xmrig | 023e2151f3226ec74024b053eb2e615e7466bb28d9aafc29a471000354570a75

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
Size

1.7MB
MD5

92c8bd36f6ab7dba0380b58b4e19fa10
SHA1

187da7296652de0fe3673e7431f55baf9f67a874
SHA256

023e2151f3226ec74024b053eb2e615e7466bb28d9aafc29a471000354570a75
SHA512

6b0704aafa778cde56a23b42079755119a42192098c7488416c57e241632b44aeb1b74242a8b296401d5fa9431a7bd4568f3424d9d541babe58682370a51383d
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc5yT:GemTLkNdfE0pZaU

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000800000002342c-4.dat	xmrig
behavioral2/files/0x0007000000023434-8.dat	xmrig
behavioral2/files/0x0008000000023432-9.dat	xmrig
behavioral2/files/0x0007000000023435-17.dat	xmrig
behavioral2/files/0x0007000000023438-32.dat	xmrig
behavioral2/files/0x0007000000023437-31.dat	xmrig
behavioral2/files/0x0007000000023439-42.dat	xmrig
behavioral2/files/0x000700000002343a-41.dat	xmrig
behavioral2/files/0x000700000002343b-48.dat	xmrig
behavioral2/files/0x000700000002343c-54.dat	xmrig
behavioral2/files/0x0007000000023445-102.dat	xmrig
behavioral2/files/0x0007000000023447-112.dat	xmrig
behavioral2/files/0x000700000002344d-136.dat	xmrig
behavioral2/files/0x0007000000023452-161.dat	xmrig
behavioral2/files/0x0007000000023450-159.dat	xmrig
behavioral2/files/0x0007000000023451-156.dat	xmrig
behavioral2/files/0x000700000002344f-154.dat	xmrig
behavioral2/files/0x000700000002344e-149.dat	xmrig
behavioral2/files/0x000700000002344c-139.dat	xmrig
behavioral2/files/0x000700000002344b-134.dat	xmrig
behavioral2/files/0x000700000002344a-129.dat	xmrig
behavioral2/files/0x0007000000023449-119.dat	xmrig
behavioral2/files/0x0007000000023448-117.dat	xmrig
behavioral2/files/0x0007000000023446-106.dat	xmrig
behavioral2/files/0x0007000000023444-96.dat	xmrig
behavioral2/files/0x0007000000023443-89.dat	xmrig
behavioral2/files/0x0007000000023442-87.dat	xmrig
behavioral2/files/0x0007000000023441-82.dat	xmrig
behavioral2/files/0x0007000000023440-76.dat	xmrig
behavioral2/files/0x000700000002343f-72.dat	xmrig
behavioral2/files/0x000700000002343e-67.dat	xmrig
behavioral2/files/0x000700000002343d-62.dat	xmrig
behavioral2/files/0x0007000000023436-23.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2868	HnjLvyf.exe
3480	ydqWmir.exe
624	FXGSkpr.exe
2664	IWwAraN.exe
4756	JZTiCdl.exe
3620	VWGHEiv.exe
3880	lMjaQzq.exe
2356	EccxlWb.exe
4856	skKrHve.exe
3372	TGMYcax.exe
2668	LKxCvYn.exe
1744	qqnLRSy.exe
1900	NmJIsMt.exe
1852	pWQcDwq.exe
740	FoSwBcr.exe
2008	resEBQX.exe
1556	HDiAyPI.exe
2732	CrZxkmi.exe
2484	EPzIYGK.exe
4976	TkCTjLP.exe
4604	OJiuaAh.exe
4736	tFmAVyU.exe
1032	sEakPHg.exe
64	ZjmaEcm.exe
1220	ukaXsDM.exe
372	onrZRcX.exe
1896	psxDydD.exe
2328	elDvslY.exe
960	aVPyzZW.exe
4880	ujvxhpF.exe
1232	YAjvpiX.exe
4328	vrhobWT.exe
3068	loqicCv.exe
3244	lPNujMw.exe
4948	tjMPLKH.exe
4792	NiVWZIz.exe
4548	slsSdxo.exe
912	hojdFCm.exe
2456	GfjojeM.exe
3588	eGntkAm.exe
4944	eZzrNYm.exe
4296	GNwPJCd.exe
4292	KPUCpmA.exe
3584	eRzHmht.exe
4884	HPBaYer.exe
2024	dgwFUUR.exe
228	olWpzXf.exe
4340	KepijwA.exe
232	lNFAKjw.exe
4308	cZRwHgV.exe
60	dsGKCYP.exe
4544	jZpOReC.exe
2596	oCPzJef.exe
1240	vWQvCng.exe
3700	hSPWWcT.exe
976	uQdBYtY.exe
1064	WOCFTZL.exe
1712	STeVOkl.exe
2880	rxTznsG.exe
4112	rIbxbdp.exe
4312	bbQXsQv.exe
4988	EbwNnTg.exe
1916	TwkxGIH.exe
2452	hYxTuvP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TGMYcax.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\lfdBYxn.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\zyolPad.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\kUBcIYN.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\RMeAbQX.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\ddMOZvq.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\uRSZusv.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\uiNlyke.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\DyPJyNF.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\UvYLaMI.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\AICAWHm.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\IJGCFSG.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\WVCwOQT.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\aKVTikE.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\EbwNnTg.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\mZzxCCr.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\wuCZuwj.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\HMHgtFs.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\PWFKdQf.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\vrhobWT.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\OxnoFjg.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\FoSwBcr.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\SOSfoQS.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\HprJXhN.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\sGgtbQF.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\ZetrXQz.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\dfJKHQR.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\FRQGknX.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\CNZScSL.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\KgWNcAE.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\yrLsTqe.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\ccXYTkJ.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\bPjfOQY.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\KpozvcL.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\GBuzJqc.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\gtsITeD.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\bkTrGFd.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\FFrJFYX.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\TyfrbbJ.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\dbpfzAL.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\VOeRMKm.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\nskBflp.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\IqruNbY.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\IVbTUmt.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\jzCeTOo.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\QwmTEJY.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\cDFAxWy.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\aKZdrmt.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\UXOrVjJ.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\jxUpDsu.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\pKdURzF.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\eRzHmht.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\ewsOZNy.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\lQhFAyA.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\fvUBeKh.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\ckfHvha.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\vKrsdbv.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\xKtGHor.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\ehVVbIs.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\qyFTuMP.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\olWpzXf.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\HWDaZiu.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\XArSQef.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
File created	C:\Windows\System\kOEZIoV.exe	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	9032	dwm.exe
Token: SeChangeNotifyPrivilege	9032	dwm.exe
Token: 33	9032	dwm.exe
Token: SeIncBasePriorityPrivilege	9032	dwm.exe
Token: SeShutdownPrivilege	9032	dwm.exe
Token: SeCreatePagefilePrivilege	9032	dwm.exe
Token: SeShutdownPrivilege	9032	dwm.exe
Token: SeCreatePagefilePrivilege	9032	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2868	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	83
PID 1228 wrote to memory of 2868	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	83
PID 1228 wrote to memory of 3480	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	84
PID 1228 wrote to memory of 3480	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	84
PID 1228 wrote to memory of 624	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	85
PID 1228 wrote to memory of 624	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	85
PID 1228 wrote to memory of 2664	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	86
PID 1228 wrote to memory of 2664	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	86
PID 1228 wrote to memory of 4756	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	87
PID 1228 wrote to memory of 4756	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	87
PID 1228 wrote to memory of 3620	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	88
PID 1228 wrote to memory of 3620	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	88
PID 1228 wrote to memory of 3880	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	89
PID 1228 wrote to memory of 3880	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	89
PID 1228 wrote to memory of 2356	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	90
PID 1228 wrote to memory of 2356	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	90
PID 1228 wrote to memory of 4856	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	91
PID 1228 wrote to memory of 4856	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	91
PID 1228 wrote to memory of 3372	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	92
PID 1228 wrote to memory of 3372	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	92
PID 1228 wrote to memory of 2668	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	94
PID 1228 wrote to memory of 2668	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	94
PID 1228 wrote to memory of 1744	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	95
PID 1228 wrote to memory of 1744	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	95
PID 1228 wrote to memory of 1900	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	96
PID 1228 wrote to memory of 1900	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	96
PID 1228 wrote to memory of 1852	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	97
PID 1228 wrote to memory of 1852	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	97
PID 1228 wrote to memory of 740	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	98
PID 1228 wrote to memory of 740	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	98
PID 1228 wrote to memory of 2008	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	99
PID 1228 wrote to memory of 2008	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	99
PID 1228 wrote to memory of 1556	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	100
PID 1228 wrote to memory of 1556	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	100
PID 1228 wrote to memory of 2732	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	101
PID 1228 wrote to memory of 2732	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	101
PID 1228 wrote to memory of 2484	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	102
PID 1228 wrote to memory of 2484	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	102
PID 1228 wrote to memory of 4976	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	103
PID 1228 wrote to memory of 4976	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	103
PID 1228 wrote to memory of 4604	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	104
PID 1228 wrote to memory of 4604	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	104
PID 1228 wrote to memory of 4736	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	105
PID 1228 wrote to memory of 4736	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	105
PID 1228 wrote to memory of 1032	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	106
PID 1228 wrote to memory of 1032	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	106
PID 1228 wrote to memory of 64	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	107
PID 1228 wrote to memory of 64	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	107
PID 1228 wrote to memory of 1220	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	108
PID 1228 wrote to memory of 1220	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	108
PID 1228 wrote to memory of 372	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	109
PID 1228 wrote to memory of 372	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	109
PID 1228 wrote to memory of 1896	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	110
PID 1228 wrote to memory of 1896	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	110
PID 1228 wrote to memory of 2328	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	111
PID 1228 wrote to memory of 2328	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	111
PID 1228 wrote to memory of 960	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	112
PID 1228 wrote to memory of 960	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	112
PID 1228 wrote to memory of 4880	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	113
PID 1228 wrote to memory of 4880	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	113
PID 1228 wrote to memory of 1232	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	114
PID 1228 wrote to memory of 1232	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	114
PID 1228 wrote to memory of 4328	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	115
PID 1228 wrote to memory of 4328	1228	92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\92c8bd36f6ab7dba0380b58b4e19fa10_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\System\HnjLvyf.exe
  C:\Windows\System\HnjLvyf.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\ydqWmir.exe
  C:\Windows\System\ydqWmir.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\FXGSkpr.exe
  C:\Windows\System\FXGSkpr.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\IWwAraN.exe
  C:\Windows\System\IWwAraN.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\JZTiCdl.exe
  C:\Windows\System\JZTiCdl.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\VWGHEiv.exe
  C:\Windows\System\VWGHEiv.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\lMjaQzq.exe
  C:\Windows\System\lMjaQzq.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\EccxlWb.exe
  C:\Windows\System\EccxlWb.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\skKrHve.exe
  C:\Windows\System\skKrHve.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\TGMYcax.exe
  C:\Windows\System\TGMYcax.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\LKxCvYn.exe
  C:\Windows\System\LKxCvYn.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\qqnLRSy.exe
  C:\Windows\System\qqnLRSy.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\NmJIsMt.exe
  C:\Windows\System\NmJIsMt.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\pWQcDwq.exe
  C:\Windows\System\pWQcDwq.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\FoSwBcr.exe
  C:\Windows\System\FoSwBcr.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\resEBQX.exe
  C:\Windows\System\resEBQX.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\HDiAyPI.exe
  C:\Windows\System\HDiAyPI.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\CrZxkmi.exe
  C:\Windows\System\CrZxkmi.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\EPzIYGK.exe
  C:\Windows\System\EPzIYGK.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\TkCTjLP.exe
  C:\Windows\System\TkCTjLP.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\OJiuaAh.exe
  C:\Windows\System\OJiuaAh.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\tFmAVyU.exe
  C:\Windows\System\tFmAVyU.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\sEakPHg.exe
  C:\Windows\System\sEakPHg.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\ZjmaEcm.exe
  C:\Windows\System\ZjmaEcm.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\ukaXsDM.exe
  C:\Windows\System\ukaXsDM.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\onrZRcX.exe
  C:\Windows\System\onrZRcX.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\psxDydD.exe
  C:\Windows\System\psxDydD.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\elDvslY.exe
  C:\Windows\System\elDvslY.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\aVPyzZW.exe
  C:\Windows\System\aVPyzZW.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\ujvxhpF.exe
  C:\Windows\System\ujvxhpF.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\YAjvpiX.exe
  C:\Windows\System\YAjvpiX.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\vrhobWT.exe
  C:\Windows\System\vrhobWT.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\loqicCv.exe
  C:\Windows\System\loqicCv.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\lPNujMw.exe
  C:\Windows\System\lPNujMw.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\tjMPLKH.exe
  C:\Windows\System\tjMPLKH.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\NiVWZIz.exe
  C:\Windows\System\NiVWZIz.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\slsSdxo.exe
  C:\Windows\System\slsSdxo.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\hojdFCm.exe
  C:\Windows\System\hojdFCm.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\GfjojeM.exe
  C:\Windows\System\GfjojeM.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\eGntkAm.exe
  C:\Windows\System\eGntkAm.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\eZzrNYm.exe
  C:\Windows\System\eZzrNYm.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\GNwPJCd.exe
  C:\Windows\System\GNwPJCd.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\KPUCpmA.exe
  C:\Windows\System\KPUCpmA.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\eRzHmht.exe
  C:\Windows\System\eRzHmht.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\HPBaYer.exe
  C:\Windows\System\HPBaYer.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\dgwFUUR.exe
  C:\Windows\System\dgwFUUR.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\olWpzXf.exe
  C:\Windows\System\olWpzXf.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\KepijwA.exe
  C:\Windows\System\KepijwA.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\lNFAKjw.exe
  C:\Windows\System\lNFAKjw.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\cZRwHgV.exe
  C:\Windows\System\cZRwHgV.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\dsGKCYP.exe
  C:\Windows\System\dsGKCYP.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\jZpOReC.exe
  C:\Windows\System\jZpOReC.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\oCPzJef.exe
  C:\Windows\System\oCPzJef.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\vWQvCng.exe
  C:\Windows\System\vWQvCng.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\hSPWWcT.exe
  C:\Windows\System\hSPWWcT.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\uQdBYtY.exe
  C:\Windows\System\uQdBYtY.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\WOCFTZL.exe
  C:\Windows\System\WOCFTZL.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\STeVOkl.exe
  C:\Windows\System\STeVOkl.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\rxTznsG.exe
  C:\Windows\System\rxTznsG.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\rIbxbdp.exe
  C:\Windows\System\rIbxbdp.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\bbQXsQv.exe
  C:\Windows\System\bbQXsQv.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\EbwNnTg.exe
  C:\Windows\System\EbwNnTg.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\TwkxGIH.exe
  C:\Windows\System\TwkxGIH.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\hYxTuvP.exe
  C:\Windows\System\hYxTuvP.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\ybkZtaF.exe
  C:\Windows\System\ybkZtaF.exe
  2⤵
  PID:1520
- C:\Windows\System\UGOmcLk.exe
  C:\Windows\System\UGOmcLk.exe
  2⤵
  PID:516
- C:\Windows\System\uMAtekL.exe
  C:\Windows\System\uMAtekL.exe
  2⤵
  PID:3516
- C:\Windows\System\pudHDzu.exe
  C:\Windows\System\pudHDzu.exe
  2⤵
  PID:3540
- C:\Windows\System\IgZJqGC.exe
  C:\Windows\System\IgZJqGC.exe
  2⤵
  PID:4532
- C:\Windows\System\rpTDEUD.exe
  C:\Windows\System\rpTDEUD.exe
  2⤵
  PID:3992
- C:\Windows\System\NGRlyZC.exe
  C:\Windows\System\NGRlyZC.exe
  2⤵
  PID:1412
- C:\Windows\System\zeNnVJn.exe
  C:\Windows\System\zeNnVJn.exe
  2⤵
  PID:5040
- C:\Windows\System\RgoUkUh.exe
  C:\Windows\System\RgoUkUh.exe
  2⤵
  PID:3984
- C:\Windows\System\HTaUWrZ.exe
  C:\Windows\System\HTaUWrZ.exe
  2⤵
  PID:1324
- C:\Windows\System\eAMoJMX.exe
  C:\Windows\System\eAMoJMX.exe
  2⤵
  PID:4788
- C:\Windows\System\YXJSvwA.exe
  C:\Windows\System\YXJSvwA.exe
  2⤵
  PID:4908
- C:\Windows\System\RxLNrOp.exe
  C:\Windows\System\RxLNrOp.exe
  2⤵
  PID:1892
- C:\Windows\System\cwTGEVa.exe
  C:\Windows\System\cwTGEVa.exe
  2⤵
  PID:3044
- C:\Windows\System\cQDXgwS.exe
  C:\Windows\System\cQDXgwS.exe
  2⤵
  PID:2680
- C:\Windows\System\moUWaqB.exe
  C:\Windows\System\moUWaqB.exe
  2⤵
  PID:3968
- C:\Windows\System\GJqTGCA.exe
  C:\Windows\System\GJqTGCA.exe
  2⤵
  PID:388
- C:\Windows\System\BusRqhr.exe
  C:\Windows\System\BusRqhr.exe
  2⤵
  PID:3728
- C:\Windows\System\doVGJOJ.exe
  C:\Windows\System\doVGJOJ.exe
  2⤵
  PID:3812
- C:\Windows\System\VvREXEB.exe
  C:\Windows\System\VvREXEB.exe
  2⤵
  PID:1340
- C:\Windows\System\NdOVKqK.exe
  C:\Windows\System\NdOVKqK.exe
  2⤵
  PID:4576
- C:\Windows\System\WaDQLWD.exe
  C:\Windows\System\WaDQLWD.exe
  2⤵
  PID:804
- C:\Windows\System\NBAYEnX.exe
  C:\Windows\System\NBAYEnX.exe
  2⤵
  PID:528
- C:\Windows\System\lfdBYxn.exe
  C:\Windows\System\lfdBYxn.exe
  2⤵
  PID:2260
- C:\Windows\System\PukuvLW.exe
  C:\Windows\System\PukuvLW.exe
  2⤵
  PID:1424
- C:\Windows\System\jHsENNa.exe
  C:\Windows\System\jHsENNa.exe
  2⤵
  PID:5140
- C:\Windows\System\zxbflRZ.exe
  C:\Windows\System\zxbflRZ.exe
  2⤵
  PID:5164
- C:\Windows\System\IYiARal.exe
  C:\Windows\System\IYiARal.exe
  2⤵
  PID:5196
- C:\Windows\System\rDYPDpO.exe
  C:\Windows\System\rDYPDpO.exe
  2⤵
  PID:5224
- C:\Windows\System\JHToqpU.exe
  C:\Windows\System\JHToqpU.exe
  2⤵
  PID:5252
- C:\Windows\System\XZMPhbc.exe
  C:\Windows\System\XZMPhbc.exe
  2⤵
  PID:5280
- C:\Windows\System\jZqWbpB.exe
  C:\Windows\System\jZqWbpB.exe
  2⤵
  PID:5308
- C:\Windows\System\ixwUIEI.exe
  C:\Windows\System\ixwUIEI.exe
  2⤵
  PID:5336
- C:\Windows\System\MhNqQsU.exe
  C:\Windows\System\MhNqQsU.exe
  2⤵
  PID:5364
- C:\Windows\System\MedjFTX.exe
  C:\Windows\System\MedjFTX.exe
  2⤵
  PID:5424
- C:\Windows\System\DyAHXXi.exe
  C:\Windows\System\DyAHXXi.exe
  2⤵
  PID:5452
- C:\Windows\System\LUbXebP.exe
  C:\Windows\System\LUbXebP.exe
  2⤵
  PID:5552
- C:\Windows\System\QsusnnF.exe
  C:\Windows\System\QsusnnF.exe
  2⤵
  PID:5596
- C:\Windows\System\ZIQAJXA.exe
  C:\Windows\System\ZIQAJXA.exe
  2⤵
  PID:5632
- C:\Windows\System\LJHbXpm.exe
  C:\Windows\System\LJHbXpm.exe
  2⤵
  PID:5660
- C:\Windows\System\ewsOZNy.exe
  C:\Windows\System\ewsOZNy.exe
  2⤵
  PID:5688
- C:\Windows\System\muiWnjH.exe
  C:\Windows\System\muiWnjH.exe
  2⤵
  PID:5720
- C:\Windows\System\VlHOUfe.exe
  C:\Windows\System\VlHOUfe.exe
  2⤵
  PID:5744
- C:\Windows\System\PApcdTP.exe
  C:\Windows\System\PApcdTP.exe
  2⤵
  PID:5772
- C:\Windows\System\MwWrePm.exe
  C:\Windows\System\MwWrePm.exe
  2⤵
  PID:5796
- C:\Windows\System\qZOkqxO.exe
  C:\Windows\System\qZOkqxO.exe
  2⤵
  PID:5820
- C:\Windows\System\JWJjcwp.exe
  C:\Windows\System\JWJjcwp.exe
  2⤵
  PID:5844
- C:\Windows\System\YHxneTn.exe
  C:\Windows\System\YHxneTn.exe
  2⤵
  PID:5872
- C:\Windows\System\JHvaoEH.exe
  C:\Windows\System\JHvaoEH.exe
  2⤵
  PID:5912
- C:\Windows\System\VOeRMKm.exe
  C:\Windows\System\VOeRMKm.exe
  2⤵
  PID:5944
- C:\Windows\System\HfMVWWF.exe
  C:\Windows\System\HfMVWWF.exe
  2⤵
  PID:5972
- C:\Windows\System\HEmnkxS.exe
  C:\Windows\System\HEmnkxS.exe
  2⤵
  PID:5992
- C:\Windows\System\AGXgGNl.exe
  C:\Windows\System\AGXgGNl.exe
  2⤵
  PID:6016
- C:\Windows\System\ScLnadB.exe
  C:\Windows\System\ScLnadB.exe
  2⤵
  PID:6044
- C:\Windows\System\stRTjUq.exe
  C:\Windows\System\stRTjUq.exe
  2⤵
  PID:6084
- C:\Windows\System\RybYopd.exe
  C:\Windows\System\RybYopd.exe
  2⤵
  PID:6116
- C:\Windows\System\CaoRTch.exe
  C:\Windows\System\CaoRTch.exe
  2⤵
  PID:6136
- C:\Windows\System\ZCTmOht.exe
  C:\Windows\System\ZCTmOht.exe
  2⤵
  PID:4488
- C:\Windows\System\xaRNgEp.exe
  C:\Windows\System\xaRNgEp.exe
  2⤵
  PID:5132
- C:\Windows\System\IxRrxpO.exe
  C:\Windows\System\IxRrxpO.exe
  2⤵
  PID:5180
- C:\Windows\System\vOLFvmP.exe
  C:\Windows\System\vOLFvmP.exe
  2⤵
  PID:5236
- C:\Windows\System\XGXugLx.exe
  C:\Windows\System\XGXugLx.exe
  2⤵
  PID:5268
- C:\Windows\System\vKrsdbv.exe
  C:\Windows\System\vKrsdbv.exe
  2⤵
  PID:5328
- C:\Windows\System\duDkfve.exe
  C:\Windows\System\duDkfve.exe
  2⤵
  PID:2036
- C:\Windows\System\wtbCbPg.exe
  C:\Windows\System\wtbCbPg.exe
  2⤵
  PID:5444
- C:\Windows\System\uGYanmY.exe
  C:\Windows\System\uGYanmY.exe
  2⤵
  PID:1284
- C:\Windows\System\nEUVrwr.exe
  C:\Windows\System\nEUVrwr.exe
  2⤵
  PID:4764
- C:\Windows\System\gbqsMzY.exe
  C:\Windows\System\gbqsMzY.exe
  2⤵
  PID:4164
- C:\Windows\System\mbNABpb.exe
  C:\Windows\System\mbNABpb.exe
  2⤵
  PID:5592
- C:\Windows\System\zyolPad.exe
  C:\Windows\System\zyolPad.exe
  2⤵
  PID:5612
- C:\Windows\System\filukCX.exe
  C:\Windows\System\filukCX.exe
  2⤵
  PID:5648
- C:\Windows\System\GkctLRS.exe
  C:\Windows\System\GkctLRS.exe
  2⤵
  PID:5680
- C:\Windows\System\clAAdgR.exe
  C:\Windows\System\clAAdgR.exe
  2⤵
  PID:5728
- C:\Windows\System\kPBSdid.exe
  C:\Windows\System\kPBSdid.exe
  2⤵
  PID:5788
- C:\Windows\System\ZSkXxGH.exe
  C:\Windows\System\ZSkXxGH.exe
  2⤵
  PID:5816
- C:\Windows\System\npXcayG.exe
  C:\Windows\System\npXcayG.exe
  2⤵
  PID:5836
- C:\Windows\System\VwuyMtk.exe
  C:\Windows\System\VwuyMtk.exe
  2⤵
  PID:2300
- C:\Windows\System\gPMPyuj.exe
  C:\Windows\System\gPMPyuj.exe
  2⤵
  PID:5964
- C:\Windows\System\iaDpKib.exe
  C:\Windows\System\iaDpKib.exe
  2⤵
  PID:6032
- C:\Windows\System\pNNRuuK.exe
  C:\Windows\System\pNNRuuK.exe
  2⤵
  PID:6076
- C:\Windows\System\HEFQWsm.exe
  C:\Windows\System\HEFQWsm.exe
  2⤵
  PID:556
- C:\Windows\System\NxQmzCs.exe
  C:\Windows\System\NxQmzCs.exe
  2⤵
  PID:5404
- C:\Windows\System\lQhFAyA.exe
  C:\Windows\System\lQhFAyA.exe
  2⤵
  PID:5408
- C:\Windows\System\FsvnzEX.exe
  C:\Windows\System\FsvnzEX.exe
  2⤵
  PID:4772
- C:\Windows\System\VFTEUvq.exe
  C:\Windows\System\VFTEUvq.exe
  2⤵
  PID:2240
- C:\Windows\System\GcMUZiv.exe
  C:\Windows\System\GcMUZiv.exe
  2⤵
  PID:4916
- C:\Windows\System\cXyDYHU.exe
  C:\Windows\System\cXyDYHU.exe
  2⤵
  PID:1172
- C:\Windows\System\iuaYmfT.exe
  C:\Windows\System\iuaYmfT.exe
  2⤵
  PID:5736
- C:\Windows\System\zSWvLuB.exe
  C:\Windows\System\zSWvLuB.exe
  2⤵
  PID:4204
- C:\Windows\System\HGWraTs.exe
  C:\Windows\System\HGWraTs.exe
  2⤵
  PID:6064
- C:\Windows\System\tdCQDCa.exe
  C:\Windows\System\tdCQDCa.exe
  2⤵
  PID:5124
- C:\Windows\System\McgrzDi.exe
  C:\Windows\System\McgrzDi.exe
  2⤵
  PID:6000
- C:\Windows\System\NYZNlLa.exe
  C:\Windows\System\NYZNlLa.exe
  2⤵
  PID:5084
- C:\Windows\System\mplPCRp.exe
  C:\Windows\System\mplPCRp.exe
  2⤵
  PID:5652
- C:\Windows\System\lEARmAG.exe
  C:\Windows\System\lEARmAG.exe
  2⤵
  PID:5812
- C:\Windows\System\fvUBeKh.exe
  C:\Windows\System\fvUBeKh.exe
  2⤵
  PID:5516
- C:\Windows\System\UIJskGK.exe
  C:\Windows\System\UIJskGK.exe
  2⤵
  PID:4380
- C:\Windows\System\YINqCln.exe
  C:\Windows\System\YINqCln.exe
  2⤵
  PID:5208
- C:\Windows\System\LAwbJGv.exe
  C:\Windows\System\LAwbJGv.exe
  2⤵
  PID:4060
- C:\Windows\System\zgOsyRX.exe
  C:\Windows\System\zgOsyRX.exe
  2⤵
  PID:6164
- C:\Windows\System\BvLlqHV.exe
  C:\Windows\System\BvLlqHV.exe
  2⤵
  PID:6180
- C:\Windows\System\tRJetmd.exe
  C:\Windows\System\tRJetmd.exe
  2⤵
  PID:6204
- C:\Windows\System\LzMqPUO.exe
  C:\Windows\System\LzMqPUO.exe
  2⤵
  PID:6232
- C:\Windows\System\bhsxkos.exe
  C:\Windows\System\bhsxkos.exe
  2⤵
  PID:6264
- C:\Windows\System\YswfWNf.exe
  C:\Windows\System\YswfWNf.exe
  2⤵
  PID:6300
- C:\Windows\System\zKlWQzJ.exe
  C:\Windows\System\zKlWQzJ.exe
  2⤵
  PID:6340
- C:\Windows\System\gmYjZpu.exe
  C:\Windows\System\gmYjZpu.exe
  2⤵
  PID:6376
- C:\Windows\System\WBKfDVy.exe
  C:\Windows\System\WBKfDVy.exe
  2⤵
  PID:6404
- C:\Windows\System\OFLFGFJ.exe
  C:\Windows\System\OFLFGFJ.exe
  2⤵
  PID:6432
- C:\Windows\System\ybDaAFw.exe
  C:\Windows\System\ybDaAFw.exe
  2⤵
  PID:6460
- C:\Windows\System\gADBYIs.exe
  C:\Windows\System\gADBYIs.exe
  2⤵
  PID:6488
- C:\Windows\System\bQPwqbt.exe
  C:\Windows\System\bQPwqbt.exe
  2⤵
  PID:6516
- C:\Windows\System\bPjfOQY.exe
  C:\Windows\System\bPjfOQY.exe
  2⤵
  PID:6548
- C:\Windows\System\zWVyfSD.exe
  C:\Windows\System\zWVyfSD.exe
  2⤵
  PID:6576
- C:\Windows\System\mRmQUeX.exe
  C:\Windows\System\mRmQUeX.exe
  2⤵
  PID:6604
- C:\Windows\System\QOxiKnv.exe
  C:\Windows\System\QOxiKnv.exe
  2⤵
  PID:6636
- C:\Windows\System\HRVyKmT.exe
  C:\Windows\System\HRVyKmT.exe
  2⤵
  PID:6660
- C:\Windows\System\jvCCWbE.exe
  C:\Windows\System\jvCCWbE.exe
  2⤵
  PID:6688
- C:\Windows\System\SSWvEUo.exe
  C:\Windows\System\SSWvEUo.exe
  2⤵
  PID:6716
- C:\Windows\System\ILubxKs.exe
  C:\Windows\System\ILubxKs.exe
  2⤵
  PID:6744
- C:\Windows\System\RRBEPfR.exe
  C:\Windows\System\RRBEPfR.exe
  2⤵
  PID:6772
- C:\Windows\System\xhaAUwp.exe
  C:\Windows\System\xhaAUwp.exe
  2⤵
  PID:6800
- C:\Windows\System\nqtBrmU.exe
  C:\Windows\System\nqtBrmU.exe
  2⤵
  PID:6828
- C:\Windows\System\QtnATKd.exe
  C:\Windows\System\QtnATKd.exe
  2⤵
  PID:6856
- C:\Windows\System\zZngsHv.exe
  C:\Windows\System\zZngsHv.exe
  2⤵
  PID:6884
- C:\Windows\System\nLJGJHi.exe
  C:\Windows\System\nLJGJHi.exe
  2⤵
  PID:6912
- C:\Windows\System\dqkCoKE.exe
  C:\Windows\System\dqkCoKE.exe
  2⤵
  PID:6940
- C:\Windows\System\ZnSBTlI.exe
  C:\Windows\System\ZnSBTlI.exe
  2⤵
  PID:6968
- C:\Windows\System\rkFVqDs.exe
  C:\Windows\System\rkFVqDs.exe
  2⤵
  PID:7004
- C:\Windows\System\HWDaZiu.exe
  C:\Windows\System\HWDaZiu.exe
  2⤵
  PID:7032
- C:\Windows\System\MMsCyye.exe
  C:\Windows\System\MMsCyye.exe
  2⤵
  PID:7060
- C:\Windows\System\cKVbswH.exe
  C:\Windows\System\cKVbswH.exe
  2⤵
  PID:7088
- C:\Windows\System\RKGYGJO.exe
  C:\Windows\System\RKGYGJO.exe
  2⤵
  PID:7116
- C:\Windows\System\KpozvcL.exe
  C:\Windows\System\KpozvcL.exe
  2⤵
  PID:7144
- C:\Windows\System\Mopxaau.exe
  C:\Windows\System\Mopxaau.exe
  2⤵
  PID:6156
- C:\Windows\System\cJnXPGw.exe
  C:\Windows\System\cJnXPGw.exe
  2⤵
  PID:6220
- C:\Windows\System\xIIKSwe.exe
  C:\Windows\System\xIIKSwe.exe
  2⤵
  PID:6280
- C:\Windows\System\QroPzOE.exe
  C:\Windows\System\QroPzOE.exe
  2⤵
  PID:6332
- C:\Windows\System\ILtuoNZ.exe
  C:\Windows\System\ILtuoNZ.exe
  2⤵
  PID:6416
- C:\Windows\System\RVzEFrq.exe
  C:\Windows\System\RVzEFrq.exe
  2⤵
  PID:6480
- C:\Windows\System\FHiEcWi.exe
  C:\Windows\System\FHiEcWi.exe
  2⤵
  PID:6536
- C:\Windows\System\fEdmUCO.exe
  C:\Windows\System\fEdmUCO.exe
  2⤵
  PID:6616
- C:\Windows\System\qZPedZU.exe
  C:\Windows\System\qZPedZU.exe
  2⤵
  PID:6680
- C:\Windows\System\IdXMvHS.exe
  C:\Windows\System\IdXMvHS.exe
  2⤵
  PID:6740
- C:\Windows\System\LhXciGk.exe
  C:\Windows\System\LhXciGk.exe
  2⤵
  PID:6812
- C:\Windows\System\RHVktlz.exe
  C:\Windows\System\RHVktlz.exe
  2⤵
  PID:6876
- C:\Windows\System\esuNqxl.exe
  C:\Windows\System\esuNqxl.exe
  2⤵
  PID:6948
- C:\Windows\System\QyIKYgX.exe
  C:\Windows\System\QyIKYgX.exe
  2⤵
  PID:7016
- C:\Windows\System\kUBcIYN.exe
  C:\Windows\System\kUBcIYN.exe
  2⤵
  PID:7076
- C:\Windows\System\UsMpTiE.exe
  C:\Windows\System\UsMpTiE.exe
  2⤵
  PID:7140
- C:\Windows\System\wTqQpTa.exe
  C:\Windows\System\wTqQpTa.exe
  2⤵
  PID:6228
- C:\Windows\System\DpoLLnW.exe
  C:\Windows\System\DpoLLnW.exe
  2⤵
  PID:6396
- C:\Windows\System\xPegfkK.exe
  C:\Windows\System\xPegfkK.exe
  2⤵
  PID:6528
- C:\Windows\System\GBuzJqc.exe
  C:\Windows\System\GBuzJqc.exe
  2⤵
  PID:6712
- C:\Windows\System\bNuyXgi.exe
  C:\Windows\System\bNuyXgi.exe
  2⤵
  PID:6848
- C:\Windows\System\PCFpJfB.exe
  C:\Windows\System\PCFpJfB.exe
  2⤵
  PID:7000
- C:\Windows\System\zlIkwyt.exe
  C:\Windows\System\zlIkwyt.exe
  2⤵
  PID:6192
- C:\Windows\System\RMeAbQX.exe
  C:\Windows\System\RMeAbQX.exe
  2⤵
  PID:6452
- C:\Windows\System\EAzHixu.exe
  C:\Windows\System\EAzHixu.exe
  2⤵
  PID:6840
- C:\Windows\System\nskBflp.exe
  C:\Windows\System\nskBflp.exe
  2⤵
  PID:6244
- C:\Windows\System\BcEyAck.exe
  C:\Windows\System\BcEyAck.exe
  2⤵
  PID:7112
- C:\Windows\System\Aqfbrsy.exe
  C:\Windows\System\Aqfbrsy.exe
  2⤵
  PID:7184
- C:\Windows\System\OibYXPF.exe
  C:\Windows\System\OibYXPF.exe
  2⤵
  PID:7216
- C:\Windows\System\ZsDHsrJ.exe
  C:\Windows\System\ZsDHsrJ.exe
  2⤵
  PID:7244
- C:\Windows\System\oRRbcMO.exe
  C:\Windows\System\oRRbcMO.exe
  2⤵
  PID:7272
- C:\Windows\System\JAbLbWz.exe
  C:\Windows\System\JAbLbWz.exe
  2⤵
  PID:7300
- C:\Windows\System\asjLtZx.exe
  C:\Windows\System\asjLtZx.exe
  2⤵
  PID:7328
- C:\Windows\System\IoyATcm.exe
  C:\Windows\System\IoyATcm.exe
  2⤵
  PID:7356
- C:\Windows\System\BZobLog.exe
  C:\Windows\System\BZobLog.exe
  2⤵
  PID:7384
- C:\Windows\System\ASiCDcJ.exe
  C:\Windows\System\ASiCDcJ.exe
  2⤵
  PID:7404
- C:\Windows\System\bLelkNO.exe
  C:\Windows\System\bLelkNO.exe
  2⤵
  PID:7440
- C:\Windows\System\LAqQyaO.exe
  C:\Windows\System\LAqQyaO.exe
  2⤵
  PID:7468
- C:\Windows\System\cOenQsT.exe
  C:\Windows\System\cOenQsT.exe
  2⤵
  PID:7496
- C:\Windows\System\QzDvBZf.exe
  C:\Windows\System\QzDvBZf.exe
  2⤵
  PID:7524
- C:\Windows\System\tUXtJsz.exe
  C:\Windows\System\tUXtJsz.exe
  2⤵
  PID:7552
- C:\Windows\System\uAFGtBX.exe
  C:\Windows\System\uAFGtBX.exe
  2⤵
  PID:7572
- C:\Windows\System\nNzLxUN.exe
  C:\Windows\System\nNzLxUN.exe
  2⤵
  PID:7608
- C:\Windows\System\xmNMMDi.exe
  C:\Windows\System\xmNMMDi.exe
  2⤵
  PID:7624
- C:\Windows\System\FWKwZjE.exe
  C:\Windows\System\FWKwZjE.exe
  2⤵
  PID:7648
- C:\Windows\System\glMrpRt.exe
  C:\Windows\System\glMrpRt.exe
  2⤵
  PID:7664
- C:\Windows\System\XtAEzVk.exe
  C:\Windows\System\XtAEzVk.exe
  2⤵
  PID:7684
- C:\Windows\System\uLrreYL.exe
  C:\Windows\System\uLrreYL.exe
  2⤵
  PID:7700
- C:\Windows\System\yFiyRLK.exe
  C:\Windows\System\yFiyRLK.exe
  2⤵
  PID:7720
- C:\Windows\System\fknHwlH.exe
  C:\Windows\System\fknHwlH.exe
  2⤵
  PID:7744
- C:\Windows\System\CleCDyL.exe
  C:\Windows\System\CleCDyL.exe
  2⤵
  PID:7792
- C:\Windows\System\QcGKhpH.exe
  C:\Windows\System\QcGKhpH.exe
  2⤵
  PID:7840
- C:\Windows\System\JyqYEtt.exe
  C:\Windows\System\JyqYEtt.exe
  2⤵
  PID:7876
- C:\Windows\System\legPdaw.exe
  C:\Windows\System\legPdaw.exe
  2⤵
  PID:7908
- C:\Windows\System\rDgzuhh.exe
  C:\Windows\System\rDgzuhh.exe
  2⤵
  PID:7928
- C:\Windows\System\NVWkpiI.exe
  C:\Windows\System\NVWkpiI.exe
  2⤵
  PID:7948
- C:\Windows\System\BnNnGgS.exe
  C:\Windows\System\BnNnGgS.exe
  2⤵
  PID:7964
- C:\Windows\System\VhePVkN.exe
  C:\Windows\System\VhePVkN.exe
  2⤵
  PID:7992
- C:\Windows\System\ZVDnszS.exe
  C:\Windows\System\ZVDnszS.exe
  2⤵
  PID:8032
- C:\Windows\System\BCPrNMF.exe
  C:\Windows\System\BCPrNMF.exe
  2⤵
  PID:8064
- C:\Windows\System\Jkyvfmg.exe
  C:\Windows\System\Jkyvfmg.exe
  2⤵
  PID:8112
- C:\Windows\System\IqruNbY.exe
  C:\Windows\System\IqruNbY.exe
  2⤵
  PID:8140
- C:\Windows\System\AYYVULd.exe
  C:\Windows\System\AYYVULd.exe
  2⤵
  PID:8168
- C:\Windows\System\ihoeXtf.exe
  C:\Windows\System\ihoeXtf.exe
  2⤵
  PID:7180
- C:\Windows\System\qLDXwnx.exe
  C:\Windows\System\qLDXwnx.exe
  2⤵
  PID:7228
- C:\Windows\System\PqUWpGO.exe
  C:\Windows\System\PqUWpGO.exe
  2⤵
  PID:7292
- C:\Windows\System\wYnQfjh.exe
  C:\Windows\System\wYnQfjh.exe
  2⤵
  PID:7376
- C:\Windows\System\xKtGHor.exe
  C:\Windows\System\xKtGHor.exe
  2⤵
  PID:7436
- C:\Windows\System\XArSQef.exe
  C:\Windows\System\XArSQef.exe
  2⤵
  PID:7508
- C:\Windows\System\tiWrLIj.exe
  C:\Windows\System\tiWrLIj.exe
  2⤵
  PID:7568
- C:\Windows\System\tZDWlsj.exe
  C:\Windows\System\tZDWlsj.exe
  2⤵
  PID:7644
- C:\Windows\System\cDFAxWy.exe
  C:\Windows\System\cDFAxWy.exe
  2⤵
  PID:7692
- C:\Windows\System\ghRBADq.exe
  C:\Windows\System\ghRBADq.exe
  2⤵
  PID:7716
- C:\Windows\System\zVWsvmx.exe
  C:\Windows\System\zVWsvmx.exe
  2⤵
  PID:7784
- C:\Windows\System\UvYLaMI.exe
  C:\Windows\System\UvYLaMI.exe
  2⤵
  PID:7848
- C:\Windows\System\JkDPhty.exe
  C:\Windows\System\JkDPhty.exe
  2⤵
  PID:7904
- C:\Windows\System\zMwVxZO.exe
  C:\Windows\System\zMwVxZO.exe
  2⤵
  PID:8052
- C:\Windows\System\ESMzMQf.exe
  C:\Windows\System\ESMzMQf.exe
  2⤵
  PID:8096
- C:\Windows\System\YzUZyov.exe
  C:\Windows\System\YzUZyov.exe
  2⤵
  PID:7268
- C:\Windows\System\oRvGVxu.exe
  C:\Windows\System\oRvGVxu.exe
  2⤵
  PID:7400
- C:\Windows\System\DVqIDCY.exe
  C:\Windows\System\DVqIDCY.exe
  2⤵
  PID:7536
- C:\Windows\System\HMHgtFs.exe
  C:\Windows\System\HMHgtFs.exe
  2⤵
  PID:7740
- C:\Windows\System\VCGyrjw.exe
  C:\Windows\System\VCGyrjw.exe
  2⤵
  PID:7936
- C:\Windows\System\GHCATXw.exe
  C:\Windows\System\GHCATXw.exe
  2⤵
  PID:8072
- C:\Windows\System\tBosZpJ.exe
  C:\Windows\System\tBosZpJ.exe
  2⤵
  PID:7636
- C:\Windows\System\biGmKLl.exe
  C:\Windows\System\biGmKLl.exe
  2⤵
  PID:7836
- C:\Windows\System\hZrsSHv.exe
  C:\Windows\System\hZrsSHv.exe
  2⤵
  PID:8188
- C:\Windows\System\jxHLAnG.exe
  C:\Windows\System\jxHLAnG.exe
  2⤵
  PID:8016
- C:\Windows\System\ZetrXQz.exe
  C:\Windows\System\ZetrXQz.exe
  2⤵
  PID:8200
- C:\Windows\System\TxcpqFE.exe
  C:\Windows\System\TxcpqFE.exe
  2⤵
  PID:8228
- C:\Windows\System\siUsEGU.exe
  C:\Windows\System\siUsEGU.exe
  2⤵
  PID:8256
- C:\Windows\System\wTxsydH.exe
  C:\Windows\System\wTxsydH.exe
  2⤵
  PID:8284
- C:\Windows\System\xzrOTZK.exe
  C:\Windows\System\xzrOTZK.exe
  2⤵
  PID:8312
- C:\Windows\System\hdnELQU.exe
  C:\Windows\System\hdnELQU.exe
  2⤵
  PID:8340
- C:\Windows\System\XDLSEDS.exe
  C:\Windows\System\XDLSEDS.exe
  2⤵
  PID:8368
- C:\Windows\System\ORLGtBJ.exe
  C:\Windows\System\ORLGtBJ.exe
  2⤵
  PID:8396
- C:\Windows\System\baKWzhl.exe
  C:\Windows\System\baKWzhl.exe
  2⤵
  PID:8424
- C:\Windows\System\VLBXsfv.exe
  C:\Windows\System\VLBXsfv.exe
  2⤵
  PID:8452
- C:\Windows\System\TlXhgvD.exe
  C:\Windows\System\TlXhgvD.exe
  2⤵
  PID:8480
- C:\Windows\System\IVbTUmt.exe
  C:\Windows\System\IVbTUmt.exe
  2⤵
  PID:8508
- C:\Windows\System\rYEjqDd.exe
  C:\Windows\System\rYEjqDd.exe
  2⤵
  PID:8536
- C:\Windows\System\SYxItGY.exe
  C:\Windows\System\SYxItGY.exe
  2⤵
  PID:8568
- C:\Windows\System\iiORNJD.exe
  C:\Windows\System\iiORNJD.exe
  2⤵
  PID:8596
- C:\Windows\System\cYjabVD.exe
  C:\Windows\System\cYjabVD.exe
  2⤵
  PID:8624
- C:\Windows\System\kBjfWUo.exe
  C:\Windows\System\kBjfWUo.exe
  2⤵
  PID:8652
- C:\Windows\System\SsZERRH.exe
  C:\Windows\System\SsZERRH.exe
  2⤵
  PID:8680
- C:\Windows\System\uoilvPP.exe
  C:\Windows\System\uoilvPP.exe
  2⤵
  PID:8708
- C:\Windows\System\nmaTgyw.exe
  C:\Windows\System\nmaTgyw.exe
  2⤵
  PID:8736
- C:\Windows\System\QMWFruZ.exe
  C:\Windows\System\QMWFruZ.exe
  2⤵
  PID:8764
- C:\Windows\System\RhCYzmV.exe
  C:\Windows\System\RhCYzmV.exe
  2⤵
  PID:8792
- C:\Windows\System\HQjfWpY.exe
  C:\Windows\System\HQjfWpY.exe
  2⤵
  PID:8820
- C:\Windows\System\bCsHqVo.exe
  C:\Windows\System\bCsHqVo.exe
  2⤵
  PID:8848
- C:\Windows\System\EeFzqvJ.exe
  C:\Windows\System\EeFzqvJ.exe
  2⤵
  PID:8876
- C:\Windows\System\dFpgyOZ.exe
  C:\Windows\System\dFpgyOZ.exe
  2⤵
  PID:8904
- C:\Windows\System\dfJKHQR.exe
  C:\Windows\System\dfJKHQR.exe
  2⤵
  PID:8940
- C:\Windows\System\omWJfjt.exe
  C:\Windows\System\omWJfjt.exe
  2⤵
  PID:8960
- C:\Windows\System\nioBTrG.exe
  C:\Windows\System\nioBTrG.exe
  2⤵
  PID:8988
- C:\Windows\System\dMwliZl.exe
  C:\Windows\System\dMwliZl.exe
  2⤵
  PID:9016
- C:\Windows\System\vtKzHsr.exe
  C:\Windows\System\vtKzHsr.exe
  2⤵
  PID:9044
- C:\Windows\System\WtyZmYY.exe
  C:\Windows\System\WtyZmYY.exe
  2⤵
  PID:9072
- C:\Windows\System\oWtmVSJ.exe
  C:\Windows\System\oWtmVSJ.exe
  2⤵
  PID:9104
- C:\Windows\System\ZZnpJpt.exe
  C:\Windows\System\ZZnpJpt.exe
  2⤵
  PID:9132
- C:\Windows\System\dMrMOeo.exe
  C:\Windows\System\dMrMOeo.exe
  2⤵
  PID:9160
- C:\Windows\System\bKRxLPe.exe
  C:\Windows\System\bKRxLPe.exe
  2⤵
  PID:9188
- C:\Windows\System\KbFoKjx.exe
  C:\Windows\System\KbFoKjx.exe
  2⤵
  PID:7752
- C:\Windows\System\BQBbizF.exe
  C:\Windows\System\BQBbizF.exe
  2⤵
  PID:8248
- C:\Windows\System\yWfSBzb.exe
  C:\Windows\System\yWfSBzb.exe
  2⤵
  PID:8304
- C:\Windows\System\JSyVkmI.exe
  C:\Windows\System\JSyVkmI.exe
  2⤵
  PID:8380
- C:\Windows\System\fwdkWfO.exe
  C:\Windows\System\fwdkWfO.exe
  2⤵
  PID:8444
- C:\Windows\System\yKKmlPi.exe
  C:\Windows\System\yKKmlPi.exe
  2⤵
  PID:8504
- C:\Windows\System\GmenYGE.exe
  C:\Windows\System\GmenYGE.exe
  2⤵
  PID:8580
- C:\Windows\System\iBTpZHg.exe
  C:\Windows\System\iBTpZHg.exe
  2⤵
  PID:8644
- C:\Windows\System\KceLfpD.exe
  C:\Windows\System\KceLfpD.exe
  2⤵
  PID:8720
- C:\Windows\System\sBNkeZl.exe
  C:\Windows\System\sBNkeZl.exe
  2⤵
  PID:8776
- C:\Windows\System\tDGVwIU.exe
  C:\Windows\System\tDGVwIU.exe
  2⤵
  PID:8840
- C:\Windows\System\nHUpzGn.exe
  C:\Windows\System\nHUpzGn.exe
  2⤵
  PID:8896
- C:\Windows\System\ckfHvha.exe
  C:\Windows\System\ckfHvha.exe
  2⤵
  PID:8972
- C:\Windows\System\GxuVYmL.exe
  C:\Windows\System\GxuVYmL.exe
  2⤵
  PID:9068
- C:\Windows\System\MTggfJt.exe
  C:\Windows\System\MTggfJt.exe
  2⤵
  PID:9148
- C:\Windows\System\JSXuEjY.exe
  C:\Windows\System\JSXuEjY.exe
  2⤵
  PID:9208
- C:\Windows\System\ULfuDyR.exe
  C:\Windows\System\ULfuDyR.exe
  2⤵
  PID:8360
- C:\Windows\System\zDUqBzh.exe
  C:\Windows\System\zDUqBzh.exe
  2⤵
  PID:8564
- C:\Windows\System\Aedqvxx.exe
  C:\Windows\System\Aedqvxx.exe
  2⤵
  PID:8700
- C:\Windows\System\aIBpLcV.exe
  C:\Windows\System\aIBpLcV.exe
  2⤵
  PID:8816
- C:\Windows\System\gcQyAFs.exe
  C:\Windows\System\gcQyAFs.exe
  2⤵
  PID:9000
- C:\Windows\System\VnrxmwZ.exe
  C:\Windows\System\VnrxmwZ.exe
  2⤵
  PID:9180
- C:\Windows\System\bXJIHJu.exe
  C:\Windows\System\bXJIHJu.exe
  2⤵
  PID:8476
- C:\Windows\System\mZzxCCr.exe
  C:\Windows\System\mZzxCCr.exe
  2⤵
  PID:8756
- C:\Windows\System\vUqHNzM.exe
  C:\Windows\System\vUqHNzM.exe
  2⤵
  PID:9232
- C:\Windows\System\GwhxgCP.exe
  C:\Windows\System\GwhxgCP.exe
  2⤵
  PID:9288
- C:\Windows\System\PRQYatM.exe
  C:\Windows\System\PRQYatM.exe
  2⤵
  PID:9304
- C:\Windows\System\zMnBVOu.exe
  C:\Windows\System\zMnBVOu.exe
  2⤵
  PID:9320
- C:\Windows\System\dWPJgAA.exe
  C:\Windows\System\dWPJgAA.exe
  2⤵
  PID:9344
- C:\Windows\System\LWylrDC.exe
  C:\Windows\System\LWylrDC.exe
  2⤵
  PID:9364
- C:\Windows\System\xFeAZHa.exe
  C:\Windows\System\xFeAZHa.exe
  2⤵
  PID:9396
- C:\Windows\System\gddOHTA.exe
  C:\Windows\System\gddOHTA.exe
  2⤵
  PID:9436
- C:\Windows\System\gUlEdVf.exe
  C:\Windows\System\gUlEdVf.exe
  2⤵
  PID:9468
- C:\Windows\System\PoKEemg.exe
  C:\Windows\System\PoKEemg.exe
  2⤵
  PID:9496
- C:\Windows\System\KwzBmHK.exe
  C:\Windows\System\KwzBmHK.exe
  2⤵
  PID:9528
- C:\Windows\System\iwfQfnx.exe
  C:\Windows\System\iwfQfnx.exe
  2⤵
  PID:9552
- C:\Windows\System\PlvIxZW.exe
  C:\Windows\System\PlvIxZW.exe
  2⤵
  PID:9588
- C:\Windows\System\uRanvOz.exe
  C:\Windows\System\uRanvOz.exe
  2⤵
  PID:9644
- C:\Windows\System\ISBeiWf.exe
  C:\Windows\System\ISBeiWf.exe
  2⤵
  PID:9668
- C:\Windows\System\lEqAPKc.exe
  C:\Windows\System\lEqAPKc.exe
  2⤵
  PID:9708
- C:\Windows\System\yIsCCjA.exe
  C:\Windows\System\yIsCCjA.exe
  2⤵
  PID:9736
- C:\Windows\System\LpLDQbm.exe
  C:\Windows\System\LpLDQbm.exe
  2⤵
  PID:9760
- C:\Windows\System\ZirxzAD.exe
  C:\Windows\System\ZirxzAD.exe
  2⤵
  PID:9796
- C:\Windows\System\mDVsRIU.exe
  C:\Windows\System\mDVsRIU.exe
  2⤵
  PID:9836
- C:\Windows\System\hkLIbsi.exe
  C:\Windows\System\hkLIbsi.exe
  2⤵
  PID:9852
- C:\Windows\System\xUWjMif.exe
  C:\Windows\System\xUWjMif.exe
  2⤵
  PID:9880
- C:\Windows\System\WBohNia.exe
  C:\Windows\System\WBohNia.exe
  2⤵
  PID:9928
- C:\Windows\System\ddMOZvq.exe
  C:\Windows\System\ddMOZvq.exe
  2⤵
  PID:9968
- C:\Windows\System\MZoygiY.exe
  C:\Windows\System\MZoygiY.exe
  2⤵
  PID:9996
- C:\Windows\System\lTGHGnZ.exe
  C:\Windows\System\lTGHGnZ.exe
  2⤵
  PID:10016
- C:\Windows\System\HOsLIDT.exe
  C:\Windows\System\HOsLIDT.exe
  2⤵
  PID:10040
- C:\Windows\System\SuvtrlN.exe
  C:\Windows\System\SuvtrlN.exe
  2⤵
  PID:10068
- C:\Windows\System\QoPufpa.exe
  C:\Windows\System\QoPufpa.exe
  2⤵
  PID:10088
- C:\Windows\System\dxnpyEK.exe
  C:\Windows\System\dxnpyEK.exe
  2⤵
  PID:10136
- C:\Windows\System\iWYlHdQ.exe
  C:\Windows\System\iWYlHdQ.exe
  2⤵
  PID:10152
- C:\Windows\System\kYMZMid.exe
  C:\Windows\System\kYMZMid.exe
  2⤵
  PID:10172
- C:\Windows\System\SRLuAaK.exe
  C:\Windows\System\SRLuAaK.exe
  2⤵
  PID:10192
- C:\Windows\System\HQrlBRv.exe
  C:\Windows\System\HQrlBRv.exe
  2⤵
  PID:10212
- C:\Windows\System\PDBviuT.exe
  C:\Windows\System\PDBviuT.exe
  2⤵
  PID:10232
- C:\Windows\System\NKBwrbs.exe
  C:\Windows\System\NKBwrbs.exe
  2⤵
  PID:9252
- C:\Windows\System\VSwMoDJ.exe
  C:\Windows\System\VSwMoDJ.exe
  2⤵
  PID:9312
- C:\Windows\System\diZVwAF.exe
  C:\Windows\System\diZVwAF.exe
  2⤵
  PID:9392
- C:\Windows\System\ToDvphU.exe
  C:\Windows\System\ToDvphU.exe
  2⤵
  PID:9504
- C:\Windows\System\lBPYjom.exe
  C:\Windows\System\lBPYjom.exe
  2⤵
  PID:9560
- C:\Windows\System\nOlrrWZ.exe
  C:\Windows\System\nOlrrWZ.exe
  2⤵
  PID:9664
- C:\Windows\System\UENmSig.exe
  C:\Windows\System\UENmSig.exe
  2⤵
  PID:9744
- C:\Windows\System\JbXgQYD.exe
  C:\Windows\System\JbXgQYD.exe
  2⤵
  PID:9816
- C:\Windows\System\JCECMKa.exe
  C:\Windows\System\JCECMKa.exe
  2⤵
  PID:9872
- C:\Windows\System\taWwYmv.exe
  C:\Windows\System\taWwYmv.exe
  2⤵
  PID:9960
- C:\Windows\System\lDRTvFu.exe
  C:\Windows\System\lDRTvFu.exe
  2⤵
  PID:10084
- C:\Windows\System\VOrqRdt.exe
  C:\Windows\System\VOrqRdt.exe
  2⤵
  PID:10228
- C:\Windows\System\HcPlFQA.exe
  C:\Windows\System\HcPlFQA.exe
  2⤵
  PID:9220
- C:\Windows\System\ugrkvpv.exe
  C:\Windows\System\ugrkvpv.exe
  2⤵
  PID:9536
- C:\Windows\System\gJnpOZM.exe
  C:\Windows\System\gJnpOZM.exe
  2⤵
  PID:9352
- C:\Windows\System\NdKZKKf.exe
  C:\Windows\System\NdKZKKf.exe
  2⤵
  PID:9792
- C:\Windows\System\xNysJho.exe
  C:\Windows\System\xNysJho.exe
  2⤵
  PID:9728
- C:\Windows\System\qIfHSOu.exe
  C:\Windows\System\qIfHSOu.exe
  2⤵
  PID:10008
- C:\Windows\System\egQigcI.exe
  C:\Windows\System\egQigcI.exe
  2⤵
  PID:10160
- C:\Windows\System\hBUsXyn.exe
  C:\Windows\System\hBUsXyn.exe
  2⤵
  PID:9336
- C:\Windows\System\BzUNwap.exe
  C:\Windows\System\BzUNwap.exe
  2⤵
  PID:10220
- C:\Windows\System\eJQMnlg.exe
  C:\Windows\System\eJQMnlg.exe
  2⤵
  PID:9512
- C:\Windows\System\YGGFCCA.exe
  C:\Windows\System\YGGFCCA.exe
  2⤵
  PID:9848
- C:\Windows\System\AICAWHm.exe
  C:\Windows\System\AICAWHm.exe
  2⤵
  PID:10288
- C:\Windows\System\KxSLxqt.exe
  C:\Windows\System\KxSLxqt.exe
  2⤵
  PID:10308
- C:\Windows\System\IFKLVHF.exe
  C:\Windows\System\IFKLVHF.exe
  2⤵
  PID:10324
- C:\Windows\System\eRBWhVi.exe
  C:\Windows\System\eRBWhVi.exe
  2⤵
  PID:10352
- C:\Windows\System\LdkgIGq.exe
  C:\Windows\System\LdkgIGq.exe
  2⤵
  PID:10392
- C:\Windows\System\STCXMHi.exe
  C:\Windows\System\STCXMHi.exe
  2⤵
  PID:10408
- C:\Windows\System\SDKOfnh.exe
  C:\Windows\System\SDKOfnh.exe
  2⤵
  PID:10428
- C:\Windows\System\XOUCHph.exe
  C:\Windows\System\XOUCHph.exe
  2⤵
  PID:10452
- C:\Windows\System\OciVsJN.exe
  C:\Windows\System\OciVsJN.exe
  2⤵
  PID:10476
- C:\Windows\System\kMaWesz.exe
  C:\Windows\System\kMaWesz.exe
  2⤵
  PID:10512
- C:\Windows\System\HHjupjn.exe
  C:\Windows\System\HHjupjn.exe
  2⤵
  PID:10540
- C:\Windows\System\DyQzfeH.exe
  C:\Windows\System\DyQzfeH.exe
  2⤵
  PID:10568
- C:\Windows\System\IbvWKIk.exe
  C:\Windows\System\IbvWKIk.exe
  2⤵
  PID:10624
- C:\Windows\System\EiCNOnY.exe
  C:\Windows\System\EiCNOnY.exe
  2⤵
  PID:10664
- C:\Windows\System\PBTKdTC.exe
  C:\Windows\System\PBTKdTC.exe
  2⤵
  PID:10680
- C:\Windows\System\LIgzcKV.exe
  C:\Windows\System\LIgzcKV.exe
  2⤵
  PID:10720
- C:\Windows\System\tGsFSJM.exe
  C:\Windows\System\tGsFSJM.exe
  2⤵
  PID:10748
- C:\Windows\System\Ywusiet.exe
  C:\Windows\System\Ywusiet.exe
  2⤵
  PID:10776
- C:\Windows\System\trQRfQl.exe
  C:\Windows\System\trQRfQl.exe
  2⤵
  PID:10804
- C:\Windows\System\PbvoZIC.exe
  C:\Windows\System\PbvoZIC.exe
  2⤵
  PID:10832
- C:\Windows\System\KYVenhF.exe
  C:\Windows\System\KYVenhF.exe
  2⤵
  PID:10860
- C:\Windows\System\SOSfoQS.exe
  C:\Windows\System\SOSfoQS.exe
  2⤵
  PID:10888
- C:\Windows\System\OIFiEQJ.exe
  C:\Windows\System\OIFiEQJ.exe
  2⤵
  PID:10904
- C:\Windows\System\ShpNXvK.exe
  C:\Windows\System\ShpNXvK.exe
  2⤵
  PID:10944
- C:\Windows\System\HFttYly.exe
  C:\Windows\System\HFttYly.exe
  2⤵
  PID:10972
- C:\Windows\System\aUrokvP.exe
  C:\Windows\System\aUrokvP.exe
  2⤵
  PID:11000
- C:\Windows\System\MdpgAny.exe
  C:\Windows\System\MdpgAny.exe
  2⤵
  PID:11028
- C:\Windows\System\YHAOtVi.exe
  C:\Windows\System\YHAOtVi.exe
  2⤵
  PID:11064
- C:\Windows\System\VbBJkFz.exe
  C:\Windows\System\VbBJkFz.exe
  2⤵
  PID:11096
- C:\Windows\System\nYnKFRm.exe
  C:\Windows\System\nYnKFRm.exe
  2⤵
  PID:11124
- C:\Windows\System\rZTwvkG.exe
  C:\Windows\System\rZTwvkG.exe
  2⤵
  PID:11140
- C:\Windows\System\nviYdUG.exe
  C:\Windows\System\nviYdUG.exe
  2⤵
  PID:11160
- C:\Windows\System\bIqzoiJ.exe
  C:\Windows\System\bIqzoiJ.exe
  2⤵
  PID:11208
- C:\Windows\System\jzCeTOo.exe
  C:\Windows\System\jzCeTOo.exe
  2⤵
  PID:11228
- C:\Windows\System\ijdtlgj.exe
  C:\Windows\System\ijdtlgj.exe
  2⤵
  PID:11252
- C:\Windows\System\YdjfcsC.exe
  C:\Windows\System\YdjfcsC.exe
  2⤵
  PID:10276
- C:\Windows\System\lLdaMTp.exe
  C:\Windows\System\lLdaMTp.exe
  2⤵
  PID:10268
- C:\Windows\System\ImjxunN.exe
  C:\Windows\System\ImjxunN.exe
  2⤵
  PID:10340
- C:\Windows\System\wUbQnmV.exe
  C:\Windows\System\wUbQnmV.exe
  2⤵
  PID:10504
- C:\Windows\System\OCdEPDq.exe
  C:\Windows\System\OCdEPDq.exe
  2⤵
  PID:10588
- C:\Windows\System\PwKZUwP.exe
  C:\Windows\System\PwKZUwP.exe
  2⤵
  PID:10616
- C:\Windows\System\pVAnxBi.exe
  C:\Windows\System\pVAnxBi.exe
  2⤵
  PID:10640
- C:\Windows\System\zFWMXon.exe
  C:\Windows\System\zFWMXon.exe
  2⤵
  PID:10716
- C:\Windows\System\SKgIwIX.exe
  C:\Windows\System\SKgIwIX.exe
  2⤵
  PID:10764
- C:\Windows\System\XCmdPfd.exe
  C:\Windows\System\XCmdPfd.exe
  2⤵
  PID:10820
- C:\Windows\System\UXOrVjJ.exe
  C:\Windows\System\UXOrVjJ.exe
  2⤵
  PID:10900
- C:\Windows\System\EsqSnyc.exe
  C:\Windows\System\EsqSnyc.exe
  2⤵
  PID:10984
- C:\Windows\System\lZtgXgU.exe
  C:\Windows\System\lZtgXgU.exe
  2⤵
  PID:11084
- C:\Windows\System\lYRSybD.exe
  C:\Windows\System\lYRSybD.exe
  2⤵
  PID:11168
- C:\Windows\System\MDcmgSd.exe
  C:\Windows\System\MDcmgSd.exe
  2⤵
  PID:11184
- C:\Windows\System\iGPWXWe.exe
  C:\Windows\System\iGPWXWe.exe
  2⤵
  PID:9280
- C:\Windows\System\kulkESh.exe
  C:\Windows\System\kulkESh.exe
  2⤵
  PID:10336
- C:\Windows\System\znYTLzf.exe
  C:\Windows\System\znYTLzf.exe
  2⤵
  PID:10472
- C:\Windows\System\MvzlbHY.exe
  C:\Windows\System\MvzlbHY.exe
  2⤵
  PID:10736
- C:\Windows\System\VoguSHK.exe
  C:\Windows\System\VoguSHK.exe
  2⤵
  PID:10788
- C:\Windows\System\asEPxpE.exe
  C:\Windows\System\asEPxpE.exe
  2⤵
  PID:10960
- C:\Windows\System\CGypKlG.exe
  C:\Windows\System\CGypKlG.exe
  2⤵
  PID:11116
- C:\Windows\System\IkPtQwA.exe
  C:\Windows\System\IkPtQwA.exe
  2⤵
  PID:11236
- C:\Windows\System\aNjmZLY.exe
  C:\Windows\System\aNjmZLY.exe
  2⤵
  PID:10416
- C:\Windows\System\tTKQacB.exe
  C:\Windows\System\tTKQacB.exe
  2⤵
  PID:10872
- C:\Windows\System\JwCHESW.exe
  C:\Windows\System\JwCHESW.exe
  2⤵
  PID:11292
- C:\Windows\System\tHhZnLx.exe
  C:\Windows\System\tHhZnLx.exe
  2⤵
  PID:11320
- C:\Windows\System\vgFGgiu.exe
  C:\Windows\System\vgFGgiu.exe
  2⤵
  PID:11336
- C:\Windows\System\TDsFrNE.exe
  C:\Windows\System\TDsFrNE.exe
  2⤵
  PID:11372
- C:\Windows\System\gKxLqzN.exe
  C:\Windows\System\gKxLqzN.exe
  2⤵
  PID:11404
- C:\Windows\System\tsPTIYr.exe
  C:\Windows\System\tsPTIYr.exe
  2⤵
  PID:11420
- C:\Windows\System\Vnffrar.exe
  C:\Windows\System\Vnffrar.exe
  2⤵
  PID:11436
- C:\Windows\System\XOvsWgB.exe
  C:\Windows\System\XOvsWgB.exe
  2⤵
  PID:11476
- C:\Windows\System\JApHMbT.exe
  C:\Windows\System\JApHMbT.exe
  2⤵
  PID:11516
- C:\Windows\System\aQBqcRj.exe
  C:\Windows\System\aQBqcRj.exe
  2⤵
  PID:11544
- C:\Windows\System\ZyHyMUS.exe
  C:\Windows\System\ZyHyMUS.exe
  2⤵
  PID:11572
- C:\Windows\System\KLBHFUk.exe
  C:\Windows\System\KLBHFUk.exe
  2⤵
  PID:11600
- C:\Windows\System\AvJKprU.exe
  C:\Windows\System\AvJKprU.exe
  2⤵
  PID:11628
- C:\Windows\System\AOEKfpd.exe
  C:\Windows\System\AOEKfpd.exe
  2⤵
  PID:11644
- C:\Windows\System\XmXmzuf.exe
  C:\Windows\System\XmXmzuf.exe
  2⤵
  PID:11664
- C:\Windows\System\sWgdUrP.exe
  C:\Windows\System\sWgdUrP.exe
  2⤵
  PID:11688
- C:\Windows\System\NFngWwn.exe
  C:\Windows\System\NFngWwn.exe
  2⤵
  PID:11716
- C:\Windows\System\YCwNAxr.exe
  C:\Windows\System\YCwNAxr.exe
  2⤵
  PID:11748
- C:\Windows\System\HFXqoel.exe
  C:\Windows\System\HFXqoel.exe
  2⤵
  PID:11776
- C:\Windows\System\WaNxrXz.exe
  C:\Windows\System\WaNxrXz.exe
  2⤵
  PID:11800
- C:\Windows\System\gDeKwhm.exe
  C:\Windows\System\gDeKwhm.exe
  2⤵
  PID:11820
- C:\Windows\System\giRfQcT.exe
  C:\Windows\System\giRfQcT.exe
  2⤵
  PID:11848
- C:\Windows\System\tWHJKDA.exe
  C:\Windows\System\tWHJKDA.exe
  2⤵
  PID:11908
- C:\Windows\System\FpWVADV.exe
  C:\Windows\System\FpWVADV.exe
  2⤵
  PID:11928
- C:\Windows\System\zMmAQnv.exe
  C:\Windows\System\zMmAQnv.exe
  2⤵
  PID:11952
- C:\Windows\System\LVLVnMj.exe
  C:\Windows\System\LVLVnMj.exe
  2⤵
  PID:11980
- C:\Windows\System\xrfqnix.exe
  C:\Windows\System\xrfqnix.exe
  2⤵
  PID:12020
- C:\Windows\System\cqpName.exe
  C:\Windows\System\cqpName.exe
  2⤵
  PID:12040
- C:\Windows\System\hAxpXzd.exe
  C:\Windows\System\hAxpXzd.exe
  2⤵
  PID:12064
- C:\Windows\System\VCkrSiW.exe
  C:\Windows\System\VCkrSiW.exe
  2⤵
  PID:12092
- C:\Windows\System\pwimxue.exe
  C:\Windows\System\pwimxue.exe
  2⤵
  PID:12140
- C:\Windows\System\MWnTUdY.exe
  C:\Windows\System\MWnTUdY.exe
  2⤵
  PID:12184
- C:\Windows\System\uTRfHXB.exe
  C:\Windows\System\uTRfHXB.exe
  2⤵
  PID:12200
- C:\Windows\System\OmnfrpW.exe
  C:\Windows\System\OmnfrpW.exe
  2⤵
  PID:12228
- C:\Windows\System\eBvqgoo.exe
  C:\Windows\System\eBvqgoo.exe
  2⤵
  PID:12260
- C:\Windows\System\TZGAgst.exe
  C:\Windows\System\TZGAgst.exe
  2⤵
  PID:11188
- C:\Windows\System\viiUWTW.exe
  C:\Windows\System\viiUWTW.exe
  2⤵
  PID:10304
- C:\Windows\System\DWsCgGQ.exe
  C:\Windows\System\DWsCgGQ.exe
  2⤵
  PID:11312
- C:\Windows\System\TRBailW.exe
  C:\Windows\System\TRBailW.exe
  2⤵
  PID:11360
- C:\Windows\System\fVkaYeR.exe
  C:\Windows\System\fVkaYeR.exe
  2⤵
  PID:11456
- C:\Windows\System\mByaAUa.exe
  C:\Windows\System\mByaAUa.exe
  2⤵
  PID:11496
- C:\Windows\System\AHYiPus.exe
  C:\Windows\System\AHYiPus.exe
  2⤵
  PID:11592
- C:\Windows\System\PWFKdQf.exe
  C:\Windows\System\PWFKdQf.exe
  2⤵
  PID:11652
- C:\Windows\System\IJGCFSG.exe
  C:\Windows\System\IJGCFSG.exe
  2⤵
  PID:11712
- C:\Windows\System\MNDuvBC.exe
  C:\Windows\System\MNDuvBC.exe
  2⤵
  PID:11768
- C:\Windows\System\saCvyCx.exe
  C:\Windows\System\saCvyCx.exe
  2⤵
  PID:11808
- C:\Windows\System\ocjzblF.exe
  C:\Windows\System\ocjzblF.exe
  2⤵
  PID:11944
- C:\Windows\System\aKZdrmt.exe
  C:\Windows\System\aKZdrmt.exe
  2⤵
  PID:12012
- C:\Windows\System\yFACulL.exe
  C:\Windows\System\yFACulL.exe
  2⤵
  PID:12028
- C:\Windows\System\uSnSSPM.exe
  C:\Windows\System\uSnSSPM.exe
  2⤵
  PID:12132
- C:\Windows\System\mihSwEO.exe
  C:\Windows\System\mihSwEO.exe
  2⤵
  PID:12240
- C:\Windows\System\xIIVhuZ.exe
  C:\Windows\System\xIIVhuZ.exe
  2⤵
  PID:12252
- C:\Windows\System\IxrxFfO.exe
  C:\Windows\System\IxrxFfO.exe
  2⤵
  PID:11308
- C:\Windows\System\xpswpyC.exe
  C:\Windows\System\xpswpyC.exe
  2⤵
  PID:11428
- C:\Windows\System\BUCGxIy.exe
  C:\Windows\System\BUCGxIy.exe
  2⤵
  PID:11636
- C:\Windows\System\wuCZuwj.exe
  C:\Windows\System\wuCZuwj.exe
  2⤵
  PID:11772
- C:\Windows\System\DODOARm.exe
  C:\Windows\System\DODOARm.exe
  2⤵
  PID:11092
- C:\Windows\System\NRVuYLH.exe
  C:\Windows\System\NRVuYLH.exe
  2⤵
  PID:12036
- C:\Windows\System\lfHlrGc.exe
  C:\Windows\System\lfHlrGc.exe
  2⤵
  PID:12180
- C:\Windows\System\fPUFMMx.exe
  C:\Windows\System\fPUFMMx.exe
  2⤵
  PID:11392
- C:\Windows\System\CDUuwSz.exe
  C:\Windows\System\CDUuwSz.exe
  2⤵
  PID:11836
- C:\Windows\System\JNcaiCY.exe
  C:\Windows\System\JNcaiCY.exe
  2⤵
  PID:11564
- C:\Windows\System\pMGkBbf.exe
  C:\Windows\System\pMGkBbf.exe
  2⤵
  PID:12220
- C:\Windows\System\lWWuOBQ.exe
  C:\Windows\System\lWWuOBQ.exe
  2⤵
  PID:12304
- C:\Windows\System\PtgstGr.exe
  C:\Windows\System\PtgstGr.exe
  2⤵
  PID:12332
- C:\Windows\System\KQAKEmZ.exe
  C:\Windows\System\KQAKEmZ.exe
  2⤵
  PID:12352
- C:\Windows\System\pusFUpP.exe
  C:\Windows\System\pusFUpP.exe
  2⤵
  PID:12384
- C:\Windows\System\sFgJAfl.exe
  C:\Windows\System\sFgJAfl.exe
  2⤵
  PID:12416
- C:\Windows\System\UQhSllY.exe
  C:\Windows\System\UQhSllY.exe
  2⤵
  PID:12444
- C:\Windows\System\dzSKfeN.exe
  C:\Windows\System\dzSKfeN.exe
  2⤵
  PID:12460
- C:\Windows\System\EUHNoXz.exe
  C:\Windows\System\EUHNoXz.exe
  2⤵
  PID:12480
- C:\Windows\System\QULTZgE.exe
  C:\Windows\System\QULTZgE.exe
  2⤵
  PID:12500
- C:\Windows\System\RixMVox.exe
  C:\Windows\System\RixMVox.exe
  2⤵
  PID:12548
- C:\Windows\System\uRSZusv.exe
  C:\Windows\System\uRSZusv.exe
  2⤵
  PID:12572
- C:\Windows\System\TwVTOzG.exe
  C:\Windows\System\TwVTOzG.exe
  2⤵
  PID:12600
- C:\Windows\System\PxGeLOV.exe
  C:\Windows\System\PxGeLOV.exe
  2⤵
  PID:12640
- C:\Windows\System\zKxgPWe.exe
  C:\Windows\System\zKxgPWe.exe
  2⤵
  PID:12668
- C:\Windows\System\OJhYdzR.exe
  C:\Windows\System\OJhYdzR.exe
  2⤵
  PID:12696
- C:\Windows\System\EjFEAJE.exe
  C:\Windows\System\EjFEAJE.exe
  2⤵
  PID:12724
- C:\Windows\System\tVhjsOy.exe
  C:\Windows\System\tVhjsOy.exe
  2⤵
  PID:12752
- C:\Windows\System\FyvIvEE.exe
  C:\Windows\System\FyvIvEE.exe
  2⤵
  PID:12780
- C:\Windows\System\NKndzwx.exe
  C:\Windows\System\NKndzwx.exe
  2⤵
  PID:12808
- C:\Windows\System\mhwuALz.exe
  C:\Windows\System\mhwuALz.exe
  2⤵
  PID:12836
- C:\Windows\System\DOSVfDn.exe
  C:\Windows\System\DOSVfDn.exe
  2⤵
  PID:12860
- C:\Windows\System\kjFXJyq.exe
  C:\Windows\System\kjFXJyq.exe
  2⤵
  PID:12884
- C:\Windows\System\uFuRPNq.exe
  C:\Windows\System\uFuRPNq.exe
  2⤵
  PID:12912
- C:\Windows\System\ziaWJeV.exe
  C:\Windows\System\ziaWJeV.exe
  2⤵
  PID:12948
- C:\Windows\System\qOOHOYO.exe
  C:\Windows\System\qOOHOYO.exe
  2⤵
  PID:12976
- C:\Windows\System\uiNlyke.exe
  C:\Windows\System\uiNlyke.exe
  2⤵
  PID:13000
- C:\Windows\System\oKJxtBP.exe
  C:\Windows\System\oKJxtBP.exe
  2⤵
  PID:13032
- C:\Windows\System\FCSDmrt.exe
  C:\Windows\System\FCSDmrt.exe
  2⤵
  PID:13048
- C:\Windows\System\QkNDqek.exe
  C:\Windows\System\QkNDqek.exe
  2⤵
  PID:13088
- C:\Windows\System\sPBycbi.exe
  C:\Windows\System\sPBycbi.exe
  2⤵
  PID:13116
- C:\Windows\System\haYlQcP.exe
  C:\Windows\System\haYlQcP.exe
  2⤵
  PID:13144
- C:\Windows\System\ZwTXjQn.exe
  C:\Windows\System\ZwTXjQn.exe
  2⤵
  PID:13172
- C:\Windows\System\IUfvZQV.exe
  C:\Windows\System\IUfvZQV.exe
  2⤵
  PID:13200
- C:\Windows\System\klorGpU.exe
  C:\Windows\System\klorGpU.exe
  2⤵
  PID:13228
- C:\Windows\System\oIZcbfp.exe
  C:\Windows\System\oIZcbfp.exe
  2⤵
  PID:13256
- C:\Windows\System\yhAKXxV.exe
  C:\Windows\System\yhAKXxV.exe
  2⤵
  PID:13284
- C:\Windows\System\NkQHLMl.exe
  C:\Windows\System\NkQHLMl.exe
  2⤵
  PID:11732
- C:\Windows\System\MfaddWP.exe
  C:\Windows\System\MfaddWP.exe
  2⤵
  PID:12372
- C:\Windows\System\cXxgMhB.exe
  C:\Windows\System\cXxgMhB.exe
  2⤵
  PID:12404
- C:\Windows\System\RMhZUTC.exe
  C:\Windows\System\RMhZUTC.exe
  2⤵
  PID:12492
- C:\Windows\System\XMKRKdb.exe
  C:\Windows\System\XMKRKdb.exe
  2⤵
  PID:12536
- C:\Windows\System\GiqVBAh.exe
  C:\Windows\System\GiqVBAh.exe
  2⤵
  PID:12616
- C:\Windows\System\UbRzWDO.exe
  C:\Windows\System\UbRzWDO.exe
  2⤵
  PID:12680
- C:\Windows\System\KUvRwgt.exe
  C:\Windows\System\KUvRwgt.exe
  2⤵
  PID:12736
- C:\Windows\System\Jvuycgb.exe
  C:\Windows\System\Jvuycgb.exe
  2⤵
  PID:12804
- C:\Windows\System\dGWZszY.exe
  C:\Windows\System\dGWZszY.exe
  2⤵
  PID:12872
- C:\Windows\System\eQyzTTN.exe
  C:\Windows\System\eQyzTTN.exe
  2⤵
  PID:12936
- C:\Windows\System\DyPJyNF.exe
  C:\Windows\System\DyPJyNF.exe
  2⤵
  PID:12988
- C:\Windows\System\PBedLie.exe
  C:\Windows\System\PBedLie.exe
  2⤵
  PID:13064
- C:\Windows\System\yeJJBTe.exe
  C:\Windows\System\yeJJBTe.exe
  2⤵
  PID:13128
- C:\Windows\System\xIlDQZy.exe
  C:\Windows\System\xIlDQZy.exe
  2⤵
  PID:13192
- C:\Windows\System\bQwqMYg.exe
  C:\Windows\System\bQwqMYg.exe
  2⤵
  PID:13224
- C:\Windows\System\LEGFqQH.exe
  C:\Windows\System\LEGFqQH.exe
  2⤵
  PID:13300
- C:\Windows\System\HprJXhN.exe
  C:\Windows\System\HprJXhN.exe
  2⤵
  PID:12360
- C:\Windows\System\EuntSpX.exe
  C:\Windows\System\EuntSpX.exe
  2⤵
  PID:12560
- C:\Windows\System\eQMBgTb.exe
  C:\Windows\System\eQMBgTb.exe
  2⤵
  PID:12664
- C:\Windows\System\DRxDDbc.exe
  C:\Windows\System\DRxDDbc.exe
  2⤵
  PID:12868
- C:\Windows\System\JHeleSd.exe
  C:\Windows\System\JHeleSd.exe
  2⤵
  PID:12992
- C:\Windows\System\yaroupc.exe
  C:\Windows\System\yaroupc.exe
  2⤵
  PID:13164
- C:\Windows\System\ZiLoKIF.exe
  C:\Windows\System\ZiLoKIF.exe
  2⤵
  PID:13212
- C:\Windows\System\udjRsTs.exe
  C:\Windows\System\udjRsTs.exe
  2⤵
  PID:12652
- C:\Windows\System\zAPbwQk.exe
  C:\Windows\System\zAPbwQk.exe
  2⤵
  PID:12932
- C:\Windows\System\lMnFNod.exe
  C:\Windows\System\lMnFNod.exe
  2⤵
  PID:13252
- C:\Windows\System\RBcsIzb.exe
  C:\Windows\System\RBcsIzb.exe
  2⤵
  PID:13272
- C:\Windows\System\YYbJgQP.exe
  C:\Windows\System\YYbJgQP.exe
  2⤵
  PID:13340
- C:\Windows\System\TsFIqyE.exe
  C:\Windows\System\TsFIqyE.exe
  2⤵
  PID:13380
- C:\Windows\System\uHAIDnH.exe
  C:\Windows\System\uHAIDnH.exe
  2⤵
  PID:13408
- C:\Windows\System\KzDkftU.exe
  C:\Windows\System\KzDkftU.exe
  2⤵
  PID:13424
- C:\Windows\System\HNcTNgg.exe
  C:\Windows\System\HNcTNgg.exe
  2⤵
  PID:13464
- C:\Windows\System\BteCydK.exe
  C:\Windows\System\BteCydK.exe
  2⤵
  PID:13480
- C:\Windows\System\ENdsljh.exe
  C:\Windows\System\ENdsljh.exe
  2⤵
  PID:13520
- C:\Windows\System\ChmGeRv.exe
  C:\Windows\System\ChmGeRv.exe
  2⤵
  PID:13548
- C:\Windows\System\adzbSGm.exe
  C:\Windows\System\adzbSGm.exe
  2⤵
  PID:13564
- C:\Windows\System\EttgdEx.exe
  C:\Windows\System\EttgdEx.exe
  2⤵
  PID:13604
- C:\Windows\System\yyYhKCn.exe
  C:\Windows\System\yyYhKCn.exe
  2⤵
  PID:13632
- C:\Windows\System\ymAIjbZ.exe
  C:\Windows\System\ymAIjbZ.exe
  2⤵
  PID:13660
- C:\Windows\System\WVCwOQT.exe
  C:\Windows\System\WVCwOQT.exe
  2⤵
  PID:13688
- C:\Windows\System\ZxqjgjA.exe
  C:\Windows\System\ZxqjgjA.exe
  2⤵
  PID:13720
- C:\Windows\System\yqZcGEJ.exe
  C:\Windows\System\yqZcGEJ.exe
  2⤵
  PID:13748
- C:\Windows\System\xpTVhnb.exe
  C:\Windows\System\xpTVhnb.exe
  2⤵
  PID:13764
- C:\Windows\System\ldbjNOp.exe
  C:\Windows\System\ldbjNOp.exe
  2⤵
  PID:13788
- C:\Windows\System\GcmyUAW.exe
  C:\Windows\System\GcmyUAW.exe
  2⤵
  PID:13820
- C:\Windows\System\hCABZgm.exe
  C:\Windows\System\hCABZgm.exe
  2⤵
  PID:13860
- C:\Windows\System\ScKWvaw.exe
  C:\Windows\System\ScKWvaw.exe
  2⤵
  PID:13876
- C:\Windows\System\pzxYCiX.exe
  C:\Windows\System\pzxYCiX.exe
  2⤵
  PID:13896
- C:\Windows\System\DDtxDNW.exe
  C:\Windows\System\DDtxDNW.exe
  2⤵
  PID:13944
- C:\Windows\System\WWWdyia.exe
  C:\Windows\System\WWWdyia.exe
  2⤵
  PID:13972
- C:\Windows\System\nkEbjIW.exe
  C:\Windows\System\nkEbjIW.exe
  2⤵
  PID:14000
- C:\Windows\System\YnnGlyT.exe
  C:\Windows\System\YnnGlyT.exe
  2⤵
  PID:14016
- C:\Windows\System\LpvJwyT.exe
  C:\Windows\System\LpvJwyT.exe
  2⤵
  PID:14032
- C:\Windows\System\GooZgcS.exe
  C:\Windows\System\GooZgcS.exe
  2⤵
  PID:14048
- C:\Windows\System\dtncehM.exe
  C:\Windows\System\dtncehM.exe
  2⤵
  PID:14072
- C:\Windows\System\FFrJFYX.exe
  C:\Windows\System\FFrJFYX.exe
  2⤵
  PID:14100
- C:\Windows\System\PdjkTMC.exe
  C:\Windows\System\PdjkTMC.exe
  2⤵
  PID:14156
- C:\Windows\System\svDZzyJ.exe
  C:\Windows\System\svDZzyJ.exe
  2⤵
  PID:14196
- C:\Windows\System\SdCvAiC.exe
  C:\Windows\System\SdCvAiC.exe
  2⤵
  PID:14212
- C:\Windows\System\bGxZIDp.exe
  C:\Windows\System\bGxZIDp.exe
  2⤵
  PID:14232
- C:\Windows\System\iNXGxmU.exe
  C:\Windows\System\iNXGxmU.exe
  2⤵
  PID:14256
- C:\Windows\System\feLShqX.exe
  C:\Windows\System\feLShqX.exe
  2⤵
  PID:14288
- C:\Windows\System\SFyFUcU.exe
  C:\Windows\System\SFyFUcU.exe
  2⤵
  PID:14312
- C:\Windows\System\JcVITcu.exe
  C:\Windows\System\JcVITcu.exe
  2⤵
  PID:14328
- C:\Windows\System\oYHoUiO.exe
  C:\Windows\System\oYHoUiO.exe
  2⤵
  PID:13332
- C:\Windows\System\YqlpBEc.exe
  C:\Windows\System\YqlpBEc.exe
  2⤵
  PID:13392
- C:\Windows\System\eEYgKoz.exe
  C:\Windows\System\eEYgKoz.exe
  2⤵
  PID:13456
- C:\Windows\System\OWqRSlg.exe
  C:\Windows\System\OWqRSlg.exe
  2⤵
  PID:13624
- C:\Windows\System\jvNumlZ.exe
  C:\Windows\System\jvNumlZ.exe
  2⤵
  PID:13644
- C:\Windows\System\hUXanlT.exe
  C:\Windows\System\hUXanlT.exe
  2⤵
  PID:13740
- C:\Windows\System\BWrRmdx.exe
  C:\Windows\System\BWrRmdx.exe
  2⤵
  PID:13836
- C:\Windows\System\XBGBuyt.exe
  C:\Windows\System\XBGBuyt.exe
  2⤵
  PID:13872
- C:\Windows\System\NKaMsXu.exe
  C:\Windows\System\NKaMsXu.exe
  2⤵
  PID:13916
- C:\Windows\System\JsuptwO.exe
  C:\Windows\System\JsuptwO.exe
  2⤵
  PID:13992
- C:\Windows\System\UVSBaxC.exe
  C:\Windows\System\UVSBaxC.exe
  2⤵
  PID:14024
- C:\Windows\System\UsxPyHK.exe
  C:\Windows\System\UsxPyHK.exe
  2⤵
  PID:14040
- C:\Windows\System\hpFzElW.exe
  C:\Windows\System\hpFzElW.exe
  2⤵
  PID:14096
- C:\Windows\System\zlcMtVO.exe
  C:\Windows\System\zlcMtVO.exe
  2⤵
  PID:14192
- C:\Windows\System\hJlfVNY.exe
  C:\Windows\System\hJlfVNY.exe
  2⤵
  PID:14296
- C:\Windows\System\WanjrqW.exe
  C:\Windows\System\WanjrqW.exe
  2⤵
  PID:13372
- C:\Windows\System\XZnJSlW.exe
  C:\Windows\System\XZnJSlW.exe
  2⤵
  PID:13556
- C:\Windows\System\CbxUrgy.exe
  C:\Windows\System\CbxUrgy.exe
  2⤵
  PID:13628
- C:\Windows\System\RJWvzpl.exe
  C:\Windows\System\RJWvzpl.exe
  2⤵
  PID:13856
- C:\Windows\System\zPoiisc.exe
  C:\Windows\System\zPoiisc.exe
  2⤵
  PID:13936
- C:\Windows\System\FRQGknX.exe
  C:\Windows\System\FRQGknX.exe
  2⤵
  PID:14064
- C:\Windows\System\XLrOngZ.exe
  C:\Windows\System\XLrOngZ.exe
  2⤵
  PID:14152
- C:\Windows\System\dMvzAiN.exe
  C:\Windows\System\dMvzAiN.exe
  2⤵
  PID:14320
- C:\Windows\System\OIZXDyP.exe
  C:\Windows\System\OIZXDyP.exe
  2⤵
  PID:13496
- C:\Windows\System\kIPlWZg.exe
  C:\Windows\System\kIPlWZg.exe
  2⤵
  PID:13884
- C:\Windows\System\zwCGzmz.exe
  C:\Windows\System\zwCGzmz.exe
  2⤵
  PID:14084
- C:\Windows\System\EkRjELE.exe
  C:\Windows\System\EkRjELE.exe
  2⤵
  PID:14356
- C:\Windows\System\cSBJNRJ.exe
  C:\Windows\System\cSBJNRJ.exe
  2⤵
  PID:14380
- C:\Windows\System\VERSrFi.exe
  C:\Windows\System\VERSrFi.exe
  2⤵
  PID:14400
- C:\Windows\System\LjlqItx.exe
  C:\Windows\System\LjlqItx.exe
  2⤵
  PID:14452
- C:\Windows\System\gtsITeD.exe
  C:\Windows\System\gtsITeD.exe
  2⤵
  PID:14468
- C:\Windows\System\UajYvOP.exe
  C:\Windows\System\UajYvOP.exe
  2⤵
  PID:14496
- C:\Windows\System\tWIWtKD.exe
  C:\Windows\System\tWIWtKD.exe
  2⤵
  PID:14528
- C:\Windows\System\dobEEUe.exe
  C:\Windows\System\dobEEUe.exe
  2⤵
  PID:14560
- C:\Windows\System\uNpSUOY.exe
  C:\Windows\System\uNpSUOY.exe
  2⤵
  PID:14612
- C:\Windows\System\HRpLWyX.exe
  C:\Windows\System\HRpLWyX.exe
  2⤵
  PID:14636
- C:\Windows\System\ANzyuRV.exe
  C:\Windows\System\ANzyuRV.exe
  2⤵
  PID:14664
- C:\Windows\System\TuTlYpi.exe
  C:\Windows\System\TuTlYpi.exe
  2⤵
  PID:14704
- C:\Windows\System\hfYCSFr.exe
  C:\Windows\System\hfYCSFr.exe
  2⤵
  PID:14732
- C:\Windows\System\TvJgoeB.exe
  C:\Windows\System\TvJgoeB.exe
  2⤵
  PID:14752
- C:\Windows\System\UjtCWyd.exe
  C:\Windows\System\UjtCWyd.exe
  2⤵
  PID:14780
- C:\Windows\System\VtlAAoD.exe
  C:\Windows\System\VtlAAoD.exe
  2⤵
  PID:14808
- C:\Windows\System\jxUpDsu.exe
  C:\Windows\System\jxUpDsu.exe
  2⤵
  PID:14848
- C:\Windows\System\enejpwu.exe
  C:\Windows\System\enejpwu.exe
  2⤵
  PID:14872
- C:\Windows\System\uTrndvk.exe
  C:\Windows\System\uTrndvk.exe
  2⤵
  PID:14904
- C:\Windows\System\mdpqwvq.exe
  C:\Windows\System\mdpqwvq.exe
  2⤵
  PID:14936
- C:\Windows\System\STBIwGk.exe
  C:\Windows\System\STBIwGk.exe
  2⤵
  PID:14960
- C:\Windows\System\GesRJyJ.exe
  C:\Windows\System\GesRJyJ.exe
  2⤵
  PID:15000
- C:\Windows\System\zLqwsml.exe
  C:\Windows\System\zLqwsml.exe
  2⤵
  PID:15016
- C:\Windows\System\QRmEZLX.exe
  C:\Windows\System\QRmEZLX.exe
  2⤵
  PID:15064
- C:\Windows\System\hcdWqGx.exe
  C:\Windows\System\hcdWqGx.exe
  2⤵
  PID:15088
- C:\Windows\System\lPRFjan.exe
  C:\Windows\System\lPRFjan.exe
  2⤵
  PID:15188
- C:\Windows\System\CGArKnh.exe
  C:\Windows\System\CGArKnh.exe
  2⤵
  PID:15216
- C:\Windows\System\XVkJukV.exe
  C:\Windows\System\XVkJukV.exe
  2⤵
  PID:15232
- C:\Windows\System\ZjkaUkR.exe
  C:\Windows\System\ZjkaUkR.exe
  2⤵
  PID:15276
- C:\Windows\System\JzlBNDP.exe
  C:\Windows\System\JzlBNDP.exe
  2⤵
  PID:15308
- C:\Windows\System\iTdHMXe.exe
  C:\Windows\System\iTdHMXe.exe
  2⤵
  PID:15324
- C:\Windows\System\BWJkFwY.exe
  C:\Windows\System\BWJkFwY.exe
  2⤵
  PID:15352
- C:\Windows\System\aktJukm.exe
  C:\Windows\System\aktJukm.exe
  2⤵
  PID:14376
- C:\Windows\System\bkTrGFd.exe
  C:\Windows\System\bkTrGFd.exe
  2⤵
  PID:14392
- C:\Windows\System\dBEkQzR.exe
  C:\Windows\System\dBEkQzR.exe
  2⤵
  PID:14524
- C:\Windows\System\CvzghXw.exe
  C:\Windows\System\CvzghXw.exe
  2⤵
  PID:14580
- C:\Windows\System\FwaGXoL.exe
  C:\Windows\System\FwaGXoL.exe
  2⤵
  PID:14688
- C:\Windows\System\kXOMqPw.exe
  C:\Windows\System\kXOMqPw.exe
  2⤵
  PID:14748
- C:\Windows\System\BBWWkgN.exe
  C:\Windows\System\BBWWkgN.exe
  2⤵
  PID:14772
- C:\Windows\System\iWloWLf.exe
  C:\Windows\System\iWloWLf.exe
  2⤵
  PID:14868
- C:\Windows\System\hWtFgBJ.exe
  C:\Windows\System\hWtFgBJ.exe
  2⤵
  PID:14944
- C:\Windows\System\GVOxxIx.exe
  C:\Windows\System\GVOxxIx.exe
  2⤵
  PID:14972
- C:\Windows\System\TLHGjQS.exe
  C:\Windows\System\TLHGjQS.exe
  2⤵
  PID:15132
- C:\Windows\System\hUjoLdb.exe
  C:\Windows\System\hUjoLdb.exe
  2⤵
  PID:15204
- C:\Windows\System\QfMFOEd.exe
  C:\Windows\System\QfMFOEd.exe
  2⤵
  PID:15268
- C:\Windows\System\DBIbFXU.exe
  C:\Windows\System\DBIbFXU.exe
  2⤵
  PID:15348
- C:\Windows\System\iaXLKYi.exe
  C:\Windows\System\iaXLKYi.exe
  2⤵
  PID:14516
- C:\Windows\System\ehVVbIs.exe
  C:\Windows\System\ehVVbIs.exe
  2⤵
  PID:14632
- C:\Windows\System\kpdoBcc.exe
  C:\Windows\System\kpdoBcc.exe
  2⤵
  PID:14820
- C:\Windows\System\tjxZbmF.exe
  C:\Windows\System\tjxZbmF.exe
  2⤵
  PID:14924
- C:\Windows\System\exYTvWU.exe
  C:\Windows\System\exYTvWU.exe
  2⤵
  PID:15084
- C:\Windows\System\SSsdYeS.exe
  C:\Windows\System\SSsdYeS.exe
  2⤵
  PID:15320
- C:\Windows\System\jGSMNAc.exe
  C:\Windows\System\jGSMNAc.exe
  2⤵
  PID:14424
- C:\Windows\System\ISvftjy.exe
  C:\Windows\System\ISvftjy.exe
  2⤵
  PID:14724
- C:\Windows\System\CNZScSL.exe
  C:\Windows\System\CNZScSL.exe
  2⤵
  PID:14984
- C:\Windows\System\BTingnJ.exe
  C:\Windows\System\BTingnJ.exe
  2⤵
  PID:14396
- C:\Windows\System\irmYyjp.exe
  C:\Windows\System\irmYyjp.exe
  2⤵
  PID:15364
- C:\Windows\System\LuBaDTv.exe
  C:\Windows\System\LuBaDTv.exe
  2⤵
  PID:15388
- C:\Windows\System\jFdFeER.exe
  C:\Windows\System\jFdFeER.exe
  2⤵
  PID:15420
- C:\Windows\System\FQYZayF.exe
  C:\Windows\System\FQYZayF.exe
  2⤵
  PID:15440
- C:\Windows\System\FPlsrPg.exe
  C:\Windows\System\FPlsrPg.exe
  2⤵
  PID:15468
- C:\Windows\System\RtzdPQk.exe
  C:\Windows\System\RtzdPQk.exe
  2⤵
  PID:15496
- C:\Windows\System\VMgIyaf.exe
  C:\Windows\System\VMgIyaf.exe
  2⤵
  PID:15512
- C:\Windows\System\fSwbSjD.exe
  C:\Windows\System\fSwbSjD.exe
  2⤵
  PID:15548
- C:\Windows\System\hImdnze.exe
  C:\Windows\System\hImdnze.exe
  2⤵
  PID:15564
- C:\Windows\System\IjIGzze.exe
  C:\Windows\System\IjIGzze.exe
  2⤵
  PID:15604
- C:\Windows\System\pSQDoIm.exe
  C:\Windows\System\pSQDoIm.exe
  2⤵
  PID:15628
- C:\Windows\System\kOEZIoV.exe
  C:\Windows\System\kOEZIoV.exe
  2⤵
  PID:15652
- C:\Windows\System\apalRei.exe
  C:\Windows\System\apalRei.exe
  2⤵
  PID:15676
- C:\Windows\System\UiZXAjs.exe
  C:\Windows\System\UiZXAjs.exe
  2⤵
  PID:15712
- C:\Windows\System\SybnXxg.exe
  C:\Windows\System\SybnXxg.exe
  2⤵
  PID:15736
- C:\Windows\System\UxsXfEQ.exe
  C:\Windows\System\UxsXfEQ.exe
  2⤵
  PID:15764
- C:\Windows\System\nWyAWGb.exe
  C:\Windows\System\nWyAWGb.exe
  2⤵
  PID:15792
- C:\Windows\System\VVMfvfz.exe
  C:\Windows\System\VVMfvfz.exe
  2⤵
  PID:15828
- C:\Windows\System\LAlwHYn.exe
  C:\Windows\System\LAlwHYn.exe
  2⤵
  PID:15856
- C:\Windows\System\HCXOkVw.exe
  C:\Windows\System\HCXOkVw.exe
  2⤵
  PID:15880
- C:\Windows\System\cIdVbVo.exe
  C:\Windows\System\cIdVbVo.exe
  2⤵
  PID:15904
- C:\Windows\System\TyfrbbJ.exe
  C:\Windows\System\TyfrbbJ.exe
  2⤵
  PID:15924
- C:\Windows\System\jcYaHex.exe
  C:\Windows\System\jcYaHex.exe
  2⤵
  PID:15944
- C:\Windows\System\xBTVqxu.exe
  C:\Windows\System\xBTVqxu.exe
  2⤵
  PID:15972
- C:\Windows\System\nGETxeX.exe
  C:\Windows\System\nGETxeX.exe
  2⤵
  PID:16004
- C:\Windows\System\fmjnfEn.exe
  C:\Windows\System\fmjnfEn.exe
  2⤵
  PID:16036
- C:\Windows\System\UkILCGc.exe
  C:\Windows\System\UkILCGc.exe
  2⤵
  PID:16056
- C:\Windows\System\LsTwabC.exe
  C:\Windows\System\LsTwabC.exe
  2⤵
  PID:16084
- C:\Windows\System\VCddHrI.exe
  C:\Windows\System\VCddHrI.exe
  2⤵
  PID:16120
- C:\Windows\System\pjytNlk.exe
  C:\Windows\System\pjytNlk.exe
  2⤵
  PID:16140
- C:\Windows\System\qyFTuMP.exe
  C:\Windows\System\qyFTuMP.exe
  2⤵
  PID:16168
- C:\Windows\System\gZVxsMV.exe
  C:\Windows\System\gZVxsMV.exe
  2⤵
  PID:16196
- C:\Windows\System\pKdURzF.exe
  C:\Windows\System\pKdURzF.exe
  2⤵
  PID:16232
- C:\Windows\System\zzIBHnF.exe
  C:\Windows\System\zzIBHnF.exe
  2⤵
  PID:16252
- C:\Windows\System\khtgsXH.exe
  C:\Windows\System\khtgsXH.exe
  2⤵
  PID:16288
- C:\Windows\System\JSWeaKT.exe
  C:\Windows\System\JSWeaKT.exe
  2⤵
  PID:16308
- C:\Windows\System\JNLhkVm.exe
  C:\Windows\System\JNLhkVm.exe
  2⤵
  PID:16340
- C:\Windows\System\rmOzJJV.exe
  C:\Windows\System\rmOzJJV.exe
  2⤵
  PID:16368
- C:\Windows\System\RNpKXjd.exe
  C:\Windows\System\RNpKXjd.exe
  2⤵
  PID:14896
- C:\Windows\System\cbSysxU.exe
  C:\Windows\System\cbSysxU.exe
  2⤵
  PID:15252
- C:\Windows\System\gRnywBq.exe
  C:\Windows\System\gRnywBq.exe
  2⤵
  PID:15464
- C:\Windows\System\HprFlgr.exe
  C:\Windows\System\HprFlgr.exe
  2⤵
  PID:15540
- C:\Windows\System\mkRlTwT.exe
  C:\Windows\System\mkRlTwT.exe
  2⤵
  PID:15620
- C:\Windows\System\BUAbolo.exe
  C:\Windows\System\BUAbolo.exe
  2⤵
  PID:15672
- C:\Windows\System\NGKHdbu.exe
  C:\Windows\System\NGKHdbu.exe
  2⤵
  PID:15684
- C:\Windows\System\EHlPWWD.exe
  C:\Windows\System\EHlPWWD.exe
  2⤵
  PID:15780
- C:\Windows\System\WJGuawP.exe
  C:\Windows\System\WJGuawP.exe
  2⤵
  PID:15872
- C:\Windows\System\CvvXHNg.exe
  C:\Windows\System\CvvXHNg.exe
  2⤵
  PID:15912
- C:\Windows\System\eaCUmlA.exe
  C:\Windows\System\eaCUmlA.exe
  2⤵
  PID:15936
- C:\Windows\System\yPvSNcs.exe
  C:\Windows\System\yPvSNcs.exe
  2⤵
  PID:15964
- C:\Windows\System\tQJksUw.exe
  C:\Windows\System\tQJksUw.exe
  2⤵
  PID:16184
- C:\Windows\System\ibwwsub.exe
  C:\Windows\System\ibwwsub.exe
  2⤵
  PID:16092
- C:\Windows\System\TgVqAhv.exe
  C:\Windows\System\TgVqAhv.exe
  2⤵
  PID:16204
- C:\Windows\System\mjyDIEp.exe
  C:\Windows\System\mjyDIEp.exe
  2⤵
  PID:16376
- C:\Windows\System\PChDCzN.exe
  C:\Windows\System\PChDCzN.exe
  2⤵
  PID:16332
- C:\Windows\System\pMLcpko.exe
  C:\Windows\System\pMLcpko.exe
  2⤵
  PID:16380
- C:\Windows\System\lYPStQb.exe
  C:\Windows\System\lYPStQb.exe
  2⤵
  PID:15416
- C:\Windows\System\qVdImOI.exe
  C:\Windows\System\qVdImOI.exe
  2⤵
  PID:15592
- C:\Windows\System\ojzGfua.exe
  C:\Windows\System\ojzGfua.exe
  2⤵
  PID:15728
- C:\Windows\System\xXpwcBd.exe
  C:\Windows\System\xXpwcBd.exe
  2⤵
  PID:15648
- C:\Windows\System\dbpfzAL.exe
  C:\Windows\System\dbpfzAL.exe
  2⤵
  PID:16108
- C:\Windows\System\QXPjenr.exe
  C:\Windows\System\QXPjenr.exe
  2⤵
  PID:15408
- C:\Windows\System\esIoMdu.exe
  C:\Windows\System\esIoMdu.exe
  2⤵
  PID:16360
- C:\Windows\System\aAKfJZC.exe
  C:\Windows\System\aAKfJZC.exe
  2⤵
  PID:16392
- C:\Windows\System\SHiHtwx.exe
  C:\Windows\System\SHiHtwx.exe
  2⤵
  PID:16420
- C:\Windows\System\HgvmSTp.exe
  C:\Windows\System\HgvmSTp.exe
  2⤵
  PID:16452
- C:\Windows\System\LnxvIoU.exe
  C:\Windows\System\LnxvIoU.exe
  2⤵
  PID:16472
- C:\Windows\System\nNChrgE.exe
  C:\Windows\System\nNChrgE.exe
  2⤵
  PID:16500
- C:\Windows\System\tEhxRRT.exe
  C:\Windows\System\tEhxRRT.exe
  2⤵
  PID:16520
- C:\Windows\System\yrLsTqe.exe
  C:\Windows\System\yrLsTqe.exe
  2⤵
  PID:16540
- C:\Windows\System\inDwoum.exe
  C:\Windows\System\inDwoum.exe
  2⤵
  PID:16568
- C:\Windows\System\lilWBMU.exe
  C:\Windows\System\lilWBMU.exe
  2⤵
  PID:16596
- C:\Windows\System\cBBhPeS.exe
  C:\Windows\System\cBBhPeS.exe
  2⤵
  PID:16624
- C:\Windows\System\UEQLEzu.exe
  C:\Windows\System\UEQLEzu.exe
  2⤵
  PID:16656
- C:\Windows\System\TxXjNzf.exe
  C:\Windows\System\TxXjNzf.exe
  2⤵
  PID:16688
- C:\Windows\System\RpfYVZZ.exe
  C:\Windows\System\RpfYVZZ.exe
  2⤵
  PID:16724
- C:\Windows\System\MGVOGLz.exe
  C:\Windows\System\MGVOGLz.exe
  2⤵
  PID:16752
- C:\Windows\System\NGCBuTh.exe
  C:\Windows\System\NGCBuTh.exe
  2⤵
  PID:16772
- C:\Windows\System\javpKFX.exe
  C:\Windows\System\javpKFX.exe
  2⤵
  PID:16808
- C:\Windows\System\JgocuVT.exe
  C:\Windows\System\JgocuVT.exe
  2⤵
  PID:16836
- C:\Windows\System\LcXZgnj.exe
  C:\Windows\System\LcXZgnj.exe
  2⤵
  PID:16868
- C:\Windows\System\HxsVvqK.exe
  C:\Windows\System\HxsVvqK.exe
  2⤵
  PID:16884
- C:\Windows\System\AQSLsXd.exe
  C:\Windows\System\AQSLsXd.exe
  2⤵
  PID:16912
- C:\Windows\System\cVQgvbx.exe
  C:\Windows\System\cVQgvbx.exe
  2⤵
  PID:16936
- C:\Windows\System\khYwKTI.exe
  C:\Windows\System\khYwKTI.exe
  2⤵
  PID:16968
- C:\Windows\System\kiVgWAq.exe
  C:\Windows\System\kiVgWAq.exe
  2⤵
  PID:16988
- C:\Windows\System\aKVTikE.exe
  C:\Windows\System\aKVTikE.exe
  2⤵
  PID:17016
- C:\Windows\System\cjBurgq.exe
  C:\Windows\System\cjBurgq.exe
  2⤵
  PID:17040
- C:\Windows\System\SCUUbjw.exe
  C:\Windows\System\SCUUbjw.exe
  2⤵
  PID:17076
- C:\Windows\System\xIEsblD.exe
  C:\Windows\System\xIEsblD.exe
  2⤵
  PID:17104
- C:\Windows\System\IrAhEgV.exe
  C:\Windows\System\IrAhEgV.exe
  2⤵
  PID:17136
- C:\Windows\System\UXjnGJY.exe
  C:\Windows\System\UXjnGJY.exe
  2⤵
  PID:17168
- C:\Windows\System\lxKUEbC.exe
  C:\Windows\System\lxKUEbC.exe
  2⤵
  PID:17196
- C:\Windows\System\OxnoFjg.exe
  C:\Windows\System\OxnoFjg.exe
  2⤵
  PID:17212
- C:\Windows\System\ihIznvs.exe
  C:\Windows\System\ihIznvs.exe
  2⤵
  PID:17236
- C:\Windows\System\TXihPIg.exe
  C:\Windows\System\TXihPIg.exe
  2⤵
  PID:17268
- C:\Windows\System\gRddUxa.exe
  C:\Windows\System\gRddUxa.exe
  2⤵
  PID:17296
- C:\Windows\System\pztlNPn.exe
  C:\Windows\System\pztlNPn.exe
  2⤵
  PID:17324
- C:\Windows\System\fVpDmDr.exe
  C:\Windows\System\fVpDmDr.exe
  2⤵
  PID:17348
- C:\Windows\System\XWwAwhb.exe
  C:\Windows\System\XWwAwhb.exe
  2⤵
  PID:17376
- C:\Windows\System\ePrQTMC.exe
  C:\Windows\System\ePrQTMC.exe
  2⤵
  PID:17400
- C:\Windows\System\rXCQFLT.exe
  C:\Windows\System\rXCQFLT.exe
  2⤵
  PID:15476
- C:\Windows\System\cSShJKb.exe
  C:\Windows\System\cSShJKb.exe
  2⤵
  PID:15984
- C:\Windows\System\llvynGh.exe
  C:\Windows\System\llvynGh.exe
  2⤵
  PID:16152
- C:\Windows\System\UsgCpyU.exe
  C:\Windows\System\UsgCpyU.exe
  2⤵
  PID:16580
- C:\Windows\System\sGgtbQF.exe
  C:\Windows\System\sGgtbQF.exe
  2⤵
  PID:16684
- C:\Windows\System\doxYCRi.exe
  C:\Windows\System\doxYCRi.exe
  2⤵
  PID:16736
- C:\Windows\System\QwmTEJY.exe
  C:\Windows\System\QwmTEJY.exe
  2⤵
  PID:16744
- C:\Windows\System\xVsMoqn.exe
  C:\Windows\System\xVsMoqn.exe
  2⤵
  PID:16876
- C:\Windows\System\noIUhMT.exe
  C:\Windows\System\noIUhMT.exe
  2⤵
  PID:16848
- C:\Windows\System\qhWKiJU.exe
  C:\Windows\System\qhWKiJU.exe
  2⤵
  PID:16880
- C:\Windows\System\EvhzErN.exe
  C:\Windows\System\EvhzErN.exe
  2⤵
  PID:17088
- C:\Windows\System\NsHeAyA.exe
  C:\Windows\System\NsHeAyA.exe
  2⤵
  PID:17060
- C:\Windows\System\qcSgYVr.exe
  C:\Windows\System\qcSgYVr.exe
  2⤵
  PID:17156
- C:\Windows\System\FTJlZbb.exe
  C:\Windows\System\FTJlZbb.exe
  2⤵
  PID:17260
- C:\Windows\System\TSisUxZ.exe
  C:\Windows\System\TSisUxZ.exe
  2⤵
  PID:17336
- C:\Windows\System\aUMDsPx.exe
  C:\Windows\System\aUMDsPx.exe
  2⤵
  PID:17396
- C:\Windows\System\bLnmrdG.exe
  C:\Windows\System\bLnmrdG.exe
  2⤵
  PID:16028
- C:\Windows\System\IdwgksY.exe
  C:\Windows\System\IdwgksY.exe
  2⤵
  PID:16516
- C:\Windows\System\emqbItz.exe
  C:\Windows\System\emqbItz.exe
  2⤵
  PID:17096
- C:\Windows\System\XQBzwyL.exe
  C:\Windows\System\XQBzwyL.exe
  2⤵
  PID:15892

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:9032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CrZxkmi.exe

Filesize
1.7MB

MD5
7ce8e94675049da3b3a923bbef4bc199

SHA1
9fe1bd23aadce67f4ab5e3ca6627c070918750be

SHA256
c96f8c60aa24a5ef48d4c9151b14d2b6d30b21a3984b271b1086a5705476f92b

SHA512
b7eb675b449ffc8180df15cc4ea9ed98dba0764232d89e8913708bddfbb874394398ce78a5002e655980836621e6d2d0e7628b8d49e55bbd9ad06122f325eb50

Download Submit
C:\Windows\System\EPzIYGK.exe

Filesize
1.7MB

MD5
9b36f20ab8bbb48cdec904aad4563133

SHA1
665c87973eb50fde338a0e5594d0e36a39945d0b

SHA256
b45e191bc1864d9bec68d14104bdddea0b337934cae686c05af6921a11ba0711

SHA512
4ab2c5e1f5b0e50388bf64dc1006d80f71fd6a9a7af86fc3303482810c385a7425db30578bd467a0ced68562de2460373053982a7c99fee307b5c7be8e65ca38

Download Submit
C:\Windows\System\EccxlWb.exe

Filesize
1.7MB

MD5
de9ccf8a10febc50fcb68a86f7cbd67e

SHA1
c1541faee7b220e5431fec7aa7aa47c849eff76e

SHA256
7a51f1ee57730f45bb57be2348d8e6bd5fedd3ae1ab9134cd9e410f7686a7ab9

SHA512
07d9e337967b9b14e16ccdcee20167d03ac5e27b060066fe6d21265ec272770a0c617fd2ffae1832f6fe3a966bf83b7625eb25dc7adb3af9c2c82bfe87522fb4

Download Submit
C:\Windows\System\FXGSkpr.exe

Filesize
1.7MB

MD5
648fb5960971553f02fcd012cfd8f306

SHA1
76437d489565ece97c8358ccb8df0060a0f2dadc

SHA256
48776beb2ee2cca19b036990a5eb9bc150e5cd8e202094315e61d8bd92d60c19

SHA512
ef06b4a49a293ad591f6a0bbf1120cad403d35585a92094507986314e0e984951156330cb9d04fd57fc9d0dd531aaf56f804d7db0b57fff2a1d4b7d5d2ad42fa

Download Submit
C:\Windows\System\FoSwBcr.exe

Filesize
1.7MB

MD5
8f18079935f76eec02fa77b010589315

SHA1
a7f4a7d45dc6ec94a6c8e984b28f04d9229f89ef

SHA256
e1f5edd1042b072d6c29eb80c9e5d5f77ac4ceaaa27ae8186803afbf5926e3e2

SHA512
a7417a2068b9e047c25d83a5baee2a9fbd9e3450d44d030613ed6bd02986eadbc30744edd7e9c44c1a0f36694854f51cd2924434771f4276d62010d67dc0f988

Download Submit
C:\Windows\System\HDiAyPI.exe

Filesize
1.7MB

MD5
e0dbbcb1d81b6f5dc657ccc60a8d230c

SHA1
4e021a6796db585f914a57560400a5601ebf4d2b

SHA256
12f5460db4372f54b1b69b157f4c4f9e34dd45c3e8a170a8db49cbab34d5ab1e

SHA512
bf29c30894290ecc5b7c0ae93d6bc0f627ce96f7a4322eece2c55cc2e74b76bfc5d6d539057a4f9c1e25b2916490eb94762821a79c254745600c96d4fa271900

Download Submit
C:\Windows\System\HnjLvyf.exe

Filesize
1.7MB

MD5
4e4140f2546c7749fe72d4dfe026d2b0

SHA1
f04cd4d831f0523edcf17c7e46504fe28921012c

SHA256
4b5041626f52e93e5f8d18680b3e2508ad0c4df13f96ef9a24482345c7098811

SHA512
b1008cfb5063326590c7e3748426c723c880f5a8cf5259c3184491998ec447a2648928b454e8196e15b3fdec3c2ba4b80e56953984d53364b3f81b861c674bdf

Download Submit
C:\Windows\System\IWwAraN.exe

Filesize
1.7MB

MD5
c3d20eaa1bc05b17e49e2a641aca95ec

SHA1
87f74c4e33773ee88f396cd556bd9a96bdf0f68d

SHA256
db6b43dd7f7c0e818ed0cc2b275dae2f4125fcd03add91f414dcd55f2d6f1724

SHA512
2ff0a948e7d85ca7e9b6bd53442d1445ff3cde0141e66a48a09e3a6066517b8c22acdda78c9cb0319980cd39d448a6b18caf873b33e62af6d4628bc26562e2b2

Download Submit
C:\Windows\System\JZTiCdl.exe

Filesize
1.7MB

MD5
7e040761c848ba2dae4c27de86164ead

SHA1
4b7df09a4f81d093827fe3cc61eae73498ecb1a5

SHA256
bc78f62f12ae97215a4980b42ed847b5f3c3cc22860426093679ade7528f34a1

SHA512
1963dbb108bb85afce627ddd3c7a4c5868380b780da62896360f963ead6c64779d23ec28a22975134a10fc962729452556e901b7f9e958452816649e359309ae

Download Submit
C:\Windows\System\LKxCvYn.exe

Filesize
1.7MB

MD5
e6688e5a582be886b15b69bfa700b06a

SHA1
20c78ebcf90e2b9c796535a088af7ed0a0c0e3e7

SHA256
e0960d9488ae38b0b6feb719fc4299f9785f5e57ffb2077c059f220083f5a699

SHA512
a6f4deae2f5ff0f87c9b7bc8d56df6d6dbb0c588b4ab002f1d64fd26b496be69f7b5549521b6f1ac21fc89cb8804bc87bca1acf5deb5881ad5912846323d76e8

Download Submit
C:\Windows\System\NmJIsMt.exe

Filesize
1.7MB

MD5
339f1af920cfb096c8531fc5de963054

SHA1
b51dfcf55795a342f0ba55351f192f2a00e00a5d

SHA256
23190fe003ee65ace6f52845e426f3c54c37594d715adbd190f493f90e037264

SHA512
6673ae00a7e0b150faf2fe44019cfd2709b3ec85d3b3035f6609be8371da39914f57f84d4c803236c0f0c5c2b8091cf5a70770245bb63256e74f851a9ac3803b

Download Submit
C:\Windows\System\OJiuaAh.exe

Filesize
1.7MB

MD5
bbdd060a82f6d866a9619e7cf8038310

SHA1
a3b9cdc7987e2844732138fcca5d3be9c740dc35

SHA256
e960130d0136530ad8f818f3d4f5eca0ef0447161f404e095172a7da195b1430

SHA512
dad89b9eabd0e08fa8b2fa3fb09f1390766cae941f3049e2a77724d099cc9c371e3db3af724a16a476328a84ae93026578fc343eec3627167a5f78dd22934b30

Download Submit
C:\Windows\System\TGMYcax.exe

Filesize
1.7MB

MD5
114238ccf7c150e8cffe50f3f992b123

SHA1
47c45203361d51d903a61c16992dde25af4f3e37

SHA256
45928d6cfd5b7db7cdf4463cf4c84d9a3c4ca376e4390593db75735aa1a0e50c

SHA512
80518169263a23ab935de44469698e0e975bebf91416582e0754b78cc0d5e150e1eb30fd2832b2eb192f37bde0598e74fa724301044e03ae5f156de95f7a6b46

Download Submit
C:\Windows\System\TkCTjLP.exe

Filesize
1.7MB

MD5
78ebeb69f6603363c178286b975a383b

SHA1
e2782a6e081f99817c9ea29cfc9ee8f296678302

SHA256
23dd39672ccdbb58d2533e3be464bd19dead2c5d39e8447876a49d0c11cb93c8

SHA512
784434dc78907d77e484821d1d11a7ee4082f41812acb587f2577808ff0f0c1d7d4f505bb1e476493119164752d6d563af50ae572d2cef31f0d1f4c8f5e691de

Download Submit
C:\Windows\System\VWGHEiv.exe

Filesize
1.7MB

MD5
bd671556e5d102ff2cffd59798a357fa

SHA1
17b34fc3203b9629402d7a0e024f977abd5be295

SHA256
46bf8f3403fc192236c0782e365d2de00f56a192bc0cdf2cbb69a021df1c234d

SHA512
b66d0cf8f465139fd88e6517af4fdadc1fca162e54d80f67ad97eeebcdd7f6c490bc2a182fd2efa54f441b5715f34a8d5d66022c3c02d4b298a227f7827fde2a

Download Submit
C:\Windows\System\YAjvpiX.exe

Filesize
1.7MB

MD5
c53d7cd3af437fe5395dfe6c3bd60472

SHA1
568e18e7fd83bb9bab4d2d7cedf002c70ca9c0e8

SHA256
3080902d97b5c6d4d45ac4ce21cae6c08c10b3058b3f1909ac111ae2b5b4cabe

SHA512
66fc72f20d3400b8b2a019e0eb518b9b127c751b13087860517d3ccfc79929c43860a6823d0313bee8286a8cd2ed7c1f31816783165767f8045a3b890ae43b93

Download Submit
C:\Windows\System\ZjmaEcm.exe

Filesize
1.7MB

MD5
d086a47a455ff1d0fc58f7df93538c95

SHA1
01f152757b03e6e63280daeaa2a4585de13b2099

SHA256
b235c1deea0f3c34ba2a71c8bbc80021632147c86eb30799988b8ce2f60d8204

SHA512
6f8203de4faab0258b8a77025e696be386822b4650094fb5df111f23039bdcb680d2a09cc7b95539afc2f8dc6fee10cd948ea19f2b4d699796c959daa2957bfa

Download Submit
C:\Windows\System\aVPyzZW.exe

Filesize
1.7MB

MD5
77cec826d95d5047ec84a4036e0137b8

SHA1
705a01b172746ef2624462c59a5aff168530d0bf

SHA256
b34b4a5480e9ee8f2b5a571a751077b3fb4ddf0f22dff62f0ac98dd7c299d066

SHA512
923cb5105aca0ef33b27c4d724c3c5dfa4ba38fdc24043ae82ae4a294a2c8f443ecc44f1a4eab08abb3423051aef4ecc1fe01a43b159d33d9bf3bce68a5a2cca

Download Submit
C:\Windows\System\elDvslY.exe

Filesize
1.7MB

MD5
76e51e47dc5e567084795aef7a06b692

SHA1
9ce15238185d3c6209c74ccee541315426fd7e53

SHA256
c46e837c7357d0848a31fd8082890c49d20ae31369e66104117b951750810de2

SHA512
c9ae47edfb8d927c414c5d047c3dd8f5d3252905f6fc7ecf811524f587307362c1dfd2a41ba50b38548637f13d4884085ed4c98de4c46de761dd0cb252f4c129

Download Submit
C:\Windows\System\lMjaQzq.exe

Filesize
1.7MB

MD5
cda71cc8adce05fbe3b58787efbe53b0

SHA1
46a7f3d1cab35d88945961583f84618464bb393e

SHA256
81ac5391c961009e272d15b8c815c984211d13f23de3f8431be8e6ec56d7c488

SHA512
48ca0bf2748e8da851aba284610d63a826a475623ea8e4579e8517b780e8696a2ff41db92705ef936e6d4e3d59dcb553affad89fe462a5e463057c73bc488cde

Download Submit
C:\Windows\System\loqicCv.exe

Filesize
1.7MB

MD5
8201fccffea78cf53349f91a374c69a8

SHA1
5659036ac1260c269a124faeab5ab1bd4f1a39ee

SHA256
a007b33a0011e6e117a1419f01709a6f93b0f772ecfa4c698913a1525ae6fa6d

SHA512
2e623a3918348202ca88d7116ebece4156532f1afcf744af3c84091ae7e3fae038580c053b8da1f13bf7377dc7ce6ef03082f12045733d5fc4be68f4aeb9b1a9

Download Submit
C:\Windows\System\onrZRcX.exe

Filesize
1.7MB

MD5
57d536628845b2908aabbfd2ea010dc5

SHA1
02144c1993a3039168a74a67a5326ad02835c248

SHA256
8ed954c056f21ae754ae12c37bb14cdb59ecb173e079ddfe1cd7523f607083b9

SHA512
9571d14dff21cdb9a586ce739fbf599ddfd9355efdfe9fbf693346333e85828daa92a04f012e9660fa3d00d6264af2ef4ebb949207e87aea978d1a6f47ab17de

Download Submit
C:\Windows\System\pWQcDwq.exe

Filesize
1.7MB

MD5
443c1b32e66d6d2de01c453f0dc87bd4

SHA1
ab628bf64cafb3dd10e208c595e0249ed1b63836

SHA256
42f5873aa7307fcb70dc61e1fe0dac3df913e37408c2612d61a25a0c92156677

SHA512
3a8cc8431ec182b92e9c34d3b63fceebddd2c7ecdfb01b8aca95adbbc2fe96600c8cdb07ffc62d896dd1e43c86563d2d4ab7100f0cb2acf813e82c9332201148

Download Submit
C:\Windows\System\psxDydD.exe

Filesize
1.7MB

MD5
01df607adc10437637724607080888df

SHA1
d7287391f53eccdd3441d65807aa250d18032ed2

SHA256
01025a6d550ae20a2046e405af330c82617af3a44ba9fd2602d30ef2e5d69b2e

SHA512
a462c40248157364c76005902e27994a3c164255281fef3fdeaa24b40a9d0982faed6d739b31e1d6e02457e60e065b695a81319071306a3fcabebebf54cd6f24

Download Submit
C:\Windows\System\qqnLRSy.exe

Filesize
1.7MB

MD5
cb5a99789809eb713ad596e79469c56c

SHA1
d4291c85a08f699963e9464a7c34973aff803636

SHA256
e2e08b13339c145fac59d5ba54e179d8aaea3faddf5fb7d6aead233eff94d07c

SHA512
98b2e6c6566e946e38556525d8554a98321e1f6f13841285457ddbbe73310555731fdc346882797c9c54b4269874511da5cf14f3178d0123f106f78ec7409c86

Download Submit
C:\Windows\System\resEBQX.exe

Filesize
1.7MB

MD5
05688f7b1a425dc8c98bd3dc0dedea1e

SHA1
abfab5e1349f2030902fe25924be2fd6f5750598

SHA256
367c782633fbbcff6cb0442f82149645320a923d793411cc977b1e7d7ecce838

SHA512
854ff92bdf7a345de6d7631043f28fb04640065d6bedc0186d30f9ef830126b23ab96e74a4dae84332b62ae4db426a97970682e4503b1b43f9b02ad920c2709a

Download Submit
C:\Windows\System\sEakPHg.exe

Filesize
1.7MB

MD5
fd7e9cbe5816ac93c66ad2d51d6de682

SHA1
ce73c034d634888b28277cc113980b1be2edbec3

SHA256
80f7e3ba84b8f00ef52ecb4b6da08f97d3fdf6be7b6f2d91cf96391663a9f2a8

SHA512
9cf3995ff8062e68e272a0fbc4903437093ab83192a3aedcf568d1eeb96ead4e46484fb932f76846412a9cbfc83a3990b7971ef987bbbc43790e893df8963705

Download Submit
C:\Windows\System\skKrHve.exe

Filesize
1.7MB

MD5
bf86cd7bf299c82d38ae40a2476f0634

SHA1
5d736a8131795176a35c617feb7daff704f6d115

SHA256
0dc100bb19f852dbc8859d588b47fd4f484672369ecba007138576cdfad6b80e

SHA512
dc8a7113f70030ab89d7c5a1a07764d1373bbc9ac1d1535b71cc523e05dc329f09d67ae0741c74048ac27a790380d0e5de3ffd391b38327dc1ace0b64f51e092

Download Submit
C:\Windows\System\tFmAVyU.exe

Filesize
1.7MB

MD5
a2c9a134416ff45defd01eb419fb2c47

SHA1
a75847c8b449d64c806ac35c32d2c73aa1ef89c1

SHA256
fc9343e86be9c3e89b207d5e8fca341d33842c5cda32d2dd487be3f7f458fee0

SHA512
ffee5cbde3b054d533a3b5a3902479da806743e53c42c8a54de8d61b18c2a31c29b36927efdd4dd42a7add439ebd941e4458f3eddcb45b9cae1ab486946bda14

Download Submit
C:\Windows\System\ujvxhpF.exe

Filesize
1.7MB

MD5
799fffe254bd0efe93ca813e5f7f6435

SHA1
70baba4a59b81b6cb57e7188f65f19bb82a5f6d1

SHA256
7377fd5f33c57d2b727a2867f2edf638c04f09a42123c741b7df284b7290065c

SHA512
28ae9164bb00e9c12877970ba86b633719ec7f558bbd9b9af73b5e71e9b936efde33e5b9f7eeb2c33271c451c959d4a2688f7aaa5f3e355b1b9152f8e205379e

Download Submit
C:\Windows\System\ukaXsDM.exe

Filesize
1.7MB

MD5
e4317bfac7904f65d541da84d8248238

SHA1
8df9f3f704f0b3a347c07618229a950308e5b040

SHA256
f8cbe82c81a85d1b97a85b77b38727b41955f64bd7c66781c7ec8715203c7a90

SHA512
8a74a2d5a180526646a684448c598cc76e174b53a082222f6cd49949bdbb3b302857f988b16c2eda5c4a3ef2ef8df7b17b96d36bfd5ca6ba34e87c1ccf21ee69

Download Submit
C:\Windows\System\vrhobWT.exe

Filesize
1.7MB

MD5
4476756bc88073963e9d5289fcdfed70

SHA1
dd35b589a1965ad20c27df2aa7cd4b99b40ea389

SHA256
9bd95016d7872de039ffad960e5275601ad5a77c740dbfdc69d4593eb15ffd3c

SHA512
55655840c0c892b5b44678e7cd7ff9f7323f1113bf559130885705421efe31089ec04ca3b7fdab311e7424b829fef9d4e51ee3cf771b5ca5cbb0691e329b4e9f

Download Submit
C:\Windows\System\ydqWmir.exe

Filesize
1.7MB

MD5
2a2a5cd3eef5176a97b6d02478437261

SHA1
696183c0979cb2848ba58f9c8e2e3b5538451290

SHA256
7586303097620db177020ef8da7d8237010ef6b049ca4b78369275c30ca685ac

SHA512
4983c2c6a8565d156ac2f4cbd59116969f41dfa38b9e1eaee23da43be7b6f8732f5aefdb73bc45c00d8bc5c05db1673a677b1cf2c4f722b0ff01e44b2f5e81ba

Download Submit
memory/1228-0-0x0000017451FE0000-0x0000017451FF0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads