fd4b2ab37db61cee2a0c8eed47581202390ffc7196

Download Submit
C:\Windows\System\aDDZOan.exe

Filesize
1.9MB

MD5
9e275f50d5cf9b72e2ab2bed767c9018

SHA1
311ba7a24d24e5ddc1de41799c11d0d96fb0be3e

SHA256
e6518ff7f3ecc444031e696d35f9bdb705e1bdd18edb2d423384e2270c5d943f

SHA512
420b0fe754487f3c904ad8428af20fbdd5799cfe139fb36628380cecc9f83535a87d0bcbb69eb96559668c38bcfa4759231d99ed979c900d6329ed3c7c138c1b

Download Submit
C:\Windows\System\aPolFYO.exe

Filesize
1.9MB

MD5
86c64634d4a3dc83e8bc982cc550f13d

SHA1
f652065a250cc6a2243afe020e6a29e72b7ed7b4

SHA256
d17d52b649886182444f6318c29c65da1ca7c324302109c9514f17088ea8df82

SHA512
4a90e34f0681c639a20d284f927803a706e499ad817a6e5315f70cb086661d7c5d269d5f5a4537b05afadff39c60432ad6901741fa68d72efd1c42bde3b4b232

Download Submit
C:\Windows\System\cidEHZr.exe

Filesize
1.9MB

MD5
ecbaa0792c4e0814eb55aba5dd5a4a80

SHA1
940c084b6186d3372427ba4de18a7c700e6f0e02

SHA256
5c2f42b24e81bf67a4e40d4df0dad6471442829e1c44bae1a14c2b66deca2fb7

SHA512
a132f30a1d4e89b965b2afe024b84a4ed84bf62a1a2f1dc16cae749a82f49b9b4b7edf318ef9acdee4c5f4512a21c08f33c174c312b5e0c066d66bb09cfce94e

Download Submit
C:\Windows\System\eaAaFZi.exe

Filesize
1.9MB

MD5
2e34554da7ee7dec9db7a253371b1074

SHA1
ef6eca61a153d17227b41fb4e546ad3ffbfb59a3

SHA256
660c98facdcabab1801172c235839239832241cb70cbc4571d3adb8d98ddfc90

SHA512
96fccb16f32fc58b22677797fb6b86a6ccb325961b48b2ad3a40e7f7601fe31d793840cf12a75a3fc0cb4838a0129216017195cc81a5af354febb7fb21792eb5

Download Submit
C:\Windows\System\jAlpXZE.exe

Filesize
1.9MB

MD5
c4813d775d4f57ab9c1dfea0351d455a

SHA1
13e53d7500b55f13e0977831e6e10eae51613844

SHA256
a37251c59e3df963086c6647a5b89325a738eed0e3edd4cf927536a03f5ffe6e

SHA512
e49d995ad7c75d0aa11f7c6c0b1585cccfc9e071d2a405d07874f2bf28e1fc121f22305d32e94bef75e445d279bafcdf22d8674c056b39b0c33894ffa9e67f9e

Download Submit
C:\Windows\System\mhfcVfO.exe

Filesize
1.9MB

MD5
10d184e042a8c4b8ebf8ca2d44167849

SHA1
7398a3c3c8e146c5d58248e60d82483f657c542d

SHA256
96b65d94aff355672bc92e5ccfa6732b8cdc4c32138eac494e3bfeee633b24f0

SHA512
592564fb0e474ff5dd9855d574d73e792b2bd50777abdf9d1b8f7766b0f191ddeb335fb8176c3e575cf42098848426fc9654da4601c7af17c2e7f829a85549da

Download Submit
C:\Windows\System\nDJiYsb.exe

Filesize
1.9MB

MD5
625227f4383395ff9b3277aac5eb1864

SHA1
f70513ed4bc1a24c2f4d36bdbd43e1cbd492bd61

SHA256
a87e8e305791e9dbc2aba6be4cebed91af3d43f8412f8b3384581f1f68f6df2f

SHA512
d6efb8f0d20b37d0b29c9f6cfc6bffd2bba214cb00808f7acfbd3c9bf4379441e1c33bca7bd058a8e5f89f6af4b55b57a2ff71aa3764a469c56f998fc4be251f

Download Submit
C:\Windows\System\pNxbbPt.exe

Filesize
1.9MB

MD5
b8fa1f2a3815d61e0c25fdad89924d6d

SHA1
328c923a57a5054945828574c3c1fa23eb5efe4c

SHA256
a14eb7c3929a326369b160b0193041007b720b3d66b540f76b002445792aa1ab

SHA512
bab1564c6d23bcd76763c439475fbba4c0c2306e2875d5bb834a48efb9f274a9fdb3d0efc58a6d9d71e0af91fbf3b952de3c187a8183bd622f3417c5e171972f

Download Submit
C:\Windows\System\pfcwMHu.exe

Filesize
1.9MB

MD5
56d676f43def29ea23ea3abaf120a6c0

SHA1
8853b81b6acbe87db163aa5506e2a4cafc3bbd86

SHA256
d390a3877a77a0f58e8e6349ef11d55a8fef952cec268a1e3e83d7cf0eade117

SHA512
46686b64f922852d125b04db4154d1bd9f5ce98f67d6ce85f017c076db651b6e4974923d99cc5ce9aa5cf4d2df5df641f7554fc04a1e7f5cf5c7c3e944929ebf

Download Submit
C:\Windows\System\rzZsOtO.exe

Filesize
1.9MB

MD5
3f9961c939f50d2019faf7e21ea617b4

SHA1
73b4b12e9ae8bb09143b077343a9044c9aea44d9

SHA256
03d45f2b0be7c3e01ef40c9a80783d9ddffe65383020fbe2993b272feed05d85

SHA512
52447e06a0afca734e4fb7690be5fbee3fe2f5d4bcfc2070323413741232a57f6bd6a817a01ac43bfbf3b21f8aadcc26b98539b3c392c7e0f943cb7c6392347b

Download Submit
C:\Windows\System\tkdxqLo.exe

Filesize
1.9MB

MD5
2b8ffb1e71a358e9a3df3a79823c310b

SHA1
230a905ee527373427c8ef9389a42228557a7cf2

SHA256
d3f4e78e783bd5e8ed556ae44b38ad96f05864b3ae910c366f07cae64f42cd31

SHA512
526e0f1e48e532af94f0d5278468f2c56aa42ebfea2598dd3224fbc80b391aa37996ce1d0e3963f191bc644175749d404915207fb2e55e976010eabc1c9ee56c

Download Submit
C:\Windows\System\vdrpaWG.exe

Filesize
1.9MB

MD5
5f3aa59f9ac809edf872d992e7963b17

SHA1
bfa22abb6d334ef79765285fa89fc0cd70405313

SHA256
c3fb2e4fd820bac70d93bd62da977906e223eaad442f75d9214b660ab436bcac

SHA512
d46ace9b5daa136a3e6af17ed5d472fdbb84b88feb3e62b60de2735ba1faaff257bcb4cdf505ddbc6edd24787609aae0e64b9603130fd9517cfc0517835134fd

Download Submit
C:\Windows\System\wLcyQsf.exe

Filesize
1.9MB

MD5
ebadd49ce71bfc55e1d63044f04a64d5

SHA1
1f36af6ca4822ec1565e655b23cccd48da9f3a54

SHA256
fcbec258a17a54670c19e1f6e5aed865eba0de1d652aeea3057120f49e3f7bf4

SHA512
1e15526674aeabb6da1d845eafe11d55c351cc6ea7af54cecce24b4947f9dcde23d34fc697aff1e059b2e90997c0f6f18717f04d5bc3a6a7d169b07cf4119aa2

Download Submit
C:\Windows\System\wfqjpqd.exe

Filesize
1.9MB

MD5
698dbf39cbc40d4f8e4679c8a5ae5088

SHA1
7143a065936ae21f2823ccbace69e7204bca3a25

SHA256
6029841889b73249ece006e5c8ce01579a3d02db1c562d10286ffb7eced1d8e6

SHA512
7b0ebfef52e84bbb4ad1fafad8a15a8f177c0e345f8185842aa44c3708ea4e8ff3f34182b3460e52c527b1405575a154e0d1aad8ba8ecb198931eaddb79c4693

Download Submit
memory/2248-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads