xmrig | b199e6ffbf66fe743cd9f16d1d310a0bcdce1465d77fe861e068a096b0bb297e

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
Size

2.9MB
MD5

c3163b00cf85630d6a5233e56d375890
SHA1

057f3f00e84fdb02bd03ca4bf4ab8fdcc8bdc60d
SHA256

b199e6ffbf66fe743cd9f16d1d310a0bcdce1465d77fe861e068a096b0bb297e
SHA512

b98bd3a04aa507a9f51458111717fc45525d57ac4fdeb97a6b0c1a76c83f91d46501dd6c9b94bd07a5babb6996604ea78c242f0580684a798da9559abadee41a
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iR3:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rd

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 57 IoCs

miner

resource	yara_rule
behavioral1/memory/2104-2-0x000000013FB20000-0x000000013FF16000-memory.dmp	xmrig
behavioral1/files/0x000a000000012286-5.dat	xmrig
behavioral1/memory/2704-9-0x000000013FF90000-0x0000000140386000-memory.dmp	xmrig
behavioral1/files/0x0037000000015fef-10.dat	xmrig
behavioral1/memory/2628-15-0x000000013FD00000-0x00000001400F6000-memory.dmp	xmrig
behavioral1/files/0x000a0000000162e4-12.dat	xmrig
behavioral1/memory/2104-17-0x0000000003490000-0x0000000003886000-memory.dmp	xmrig
behavioral1/memory/2524-34-0x000000013F760000-0x000000013FB56000-memory.dmp	xmrig
behavioral1/memory/2748-35-0x000000013F5B0000-0x000000013F9A6000-memory.dmp	xmrig
behavioral1/files/0x0007000000016a8a-46.dat	xmrig
behavioral1/files/0x0007000000016c6f-51.dat	xmrig
behavioral1/files/0x0007000000016c52-50.dat	xmrig
behavioral1/memory/2104-63-0x000000013FB20000-0x000000013FF16000-memory.dmp	xmrig
behavioral1/files/0x00060000000173f9-117.dat	xmrig
behavioral1/files/0x000500000001870e-138.dat	xmrig
behavioral1/files/0x0005000000018723-152.dat	xmrig
behavioral1/files/0x0006000000018b86-173.dat	xmrig
behavioral1/memory/2252-316-0x000000013F210000-0x000000013F606000-memory.dmp	xmrig
behavioral1/memory/2184-312-0x000000013F050000-0x000000013F446000-memory.dmp	xmrig
behavioral1/memory/2628-1126-0x000000013FD00000-0x00000001400F6000-memory.dmp	xmrig
behavioral1/memory/2592-304-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	xmrig
behavioral1/files/0x0006000000018bed-182.dat	xmrig
behavioral1/files/0x000500000001879e-171.dat	xmrig
behavioral1/files/0x0006000000018bd9-176.dat	xmrig
behavioral1/files/0x0005000000018797-159.dat	xmrig
behavioral1/files/0x00050000000187b3-166.dat	xmrig
behavioral1/files/0x000500000001870f-142.dat	xmrig
behavioral1/files/0x000d000000018673-132.dat	xmrig
behavioral1/files/0x000500000001871f-147.dat	xmrig
behavioral1/files/0x0014000000018668-127.dat	xmrig
behavioral1/files/0x0006000000017577-122.dat	xmrig
behavioral1/files/0x00060000000173f6-112.dat	xmrig
behavioral1/files/0x00060000000173ca-107.dat	xmrig
behavioral1/files/0x0006000000017223-102.dat	xmrig
behavioral1/files/0x00070000000171d7-97.dat	xmrig
behavioral1/files/0x000d00000000549e-93.dat	xmrig
behavioral1/files/0x0006000000016ddc-88.dat	xmrig
behavioral1/files/0x0006000000016dd1-78.dat	xmrig
behavioral1/memory/2692-62-0x000000013F670000-0x000000013FA66000-memory.dmp	xmrig
behavioral1/files/0x0008000000016cc1-61.dat	xmrig
behavioral1/memory/2560-59-0x000000013F860000-0x000000013FC56000-memory.dmp	xmrig
behavioral1/files/0x0006000000016dc8-72.dat	xmrig
behavioral1/memory/2536-71-0x000000013F960000-0x000000013FD56000-memory.dmp	xmrig
behavioral1/memory/2620-42-0x000000013F380000-0x000000013F776000-memory.dmp	xmrig
behavioral1/files/0x00080000000165e1-40.dat	xmrig
behavioral1/files/0x0008000000016455-27.dat	xmrig
behavioral1/files/0x003800000001611e-32.dat	xmrig
behavioral1/memory/2768-23-0x000000013FC60000-0x0000000140056000-memory.dmp	xmrig
behavioral1/memory/2748-2413-0x000000013F5B0000-0x000000013F9A6000-memory.dmp	xmrig
behavioral1/memory/2620-2838-0x000000013F380000-0x000000013F776000-memory.dmp	xmrig
behavioral1/memory/2560-3210-0x000000013F860000-0x000000013FC56000-memory.dmp	xmrig
behavioral1/memory/2692-3219-0x000000013F670000-0x000000013FA66000-memory.dmp	xmrig
behavioral1/memory/2704-5940-0x000000013FF90000-0x0000000140386000-memory.dmp	xmrig
behavioral1/memory/2768-6136-0x000000013FC60000-0x0000000140056000-memory.dmp	xmrig
behavioral1/memory/2560-6179-0x000000013F860000-0x000000013FC56000-memory.dmp	xmrig
behavioral1/memory/2692-6182-0x000000013F670000-0x000000013FA66000-memory.dmp	xmrig
behavioral1/memory/2184-6191-0x000000013F050000-0x000000013F446000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1788	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2704	sPvMiOC.exe
2628	hoTAxEB.exe
2768	qZsFiLL.exe
2524	XDmTZdg.exe
2748	BDAbRMc.exe
2620	hXjYcaY.exe
2560	LaMovgH.exe
2692	iyryfno.exe
2536	QcaqPIy.exe
2592	rNLcvZl.exe
2252	TjKlRLE.exe
2184	rnxHEzW.exe
2752	mqXNDwt.exe
1300	fxWEYii.exe
2440	ubtPvVn.exe
1920	sOtZRLM.exe
1072	lUJIDSz.exe
1632	UIOKliC.exe
2032	MZruidc.exe
2412	LftJKJl.exe
1060	ItcZsWN.exe
484	hjmZZpY.exe
1152	ArOKMgR.exe
2428	lshiFxS.exe
804	wPfxOjY.exe
1244	CoPovuG.exe
2852	fYHeRmj.exe
588	AXcKbut.exe
1144	sfdQvjN.exe
2616	KZcgTvf.exe
108	pJyFaVi.exe
700	QFYdwCV.exe
3052	ZlOWgGw.exe
1704	cUDPJVE.exe
1660	wiNxyKU.exe
1364	uUEzTYD.exe
2232	ttykZUf.exe
3036	nxaPAdH.exe
3020	hqtjDof.exe
1020	AnUMnzq.exe
2312	dGisrsG.exe
3040	FMoYOgy.exe
2972	biqInbR.exe
2928	yWLdBya.exe
396	fZGbtsx.exe
1700	VjDFgHL.exe
2112	fTDiQCb.exe
2488	YjJBeBR.exe
1588	FrmDlUv.exe
2836	mewLdVh.exe
2572	aweoqQD.exe
1668	AkuoulK.exe
2920	MAtuYlm.exe
2568	NQQImRM.exe
1320	LAwvFIA.exe
1824	BtIAPTk.exe
536	dMAVcrK.exe
1716	NeWElIY.exe
596	KLtwLaL.exe
3000	DBATHQV.exe
2472	TXGnRfq.exe
3068	tZheAMD.exe
2868	TDXypxW.exe
2828	tgdsjlM.exe

Loads dropped DLL 64 IoCs

pid	Process
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2104-2-0x000000013FB20000-0x000000013FF16000-memory.dmp	upx
behavioral1/files/0x000a000000012286-5.dat	upx
behavioral1/memory/2704-9-0x000000013FF90000-0x0000000140386000-memory.dmp	upx
behavioral1/files/0x0037000000015fef-10.dat	upx
behavioral1/memory/2628-15-0x000000013FD00000-0x00000001400F6000-memory.dmp	upx
behavioral1/files/0x000a0000000162e4-12.dat	upx
behavioral1/memory/2104-17-0x0000000003490000-0x0000000003886000-memory.dmp	upx
behavioral1/memory/2524-34-0x000000013F760000-0x000000013FB56000-memory.dmp	upx
behavioral1/memory/2748-35-0x000000013F5B0000-0x000000013F9A6000-memory.dmp	upx
behavioral1/files/0x0007000000016a8a-46.dat	upx
behavioral1/files/0x0007000000016c6f-51.dat	upx
behavioral1/files/0x0007000000016c52-50.dat	upx
behavioral1/memory/2104-63-0x000000013FB20000-0x000000013FF16000-memory.dmp	upx
behavioral1/files/0x00060000000173f9-117.dat	upx
behavioral1/files/0x000500000001870e-138.dat	upx
behavioral1/files/0x0005000000018723-152.dat	upx
behavioral1/files/0x0006000000018b86-173.dat	upx
behavioral1/memory/2252-316-0x000000013F210000-0x000000013F606000-memory.dmp	upx
behavioral1/memory/2184-312-0x000000013F050000-0x000000013F446000-memory.dmp	upx
behavioral1/memory/2628-1126-0x000000013FD00000-0x00000001400F6000-memory.dmp	upx
behavioral1/memory/2592-304-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	upx
behavioral1/files/0x0006000000018bed-182.dat	upx
behavioral1/files/0x000500000001879e-171.dat	upx
behavioral1/files/0x0006000000018bd9-176.dat	upx
behavioral1/files/0x0005000000018797-159.dat	upx
behavioral1/files/0x00050000000187b3-166.dat	upx
behavioral1/files/0x000500000001870f-142.dat	upx
behavioral1/files/0x000d000000018673-132.dat	upx
behavioral1/files/0x000500000001871f-147.dat	upx
behavioral1/files/0x0014000000018668-127.dat	upx
behavioral1/files/0x0006000000017577-122.dat	upx
behavioral1/files/0x00060000000173f6-112.dat	upx
behavioral1/files/0x00060000000173ca-107.dat	upx
behavioral1/files/0x0006000000017223-102.dat	upx
behavioral1/files/0x00070000000171d7-97.dat	upx
behavioral1/files/0x000d00000000549e-93.dat	upx
behavioral1/files/0x0006000000016ddc-88.dat	upx
behavioral1/files/0x0006000000016dd1-78.dat	upx
behavioral1/memory/2692-62-0x000000013F670000-0x000000013FA66000-memory.dmp	upx
behavioral1/files/0x0008000000016cc1-61.dat	upx
behavioral1/memory/2560-59-0x000000013F860000-0x000000013FC56000-memory.dmp	upx
behavioral1/files/0x0006000000016dc8-72.dat	upx
behavioral1/memory/2536-71-0x000000013F960000-0x000000013FD56000-memory.dmp	upx
behavioral1/memory/2620-42-0x000000013F380000-0x000000013F776000-memory.dmp	upx
behavioral1/files/0x00080000000165e1-40.dat	upx
behavioral1/files/0x0008000000016455-27.dat	upx
behavioral1/files/0x003800000001611e-32.dat	upx
behavioral1/memory/2768-23-0x000000013FC60000-0x0000000140056000-memory.dmp	upx
behavioral1/memory/2748-2413-0x000000013F5B0000-0x000000013F9A6000-memory.dmp	upx
behavioral1/memory/2620-2838-0x000000013F380000-0x000000013F776000-memory.dmp	upx
behavioral1/memory/2560-3210-0x000000013F860000-0x000000013FC56000-memory.dmp	upx
behavioral1/memory/2692-3219-0x000000013F670000-0x000000013FA66000-memory.dmp	upx
behavioral1/memory/2704-5940-0x000000013FF90000-0x0000000140386000-memory.dmp	upx
behavioral1/memory/2768-6136-0x000000013FC60000-0x0000000140056000-memory.dmp	upx
behavioral1/memory/2560-6179-0x000000013F860000-0x000000013FC56000-memory.dmp	upx
behavioral1/memory/2692-6182-0x000000013F670000-0x000000013FA66000-memory.dmp	upx
behavioral1/memory/2184-6191-0x000000013F050000-0x000000013F446000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FdNgZDJ.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\exIBbSL.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\PgCEcUV.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\AEdMUyH.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\DXzFmBi.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\VGOvyzF.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\XhjFHMG.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\NKhGPei.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\mTkfGIz.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\RlNXfGH.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\cdzOzsa.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\pHIScIW.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\HpNnuYC.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\oQWWzys.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\ClrYZsu.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\JGIggQm.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\CFZnbRb.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\jOHIFpD.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\wOpOPso.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\oaIErJt.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\gFfmmXH.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\urHugfr.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\ZqFthYG.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\XfoLJIC.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\jUSTeaV.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\iIneGjV.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\IwSEflY.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\OVSkcHE.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\iHJRbnV.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\WfqKvAV.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\YNcEIHH.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\vRGcwxB.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\HbZSIwT.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\LxYRvXK.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\DYfBQdp.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\knKipGM.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\rEiyKGj.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\uckdERc.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\texesxs.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\hErXEvo.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\LERfZQb.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\bEOLCBd.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\GrEeDpm.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\kBdgFlx.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\FZDQSGF.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\bRcmSeA.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\hfRwXjE.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\yuuYwOg.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\OCwiqzp.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\DyErmFs.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\TUglUDX.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\inxPdSP.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\WXTqyEp.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\BuCpfTG.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\tVeWLNy.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\muidJBc.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\agsXMdG.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\hjmXTDi.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\fCLgCpv.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\dFdjJDV.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\yQRPwyo.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\cbwtjqO.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\JlsIXDF.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
File created	C:\Windows\System\Vdsxzgl.exe	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1788	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
Token: SeDebugPrivilege	1788	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1788	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	29
PID 2104 wrote to memory of 1788	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	29
PID 2104 wrote to memory of 1788	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	29
PID 2104 wrote to memory of 2704	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	30
PID 2104 wrote to memory of 2704	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	30
PID 2104 wrote to memory of 2704	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	30
PID 2104 wrote to memory of 2628	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	31
PID 2104 wrote to memory of 2628	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	31
PID 2104 wrote to memory of 2628	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	31
PID 2104 wrote to memory of 2768	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	32
PID 2104 wrote to memory of 2768	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	32
PID 2104 wrote to memory of 2768	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	32
PID 2104 wrote to memory of 2524	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	33
PID 2104 wrote to memory of 2524	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	33
PID 2104 wrote to memory of 2524	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	33
PID 2104 wrote to memory of 2748	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	34
PID 2104 wrote to memory of 2748	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	34
PID 2104 wrote to memory of 2748	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	34
PID 2104 wrote to memory of 2620	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	35
PID 2104 wrote to memory of 2620	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	35
PID 2104 wrote to memory of 2620	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	35
PID 2104 wrote to memory of 2560	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	36
PID 2104 wrote to memory of 2560	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	36
PID 2104 wrote to memory of 2560	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	36
PID 2104 wrote to memory of 2692	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	37
PID 2104 wrote to memory of 2692	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	37
PID 2104 wrote to memory of 2692	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	37
PID 2104 wrote to memory of 2536	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	38
PID 2104 wrote to memory of 2536	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	38
PID 2104 wrote to memory of 2536	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	38
PID 2104 wrote to memory of 2592	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	39
PID 2104 wrote to memory of 2592	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	39
PID 2104 wrote to memory of 2592	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	39
PID 2104 wrote to memory of 2252	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	40
PID 2104 wrote to memory of 2252	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	40
PID 2104 wrote to memory of 2252	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	40
PID 2104 wrote to memory of 2184	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	41
PID 2104 wrote to memory of 2184	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	41
PID 2104 wrote to memory of 2184	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	41
PID 2104 wrote to memory of 2752	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	42
PID 2104 wrote to memory of 2752	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	42
PID 2104 wrote to memory of 2752	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	42
PID 2104 wrote to memory of 1300	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	43
PID 2104 wrote to memory of 1300	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	43
PID 2104 wrote to memory of 1300	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	43
PID 2104 wrote to memory of 2440	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	44
PID 2104 wrote to memory of 2440	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	44
PID 2104 wrote to memory of 2440	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	44
PID 2104 wrote to memory of 1920	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	45
PID 2104 wrote to memory of 1920	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	45
PID 2104 wrote to memory of 1920	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	45
PID 2104 wrote to memory of 1072	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	46
PID 2104 wrote to memory of 1072	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	46
PID 2104 wrote to memory of 1072	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	46
PID 2104 wrote to memory of 1632	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	47
PID 2104 wrote to memory of 1632	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	47
PID 2104 wrote to memory of 1632	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	47
PID 2104 wrote to memory of 2032	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	48
PID 2104 wrote to memory of 2032	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	48
PID 2104 wrote to memory of 2032	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	48
PID 2104 wrote to memory of 2412	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	49
PID 2104 wrote to memory of 2412	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	49
PID 2104 wrote to memory of 2412	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	49
PID 2104 wrote to memory of 1060	2104	c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c3163b00cf85630d6a5233e56d375890_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\System\sPvMiOC.exe
  C:\Windows\System\sPvMiOC.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\hoTAxEB.exe
  C:\Windows\System\hoTAxEB.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\qZsFiLL.exe
  C:\Windows\System\qZsFiLL.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\XDmTZdg.exe
  C:\Windows\System\XDmTZdg.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\BDAbRMc.exe
  C:\Windows\System\BDAbRMc.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\hXjYcaY.exe
  C:\Windows\System\hXjYcaY.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\LaMovgH.exe
  C:\Windows\System\LaMovgH.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\iyryfno.exe
  C:\Windows\System\iyryfno.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\QcaqPIy.exe
  C:\Windows\System\QcaqPIy.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\rNLcvZl.exe
  C:\Windows\System\rNLcvZl.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\TjKlRLE.exe
  C:\Windows\System\TjKlRLE.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\rnxHEzW.exe
  C:\Windows\System\rnxHEzW.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\mqXNDwt.exe
  C:\Windows\System\mqXNDwt.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\fxWEYii.exe
  C:\Windows\System\fxWEYii.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\ubtPvVn.exe
  C:\Windows\System\ubtPvVn.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\sOtZRLM.exe
  C:\Windows\System\sOtZRLM.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\lUJIDSz.exe
  C:\Windows\System\lUJIDSz.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\UIOKliC.exe
  C:\Windows\System\UIOKliC.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\MZruidc.exe
  C:\Windows\System\MZruidc.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\LftJKJl.exe
  C:\Windows\System\LftJKJl.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\ItcZsWN.exe
  C:\Windows\System\ItcZsWN.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\hjmZZpY.exe
  C:\Windows\System\hjmZZpY.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\ArOKMgR.exe
  C:\Windows\System\ArOKMgR.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\lshiFxS.exe
  C:\Windows\System\lshiFxS.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\wPfxOjY.exe
  C:\Windows\System\wPfxOjY.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\CoPovuG.exe
  C:\Windows\System\CoPovuG.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\fYHeRmj.exe
  C:\Windows\System\fYHeRmj.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\sfdQvjN.exe
  C:\Windows\System\sfdQvjN.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\AXcKbut.exe
  C:\Windows\System\AXcKbut.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\KZcgTvf.exe
  C:\Windows\System\KZcgTvf.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\pJyFaVi.exe
  C:\Windows\System\pJyFaVi.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\QFYdwCV.exe
  C:\Windows\System\QFYdwCV.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\ZlOWgGw.exe
  C:\Windows\System\ZlOWgGw.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\cUDPJVE.exe
  C:\Windows\System\cUDPJVE.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\wiNxyKU.exe
  C:\Windows\System\wiNxyKU.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\ttykZUf.exe
  C:\Windows\System\ttykZUf.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\uUEzTYD.exe
  C:\Windows\System\uUEzTYD.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\nxaPAdH.exe
  C:\Windows\System\nxaPAdH.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\hqtjDof.exe
  C:\Windows\System\hqtjDof.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\AnUMnzq.exe
  C:\Windows\System\AnUMnzq.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\dGisrsG.exe
  C:\Windows\System\dGisrsG.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\FMoYOgy.exe
  C:\Windows\System\FMoYOgy.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\biqInbR.exe
  C:\Windows\System\biqInbR.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\TDXypxW.exe
  C:\Windows\System\TDXypxW.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\yWLdBya.exe
  C:\Windows\System\yWLdBya.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\tgdsjlM.exe
  C:\Windows\System\tgdsjlM.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\fZGbtsx.exe
  C:\Windows\System\fZGbtsx.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\UTdYYJH.exe
  C:\Windows\System\UTdYYJH.exe
  2⤵
  PID:2056
- C:\Windows\System\VjDFgHL.exe
  C:\Windows\System\VjDFgHL.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\LfADqcb.exe
  C:\Windows\System\LfADqcb.exe
  2⤵
  PID:1724
- C:\Windows\System\fTDiQCb.exe
  C:\Windows\System\fTDiQCb.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\UKBKeVn.exe
  C:\Windows\System\UKBKeVn.exe
  2⤵
  PID:1680
- C:\Windows\System\YjJBeBR.exe
  C:\Windows\System\YjJBeBR.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\eannpJU.exe
  C:\Windows\System\eannpJU.exe
  2⤵
  PID:1732
- C:\Windows\System\FrmDlUv.exe
  C:\Windows\System\FrmDlUv.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\uKLrCNl.exe
  C:\Windows\System\uKLrCNl.exe
  2⤵
  PID:2396
- C:\Windows\System\mewLdVh.exe
  C:\Windows\System\mewLdVh.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\eEdrCyH.exe
  C:\Windows\System\eEdrCyH.exe
  2⤵
  PID:2364
- C:\Windows\System\aweoqQD.exe
  C:\Windows\System\aweoqQD.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\ZpwzebB.exe
  C:\Windows\System\ZpwzebB.exe
  2⤵
  PID:2784
- C:\Windows\System\AkuoulK.exe
  C:\Windows\System\AkuoulK.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\XQXjCyQ.exe
  C:\Windows\System\XQXjCyQ.exe
  2⤵
  PID:1644
- C:\Windows\System\MAtuYlm.exe
  C:\Windows\System\MAtuYlm.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\wotHwLY.exe
  C:\Windows\System\wotHwLY.exe
  2⤵
  PID:1952
- C:\Windows\System\NQQImRM.exe
  C:\Windows\System\NQQImRM.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\URPPYVL.exe
  C:\Windows\System\URPPYVL.exe
  2⤵
  PID:1868
- C:\Windows\System\LAwvFIA.exe
  C:\Windows\System\LAwvFIA.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\cIFaJmO.exe
  C:\Windows\System\cIFaJmO.exe
  2⤵
  PID:1996
- C:\Windows\System\BtIAPTk.exe
  C:\Windows\System\BtIAPTk.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\LmHGqeW.exe
  C:\Windows\System\LmHGqeW.exe
  2⤵
  PID:1368
- C:\Windows\System\dMAVcrK.exe
  C:\Windows\System\dMAVcrK.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\NwomcTB.exe
  C:\Windows\System\NwomcTB.exe
  2⤵
  PID:692
- C:\Windows\System\NeWElIY.exe
  C:\Windows\System\NeWElIY.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\szHzhOI.exe
  C:\Windows\System\szHzhOI.exe
  2⤵
  PID:756
- C:\Windows\System\KLtwLaL.exe
  C:\Windows\System\KLtwLaL.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\FtuBKtG.exe
  C:\Windows\System\FtuBKtG.exe
  2⤵
  PID:2400
- C:\Windows\System\DBATHQV.exe
  C:\Windows\System\DBATHQV.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\iXcnkUB.exe
  C:\Windows\System\iXcnkUB.exe
  2⤵
  PID:2968
- C:\Windows\System\TXGnRfq.exe
  C:\Windows\System\TXGnRfq.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\qkytvvJ.exe
  C:\Windows\System\qkytvvJ.exe
  2⤵
  PID:840
- C:\Windows\System\tZheAMD.exe
  C:\Windows\System\tZheAMD.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\RMdYIyY.exe
  C:\Windows\System\RMdYIyY.exe
  2⤵
  PID:2360
- C:\Windows\System\gSfVrIg.exe
  C:\Windows\System\gSfVrIg.exe
  2⤵
  PID:1536
- C:\Windows\System\dYdrRaI.exe
  C:\Windows\System\dYdrRaI.exe
  2⤵
  PID:956
- C:\Windows\System\xpDMMXQ.exe
  C:\Windows\System\xpDMMXQ.exe
  2⤵
  PID:908
- C:\Windows\System\fdBtQkz.exe
  C:\Windows\System\fdBtQkz.exe
  2⤵
  PID:2484
- C:\Windows\System\tZFusMi.exe
  C:\Windows\System\tZFusMi.exe
  2⤵
  PID:584
- C:\Windows\System\hSXFekP.exe
  C:\Windows\System\hSXFekP.exe
  2⤵
  PID:2932
- C:\Windows\System\GZTqvEI.exe
  C:\Windows\System\GZTqvEI.exe
  2⤵
  PID:1960
- C:\Windows\System\iOefWEn.exe
  C:\Windows\System\iOefWEn.exe
  2⤵
  PID:2848
- C:\Windows\System\NVUZsOL.exe
  C:\Windows\System\NVUZsOL.exe
  2⤵
  PID:2612
- C:\Windows\System\aZjVHKA.exe
  C:\Windows\System\aZjVHKA.exe
  2⤵
  PID:1976
- C:\Windows\System\utmmaKx.exe
  C:\Windows\System\utmmaKx.exe
  2⤵
  PID:2816
- C:\Windows\System\dbneRix.exe
  C:\Windows\System\dbneRix.exe
  2⤵
  PID:1816
- C:\Windows\System\hICwueT.exe
  C:\Windows\System\hICwueT.exe
  2⤵
  PID:1180
- C:\Windows\System\XJpOxFd.exe
  C:\Windows\System\XJpOxFd.exe
  2⤵
  PID:308
- C:\Windows\System\auMcQrJ.exe
  C:\Windows\System\auMcQrJ.exe
  2⤵
  PID:1612
- C:\Windows\System\kltVSnA.exe
  C:\Windows\System\kltVSnA.exe
  2⤵
  PID:860
- C:\Windows\System\CFPizNo.exe
  C:\Windows\System\CFPizNo.exe
  2⤵
  PID:2776
- C:\Windows\System\mRlceNn.exe
  C:\Windows\System\mRlceNn.exe
  2⤵
  PID:316
- C:\Windows\System\tkvmAnD.exe
  C:\Windows\System\tkvmAnD.exe
  2⤵
  PID:1604
- C:\Windows\System\qYXjwlC.exe
  C:\Windows\System\qYXjwlC.exe
  2⤵
  PID:2896
- C:\Windows\System\lmfonjB.exe
  C:\Windows\System\lmfonjB.exe
  2⤵
  PID:1696
- C:\Windows\System\oOSnCgG.exe
  C:\Windows\System\oOSnCgG.exe
  2⤵
  PID:1040
- C:\Windows\System\BBBaMLH.exe
  C:\Windows\System\BBBaMLH.exe
  2⤵
  PID:2552
- C:\Windows\System\NlvtddL.exe
  C:\Windows\System\NlvtddL.exe
  2⤵
  PID:640
- C:\Windows\System\lSUVRXc.exe
  C:\Windows\System\lSUVRXc.exe
  2⤵
  PID:1636
- C:\Windows\System\wLDYmne.exe
  C:\Windows\System\wLDYmne.exe
  2⤵
  PID:1872
- C:\Windows\System\wOpOPso.exe
  C:\Windows\System\wOpOPso.exe
  2⤵
  PID:2788
- C:\Windows\System\WkeTqbn.exe
  C:\Windows\System\WkeTqbn.exe
  2⤵
  PID:1064
- C:\Windows\System\opjnjam.exe
  C:\Windows\System\opjnjam.exe
  2⤵
  PID:1640
- C:\Windows\System\Rgpkiok.exe
  C:\Windows\System\Rgpkiok.exe
  2⤵
  PID:268
- C:\Windows\System\IzUWjeV.exe
  C:\Windows\System\IzUWjeV.exe
  2⤵
  PID:2720
- C:\Windows\System\xpQAkCv.exe
  C:\Windows\System\xpQAkCv.exe
  2⤵
  PID:2780
- C:\Windows\System\JslXXLd.exe
  C:\Windows\System\JslXXLd.exe
  2⤵
  PID:3092
- C:\Windows\System\zPlXLoD.exe
  C:\Windows\System\zPlXLoD.exe
  2⤵
  PID:3112
- C:\Windows\System\IiABqGM.exe
  C:\Windows\System\IiABqGM.exe
  2⤵
  PID:3128
- C:\Windows\System\HPvNKER.exe
  C:\Windows\System\HPvNKER.exe
  2⤵
  PID:3144
- C:\Windows\System\BWgjwDM.exe
  C:\Windows\System\BWgjwDM.exe
  2⤵
  PID:3168
- C:\Windows\System\bwvgNCp.exe
  C:\Windows\System\bwvgNCp.exe
  2⤵
  PID:3184
- C:\Windows\System\qhLVxMg.exe
  C:\Windows\System\qhLVxMg.exe
  2⤵
  PID:3224
- C:\Windows\System\JBjjVIt.exe
  C:\Windows\System\JBjjVIt.exe
  2⤵
  PID:3244
- C:\Windows\System\msrlKkI.exe
  C:\Windows\System\msrlKkI.exe
  2⤵
  PID:3264
- C:\Windows\System\ucJVOcU.exe
  C:\Windows\System\ucJVOcU.exe
  2⤵
  PID:3280
- C:\Windows\System\onuwzvp.exe
  C:\Windows\System\onuwzvp.exe
  2⤵
  PID:3300
- C:\Windows\System\sHMNoga.exe
  C:\Windows\System\sHMNoga.exe
  2⤵
  PID:3320
- C:\Windows\System\YnBPUbd.exe
  C:\Windows\System\YnBPUbd.exe
  2⤵
  PID:3340
- C:\Windows\System\SgqiJxA.exe
  C:\Windows\System\SgqiJxA.exe
  2⤵
  PID:3356
- C:\Windows\System\xVmpkii.exe
  C:\Windows\System\xVmpkii.exe
  2⤵
  PID:3372
- C:\Windows\System\xMvMPJG.exe
  C:\Windows\System\xMvMPJG.exe
  2⤵
  PID:3400
- C:\Windows\System\WlXHJFf.exe
  C:\Windows\System\WlXHJFf.exe
  2⤵
  PID:3416
- C:\Windows\System\OMchIkE.exe
  C:\Windows\System\OMchIkE.exe
  2⤵
  PID:3436
- C:\Windows\System\wxyoIBt.exe
  C:\Windows\System\wxyoIBt.exe
  2⤵
  PID:3464
- C:\Windows\System\SYUFKru.exe
  C:\Windows\System\SYUFKru.exe
  2⤵
  PID:3484
- C:\Windows\System\yZcPjAo.exe
  C:\Windows\System\yZcPjAo.exe
  2⤵
  PID:3504
- C:\Windows\System\lAcQZKn.exe
  C:\Windows\System\lAcQZKn.exe
  2⤵
  PID:3524
- C:\Windows\System\HHPXdZM.exe
  C:\Windows\System\HHPXdZM.exe
  2⤵
  PID:3544
- C:\Windows\System\kGVFUfR.exe
  C:\Windows\System\kGVFUfR.exe
  2⤵
  PID:3564
- C:\Windows\System\gqquKBP.exe
  C:\Windows\System\gqquKBP.exe
  2⤵
  PID:3584
- C:\Windows\System\MWAHGFu.exe
  C:\Windows\System\MWAHGFu.exe
  2⤵
  PID:3604
- C:\Windows\System\ClPXycW.exe
  C:\Windows\System\ClPXycW.exe
  2⤵
  PID:3620
- C:\Windows\System\NADGRRH.exe
  C:\Windows\System\NADGRRH.exe
  2⤵
  PID:3640
- C:\Windows\System\ISwVxec.exe
  C:\Windows\System\ISwVxec.exe
  2⤵
  PID:3664
- C:\Windows\System\XIGONWj.exe
  C:\Windows\System\XIGONWj.exe
  2⤵
  PID:3684
- C:\Windows\System\scqtwFz.exe
  C:\Windows\System\scqtwFz.exe
  2⤵
  PID:3704
- C:\Windows\System\XKzAoOc.exe
  C:\Windows\System\XKzAoOc.exe
  2⤵
  PID:3724
- C:\Windows\System\zDWSoeY.exe
  C:\Windows\System\zDWSoeY.exe
  2⤵
  PID:3744
- C:\Windows\System\UNuyzOZ.exe
  C:\Windows\System\UNuyzOZ.exe
  2⤵
  PID:3764
- C:\Windows\System\ITOxMBQ.exe
  C:\Windows\System\ITOxMBQ.exe
  2⤵
  PID:3780
- C:\Windows\System\AGRpylx.exe
  C:\Windows\System\AGRpylx.exe
  2⤵
  PID:3804
- C:\Windows\System\fihTqVL.exe
  C:\Windows\System\fihTqVL.exe
  2⤵
  PID:3824
- C:\Windows\System\LxYRvXK.exe
  C:\Windows\System\LxYRvXK.exe
  2⤵
  PID:3844
- C:\Windows\System\EOxQehw.exe
  C:\Windows\System\EOxQehw.exe
  2⤵
  PID:3860
- C:\Windows\System\odXgOqp.exe
  C:\Windows\System\odXgOqp.exe
  2⤵
  PID:3876
- C:\Windows\System\ZPgvsCk.exe
  C:\Windows\System\ZPgvsCk.exe
  2⤵
  PID:3900
- C:\Windows\System\ZDCWnWT.exe
  C:\Windows\System\ZDCWnWT.exe
  2⤵
  PID:3924
- C:\Windows\System\zxIdeGn.exe
  C:\Windows\System\zxIdeGn.exe
  2⤵
  PID:3940
- C:\Windows\System\sISsxPS.exe
  C:\Windows\System\sISsxPS.exe
  2⤵
  PID:3960
- C:\Windows\System\ZXLozRb.exe
  C:\Windows\System\ZXLozRb.exe
  2⤵
  PID:3984
- C:\Windows\System\QwSCafS.exe
  C:\Windows\System\QwSCafS.exe
  2⤵
  PID:4004
- C:\Windows\System\qLGLnsY.exe
  C:\Windows\System\qLGLnsY.exe
  2⤵
  PID:4024
- C:\Windows\System\GpPxrxe.exe
  C:\Windows\System\GpPxrxe.exe
  2⤵
  PID:4044
- C:\Windows\System\rykmZUV.exe
  C:\Windows\System\rykmZUV.exe
  2⤵
  PID:4060
- C:\Windows\System\YtRSeQy.exe
  C:\Windows\System\YtRSeQy.exe
  2⤵
  PID:4084
- C:\Windows\System\mKhveCp.exe
  C:\Windows\System\mKhveCp.exe
  2⤵
  PID:2688
- C:\Windows\System\EGsENLE.exe
  C:\Windows\System\EGsENLE.exe
  2⤵
  PID:2740
- C:\Windows\System\VVqaCGK.exe
  C:\Windows\System\VVqaCGK.exe
  2⤵
  PID:2036
- C:\Windows\System\NXIkBhT.exe
  C:\Windows\System\NXIkBhT.exe
  2⤵
  PID:1988
- C:\Windows\System\sUBhMbb.exe
  C:\Windows\System\sUBhMbb.exe
  2⤵
  PID:1332
- C:\Windows\System\sWhbgNc.exe
  C:\Windows\System\sWhbgNc.exe
  2⤵
  PID:880
- C:\Windows\System\KDJIYpU.exe
  C:\Windows\System\KDJIYpU.exe
  2⤵
  PID:1620
- C:\Windows\System\MbMjSVO.exe
  C:\Windows\System\MbMjSVO.exe
  2⤵
  PID:696
- C:\Windows\System\VLeGFGk.exe
  C:\Windows\System\VLeGFGk.exe
  2⤵
  PID:2436
- C:\Windows\System\PPADWeB.exe
  C:\Windows\System\PPADWeB.exe
  2⤵
  PID:3136
- C:\Windows\System\hANjsvy.exe
  C:\Windows\System\hANjsvy.exe
  2⤵
  PID:2000
- C:\Windows\System\RTYvZDC.exe
  C:\Windows\System\RTYvZDC.exe
  2⤵
  PID:2664
- C:\Windows\System\UCBLbHv.exe
  C:\Windows\System\UCBLbHv.exe
  2⤵
  PID:3164
- C:\Windows\System\kbcfxkV.exe
  C:\Windows\System\kbcfxkV.exe
  2⤵
  PID:3204
- C:\Windows\System\ULyQCLs.exe
  C:\Windows\System\ULyQCLs.exe
  2⤵
  PID:3240
- C:\Windows\System\eYuFuci.exe
  C:\Windows\System\eYuFuci.exe
  2⤵
  PID:3316
- C:\Windows\System\aTbEycR.exe
  C:\Windows\System\aTbEycR.exe
  2⤵
  PID:3260
- C:\Windows\System\doQAVBN.exe
  C:\Windows\System\doQAVBN.exe
  2⤵
  PID:3352
- C:\Windows\System\txjwZHY.exe
  C:\Windows\System\txjwZHY.exe
  2⤵
  PID:3384
- C:\Windows\System\agyQorK.exe
  C:\Windows\System\agyQorK.exe
  2⤵
  PID:3332
- C:\Windows\System\ygnTjYP.exe
  C:\Windows\System\ygnTjYP.exe
  2⤵
  PID:3456
- C:\Windows\System\CLcmJBI.exe
  C:\Windows\System\CLcmJBI.exe
  2⤵
  PID:3472
- C:\Windows\System\duvQigx.exe
  C:\Windows\System\duvQigx.exe
  2⤵
  PID:3520
- C:\Windows\System\LEaqowD.exe
  C:\Windows\System\LEaqowD.exe
  2⤵
  PID:3592
- C:\Windows\System\eTEydFt.exe
  C:\Windows\System\eTEydFt.exe
  2⤵
  PID:3492
- C:\Windows\System\JKCDXPv.exe
  C:\Windows\System\JKCDXPv.exe
  2⤵
  PID:3536
- C:\Windows\System\oJHNmWi.exe
  C:\Windows\System\oJHNmWi.exe
  2⤵
  PID:3572
- C:\Windows\System\OBWuaHy.exe
  C:\Windows\System\OBWuaHy.exe
  2⤵
  PID:3648
- C:\Windows\System\CKFvIxf.exe
  C:\Windows\System\CKFvIxf.exe
  2⤵
  PID:3692
- C:\Windows\System\gsLUCZO.exe
  C:\Windows\System\gsLUCZO.exe
  2⤵
  PID:3700
- C:\Windows\System\UjuGYJW.exe
  C:\Windows\System\UjuGYJW.exe
  2⤵
  PID:3740
- C:\Windows\System\QLdcMDh.exe
  C:\Windows\System\QLdcMDh.exe
  2⤵
  PID:3796
- C:\Windows\System\kyPuZkL.exe
  C:\Windows\System\kyPuZkL.exe
  2⤵
  PID:3872
- C:\Windows\System\spuUQlm.exe
  C:\Windows\System\spuUQlm.exe
  2⤵
  PID:3812
- C:\Windows\System\sCJZcCp.exe
  C:\Windows\System\sCJZcCp.exe
  2⤵
  PID:3852
- C:\Windows\System\EeWBasD.exe
  C:\Windows\System\EeWBasD.exe
  2⤵
  PID:3992
- C:\Windows\System\ZEyWIoY.exe
  C:\Windows\System\ZEyWIoY.exe
  2⤵
  PID:4036
- C:\Windows\System\yerRXcr.exe
  C:\Windows\System\yerRXcr.exe
  2⤵
  PID:4080
- C:\Windows\System\fmrHQYw.exe
  C:\Windows\System\fmrHQYw.exe
  2⤵
  PID:3936
- C:\Windows\System\CwwyxDl.exe
  C:\Windows\System\CwwyxDl.exe
  2⤵
  PID:4016
- C:\Windows\System\wzKGmvB.exe
  C:\Windows\System\wzKGmvB.exe
  2⤵
  PID:4076
- C:\Windows\System\sFcaRbx.exe
  C:\Windows\System\sFcaRbx.exe
  2⤵
  PID:1196
- C:\Windows\System\dGSHGXC.exe
  C:\Windows\System\dGSHGXC.exe
  2⤵
  PID:2148
- C:\Windows\System\dZlfUNS.exe
  C:\Windows\System\dZlfUNS.exe
  2⤵
  PID:1672
- C:\Windows\System\MkVNBrJ.exe
  C:\Windows\System\MkVNBrJ.exe
  2⤵
  PID:3100
- C:\Windows\System\QxUHTGo.exe
  C:\Windows\System\QxUHTGo.exe
  2⤵
  PID:236
- C:\Windows\System\ATQKOFa.exe
  C:\Windows\System\ATQKOFa.exe
  2⤵
  PID:3196
- C:\Windows\System\DqbmMLe.exe
  C:\Windows\System\DqbmMLe.exe
  2⤵
  PID:2644
- C:\Windows\System\JixaZGJ.exe
  C:\Windows\System\JixaZGJ.exe
  2⤵
  PID:3152
- C:\Windows\System\KKHqCLX.exe
  C:\Windows\System\KKHqCLX.exe
  2⤵
  PID:3276
- C:\Windows\System\xrTUNwe.exe
  C:\Windows\System\xrTUNwe.exe
  2⤵
  PID:3232
- C:\Windows\System\LmFtgNW.exe
  C:\Windows\System\LmFtgNW.exe
  2⤵
  PID:3432
- C:\Windows\System\GCHOXZe.exe
  C:\Windows\System\GCHOXZe.exe
  2⤵
  PID:3408
- C:\Windows\System\cWoAmvQ.exe
  C:\Windows\System\cWoAmvQ.exe
  2⤵
  PID:3364
- C:\Windows\System\HAsLDOC.exe
  C:\Windows\System\HAsLDOC.exe
  2⤵
  PID:3560
- C:\Windows\System\nIxtgAA.exe
  C:\Windows\System\nIxtgAA.exe
  2⤵
  PID:3680
- C:\Windows\System\uWMWJlR.exe
  C:\Windows\System\uWMWJlR.exe
  2⤵
  PID:3660
- C:\Windows\System\CFbfEdP.exe
  C:\Windows\System\CFbfEdP.exe
  2⤵
  PID:3596
- C:\Windows\System\xVFoKaG.exe
  C:\Windows\System\xVFoKaG.exe
  2⤵
  PID:3720
- C:\Windows\System\QAmATxk.exe
  C:\Windows\System\QAmATxk.exe
  2⤵
  PID:3792
- C:\Windows\System\rTCDUYi.exe
  C:\Windows\System\rTCDUYi.exe
  2⤵
  PID:4120
- C:\Windows\System\OajhITV.exe
  C:\Windows\System\OajhITV.exe
  2⤵
  PID:4140
- C:\Windows\System\ZtMkWmj.exe
  C:\Windows\System\ZtMkWmj.exe
  2⤵
  PID:4156
- C:\Windows\System\KgGAklU.exe
  C:\Windows\System\KgGAklU.exe
  2⤵
  PID:4176
- C:\Windows\System\qeuWrIL.exe
  C:\Windows\System\qeuWrIL.exe
  2⤵
  PID:4200
- C:\Windows\System\TvjlQep.exe
  C:\Windows\System\TvjlQep.exe
  2⤵
  PID:4220
- C:\Windows\System\dMSVWoT.exe
  C:\Windows\System\dMSVWoT.exe
  2⤵
  PID:4236
- C:\Windows\System\FtAtgxR.exe
  C:\Windows\System\FtAtgxR.exe
  2⤵
  PID:4252
- C:\Windows\System\YCWRdJW.exe
  C:\Windows\System\YCWRdJW.exe
  2⤵
  PID:4280
- C:\Windows\System\VyrFfCX.exe
  C:\Windows\System\VyrFfCX.exe
  2⤵
  PID:4296
- C:\Windows\System\AmVyrUZ.exe
  C:\Windows\System\AmVyrUZ.exe
  2⤵
  PID:4320
- C:\Windows\System\tWiGsyI.exe
  C:\Windows\System\tWiGsyI.exe
  2⤵
  PID:4340
- C:\Windows\System\rKeYybl.exe
  C:\Windows\System\rKeYybl.exe
  2⤵
  PID:4360
- C:\Windows\System\oavblzG.exe
  C:\Windows\System\oavblzG.exe
  2⤵
  PID:4380
- C:\Windows\System\GrMvPsp.exe
  C:\Windows\System\GrMvPsp.exe
  2⤵
  PID:4400
- C:\Windows\System\DvLpbuG.exe
  C:\Windows\System\DvLpbuG.exe
  2⤵
  PID:4416
- C:\Windows\System\UVAlaeL.exe
  C:\Windows\System\UVAlaeL.exe
  2⤵
  PID:4436
- C:\Windows\System\CACxCZQ.exe
  C:\Windows\System\CACxCZQ.exe
  2⤵
  PID:4460
- C:\Windows\System\PLZXGDd.exe
  C:\Windows\System\PLZXGDd.exe
  2⤵
  PID:4480
- C:\Windows\System\JYNDcCA.exe
  C:\Windows\System\JYNDcCA.exe
  2⤵
  PID:4500
- C:\Windows\System\uBAdPIy.exe
  C:\Windows\System\uBAdPIy.exe
  2⤵
  PID:4524
- C:\Windows\System\ShWomgo.exe
  C:\Windows\System\ShWomgo.exe
  2⤵
  PID:4544
- C:\Windows\System\NEfCsVL.exe
  C:\Windows\System\NEfCsVL.exe
  2⤵
  PID:4560
- C:\Windows\System\cGpjHjV.exe
  C:\Windows\System\cGpjHjV.exe
  2⤵
  PID:4580
- C:\Windows\System\meJKbPR.exe
  C:\Windows\System\meJKbPR.exe
  2⤵
  PID:4600
- C:\Windows\System\tforZGv.exe
  C:\Windows\System\tforZGv.exe
  2⤵
  PID:4620
- C:\Windows\System\TpGhlTg.exe
  C:\Windows\System\TpGhlTg.exe
  2⤵
  PID:4636
- C:\Windows\System\zvYhBkU.exe
  C:\Windows\System\zvYhBkU.exe
  2⤵
  PID:4656
- C:\Windows\System\GWWPfim.exe
  C:\Windows\System\GWWPfim.exe
  2⤵
  PID:4676
- C:\Windows\System\FNOfcwO.exe
  C:\Windows\System\FNOfcwO.exe
  2⤵
  PID:4696
- C:\Windows\System\sDxgnbP.exe
  C:\Windows\System\sDxgnbP.exe
  2⤵
  PID:4716
- C:\Windows\System\EklmvUB.exe
  C:\Windows\System\EklmvUB.exe
  2⤵
  PID:4736
- C:\Windows\System\LGhxqVz.exe
  C:\Windows\System\LGhxqVz.exe
  2⤵
  PID:4764
- C:\Windows\System\lipbJcn.exe
  C:\Windows\System\lipbJcn.exe
  2⤵
  PID:4784
- C:\Windows\System\XKDYwtb.exe
  C:\Windows\System\XKDYwtb.exe
  2⤵
  PID:4804
- C:\Windows\System\GfeQLcB.exe
  C:\Windows\System\GfeQLcB.exe
  2⤵
  PID:4824
- C:\Windows\System\joYPzda.exe
  C:\Windows\System\joYPzda.exe
  2⤵
  PID:4844
- C:\Windows\System\zDCntBl.exe
  C:\Windows\System\zDCntBl.exe
  2⤵
  PID:4864
- C:\Windows\System\eLkAgCJ.exe
  C:\Windows\System\eLkAgCJ.exe
  2⤵
  PID:4884
- C:\Windows\System\JNIcjzo.exe
  C:\Windows\System\JNIcjzo.exe
  2⤵
  PID:4904
- C:\Windows\System\bwNaAJO.exe
  C:\Windows\System\bwNaAJO.exe
  2⤵
  PID:4924
- C:\Windows\System\VUQAXor.exe
  C:\Windows\System\VUQAXor.exe
  2⤵
  PID:4944
- C:\Windows\System\ZDTCfex.exe
  C:\Windows\System\ZDTCfex.exe
  2⤵
  PID:4964
- C:\Windows\System\JRxGCaz.exe
  C:\Windows\System\JRxGCaz.exe
  2⤵
  PID:4984
- C:\Windows\System\MzPbySA.exe
  C:\Windows\System\MzPbySA.exe
  2⤵
  PID:5004
- C:\Windows\System\XeVzHux.exe
  C:\Windows\System\XeVzHux.exe
  2⤵
  PID:5024
- C:\Windows\System\rEiyKGj.exe
  C:\Windows\System\rEiyKGj.exe
  2⤵
  PID:5044
- C:\Windows\System\ugvKqHe.exe
  C:\Windows\System\ugvKqHe.exe
  2⤵
  PID:5064
- C:\Windows\System\onoxtCP.exe
  C:\Windows\System\onoxtCP.exe
  2⤵
  PID:5080
- C:\Windows\System\LCYkipy.exe
  C:\Windows\System\LCYkipy.exe
  2⤵
  PID:5100
- C:\Windows\System\bUREjHZ.exe
  C:\Windows\System\bUREjHZ.exe
  2⤵
  PID:3916
- C:\Windows\System\miTCKZN.exe
  C:\Windows\System\miTCKZN.exe
  2⤵
  PID:3840
- C:\Windows\System\kMeolnI.exe
  C:\Windows\System\kMeolnI.exe
  2⤵
  PID:3952
- C:\Windows\System\XbtQsmA.exe
  C:\Windows\System\XbtQsmA.exe
  2⤵
  PID:4068
- C:\Windows\System\rQCiPNN.exe
  C:\Windows\System\rQCiPNN.exe
  2⤵
  PID:1740
- C:\Windows\System\lxJvdUr.exe
  C:\Windows\System\lxJvdUr.exe
  2⤵
  PID:3996
- C:\Windows\System\IWHBWar.exe
  C:\Windows\System\IWHBWar.exe
  2⤵
  PID:3972
- C:\Windows\System\CdvOjwN.exe
  C:\Windows\System\CdvOjwN.exe
  2⤵
  PID:1372
- C:\Windows\System\jeqKDpW.exe
  C:\Windows\System\jeqKDpW.exe
  2⤵
  PID:3104
- C:\Windows\System\OBCPzQl.exe
  C:\Windows\System\OBCPzQl.exe
  2⤵
  PID:2900
- C:\Windows\System\gpLLZMl.exe
  C:\Windows\System\gpLLZMl.exe
  2⤵
  PID:3200
- C:\Windows\System\VRVfwhi.exe
  C:\Windows\System\VRVfwhi.exe
  2⤵
  PID:2204
- C:\Windows\System\arwtQwF.exe
  C:\Windows\System\arwtQwF.exe
  2⤵
  PID:3180
- C:\Windows\System\xtRsJGw.exe
  C:\Windows\System\xtRsJGw.exe
  2⤵
  PID:3428
- C:\Windows\System\sPKAAlI.exe
  C:\Windows\System\sPKAAlI.exe
  2⤵
  PID:2452
- C:\Windows\System\ocrnKkl.exe
  C:\Windows\System\ocrnKkl.exe
  2⤵
  PID:3348
- C:\Windows\System\mSHhIcC.exe
  C:\Windows\System\mSHhIcC.exe
  2⤵
  PID:3460
- C:\Windows\System\kjdeLje.exe
  C:\Windows\System\kjdeLje.exe
  2⤵
  PID:3552
- C:\Windows\System\wkqFVVv.exe
  C:\Windows\System\wkqFVVv.exe
  2⤵
  PID:1908
- C:\Windows\System\SYPnaDW.exe
  C:\Windows\System\SYPnaDW.exe
  2⤵
  PID:4136
- C:\Windows\System\pWDwBze.exe
  C:\Windows\System\pWDwBze.exe
  2⤵
  PID:4108
- C:\Windows\System\bVYbvBE.exe
  C:\Windows\System\bVYbvBE.exe
  2⤵
  PID:4248
- C:\Windows\System\JwYFFoA.exe
  C:\Windows\System\JwYFFoA.exe
  2⤵
  PID:4116
- C:\Windows\System\gXjteWv.exe
  C:\Windows\System\gXjteWv.exe
  2⤵
  PID:4192
- C:\Windows\System\luIDNiM.exe
  C:\Windows\System\luIDNiM.exe
  2⤵
  PID:4264
- C:\Windows\System\qYdicEy.exe
  C:\Windows\System\qYdicEy.exe
  2⤵
  PID:4328
- C:\Windows\System\cqtFoAv.exe
  C:\Windows\System\cqtFoAv.exe
  2⤵
  PID:4304
- C:\Windows\System\lMjgORm.exe
  C:\Windows\System\lMjgORm.exe
  2⤵
  PID:4408
- C:\Windows\System\LqtkAEz.exe
  C:\Windows\System\LqtkAEz.exe
  2⤵
  PID:4348
- C:\Windows\System\jBtldMf.exe
  C:\Windows\System\jBtldMf.exe
  2⤵
  PID:4352
- C:\Windows\System\EscIqDu.exe
  C:\Windows\System\EscIqDu.exe
  2⤵
  PID:4392
- C:\Windows\System\mGwyMSA.exe
  C:\Windows\System\mGwyMSA.exe
  2⤵
  PID:4532
- C:\Windows\System\jlEExbu.exe
  C:\Windows\System\jlEExbu.exe
  2⤵
  PID:4512
- C:\Windows\System\EYohTFJ.exe
  C:\Windows\System\EYohTFJ.exe
  2⤵
  PID:4568
- C:\Windows\System\AJVNgNl.exe
  C:\Windows\System\AJVNgNl.exe
  2⤵
  PID:4616
- C:\Windows\System\IdBoJRi.exe
  C:\Windows\System\IdBoJRi.exe
  2⤵
  PID:4644
- C:\Windows\System\puMttIV.exe
  C:\Windows\System\puMttIV.exe
  2⤵
  PID:4588
- C:\Windows\System\vKGtmPE.exe
  C:\Windows\System\vKGtmPE.exe
  2⤵
  PID:4732
- C:\Windows\System\usTVBSy.exe
  C:\Windows\System\usTVBSy.exe
  2⤵
  PID:4744
- C:\Windows\System\iAjGiLZ.exe
  C:\Windows\System\iAjGiLZ.exe
  2⤵
  PID:4668
- C:\Windows\System\aqQipaY.exe
  C:\Windows\System\aqQipaY.exe
  2⤵
  PID:4708
- C:\Windows\System\chQArDg.exe
  C:\Windows\System\chQArDg.exe
  2⤵
  PID:4816
- C:\Windows\System\guvaVzF.exe
  C:\Windows\System\guvaVzF.exe
  2⤵
  PID:4852
- C:\Windows\System\vTWTETt.exe
  C:\Windows\System\vTWTETt.exe
  2⤵
  PID:264
- C:\Windows\System\hhlrlOX.exe
  C:\Windows\System\hhlrlOX.exe
  2⤵
  PID:4932
- C:\Windows\System\tUYshyx.exe
  C:\Windows\System\tUYshyx.exe
  2⤵
  PID:4840
- C:\Windows\System\buOYGbG.exe
  C:\Windows\System\buOYGbG.exe
  2⤵
  PID:4972
- C:\Windows\System\QtOkxPm.exe
  C:\Windows\System\QtOkxPm.exe
  2⤵
  PID:5012
- C:\Windows\System\ZnEILtE.exe
  C:\Windows\System\ZnEILtE.exe
  2⤵
  PID:5060
- C:\Windows\System\EihZoDk.exe
  C:\Windows\System\EihZoDk.exe
  2⤵
  PID:4996
- C:\Windows\System\cdbHQLG.exe
  C:\Windows\System\cdbHQLG.exe
  2⤵
  PID:5096
- C:\Windows\System\KcKgDvP.exe
  C:\Windows\System\KcKgDvP.exe
  2⤵
  PID:2608
- C:\Windows\System\gPHYNgY.exe
  C:\Windows\System\gPHYNgY.exe
  2⤵
  PID:3888
- C:\Windows\System\rKCaEpa.exe
  C:\Windows\System\rKCaEpa.exe
  2⤵
  PID:3912
- C:\Windows\System\xQKHHvs.exe
  C:\Windows\System\xQKHHvs.exe
  2⤵
  PID:3868
- C:\Windows\System\zIUdeTH.exe
  C:\Windows\System\zIUdeTH.exe
  2⤵
  PID:3976
- C:\Windows\System\lOhsuwF.exe
  C:\Windows\System\lOhsuwF.exe
  2⤵
  PID:4012
- C:\Windows\System\QtSqZfU.exe
  C:\Windows\System\QtSqZfU.exe
  2⤵
  PID:2292
- C:\Windows\System\JcAMSxl.exe
  C:\Windows\System\JcAMSxl.exe
  2⤵
  PID:2652
- C:\Windows\System\eyIcXMt.exe
  C:\Windows\System\eyIcXMt.exe
  2⤵
  PID:3124
- C:\Windows\System\IzzasKf.exe
  C:\Windows\System\IzzasKf.exe
  2⤵
  PID:3512
- C:\Windows\System\FRoHMhT.exe
  C:\Windows\System\FRoHMhT.exe
  2⤵
  PID:3392
- C:\Windows\System\AWZiTng.exe
  C:\Windows\System\AWZiTng.exe
  2⤵
  PID:4216
- C:\Windows\System\gxbkqsM.exe
  C:\Windows\System\gxbkqsM.exe
  2⤵
  PID:3476
- C:\Windows\System\lLOZVMV.exe
  C:\Windows\System\lLOZVMV.exe
  2⤵
  PID:3616
- C:\Windows\System\ieLriSM.exe
  C:\Windows\System\ieLriSM.exe
  2⤵
  PID:2544
- C:\Windows\System\xmydOjr.exe
  C:\Windows\System\xmydOjr.exe
  2⤵
  PID:4476
- C:\Windows\System\BnxbwrY.exe
  C:\Windows\System\BnxbwrY.exe
  2⤵
  PID:4448
- C:\Windows\System\FcChUbX.exe
  C:\Windows\System\FcChUbX.exe
  2⤵
  PID:4112
- C:\Windows\System\aNwUyZZ.exe
  C:\Windows\System\aNwUyZZ.exe
  2⤵
  PID:4424
- C:\Windows\System\SmgRksM.exe
  C:\Windows\System\SmgRksM.exe
  2⤵
  PID:4520
- C:\Windows\System\SxifHlG.exe
  C:\Windows\System\SxifHlG.exe
  2⤵
  PID:2008
- C:\Windows\System\mBAYTTq.exe
  C:\Windows\System\mBAYTTq.exe
  2⤵
  PID:4492
- C:\Windows\System\BNQPIVl.exe
  C:\Windows\System\BNQPIVl.exe
  2⤵
  PID:4508
- C:\Windows\System\nmWFhai.exe
  C:\Windows\System\nmWFhai.exe
  2⤵
  PID:4776
- C:\Windows\System\tewjzrA.exe
  C:\Windows\System\tewjzrA.exe
  2⤵
  PID:4576
- C:\Windows\System\yooLPHK.exe
  C:\Windows\System\yooLPHK.exe
  2⤵
  PID:4820
- C:\Windows\System\AsXAifw.exe
  C:\Windows\System\AsXAifw.exe
  2⤵
  PID:4936
- C:\Windows\System\FWMdlfJ.exe
  C:\Windows\System\FWMdlfJ.exe
  2⤵
  PID:4756
- C:\Windows\System\tkmATRu.exe
  C:\Windows\System\tkmATRu.exe
  2⤵
  PID:4980
- C:\Windows\System\FcShOZi.exe
  C:\Windows\System\FcShOZi.exe
  2⤵
  PID:4912
- C:\Windows\System\rigpFOS.exe
  C:\Windows\System\rigpFOS.exe
  2⤵
  PID:5016
- C:\Windows\System\nHBWeWb.exe
  C:\Windows\System\nHBWeWb.exe
  2⤵
  PID:5076
- C:\Windows\System\MpEOdSG.exe
  C:\Windows\System\MpEOdSG.exe
  2⤵
  PID:5056
- C:\Windows\System\VlxANDl.exe
  C:\Windows\System\VlxANDl.exe
  2⤵
  PID:4052
- C:\Windows\System\HXeVqVx.exe
  C:\Windows\System\HXeVqVx.exe
  2⤵
  PID:3656
- C:\Windows\System\BiXiXZO.exe
  C:\Windows\System\BiXiXZO.exe
  2⤵
  PID:1232
- C:\Windows\System\FFrApVI.exe
  C:\Windows\System\FFrApVI.exe
  2⤵
  PID:4128
- C:\Windows\System\AIfiETs.exe
  C:\Windows\System\AIfiETs.exe
  2⤵
  PID:332
- C:\Windows\System\HXRfiTK.exe
  C:\Windows\System\HXRfiTK.exe
  2⤵
  PID:3636
- C:\Windows\System\rogIuoO.exe
  C:\Windows\System\rogIuoO.exe
  2⤵
  PID:2272
- C:\Windows\System\KGJxlde.exe
  C:\Windows\System\KGJxlde.exe
  2⤵
  PID:4452
- C:\Windows\System\pAOSbNp.exe
  C:\Windows\System\pAOSbNp.exe
  2⤵
  PID:4232
- C:\Windows\System\NxesEWN.exe
  C:\Windows\System\NxesEWN.exe
  2⤵
  PID:2416
- C:\Windows\System\YjBzhFJ.exe
  C:\Windows\System\YjBzhFJ.exe
  2⤵
  PID:4312
- C:\Windows\System\UlZltrW.exe
  C:\Windows\System\UlZltrW.exe
  2⤵
  PID:4628
- C:\Windows\System\RICRRWF.exe
  C:\Windows\System\RICRRWF.exe
  2⤵
  PID:4688
- C:\Windows\System\zAtdkqq.exe
  C:\Windows\System\zAtdkqq.exe
  2⤵
  PID:4748
- C:\Windows\System\ErlQQhh.exe
  C:\Windows\System\ErlQQhh.exe
  2⤵
  PID:4900
- C:\Windows\System\OUZJyPk.exe
  C:\Windows\System\OUZJyPk.exe
  2⤵
  PID:4648
- C:\Windows\System\loLgwVP.exe
  C:\Windows\System\loLgwVP.exe
  2⤵
  PID:5112
- C:\Windows\System\tXadFLd.exe
  C:\Windows\System\tXadFLd.exe
  2⤵
  PID:2288
- C:\Windows\System\jOHtaQu.exe
  C:\Windows\System\jOHtaQu.exe
  2⤵
  PID:3732
- C:\Windows\System\ejhJmkb.exe
  C:\Windows\System\ejhJmkb.exe
  2⤵
  PID:3080
- C:\Windows\System\zcNglJt.exe
  C:\Windows\System\zcNglJt.exe
  2⤵
  PID:4152
- C:\Windows\System\FwMMIjc.exe
  C:\Windows\System\FwMMIjc.exe
  2⤵
  PID:4212
- C:\Windows\System\ATzgzDw.exe
  C:\Windows\System\ATzgzDw.exe
  2⤵
  PID:4376
- C:\Windows\System\kBMTFED.exe
  C:\Windows\System\kBMTFED.exe
  2⤵
  PID:4228
- C:\Windows\System\dayHSfO.exe
  C:\Windows\System\dayHSfO.exe
  2⤵
  PID:4456
- C:\Windows\System\jmSsaKi.exe
  C:\Windows\System\jmSsaKi.exe
  2⤵
  PID:4388
- C:\Windows\System\dVxbYWQ.exe
  C:\Windows\System\dVxbYWQ.exe
  2⤵
  PID:4832
- C:\Windows\System\aaDsAGt.exe
  C:\Windows\System\aaDsAGt.exe
  2⤵
  PID:4992
- C:\Windows\System\JaADLYn.exe
  C:\Windows\System\JaADLYn.exe
  2⤵
  PID:5128
- C:\Windows\System\TYtfTUe.exe
  C:\Windows\System\TYtfTUe.exe
  2⤵
  PID:5152
- C:\Windows\System\PCyxmIr.exe
  C:\Windows\System\PCyxmIr.exe
  2⤵
  PID:5168
- C:\Windows\System\pNEdcrB.exe
  C:\Windows\System\pNEdcrB.exe
  2⤵
  PID:5188
- C:\Windows\System\GXEclsa.exe
  C:\Windows\System\GXEclsa.exe
  2⤵
  PID:5212
- C:\Windows\System\pYGrZSx.exe
  C:\Windows\System\pYGrZSx.exe
  2⤵
  PID:5232
- C:\Windows\System\MTPUofB.exe
  C:\Windows\System\MTPUofB.exe
  2⤵
  PID:5248
- C:\Windows\System\DefJFvk.exe
  C:\Windows\System\DefJFvk.exe
  2⤵
  PID:5268
- C:\Windows\System\LPnpFxh.exe
  C:\Windows\System\LPnpFxh.exe
  2⤵
  PID:5292
- C:\Windows\System\DJZfStY.exe
  C:\Windows\System\DJZfStY.exe
  2⤵
  PID:5312
- C:\Windows\System\BXEyWDq.exe
  C:\Windows\System\BXEyWDq.exe
  2⤵
  PID:5328
- C:\Windows\System\BGIVRHk.exe
  C:\Windows\System\BGIVRHk.exe
  2⤵
  PID:5348
- C:\Windows\System\VtBeJIp.exe
  C:\Windows\System\VtBeJIp.exe
  2⤵
  PID:5372
- C:\Windows\System\uIJQDHq.exe
  C:\Windows\System\uIJQDHq.exe
  2⤵
  PID:5388
- C:\Windows\System\EYmbKCY.exe
  C:\Windows\System\EYmbKCY.exe
  2⤵
  PID:5408
- C:\Windows\System\XuBzdHA.exe
  C:\Windows\System\XuBzdHA.exe
  2⤵
  PID:5424
- C:\Windows\System\YzGEeNy.exe
  C:\Windows\System\YzGEeNy.exe
  2⤵
  PID:5444
- C:\Windows\System\ZlQZZrK.exe
  C:\Windows\System\ZlQZZrK.exe
  2⤵
  PID:5464
- C:\Windows\System\RbKdfbA.exe
  C:\Windows\System\RbKdfbA.exe
  2⤵
  PID:5484
- C:\Windows\System\HeeyKeP.exe
  C:\Windows\System\HeeyKeP.exe
  2⤵
  PID:5504
- C:\Windows\System\rknliCc.exe
  C:\Windows\System\rknliCc.exe
  2⤵
  PID:5532
- C:\Windows\System\AjKXLfU.exe
  C:\Windows\System\AjKXLfU.exe
  2⤵
  PID:5548
- C:\Windows\System\YKyFzNs.exe
  C:\Windows\System\YKyFzNs.exe
  2⤵
  PID:5568
- C:\Windows\System\BPITvBh.exe
  C:\Windows\System\BPITvBh.exe
  2⤵
  PID:5588
- C:\Windows\System\SzVoPeH.exe
  C:\Windows\System\SzVoPeH.exe
  2⤵
  PID:5604
- C:\Windows\System\YlwTcgE.exe
  C:\Windows\System\YlwTcgE.exe
  2⤵
  PID:5620
- C:\Windows\System\IgEvZlA.exe
  C:\Windows\System\IgEvZlA.exe
  2⤵
  PID:5652
- C:\Windows\System\UhAgUOm.exe
  C:\Windows\System\UhAgUOm.exe
  2⤵
  PID:5668
- C:\Windows\System\GtaVlkz.exe
  C:\Windows\System\GtaVlkz.exe
  2⤵
  PID:5688
- C:\Windows\System\eBIuAAW.exe
  C:\Windows\System\eBIuAAW.exe
  2⤵
  PID:5708
- C:\Windows\System\eSLGArF.exe
  C:\Windows\System\eSLGArF.exe
  2⤵
  PID:5724
- C:\Windows\System\DSoLZFE.exe
  C:\Windows\System\DSoLZFE.exe
  2⤵
  PID:5740
- C:\Windows\System\KjXvrqo.exe
  C:\Windows\System\KjXvrqo.exe
  2⤵
  PID:5760
- C:\Windows\System\RcJpZLG.exe
  C:\Windows\System\RcJpZLG.exe
  2⤵
  PID:5776
- C:\Windows\System\RbDhkPR.exe
  C:\Windows\System\RbDhkPR.exe
  2⤵
  PID:5796
- C:\Windows\System\zmSFHKQ.exe
  C:\Windows\System\zmSFHKQ.exe
  2⤵
  PID:5816
- C:\Windows\System\NiwxAFf.exe
  C:\Windows\System\NiwxAFf.exe
  2⤵
  PID:5832
- C:\Windows\System\dGwdFgy.exe
  C:\Windows\System\dGwdFgy.exe
  2⤵
  PID:5856
- C:\Windows\System\ZoXIHcC.exe
  C:\Windows\System\ZoXIHcC.exe
  2⤵
  PID:5872
- C:\Windows\System\IyFhpMy.exe
  C:\Windows\System\IyFhpMy.exe
  2⤵
  PID:5892
- C:\Windows\System\BwMAElo.exe
  C:\Windows\System\BwMAElo.exe
  2⤵
  PID:5932
- C:\Windows\System\kpvsmAG.exe
  C:\Windows\System\kpvsmAG.exe
  2⤵
  PID:5952
- C:\Windows\System\kgVSAcu.exe
  C:\Windows\System\kgVSAcu.exe
  2⤵
  PID:5968
- C:\Windows\System\TojgDzM.exe
  C:\Windows\System\TojgDzM.exe
  2⤵
  PID:5988
- C:\Windows\System\eypghvV.exe
  C:\Windows\System\eypghvV.exe
  2⤵
  PID:6004
- C:\Windows\System\hSBSSUY.exe
  C:\Windows\System\hSBSSUY.exe
  2⤵
  PID:6020
- C:\Windows\System\QVkDKYW.exe
  C:\Windows\System\QVkDKYW.exe
  2⤵
  PID:6040
- C:\Windows\System\wmkjrck.exe
  C:\Windows\System\wmkjrck.exe
  2⤵
  PID:6060
- C:\Windows\System\mGMEZNA.exe
  C:\Windows\System\mGMEZNA.exe
  2⤵
  PID:6092
- C:\Windows\System\LrDJghJ.exe
  C:\Windows\System\LrDJghJ.exe
  2⤵
  PID:6112
- C:\Windows\System\TekVhhG.exe
  C:\Windows\System\TekVhhG.exe
  2⤵
  PID:6132
- C:\Windows\System\wMSadqc.exe
  C:\Windows\System\wMSadqc.exe
  2⤵
  PID:4956
- C:\Windows\System\FqykZYU.exe
  C:\Windows\System\FqykZYU.exe
  2⤵
  PID:5108
- C:\Windows\System\UNOTRuD.exe
  C:\Windows\System\UNOTRuD.exe
  2⤵
  PID:3612
- C:\Windows\System\TnvmQXR.exe
  C:\Windows\System\TnvmQXR.exe
  2⤵
  PID:1220
- C:\Windows\System\kAPSrky.exe
  C:\Windows\System\kAPSrky.exe
  2⤵
  PID:4148
- C:\Windows\System\HwuaxXX.exe
  C:\Windows\System\HwuaxXX.exe
  2⤵
  PID:4552
- C:\Windows\System\zGSMSoC.exe
  C:\Windows\System\zGSMSoC.exe
  2⤵
  PID:2764
- C:\Windows\System\rSTtRLY.exe
  C:\Windows\System\rSTtRLY.exe
  2⤵
  PID:5144
- C:\Windows\System\hzOtVul.exe
  C:\Windows\System\hzOtVul.exe
  2⤵
  PID:4780
- C:\Windows\System\aPcIBhN.exe
  C:\Windows\System\aPcIBhN.exe
  2⤵
  PID:5164
- C:\Windows\System\gpGMgPo.exe
  C:\Windows\System\gpGMgPo.exe
  2⤵
  PID:5264
- C:\Windows\System\mQEXJDe.exe
  C:\Windows\System\mQEXJDe.exe
  2⤵
  PID:5336
- C:\Windows\System\NhiXMIO.exe
  C:\Windows\System\NhiXMIO.exe
  2⤵
  PID:5208
- C:\Windows\System\PDTYvDr.exe
  C:\Windows\System\PDTYvDr.exe
  2⤵
  PID:5276
- C:\Windows\System\BiGNMur.exe
  C:\Windows\System\BiGNMur.exe
  2⤵
  PID:5420
- C:\Windows\System\QKcqYBu.exe
  C:\Windows\System\QKcqYBu.exe
  2⤵
  PID:5492
- C:\Windows\System\sJyqPwN.exe
  C:\Windows\System\sJyqPwN.exe
  2⤵
  PID:5576
- C:\Windows\System\JqKlfBg.exe
  C:\Windows\System\JqKlfBg.exe
  2⤵
  PID:5660
- C:\Windows\System\cYVmjzl.exe
  C:\Windows\System\cYVmjzl.exe
  2⤵
  PID:5356
- C:\Windows\System\CjOavUZ.exe
  C:\Windows\System\CjOavUZ.exe
  2⤵
  PID:5368
- C:\Windows\System\ppdktqz.exe
  C:\Windows\System\ppdktqz.exe
  2⤵
  PID:5480
- C:\Windows\System\jyJwAuC.exe
  C:\Windows\System\jyJwAuC.exe
  2⤵
  PID:5732
- C:\Windows\System\TFBQNFY.exe
  C:\Windows\System\TFBQNFY.exe
  2⤵
  PID:5524
- C:\Windows\System\jXPwelh.exe
  C:\Windows\System\jXPwelh.exe
  2⤵
  PID:5840
- C:\Windows\System\wdZQWDu.exe
  C:\Windows\System\wdZQWDu.exe
  2⤵
  PID:5564
- C:\Windows\System\XrVSnfE.exe
  C:\Windows\System\XrVSnfE.exe
  2⤵
  PID:5636
- C:\Windows\System\ZgAbqoJ.exe
  C:\Windows\System\ZgAbqoJ.exe
  2⤵
  PID:5556
- C:\Windows\System\MSxScjr.exe
  C:\Windows\System\MSxScjr.exe
  2⤵
  PID:5684
- C:\Windows\System\oADMBtR.exe
  C:\Windows\System\oADMBtR.exe
  2⤵
  PID:2640
- C:\Windows\System\mRMvUWw.exe
  C:\Windows\System\mRMvUWw.exe
  2⤵
  PID:5716
- C:\Windows\System\IYKjyrT.exe
  C:\Windows\System\IYKjyrT.exe
  2⤵
  PID:5940
- C:\Windows\System\CAlIsrN.exe
  C:\Windows\System\CAlIsrN.exe
  2⤵
  PID:5980
- C:\Windows\System\ZFgNrDx.exe
  C:\Windows\System\ZFgNrDx.exe
  2⤵
  PID:5828
- C:\Windows\System\qfJtKAV.exe
  C:\Windows\System\qfJtKAV.exe
  2⤵
  PID:5752
- C:\Windows\System\BavxdQt.exe
  C:\Windows\System\BavxdQt.exe
  2⤵
  PID:6016
- C:\Windows\System\TlBCBPK.exe
  C:\Windows\System\TlBCBPK.exe
  2⤵
  PID:2004
- C:\Windows\System\CepVctV.exe
  C:\Windows\System\CepVctV.exe
  2⤵
  PID:2952
- C:\Windows\System\NGofPAm.exe
  C:\Windows\System\NGofPAm.exe
  2⤵
  PID:5964
- C:\Windows\System\IpATGoO.exe
  C:\Windows\System\IpATGoO.exe
  2⤵
  PID:6036
- C:\Windows\System\IYAfuGD.exe
  C:\Windows\System\IYAfuGD.exe
  2⤵
  PID:6108
- C:\Windows\System\bpSxSrH.exe
  C:\Windows\System\bpSxSrH.exe
  2⤵
  PID:2476
- C:\Windows\System\nuMYZHH.exe
  C:\Windows\System\nuMYZHH.exe
  2⤵
  PID:3956
- C:\Windows\System\ufgKacJ.exe
  C:\Windows\System\ufgKacJ.exe
  2⤵
  PID:3256
- C:\Windows\System\bUXJuZz.exe
  C:\Windows\System\bUXJuZz.exe
  2⤵
  PID:5140
- C:\Windows\System\EydFfhH.exe
  C:\Windows\System\EydFfhH.exe
  2⤵
  PID:5176
- C:\Windows\System\RFAENDO.exe
  C:\Windows\System\RFAENDO.exe
  2⤵
  PID:4684
- C:\Windows\System\guKusaN.exe
  C:\Windows\System\guKusaN.exe
  2⤵
  PID:5224
- C:\Windows\System\JWdjKUA.exe
  C:\Windows\System\JWdjKUA.exe
  2⤵
  PID:5072
- C:\Windows\System\XGVJfIi.exe
  C:\Windows\System\XGVJfIi.exe
  2⤵
  PID:5380
- C:\Windows\System\FkxaJNs.exe
  C:\Windows\System\FkxaJNs.exe
  2⤵
  PID:2532
- C:\Windows\System\VDpfdjB.exe
  C:\Windows\System\VDpfdjB.exe
  2⤵
  PID:2244
- C:\Windows\System\CZZChku.exe
  C:\Windows\System\CZZChku.exe
  2⤵
  PID:5696
- C:\Windows\System\JnnxkvJ.exe
  C:\Windows\System\JnnxkvJ.exe
  2⤵
  PID:4168
- C:\Windows\System\UpRsPFm.exe
  C:\Windows\System\UpRsPFm.exe
  2⤵
  PID:5400
- C:\Windows\System\OvRJsrN.exe
  C:\Windows\System\OvRJsrN.exe
  2⤵
  PID:5804
- C:\Windows\System\zZyPLYX.exe
  C:\Windows\System\zZyPLYX.exe
  2⤵
  PID:5520
- C:\Windows\System\chbCKKC.exe
  C:\Windows\System\chbCKKC.exe
  2⤵
  PID:5560
- C:\Windows\System\ooJcYYB.exe
  C:\Windows\System\ooJcYYB.exe
  2⤵
  PID:5912
- C:\Windows\System\LpVOtZs.exe
  C:\Windows\System\LpVOtZs.exe
  2⤵
  PID:5868
- C:\Windows\System\QzfXBqX.exe
  C:\Windows\System\QzfXBqX.exe
  2⤵
  PID:1648
- C:\Windows\System\udboNAc.exe
  C:\Windows\System\udboNAc.exe
  2⤵
  PID:5632
- C:\Windows\System\UkkNxUR.exe
  C:\Windows\System\UkkNxUR.exe
  2⤵
  PID:5676
- C:\Windows\System\GOmZWdg.exe
  C:\Windows\System\GOmZWdg.exe
  2⤵
  PID:5984
- C:\Windows\System\vvLRqUp.exe
  C:\Windows\System\vvLRqUp.exe
  2⤵
  PID:6140
- C:\Windows\System\SfpQzvE.exe
  C:\Windows\System\SfpQzvE.exe
  2⤵
  PID:3328
- C:\Windows\System\VvnIdQr.exe
  C:\Windows\System\VvnIdQr.exe
  2⤵
  PID:808
- C:\Windows\System\mKhpgxu.exe
  C:\Windows\System\mKhpgxu.exe
  2⤵
  PID:1684
- C:\Windows\System\LERfZQb.exe
  C:\Windows\System\LERfZQb.exe
  2⤵
  PID:1584
- C:\Windows\System\vmnZfnO.exe
  C:\Windows\System\vmnZfnO.exe
  2⤵
  PID:1760
- C:\Windows\System\UGleGJa.exe
  C:\Windows\System\UGleGJa.exe
  2⤵
  PID:3220
- C:\Windows\System\EXlFLcw.exe
  C:\Windows\System\EXlFLcw.exe
  2⤵
  PID:6000
- C:\Windows\System\bTRBHvm.exe
  C:\Windows\System\bTRBHvm.exe
  2⤵
  PID:6124
- C:\Windows\System\acCrzyN.exe
  C:\Windows\System\acCrzyN.exe
  2⤵
  PID:5256
- C:\Windows\System\avfhKAW.exe
  C:\Windows\System\avfhKAW.exe
  2⤵
  PID:5204
- C:\Windows\System\XHKSabU.exe
  C:\Windows\System\XHKSabU.exe
  2⤵
  PID:5160
- C:\Windows\System\XPRUHSC.exe
  C:\Windows\System\XPRUHSC.exe
  2⤵
  PID:5580
- C:\Windows\System\XxNMgiU.exe
  C:\Windows\System\XxNMgiU.exe
  2⤵
  PID:2520
- C:\Windows\System\fpBpLqU.exe
  C:\Windows\System\fpBpLqU.exe
  2⤵
  PID:5440
- C:\Windows\System\MUNorND.exe
  C:\Windows\System\MUNorND.exe
  2⤵
  PID:5812
- C:\Windows\System\XLVlmFd.exe
  C:\Windows\System\XLVlmFd.exe
  2⤵
  PID:5324
- C:\Windows\System\PBiscCs.exe
  C:\Windows\System\PBiscCs.exe
  2⤵
  PID:1600
- C:\Windows\System\bOhTffU.exe
  C:\Windows\System\bOhTffU.exe
  2⤵
  PID:5880
- C:\Windows\System\huIoEcu.exe
  C:\Windows\System\huIoEcu.exe
  2⤵
  PID:2044
- C:\Windows\System\sxaQQsw.exe
  C:\Windows\System\sxaQQsw.exe
  2⤵
  PID:2588
- C:\Windows\System\KSHVIob.exe
  C:\Windows\System\KSHVIob.exe
  2⤵
  PID:3024
- C:\Windows\System\huNBjvd.exe
  C:\Windows\System\huNBjvd.exe
  2⤵
  PID:2604
- C:\Windows\System\qJOHOne.exe
  C:\Windows\System\qJOHOne.exe
  2⤵
  PID:2096
- C:\Windows\System\vxNouKV.exe
  C:\Windows\System\vxNouKV.exe
  2⤵
  PID:2156
- C:\Windows\System\skzzcZT.exe
  C:\Windows\System\skzzcZT.exe
  2⤵
  PID:5680
- C:\Windows\System\JMJcXlh.exe
  C:\Windows\System\JMJcXlh.exe
  2⤵
  PID:2844
- C:\Windows\System\WBrcNlG.exe
  C:\Windows\System\WBrcNlG.exe
  2⤵
  PID:2224
- C:\Windows\System\wflkxZB.exe
  C:\Windows\System\wflkxZB.exe
  2⤵
  PID:6068
- C:\Windows\System\fTbsNDb.exe
  C:\Windows\System\fTbsNDb.exe
  2⤵
  PID:4488
- C:\Windows\System\tMOnWen.exe
  C:\Windows\System\tMOnWen.exe
  2⤵
  PID:5052
- C:\Windows\System\UvGuoQH.exe
  C:\Windows\System\UvGuoQH.exe
  2⤵
  PID:5124
- C:\Windows\System\uQepRGE.exe
  C:\Windows\System\uQepRGE.exe
  2⤵
  PID:5704
- C:\Windows\System\DALqpZi.exe
  C:\Windows\System\DALqpZi.exe
  2⤵
  PID:5544
- C:\Windows\System\AOgZxDQ.exe
  C:\Windows\System\AOgZxDQ.exe
  2⤵
  PID:5848
- C:\Windows\System\sjnaCMm.exe
  C:\Windows\System\sjnaCMm.exe
  2⤵
  PID:5852
- C:\Windows\System\ZYKcUeM.exe
  C:\Windows\System\ZYKcUeM.exe
  2⤵
  PID:5916
- C:\Windows\System\kwZqksW.exe
  C:\Windows\System\kwZqksW.exe
  2⤵
  PID:3016
- C:\Windows\System\xmEMIBm.exe
  C:\Windows\System\xmEMIBm.exe
  2⤵
  PID:2208
- C:\Windows\System\jEVgqqD.exe
  C:\Windows\System\jEVgqqD.exe
  2⤵
  PID:5900
- C:\Windows\System\NmIeikb.exe
  C:\Windows\System\NmIeikb.exe
  2⤵
  PID:6056
- C:\Windows\System\LkgIbaj.exe
  C:\Windows\System\LkgIbaj.exe
  2⤵
  PID:5436
- C:\Windows\System\cOQrfkq.exe
  C:\Windows\System\cOQrfkq.exe
  2⤵
  PID:2168
- C:\Windows\System\LXgaggl.exe
  C:\Windows\System\LXgaggl.exe
  2⤵
  PID:3980
- C:\Windows\System\Zvksplq.exe
  C:\Windows\System\Zvksplq.exe
  2⤵
  PID:5808
- C:\Windows\System\TveJxZH.exe
  C:\Windows\System\TveJxZH.exe
  2⤵
  PID:2228
- C:\Windows\System\mcDvTzC.exe
  C:\Windows\System\mcDvTzC.exe
  2⤵
  PID:5304
- C:\Windows\System\GIdrInP.exe
  C:\Windows\System\GIdrInP.exe
  2⤵
  PID:3056
- C:\Windows\System\judMocI.exe
  C:\Windows\System\judMocI.exe
  2⤵
  PID:5184
- C:\Windows\System\yyBJBrT.exe
  C:\Windows\System\yyBJBrT.exe
  2⤵
  PID:6012
- C:\Windows\System\OVSkcHE.exe
  C:\Windows\System\OVSkcHE.exe
  2⤵
  PID:5320
- C:\Windows\System\rJBFZKl.exe
  C:\Windows\System\rJBFZKl.exe
  2⤵
  PID:2016
- C:\Windows\System\qdPVJOY.exe
  C:\Windows\System\qdPVJOY.exe
  2⤵
  PID:5792
- C:\Windows\System\UTsokJZ.exe
  C:\Windows\System\UTsokJZ.exe
  2⤵
  PID:6148
- C:\Windows\System\BkJHGGp.exe
  C:\Windows\System\BkJHGGp.exe
  2⤵
  PID:6164
- C:\Windows\System\bIVQkgT.exe
  C:\Windows\System\bIVQkgT.exe
  2⤵
  PID:6180
- C:\Windows\System\skBWlzm.exe
  C:\Windows\System\skBWlzm.exe
  2⤵
  PID:6204
- C:\Windows\System\iCvSobS.exe
  C:\Windows\System\iCvSobS.exe
  2⤵
  PID:6224
- C:\Windows\System\RJSHmGg.exe
  C:\Windows\System\RJSHmGg.exe
  2⤵
  PID:6252
- C:\Windows\System\vtnNYyZ.exe
  C:\Windows\System\vtnNYyZ.exe
  2⤵
  PID:6280
- C:\Windows\System\FsrwKoP.exe
  C:\Windows\System\FsrwKoP.exe
  2⤵
  PID:6296
- C:\Windows\System\HqeHfjk.exe
  C:\Windows\System\HqeHfjk.exe
  2⤵
  PID:6312
- C:\Windows\System\lJfRNWP.exe
  C:\Windows\System\lJfRNWP.exe
  2⤵
  PID:6328
- C:\Windows\System\ekyzmrl.exe
  C:\Windows\System\ekyzmrl.exe
  2⤵
  PID:6344
- C:\Windows\System\aJkbnzI.exe
  C:\Windows\System\aJkbnzI.exe
  2⤵
  PID:6364
- C:\Windows\System\dlxrmeX.exe
  C:\Windows\System\dlxrmeX.exe
  2⤵
  PID:6380
- C:\Windows\System\SAFNiqy.exe
  C:\Windows\System\SAFNiqy.exe
  2⤵
  PID:6400
- C:\Windows\System\OLfREPq.exe
  C:\Windows\System\OLfREPq.exe
  2⤵
  PID:6416
- C:\Windows\System\MwclvGd.exe
  C:\Windows\System\MwclvGd.exe
  2⤵
  PID:6436
- C:\Windows\System\xWvsEfI.exe
  C:\Windows\System\xWvsEfI.exe
  2⤵
  PID:6456
- C:\Windows\System\AtIJOOO.exe
  C:\Windows\System\AtIJOOO.exe
  2⤵
  PID:6476
- C:\Windows\System\FMxSyoh.exe
  C:\Windows\System\FMxSyoh.exe
  2⤵
  PID:6528
- C:\Windows\System\KxOLySh.exe
  C:\Windows\System\KxOLySh.exe
  2⤵
  PID:6544
- C:\Windows\System\MJfJLrI.exe
  C:\Windows\System\MJfJLrI.exe
  2⤵
  PID:6564
- C:\Windows\System\DTDnluD.exe
  C:\Windows\System\DTDnluD.exe
  2⤵
  PID:6580
- C:\Windows\System\wmtGwKQ.exe
  C:\Windows\System\wmtGwKQ.exe
  2⤵
  PID:6604
- C:\Windows\System\sdOxcOe.exe
  C:\Windows\System\sdOxcOe.exe
  2⤵
  PID:6620
- C:\Windows\System\jLrkMvL.exe
  C:\Windows\System\jLrkMvL.exe
  2⤵
  PID:6640
- C:\Windows\System\JJWHvwi.exe
  C:\Windows\System\JJWHvwi.exe
  2⤵
  PID:6660
- C:\Windows\System\nJwDVrP.exe
  C:\Windows\System\nJwDVrP.exe
  2⤵
  PID:6676
- C:\Windows\System\wyJUgZy.exe
  C:\Windows\System\wyJUgZy.exe
  2⤵
  PID:6700
- C:\Windows\System\yYnXvLP.exe
  C:\Windows\System\yYnXvLP.exe
  2⤵
  PID:6716
- C:\Windows\System\SoJxxDo.exe
  C:\Windows\System\SoJxxDo.exe
  2⤵
  PID:6732
- C:\Windows\System\QlBVaoE.exe
  C:\Windows\System\QlBVaoE.exe
  2⤵
  PID:6756
- C:\Windows\System\fUMjjcu.exe
  C:\Windows\System\fUMjjcu.exe
  2⤵
  PID:6780
- C:\Windows\System\sUrBYjU.exe
  C:\Windows\System\sUrBYjU.exe
  2⤵
  PID:6800
- C:\Windows\System\FEUuzvE.exe
  C:\Windows\System\FEUuzvE.exe
  2⤵
  PID:6816
- C:\Windows\System\RAphmao.exe
  C:\Windows\System\RAphmao.exe
  2⤵
  PID:6832
- C:\Windows\System\yheXfHG.exe
  C:\Windows\System\yheXfHG.exe
  2⤵
  PID:6856
- C:\Windows\System\bnrqpdT.exe
  C:\Windows\System\bnrqpdT.exe
  2⤵
  PID:6872
- C:\Windows\System\ulPGivd.exe
  C:\Windows\System\ulPGivd.exe
  2⤵
  PID:6892
- C:\Windows\System\ikVswCQ.exe
  C:\Windows\System\ikVswCQ.exe
  2⤵
  PID:6912
- C:\Windows\System\pQOAbsf.exe
  C:\Windows\System\pQOAbsf.exe
  2⤵
  PID:6932
- C:\Windows\System\hAfaNIP.exe
  C:\Windows\System\hAfaNIP.exe
  2⤵
  PID:6952
- C:\Windows\System\nJTLFas.exe
  C:\Windows\System\nJTLFas.exe
  2⤵
  PID:6972
- C:\Windows\System\oRPeVnm.exe
  C:\Windows\System\oRPeVnm.exe
  2⤵
  PID:6996
- C:\Windows\System\opjhmdo.exe
  C:\Windows\System\opjhmdo.exe
  2⤵
  PID:7020
- C:\Windows\System\iDrvmgi.exe
  C:\Windows\System\iDrvmgi.exe
  2⤵
  PID:7036
- C:\Windows\System\zddXtEm.exe
  C:\Windows\System\zddXtEm.exe
  2⤵
  PID:7056
- C:\Windows\System\hODlYhZ.exe
  C:\Windows\System\hODlYhZ.exe
  2⤵
  PID:7080
- C:\Windows\System\UGTKSjB.exe
  C:\Windows\System\UGTKSjB.exe
  2⤵
  PID:7100
- C:\Windows\System\pOVydLM.exe
  C:\Windows\System\pOVydLM.exe
  2⤵
  PID:7120
- C:\Windows\System\wcyAMzD.exe
  C:\Windows\System\wcyAMzD.exe
  2⤵
  PID:7136
- C:\Windows\System\PvACXSM.exe
  C:\Windows\System\PvACXSM.exe
  2⤵
  PID:7156
- C:\Windows\System\RJLfShc.exe
  C:\Windows\System\RJLfShc.exe
  2⤵
  PID:3396
- C:\Windows\System\eOIOLqy.exe
  C:\Windows\System\eOIOLqy.exe
  2⤵
  PID:6196
- C:\Windows\System\dahnDeg.exe
  C:\Windows\System\dahnDeg.exe
  2⤵
  PID:6236
- C:\Windows\System\bVyTCLa.exe
  C:\Windows\System\bVyTCLa.exe
  2⤵
  PID:6032
- C:\Windows\System\KtPTHSX.exe
  C:\Windows\System\KtPTHSX.exe
  2⤵
  PID:2212
- C:\Windows\System\UJRkbUl.exe
  C:\Windows\System\UJRkbUl.exe
  2⤵
  PID:6292
- C:\Windows\System\psGBSzu.exe
  C:\Windows\System\psGBSzu.exe
  2⤵
  PID:6468
- C:\Windows\System\FppkCVA.exe
  C:\Windows\System\FppkCVA.exe
  2⤵
  PID:5240
- C:\Windows\System\MLlkngZ.exe
  C:\Windows\System\MLlkngZ.exe
  2⤵
  PID:2052
- C:\Windows\System\ZpPWlIz.exe
  C:\Windows\System\ZpPWlIz.exe
  2⤵
  PID:6220
- C:\Windows\System\ndtypCb.exe
  C:\Windows\System\ndtypCb.exe
  2⤵
  PID:6336
- C:\Windows\System\QdYVYgK.exe
  C:\Windows\System\QdYVYgK.exe
  2⤵
  PID:6272
- C:\Windows\System\XdvYvaS.exe
  C:\Windows\System\XdvYvaS.exe
  2⤵
  PID:6376
- C:\Windows\System\iUMpsEa.exe
  C:\Windows\System\iUMpsEa.exe
  2⤵
  PID:6496
- C:\Windows\System\QpYheal.exe
  C:\Windows\System\QpYheal.exe
  2⤵
  PID:6612
- C:\Windows\System\FtCvnis.exe
  C:\Windows\System\FtCvnis.exe
  2⤵
  PID:6492
- C:\Windows\System\rZAYfmx.exe
  C:\Windows\System\rZAYfmx.exe
  2⤵
  PID:6656
- C:\Windows\System\QPFinOO.exe
  C:\Windows\System\QPFinOO.exe
  2⤵
  PID:6724
- C:\Windows\System\DGkrRxh.exe
  C:\Windows\System\DGkrRxh.exe
  2⤵
  PID:6556
- C:\Windows\System\GDEOXyb.exe
  C:\Windows\System\GDEOXyb.exe
  2⤵
  PID:6768
- C:\Windows\System\tlJKOJm.exe
  C:\Windows\System\tlJKOJm.exe
  2⤵
  PID:6812
- C:\Windows\System\pkbVpaq.exe
  C:\Windows\System\pkbVpaq.exe
  2⤵
  PID:6852
- C:\Windows\System\sjyMJYm.exe
  C:\Windows\System\sjyMJYm.exe
  2⤵
  PID:6920
- C:\Windows\System\yKzMcDK.exe
  C:\Windows\System\yKzMcDK.exe
  2⤵
  PID:6968
- C:\Windows\System\LxUdViU.exe
  C:\Windows\System\LxUdViU.exe
  2⤵
  PID:6948
- C:\Windows\System\LkleYbN.exe
  C:\Windows\System\LkleYbN.exe
  2⤵
  PID:6668
- C:\Windows\System\rdsXWhc.exe
  C:\Windows\System\rdsXWhc.exe
  2⤵
  PID:7088
- C:\Windows\System\MbUTYZr.exe
  C:\Windows\System\MbUTYZr.exe
  2⤵
  PID:6740
- C:\Windows\System\RlAQoCK.exe
  C:\Windows\System\RlAQoCK.exe
  2⤵
  PID:7032
- C:\Windows\System\ZMaZVer.exe
  C:\Windows\System\ZMaZVer.exe
  2⤵
  PID:6232
- C:\Windows\System\KKhWqXA.exe
  C:\Windows\System\KKhWqXA.exe
  2⤵
  PID:6788
- C:\Windows\System\zBqsDnx.exe
  C:\Windows\System\zBqsDnx.exe
  2⤵
  PID:6868
- C:\Windows\System\fpTHgxB.exe
  C:\Windows\System\fpTHgxB.exe
  2⤵
  PID:6248
- C:\Windows\System\atRYtKb.exe
  C:\Windows\System\atRYtKb.exe
  2⤵
  PID:6988
- C:\Windows\System\AXtdyNq.exe
  C:\Windows\System\AXtdyNq.exe
  2⤵
  PID:7068
- C:\Windows\System\beTJGmi.exe
  C:\Windows\System\beTJGmi.exe
  2⤵
  PID:7112
- C:\Windows\System\anNTHEI.exe
  C:\Windows\System\anNTHEI.exe
  2⤵
  PID:6160
- C:\Windows\System\VGYykdj.exe
  C:\Windows\System\VGYykdj.exe
  2⤵
  PID:2684
- C:\Windows\System\mevhbFa.exe
  C:\Windows\System\mevhbFa.exe
  2⤵
  PID:5432
- C:\Windows\System\Filbgmh.exe
  C:\Windows\System\Filbgmh.exe
  2⤵
  PID:5404
- C:\Windows\System\HmUAvUD.exe
  C:\Windows\System\HmUAvUD.exe
  2⤵
  PID:6540
- C:\Windows\System\mDxvkNJ.exe
  C:\Windows\System\mDxvkNJ.exe
  2⤵
  PID:6592
- C:\Windows\System\AneMNdz.exe
  C:\Windows\System\AneMNdz.exe
  2⤵
  PID:6888
- C:\Windows\System\qOiQwgE.exe
  C:\Windows\System\qOiQwgE.exe
  2⤵
  PID:7044
- C:\Windows\System\eiaTpro.exe
  C:\Windows\System\eiaTpro.exe
  2⤵
  PID:6444
- C:\Windows\System\tIXDkIS.exe
  C:\Windows\System\tIXDkIS.exe
  2⤵
  PID:6508
- C:\Windows\System\jjDVmLx.exe
  C:\Windows\System\jjDVmLx.exe
  2⤵
  PID:6696
- C:\Windows\System\xmMFTHN.exe
  C:\Windows\System\xmMFTHN.exe
  2⤵
  PID:6928
- C:\Windows\System\yTXMnQs.exe
  C:\Windows\System\yTXMnQs.exe
  2⤵
  PID:6960
- C:\Windows\System\XGXXDWf.exe
  C:\Windows\System\XGXXDWf.exe
  2⤵
  PID:6636
- C:\Windows\System\YClQzEB.exe
  C:\Windows\System\YClQzEB.exe
  2⤵
  PID:5456
- C:\Windows\System\LdFrXiT.exe
  C:\Windows\System\LdFrXiT.exe
  2⤵
  PID:3012
- C:\Windows\System\ppUwTeT.exe
  C:\Windows\System\ppUwTeT.exe
  2⤵
  PID:2540
- C:\Windows\System\YjGHtBT.exe
  C:\Windows\System\YjGHtBT.exe
  2⤵
  PID:6536
- C:\Windows\System\bkDpXud.exe
  C:\Windows\System\bkDpXud.exe
  2⤵
  PID:6884
- C:\Windows\System\sXgaovF.exe
  C:\Windows\System\sXgaovF.exe
  2⤵
  PID:6372
- C:\Windows\System\gADDLfh.exe
  C:\Windows\System\gADDLfh.exe
  2⤵
  PID:6576
- C:\Windows\System\cRkoUGi.exe
  C:\Windows\System\cRkoUGi.exe
  2⤵
  PID:6828
- C:\Windows\System\ZzShMug.exe
  C:\Windows\System\ZzShMug.exe
  2⤵
  PID:6432
- C:\Windows\System\sqZHmBZ.exe
  C:\Windows\System\sqZHmBZ.exe
  2⤵
  PID:6516
- C:\Windows\System\TYGRSaa.exe
  C:\Windows\System\TYGRSaa.exe
  2⤵
  PID:5756
- C:\Windows\System\EPTEumf.exe
  C:\Windows\System\EPTEumf.exe
  2⤵
  PID:7028
- C:\Windows\System\hUrDFnR.exe
  C:\Windows\System\hUrDFnR.exe
  2⤵
  PID:7152
- C:\Windows\System\GaHlsTv.exe
  C:\Windows\System\GaHlsTv.exe
  2⤵
  PID:6264
- C:\Windows\System\LuqHTab.exe
  C:\Windows\System\LuqHTab.exe
  2⤵
  PID:6864
- C:\Windows\System\SxUqoYc.exe
  C:\Windows\System\SxUqoYc.exe
  2⤵
  PID:6308
- C:\Windows\System\meXAhuJ.exe
  C:\Windows\System\meXAhuJ.exe
  2⤵
  PID:7176
- C:\Windows\System\VMYswSw.exe
  C:\Windows\System\VMYswSw.exe
  2⤵
  PID:7192
- C:\Windows\System\MTKkLRb.exe
  C:\Windows\System\MTKkLRb.exe
  2⤵
  PID:7212
- C:\Windows\System\DCYKhXc.exe
  C:\Windows\System\DCYKhXc.exe
  2⤵
  PID:7232
- C:\Windows\System\DyICgTY.exe
  C:\Windows\System\DyICgTY.exe
  2⤵
  PID:7256
- C:\Windows\System\ACODnBo.exe
  C:\Windows\System\ACODnBo.exe
  2⤵
  PID:7272
- C:\Windows\System\KfgqpbY.exe
  C:\Windows\System\KfgqpbY.exe
  2⤵
  PID:7288
- C:\Windows\System\RstYbvL.exe
  C:\Windows\System\RstYbvL.exe
  2⤵
  PID:7304
- C:\Windows\System\XxpJQyu.exe
  C:\Windows\System\XxpJQyu.exe
  2⤵
  PID:7324
- C:\Windows\System\qvbzsSY.exe
  C:\Windows\System\qvbzsSY.exe
  2⤵
  PID:7340
- C:\Windows\System\YJgowXn.exe
  C:\Windows\System\YJgowXn.exe
  2⤵
  PID:7356
- C:\Windows\System\xTPdwld.exe
  C:\Windows\System\xTPdwld.exe
  2⤵
  PID:7372
- C:\Windows\System\qHWppaL.exe
  C:\Windows\System\qHWppaL.exe
  2⤵
  PID:7392
- C:\Windows\System\KtcGTiR.exe
  C:\Windows\System\KtcGTiR.exe
  2⤵
  PID:7416
- C:\Windows\System\ZfCJyFu.exe
  C:\Windows\System\ZfCJyFu.exe
  2⤵
  PID:7436
- C:\Windows\System\ZbouVGx.exe
  C:\Windows\System\ZbouVGx.exe
  2⤵
  PID:7460
- C:\Windows\System\VSLUXCa.exe
  C:\Windows\System\VSLUXCa.exe
  2⤵
  PID:7476
- C:\Windows\System\mfZviyL.exe
  C:\Windows\System\mfZviyL.exe
  2⤵
  PID:7496
- C:\Windows\System\GhUxjfk.exe
  C:\Windows\System\GhUxjfk.exe
  2⤵
  PID:7512
- C:\Windows\System\irvlTpV.exe
  C:\Windows\System\irvlTpV.exe
  2⤵
  PID:7528
- C:\Windows\System\FGAFuZq.exe
  C:\Windows\System\FGAFuZq.exe
  2⤵
  PID:7544
- C:\Windows\System\yEmbYMS.exe
  C:\Windows\System\yEmbYMS.exe
  2⤵
  PID:7560
- C:\Windows\System\ivEoqwm.exe
  C:\Windows\System\ivEoqwm.exe
  2⤵
  PID:7584
- C:\Windows\System\eWLSHVW.exe
  C:\Windows\System\eWLSHVW.exe
  2⤵
  PID:7604
- C:\Windows\System\XZINAax.exe
  C:\Windows\System\XZINAax.exe
  2⤵
  PID:7624
- C:\Windows\System\sAswkDu.exe
  C:\Windows\System\sAswkDu.exe
  2⤵
  PID:7640
- C:\Windows\System\KAdDjoJ.exe
  C:\Windows\System\KAdDjoJ.exe
  2⤵
  PID:7656
- C:\Windows\System\rbkYaEm.exe
  C:\Windows\System\rbkYaEm.exe
  2⤵
  PID:7672
- C:\Windows\System\qlSanQi.exe
  C:\Windows\System\qlSanQi.exe
  2⤵
  PID:7688
- C:\Windows\System\NSwDWLs.exe
  C:\Windows\System\NSwDWLs.exe
  2⤵
  PID:7708
- C:\Windows\System\CbjPLTS.exe
  C:\Windows\System\CbjPLTS.exe
  2⤵
  PID:7728
- C:\Windows\System\rxNgOnk.exe
  C:\Windows\System\rxNgOnk.exe
  2⤵
  PID:7808
- C:\Windows\System\tyTgdNl.exe
  C:\Windows\System\tyTgdNl.exe
  2⤵
  PID:7824
- C:\Windows\System\sgtDAZw.exe
  C:\Windows\System\sgtDAZw.exe
  2⤵
  PID:7844
- C:\Windows\System\EkNtokK.exe
  C:\Windows\System\EkNtokK.exe
  2⤵
  PID:7860
- C:\Windows\System\JzwUkVU.exe
  C:\Windows\System\JzwUkVU.exe
  2⤵
  PID:7880
- C:\Windows\System\MByxYXe.exe
  C:\Windows\System\MByxYXe.exe
  2⤵
  PID:7896
- C:\Windows\System\MPyAeCH.exe
  C:\Windows\System\MPyAeCH.exe
  2⤵
  PID:7916
- C:\Windows\System\RkrERcq.exe
  C:\Windows\System\RkrERcq.exe
  2⤵
  PID:7932
- C:\Windows\System\KSgrHkV.exe
  C:\Windows\System\KSgrHkV.exe
  2⤵
  PID:7948
- C:\Windows\System\HtVbbNJ.exe
  C:\Windows\System\HtVbbNJ.exe
  2⤵
  PID:7968
- C:\Windows\System\KhmuqQt.exe
  C:\Windows\System\KhmuqQt.exe
  2⤵
  PID:7988
- C:\Windows\System\tslHsLo.exe
  C:\Windows\System\tslHsLo.exe
  2⤵
  PID:8004
- C:\Windows\System\XRyFUqF.exe
  C:\Windows\System\XRyFUqF.exe
  2⤵
  PID:8020
- C:\Windows\System\YUomePj.exe
  C:\Windows\System\YUomePj.exe
  2⤵
  PID:8036
- C:\Windows\System\VxRdTGg.exe
  C:\Windows\System\VxRdTGg.exe
  2⤵
  PID:8064
- C:\Windows\System\smWsIVf.exe
  C:\Windows\System\smWsIVf.exe
  2⤵
  PID:8088
- C:\Windows\System\HcxMENt.exe
  C:\Windows\System\HcxMENt.exe
  2⤵
  PID:8112
- C:\Windows\System\yGJIOKr.exe
  C:\Windows\System\yGJIOKr.exe
  2⤵
  PID:8128
- C:\Windows\System\TsFtuOr.exe
  C:\Windows\System\TsFtuOr.exe
  2⤵
  PID:8148
- C:\Windows\System\uubQaxL.exe
  C:\Windows\System\uubQaxL.exe
  2⤵
  PID:8168
- C:\Windows\System\mEjPuOU.exe
  C:\Windows\System\mEjPuOU.exe
  2⤵
  PID:7172
- C:\Windows\System\hNHuhJw.exe
  C:\Windows\System\hNHuhJw.exe
  2⤵
  PID:7252
- C:\Windows\System\oBDLKJG.exe
  C:\Windows\System\oBDLKJG.exe
  2⤵
  PID:7320
- C:\Windows\System\CFOkRtb.exe
  C:\Windows\System\CFOkRtb.exe
  2⤵
  PID:7384
- C:\Windows\System\XuuXRdE.exe
  C:\Windows\System\XuuXRdE.exe
  2⤵
  PID:7432
- C:\Windows\System\cFFnFuR.exe
  C:\Windows\System\cFFnFuR.exe
  2⤵
  PID:6940
- C:\Windows\System\JILHgce.exe
  C:\Windows\System\JILHgce.exe
  2⤵
  PID:7508
- C:\Windows\System\iyRBgiN.exe
  C:\Windows\System\iyRBgiN.exe
  2⤵
  PID:7620
- C:\Windows\System\WhJFPQs.exe
  C:\Windows\System\WhJFPQs.exe
  2⤵
  PID:6504
- C:\Windows\System\AhXUdkc.exe
  C:\Windows\System\AhXUdkc.exe
  2⤵
  PID:6744
- C:\Windows\System\Oocsaqe.exe
  C:\Windows\System\Oocsaqe.exe
  2⤵
  PID:7224
- C:\Windows\System\HUXWMWO.exe
  C:\Windows\System\HUXWMWO.exe
  2⤵
  PID:6192
- C:\Windows\System\eXeaHzh.exe
  C:\Windows\System\eXeaHzh.exe
  2⤵
  PID:6648
- C:\Windows\System\fpOaiLu.exe
  C:\Windows\System\fpOaiLu.exe
  2⤵
  PID:4760
- C:\Windows\System\uVZHypz.exe
  C:\Windows\System\uVZHypz.exe
  2⤵
  PID:7012
- C:\Windows\System\JQvYNNi.exe
  C:\Windows\System\JQvYNNi.exe
  2⤵
  PID:6984
- C:\Windows\System\wIVXfGz.exe
  C:\Windows\System\wIVXfGz.exe
  2⤵
  PID:6464
- C:\Windows\System\yONNGiv.exe
  C:\Windows\System\yONNGiv.exe
  2⤵
  PID:7552
- C:\Windows\System\XyUumiL.exe
  C:\Windows\System\XyUumiL.exe
  2⤵
  PID:7108
- C:\Windows\System\bgemXuH.exe
  C:\Windows\System\bgemXuH.exe
  2⤵
  PID:7700
- C:\Windows\System\krhekjR.exe
  C:\Windows\System\krhekjR.exe
  2⤵
  PID:7816
- C:\Windows\System\ABeZuFz.exe
  C:\Windows\System\ABeZuFz.exe
  2⤵
  PID:7760
- C:\Windows\System\bKAsYvT.exe
  C:\Windows\System\bKAsYvT.exe
  2⤵
  PID:7888
- C:\Windows\System\RlORCWv.exe
  C:\Windows\System\RlORCWv.exe
  2⤵
  PID:7452
- C:\Windows\System\DnyfoyB.exe
  C:\Windows\System\DnyfoyB.exe
  2⤵
  PID:7336
- C:\Windows\System\qWbUNVh.exe
  C:\Windows\System\qWbUNVh.exe
  2⤵
  PID:7268
- C:\Windows\System\INjnCrc.exe
  C:\Windows\System\INjnCrc.exe
  2⤵
  PID:7960
- C:\Windows\System\QDjIVfo.exe
  C:\Windows\System\QDjIVfo.exe
  2⤵
  PID:7996
- C:\Windows\System\ffwfZUL.exe
  C:\Windows\System\ffwfZUL.exe
  2⤵
  PID:7904
- C:\Windows\System\UiDCDRP.exe
  C:\Windows\System\UiDCDRP.exe
  2⤵
  PID:7796
- C:\Windows\System\lkQlqOT.exe
  C:\Windows\System\lkQlqOT.exe
  2⤵
  PID:7840
- C:\Windows\System\uyDQrnR.exe
  C:\Windows\System\uyDQrnR.exe
  2⤵
  PID:8160
- C:\Windows\System\QBDElYl.exe
  C:\Windows\System\QBDElYl.exe
  2⤵
  PID:8052
- C:\Windows\System\ELJdmmP.exe
  C:\Windows\System\ELJdmmP.exe
  2⤵
  PID:7940
- C:\Windows\System\SRxKufB.exe
  C:\Windows\System\SRxKufB.exe
  2⤵
  PID:8176
- C:\Windows\System\PabLQyJ.exe
  C:\Windows\System\PabLQyJ.exe
  2⤵
  PID:8084
- C:\Windows\System\grqaZxa.exe
  C:\Windows\System\grqaZxa.exe
  2⤵
  PID:7240
- C:\Windows\System\ExhcopO.exe
  C:\Windows\System\ExhcopO.exe
  2⤵
  PID:8188
- C:\Windows\System\ufXAEIR.exe
  C:\Windows\System\ufXAEIR.exe
  2⤵
  PID:6412
- C:\Windows\System\nsLHIbY.exe
  C:\Windows\System\nsLHIbY.exe
  2⤵
  PID:6652
- C:\Windows\System\oYRCPCv.exe
  C:\Windows\System\oYRCPCv.exe
  2⤵
  PID:6628
- C:\Windows\System\AxaVwMG.exe
  C:\Windows\System\AxaVwMG.exe
  2⤵
  PID:7612
- C:\Windows\System\aaoXLlq.exe
  C:\Windows\System\aaoXLlq.exe
  2⤵
  PID:7424
- C:\Windows\System\HeuEGxI.exe
  C:\Windows\System\HeuEGxI.exe
  2⤵
  PID:6848
- C:\Windows\System\lFRsotd.exe
  C:\Windows\System\lFRsotd.exe
  2⤵
  PID:7052
- C:\Windows\System\yNPsjfT.exe
  C:\Windows\System\yNPsjfT.exe
  2⤵
  PID:7752
- C:\Windows\System\DoNrCHo.exe
  C:\Windows\System\DoNrCHo.exe
  2⤵
  PID:7636
- C:\Windows\System\ZhWIDNT.exe
  C:\Windows\System\ZhWIDNT.exe
  2⤵
  PID:7744
- C:\Windows\System\TSLDpWa.exe
  C:\Windows\System\TSLDpWa.exe
  2⤵
  PID:7652
- C:\Windows\System\tedPIYk.exe
  C:\Windows\System\tedPIYk.exe
  2⤵
  PID:7784
- C:\Windows\System\TPFZGlY.exe
  C:\Windows\System\TPFZGlY.exe
  2⤵
  PID:7332
- C:\Windows\System\UosycLu.exe
  C:\Windows\System\UosycLu.exe
  2⤵
  PID:7448
- C:\Windows\System\ZdMLJFt.exe
  C:\Windows\System\ZdMLJFt.exe
  2⤵
  PID:7668
- C:\Windows\System\SjIfIyC.exe
  C:\Windows\System\SjIfIyC.exe
  2⤵
  PID:7600
- C:\Windows\System\TllmIra.exe
  C:\Windows\System\TllmIra.exe
  2⤵
  PID:7492
- C:\Windows\System\QFawaoA.exe
  C:\Windows\System\QFawaoA.exe
  2⤵
  PID:7780
- C:\Windows\System\YtMoEzt.exe
  C:\Windows\System\YtMoEzt.exe
  2⤵
  PID:7868
- C:\Windows\System\TKpjOyS.exe
  C:\Windows\System\TKpjOyS.exe
  2⤵
  PID:7188
- C:\Windows\System\dTOBJOk.exe
  C:\Windows\System\dTOBJOk.exe
  2⤵
  PID:8028
- C:\Windows\System\pSFSlxs.exe
  C:\Windows\System\pSFSlxs.exe
  2⤵
  PID:8044
- C:\Windows\System\jxTRbmj.exe
  C:\Windows\System\jxTRbmj.exe
  2⤵
  PID:7204
- C:\Windows\System\tWGbDxh.exe
  C:\Windows\System\tWGbDxh.exe
  2⤵
  PID:7872
- C:\Windows\System\dEpNtdA.exe
  C:\Windows\System\dEpNtdA.exe
  2⤵
  PID:7976
- C:\Windows\System\PqYiiJS.exe
  C:\Windows\System\PqYiiJS.exe
  2⤵
  PID:7756
- C:\Windows\System\iqplCGL.exe
  C:\Windows\System\iqplCGL.exe
  2⤵
  PID:7484
- C:\Windows\System\BvBlkww.exe
  C:\Windows\System\BvBlkww.exe
  2⤵
  PID:7444
- C:\Windows\System\oibElpv.exe
  C:\Windows\System\oibElpv.exe
  2⤵
  PID:7400
- C:\Windows\System\SbNsmnv.exe
  C:\Windows\System\SbNsmnv.exe
  2⤵
  PID:7772
- C:\Windows\System\eUGxwdO.exe
  C:\Windows\System\eUGxwdO.exe
  2⤵
  PID:8124
- C:\Windows\System\jPpWYfl.exe
  C:\Windows\System\jPpWYfl.exe
  2⤵
  PID:2948
- C:\Windows\System\ooYDeLQ.exe
  C:\Windows\System\ooYDeLQ.exe
  2⤵
  PID:8136
- C:\Windows\System\VPqZQtv.exe
  C:\Windows\System\VPqZQtv.exe
  2⤵
  PID:8080
- C:\Windows\System\RwFwIWZ.exe
  C:\Windows\System\RwFwIWZ.exe
  2⤵
  PID:8104
- C:\Windows\System\VIjsWcE.exe
  C:\Windows\System\VIjsWcE.exe
  2⤵
  PID:7472
- C:\Windows\System\eueYCXM.exe
  C:\Windows\System\eueYCXM.exe
  2⤵
  PID:7596
- C:\Windows\System\hcXbtWD.exe
  C:\Windows\System\hcXbtWD.exe
  2⤵
  PID:7616
- C:\Windows\System\WAxbRgV.exe
  C:\Windows\System\WAxbRgV.exe
  2⤵
  PID:6908
- C:\Windows\System\kQGUoqN.exe
  C:\Windows\System\kQGUoqN.exe
  2⤵
  PID:7632
- C:\Windows\System\cYZJAPw.exe
  C:\Windows\System\cYZJAPw.exe
  2⤵
  PID:6596
- C:\Windows\System\XVUuNzZ.exe
  C:\Windows\System\XVUuNzZ.exe
  2⤵
  PID:7928
- C:\Windows\System\jXuiiYk.exe
  C:\Windows\System\jXuiiYk.exe
  2⤵
  PID:7956
- C:\Windows\System\kUtrNlL.exe
  C:\Windows\System\kUtrNlL.exe
  2⤵
  PID:7720
- C:\Windows\System\emcRCpO.exe
  C:\Windows\System\emcRCpO.exe
  2⤵
  PID:8140
- C:\Windows\System\NaTueFA.exe
  C:\Windows\System\NaTueFA.exe
  2⤵
  PID:8012
- C:\Windows\System\kputaxH.exe
  C:\Windows\System\kputaxH.exe
  2⤵
  PID:6844
- C:\Windows\System\NxIVZNA.exe
  C:\Windows\System\NxIVZNA.exe
  2⤵
  PID:7296
- C:\Windows\System\GnBUgAD.exe
  C:\Windows\System\GnBUgAD.exe
  2⤵
  PID:8156
- C:\Windows\System\OYlmLyu.exe
  C:\Windows\System\OYlmLyu.exe
  2⤵
  PID:8076
- C:\Windows\System\nhbQEHx.exe
  C:\Windows\System\nhbQEHx.exe
  2⤵
  PID:8180
- C:\Windows\System\PYfWBIo.exe
  C:\Windows\System\PYfWBIo.exe
  2⤵
  PID:6488
- C:\Windows\System\KZfUjaP.exe
  C:\Windows\System\KZfUjaP.exe
  2⤵
  PID:8208
- C:\Windows\System\ecfGkFn.exe
  C:\Windows\System\ecfGkFn.exe
  2⤵
  PID:8224
- C:\Windows\System\VaKdzns.exe
  C:\Windows\System\VaKdzns.exe
  2⤵
  PID:8240
- C:\Windows\System\uKlMFei.exe
  C:\Windows\System\uKlMFei.exe
  2⤵
  PID:8256
- C:\Windows\System\aTbnVNh.exe
  C:\Windows\System\aTbnVNh.exe
  2⤵
  PID:8272
- C:\Windows\System\TpcDJAd.exe
  C:\Windows\System\TpcDJAd.exe
  2⤵
  PID:8288
- C:\Windows\System\ZMNaISC.exe
  C:\Windows\System\ZMNaISC.exe
  2⤵
  PID:8304
- C:\Windows\System\BmQYzny.exe
  C:\Windows\System\BmQYzny.exe
  2⤵
  PID:8320
- C:\Windows\System\ieWGWLo.exe
  C:\Windows\System\ieWGWLo.exe
  2⤵
  PID:8340
- C:\Windows\System\mLtIhwZ.exe
  C:\Windows\System\mLtIhwZ.exe
  2⤵
  PID:8356
- C:\Windows\System\bUakFSt.exe
  C:\Windows\System\bUakFSt.exe
  2⤵
  PID:8372
- C:\Windows\System\pUTbyBh.exe
  C:\Windows\System\pUTbyBh.exe
  2⤵
  PID:8396
- C:\Windows\System\PrBrUNy.exe
  C:\Windows\System\PrBrUNy.exe
  2⤵
  PID:8412
- C:\Windows\System\Mfyzroa.exe
  C:\Windows\System\Mfyzroa.exe
  2⤵
  PID:8428
- C:\Windows\System\CqZrYIV.exe
  C:\Windows\System\CqZrYIV.exe
  2⤵
  PID:8444
- C:\Windows\System\UTliFcH.exe
  C:\Windows\System\UTliFcH.exe
  2⤵
  PID:8460
- C:\Windows\System\ARYLSoz.exe
  C:\Windows\System\ARYLSoz.exe
  2⤵
  PID:8476
- C:\Windows\System\CDENdzv.exe
  C:\Windows\System\CDENdzv.exe
  2⤵
  PID:8492
- C:\Windows\System\PIDhRhF.exe
  C:\Windows\System\PIDhRhF.exe
  2⤵
  PID:8508
- C:\Windows\System\gADYaHU.exe
  C:\Windows\System\gADYaHU.exe
  2⤵
  PID:8524
- C:\Windows\System\YNUyBtB.exe
  C:\Windows\System\YNUyBtB.exe
  2⤵
  PID:8540
- C:\Windows\System\nahkMID.exe
  C:\Windows\System\nahkMID.exe
  2⤵
  PID:8556
- C:\Windows\System\ALWuNqG.exe
  C:\Windows\System\ALWuNqG.exe
  2⤵
  PID:8572
- C:\Windows\System\MMixxgW.exe
  C:\Windows\System\MMixxgW.exe
  2⤵
  PID:8588
- C:\Windows\System\zvRPksg.exe
  C:\Windows\System\zvRPksg.exe
  2⤵
  PID:8604
- C:\Windows\System\GZhKGdv.exe
  C:\Windows\System\GZhKGdv.exe
  2⤵
  PID:8620
- C:\Windows\System\ZnyNEAw.exe
  C:\Windows\System\ZnyNEAw.exe
  2⤵
  PID:8724
- C:\Windows\System\lMtQelK.exe
  C:\Windows\System\lMtQelK.exe
  2⤵
  PID:8744
- C:\Windows\System\zLrlqCl.exe
  C:\Windows\System\zLrlqCl.exe
  2⤵
  PID:8768
- C:\Windows\System\jWnmqrj.exe
  C:\Windows\System\jWnmqrj.exe
  2⤵
  PID:8796
- C:\Windows\System\DVlLoEO.exe
  C:\Windows\System\DVlLoEO.exe
  2⤵
  PID:8812
- C:\Windows\System\DbBRmlG.exe
  C:\Windows\System\DbBRmlG.exe
  2⤵
  PID:8828
- C:\Windows\System\sIZahjC.exe
  C:\Windows\System\sIZahjC.exe
  2⤵
  PID:8844
- C:\Windows\System\EYTMmMV.exe
  C:\Windows\System\EYTMmMV.exe
  2⤵
  PID:8864
- C:\Windows\System\TOPrscf.exe
  C:\Windows\System\TOPrscf.exe
  2⤵
  PID:8884
- C:\Windows\System\rFQIGSS.exe
  C:\Windows\System\rFQIGSS.exe
  2⤵
  PID:8908
- C:\Windows\System\dOHjtsG.exe
  C:\Windows\System\dOHjtsG.exe
  2⤵
  PID:8924
- C:\Windows\System\oBZkdLQ.exe
  C:\Windows\System\oBZkdLQ.exe
  2⤵
  PID:8944
- C:\Windows\System\fOFaXuv.exe
  C:\Windows\System\fOFaXuv.exe
  2⤵
  PID:8968
- C:\Windows\System\LyHjTPp.exe
  C:\Windows\System\LyHjTPp.exe
  2⤵
  PID:8988
- C:\Windows\System\sDYWuCv.exe
  C:\Windows\System\sDYWuCv.exe
  2⤵
  PID:9004
- C:\Windows\System\QCKuspz.exe
  C:\Windows\System\QCKuspz.exe
  2⤵
  PID:9024
- C:\Windows\System\NdjJhYH.exe
  C:\Windows\System\NdjJhYH.exe
  2⤵
  PID:9040
- C:\Windows\System\ywmCBXg.exe
  C:\Windows\System\ywmCBXg.exe
  2⤵
  PID:9056
- C:\Windows\System\axMcEqT.exe
  C:\Windows\System\axMcEqT.exe
  2⤵
  PID:9072
- C:\Windows\System\UUQVCQF.exe
  C:\Windows\System\UUQVCQF.exe
  2⤵
  PID:9128
- C:\Windows\System\GlJaKsQ.exe
  C:\Windows\System\GlJaKsQ.exe
  2⤵
  PID:9148
- C:\Windows\System\ltuOzAd.exe
  C:\Windows\System\ltuOzAd.exe
  2⤵
  PID:9172
- C:\Windows\System\GcZscNB.exe
  C:\Windows\System\GcZscNB.exe
  2⤵
  PID:9188
- C:\Windows\System\yivnidV.exe
  C:\Windows\System\yivnidV.exe
  2⤵
  PID:9204
- C:\Windows\System\mxJgAnB.exe
  C:\Windows\System\mxJgAnB.exe
  2⤵
  PID:8200
- C:\Windows\System\piXeVzg.exe
  C:\Windows\System\piXeVzg.exe
  2⤵
  PID:8216
- C:\Windows\System\cgkFPdl.exe
  C:\Windows\System\cgkFPdl.exe
  2⤵
  PID:8300
- C:\Windows\System\BJTwInH.exe
  C:\Windows\System\BJTwInH.exe
  2⤵
  PID:8296
- C:\Windows\System\RYynAai.exe
  C:\Windows\System\RYynAai.exe
  2⤵
  PID:8144
- C:\Windows\System\YbREkfB.exe
  C:\Windows\System\YbREkfB.exe
  2⤵
  PID:8364
- C:\Windows\System\RCoBtyb.exe
  C:\Windows\System\RCoBtyb.exe
  2⤵
  PID:8348
- C:\Windows\System\KajHVjp.exe
  C:\Windows\System\KajHVjp.exe
  2⤵
  PID:8388
- C:\Windows\System\grEZztT.exe
  C:\Windows\System\grEZztT.exe
  2⤵
  PID:7568
- C:\Windows\System\WQfOTGs.exe
  C:\Windows\System\WQfOTGs.exe
  2⤵
  PID:8520
- C:\Windows\System\PSELRFh.exe
  C:\Windows\System\PSELRFh.exe
  2⤵
  PID:8580
- C:\Windows\System\frhgyAp.exe
  C:\Windows\System\frhgyAp.exe
  2⤵
  PID:8600
- C:\Windows\System\VRcEBQj.exe
  C:\Windows\System\VRcEBQj.exe
  2⤵
  PID:8628
- C:\Windows\System\bnDSZDZ.exe
  C:\Windows\System\bnDSZDZ.exe
  2⤵
  PID:8636
- C:\Windows\System\QkgdmaA.exe
  C:\Windows\System\QkgdmaA.exe
  2⤵
  PID:8660
- C:\Windows\System\ibDPXDn.exe
  C:\Windows\System\ibDPXDn.exe
  2⤵
  PID:8672
- C:\Windows\System\vpQIXwg.exe
  C:\Windows\System\vpQIXwg.exe
  2⤵
  PID:8696
- C:\Windows\System\cVDDBMo.exe
  C:\Windows\System\cVDDBMo.exe
  2⤵
  PID:8716
- C:\Windows\System\BgZjJQs.exe
  C:\Windows\System\BgZjJQs.exe
  2⤵
  PID:8756
- C:\Windows\System\YFPzorV.exe
  C:\Windows\System\YFPzorV.exe
  2⤵
  PID:8824
- C:\Windows\System\kknyyMV.exe
  C:\Windows\System\kknyyMV.exe
  2⤵
  PID:8788
- C:\Windows\System\YTANPfR.exe
  C:\Windows\System\YTANPfR.exe
  2⤵
  PID:8900
- C:\Windows\System\inneRpN.exe
  C:\Windows\System\inneRpN.exe
  2⤵
  PID:8940
- C:\Windows\System\PNKTHdi.exe
  C:\Windows\System\PNKTHdi.exe
  2⤵
  PID:9020
- C:\Windows\System\KtfpgBs.exe
  C:\Windows\System\KtfpgBs.exe
  2⤵
  PID:9080
- C:\Windows\System\THfLWPU.exe
  C:\Windows\System\THfLWPU.exe
  2⤵
  PID:8840
- C:\Windows\System\hdvswWr.exe
  C:\Windows\System\hdvswWr.exe
  2⤵
  PID:8920
- C:\Windows\System\FCLkxKn.exe
  C:\Windows\System\FCLkxKn.exe
  2⤵
  PID:8964
- C:\Windows\System\KmZWlmB.exe
  C:\Windows\System\KmZWlmB.exe
  2⤵
  PID:9064
- C:\Windows\System\mKYOKfI.exe
  C:\Windows\System\mKYOKfI.exe
  2⤵
  PID:9120
- C:\Windows\System\CNafktM.exe
  C:\Windows\System\CNafktM.exe
  2⤵
  PID:9100
- C:\Windows\System\Ehpkgkr.exe
  C:\Windows\System\Ehpkgkr.exe
  2⤵
  PID:9180
- C:\Windows\System\yzZDLWw.exe
  C:\Windows\System\yzZDLWw.exe
  2⤵
  PID:9212
- C:\Windows\System\BStxIVI.exe
  C:\Windows\System\BStxIVI.exe
  2⤵
  PID:8316
- C:\Windows\System\EwDQTHj.exe
  C:\Windows\System\EwDQTHj.exe
  2⤵
  PID:7696
- C:\Windows\System\JHAxEYb.exe
  C:\Windows\System\JHAxEYb.exe
  2⤵
  PID:7776
- C:\Windows\System\KpfjeRy.exe
  C:\Windows\System\KpfjeRy.exe
  2⤵
  PID:8328
- C:\Windows\System\loPplZS.exe
  C:\Windows\System\loPplZS.exe
  2⤵
  PID:8420
- C:\Windows\System\OPeZsur.exe
  C:\Windows\System\OPeZsur.exe
  2⤵
  PID:8456
- C:\Windows\System\mEVNNjW.exe
  C:\Windows\System\mEVNNjW.exe
  2⤵
  PID:8584
- C:\Windows\System\xIknORD.exe
  C:\Windows\System\xIknORD.exe
  2⤵
  PID:8632
- C:\Windows\System\gxPFPBd.exe
  C:\Windows\System\gxPFPBd.exe
  2⤵
  PID:8708
- C:\Windows\System\FGcbwVx.exe
  C:\Windows\System\FGcbwVx.exe
  2⤵
  PID:8764
- C:\Windows\System\anOUwwl.exe
  C:\Windows\System\anOUwwl.exe
  2⤵
  PID:8692
- C:\Windows\System\UgBoxIR.exe
  C:\Windows\System\UgBoxIR.exe
  2⤵
  PID:1564
- C:\Windows\System\mIAnqvr.exe
  C:\Windows\System\mIAnqvr.exe
  2⤵
  PID:9016
- C:\Windows\System\lKJgDzz.exe
  C:\Windows\System\lKJgDzz.exe
  2⤵
  PID:8956
- C:\Windows\System\BoIXrog.exe
  C:\Windows\System\BoIXrog.exe
  2⤵
  PID:9092
- C:\Windows\System\DPAeLkv.exe
  C:\Windows\System\DPAeLkv.exe
  2⤵
  PID:8312
- C:\Windows\System\dpzZfpS.exe
  C:\Windows\System\dpzZfpS.exe
  2⤵
  PID:8936
- C:\Windows\System\rtEdYnK.exe
  C:\Windows\System\rtEdYnK.exe
  2⤵
  PID:9104
- C:\Windows\System\lVwiyTR.exe
  C:\Windows\System\lVwiyTR.exe
  2⤵
  PID:8880
- C:\Windows\System\ofkODqw.exe
  C:\Windows\System\ofkODqw.exe
  2⤵
  PID:9164
- C:\Windows\System\gUjTNZr.exe
  C:\Windows\System\gUjTNZr.exe
  2⤵
  PID:7468
- C:\Windows\System\MfbVqpe.exe
  C:\Windows\System\MfbVqpe.exe
  2⤵
  PID:8236
- C:\Windows\System\oEfnCiE.exe
  C:\Windows\System\oEfnCiE.exe
  2⤵
  PID:8704
- C:\Windows\System\PtddQbD.exe
  C:\Windows\System\PtddQbD.exe
  2⤵
  PID:8892
- C:\Windows\System\eFEDkPa.exe
  C:\Windows\System\eFEDkPa.exe
  2⤵
  PID:8688
- C:\Windows\System\lEXJPUj.exe
  C:\Windows\System\lEXJPUj.exe
  2⤵
  PID:8760
- C:\Windows\System\vsnrzZy.exe
  C:\Windows\System\vsnrzZy.exe
  2⤵
  PID:8980
- C:\Windows\System\OIQPbdw.exe
  C:\Windows\System\OIQPbdw.exe
  2⤵
  PID:9088
- C:\Windows\System\mfzDgrA.exe
  C:\Windows\System\mfzDgrA.exe
  2⤵
  PID:9144
- C:\Windows\System\GZRZZhp.exe
  C:\Windows\System\GZRZZhp.exe
  2⤵
  PID:8784
- C:\Windows\System\AROhTxM.exe
  C:\Windows\System\AROhTxM.exe
  2⤵
  PID:9108
- C:\Windows\System\mSWaOPT.exe
  C:\Windows\System\mSWaOPT.exe
  2⤵
  PID:9156
- C:\Windows\System\DAuFsRy.exe
  C:\Windows\System\DAuFsRy.exe
  2⤵
  PID:8516
- C:\Windows\System\fKOYaHA.exe
  C:\Windows\System\fKOYaHA.exe
  2⤵
  PID:9168
- C:\Windows\System\zOjjwAw.exe
  C:\Windows\System\zOjjwAw.exe
  2⤵
  PID:8612
- C:\Windows\System\grxTTAN.exe
  C:\Windows\System\grxTTAN.exe
  2⤵
  PID:8732
- C:\Windows\System\KzbjORv.exe
  C:\Windows\System\KzbjORv.exe
  2⤵
  PID:8248
- C:\Windows\System\FhKKOkY.exe
  C:\Windows\System\FhKKOkY.exe
  2⤵
  PID:9032
- C:\Windows\System\FgGkYps.exe
  C:\Windows\System\FgGkYps.exe
  2⤵
  PID:8408
- C:\Windows\System\IAXJamf.exe
  C:\Windows\System\IAXJamf.exe
  2⤵
  PID:8488
- C:\Windows\System\QznkXdP.exe
  C:\Windows\System\QznkXdP.exe
  2⤵
  PID:9140
- C:\Windows\System\CKHQxpL.exe
  C:\Windows\System\CKHQxpL.exe
  2⤵
  PID:8644
- C:\Windows\System\NVuKvIK.exe
  C:\Windows\System\NVuKvIK.exe
  2⤵
  PID:8268
- C:\Windows\System\dmoqZgm.exe
  C:\Windows\System\dmoqZgm.exe
  2⤵
  PID:8232
- C:\Windows\System\VoRJJdP.exe
  C:\Windows\System\VoRJJdP.exe
  2⤵
  PID:9124
- C:\Windows\System\WzvzjNB.exe
  C:\Windows\System\WzvzjNB.exe
  2⤵
  PID:8916
- C:\Windows\System\gglGywg.exe
  C:\Windows\System\gglGywg.exe
  2⤵
  PID:9084
- C:\Windows\System\aITHZXE.exe
  C:\Windows\System\aITHZXE.exe
  2⤵
  PID:9232
- C:\Windows\System\bobibDG.exe
  C:\Windows\System\bobibDG.exe
  2⤵
  PID:9248
- C:\Windows\System\muiNYGY.exe
  C:\Windows\System\muiNYGY.exe
  2⤵
  PID:9268
- C:\Windows\System\BgegaEz.exe
  C:\Windows\System\BgegaEz.exe
  2⤵
  PID:9288
- C:\Windows\System\FrQJpZs.exe
  C:\Windows\System\FrQJpZs.exe
  2⤵
  PID:9304
- C:\Windows\System\GVihAbq.exe
  C:\Windows\System\GVihAbq.exe
  2⤵
  PID:9324
- C:\Windows\System\fTOLlJJ.exe
  C:\Windows\System\fTOLlJJ.exe
  2⤵
  PID:9364
- C:\Windows\System\HtKhFGI.exe
  C:\Windows\System\HtKhFGI.exe
  2⤵
  PID:9380
- C:\Windows\System\FteIMKt.exe
  C:\Windows\System\FteIMKt.exe
  2⤵
  PID:9396
- C:\Windows\System\oKPEArF.exe
  C:\Windows\System\oKPEArF.exe
  2⤵
  PID:9412
- C:\Windows\System\uFnvtme.exe
  C:\Windows\System\uFnvtme.exe
  2⤵
  PID:9428
- C:\Windows\System\vQxSESM.exe
  C:\Windows\System\vQxSESM.exe
  2⤵
  PID:9448
- C:\Windows\System\xkHoTzt.exe
  C:\Windows\System\xkHoTzt.exe
  2⤵
  PID:9464
- C:\Windows\System\PfxYXXD.exe
  C:\Windows\System\PfxYXXD.exe
  2⤵
  PID:9480
- C:\Windows\System\lkkZkQM.exe
  C:\Windows\System\lkkZkQM.exe
  2⤵
  PID:9500
- C:\Windows\System\TthmDJF.exe
  C:\Windows\System\TthmDJF.exe
  2⤵
  PID:9520
- C:\Windows\System\gGtdAJq.exe
  C:\Windows\System\gGtdAJq.exe
  2⤵
  PID:9564
- C:\Windows\System\zkorgoE.exe
  C:\Windows\System\zkorgoE.exe
  2⤵
  PID:9580
- C:\Windows\System\uFhEWJH.exe
  C:\Windows\System\uFhEWJH.exe
  2⤵
  PID:9596
- C:\Windows\System\gLwqZax.exe
  C:\Windows\System\gLwqZax.exe
  2⤵
  PID:9612
- C:\Windows\System\nwYGrFM.exe
  C:\Windows\System\nwYGrFM.exe
  2⤵
  PID:9628
- C:\Windows\System\clLveZT.exe
  C:\Windows\System\clLveZT.exe
  2⤵
  PID:9652
- C:\Windows\System\VGwICdx.exe
  C:\Windows\System\VGwICdx.exe
  2⤵
  PID:9668
- C:\Windows\System\ctzzcht.exe
  C:\Windows\System\ctzzcht.exe
  2⤵
  PID:9692
- C:\Windows\System\ZmsBqfc.exe
  C:\Windows\System\ZmsBqfc.exe
  2⤵
  PID:9716
- C:\Windows\System\ElBjifU.exe
  C:\Windows\System\ElBjifU.exe
  2⤵
  PID:9740
- C:\Windows\System\BXhoDru.exe
  C:\Windows\System\BXhoDru.exe
  2⤵
  PID:9760
- C:\Windows\System\WbSDoHe.exe
  C:\Windows\System\WbSDoHe.exe
  2⤵
  PID:9780
- C:\Windows\System\jAkMZQU.exe
  C:\Windows\System\jAkMZQU.exe
  2⤵
  PID:9796
- C:\Windows\System\bEOLCBd.exe
  C:\Windows\System\bEOLCBd.exe
  2⤵
  PID:9812
- C:\Windows\System\lSOzzAz.exe
  C:\Windows\System\lSOzzAz.exe
  2⤵
  PID:9832
- C:\Windows\System\YyEGgPs.exe
  C:\Windows\System\YyEGgPs.exe
  2⤵
  PID:9848
- C:\Windows\System\HIihROy.exe
  C:\Windows\System\HIihROy.exe
  2⤵
  PID:9868
- C:\Windows\System\MXbTuqB.exe
  C:\Windows\System\MXbTuqB.exe
  2⤵
  PID:9884
- C:\Windows\System\zaZJARW.exe
  C:\Windows\System\zaZJARW.exe
  2⤵
  PID:9904
- C:\Windows\System\OPoxFRZ.exe
  C:\Windows\System\OPoxFRZ.exe
  2⤵
  PID:9924
- C:\Windows\System\OSuwYtW.exe
  C:\Windows\System\OSuwYtW.exe
  2⤵
  PID:9940
- C:\Windows\System\KGrDwbK.exe
  C:\Windows\System\KGrDwbK.exe
  2⤵
  PID:9960
- C:\Windows\System\RXyEjNk.exe
  C:\Windows\System\RXyEjNk.exe
  2⤵
  PID:9976
- C:\Windows\System\DHimcyH.exe
  C:\Windows\System\DHimcyH.exe
  2⤵
  PID:9996
- C:\Windows\System\zhzqSpe.exe
  C:\Windows\System\zhzqSpe.exe
  2⤵
  PID:10012
- C:\Windows\System\JlDcpWX.exe
  C:\Windows\System\JlDcpWX.exe
  2⤵
  PID:10044
- C:\Windows\System\HMxUpbp.exe
  C:\Windows\System\HMxUpbp.exe
  2⤵
  PID:10072
- C:\Windows\System\HcPJlUF.exe
  C:\Windows\System\HcPJlUF.exe
  2⤵
  PID:10108
- C:\Windows\System\ARGCRKA.exe
  C:\Windows\System\ARGCRKA.exe
  2⤵
  PID:10124
- C:\Windows\System\FjQvlev.exe
  C:\Windows\System\FjQvlev.exe
  2⤵
  PID:10140
- C:\Windows\System\iRLXoSU.exe
  C:\Windows\System\iRLXoSU.exe
  2⤵
  PID:10156
- C:\Windows\System\BaPWwnE.exe
  C:\Windows\System\BaPWwnE.exe
  2⤵
  PID:10176
- C:\Windows\System\vSJgOJd.exe
  C:\Windows\System\vSJgOJd.exe
  2⤵
  PID:10192
- C:\Windows\System\ceZVwZK.exe
  C:\Windows\System\ceZVwZK.exe
  2⤵
  PID:10212
- C:\Windows\System\sJXJsAY.exe
  C:\Windows\System\sJXJsAY.exe
  2⤵
  PID:10228
- C:\Windows\System\axsCvvz.exe
  C:\Windows\System\axsCvvz.exe
  2⤵
  PID:8204
- C:\Windows\System\CwcOmpO.exe
  C:\Windows\System\CwcOmpO.exe
  2⤵
  PID:9284
- C:\Windows\System\uuchhbX.exe
  C:\Windows\System\uuchhbX.exe
  2⤵
  PID:9264
- C:\Windows\System\YQUwqQc.exe
  C:\Windows\System\YQUwqQc.exe
  2⤵
  PID:9224
- C:\Windows\System\mrFLrmg.exe
  C:\Windows\System\mrFLrmg.exe
  2⤵
  PID:9348
- C:\Windows\System\MNTqSta.exe
  C:\Windows\System\MNTqSta.exe
  2⤵
  PID:9376
- C:\Windows\System\lxZGtyB.exe
  C:\Windows\System\lxZGtyB.exe
  2⤵
  PID:9424
- C:\Windows\System\XkdTiBn.exe
  C:\Windows\System\XkdTiBn.exe
  2⤵
  PID:9436
- C:\Windows\System\SjtuOxv.exe
  C:\Windows\System\SjtuOxv.exe
  2⤵
  PID:9492
- C:\Windows\System\TtqfOIK.exe
  C:\Windows\System\TtqfOIK.exe
  2⤵
  PID:9472
- C:\Windows\System\hmXuVjq.exe
  C:\Windows\System\hmXuVjq.exe
  2⤵
  PID:9548
- C:\Windows\System\MOWaqJp.exe
  C:\Windows\System\MOWaqJp.exe
  2⤵
  PID:9576
- C:\Windows\System\UKLYdEf.exe
  C:\Windows\System\UKLYdEf.exe
  2⤵
  PID:9608
- C:\Windows\System\EGEWese.exe
  C:\Windows\System\EGEWese.exe
  2⤵
  PID:9684
- C:\Windows\System\lGoyINe.exe
  C:\Windows\System\lGoyINe.exe
  2⤵
  PID:9664
- C:\Windows\System\pWGrcIt.exe
  C:\Windows\System\pWGrcIt.exe
  2⤵
  PID:9724
- C:\Windows\System\bLWSOOh.exe
  C:\Windows\System\bLWSOOh.exe
  2⤵
  PID:9804
- C:\Windows\System\JKwjImJ.exe
  C:\Windows\System\JKwjImJ.exe
  2⤵
  PID:9880
- C:\Windows\System\NFXYVHA.exe
  C:\Windows\System\NFXYVHA.exe
  2⤵
  PID:9952
- C:\Windows\System\frexkGh.exe
  C:\Windows\System\frexkGh.exe
  2⤵
  PID:10020
- C:\Windows\System\Mvhyjyj.exe
  C:\Windows\System\Mvhyjyj.exe
  2⤵
  PID:9788
- C:\Windows\System\UVRjCom.exe
  C:\Windows\System\UVRjCom.exe
  2⤵
  PID:9756
- C:\Windows\System\FcJFokm.exe
  C:\Windows\System\FcJFokm.exe
  2⤵
  PID:9860
- C:\Windows\System\IuXWZmG.exe
  C:\Windows\System\IuXWZmG.exe
  2⤵
  PID:9936
- C:\Windows\System\YyTYucb.exe
  C:\Windows\System\YyTYucb.exe
  2⤵
  PID:10036
- C:\Windows\System\WTlJsLC.exe
  C:\Windows\System\WTlJsLC.exe
  2⤵
  PID:10064
- C:\Windows\System\uixFkpE.exe
  C:\Windows\System\uixFkpE.exe
  2⤵
  PID:10092
- C:\Windows\System\zyMztYG.exe
  C:\Windows\System\zyMztYG.exe
  2⤵
  PID:10132
- C:\Windows\System\hDACiGo.exe
  C:\Windows\System\hDACiGo.exe
  2⤵
  PID:10200
- C:\Windows\System\WwuwvyI.exe
  C:\Windows\System\WwuwvyI.exe
  2⤵
  PID:10236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AXcKbut.exe

Filesize
2.9MB

MD5
3787c48cb4530000e59f4b4e2aa3a899

SHA1
851bd72da37063546e535f05c5990ffa14b3bf07

SHA256
c79d9715653b48f7514606bf08fe1f10821cb99ff91331203d5b31236cab6011

SHA512
b90651ed20066146f3107251696c39d1c4a96e941ec68c903153444d18bb155e46c05785e40edc8b08ace12f15d302ba8f71407591eae0e6a0143ec3d890acbf

Download Submit
C:\Windows\system\ArOKMgR.exe

Filesize
2.9MB

MD5
f4c40e0a3e13dd91530d3664058c588b

SHA1
f29cfbf2e031e2ebe4f72be7f8054093b840fe07

SHA256
c9768e81d0797a7d1f2e0c949d152de724a1ce26e3c96745a70e4c33d16604b5

SHA512
b1e3aa5e2a5e83b5c06c33a9cd1509521b7b3adeb25a3b3eeeb4aa59f9b1fe32af6fb4a5ae72a942ed6f52603400e3d4db87c2d2b975ece68fe847e49ebf35a5

Download Submit
C:\Windows\system\BDAbRMc.exe

Filesize
2.9MB

MD5
63c850e0c80fad2d9f5d7a8f684cc770

SHA1
a67fab7c148683d699604efcaf535ce962f82a53

SHA256
ba44fc124ac5bc591a616fb82fedfb9ebdc9043acd259965892cbb575ff801f0

SHA512
c0ae1be08378ee21314a82dbab42d8a6f42e808a1184f4a66cffba91b544375219d47cd1beb5476bc388a14a349c1e1edf6b7dcfd789d9e3970b6e7eb636557e

Download Submit
C:\Windows\system\CoPovuG.exe

Filesize
2.9MB

MD5
e755e5568499d0c82f34862ad5ca816c

SHA1
f4f2d3226f90ec073a65708278a9e04cd042c42e

SHA256
b502e70c17e1e478d6949a6841f0761a496060bf910f005b8e521359d0f7dffd

SHA512
3ed932c2065c3282cf7d33447e71ad9c0813fcab2f03fdd6bf84d5cd96c89bc809409ecf15dd3633249e844c9cdc5e65fa176d7001191c69746ad4b84aac340a

Download Submit
C:\Windows\system\ItcZsWN.exe

Filesize
2.9MB

MD5
cc2ab83334ba2267dc0cbd6df3310fc6

SHA1
1d7c1888e2c986d9166c333bbaf608a98268aa9f

SHA256
f288a00fd3025cb34fcda99091a3bf073b69b5b1607ecc79d8506b697c325116

SHA512
3e9174802e3a1e0d96d32b973ae7b887a21bc76be31a547f198790386a738670ff8cd14b4babffa75b37e600ff839e374f00acba886aa316ef878b1df49ce7e9

Download Submit
C:\Windows\system\KZcgTvf.exe

Filesize
2.9MB

MD5
0b2f07093230ee9aaa8701408c6c50ee

SHA1
ebb497f70636edd11eaad8026e367e59321b5c22

SHA256
b2ffa48dadfd03fcf83c3d8e28381dcfba43e609359184caff5ad70b2f5735e5

SHA512
644fbb972a11ced7a5e456a47c5aaaf17191dd8f44462378e93e10f5fa07f18b1a73c7a3d7004b4a2b2fd91c30cb95742f95fe64d676de100557d470cb1766fb

Download Submit
C:\Windows\system\LaMovgH.exe

Filesize
2.9MB

MD5
acd2c42286be1a44260bcd172789e4c6

SHA1
b584c41c2eb6adf5600674dea0d32994604d14e1

SHA256
8fdc4d459433863161d97364dd3eb395eb2ed7a78311db9a380d2e546244e2a6

SHA512
502e0b9bd0329317f89bbf1ba32c49e4f45b8ea7b1422ad95b664ef11b401d41a3ae8be1a7122310c9c1435cd1334cc4f345f6707cb9ee9814fb1e9b8c982270

Download Submit
C:\Windows\system\LftJKJl.exe

Filesize
2.9MB

MD5
1b7bea62c8e0ddf5d7ec7a12a4ce5920

SHA1
119f73a96bce1a24c3543b845982f43c606681c2

SHA256
caa32846be97a60624a616d19006b91d2d70322e6a7c5dfb51418d3133e40563

SHA512
05f6a608d4455318ddd87a69a79b7f4ab9d1cb339834f985e8626aa8cf0a2a3eba205835c2e3e7128dac579c4f0c690678bd585d47c8e84d0fae8c0b661d0a14

Download Submit
C:\Windows\system\MZruidc.exe

Filesize
2.9MB

MD5
308e88efe70470e6ca55a40a9e6f9a56

SHA1
481d6cfa99ec432f0f08256cbda41d902bc459ba

SHA256
870292cc92ac543ea76b240eeb274f137615868980f21bb8d77dada285e06857

SHA512
4c1699f9143d13d2aaad92aec556bd5ec8f2a37e1b209b1cbb4286b4cd2b3d1739a26f9a80b86a7b1b3a17cd16ea5ee8227028051e53e012f2ee841072801f5a

Download Submit
C:\Windows\system\QFYdwCV.exe

Filesize
2.9MB

MD5
f6bdac0986a864fe8fac4c6070170fbf

SHA1
068aa8600e08085992ee2b52745de3d7b80f9e05

SHA256
56c4ba89924f06f15ae23154cc80882c6a6d150f0ffe77fcc3606a47c7f1a11c

SHA512
56c67b5e9771d7febcb26a5ef9006c9ac5aff234e42471af110a8d8a11bb09e1b7b601f09ba507156e05a91913a7e24d60ee82ae586d7c5aee3d063f01d83c4f

Download Submit
C:\Windows\system\TjKlRLE.exe

Filesize
2.9MB

MD5
c636c41a9566f1ebeae0490af6f62916

SHA1
e6cac856bcf502d8a4d6578fa9982fc1908d440e

SHA256
794cb91d3d81ec70bd9068cf73701c0e7526e5f40c62311227163d7e5dba8764

SHA512
99dffd8fe3dcee55eaeba20b51d575265b45816c89bf7f75e9c6be9ffca1641e52572c5d5764080c528aa61a43123bd55931508914cfc64fb8714af714f31b92

Download Submit
C:\Windows\system\UIOKliC.exe

Filesize
2.9MB

MD5
11fb777a8e47b613ffa0d8993fe96aa9

SHA1
8712ec6e0b8ec01d45d48c7cd6fd83a5b52fd3b1

SHA256
c5d5b983b9498f5f91efc295cbd597f2561a5bd0ec33f3e94481422bc6ba562f

SHA512
49fbdfda47fff51eabfe1f03ce871bb11e09ff19c7489b8e33608dafbff765373fe97986ea21b632a5a5abf932c81434e0992b61642098fd64ff99497ff358a4

Download Submit
C:\Windows\system\XDmTZdg.exe

Filesize
2.9MB

MD5
b7bad76425f2cb540537f7a8b7cd86d3

SHA1
72b5cd2ac3a819b94bc46c7f8b7cb8d593c141de

SHA256
1d895b282ea4013e46df7306a96f84e6b579428d86e95107eaf8268eca9049fb

SHA512
c0d5af56a1f70c9e37a013ee37a0de3b161a4e55ff54c400146ddfdb22c272e6d4c677a53c5b95ecf5cde59e1d4f245688c1be0854e83809d5dd4c625946ed7c

Download Submit
C:\Windows\system\fYHeRmj.exe

Filesize
2.9MB

MD5
83c4f417cf429b95778b25639b08392d

SHA1
e1bf76644516a3b61e08d2dfb78c8357c47f23fa

SHA256
4710a997e653f222ca8084d2509d08f25314a68123ff0b9ce4353161408c6630

SHA512
448b4af7252eb9bf7b3b85300245d10111cb4943fa1b4d87e79bb47004737be9a676032d340f955851a345b05e796cef8bdc968a575ef74d668460bc79c2b569

Download Submit
C:\Windows\system\fxWEYii.exe

Filesize
2.9MB

MD5
d6dd3331e3625522769ed99fa5ca73e7

SHA1
2ca2d05fb718c693ed685237f10ef1faacfa44f0

SHA256
55e4e9944fc03624c3e8dfddfc34995c5cc909ed3ae1ccdfa62e4e3ad4cc4e05

SHA512
34568e58d8501dfc28e6d2cc64cc34b925e9fbd6e44cd88513e08aafa9e657a2f056021c574b49d0516d37b8d8cc8b4437526df35ca5be51a61c7f851721f030

Download Submit
C:\Windows\system\hXjYcaY.exe

Filesize
2.9MB

MD5
e9166086d89690dbedf1b19e3bf4d954

SHA1
fcdba28974e1f40326d87de77fdafffd7d68accd

SHA256
0ac1c3b1c2929685d328f0a02025439a1e40f93fbb2875393666bd5b5eef9303

SHA512
2c248b8e5d8233a451f24024d168d654e9975415200e71c61d4b74bc210b723e0f2a99e7d19d60d7800564bb91ca6e1c86a8f3d4ea3ef391e5190ed680f2a431

Download Submit
C:\Windows\system\hjmZZpY.exe

Filesize
2.9MB

MD5
f28270353b8527dc701911b635cf41fd

SHA1
553a9df4f0181d54570c6935499deff5c1e132a8

SHA256
ea2d83d2f02cbac3ceb50bd65f9ae007e532ea3dc0115970419a12775f3eaf64

SHA512
688d95110381e0a4ce462ad911928af6e8f4200bf64fd5b270b9278f86a3b44c355a16d6172aacad9d06221dd95aff9c64a34eaa5a451f3df1b1e75cb66f2a48

Download Submit
C:\Windows\system\iyryfno.exe

Filesize
2.9MB

MD5
8753c0d3ae5418112a16ea156d0e0095

SHA1
4c7f225d18a0727b99d3b3655b7c10a61c85f816

SHA256
31e8331982ef1ae782c21954494f2ace886e9666279de48a9a739626f40c7ce3

SHA512
1e73e1d92fe203a097af3c3afa1925aafc3b84307b19c3deb43db874b75499af015dedc1ff16cec44436653568282f59d2a90ff21fab67512af8c1e05214bc6a

Download Submit
C:\Windows\system\lUJIDSz.exe

Filesize
2.9MB

MD5
2735760ac248c2adc545871f679394b5

SHA1
cfeb35318bfc7b88ea35f1bfbc8ab0917777e2d7

SHA256
d0eb68e73c662d7969f2c9d82daf54f46455995f24ec9d3edbffecb6778137bf

SHA512
de0fd12e309db091694afd930cc0ce094771b9b19776af2ae50a3478fa95cc3cbd271680484b0d1855f5071e53f85ad0b60d04a64dc4a515be39eef7c7f0e5fe

Download Submit
C:\Windows\system\lshiFxS.exe

Filesize
2.9MB

MD5
a12dadcfd9f8120fcbae5eed25bd0054

SHA1
3d0685c4719551d92701487bfbd685ac3bd16c88

SHA256
f9ea6d011857924b96ad14a1410561902708d8d5307d594d0a45f998b2edd07a

SHA512
4cd8187213da9442c1a42c16bbee5af4af3f3f424f97f8e97eb26aae5d029d2366b714322408e6e098d93592700245582565042b793177485366426e49dae1cd

Download Submit
C:\Windows\system\mqXNDwt.exe

Filesize
2.9MB

MD5
06bcd23891d4bd0fbb451026261c58aa

SHA1
7d228246eeac0d43a3911d2161ad4f1cb88bd2ea

SHA256
d6550fc4310886ac52258a9e01b9f0ca71b7e8c2939b4280fd97cd5048594e34

SHA512
ae8ec7d9aa98e0fa0167956ea6e3cb18a7f5503c0902bd5f46bc1fc69ed88094729c156be6185b7c6359c6dc0289433a696d8bbde16903344da42274e99798a9

Download Submit
C:\Windows\system\pJyFaVi.exe

Filesize
2.9MB

MD5
278a51d3652bbaf4a8fe5ebb3cceab0c

SHA1
04b454398fa175e23118235e418fb9b10e6903bb

SHA256
a716175b41dae913ba5c2089cc14cfb82e838943f0408d71c7b628185c7a37fb

SHA512
e03a2e52d0b916b7fa93b7683ecbc0d9d63d21ac5e41e7d75213b9abc9df5f9496be42d7273b39ac93837e68937d05db76728ecd7466be1051a60bbc37c6dbdd

Download Submit
C:\Windows\system\qZsFiLL.exe

Filesize
2.9MB

MD5
ad9c3c6d317196ab56334562174d8cd6

SHA1
4adfb8a1783eb528c1338f5fe3a47593911705a4

SHA256
5c21c7fbbee5c6e12ad824f76dbdcdc52f3950697033e69915edb0dae1c6df65

SHA512
44c62c7ddba3bb680a968521eb01a7512523baca76c2318d9c7e01ab029f2aee6a21d4c6fd75dfb41f07054d0d5bd14f86a74f10085d905bf79ca6654f16631f

Download Submit
C:\Windows\system\rNLcvZl.exe

Filesize
2.9MB

MD5
a834b9c96ef821e126df09990b47fc35

SHA1
c7f116f6642ffe7d668ae46efbba316b3a3149dc

SHA256
734041d936b0db1448a35025cc23fc436244abc109219d5b2895bd6950f19d1e

SHA512
1c689804d8ce21a0bf3d7fa042b55638ee98159ba9b109c2389fb0048d3d506b1ea335830bfbf6a1ab285cdb8bf179a6a62997e47fba487fd64cb4dc6b108065

Download Submit
C:\Windows\system\rnxHEzW.exe

Filesize
2.9MB

MD5
05b2f68ec3edb924c24081a51229b5b7

SHA1
b2e7f7090750108bef1e8044aea1b92724f2bf1b

SHA256
984554044998fb5ad7ffe50f60016b43e6893c6496e8b85a5119df828e3445b6

SHA512
9e1c4686395af3d0693b6e31a0819cc4ef2bf544f2404da0e3873c7cca29c670252fbcfdac60ce6a2887f085c0cabfbec6ac4b8c8d3d696801a2a45824cae3fe

Download Submit
C:\Windows\system\sOtZRLM.exe

Filesize
2.9MB

MD5
f7143bc8dc34c9e007274de52cdb3d62

SHA1
4a6aab300b8020be4bb2608493290dc4c82dda61

SHA256
d47d5485770ae176577d8f8166af5a57ca42a625688ec23829df771811b08547

SHA512
5808c8eb4d999682741bd2e06e446a0132f8f498be78aba4805f7b988095e9bd839f4493aeb70fee840d741915301bf7571dee728b44ac106fb31f55d70e341f

Download Submit
C:\Windows\system\sPvMiOC.exe

Filesize
2.9MB

MD5
4693f72fd78916915b6348f0c8049227

SHA1
2e649f1d690f3a505c94555bf94bc7ce33e3fe20

SHA256
61e0e2b258d5f2355cace18d41afaecedf47c10f36032f4a7e6a4d8c71301705

SHA512
6b452bf631fa5d1ffff8e757721d76ce7643b346b6c005393a782d8e450e9f533ef19c9e9d11aa8563bd3bc08ae8db62e4df38dfaa73f2c90286f3696f0d0f28

Download Submit
C:\Windows\system\sfdQvjN.exe

Filesize
2.9MB

MD5
f97734491c0b4410ebef62ddff9da57e

SHA1
4a77cb212a0f646596f83bd983f3be6cae6ba422

SHA256
c50f4d8bfaf7e76cded7fafe0751dfe60d301c40100211cb855a0398532c2b9f

SHA512
b81c55234ba0e5e38ed9435b16a9ce38e5439a1a5494493608c48b362b187079b948ab471dd8386e411ced65b818ba2b0d8c039fd7d7d7181e7f7d48d901e478

Download Submit
C:\Windows\system\ubtPvVn.exe

Filesize
2.9MB

MD5
b263aa2977c0c7226cee13c4884f6d0c

SHA1
325a8316229ac9b27c9fd1995d0e406a159982de

SHA256
25aeb643860d7a06943bc733c7374d9b797cbf29637bd7761d40131a89db81a0

SHA512
a8a10e544a5ac60933a9f0cd5a7b5c410222d5e10b7d0f890cc17a1c41f14ddb7cca43cb531e1d3b4309518ef6e268a38639e3aa21be8095243a3f90c6c2d204

Download Submit
C:\Windows\system\wPfxOjY.exe

Filesize
2.9MB

MD5
05bc4caddebb7808f5ec05ba0633a8f9

SHA1
3b92e9f52fdbec46e81f548a6b4beebb2f90cbb5

SHA256
59a80a80125365bb7be7bee9448b3c0aa62d0e9d01531e3127c8d655850cacea

SHA512
6929627bf7842f131250e823ef8a9e0738cc42fb2cd6209b8065e57038ed4c4e1864bdeadc827c0c1204dbf19923dfa0e36c3248bac01ee55a5dc72ac50c1c8b

Download Submit
\Windows\system\QcaqPIy.exe

Filesize
2.9MB

MD5
0bc1add4368bddab333d54eff2ea7100

SHA1
8c9b0cc9a1a2ac575286de92cf3cc930f65570b8

SHA256
1ac77de0a14becb284706cfe71f9fc5b525f292690c13c6609aee6607fd128e5

SHA512
f35ebbeacc9451dc301ec781942e83d710eee3490a343c5ffaaa70b7dd110158e35b2b9a31be0445e021c11deb085bad5dc549c9646ebfe8ccebf58f328bd782

Download Submit
\Windows\system\hoTAxEB.exe

Filesize
2.9MB

MD5
761a5e663cb088005569d990b5065943

SHA1
8cd8efa8d4a56c393563415e68dcc88d3a001cca

SHA256
39071e8b1c3781282785d4f9088343fb665d433bd2dcf84e5e240d9aaa3784d9

SHA512
cd2f9494a2b50bc1ae8a187d426e639bc0650bebe640eede4fc4cdeae85d01b7542aaebb974f32618664d93f983acbfb6b9e174e5da76a769bc76b543ae36c63

Download Submit
memory/1788-197-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/1788-201-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2104-4688-0x000000013F050000-0x000000013F446000-memory.dmp

Filesize
4.0MB

Download
memory/2104-63-0x000000013FB20000-0x000000013FF16000-memory.dmp

Filesize
4.0MB

Download
memory/2104-3206-0x0000000003490000-0x0000000003886000-memory.dmp

Filesize
4.0MB

Download
memory/2104-1509-0x0000000003490000-0x0000000003886000-memory.dmp

Filesize
4.0MB

Download
memory/2104-17-0x0000000003490000-0x0000000003886000-memory.dmp

Filesize
4.0MB

Download
memory/2104-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2104-313-0x000000013F210000-0x000000013F606000-memory.dmp

Filesize
4.0MB

Download
memory/2104-2-0x000000013FB20000-0x000000013FF16000-memory.dmp

Filesize
4.0MB

Download
memory/2104-7-0x000000013FF90000-0x0000000140386000-memory.dmp

Filesize
4.0MB

Download
memory/2104-310-0x000000013F050000-0x000000013F446000-memory.dmp

Filesize
4.0MB

Download
memory/2104-2411-0x0000000003490000-0x0000000003886000-memory.dmp

Filesize
4.0MB

Download
memory/2104-4686-0x0000000003490000-0x0000000003886000-memory.dmp

Filesize
4.0MB

Download
memory/2104-5169-0x000000013F210000-0x000000013F606000-memory.dmp

Filesize
4.0MB

Download
memory/2104-67-0x0000000003490000-0x0000000003886000-memory.dmp

Filesize
4.0MB

Download
memory/2104-37-0x000000013F5B0000-0x000000013F9A6000-memory.dmp

Filesize
4.0MB

Download
memory/2104-33-0x0000000003490000-0x0000000003886000-memory.dmp

Filesize
4.0MB

Download
memory/2104-60-0x000000013F670000-0x000000013FA66000-memory.dmp

Filesize
4.0MB

Download
memory/2104-39-0x000000013F380000-0x000000013F776000-memory.dmp

Filesize
4.0MB

Download
memory/2104-56-0x0000000003490000-0x0000000003886000-memory.dmp

Filesize
4.0MB

Download
memory/2104-13-0x00000000030C0000-0x00000000034B6000-memory.dmp

Filesize
4.0MB

Download
memory/2184-312-0x000000013F050000-0x000000013F446000-memory.dmp

Filesize
4.0MB

Download
memory/2184-6191-0x000000013F050000-0x000000013F446000-memory.dmp

Filesize
4.0MB

Download
memory/2252-316-0x000000013F210000-0x000000013F606000-memory.dmp

Filesize
4.0MB

Download
memory/2524-34-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/2536-71-0x000000013F960000-0x000000013FD56000-memory.dmp

Filesize
4.0MB

Download
memory/2560-3210-0x000000013F860000-0x000000013FC56000-memory.dmp

Filesize
4.0MB

Download
memory/2560-59-0x000000013F860000-0x000000013FC56000-memory.dmp

Filesize
4.0MB

Download
memory/2560-6179-0x000000013F860000-0x000000013FC56000-memory.dmp

Filesize
4.0MB

Download
memory/2592-304-0x000000013F8E0000-0x000000013FCD6000-memory.dmp

Filesize
4.0MB

Download
memory/2620-42-0x000000013F380000-0x000000013F776000-memory.dmp

Filesize
4.0MB

Download
memory/2620-2838-0x000000013F380000-0x000000013F776000-memory.dmp

Filesize
4.0MB

Download
memory/2628-15-0x000000013FD00000-0x00000001400F6000-memory.dmp

Filesize
4.0MB

Download
memory/2628-1126-0x000000013FD00000-0x00000001400F6000-memory.dmp

Filesize
4.0MB

Download
memory/2692-3219-0x000000013F670000-0x000000013FA66000-memory.dmp

Filesize
4.0MB

Download
memory/2692-6182-0x000000013F670000-0x000000013FA66000-memory.dmp

Filesize
4.0MB

Download
memory/2692-62-0x000000013F670000-0x000000013FA66000-memory.dmp

Filesize
4.0MB

Download
memory/2704-9-0x000000013FF90000-0x0000000140386000-memory.dmp

Filesize
4.0MB

Download
memory/2704-5940-0x000000013FF90000-0x0000000140386000-memory.dmp

Filesize
4.0MB

Download
memory/2748-2413-0x000000013F5B0000-0x000000013F9A6000-memory.dmp

Filesize
4.0MB

Download
memory/2748-35-0x000000013F5B0000-0x000000013F9A6000-memory.dmp

Filesize
4.0MB

Download
memory/2768-23-0x000000013FC60000-0x0000000140056000-memory.dmp

Filesize
4.0MB

Download
memory/2768-6136-0x000000013FC60000-0x0000000140056000-memory.dmp

Filesize
4.0MB

Download