xmrig | 4d4dff5bc77e72a33cb640909fd642a8323e212d0342a2bad2f8126db9004572

Analysis

max time kernel
147s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
Size

2.9MB
MD5

124fa51ac511479cf281fe751939c990
SHA1

833d433be4f12b1b4cd094d70518baa754a9c4d5
SHA256

4d4dff5bc77e72a33cb640909fd642a8323e212d0342a2bad2f8126db9004572
SHA512

4417c4b3e70071a7fce0986dda8f9ecaff160a6464aa760ae7c54aa7cecab5f4655c21cbd81a39d5314ebe4b608c1afa31d28e9331af746b8add3b527eb8b618
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfLv3zQXtTV:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RK

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 58 IoCs

miner

resource	yara_rule
behavioral1/memory/1736-0-0x000000013F400000-0x000000013F7F6000-memory.dmp	xmrig
behavioral1/files/0x000b000000014aec-3.dat	xmrig
behavioral1/files/0x0009000000014fe1-17.dat	xmrig
behavioral1/files/0x000f0000000006fd-16.dat	xmrig
behavioral1/files/0x00080000000155e2-29.dat	xmrig
behavioral1/memory/2952-27-0x000000013F760000-0x000000013FB56000-memory.dmp	xmrig
behavioral1/files/0x000700000001560a-30.dat	xmrig
behavioral1/files/0x0009000000015264-38.dat	xmrig
behavioral1/files/0x0007000000015a2d-44.dat	xmrig
behavioral1/memory/1696-13-0x000000013FD80000-0x0000000140176000-memory.dmp	xmrig
behavioral1/files/0x0007000000015e41-48.dat	xmrig
behavioral1/files/0x0006000000016d36-53.dat	xmrig
behavioral1/files/0x0006000000016d4a-63.dat	xmrig
behavioral1/files/0x0006000000016d55-73.dat	xmrig
behavioral1/files/0x0006000000016d4f-68.dat	xmrig
behavioral1/files/0x0006000000016d84-76.dat	xmrig
behavioral1/files/0x000500000001868c-98.dat	xmrig
behavioral1/files/0x00050000000186a0-109.dat	xmrig
behavioral1/files/0x0006000000018ae8-118.dat	xmrig
behavioral1/files/0x0005000000018698-130.dat	xmrig
behavioral1/files/0x0006000000018b6a-149.dat	xmrig
behavioral1/files/0x0006000000018b15-120.dat	xmrig
behavioral1/memory/2388-209-0x000000013F240000-0x000000013F636000-memory.dmp	xmrig
behavioral1/memory/2784-246-0x000000013F470000-0x000000013F866000-memory.dmp	xmrig
behavioral1/memory/2848-240-0x000000013F2A0000-0x000000013F696000-memory.dmp	xmrig
behavioral1/memory/2428-236-0x000000013FB70000-0x000000013FF66000-memory.dmp	xmrig
behavioral1/memory/2368-231-0x000000013FA50000-0x000000013FE46000-memory.dmp	xmrig
behavioral1/memory/2528-223-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	xmrig
behavioral1/memory/2400-200-0x000000013FC30000-0x0000000140026000-memory.dmp	xmrig
behavioral1/memory/2596-194-0x000000013F0A0000-0x000000013F496000-memory.dmp	xmrig
behavioral1/memory/2600-184-0x000000013F1A0000-0x000000013F596000-memory.dmp	xmrig
behavioral1/memory/2520-176-0x000000013F760000-0x000000013FB56000-memory.dmp	xmrig
behavioral1/files/0x0006000000018ba2-169.dat	xmrig
behavioral1/files/0x0006000000018b73-166.dat	xmrig
behavioral1/files/0x0006000000018b4a-143.dat	xmrig
behavioral1/files/0x0006000000018b37-133.dat	xmrig
behavioral1/files/0x0006000000017090-115.dat	xmrig
behavioral1/files/0x0006000000018ae2-110.dat	xmrig
behavioral1/files/0x0006000000018b96-157.dat	xmrig
behavioral1/files/0x000600000001704f-97.dat	xmrig
behavioral1/files/0x0006000000018b42-141.dat	xmrig
behavioral1/files/0x0006000000018b33-127.dat	xmrig
behavioral1/files/0x0006000000016e56-88.dat	xmrig
behavioral1/files/0x0006000000016d89-83.dat	xmrig
behavioral1/files/0x0006000000016d41-58.dat	xmrig
behavioral1/memory/1736-1100-0x000000013F400000-0x000000013F7F6000-memory.dmp	xmrig
behavioral1/memory/1696-2365-0x000000013FD80000-0x0000000140176000-memory.dmp	xmrig
behavioral1/memory/2952-2374-0x000000013F760000-0x000000013FB56000-memory.dmp	xmrig
behavioral1/memory/2520-2378-0x000000013F760000-0x000000013FB56000-memory.dmp	xmrig
behavioral1/memory/2600-2383-0x000000013F1A0000-0x000000013F596000-memory.dmp	xmrig
behavioral1/memory/2596-2405-0x000000013F0A0000-0x000000013F496000-memory.dmp	xmrig
behavioral1/memory/2400-2431-0x000000013FC30000-0x0000000140026000-memory.dmp	xmrig
behavioral1/memory/2784-2390-0x000000013F470000-0x000000013F866000-memory.dmp	xmrig
behavioral1/memory/2848-2502-0x000000013F2A0000-0x000000013F696000-memory.dmp	xmrig
behavioral1/memory/2388-2625-0x000000013F240000-0x000000013F636000-memory.dmp	xmrig
behavioral1/memory/2528-2624-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	xmrig
behavioral1/memory/2428-2623-0x000000013FB70000-0x000000013FF66000-memory.dmp	xmrig
behavioral1/memory/2368-2596-0x000000013FA50000-0x000000013FE46000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2312	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1696	sETrDVH.exe
2952	BVZQBME.exe
2520	BiHwzig.exe
2784	AJvyVFF.exe
2600	PWCXMGi.exe
2596	aVAFHSx.exe
2400	yTaDNyb.exe
2388	ftsceVk.exe
2528	MggtRTg.exe
2368	rlRKwwW.exe
2428	UtUCGOv.exe
2848	TkqZaRy.exe
1956	BOwjjRk.exe
1060	sJklziX.exe
1120	oDRQhoM.exe
2344	rASFwvM.exe
1412	lzIsjDn.exe
1652	dwIjMWW.exe
1040	KvYZGLn.exe
1988	natTHmz.exe
2672	VXaNsRD.exe
896	IhlTxoI.exe
1816	mrIVrhV.exe
1876	QoXbBph.exe
1888	iqnpzuf.exe
2732	BSEDSon.exe
1612	venDMVa.exe
592	CarSDre.exe
2404	LBIlOCv.exe
2080	EnydPQA.exe
476	MLuDLJs.exe
2052	DFPwzaC.exe
1476	YhMqAqW.exe
1848	JhHGvMv.exe
1580	QkTRxNO.exe
2128	FyfiHhT.exe
2032	OdfcYNJ.exe
1996	uRJYPPy.exe
3060	ZoNAJPA.exe
1168	UrGNgVK.exe
2540	SDrkTtb.exe
880	gBkJuvA.exe
1564	NKVYGRm.exe
2012	AksEEnW.exe
776	zXJyRuA.exe
2872	nxNVnWI.exe
2144	mBKoiAy.exe
2284	gkkaJev.exe
1536	fWfiTai.exe
2904	EtufjpF.exe
1628	uqnPwbO.exe
2508	AcTInfd.exe
2260	LZBcEYo.exe
2216	NsBIrii.exe
2524	BWxkiQR.exe
1784	DwjbzXQ.exe
2380	kGwIYvX.exe
1756	MOFJmvg.exe
1316	racHwrN.exe
2568	DNctBuH.exe
276	FrmYenS.exe
2544	jrcKspS.exe
2532	DPfktVP.exe
2484	uWtqOch.exe

Loads dropped DLL 64 IoCs

pid	Process
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1736-0-0x000000013F400000-0x000000013F7F6000-memory.dmp	upx
behavioral1/files/0x000b000000014aec-3.dat	upx
behavioral1/files/0x0009000000014fe1-17.dat	upx
behavioral1/files/0x000f0000000006fd-16.dat	upx
behavioral1/files/0x00080000000155e2-29.dat	upx
behavioral1/memory/2952-27-0x000000013F760000-0x000000013FB56000-memory.dmp	upx
behavioral1/files/0x000700000001560a-30.dat	upx
behavioral1/files/0x0009000000015264-38.dat	upx
behavioral1/files/0x0007000000015a2d-44.dat	upx
behavioral1/memory/1696-13-0x000000013FD80000-0x0000000140176000-memory.dmp	upx
behavioral1/files/0x0007000000015e41-48.dat	upx
behavioral1/files/0x0006000000016d36-53.dat	upx
behavioral1/files/0x0006000000016d4a-63.dat	upx
behavioral1/files/0x0006000000016d55-73.dat	upx
behavioral1/files/0x0006000000016d4f-68.dat	upx
behavioral1/files/0x0006000000016d84-76.dat	upx
behavioral1/files/0x000500000001868c-98.dat	upx
behavioral1/files/0x00050000000186a0-109.dat	upx
behavioral1/files/0x0006000000018ae8-118.dat	upx
behavioral1/files/0x0005000000018698-130.dat	upx
behavioral1/files/0x0006000000018b6a-149.dat	upx
behavioral1/files/0x0006000000018b15-120.dat	upx
behavioral1/memory/2388-209-0x000000013F240000-0x000000013F636000-memory.dmp	upx
behavioral1/memory/2784-246-0x000000013F470000-0x000000013F866000-memory.dmp	upx
behavioral1/memory/2848-240-0x000000013F2A0000-0x000000013F696000-memory.dmp	upx
behavioral1/memory/2428-236-0x000000013FB70000-0x000000013FF66000-memory.dmp	upx
behavioral1/memory/2368-231-0x000000013FA50000-0x000000013FE46000-memory.dmp	upx
behavioral1/memory/2528-223-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	upx
behavioral1/memory/2400-200-0x000000013FC30000-0x0000000140026000-memory.dmp	upx
behavioral1/memory/2596-194-0x000000013F0A0000-0x000000013F496000-memory.dmp	upx
behavioral1/memory/2600-184-0x000000013F1A0000-0x000000013F596000-memory.dmp	upx
behavioral1/memory/2520-176-0x000000013F760000-0x000000013FB56000-memory.dmp	upx
behavioral1/files/0x0006000000018ba2-169.dat	upx
behavioral1/files/0x0006000000018b73-166.dat	upx
behavioral1/files/0x0006000000018b4a-143.dat	upx
behavioral1/files/0x0006000000018b37-133.dat	upx
behavioral1/files/0x0006000000017090-115.dat	upx
behavioral1/files/0x0006000000018ae2-110.dat	upx
behavioral1/files/0x0006000000018b96-157.dat	upx
behavioral1/files/0x000600000001704f-97.dat	upx
behavioral1/files/0x0006000000018b42-141.dat	upx
behavioral1/files/0x0006000000018b33-127.dat	upx
behavioral1/files/0x0006000000016e56-88.dat	upx
behavioral1/files/0x0006000000016d89-83.dat	upx
behavioral1/files/0x0006000000016d41-58.dat	upx
behavioral1/memory/1736-1100-0x000000013F400000-0x000000013F7F6000-memory.dmp	upx
behavioral1/memory/1696-2365-0x000000013FD80000-0x0000000140176000-memory.dmp	upx
behavioral1/memory/2952-2374-0x000000013F760000-0x000000013FB56000-memory.dmp	upx
behavioral1/memory/2520-2378-0x000000013F760000-0x000000013FB56000-memory.dmp	upx
behavioral1/memory/2600-2383-0x000000013F1A0000-0x000000013F596000-memory.dmp	upx
behavioral1/memory/2596-2405-0x000000013F0A0000-0x000000013F496000-memory.dmp	upx
behavioral1/memory/2400-2431-0x000000013FC30000-0x0000000140026000-memory.dmp	upx
behavioral1/memory/2784-2390-0x000000013F470000-0x000000013F866000-memory.dmp	upx
behavioral1/memory/2848-2502-0x000000013F2A0000-0x000000013F696000-memory.dmp	upx
behavioral1/memory/2388-2625-0x000000013F240000-0x000000013F636000-memory.dmp	upx
behavioral1/memory/2528-2624-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	upx
behavioral1/memory/2428-2623-0x000000013FB70000-0x000000013FF66000-memory.dmp	upx
behavioral1/memory/2368-2596-0x000000013FA50000-0x000000013FE46000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MawPWtE.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\EYZBxYf.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\GBmRErO.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\afGIIPI.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\qdrbrGv.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\Tssmudd.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\qmgZbBp.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\gnQxPHt.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\bNhZOrW.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\VRPnMKN.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\CarSDre.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\elqKzQI.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\WFjrruU.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\jXpcEIh.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\uPpXjwQ.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\FyCkQrD.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\irtQONO.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\YUKHLcW.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\ITzmUUx.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\beLHaYI.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\BlqfTIo.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\VSZpJDT.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\HALYpWD.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\MuGvaOx.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\HTzVaSE.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\gQkDfUu.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\qKjtXUi.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\aNxvDGR.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\XaKnNXl.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\OPprdCd.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\UhOAOLK.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\iTnBLGY.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\igQZDkT.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\CjxYbJr.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\BAUuveB.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\vmiGShR.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\wzexOAu.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\FufsepO.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\fJWoUmF.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\tjfAKdt.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\PDkDxEx.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\LfGSHOU.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\pYNePGg.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\RVbcbRf.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\qreQIaw.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\NkGijLI.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\BgRkbPA.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\hrjpqlr.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\gmqCxuJ.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\QGcIIcY.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\uEmBWXV.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\XGuENcf.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\EuyzpgH.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\rmXpuyS.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\FxaSqHO.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\LbdSJrv.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\AqaLMNn.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\eCectWr.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\rNzAMVK.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\NvuyQzi.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\FAfshgQ.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\TnCDZEN.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\CDzeaVP.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
File created	C:\Windows\System\fODiBzb.exe	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2312	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
Token: SeDebugPrivilege	2312	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2312	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	29
PID 1736 wrote to memory of 2312	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	29
PID 1736 wrote to memory of 2312	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	29
PID 1736 wrote to memory of 1696	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	30
PID 1736 wrote to memory of 1696	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	30
PID 1736 wrote to memory of 1696	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	30
PID 1736 wrote to memory of 2952	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	31
PID 1736 wrote to memory of 2952	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	31
PID 1736 wrote to memory of 2952	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	31
PID 1736 wrote to memory of 2520	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	32
PID 1736 wrote to memory of 2520	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	32
PID 1736 wrote to memory of 2520	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	32
PID 1736 wrote to memory of 2784	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	33
PID 1736 wrote to memory of 2784	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	33
PID 1736 wrote to memory of 2784	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	33
PID 1736 wrote to memory of 2600	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	34
PID 1736 wrote to memory of 2600	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	34
PID 1736 wrote to memory of 2600	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	34
PID 1736 wrote to memory of 2596	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	35
PID 1736 wrote to memory of 2596	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	35
PID 1736 wrote to memory of 2596	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	35
PID 1736 wrote to memory of 2400	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	36
PID 1736 wrote to memory of 2400	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	36
PID 1736 wrote to memory of 2400	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	36
PID 1736 wrote to memory of 2388	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	37
PID 1736 wrote to memory of 2388	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	37
PID 1736 wrote to memory of 2388	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	37
PID 1736 wrote to memory of 2528	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	38
PID 1736 wrote to memory of 2528	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	38
PID 1736 wrote to memory of 2528	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	38
PID 1736 wrote to memory of 2368	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	39
PID 1736 wrote to memory of 2368	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	39
PID 1736 wrote to memory of 2368	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	39
PID 1736 wrote to memory of 2428	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	40
PID 1736 wrote to memory of 2428	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	40
PID 1736 wrote to memory of 2428	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	40
PID 1736 wrote to memory of 2848	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	41
PID 1736 wrote to memory of 2848	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	41
PID 1736 wrote to memory of 2848	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	41
PID 1736 wrote to memory of 1956	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	42
PID 1736 wrote to memory of 1956	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	42
PID 1736 wrote to memory of 1956	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	42
PID 1736 wrote to memory of 1060	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	43
PID 1736 wrote to memory of 1060	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	43
PID 1736 wrote to memory of 1060	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	43
PID 1736 wrote to memory of 1120	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	44
PID 1736 wrote to memory of 1120	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	44
PID 1736 wrote to memory of 1120	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	44
PID 1736 wrote to memory of 2344	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	45
PID 1736 wrote to memory of 2344	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	45
PID 1736 wrote to memory of 2344	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	45
PID 1736 wrote to memory of 1412	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	46
PID 1736 wrote to memory of 1412	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	46
PID 1736 wrote to memory of 1412	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	46
PID 1736 wrote to memory of 1988	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	47
PID 1736 wrote to memory of 1988	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	47
PID 1736 wrote to memory of 1988	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	47
PID 1736 wrote to memory of 1652	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	48
PID 1736 wrote to memory of 1652	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	48
PID 1736 wrote to memory of 1652	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	48
PID 1736 wrote to memory of 1816	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	49
PID 1736 wrote to memory of 1816	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	49
PID 1736 wrote to memory of 1816	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	49
PID 1736 wrote to memory of 1040	1736	124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\124fa51ac511479cf281fe751939c990_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\System\sETrDVH.exe
  C:\Windows\System\sETrDVH.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\BVZQBME.exe
  C:\Windows\System\BVZQBME.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\BiHwzig.exe
  C:\Windows\System\BiHwzig.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\AJvyVFF.exe
  C:\Windows\System\AJvyVFF.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\PWCXMGi.exe
  C:\Windows\System\PWCXMGi.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\aVAFHSx.exe
  C:\Windows\System\aVAFHSx.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\yTaDNyb.exe
  C:\Windows\System\yTaDNyb.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\ftsceVk.exe
  C:\Windows\System\ftsceVk.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\MggtRTg.exe
  C:\Windows\System\MggtRTg.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\rlRKwwW.exe
  C:\Windows\System\rlRKwwW.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\UtUCGOv.exe
  C:\Windows\System\UtUCGOv.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\TkqZaRy.exe
  C:\Windows\System\TkqZaRy.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\BOwjjRk.exe
  C:\Windows\System\BOwjjRk.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\sJklziX.exe
  C:\Windows\System\sJklziX.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\oDRQhoM.exe
  C:\Windows\System\oDRQhoM.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\rASFwvM.exe
  C:\Windows\System\rASFwvM.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\lzIsjDn.exe
  C:\Windows\System\lzIsjDn.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\natTHmz.exe
  C:\Windows\System\natTHmz.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\dwIjMWW.exe
  C:\Windows\System\dwIjMWW.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\mrIVrhV.exe
  C:\Windows\System\mrIVrhV.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\KvYZGLn.exe
  C:\Windows\System\KvYZGLn.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\QoXbBph.exe
  C:\Windows\System\QoXbBph.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\VXaNsRD.exe
  C:\Windows\System\VXaNsRD.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\iqnpzuf.exe
  C:\Windows\System\iqnpzuf.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\IhlTxoI.exe
  C:\Windows\System\IhlTxoI.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\LBIlOCv.exe
  C:\Windows\System\LBIlOCv.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\BSEDSon.exe
  C:\Windows\System\BSEDSon.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\EnydPQA.exe
  C:\Windows\System\EnydPQA.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\venDMVa.exe
  C:\Windows\System\venDMVa.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\MLuDLJs.exe
  C:\Windows\System\MLuDLJs.exe
  2⤵
  - Executes dropped EXE
  PID:476
- C:\Windows\System\CarSDre.exe
  C:\Windows\System\CarSDre.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\DFPwzaC.exe
  C:\Windows\System\DFPwzaC.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\YhMqAqW.exe
  C:\Windows\System\YhMqAqW.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\UrGNgVK.exe
  C:\Windows\System\UrGNgVK.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\JhHGvMv.exe
  C:\Windows\System\JhHGvMv.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\SDrkTtb.exe
  C:\Windows\System\SDrkTtb.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\QkTRxNO.exe
  C:\Windows\System\QkTRxNO.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\gBkJuvA.exe
  C:\Windows\System\gBkJuvA.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\FyfiHhT.exe
  C:\Windows\System\FyfiHhT.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\NKVYGRm.exe
  C:\Windows\System\NKVYGRm.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\OdfcYNJ.exe
  C:\Windows\System\OdfcYNJ.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\AksEEnW.exe
  C:\Windows\System\AksEEnW.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\uRJYPPy.exe
  C:\Windows\System\uRJYPPy.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\zXJyRuA.exe
  C:\Windows\System\zXJyRuA.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\ZoNAJPA.exe
  C:\Windows\System\ZoNAJPA.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\mBKoiAy.exe
  C:\Windows\System\mBKoiAy.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\nxNVnWI.exe
  C:\Windows\System\nxNVnWI.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\gkkaJev.exe
  C:\Windows\System\gkkaJev.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\fWfiTai.exe
  C:\Windows\System\fWfiTai.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\LZBcEYo.exe
  C:\Windows\System\LZBcEYo.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\EtufjpF.exe
  C:\Windows\System\EtufjpF.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\DwjbzXQ.exe
  C:\Windows\System\DwjbzXQ.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\uqnPwbO.exe
  C:\Windows\System\uqnPwbO.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\MOFJmvg.exe
  C:\Windows\System\MOFJmvg.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\AcTInfd.exe
  C:\Windows\System\AcTInfd.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\DNctBuH.exe
  C:\Windows\System\DNctBuH.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\NsBIrii.exe
  C:\Windows\System\NsBIrii.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\jrcKspS.exe
  C:\Windows\System\jrcKspS.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\BWxkiQR.exe
  C:\Windows\System\BWxkiQR.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\DPfktVP.exe
  C:\Windows\System\DPfktVP.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\kGwIYvX.exe
  C:\Windows\System\kGwIYvX.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\uWtqOch.exe
  C:\Windows\System\uWtqOch.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\racHwrN.exe
  C:\Windows\System\racHwrN.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\kNOkBKf.exe
  C:\Windows\System\kNOkBKf.exe
  2⤵
  PID:876
- C:\Windows\System\FrmYenS.exe
  C:\Windows\System\FrmYenS.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\QVgsxVW.exe
  C:\Windows\System\QVgsxVW.exe
  2⤵
  PID:2464
- C:\Windows\System\OYlzlBw.exe
  C:\Windows\System\OYlzlBw.exe
  2⤵
  PID:2088
- C:\Windows\System\FWQSyga.exe
  C:\Windows\System\FWQSyga.exe
  2⤵
  PID:2272
- C:\Windows\System\BNwlbDR.exe
  C:\Windows\System\BNwlbDR.exe
  2⤵
  PID:1400
- C:\Windows\System\TWxbKMn.exe
  C:\Windows\System\TWxbKMn.exe
  2⤵
  PID:2212
- C:\Windows\System\LZuUSzt.exe
  C:\Windows\System\LZuUSzt.exe
  2⤵
  PID:2996
- C:\Windows\System\vNMPewj.exe
  C:\Windows\System\vNMPewj.exe
  2⤵
  PID:584
- C:\Windows\System\eNGIOUF.exe
  C:\Windows\System\eNGIOUF.exe
  2⤵
  PID:948
- C:\Windows\System\QvxtKqt.exe
  C:\Windows\System\QvxtKqt.exe
  2⤵
  PID:2860
- C:\Windows\System\BgNXIxJ.exe
  C:\Windows\System\BgNXIxJ.exe
  2⤵
  PID:2944
- C:\Windows\System\ULXeFme.exe
  C:\Windows\System\ULXeFme.exe
  2⤵
  PID:268
- C:\Windows\System\KOgXeCE.exe
  C:\Windows\System\KOgXeCE.exe
  2⤵
  PID:2948
- C:\Windows\System\GbSUrSG.exe
  C:\Windows\System\GbSUrSG.exe
  2⤵
  PID:2892
- C:\Windows\System\dCDwyCC.exe
  C:\Windows\System\dCDwyCC.exe
  2⤵
  PID:1684
- C:\Windows\System\skLdiZD.exe
  C:\Windows\System\skLdiZD.exe
  2⤵
  PID:1708
- C:\Windows\System\YowGpmg.exe
  C:\Windows\System\YowGpmg.exe
  2⤵
  PID:2024
- C:\Windows\System\QGpRtPo.exe
  C:\Windows\System\QGpRtPo.exe
  2⤵
  PID:2124
- C:\Windows\System\XwqLDpK.exe
  C:\Windows\System\XwqLDpK.exe
  2⤵
  PID:2204
- C:\Windows\System\Psvrbjm.exe
  C:\Windows\System\Psvrbjm.exe
  2⤵
  PID:1508
- C:\Windows\System\ptfpgKv.exe
  C:\Windows\System\ptfpgKv.exe
  2⤵
  PID:1664
- C:\Windows\System\nzRxbIJ.exe
  C:\Windows\System\nzRxbIJ.exe
  2⤵
  PID:848
- C:\Windows\System\JYgfxFY.exe
  C:\Windows\System\JYgfxFY.exe
  2⤵
  PID:2616
- C:\Windows\System\wclbqto.exe
  C:\Windows\System\wclbqto.exe
  2⤵
  PID:1512
- C:\Windows\System\tSYMFyw.exe
  C:\Windows\System\tSYMFyw.exe
  2⤵
  PID:1624
- C:\Windows\System\zsjXPhl.exe
  C:\Windows\System\zsjXPhl.exe
  2⤵
  PID:2536
- C:\Windows\System\hXfIInc.exe
  C:\Windows\System\hXfIInc.exe
  2⤵
  PID:2136
- C:\Windows\System\DVZrqzT.exe
  C:\Windows\System\DVZrqzT.exe
  2⤵
  PID:1104
- C:\Windows\System\JncuZWf.exe
  C:\Windows\System\JncuZWf.exe
  2⤵
  PID:1844
- C:\Windows\System\tVvEKOS.exe
  C:\Windows\System\tVvEKOS.exe
  2⤵
  PID:2496
- C:\Windows\System\IMZzDCt.exe
  C:\Windows\System\IMZzDCt.exe
  2⤵
  PID:1584
- C:\Windows\System\NNpyTDB.exe
  C:\Windows\System\NNpyTDB.exe
  2⤵
  PID:2016
- C:\Windows\System\CyHiGIf.exe
  C:\Windows\System\CyHiGIf.exe
  2⤵
  PID:2220
- C:\Windows\System\FyCkQrD.exe
  C:\Windows\System\FyCkQrD.exe
  2⤵
  PID:1044
- C:\Windows\System\MaXJBvu.exe
  C:\Windows\System\MaXJBvu.exe
  2⤵
  PID:1420
- C:\Windows\System\gCUaSTl.exe
  C:\Windows\System\gCUaSTl.exe
  2⤵
  PID:2324
- C:\Windows\System\PlwuvNR.exe
  C:\Windows\System\PlwuvNR.exe
  2⤵
  PID:3024
- C:\Windows\System\fEVOEBz.exe
  C:\Windows\System\fEVOEBz.exe
  2⤵
  PID:2900
- C:\Windows\System\tMRspYY.exe
  C:\Windows\System\tMRspYY.exe
  2⤵
  PID:2656
- C:\Windows\System\sKGPOhb.exe
  C:\Windows\System\sKGPOhb.exe
  2⤵
  PID:2488
- C:\Windows\System\ofLMrbO.exe
  C:\Windows\System\ofLMrbO.exe
  2⤵
  PID:572
- C:\Windows\System\ZbIpjER.exe
  C:\Windows\System\ZbIpjER.exe
  2⤵
  PID:2652
- C:\Windows\System\rKFXyRj.exe
  C:\Windows\System\rKFXyRj.exe
  2⤵
  PID:2152
- C:\Windows\System\jncAWos.exe
  C:\Windows\System\jncAWos.exe
  2⤵
  PID:1052
- C:\Windows\System\AbjogAS.exe
  C:\Windows\System\AbjogAS.exe
  2⤵
  PID:924
- C:\Windows\System\gTskDlg.exe
  C:\Windows\System\gTskDlg.exe
  2⤵
  PID:1484
- C:\Windows\System\heOlfzW.exe
  C:\Windows\System\heOlfzW.exe
  2⤵
  PID:3088
- C:\Windows\System\ilQoxLZ.exe
  C:\Windows\System\ilQoxLZ.exe
  2⤵
  PID:3104
- C:\Windows\System\HhHzzoV.exe
  C:\Windows\System\HhHzzoV.exe
  2⤵
  PID:3124
- C:\Windows\System\rFjqSJv.exe
  C:\Windows\System\rFjqSJv.exe
  2⤵
  PID:3144
- C:\Windows\System\NtdjKdj.exe
  C:\Windows\System\NtdjKdj.exe
  2⤵
  PID:3164
- C:\Windows\System\anCsbYG.exe
  C:\Windows\System\anCsbYG.exe
  2⤵
  PID:3180
- C:\Windows\System\HOJOTtX.exe
  C:\Windows\System\HOJOTtX.exe
  2⤵
  PID:3196
- C:\Windows\System\djTDWKa.exe
  C:\Windows\System\djTDWKa.exe
  2⤵
  PID:3212
- C:\Windows\System\sKXfdnp.exe
  C:\Windows\System\sKXfdnp.exe
  2⤵
  PID:3228
- C:\Windows\System\cCnrwpz.exe
  C:\Windows\System\cCnrwpz.exe
  2⤵
  PID:3244
- C:\Windows\System\KdLuYid.exe
  C:\Windows\System\KdLuYid.exe
  2⤵
  PID:3260
- C:\Windows\System\ssCeQOI.exe
  C:\Windows\System\ssCeQOI.exe
  2⤵
  PID:3280
- C:\Windows\System\CtLIBSl.exe
  C:\Windows\System\CtLIBSl.exe
  2⤵
  PID:3296
- C:\Windows\System\ueEvNBd.exe
  C:\Windows\System\ueEvNBd.exe
  2⤵
  PID:3312
- C:\Windows\System\KNLnasD.exe
  C:\Windows\System\KNLnasD.exe
  2⤵
  PID:3328
- C:\Windows\System\TAkQjnu.exe
  C:\Windows\System\TAkQjnu.exe
  2⤵
  PID:3344
- C:\Windows\System\XyubDNW.exe
  C:\Windows\System\XyubDNW.exe
  2⤵
  PID:3360
- C:\Windows\System\vXEAKtP.exe
  C:\Windows\System\vXEAKtP.exe
  2⤵
  PID:3376
- C:\Windows\System\VrBojcg.exe
  C:\Windows\System\VrBojcg.exe
  2⤵
  PID:3392
- C:\Windows\System\cktvIbi.exe
  C:\Windows\System\cktvIbi.exe
  2⤵
  PID:3408
- C:\Windows\System\JQxNPcE.exe
  C:\Windows\System\JQxNPcE.exe
  2⤵
  PID:3424
- C:\Windows\System\RfkXnGN.exe
  C:\Windows\System\RfkXnGN.exe
  2⤵
  PID:3440
- C:\Windows\System\FfFHzJR.exe
  C:\Windows\System\FfFHzJR.exe
  2⤵
  PID:3456
- C:\Windows\System\TbKcnes.exe
  C:\Windows\System\TbKcnes.exe
  2⤵
  PID:3472
- C:\Windows\System\gIfmocm.exe
  C:\Windows\System\gIfmocm.exe
  2⤵
  PID:3488
- C:\Windows\System\cBvOqlz.exe
  C:\Windows\System\cBvOqlz.exe
  2⤵
  PID:3504
- C:\Windows\System\UoUFFfp.exe
  C:\Windows\System\UoUFFfp.exe
  2⤵
  PID:3520
- C:\Windows\System\OAUgHOk.exe
  C:\Windows\System\OAUgHOk.exe
  2⤵
  PID:3540
- C:\Windows\System\rvdluqG.exe
  C:\Windows\System\rvdluqG.exe
  2⤵
  PID:3556
- C:\Windows\System\HXMYHxF.exe
  C:\Windows\System\HXMYHxF.exe
  2⤵
  PID:3572
- C:\Windows\System\gcfbsMA.exe
  C:\Windows\System\gcfbsMA.exe
  2⤵
  PID:3588
- C:\Windows\System\vaGRdoM.exe
  C:\Windows\System\vaGRdoM.exe
  2⤵
  PID:3608
- C:\Windows\System\lKhPoby.exe
  C:\Windows\System\lKhPoby.exe
  2⤵
  PID:3624
- C:\Windows\System\vHrNDVu.exe
  C:\Windows\System\vHrNDVu.exe
  2⤵
  PID:3640
- C:\Windows\System\iCMJlsw.exe
  C:\Windows\System\iCMJlsw.exe
  2⤵
  PID:3656
- C:\Windows\System\yiwzHQC.exe
  C:\Windows\System\yiwzHQC.exe
  2⤵
  PID:3672
- C:\Windows\System\aciLdyf.exe
  C:\Windows\System\aciLdyf.exe
  2⤵
  PID:3688
- C:\Windows\System\sOvXhUh.exe
  C:\Windows\System\sOvXhUh.exe
  2⤵
  PID:3704
- C:\Windows\System\SLANObZ.exe
  C:\Windows\System\SLANObZ.exe
  2⤵
  PID:3720
- C:\Windows\System\CnreuCA.exe
  C:\Windows\System\CnreuCA.exe
  2⤵
  PID:3736
- C:\Windows\System\wzvfrHn.exe
  C:\Windows\System\wzvfrHn.exe
  2⤵
  PID:3752
- C:\Windows\System\UUqSslC.exe
  C:\Windows\System\UUqSslC.exe
  2⤵
  PID:3776
- C:\Windows\System\SQVacsm.exe
  C:\Windows\System\SQVacsm.exe
  2⤵
  PID:3792
- C:\Windows\System\JvZehIn.exe
  C:\Windows\System\JvZehIn.exe
  2⤵
  PID:3808
- C:\Windows\System\GPJWRIF.exe
  C:\Windows\System\GPJWRIF.exe
  2⤵
  PID:3824
- C:\Windows\System\mpJDnMN.exe
  C:\Windows\System\mpJDnMN.exe
  2⤵
  PID:3904
- C:\Windows\System\ymlhyXi.exe
  C:\Windows\System\ymlhyXi.exe
  2⤵
  PID:3920
- C:\Windows\System\dApWTHS.exe
  C:\Windows\System\dApWTHS.exe
  2⤵
  PID:3936
- C:\Windows\System\GKMqkjb.exe
  C:\Windows\System\GKMqkjb.exe
  2⤵
  PID:3952
- C:\Windows\System\hwiYiER.exe
  C:\Windows\System\hwiYiER.exe
  2⤵
  PID:3968
- C:\Windows\System\wMbIuRL.exe
  C:\Windows\System\wMbIuRL.exe
  2⤵
  PID:3988
- C:\Windows\System\cRFMLtZ.exe
  C:\Windows\System\cRFMLtZ.exe
  2⤵
  PID:4012
- C:\Windows\System\CWBAzrk.exe
  C:\Windows\System\CWBAzrk.exe
  2⤵
  PID:4032
- C:\Windows\System\bCpnOpG.exe
  C:\Windows\System\bCpnOpG.exe
  2⤵
  PID:4048
- C:\Windows\System\LYQSoWR.exe
  C:\Windows\System\LYQSoWR.exe
  2⤵
  PID:4064
- C:\Windows\System\RIWZXCi.exe
  C:\Windows\System\RIWZXCi.exe
  2⤵
  PID:4080
- C:\Windows\System\KssYEqw.exe
  C:\Windows\System\KssYEqw.exe
  2⤵
  PID:2676
- C:\Windows\System\gpiSiOR.exe
  C:\Windows\System\gpiSiOR.exe
  2⤵
  PID:1260
- C:\Windows\System\uPLmmQh.exe
  C:\Windows\System\uPLmmQh.exe
  2⤵
  PID:944
- C:\Windows\System\lBuqKSd.exe
  C:\Windows\System\lBuqKSd.exe
  2⤵
  PID:1524
- C:\Windows\System\OaEriEm.exe
  C:\Windows\System\OaEriEm.exe
  2⤵
  PID:3096
- C:\Windows\System\XvULgFy.exe
  C:\Windows\System\XvULgFy.exe
  2⤵
  PID:3136
- C:\Windows\System\hhHoafE.exe
  C:\Windows\System\hhHoafE.exe
  2⤵
  PID:3204
- C:\Windows\System\lzRuyFm.exe
  C:\Windows\System\lzRuyFm.exe
  2⤵
  PID:1568
- C:\Windows\System\XBNnlMU.exe
  C:\Windows\System\XBNnlMU.exe
  2⤵
  PID:3304
- C:\Windows\System\CyLuYth.exe
  C:\Windows\System\CyLuYth.exe
  2⤵
  PID:3372
- C:\Windows\System\TKHVRqm.exe
  C:\Windows\System\TKHVRqm.exe
  2⤵
  PID:3432
- C:\Windows\System\psDdgDT.exe
  C:\Windows\System\psDdgDT.exe
  2⤵
  PID:3268
- C:\Windows\System\mMuDVbi.exe
  C:\Windows\System\mMuDVbi.exe
  2⤵
  PID:3496
- C:\Windows\System\woXDcVr.exe
  C:\Windows\System\woXDcVr.exe
  2⤵
  PID:3564
- C:\Windows\System\kBRgDsc.exe
  C:\Windows\System\kBRgDsc.exe
  2⤵
  PID:1808
- C:\Windows\System\FmlHwIe.exe
  C:\Windows\System\FmlHwIe.exe
  2⤵
  PID:1928
- C:\Windows\System\HKEgYjP.exe
  C:\Windows\System\HKEgYjP.exe
  2⤵
  PID:3600
- C:\Windows\System\qalmSmL.exe
  C:\Windows\System\qalmSmL.exe
  2⤵
  PID:3696
- C:\Windows\System\fUWxEhj.exe
  C:\Windows\System\fUWxEhj.exe
  2⤵
  PID:3604
- C:\Windows\System\fMHTrIX.exe
  C:\Windows\System\fMHTrIX.exe
  2⤵
  PID:1704
- C:\Windows\System\AKBEgdG.exe
  C:\Windows\System\AKBEgdG.exe
  2⤵
  PID:1800
- C:\Windows\System\MqXUzci.exe
  C:\Windows\System\MqXUzci.exe
  2⤵
  PID:1036
- C:\Windows\System\pYNePGg.exe
  C:\Windows\System\pYNePGg.exe
  2⤵
  PID:3764
- C:\Windows\System\TbEksVS.exe
  C:\Windows\System\TbEksVS.exe
  2⤵
  PID:956
- C:\Windows\System\DzCdOOl.exe
  C:\Windows\System\DzCdOOl.exe
  2⤵
  PID:2120
- C:\Windows\System\MHzszJo.exe
  C:\Windows\System\MHzszJo.exe
  2⤵
  PID:2264
- C:\Windows\System\ZnpVmxF.exe
  C:\Windows\System\ZnpVmxF.exe
  2⤵
  PID:2756
- C:\Windows\System\yBZjDWK.exe
  C:\Windows\System\yBZjDWK.exe
  2⤵
  PID:3800
- C:\Windows\System\VYIMokJ.exe
  C:\Windows\System\VYIMokJ.exe
  2⤵
  PID:3840
- C:\Windows\System\BmiCPrY.exe
  C:\Windows\System\BmiCPrY.exe
  2⤵
  PID:3860
- C:\Windows\System\icYeKoe.exe
  C:\Windows\System\icYeKoe.exe
  2⤵
  PID:3928
- C:\Windows\System\wKHWNGc.exe
  C:\Windows\System\wKHWNGc.exe
  2⤵
  PID:3964
- C:\Windows\System\QgobNkV.exe
  C:\Windows\System\QgobNkV.exe
  2⤵
  PID:4008
- C:\Windows\System\DjEmRjj.exe
  C:\Windows\System\DjEmRjj.exe
  2⤵
  PID:4072
- C:\Windows\System\mMccyuL.exe
  C:\Windows\System\mMccyuL.exe
  2⤵
  PID:1768
- C:\Windows\System\aoCvoGs.exe
  C:\Windows\System\aoCvoGs.exe
  2⤵
  PID:3236
- C:\Windows\System\ScPrjvh.exe
  C:\Windows\System\ScPrjvh.exe
  2⤵
  PID:3464
- C:\Windows\System\HIvpuUW.exe
  C:\Windows\System\HIvpuUW.exe
  2⤵
  PID:824
- C:\Windows\System\vGYDFLh.exe
  C:\Windows\System\vGYDFLh.exe
  2⤵
  PID:3532
- C:\Windows\System\oryMMyZ.exe
  C:\Windows\System\oryMMyZ.exe
  2⤵
  PID:3668
- C:\Windows\System\NzjMMDF.exe
  C:\Windows\System\NzjMMDF.exe
  2⤵
  PID:1340
- C:\Windows\System\POJFcdG.exe
  C:\Windows\System\POJFcdG.exe
  2⤵
  PID:1772
- C:\Windows\System\vVBHyan.exe
  C:\Windows\System\vVBHyan.exe
  2⤵
  PID:2780
- C:\Windows\System\PUqaBeY.exe
  C:\Windows\System\PUqaBeY.exe
  2⤵
  PID:3856
- C:\Windows\System\qONroEY.exe
  C:\Windows\System\qONroEY.exe
  2⤵
  PID:2456
- C:\Windows\System\klQwRHb.exe
  C:\Windows\System\klQwRHb.exe
  2⤵
  PID:1140
- C:\Windows\System\ZQkuaQG.exe
  C:\Windows\System\ZQkuaQG.exe
  2⤵
  PID:1668
- C:\Windows\System\AsSNuLy.exe
  C:\Windows\System\AsSNuLy.exe
  2⤵
  PID:2564
- C:\Windows\System\DHXazcF.exe
  C:\Windows\System\DHXazcF.exe
  2⤵
  PID:2416
- C:\Windows\System\toZgmWx.exe
  C:\Windows\System\toZgmWx.exe
  2⤵
  PID:4132
- C:\Windows\System\jLGbksv.exe
  C:\Windows\System\jLGbksv.exe
  2⤵
  PID:4180
- C:\Windows\System\YpFBedz.exe
  C:\Windows\System\YpFBedz.exe
  2⤵
  PID:4200
- C:\Windows\System\peeQeFG.exe
  C:\Windows\System\peeQeFG.exe
  2⤵
  PID:4216
- C:\Windows\System\klxqNZJ.exe
  C:\Windows\System\klxqNZJ.exe
  2⤵
  PID:4232
- C:\Windows\System\QUYkHlp.exe
  C:\Windows\System\QUYkHlp.exe
  2⤵
  PID:4248
- C:\Windows\System\pvPbeiu.exe
  C:\Windows\System\pvPbeiu.exe
  2⤵
  PID:4264
- C:\Windows\System\MSsUeQf.exe
  C:\Windows\System\MSsUeQf.exe
  2⤵
  PID:4280
- C:\Windows\System\rCxutTq.exe
  C:\Windows\System\rCxutTq.exe
  2⤵
  PID:4296
- C:\Windows\System\GILVTFR.exe
  C:\Windows\System\GILVTFR.exe
  2⤵
  PID:4312
- C:\Windows\System\BaWoJBE.exe
  C:\Windows\System\BaWoJBE.exe
  2⤵
  PID:4328
- C:\Windows\System\hapXQoo.exe
  C:\Windows\System\hapXQoo.exe
  2⤵
  PID:4348
- C:\Windows\System\NDnlxdu.exe
  C:\Windows\System\NDnlxdu.exe
  2⤵
  PID:4364
- C:\Windows\System\VXrblkq.exe
  C:\Windows\System\VXrblkq.exe
  2⤵
  PID:4380
- C:\Windows\System\DBwPEqn.exe
  C:\Windows\System\DBwPEqn.exe
  2⤵
  PID:4396
- C:\Windows\System\FVnplgG.exe
  C:\Windows\System\FVnplgG.exe
  2⤵
  PID:4412
- C:\Windows\System\hkBaZkw.exe
  C:\Windows\System\hkBaZkw.exe
  2⤵
  PID:4640
- C:\Windows\System\UXNjwof.exe
  C:\Windows\System\UXNjwof.exe
  2⤵
  PID:4656
- C:\Windows\System\JvPvtFp.exe
  C:\Windows\System\JvPvtFp.exe
  2⤵
  PID:4676
- C:\Windows\System\nlxndIc.exe
  C:\Windows\System\nlxndIc.exe
  2⤵
  PID:4696
- C:\Windows\System\WZwVkpm.exe
  C:\Windows\System\WZwVkpm.exe
  2⤵
  PID:4712
- C:\Windows\System\jGeovPv.exe
  C:\Windows\System\jGeovPv.exe
  2⤵
  PID:4728
- C:\Windows\System\CwgzeYZ.exe
  C:\Windows\System\CwgzeYZ.exe
  2⤵
  PID:4788
- C:\Windows\System\ltILALc.exe
  C:\Windows\System\ltILALc.exe
  2⤵
  PID:4832
- C:\Windows\System\DupsbMR.exe
  C:\Windows\System\DupsbMR.exe
  2⤵
  PID:4924
- C:\Windows\System\TAsyhfG.exe
  C:\Windows\System\TAsyhfG.exe
  2⤵
  PID:4948
- C:\Windows\System\AmKPWaA.exe
  C:\Windows\System\AmKPWaA.exe
  2⤵
  PID:4964
- C:\Windows\System\uSKrnNm.exe
  C:\Windows\System\uSKrnNm.exe
  2⤵
  PID:4992
- C:\Windows\System\eVzYmAu.exe
  C:\Windows\System\eVzYmAu.exe
  2⤵
  PID:5012
- C:\Windows\System\ckxzNMC.exe
  C:\Windows\System\ckxzNMC.exe
  2⤵
  PID:5028
- C:\Windows\System\dBoxwpt.exe
  C:\Windows\System\dBoxwpt.exe
  2⤵
  PID:5052
- C:\Windows\System\CCiMYmp.exe
  C:\Windows\System\CCiMYmp.exe
  2⤵
  PID:5072
- C:\Windows\System\iRRYMTM.exe
  C:\Windows\System\iRRYMTM.exe
  2⤵
  PID:5088
- C:\Windows\System\TvaXcDP.exe
  C:\Windows\System\TvaXcDP.exe
  2⤵
  PID:5104
- C:\Windows\System\TkawFTC.exe
  C:\Windows\System\TkawFTC.exe
  2⤵
  PID:1164
- C:\Windows\System\UDpLHZA.exe
  C:\Windows\System\UDpLHZA.exe
  2⤵
  PID:2420
- C:\Windows\System\efhkySN.exe
  C:\Windows\System\efhkySN.exe
  2⤵
  PID:1984
- C:\Windows\System\imCafJd.exe
  C:\Windows\System\imCafJd.exe
  2⤵
  PID:4040
- C:\Windows\System\HYdyMWd.exe
  C:\Windows\System\HYdyMWd.exe
  2⤵
  PID:4104
- C:\Windows\System\GyGCsaj.exe
  C:\Windows\System\GyGCsaj.exe
  2⤵
  PID:4120
- C:\Windows\System\fzaxYbZ.exe
  C:\Windows\System\fzaxYbZ.exe
  2⤵
  PID:3368
- C:\Windows\System\EmlsKpF.exe
  C:\Windows\System\EmlsKpF.exe
  2⤵
  PID:4320
- C:\Windows\System\FmkmhKT.exe
  C:\Windows\System\FmkmhKT.exe
  2⤵
  PID:4360
- C:\Windows\System\PLigRuf.exe
  C:\Windows\System\PLigRuf.exe
  2⤵
  PID:2796
- C:\Windows\System\JyYYIXp.exe
  C:\Windows\System\JyYYIXp.exe
  2⤵
  PID:2480
- C:\Windows\System\ZEuAxNn.exe
  C:\Windows\System\ZEuAxNn.exe
  2⤵
  PID:4436
- C:\Windows\System\wmaTJan.exe
  C:\Windows\System\wmaTJan.exe
  2⤵
  PID:4452
- C:\Windows\System\fmaaGKT.exe
  C:\Windows\System\fmaaGKT.exe
  2⤵
  PID:4468
- C:\Windows\System\XVkhcac.exe
  C:\Windows\System\XVkhcac.exe
  2⤵
  PID:4484
- C:\Windows\System\DNbOIMk.exe
  C:\Windows\System\DNbOIMk.exe
  2⤵
  PID:2864
- C:\Windows\System\zjiqtIU.exe
  C:\Windows\System\zjiqtIU.exe
  2⤵
  PID:4508
- C:\Windows\System\oFYdPOw.exe
  C:\Windows\System\oFYdPOw.exe
  2⤵
  PID:4516
- C:\Windows\System\CiVMKaG.exe
  C:\Windows\System\CiVMKaG.exe
  2⤵
  PID:4540
- C:\Windows\System\InwjPYj.exe
  C:\Windows\System\InwjPYj.exe
  2⤵
  PID:1592
- C:\Windows\System\xwzCFLg.exe
  C:\Windows\System\xwzCFLg.exe
  2⤵
  PID:4564
- C:\Windows\System\cCuPCiW.exe
  C:\Windows\System\cCuPCiW.exe
  2⤵
  PID:4628
- C:\Windows\System\xXCekzS.exe
  C:\Windows\System\xXCekzS.exe
  2⤵
  PID:4428
- C:\Windows\System\xyqTgeg.exe
  C:\Windows\System\xyqTgeg.exe
  2⤵
  PID:4672
- C:\Windows\System\EuKhSWn.exe
  C:\Windows\System\EuKhSWn.exe
  2⤵
  PID:2836
- C:\Windows\System\xEqTeTK.exe
  C:\Windows\System\xEqTeTK.exe
  2⤵
  PID:3684
- C:\Windows\System\ARBAzSo.exe
  C:\Windows\System\ARBAzSo.exe
  2⤵
  PID:4736
- C:\Windows\System\dQDCPbZ.exe
  C:\Windows\System\dQDCPbZ.exe
  2⤵
  PID:4168
- C:\Windows\System\KiRKVwq.exe
  C:\Windows\System\KiRKVwq.exe
  2⤵
  PID:4772
- C:\Windows\System\SrvmUtu.exe
  C:\Windows\System\SrvmUtu.exe
  2⤵
  PID:3192
- C:\Windows\System\MaWPUMM.exe
  C:\Windows\System\MaWPUMM.exe
  2⤵
  PID:3288
- C:\Windows\System\fEUqVQL.exe
  C:\Windows\System\fEUqVQL.exe
  2⤵
  PID:3324
- C:\Windows\System\ZxMoSHG.exe
  C:\Windows\System\ZxMoSHG.exe
  2⤵
  PID:3548
- C:\Windows\System\elqKzQI.exe
  C:\Windows\System\elqKzQI.exe
  2⤵
  PID:3616
- C:\Windows\System\OnCCtUH.exe
  C:\Windows\System\OnCCtUH.exe
  2⤵
  PID:3716
- C:\Windows\System\zueTXVJ.exe
  C:\Windows\System\zueTXVJ.exe
  2⤵
  PID:4020
- C:\Windows\System\skWOSZz.exe
  C:\Windows\System\skWOSZz.exe
  2⤵
  PID:4060
- C:\Windows\System\pLYPPMr.exe
  C:\Windows\System\pLYPPMr.exe
  2⤵
  PID:2976
- C:\Windows\System\afGIIPI.exe
  C:\Windows\System\afGIIPI.exe
  2⤵
  PID:3404
- C:\Windows\System\PoTLKcp.exe
  C:\Windows\System\PoTLKcp.exe
  2⤵
  PID:3596
- C:\Windows\System\vSCXHWj.exe
  C:\Windows\System\vSCXHWj.exe
  2⤵
  PID:2592
- C:\Windows\System\msQOhKA.exe
  C:\Windows\System\msQOhKA.exe
  2⤵
  PID:2288
- C:\Windows\System\fGlqtJo.exe
  C:\Windows\System\fGlqtJo.exe
  2⤵
  PID:3868
- C:\Windows\System\xBQHdnc.exe
  C:\Windows\System\xBQHdnc.exe
  2⤵
  PID:3896
- C:\Windows\System\BXnKjZj.exe
  C:\Windows\System\BXnKjZj.exe
  2⤵
  PID:2044
- C:\Windows\System\tjgNUEM.exe
  C:\Windows\System\tjgNUEM.exe
  2⤵
  PID:1100
- C:\Windows\System\lxmFQzn.exe
  C:\Windows\System\lxmFQzn.exe
  2⤵
  PID:604
- C:\Windows\System\NhTpjoz.exe
  C:\Windows\System\NhTpjoz.exe
  2⤵
  PID:4164
- C:\Windows\System\LEGQQyu.exe
  C:\Windows\System\LEGQQyu.exe
  2⤵
  PID:4244
- C:\Windows\System\BzVzbVw.exe
  C:\Windows\System\BzVzbVw.exe
  2⤵
  PID:4308
- C:\Windows\System\BAWdNxe.exe
  C:\Windows\System\BAWdNxe.exe
  2⤵
  PID:4376
- C:\Windows\System\zTfpELL.exe
  C:\Windows\System\zTfpELL.exe
  2⤵
  PID:2268
- C:\Windows\System\uenJrGM.exe
  C:\Windows\System\uenJrGM.exe
  2⤵
  PID:4784
- C:\Windows\System\OSvIkCT.exe
  C:\Windows\System\OSvIkCT.exe
  2⤵
  PID:4848
- C:\Windows\System\qdxuRZx.exe
  C:\Windows\System\qdxuRZx.exe
  2⤵
  PID:4872
- C:\Windows\System\WrqlbrI.exe
  C:\Windows\System\WrqlbrI.exe
  2⤵
  PID:4888
- C:\Windows\System\BAUuveB.exe
  C:\Windows\System\BAUuveB.exe
  2⤵
  PID:4908
- C:\Windows\System\nrpcIMm.exe
  C:\Windows\System\nrpcIMm.exe
  2⤵
  PID:688
- C:\Windows\System\EAhvjfE.exe
  C:\Windows\System\EAhvjfE.exe
  2⤵
  PID:4960
- C:\Windows\System\JxbFsdR.exe
  C:\Windows\System\JxbFsdR.exe
  2⤵
  PID:4940
- C:\Windows\System\ZWcVZFu.exe
  C:\Windows\System\ZWcVZFu.exe
  2⤵
  PID:5048
- C:\Windows\System\UfYZupd.exe
  C:\Windows\System\UfYZupd.exe
  2⤵
  PID:5044
- C:\Windows\System\QzEzSCR.exe
  C:\Windows\System\QzEzSCR.exe
  2⤵
  PID:5112
- C:\Windows\System\zoeTbEi.exe
  C:\Windows\System\zoeTbEi.exe
  2⤵
  PID:2968
- C:\Windows\System\oqVxEgi.exe
  C:\Windows\System\oqVxEgi.exe
  2⤵
  PID:4256
- C:\Windows\System\eXcsejj.exe
  C:\Windows\System\eXcsejj.exe
  2⤵
  PID:4356
- C:\Windows\System\oVJVTjb.exe
  C:\Windows\System\oVJVTjb.exe
  2⤵
  PID:4476
- C:\Windows\System\EzNBvlX.exe
  C:\Windows\System\EzNBvlX.exe
  2⤵
  PID:4500
- C:\Windows\System\CVGqZKq.exe
  C:\Windows\System\CVGqZKq.exe
  2⤵
  PID:4528
- C:\Windows\System\RVbcbRf.exe
  C:\Windows\System\RVbcbRf.exe
  2⤵
  PID:4556
- C:\Windows\System\bKDhsVv.exe
  C:\Windows\System\bKDhsVv.exe
  2⤵
  PID:1500
- C:\Windows\System\TFOaUfb.exe
  C:\Windows\System\TFOaUfb.exe
  2⤵
  PID:5060
- C:\Windows\System\DadKPgI.exe
  C:\Windows\System\DadKPgI.exe
  2⤵
  PID:2824
- C:\Windows\System\atfvCJN.exe
  C:\Windows\System\atfvCJN.exe
  2⤵
  PID:4112
- C:\Windows\System\ZzOHXTg.exe
  C:\Windows\System\ZzOHXTg.exe
  2⤵
  PID:4392
- C:\Windows\System\hAujful.exe
  C:\Windows\System\hAujful.exe
  2⤵
  PID:4460
- C:\Windows\System\faZNjVQ.exe
  C:\Windows\System\faZNjVQ.exe
  2⤵
  PID:2748
- C:\Windows\System\TJorWog.exe
  C:\Windows\System\TJorWog.exe
  2⤵
  PID:4420
- C:\Windows\System\mmDFPFe.exe
  C:\Windows\System\mmDFPFe.exe
  2⤵
  PID:4616
- C:\Windows\System\EXUhwhk.exe
  C:\Windows\System\EXUhwhk.exe
  2⤵
  PID:4624
- C:\Windows\System\aVJtdzq.exe
  C:\Windows\System\aVJtdzq.exe
  2⤵
  PID:2636
- C:\Windows\System\zQfTIVb.exe
  C:\Windows\System\zQfTIVb.exe
  2⤵
  PID:2816
- C:\Windows\System\NtdhATt.exe
  C:\Windows\System\NtdhATt.exe
  2⤵
  PID:3584
- C:\Windows\System\DzbUEpJ.exe
  C:\Windows\System\DzbUEpJ.exe
  2⤵
  PID:3580
- C:\Windows\System\RXIuUfK.exe
  C:\Windows\System\RXIuUfK.exe
  2⤵
  PID:4760
- C:\Windows\System\XleoaQK.exe
  C:\Windows\System\XleoaQK.exe
  2⤵
  PID:3256
- C:\Windows\System\FgKWdyn.exe
  C:\Windows\System\FgKWdyn.exe
  2⤵
  PID:3680
- C:\Windows\System\qPQZJmc.exe
  C:\Windows\System\qPQZJmc.exe
  2⤵
  PID:4088
- C:\Windows\System\YTJYLvW.exe
  C:\Windows\System\YTJYLvW.exe
  2⤵
  PID:3172
- C:\Windows\System\RVOgbDR.exe
  C:\Windows\System\RVOgbDR.exe
  2⤵
  PID:3400
- C:\Windows\System\jujDakL.exe
  C:\Windows\System\jujDakL.exe
  2⤵
  PID:2084
- C:\Windows\System\PPsXHzI.exe
  C:\Windows\System\PPsXHzI.exe
  2⤵
  PID:3832
- C:\Windows\System\zldBBbF.exe
  C:\Windows\System\zldBBbF.exe
  2⤵
  PID:4140
- C:\Windows\System\AJDZvVp.exe
  C:\Windows\System\AJDZvVp.exe
  2⤵
  PID:2708
- C:\Windows\System\xkmFKrc.exe
  C:\Windows\System\xkmFKrc.exe
  2⤵
  PID:3528
- C:\Windows\System\fVXbxrd.exe
  C:\Windows\System\fVXbxrd.exe
  2⤵
  PID:4212
- C:\Windows\System\oxFTymy.exe
  C:\Windows\System\oxFTymy.exe
  2⤵
  PID:2812
- C:\Windows\System\AOQQDUX.exe
  C:\Windows\System\AOQQDUX.exe
  2⤵
  PID:4372
- C:\Windows\System\kNAtjnY.exe
  C:\Windows\System\kNAtjnY.exe
  2⤵
  PID:4844
- C:\Windows\System\BfKvzGB.exe
  C:\Windows\System\BfKvzGB.exe
  2⤵
  PID:2384
- C:\Windows\System\gKZcMGU.exe
  C:\Windows\System\gKZcMGU.exe
  2⤵
  PID:4796
- C:\Windows\System\iYVdwnw.exe
  C:\Windows\System\iYVdwnw.exe
  2⤵
  PID:704
- C:\Windows\System\DMDXGIG.exe
  C:\Windows\System\DMDXGIG.exe
  2⤵
  PID:4868
- C:\Windows\System\UaRMvyR.exe
  C:\Windows\System\UaRMvyR.exe
  2⤵
  PID:4972
- C:\Windows\System\bWFPJIW.exe
  C:\Windows\System\bWFPJIW.exe
  2⤵
  PID:784
- C:\Windows\System\ESSOZhY.exe
  C:\Windows\System\ESSOZhY.exe
  2⤵
  PID:2868
- C:\Windows\System\cBsQeEd.exe
  C:\Windows\System\cBsQeEd.exe
  2⤵
  PID:2340
- C:\Windows\System\uaAkpTa.exe
  C:\Windows\System\uaAkpTa.exe
  2⤵
  PID:4188
- C:\Windows\System\qjKIAsu.exe
  C:\Windows\System\qjKIAsu.exe
  2⤵
  PID:2772
- C:\Windows\System\UukfIoY.exe
  C:\Windows\System\UukfIoY.exe
  2⤵
  PID:3352
- C:\Windows\System\SFmVGYT.exe
  C:\Windows\System\SFmVGYT.exe
  2⤵
  PID:1992
- C:\Windows\System\BjpGQOu.exe
  C:\Windows\System\BjpGQOu.exe
  2⤵
  PID:1552
- C:\Windows\System\vrRleDb.exe
  C:\Windows\System\vrRleDb.exe
  2⤵
  PID:5024
- C:\Windows\System\ZsQfhDr.exe
  C:\Windows\System\ZsQfhDr.exe
  2⤵
  PID:4464
- C:\Windows\System\AArYszY.exe
  C:\Windows\System\AArYszY.exe
  2⤵
  PID:4548
- C:\Windows\System\hSTxlpo.exe
  C:\Windows\System\hSTxlpo.exe
  2⤵
  PID:300
- C:\Windows\System\WGSuzYl.exe
  C:\Windows\System\WGSuzYl.exe
  2⤵
  PID:4512
- C:\Windows\System\jcbpXLM.exe
  C:\Windows\System\jcbpXLM.exe
  2⤵
  PID:4584
- C:\Windows\System\ijslfaH.exe
  C:\Windows\System\ijslfaH.exe
  2⤵
  PID:3156
- C:\Windows\System\VHBqOKN.exe
  C:\Windows\System\VHBqOKN.exe
  2⤵
  PID:3160
- C:\Windows\System\HUQZgHX.exe
  C:\Windows\System\HUQZgHX.exe
  2⤵
  PID:4752
- C:\Windows\System\aciQGln.exe
  C:\Windows\System\aciQGln.exe
  2⤵
  PID:4000
- C:\Windows\System\FAfshgQ.exe
  C:\Windows\System\FAfshgQ.exe
  2⤵
  PID:4344
- C:\Windows\System\PODYWsQ.exe
  C:\Windows\System\PODYWsQ.exe
  2⤵
  PID:3512
- C:\Windows\System\MXQjkAa.exe
  C:\Windows\System\MXQjkAa.exe
  2⤵
  PID:3820
- C:\Windows\System\SSfReyz.exe
  C:\Windows\System\SSfReyz.exe
  2⤵
  PID:2840
- C:\Windows\System\PAiCjGr.exe
  C:\Windows\System\PAiCjGr.exe
  2⤵
  PID:4160
- C:\Windows\System\OWrCzQk.exe
  C:\Windows\System\OWrCzQk.exe
  2⤵
  PID:2280
- C:\Windows\System\IwReymH.exe
  C:\Windows\System\IwReymH.exe
  2⤵
  PID:1424
- C:\Windows\System\tWegIde.exe
  C:\Windows\System\tWegIde.exe
  2⤵
  PID:1836
- C:\Windows\System\Ckwxlnw.exe
  C:\Windows\System\Ckwxlnw.exe
  2⤵
  PID:1496
- C:\Windows\System\sEalvvS.exe
  C:\Windows\System\sEalvvS.exe
  2⤵
  PID:4144
- C:\Windows\System\BIAsQFR.exe
  C:\Windows\System\BIAsQFR.exe
  2⤵
  PID:4840
- C:\Windows\System\IRMhLYW.exe
  C:\Windows\System\IRMhLYW.exe
  2⤵
  PID:4860
- C:\Windows\System\JwuZAxV.exe
  C:\Windows\System\JwuZAxV.exe
  2⤵
  PID:4944
- C:\Windows\System\CFvJsFg.exe
  C:\Windows\System\CFvJsFg.exe
  2⤵
  PID:960
- C:\Windows\System\ROtOtim.exe
  C:\Windows\System\ROtOtim.exe
  2⤵
  PID:580
- C:\Windows\System\viqGutw.exe
  C:\Windows\System\viqGutw.exe
  2⤵
  PID:2768
- C:\Windows\System\UhCFLxW.exe
  C:\Windows\System\UhCFLxW.exe
  2⤵
  PID:2092
- C:\Windows\System\bGeWthv.exe
  C:\Windows\System\bGeWthv.exe
  2⤵
  PID:1200
- C:\Windows\System\egoCuSA.exe
  C:\Windows\System\egoCuSA.exe
  2⤵
  PID:1776
- C:\Windows\System\VcbCDxf.exe
  C:\Windows\System\VcbCDxf.exe
  2⤵
  PID:4604
- C:\Windows\System\picRVvs.exe
  C:\Windows\System\picRVvs.exe
  2⤵
  PID:5000
- C:\Windows\System\AWlHBpy.exe
  C:\Windows\System\AWlHBpy.exe
  2⤵
  PID:4600
- C:\Windows\System\fvSgZWr.exe
  C:\Windows\System\fvSgZWr.exe
  2⤵
  PID:3884
- C:\Windows\System\HLNpsWk.exe
  C:\Windows\System\HLNpsWk.exe
  2⤵
  PID:1020
- C:\Windows\System\DqNcwfi.exe
  C:\Windows\System\DqNcwfi.exe
  2⤵
  PID:2936
- C:\Windows\System\QGcIIcY.exe
  C:\Windows\System\QGcIIcY.exe
  2⤵
  PID:2068
- C:\Windows\System\JfOfsuq.exe
  C:\Windows\System\JfOfsuq.exe
  2⤵
  PID:4444
- C:\Windows\System\ZezHHFN.exe
  C:\Windows\System\ZezHHFN.exe
  2⤵
  PID:4524
- C:\Windows\System\yjYrAKd.exe
  C:\Windows\System\yjYrAKd.exe
  2⤵
  PID:4288
- C:\Windows\System\qKjtXUi.exe
  C:\Windows\System\qKjtXUi.exe
  2⤵
  PID:1032
- C:\Windows\System\VziLAMC.exe
  C:\Windows\System\VziLAMC.exe
  2⤵
  PID:2684
- C:\Windows\System\ipdocAU.exe
  C:\Windows\System\ipdocAU.exe
  2⤵
  PID:4152
- C:\Windows\System\aNxvDGR.exe
  C:\Windows\System\aNxvDGR.exe
  2⤵
  PID:5008
- C:\Windows\System\qFcYfob.exe
  C:\Windows\System\qFcYfob.exe
  2⤵
  PID:2680
- C:\Windows\System\oBSfWmW.exe
  C:\Windows\System\oBSfWmW.exe
  2⤵
  PID:5096
- C:\Windows\System\qcYNjYn.exe
  C:\Windows\System\qcYNjYn.exe
  2⤵
  PID:1692
- C:\Windows\System\XJlsHPM.exe
  C:\Windows\System\XJlsHPM.exe
  2⤵
  PID:4724
- C:\Windows\System\uXymuci.exe
  C:\Windows\System\uXymuci.exe
  2⤵
  PID:5116
- C:\Windows\System\gVxeaeH.exe
  C:\Windows\System\gVxeaeH.exe
  2⤵
  PID:3916
- C:\Windows\System\APFafpL.exe
  C:\Windows\System\APFafpL.exe
  2⤵
  PID:4572
- C:\Windows\System\BhyGqFo.exe
  C:\Windows\System\BhyGqFo.exe
  2⤵
  PID:4904
- C:\Windows\System\DjtHPsO.exe
  C:\Windows\System\DjtHPsO.exe
  2⤵
  PID:5124
- C:\Windows\System\CVJHwXz.exe
  C:\Windows\System\CVJHwXz.exe
  2⤵
  PID:5140
- C:\Windows\System\zXTkEpR.exe
  C:\Windows\System\zXTkEpR.exe
  2⤵
  PID:5156
- C:\Windows\System\GXqRTTJ.exe
  C:\Windows\System\GXqRTTJ.exe
  2⤵
  PID:5172
- C:\Windows\System\lNjPtIb.exe
  C:\Windows\System\lNjPtIb.exe
  2⤵
  PID:5188
- C:\Windows\System\pRGnLzS.exe
  C:\Windows\System\pRGnLzS.exe
  2⤵
  PID:5212
- C:\Windows\System\cmyZBSy.exe
  C:\Windows\System\cmyZBSy.exe
  2⤵
  PID:5232
- C:\Windows\System\hKcZVOo.exe
  C:\Windows\System\hKcZVOo.exe
  2⤵
  PID:5248
- C:\Windows\System\xGLZRwV.exe
  C:\Windows\System\xGLZRwV.exe
  2⤵
  PID:5264
- C:\Windows\System\bDSYGZP.exe
  C:\Windows\System\bDSYGZP.exe
  2⤵
  PID:5280
- C:\Windows\System\PXeIuiq.exe
  C:\Windows\System\PXeIuiq.exe
  2⤵
  PID:5296
- C:\Windows\System\MpRpMuA.exe
  C:\Windows\System\MpRpMuA.exe
  2⤵
  PID:5312
- C:\Windows\System\hrVlScM.exe
  C:\Windows\System\hrVlScM.exe
  2⤵
  PID:5328
- C:\Windows\System\VKZqHxN.exe
  C:\Windows\System\VKZqHxN.exe
  2⤵
  PID:5344
- C:\Windows\System\mFCAneg.exe
  C:\Windows\System\mFCAneg.exe
  2⤵
  PID:5360
- C:\Windows\System\yluoldc.exe
  C:\Windows\System\yluoldc.exe
  2⤵
  PID:5376
- C:\Windows\System\UtGGadV.exe
  C:\Windows\System\UtGGadV.exe
  2⤵
  PID:5396
- C:\Windows\System\aaaFokF.exe
  C:\Windows\System\aaaFokF.exe
  2⤵
  PID:5412
- C:\Windows\System\PPgvGgg.exe
  C:\Windows\System\PPgvGgg.exe
  2⤵
  PID:5428
- C:\Windows\System\YICjRRB.exe
  C:\Windows\System\YICjRRB.exe
  2⤵
  PID:5444
- C:\Windows\System\LkEuXMZ.exe
  C:\Windows\System\LkEuXMZ.exe
  2⤵
  PID:5460
- C:\Windows\System\nErkcuR.exe
  C:\Windows\System\nErkcuR.exe
  2⤵
  PID:5476
- C:\Windows\System\uzaRjnQ.exe
  C:\Windows\System\uzaRjnQ.exe
  2⤵
  PID:5492
- C:\Windows\System\CdObgFH.exe
  C:\Windows\System\CdObgFH.exe
  2⤵
  PID:5508
- C:\Windows\System\UCmLDfg.exe
  C:\Windows\System\UCmLDfg.exe
  2⤵
  PID:5528
- C:\Windows\System\LWagoWh.exe
  C:\Windows\System\LWagoWh.exe
  2⤵
  PID:5544
- C:\Windows\System\YlDmDCc.exe
  C:\Windows\System\YlDmDCc.exe
  2⤵
  PID:5560
- C:\Windows\System\YdGUovy.exe
  C:\Windows\System\YdGUovy.exe
  2⤵
  PID:5576
- C:\Windows\System\ZZQGJgU.exe
  C:\Windows\System\ZZQGJgU.exe
  2⤵
  PID:5592
- C:\Windows\System\EkFfTIk.exe
  C:\Windows\System\EkFfTIk.exe
  2⤵
  PID:5608
- C:\Windows\System\KwmcBJm.exe
  C:\Windows\System\KwmcBJm.exe
  2⤵
  PID:5624
- C:\Windows\System\rgBnFjL.exe
  C:\Windows\System\rgBnFjL.exe
  2⤵
  PID:5640
- C:\Windows\System\uPGVqxl.exe
  C:\Windows\System\uPGVqxl.exe
  2⤵
  PID:5656
- C:\Windows\System\sTuUoAY.exe
  C:\Windows\System\sTuUoAY.exe
  2⤵
  PID:5672
- C:\Windows\System\ODKbetI.exe
  C:\Windows\System\ODKbetI.exe
  2⤵
  PID:5692
- C:\Windows\System\kFFmEiw.exe
  C:\Windows\System\kFFmEiw.exe
  2⤵
  PID:5708
- C:\Windows\System\IamXJin.exe
  C:\Windows\System\IamXJin.exe
  2⤵
  PID:5724
- C:\Windows\System\WYUiOeo.exe
  C:\Windows\System\WYUiOeo.exe
  2⤵
  PID:5740
- C:\Windows\System\mCPeSqk.exe
  C:\Windows\System\mCPeSqk.exe
  2⤵
  PID:5764
- C:\Windows\System\DoihpPj.exe
  C:\Windows\System\DoihpPj.exe
  2⤵
  PID:5780
- C:\Windows\System\zwnJmZq.exe
  C:\Windows\System\zwnJmZq.exe
  2⤵
  PID:5796
- C:\Windows\System\pEIdjja.exe
  C:\Windows\System\pEIdjja.exe
  2⤵
  PID:5812
- C:\Windows\System\ghHDeut.exe
  C:\Windows\System\ghHDeut.exe
  2⤵
  PID:5828
- C:\Windows\System\fOMlrJX.exe
  C:\Windows\System\fOMlrJX.exe
  2⤵
  PID:5852
- C:\Windows\System\gSOzpEv.exe
  C:\Windows\System\gSOzpEv.exe
  2⤵
  PID:5872
- C:\Windows\System\BvyTRoq.exe
  C:\Windows\System\BvyTRoq.exe
  2⤵
  PID:5892
- C:\Windows\System\tZGLPQZ.exe
  C:\Windows\System\tZGLPQZ.exe
  2⤵
  PID:5908
- C:\Windows\System\homypSy.exe
  C:\Windows\System\homypSy.exe
  2⤵
  PID:5924
- C:\Windows\System\KcQJdcT.exe
  C:\Windows\System\KcQJdcT.exe
  2⤵
  PID:5940
- C:\Windows\System\EosHWEt.exe
  C:\Windows\System\EosHWEt.exe
  2⤵
  PID:4692
- C:\Windows\System\oYUoZxC.exe
  C:\Windows\System\oYUoZxC.exe
  2⤵
  PID:5152
- C:\Windows\System\lOxLQHj.exe
  C:\Windows\System\lOxLQHj.exe
  2⤵
  PID:4988
- C:\Windows\System\zxrkaKn.exe
  C:\Windows\System\zxrkaKn.exe
  2⤵
  PID:3880
- C:\Windows\System\ceWCYXr.exe
  C:\Windows\System\ceWCYXr.exe
  2⤵
  PID:4176
- C:\Windows\System\NQeFluX.exe
  C:\Windows\System\NQeFluX.exe
  2⤵
  PID:3388
- C:\Windows\System\ZkURZyd.exe
  C:\Windows\System\ZkURZyd.exe
  2⤵
  PID:5132
- C:\Windows\System\PbSRrOr.exe
  C:\Windows\System\PbSRrOr.exe
  2⤵
  PID:3420
- C:\Windows\System\puXWqAD.exe
  C:\Windows\System\puXWqAD.exe
  2⤵
  PID:5260
- C:\Windows\System\bxWUViP.exe
  C:\Windows\System\bxWUViP.exe
  2⤵
  PID:5136
- C:\Windows\System\zlDPvtl.exe
  C:\Windows\System\zlDPvtl.exe
  2⤵
  PID:5200
- C:\Windows\System\VnxgMJC.exe
  C:\Windows\System\VnxgMJC.exe
  2⤵
  PID:5276
- C:\Windows\System\GvsmpIx.exe
  C:\Windows\System\GvsmpIx.exe
  2⤵
  PID:5324
- C:\Windows\System\GyAFqDb.exe
  C:\Windows\System\GyAFqDb.exe
  2⤵
  PID:5336
- C:\Windows\System\WGVcrCP.exe
  C:\Windows\System\WGVcrCP.exe
  2⤵
  PID:5488
- C:\Windows\System\YKTGCDv.exe
  C:\Windows\System\YKTGCDv.exe
  2⤵
  PID:5552
- C:\Windows\System\JGqkRXI.exe
  C:\Windows\System\JGqkRXI.exe
  2⤵
  PID:5648
- C:\Windows\System\XXhSVOY.exe
  C:\Windows\System\XXhSVOY.exe
  2⤵
  PID:5568
- C:\Windows\System\iuHAZCc.exe
  C:\Windows\System\iuHAZCc.exe
  2⤵
  PID:5680
- C:\Windows\System\xxxrVUA.exe
  C:\Windows\System\xxxrVUA.exe
  2⤵
  PID:5468
- C:\Windows\System\ADynQLP.exe
  C:\Windows\System\ADynQLP.exe
  2⤵
  PID:5572
- C:\Windows\System\diFphfM.exe
  C:\Windows\System\diFphfM.exe
  2⤵
  PID:5632
- C:\Windows\System\igsISDz.exe
  C:\Windows\System\igsISDz.exe
  2⤵
  PID:5756
- C:\Windows\System\FlMqNus.exe
  C:\Windows\System\FlMqNus.exe
  2⤵
  PID:5820
- C:\Windows\System\gpTqNqK.exe
  C:\Windows\System\gpTqNqK.exe
  2⤵
  PID:5772
- C:\Windows\System\ZYEWSMT.exe
  C:\Windows\System\ZYEWSMT.exe
  2⤵
  PID:5836
- C:\Windows\System\tcCRNUp.exe
  C:\Windows\System\tcCRNUp.exe
  2⤵
  PID:5900
- C:\Windows\System\NYJFWdU.exe
  C:\Windows\System\NYJFWdU.exe
  2⤵
  PID:5932
- C:\Windows\System\gENvxVY.exe
  C:\Windows\System\gENvxVY.exe
  2⤵
  PID:5920
- C:\Windows\System\tkykYHV.exe
  C:\Windows\System\tkykYHV.exe
  2⤵
  PID:5964
- C:\Windows\System\ITZiXGf.exe
  C:\Windows\System\ITZiXGf.exe
  2⤵
  PID:5984
- C:\Windows\System\hffXKtr.exe
  C:\Windows\System\hffXKtr.exe
  2⤵
  PID:6000
- C:\Windows\System\pcTqyUz.exe
  C:\Windows\System\pcTqyUz.exe
  2⤵
  PID:6024
- C:\Windows\System\TgtvwcX.exe
  C:\Windows\System\TgtvwcX.exe
  2⤵
  PID:6036
- C:\Windows\System\ElOmysH.exe
  C:\Windows\System\ElOmysH.exe
  2⤵
  PID:6060
- C:\Windows\System\pygfpKz.exe
  C:\Windows\System\pygfpKz.exe
  2⤵
  PID:6076
- C:\Windows\System\AGgnolE.exe
  C:\Windows\System\AGgnolE.exe
  2⤵
  PID:6136
- C:\Windows\System\gqJRbha.exe
  C:\Windows\System\gqJRbha.exe
  2⤵
  PID:5952
- C:\Windows\System\ajhNBJN.exe
  C:\Windows\System\ajhNBJN.exe
  2⤵
  PID:4980
- C:\Windows\System\lcwqtsp.exe
  C:\Windows\System\lcwqtsp.exe
  2⤵
  PID:4592
- C:\Windows\System\SqjOKvH.exe
  C:\Windows\System\SqjOKvH.exe
  2⤵
  PID:5244
- C:\Windows\System\VyfOayI.exe
  C:\Windows\System\VyfOayI.exe
  2⤵
  PID:3484
- C:\Windows\System\zsFbMRa.exe
  C:\Windows\System\zsFbMRa.exe
  2⤵
  PID:5184
- C:\Windows\System\MFGMsyf.exe
  C:\Windows\System\MFGMsyf.exe
  2⤵
  PID:2880
- C:\Windows\System\HwDhUUC.exe
  C:\Windows\System\HwDhUUC.exe
  2⤵
  PID:5224
- C:\Windows\System\kpAwylO.exe
  C:\Windows\System\kpAwylO.exe
  2⤵
  PID:5288
- C:\Windows\System\HaODzRx.exe
  C:\Windows\System\HaODzRx.exe
  2⤵
  PID:5524
- C:\Windows\System\BSRAhBF.exe
  C:\Windows\System\BSRAhBF.exe
  2⤵
  PID:5372
- C:\Windows\System\OYlzGZF.exe
  C:\Windows\System\OYlzGZF.exe
  2⤵
  PID:5652
- C:\Windows\System\URUkCms.exe
  C:\Windows\System\URUkCms.exe
  2⤵
  PID:5748
- C:\Windows\System\BlqfTIo.exe
  C:\Windows\System\BlqfTIo.exe
  2⤵
  PID:5604
- C:\Windows\System\CVFrkqN.exe
  C:\Windows\System\CVFrkqN.exe
  2⤵
  PID:5792
- C:\Windows\System\AxtaTXA.exe
  C:\Windows\System\AxtaTXA.exe
  2⤵
  PID:5960
- C:\Windows\System\GaoSNMs.exe
  C:\Windows\System\GaoSNMs.exe
  2⤵
  PID:6068
- C:\Windows\System\BYqXBPP.exe
  C:\Windows\System\BYqXBPP.exe
  2⤵
  PID:5736
- C:\Windows\System\IEYQcBq.exe
  C:\Windows\System\IEYQcBq.exe
  2⤵
  PID:5976
- C:\Windows\System\rAtKtsH.exe
  C:\Windows\System\rAtKtsH.exe
  2⤵
  PID:6096
- C:\Windows\System\abcLKZt.exe
  C:\Windows\System\abcLKZt.exe
  2⤵
  PID:6104
- C:\Windows\System\KcXRIYK.exe
  C:\Windows\System\KcXRIYK.exe
  2⤵
  PID:5916
- C:\Windows\System\YkgRdKC.exe
  C:\Windows\System\YkgRdKC.exe
  2⤵
  PID:6128
- C:\Windows\System\tHJXMOJ.exe
  C:\Windows\System\tHJXMOJ.exe
  2⤵
  PID:2920
- C:\Windows\System\JuNqqDq.exe
  C:\Windows\System\JuNqqDq.exe
  2⤵
  PID:5320
- C:\Windows\System\DCrhdck.exe
  C:\Windows\System\DCrhdck.exe
  2⤵
  PID:5340
- C:\Windows\System\KdCyJgj.exe
  C:\Windows\System\KdCyJgj.exe
  2⤵
  PID:5664
- C:\Windows\System\AqbFllb.exe
  C:\Windows\System\AqbFllb.exe
  2⤵
  PID:3620
- C:\Windows\System\irtQONO.exe
  C:\Windows\System\irtQONO.exe
  2⤵
  PID:5168
- C:\Windows\System\hINgHBG.exe
  C:\Windows\System\hINgHBG.exe
  2⤵
  PID:272
- C:\Windows\System\buLQzXv.exe
  C:\Windows\System\buLQzXv.exe
  2⤵
  PID:5520
- C:\Windows\System\UUxpILA.exe
  C:\Windows\System\UUxpILA.exe
  2⤵
  PID:5408
- C:\Windows\System\COGmhpo.exe
  C:\Windows\System\COGmhpo.exe
  2⤵
  PID:5868
- C:\Windows\System\rFAClCA.exe
  C:\Windows\System\rFAClCA.exe
  2⤵
  PID:6072
- C:\Windows\System\abcWWFU.exe
  C:\Windows\System\abcWWFU.exe
  2⤵
  PID:6116
- C:\Windows\System\xNlIypN.exe
  C:\Windows\System\xNlIypN.exe
  2⤵
  PID:5972
- C:\Windows\System\YiRZZLS.exe
  C:\Windows\System\YiRZZLS.exe
  2⤵
  PID:6088
- C:\Windows\System\xAHmYPH.exe
  C:\Windows\System\xAHmYPH.exe
  2⤵
  PID:780
- C:\Windows\System\XcmDUCQ.exe
  C:\Windows\System\XcmDUCQ.exe
  2⤵
  PID:5760
- C:\Windows\System\lAlRQOj.exe
  C:\Windows\System\lAlRQOj.exe
  2⤵
  PID:5148
- C:\Windows\System\hFuTBPX.exe
  C:\Windows\System\hFuTBPX.exe
  2⤵
  PID:5452
- C:\Windows\System\ngxuFiU.exe
  C:\Windows\System\ngxuFiU.exe
  2⤵
  PID:6112
- C:\Windows\System\yIzeVPK.exe
  C:\Windows\System\yIzeVPK.exe
  2⤵
  PID:5356
- C:\Windows\System\TDfssmV.exe
  C:\Windows\System\TDfssmV.exe
  2⤵
  PID:5688
- C:\Windows\System\vdYiYCt.exe
  C:\Windows\System\vdYiYCt.exe
  2⤵
  PID:6160
- C:\Windows\System\EnwfyGg.exe
  C:\Windows\System\EnwfyGg.exe
  2⤵
  PID:6176
- C:\Windows\System\JacGjAz.exe
  C:\Windows\System\JacGjAz.exe
  2⤵
  PID:6196
- C:\Windows\System\hQQkgwh.exe
  C:\Windows\System\hQQkgwh.exe
  2⤵
  PID:6220
- C:\Windows\System\lhDBQOm.exe
  C:\Windows\System\lhDBQOm.exe
  2⤵
  PID:6236
- C:\Windows\System\mThVEXX.exe
  C:\Windows\System\mThVEXX.exe
  2⤵
  PID:6256
- C:\Windows\System\jbArMSY.exe
  C:\Windows\System\jbArMSY.exe
  2⤵
  PID:6304
- C:\Windows\System\sIIOmhV.exe
  C:\Windows\System\sIIOmhV.exe
  2⤵
  PID:6324
- C:\Windows\System\PPPavFj.exe
  C:\Windows\System\PPPavFj.exe
  2⤵
  PID:6340
- C:\Windows\System\TiqpfQn.exe
  C:\Windows\System\TiqpfQn.exe
  2⤵
  PID:6360
- C:\Windows\System\didErNL.exe
  C:\Windows\System\didErNL.exe
  2⤵
  PID:6376
- C:\Windows\System\VGvxymL.exe
  C:\Windows\System\VGvxymL.exe
  2⤵
  PID:6396
- C:\Windows\System\CjYIRwD.exe
  C:\Windows\System\CjYIRwD.exe
  2⤵
  PID:6412
- C:\Windows\System\puMrvyd.exe
  C:\Windows\System\puMrvyd.exe
  2⤵
  PID:6444
- C:\Windows\System\UYjgNyh.exe
  C:\Windows\System\UYjgNyh.exe
  2⤵
  PID:6460
- C:\Windows\System\AOtFKrM.exe
  C:\Windows\System\AOtFKrM.exe
  2⤵
  PID:6476
- C:\Windows\System\PVnynfA.exe
  C:\Windows\System\PVnynfA.exe
  2⤵
  PID:6496
- C:\Windows\System\FwBFHxG.exe
  C:\Windows\System\FwBFHxG.exe
  2⤵
  PID:6516
- C:\Windows\System\jxknhWo.exe
  C:\Windows\System\jxknhWo.exe
  2⤵
  PID:6532
- C:\Windows\System\AoMnIyw.exe
  C:\Windows\System\AoMnIyw.exe
  2⤵
  PID:6552
- C:\Windows\System\QQSWfxV.exe
  C:\Windows\System\QQSWfxV.exe
  2⤵
  PID:6572
- C:\Windows\System\bCBEQkG.exe
  C:\Windows\System\bCBEQkG.exe
  2⤵
  PID:6588
- C:\Windows\System\dmxViau.exe
  C:\Windows\System\dmxViau.exe
  2⤵
  PID:6604
- C:\Windows\System\kjxrCAX.exe
  C:\Windows\System\kjxrCAX.exe
  2⤵
  PID:6624
- C:\Windows\System\uYEUzpG.exe
  C:\Windows\System\uYEUzpG.exe
  2⤵
  PID:6648
- C:\Windows\System\nvOLlUe.exe
  C:\Windows\System\nvOLlUe.exe
  2⤵
  PID:6676
- C:\Windows\System\TWphtUh.exe
  C:\Windows\System\TWphtUh.exe
  2⤵
  PID:6692
- C:\Windows\System\LTzKJFE.exe
  C:\Windows\System\LTzKJFE.exe
  2⤵
  PID:6716
- C:\Windows\System\QeOlrrL.exe
  C:\Windows\System\QeOlrrL.exe
  2⤵
  PID:6740
- C:\Windows\System\UIMtuTh.exe
  C:\Windows\System\UIMtuTh.exe
  2⤵
  PID:6756
- C:\Windows\System\ybbEAtt.exe
  C:\Windows\System\ybbEAtt.exe
  2⤵
  PID:6776
- C:\Windows\System\wmRbmKM.exe
  C:\Windows\System\wmRbmKM.exe
  2⤵
  PID:6800
- C:\Windows\System\KNQHDGL.exe
  C:\Windows\System\KNQHDGL.exe
  2⤵
  PID:6816
- C:\Windows\System\wklIyzo.exe
  C:\Windows\System\wklIyzo.exe
  2⤵
  PID:6836
- C:\Windows\System\cdcNEix.exe
  C:\Windows\System\cdcNEix.exe
  2⤵
  PID:6852
- C:\Windows\System\vqgHYEL.exe
  C:\Windows\System\vqgHYEL.exe
  2⤵
  PID:6876
- C:\Windows\System\kMuRFPB.exe
  C:\Windows\System\kMuRFPB.exe
  2⤵
  PID:6892
- C:\Windows\System\TOTraDZ.exe
  C:\Windows\System\TOTraDZ.exe
  2⤵
  PID:6908
- C:\Windows\System\jgPvAQy.exe
  C:\Windows\System\jgPvAQy.exe
  2⤵
  PID:6928
- C:\Windows\System\CtblJnf.exe
  C:\Windows\System\CtblJnf.exe
  2⤵
  PID:6952
- C:\Windows\System\onxAkMc.exe
  C:\Windows\System\onxAkMc.exe
  2⤵
  PID:6976
- C:\Windows\System\nxkpxxr.exe
  C:\Windows\System\nxkpxxr.exe
  2⤵
  PID:6996
- C:\Windows\System\DWHNIMV.exe
  C:\Windows\System\DWHNIMV.exe
  2⤵
  PID:7024
- C:\Windows\System\fpmuCxE.exe
  C:\Windows\System\fpmuCxE.exe
  2⤵
  PID:7040
- C:\Windows\System\TeLcRXo.exe
  C:\Windows\System\TeLcRXo.exe
  2⤵
  PID:7060
- C:\Windows\System\ESVfFCG.exe
  C:\Windows\System\ESVfFCG.exe
  2⤵
  PID:7080
- C:\Windows\System\bOkboSQ.exe
  C:\Windows\System\bOkboSQ.exe
  2⤵
  PID:7096
- C:\Windows\System\KlbJKWr.exe
  C:\Windows\System\KlbJKWr.exe
  2⤵
  PID:7116
- C:\Windows\System\TPYJkHV.exe
  C:\Windows\System\TPYJkHV.exe
  2⤵
  PID:7144
- C:\Windows\System\UpjBSId.exe
  C:\Windows\System\UpjBSId.exe
  2⤵
  PID:7164
- C:\Windows\System\uQbfmHZ.exe
  C:\Windows\System\uQbfmHZ.exe
  2⤵
  PID:5956
- C:\Windows\System\mmyMTZq.exe
  C:\Windows\System\mmyMTZq.exe
  2⤵
  PID:6228
- C:\Windows\System\QjpqdCN.exe
  C:\Windows\System\QjpqdCN.exe
  2⤵
  PID:6272
- C:\Windows\System\ROcQDMC.exe
  C:\Windows\System\ROcQDMC.exe
  2⤵
  PID:2492
- C:\Windows\System\qPLjIiC.exe
  C:\Windows\System\qPLjIiC.exe
  2⤵
  PID:4936
- C:\Windows\System\ZJgnRBH.exe
  C:\Windows\System\ZJgnRBH.exe
  2⤵
  PID:6292
- C:\Windows\System\VAIofbA.exe
  C:\Windows\System\VAIofbA.exe
  2⤵
  PID:6016
- C:\Windows\System\QSWhMzZ.exe
  C:\Windows\System\QSWhMzZ.exe
  2⤵
  PID:6084
- C:\Windows\System\mmDhGpp.exe
  C:\Windows\System\mmDhGpp.exe
  2⤵
  PID:6252
- C:\Windows\System\KpZZvKi.exe
  C:\Windows\System\KpZZvKi.exe
  2⤵
  PID:6244
- C:\Windows\System\yrfWonx.exe
  C:\Windows\System\yrfWonx.exe
  2⤵
  PID:6368
- C:\Windows\System\nLxdplo.exe
  C:\Windows\System\nLxdplo.exe
  2⤵
  PID:6352
- C:\Windows\System\aJWOzAQ.exe
  C:\Windows\System\aJWOzAQ.exe
  2⤵
  PID:6456
- C:\Windows\System\YalqUMM.exe
  C:\Windows\System\YalqUMM.exe
  2⤵
  PID:6384
- C:\Windows\System\mzPYQxW.exe
  C:\Windows\System\mzPYQxW.exe
  2⤵
  PID:6564
- C:\Windows\System\IUaGGQV.exe
  C:\Windows\System\IUaGGQV.exe
  2⤵
  PID:6600
- C:\Windows\System\scIXmHB.exe
  C:\Windows\System\scIXmHB.exe
  2⤵
  PID:6644
- C:\Windows\System\bsdENDL.exe
  C:\Windows\System\bsdENDL.exe
  2⤵
  PID:6688
- C:\Windows\System\xDnYreF.exe
  C:\Windows\System\xDnYreF.exe
  2⤵
  PID:6580
- C:\Windows\System\ermwxzj.exe
  C:\Windows\System\ermwxzj.exe
  2⤵
  PID:6512
- C:\Windows\System\XwOcOfZ.exe
  C:\Windows\System\XwOcOfZ.exe
  2⤵
  PID:6736
- C:\Windows\System\UwmQZAm.exe
  C:\Windows\System\UwmQZAm.exe
  2⤵
  PID:6664
- C:\Windows\System\RbKdaZh.exe
  C:\Windows\System\RbKdaZh.exe
  2⤵
  PID:6612
- C:\Windows\System\yLMNPhp.exe
  C:\Windows\System\yLMNPhp.exe
  2⤵
  PID:6672
- C:\Windows\System\QZatGQA.exe
  C:\Windows\System\QZatGQA.exe
  2⤵
  PID:6700
- C:\Windows\System\bOvrqYD.exe
  C:\Windows\System\bOvrqYD.exe
  2⤵
  PID:6920
- C:\Windows\System\QYitivO.exe
  C:\Windows\System\QYitivO.exe
  2⤵
  PID:6964
- C:\Windows\System\CKVWIVy.exe
  C:\Windows\System\CKVWIVy.exe
  2⤵
  PID:6944
- C:\Windows\System\okBJxpI.exe
  C:\Windows\System\okBJxpI.exe
  2⤵
  PID:6832
- C:\Windows\System\ryrWEZP.exe
  C:\Windows\System\ryrWEZP.exe
  2⤵
  PID:6872
- C:\Windows\System\qIqKgtw.exe
  C:\Windows\System\qIqKgtw.exe
  2⤵
  PID:6948
- C:\Windows\System\YLzsLDW.exe
  C:\Windows\System\YLzsLDW.exe
  2⤵
  PID:7048
- C:\Windows\System\MGtkbuo.exe
  C:\Windows\System\MGtkbuo.exe
  2⤵
  PID:7092
- C:\Windows\System\lBLafIg.exe
  C:\Windows\System\lBLafIg.exe
  2⤵
  PID:7128
- C:\Windows\System\hkerXnw.exe
  C:\Windows\System\hkerXnw.exe
  2⤵
  PID:7136
- C:\Windows\System\mqKKpiJ.exe
  C:\Windows\System\mqKKpiJ.exe
  2⤵
  PID:6152
- C:\Windows\System\yowlWNc.exe
  C:\Windows\System\yowlWNc.exe
  2⤵
  PID:6100
- C:\Windows\System\SNINnAV.exe
  C:\Windows\System\SNINnAV.exe
  2⤵
  PID:6296
- C:\Windows\System\GvxkRav.exe
  C:\Windows\System\GvxkRav.exe
  2⤵
  PID:6172
- C:\Windows\System\dhuOEsm.exe
  C:\Windows\System\dhuOEsm.exe
  2⤵
  PID:5732
- C:\Windows\System\NZQXvdd.exe
  C:\Windows\System\NZQXvdd.exe
  2⤵
  PID:6336
- C:\Windows\System\NVbkqvM.exe
  C:\Windows\System\NVbkqvM.exe
  2⤵
  PID:5388
- C:\Windows\System\etuiEqF.exe
  C:\Windows\System\etuiEqF.exe
  2⤵
  PID:6348
- C:\Windows\System\IgiFDkA.exe
  C:\Windows\System\IgiFDkA.exe
  2⤵
  PID:6488
- C:\Windows\System\BwjUSbb.exe
  C:\Windows\System\BwjUSbb.exe
  2⤵
  PID:6392
- C:\Windows\System\dhBiLCT.exe
  C:\Windows\System\dhBiLCT.exe
  2⤵
  PID:6436
- C:\Windows\System\LSnoypd.exe
  C:\Windows\System\LSnoypd.exe
  2⤵
  PID:6728
- C:\Windows\System\EXvJoPl.exe
  C:\Windows\System\EXvJoPl.exe
  2⤵
  PID:6848
- C:\Windows\System\ddUdOUF.exe
  C:\Windows\System\ddUdOUF.exe
  2⤵
  PID:6748
- C:\Windows\System\lqPfULk.exe
  C:\Windows\System\lqPfULk.exe
  2⤵
  PID:6824
- C:\Windows\System\IKwNDHq.exe
  C:\Windows\System\IKwNDHq.exe
  2⤵
  PID:6684
- C:\Windows\System\FdhtBKF.exe
  C:\Windows\System\FdhtBKF.exe
  2⤵
  PID:6660
- C:\Windows\System\QvtvVff.exe
  C:\Windows\System\QvtvVff.exe
  2⤵
  PID:6788
- C:\Windows\System\zgZWPRt.exe
  C:\Windows\System\zgZWPRt.exe
  2⤵
  PID:7032
- C:\Windows\System\ZHicIhS.exe
  C:\Windows\System\ZHicIhS.exe
  2⤵
  PID:7112
- C:\Windows\System\FaTJeav.exe
  C:\Windows\System\FaTJeav.exe
  2⤵
  PID:6868
- C:\Windows\System\uWznIkN.exe
  C:\Windows\System\uWznIkN.exe
  2⤵
  PID:6984
- C:\Windows\System\GTiyhJl.exe
  C:\Windows\System\GTiyhJl.exe
  2⤵
  PID:7160
- C:\Windows\System\GVobkEH.exe
  C:\Windows\System\GVobkEH.exe
  2⤵
  PID:5588
- C:\Windows\System\tjwXIyl.exe
  C:\Windows\System\tjwXIyl.exe
  2⤵
  PID:4128
- C:\Windows\System\GZLMnVp.exe
  C:\Windows\System\GZLMnVp.exe
  2⤵
  PID:6420
- C:\Windows\System\ZWQYhZq.exe
  C:\Windows\System\ZWQYhZq.exe
  2⤵
  PID:6724
- C:\Windows\System\kwnxPZq.exe
  C:\Windows\System\kwnxPZq.exe
  2⤵
  PID:6708
- C:\Windows\System\riQeMRp.exe
  C:\Windows\System\riQeMRp.exe
  2⤵
  PID:6452
- C:\Windows\System\FTZXHeK.exe
  C:\Windows\System\FTZXHeK.exe
  2⤵
  PID:6968
- C:\Windows\System\ieaISbB.exe
  C:\Windows\System\ieaISbB.exe
  2⤵
  PID:6432
- C:\Windows\System\AgmzRPi.exe
  C:\Windows\System\AgmzRPi.exe
  2⤵
  PID:6992
- C:\Windows\System\zxptKaa.exe
  C:\Windows\System\zxptKaa.exe
  2⤵
  PID:7020
- C:\Windows\System\gZGtPTs.exe
  C:\Windows\System\gZGtPTs.exe
  2⤵
  PID:6904
- C:\Windows\System\JBrFlMa.exe
  C:\Windows\System\JBrFlMa.exe
  2⤵
  PID:6772
- C:\Windows\System\hMIBGnk.exe
  C:\Windows\System\hMIBGnk.exe
  2⤵
  PID:7016
- C:\Windows\System\MPnRvEA.exe
  C:\Windows\System\MPnRvEA.exe
  2⤵
  PID:7036
- C:\Windows\System\QVIMNzU.exe
  C:\Windows\System\QVIMNzU.exe
  2⤵
  PID:6300
- C:\Windows\System\VcwJtqt.exe
  C:\Windows\System\VcwJtqt.exe
  2⤵
  PID:6560
- C:\Windows\System\MkSYuIX.exe
  C:\Windows\System\MkSYuIX.exe
  2⤵
  PID:6668
- C:\Windows\System\DjpGnkm.exe
  C:\Windows\System\DjpGnkm.exe
  2⤵
  PID:7104
- C:\Windows\System\nxXXleI.exe
  C:\Windows\System\nxXXleI.exe
  2⤵
  PID:5848
- C:\Windows\System\uNMxuKh.exe
  C:\Windows\System\uNMxuKh.exe
  2⤵
  PID:6032
- C:\Windows\System\ZWnUaQZ.exe
  C:\Windows\System\ZWnUaQZ.exe
  2⤵
  PID:7172
- C:\Windows\System\tkkNzrC.exe
  C:\Windows\System\tkkNzrC.exe
  2⤵
  PID:7188
- C:\Windows\System\jkUvLpF.exe
  C:\Windows\System\jkUvLpF.exe
  2⤵
  PID:7212
- C:\Windows\System\PrpEJCO.exe
  C:\Windows\System\PrpEJCO.exe
  2⤵
  PID:7252
- C:\Windows\System\cVawKzZ.exe
  C:\Windows\System\cVawKzZ.exe
  2⤵
  PID:7272
- C:\Windows\System\pUwJKhV.exe
  C:\Windows\System\pUwJKhV.exe
  2⤵
  PID:7300
- C:\Windows\System\gtLqckO.exe
  C:\Windows\System\gtLqckO.exe
  2⤵
  PID:7316
- C:\Windows\System\rJkoGKx.exe
  C:\Windows\System\rJkoGKx.exe
  2⤵
  PID:7336
- C:\Windows\System\uTWemoi.exe
  C:\Windows\System\uTWemoi.exe
  2⤵
  PID:7352
- C:\Windows\System\DbtRcjk.exe
  C:\Windows\System\DbtRcjk.exe
  2⤵
  PID:7372
- C:\Windows\System\HBMxLiE.exe
  C:\Windows\System\HBMxLiE.exe
  2⤵
  PID:7396
- C:\Windows\System\bhXEKio.exe
  C:\Windows\System\bhXEKio.exe
  2⤵
  PID:7416
- C:\Windows\System\ktmeyvB.exe
  C:\Windows\System\ktmeyvB.exe
  2⤵
  PID:7432
- C:\Windows\System\nMqiHPZ.exe
  C:\Windows\System\nMqiHPZ.exe
  2⤵
  PID:7460
- C:\Windows\System\FnWaosn.exe
  C:\Windows\System\FnWaosn.exe
  2⤵
  PID:7480
- C:\Windows\System\RXuiwOm.exe
  C:\Windows\System\RXuiwOm.exe
  2⤵
  PID:7496
- C:\Windows\System\tLBlivL.exe
  C:\Windows\System\tLBlivL.exe
  2⤵
  PID:7512
- C:\Windows\System\NtLnQeX.exe
  C:\Windows\System\NtLnQeX.exe
  2⤵
  PID:7536
- C:\Windows\System\NQGoaxe.exe
  C:\Windows\System\NQGoaxe.exe
  2⤵
  PID:7552
- C:\Windows\System\ndoKqSN.exe
  C:\Windows\System\ndoKqSN.exe
  2⤵
  PID:7568
- C:\Windows\System\oENkjRs.exe
  C:\Windows\System\oENkjRs.exe
  2⤵
  PID:7588
- C:\Windows\System\iMDCrfK.exe
  C:\Windows\System\iMDCrfK.exe
  2⤵
  PID:7620
- C:\Windows\System\pcNsaJW.exe
  C:\Windows\System\pcNsaJW.exe
  2⤵
  PID:7640
- C:\Windows\System\vFcqqaS.exe
  C:\Windows\System\vFcqqaS.exe
  2⤵
  PID:7656
- C:\Windows\System\aXnXhHj.exe
  C:\Windows\System\aXnXhHj.exe
  2⤵
  PID:7672
- C:\Windows\System\pCdJwmn.exe
  C:\Windows\System\pCdJwmn.exe
  2⤵
  PID:7696
- C:\Windows\System\iMAoYAI.exe
  C:\Windows\System\iMAoYAI.exe
  2⤵
  PID:7712
- C:\Windows\System\AOdWOPL.exe
  C:\Windows\System\AOdWOPL.exe
  2⤵
  PID:7728
- C:\Windows\System\NAceUuf.exe
  C:\Windows\System\NAceUuf.exe
  2⤵
  PID:7744
- C:\Windows\System\fdKfygq.exe
  C:\Windows\System\fdKfygq.exe
  2⤵
  PID:7764
- C:\Windows\System\hAaRwms.exe
  C:\Windows\System\hAaRwms.exe
  2⤵
  PID:7792
- C:\Windows\System\KySnidX.exe
  C:\Windows\System\KySnidX.exe
  2⤵
  PID:7820
- C:\Windows\System\sQEUDft.exe
  C:\Windows\System\sQEUDft.exe
  2⤵
  PID:7840
- C:\Windows\System\CdkeqQT.exe
  C:\Windows\System\CdkeqQT.exe
  2⤵
  PID:7856
- C:\Windows\System\mnxwWyP.exe
  C:\Windows\System\mnxwWyP.exe
  2⤵
  PID:7880
- C:\Windows\System\MZsAQYx.exe
  C:\Windows\System\MZsAQYx.exe
  2⤵
  PID:7896
- C:\Windows\System\NjcpitE.exe
  C:\Windows\System\NjcpitE.exe
  2⤵
  PID:7916
- C:\Windows\System\uMDdFYB.exe
  C:\Windows\System\uMDdFYB.exe
  2⤵
  PID:7936
- C:\Windows\System\WFlKFXN.exe
  C:\Windows\System\WFlKFXN.exe
  2⤵
  PID:7952
- C:\Windows\System\lXfmefS.exe
  C:\Windows\System\lXfmefS.exe
  2⤵
  PID:7972
- C:\Windows\System\KAwWRWC.exe
  C:\Windows\System\KAwWRWC.exe
  2⤵
  PID:7996
- C:\Windows\System\tSiyKBx.exe
  C:\Windows\System\tSiyKBx.exe
  2⤵
  PID:8012
- C:\Windows\System\NrffpUd.exe
  C:\Windows\System\NrffpUd.exe
  2⤵
  PID:8028
- C:\Windows\System\nAFKLnu.exe
  C:\Windows\System\nAFKLnu.exe
  2⤵
  PID:8052
- C:\Windows\System\WYHaiaK.exe
  C:\Windows\System\WYHaiaK.exe
  2⤵
  PID:8072
- C:\Windows\System\hlXlLiU.exe
  C:\Windows\System\hlXlLiU.exe
  2⤵
  PID:8092
- C:\Windows\System\GASZiCb.exe
  C:\Windows\System\GASZiCb.exe
  2⤵
  PID:8112
- C:\Windows\System\HbpkJQT.exe
  C:\Windows\System\HbpkJQT.exe
  2⤵
  PID:8132
- C:\Windows\System\dGWStKq.exe
  C:\Windows\System\dGWStKq.exe
  2⤵
  PID:8148
- C:\Windows\System\llvjWaO.exe
  C:\Windows\System\llvjWaO.exe
  2⤵
  PID:8168
- C:\Windows\System\kvumxhR.exe
  C:\Windows\System\kvumxhR.exe
  2⤵
  PID:8188
- C:\Windows\System\fCtvxKU.exe
  C:\Windows\System\fCtvxKU.exe
  2⤵
  PID:7196
- C:\Windows\System\qreQIaw.exe
  C:\Windows\System\qreQIaw.exe
  2⤵
  PID:7204
- C:\Windows\System\YxrAbPV.exe
  C:\Windows\System\YxrAbPV.exe
  2⤵
  PID:6888
- C:\Windows\System\oXXCZKX.exe
  C:\Windows\System\oXXCZKX.exe
  2⤵
  PID:7260
- C:\Windows\System\YrbhTqR.exe
  C:\Windows\System\YrbhTqR.exe
  2⤵
  PID:7008
- C:\Windows\System\RlQsOBj.exe
  C:\Windows\System\RlQsOBj.exe
  2⤵
  PID:6860
- C:\Windows\System\LAbomqA.exe
  C:\Windows\System\LAbomqA.exe
  2⤵
  PID:7280
- C:\Windows\System\JRPGiRi.exe
  C:\Windows\System\JRPGiRi.exe
  2⤵
  PID:7284
- C:\Windows\System\FXRkfsJ.exe
  C:\Windows\System\FXRkfsJ.exe
  2⤵
  PID:7308
- C:\Windows\System\URsTQvl.exe
  C:\Windows\System\URsTQvl.exe
  2⤵
  PID:7332
- C:\Windows\System\ShTlKBn.exe
  C:\Windows\System\ShTlKBn.exe
  2⤵
  PID:7380
- C:\Windows\System\WFjrruU.exe
  C:\Windows\System\WFjrruU.exe
  2⤵
  PID:7408
- C:\Windows\System\rSjfGGl.exe
  C:\Windows\System\rSjfGGl.exe
  2⤵
  PID:7412
- C:\Windows\System\cnADGme.exe
  C:\Windows\System\cnADGme.exe
  2⤵
  PID:7456
- C:\Windows\System\MrQsfnQ.exe
  C:\Windows\System\MrQsfnQ.exe
  2⤵
  PID:7508
- C:\Windows\System\uUuYOGM.exe
  C:\Windows\System\uUuYOGM.exe
  2⤵
  PID:7584
- C:\Windows\System\ZqbtIHJ.exe
  C:\Windows\System\ZqbtIHJ.exe
  2⤵
  PID:7600
- C:\Windows\System\oZXYAZJ.exe
  C:\Windows\System\oZXYAZJ.exe
  2⤵
  PID:7628
- C:\Windows\System\IqrtNzt.exe
  C:\Windows\System\IqrtNzt.exe
  2⤵
  PID:7648
- C:\Windows\System\XsDXyLs.exe
  C:\Windows\System\XsDXyLs.exe
  2⤵
  PID:7776
- C:\Windows\System\LPnvoHo.exe
  C:\Windows\System\LPnvoHo.exe
  2⤵
  PID:7788
- C:\Windows\System\HNiQkqK.exe
  C:\Windows\System\HNiQkqK.exe
  2⤵
  PID:7692
- C:\Windows\System\CKxqYrY.exe
  C:\Windows\System\CKxqYrY.exe
  2⤵
  PID:7760
- C:\Windows\System\dvGieLb.exe
  C:\Windows\System\dvGieLb.exe
  2⤵
  PID:7828
- C:\Windows\System\tsgemjN.exe
  C:\Windows\System\tsgemjN.exe
  2⤵
  PID:7864
- C:\Windows\System\pNQjOYc.exe
  C:\Windows\System\pNQjOYc.exe
  2⤵
  PID:7904
- C:\Windows\System\HXXNkoO.exe
  C:\Windows\System\HXXNkoO.exe
  2⤵
  PID:7892
- C:\Windows\System\ZBKPeJc.exe
  C:\Windows\System\ZBKPeJc.exe
  2⤵
  PID:7992
- C:\Windows\System\LtlHtGi.exe
  C:\Windows\System\LtlHtGi.exe
  2⤵
  PID:8068
- C:\Windows\System\cIhWSLQ.exe
  C:\Windows\System\cIhWSLQ.exe
  2⤵
  PID:8108
- C:\Windows\System\PGCWjyU.exe
  C:\Windows\System\PGCWjyU.exe
  2⤵
  PID:8176
- C:\Windows\System\mapKvLv.exe
  C:\Windows\System\mapKvLv.exe
  2⤵
  PID:7964
- C:\Windows\System\zIANECW.exe
  C:\Windows\System\zIANECW.exe
  2⤵
  PID:6796
- C:\Windows\System\EgeJqko.exe
  C:\Windows\System\EgeJqko.exe
  2⤵
  PID:6616
- C:\Windows\System\dGBoKEu.exe
  C:\Windows\System\dGBoKEu.exe
  2⤵
  PID:8120
- C:\Windows\System\JnmUyix.exe
  C:\Windows\System\JnmUyix.exe
  2⤵
  PID:8084
- C:\Windows\System\AhopjIS.exe
  C:\Windows\System\AhopjIS.exe
  2⤵
  PID:8160
- C:\Windows\System\GsyrGAl.exe
  C:\Windows\System\GsyrGAl.exe
  2⤵
  PID:5904
- C:\Windows\System\WWOFDIF.exe
  C:\Windows\System\WWOFDIF.exe
  2⤵
  PID:7232
- C:\Windows\System\YNYfxPN.exe
  C:\Windows\System\YNYfxPN.exe
  2⤵
  PID:7264
- C:\Windows\System\OXVkCDA.exe
  C:\Windows\System\OXVkCDA.exe
  2⤵
  PID:7476
- C:\Windows\System\maZLEzW.exe
  C:\Windows\System\maZLEzW.exe
  2⤵
  PID:7576
- C:\Windows\System\GjlQWni.exe
  C:\Windows\System\GjlQWni.exe
  2⤵
  PID:7364
- C:\Windows\System\DbDRFmH.exe
  C:\Windows\System\DbDRFmH.exe
  2⤵
  PID:7472
- C:\Windows\System\XDfCqfz.exe
  C:\Windows\System\XDfCqfz.exe
  2⤵
  PID:7444
- C:\Windows\System\QXhxCMA.exe
  C:\Windows\System\QXhxCMA.exe
  2⤵
  PID:7596
- C:\Windows\System\WdwHgLN.exe
  C:\Windows\System\WdwHgLN.exe
  2⤵
  PID:7664
- C:\Windows\System\vmOIbGL.exe
  C:\Windows\System\vmOIbGL.exe
  2⤵
  PID:7772
- C:\Windows\System\MTfkfVC.exe
  C:\Windows\System\MTfkfVC.exe
  2⤵
  PID:7652
- C:\Windows\System\UDrewDX.exe
  C:\Windows\System\UDrewDX.exe
  2⤵
  PID:7852
- C:\Windows\System\rdCAzRi.exe
  C:\Windows\System\rdCAzRi.exe
  2⤵
  PID:7848
- C:\Windows\System\tywWNIH.exe
  C:\Windows\System\tywWNIH.exe
  2⤵
  PID:7984
- C:\Windows\System\REPbXTm.exe
  C:\Windows\System\REPbXTm.exe
  2⤵
  PID:8180
- C:\Windows\System\jzDCseZ.exe
  C:\Windows\System\jzDCseZ.exe
  2⤵
  PID:7180
- C:\Windows\System\qJTmGdP.exe
  C:\Windows\System\qJTmGdP.exe
  2⤵
  PID:7208
- C:\Windows\System\bJfSYbT.exe
  C:\Windows\System\bJfSYbT.exe
  2⤵
  PID:8060
- C:\Windows\System\NoCewaf.exe
  C:\Windows\System\NoCewaf.exe
  2⤵
  PID:8044
- C:\Windows\System\tlxJnOu.exe
  C:\Windows\System\tlxJnOu.exe
  2⤵
  PID:8088
- C:\Windows\System\RIvkphl.exe
  C:\Windows\System\RIvkphl.exe
  2⤵
  PID:6792
- C:\Windows\System\VirjovF.exe
  C:\Windows\System\VirjovF.exe
  2⤵
  PID:7328
- C:\Windows\System\QeOnrGL.exe
  C:\Windows\System\QeOnrGL.exe
  2⤵
  PID:7388
- C:\Windows\System\lmGufCJ.exe
  C:\Windows\System\lmGufCJ.exe
  2⤵
  PID:7288
- C:\Windows\System\cXhIIhT.exe
  C:\Windows\System\cXhIIhT.exe
  2⤵
  PID:6704
- C:\Windows\System\GxVDIyT.exe
  C:\Windows\System\GxVDIyT.exe
  2⤵
  PID:7368
- C:\Windows\System\iBSLbfs.exe
  C:\Windows\System\iBSLbfs.exe
  2⤵
  PID:7636
- C:\Windows\System\ZuYKnOb.exe
  C:\Windows\System\ZuYKnOb.exe
  2⤵
  PID:7752
- C:\Windows\System\VSZpJDT.exe
  C:\Windows\System\VSZpJDT.exe
  2⤵
  PID:8040
- C:\Windows\System\lMaceFi.exe
  C:\Windows\System\lMaceFi.exe
  2⤵
  PID:8100
- C:\Windows\System\PuLrqMW.exe
  C:\Windows\System\PuLrqMW.exe
  2⤵
  PID:6008
- C:\Windows\System\ZyFaBzF.exe
  C:\Windows\System\ZyFaBzF.exe
  2⤵
  PID:7960
- C:\Windows\System\PUaItJo.exe
  C:\Windows\System\PUaItJo.exe
  2⤵
  PID:7124
- C:\Windows\System\iGdmxJP.exe
  C:\Windows\System\iGdmxJP.exe
  2⤵
  PID:7736
- C:\Windows\System\rNZkNrW.exe
  C:\Windows\System\rNZkNrW.exe
  2⤵
  PID:7528
- C:\Windows\System\eIYGuPE.exe
  C:\Windows\System\eIYGuPE.exe
  2⤵
  PID:8144
- C:\Windows\System\lrxfnKv.exe
  C:\Windows\System\lrxfnKv.exe
  2⤵
  PID:6768
- C:\Windows\System\rziTsGF.exe
  C:\Windows\System\rziTsGF.exe
  2⤵
  PID:7832
- C:\Windows\System\TEHfrCg.exe
  C:\Windows\System\TEHfrCg.exe
  2⤵
  PID:8140
- C:\Windows\System\GlirvOy.exe
  C:\Windows\System\GlirvOy.exe
  2⤵
  PID:7228
- C:\Windows\System\UeLXCAq.exe
  C:\Windows\System\UeLXCAq.exe
  2⤵
  PID:7912
- C:\Windows\System\EybDOiK.exe
  C:\Windows\System\EybDOiK.exe
  2⤵
  PID:7724
- C:\Windows\System\MzkaEVJ.exe
  C:\Windows\System\MzkaEVJ.exe
  2⤵
  PID:7220
- C:\Windows\System\OkvpxQK.exe
  C:\Windows\System\OkvpxQK.exe
  2⤵
  PID:7812
- C:\Windows\System\vRqOuMo.exe
  C:\Windows\System\vRqOuMo.exe
  2⤵
  PID:7876
- C:\Windows\System\EDlBgLS.exe
  C:\Windows\System\EDlBgLS.exe
  2⤵
  PID:8156
- C:\Windows\System\ZOLHoDQ.exe
  C:\Windows\System\ZOLHoDQ.exe
  2⤵
  PID:8200
- C:\Windows\System\DtUVcwg.exe
  C:\Windows\System\DtUVcwg.exe
  2⤵
  PID:8216
- C:\Windows\System\CVDqcTA.exe
  C:\Windows\System\CVDqcTA.exe
  2⤵
  PID:8232
- C:\Windows\System\zBRumLk.exe
  C:\Windows\System\zBRumLk.exe
  2⤵
  PID:8248
- C:\Windows\System\gKJQxQP.exe
  C:\Windows\System\gKJQxQP.exe
  2⤵
  PID:8264
- C:\Windows\System\QkRkhaV.exe
  C:\Windows\System\QkRkhaV.exe
  2⤵
  PID:8280
- C:\Windows\System\beZWKlz.exe
  C:\Windows\System\beZWKlz.exe
  2⤵
  PID:8296
- C:\Windows\System\GakZlPo.exe
  C:\Windows\System\GakZlPo.exe
  2⤵
  PID:8312
- C:\Windows\System\UkpTECa.exe
  C:\Windows\System\UkpTECa.exe
  2⤵
  PID:8332
- C:\Windows\System\GOiBMHo.exe
  C:\Windows\System\GOiBMHo.exe
  2⤵
  PID:8348
- C:\Windows\System\PyXSbPN.exe
  C:\Windows\System\PyXSbPN.exe
  2⤵
  PID:8364
- C:\Windows\System\CeHyVYO.exe
  C:\Windows\System\CeHyVYO.exe
  2⤵
  PID:8380
- C:\Windows\System\BPzhywx.exe
  C:\Windows\System\BPzhywx.exe
  2⤵
  PID:8396
- C:\Windows\System\mypesoZ.exe
  C:\Windows\System\mypesoZ.exe
  2⤵
  PID:8420
- C:\Windows\System\rmvsEXh.exe
  C:\Windows\System\rmvsEXh.exe
  2⤵
  PID:8436
- C:\Windows\System\PuZzlId.exe
  C:\Windows\System\PuZzlId.exe
  2⤵
  PID:8452
- C:\Windows\System\NvZShZt.exe
  C:\Windows\System\NvZShZt.exe
  2⤵
  PID:8472
- C:\Windows\System\Bvitlzm.exe
  C:\Windows\System\Bvitlzm.exe
  2⤵
  PID:8488
- C:\Windows\System\hpekZAQ.exe
  C:\Windows\System\hpekZAQ.exe
  2⤵
  PID:8504
- C:\Windows\System\RTycxql.exe
  C:\Windows\System\RTycxql.exe
  2⤵
  PID:8520
- C:\Windows\System\YukOxIZ.exe
  C:\Windows\System\YukOxIZ.exe
  2⤵
  PID:8536
- C:\Windows\System\ZPFkbOp.exe
  C:\Windows\System\ZPFkbOp.exe
  2⤵
  PID:8552
- C:\Windows\System\pSqejNh.exe
  C:\Windows\System\pSqejNh.exe
  2⤵
  PID:8568
- C:\Windows\System\iJzRvPy.exe
  C:\Windows\System\iJzRvPy.exe
  2⤵
  PID:8588
- C:\Windows\System\HZtHAYJ.exe
  C:\Windows\System\HZtHAYJ.exe
  2⤵
  PID:8604
- C:\Windows\System\scmtKsh.exe
  C:\Windows\System\scmtKsh.exe
  2⤵
  PID:8620
- C:\Windows\System\ThqJpuo.exe
  C:\Windows\System\ThqJpuo.exe
  2⤵
  PID:8636
- C:\Windows\System\PjYXaim.exe
  C:\Windows\System\PjYXaim.exe
  2⤵
  PID:8652
- C:\Windows\System\uEmBWXV.exe
  C:\Windows\System\uEmBWXV.exe
  2⤵
  PID:8668
- C:\Windows\System\tOkCtve.exe
  C:\Windows\System\tOkCtve.exe
  2⤵
  PID:8684
- C:\Windows\System\DHaAXOz.exe
  C:\Windows\System\DHaAXOz.exe
  2⤵
  PID:8704
- C:\Windows\System\TjOBsze.exe
  C:\Windows\System\TjOBsze.exe
  2⤵
  PID:8724
- C:\Windows\System\CaLzyzE.exe
  C:\Windows\System\CaLzyzE.exe
  2⤵
  PID:8740
- C:\Windows\System\PHjwIdX.exe
  C:\Windows\System\PHjwIdX.exe
  2⤵
  PID:8756
- C:\Windows\System\SGurNiB.exe
  C:\Windows\System\SGurNiB.exe
  2⤵
  PID:8776
- C:\Windows\System\RIVeJlE.exe
  C:\Windows\System\RIVeJlE.exe
  2⤵
  PID:8792
- C:\Windows\System\RgSWWxd.exe
  C:\Windows\System\RgSWWxd.exe
  2⤵
  PID:8808
- C:\Windows\System\NSFUhbL.exe
  C:\Windows\System\NSFUhbL.exe
  2⤵
  PID:8824
- C:\Windows\System\FVzzIDQ.exe
  C:\Windows\System\FVzzIDQ.exe
  2⤵
  PID:8840
- C:\Windows\System\dDrAOhd.exe
  C:\Windows\System\dDrAOhd.exe
  2⤵
  PID:8864
- C:\Windows\System\CNdrDmG.exe
  C:\Windows\System\CNdrDmG.exe
  2⤵
  PID:8880
- C:\Windows\System\pCTMYdK.exe
  C:\Windows\System\pCTMYdK.exe
  2⤵
  PID:8896
- C:\Windows\System\YVCepFJ.exe
  C:\Windows\System\YVCepFJ.exe
  2⤵
  PID:8912
- C:\Windows\System\kHoyKfU.exe
  C:\Windows\System\kHoyKfU.exe
  2⤵
  PID:8928
- C:\Windows\System\rTqLZJs.exe
  C:\Windows\System\rTqLZJs.exe
  2⤵
  PID:8944
- C:\Windows\System\eYVPufD.exe
  C:\Windows\System\eYVPufD.exe
  2⤵
  PID:8964
- C:\Windows\System\FlgEaOP.exe
  C:\Windows\System\FlgEaOP.exe
  2⤵
  PID:8980
- C:\Windows\System\oABOMKu.exe
  C:\Windows\System\oABOMKu.exe
  2⤵
  PID:9004
- C:\Windows\System\papTzgO.exe
  C:\Windows\System\papTzgO.exe
  2⤵
  PID:9020
- C:\Windows\System\ERTJlkl.exe
  C:\Windows\System\ERTJlkl.exe
  2⤵
  PID:9036
- C:\Windows\System\kmTHfFV.exe
  C:\Windows\System\kmTHfFV.exe
  2⤵
  PID:9060
- C:\Windows\System\TkJQVxO.exe
  C:\Windows\System\TkJQVxO.exe
  2⤵
  PID:9080
- C:\Windows\System\KmjxuTX.exe
  C:\Windows\System\KmjxuTX.exe
  2⤵
  PID:9096
- C:\Windows\System\WmItTII.exe
  C:\Windows\System\WmItTII.exe
  2⤵
  PID:9116
- C:\Windows\System\onPeORV.exe
  C:\Windows\System\onPeORV.exe
  2⤵
  PID:9132
- C:\Windows\System\NFXkFIe.exe
  C:\Windows\System\NFXkFIe.exe
  2⤵
  PID:9152
- C:\Windows\System\vTHuicx.exe
  C:\Windows\System\vTHuicx.exe
  2⤵
  PID:9172
- C:\Windows\System\AocqyaJ.exe
  C:\Windows\System\AocqyaJ.exe
  2⤵
  PID:9188
- C:\Windows\System\GfsnBqd.exe
  C:\Windows\System\GfsnBqd.exe
  2⤵
  PID:9208
- C:\Windows\System\OduVHGv.exe
  C:\Windows\System\OduVHGv.exe
  2⤵
  PID:8240
- C:\Windows\System\xcUvKIK.exe
  C:\Windows\System\xcUvKIK.exe
  2⤵
  PID:7932
- C:\Windows\System\tbuVLMk.exe
  C:\Windows\System\tbuVLMk.exe
  2⤵
  PID:8308
- C:\Windows\System\dWOqdDG.exe
  C:\Windows\System\dWOqdDG.exe
  2⤵
  PID:8320
- C:\Windows\System\aBSLlEd.exe
  C:\Windows\System\aBSLlEd.exe
  2⤵
  PID:8360
- C:\Windows\System\sHfaVbI.exe
  C:\Windows\System\sHfaVbI.exe
  2⤵
  PID:8408
- C:\Windows\System\jhxsJcp.exe
  C:\Windows\System\jhxsJcp.exe
  2⤵
  PID:8432
- C:\Windows\System\cmwrjNV.exe
  C:\Windows\System\cmwrjNV.exe
  2⤵
  PID:8328
- C:\Windows\System\ddJjvHI.exe
  C:\Windows\System\ddJjvHI.exe
  2⤵
  PID:8612
- C:\Windows\System\VuEutai.exe
  C:\Windows\System\VuEutai.exe
  2⤵
  PID:8648
- C:\Windows\System\lrdpFRG.exe
  C:\Windows\System\lrdpFRG.exe
  2⤵
  PID:8676
- C:\Windows\System\nzkdWgZ.exe
  C:\Windows\System\nzkdWgZ.exe
  2⤵
  PID:8528
- C:\Windows\System\dPBOmSC.exe
  C:\Windows\System\dPBOmSC.exe
  2⤵
  PID:8628
- C:\Windows\System\xtZQkkE.exe
  C:\Windows\System\xtZQkkE.exe
  2⤵
  PID:8692
- C:\Windows\System\UdrKPNK.exe
  C:\Windows\System\UdrKPNK.exe
  2⤵
  PID:8716
- C:\Windows\System\kZTNOuv.exe
  C:\Windows\System\kZTNOuv.exe
  2⤵
  PID:8732
- C:\Windows\System\yvfIVQs.exe
  C:\Windows\System\yvfIVQs.exe
  2⤵
  PID:8784
- C:\Windows\System\MYgVgKT.exe
  C:\Windows\System\MYgVgKT.exe
  2⤵
  PID:8820
- C:\Windows\System\iDsILCH.exe
  C:\Windows\System\iDsILCH.exe
  2⤵
  PID:8860
- C:\Windows\System\dXCaHOn.exe
  C:\Windows\System\dXCaHOn.exe
  2⤵
  PID:8836
- C:\Windows\System\TnCDZEN.exe
  C:\Windows\System\TnCDZEN.exe
  2⤵
  PID:8876
- C:\Windows\System\xxamlBi.exe
  C:\Windows\System\xxamlBi.exe
  2⤵
  PID:8956
- C:\Windows\System\IyGeiRK.exe
  C:\Windows\System\IyGeiRK.exe
  2⤵
  PID:8960
- C:\Windows\System\lHpsANP.exe
  C:\Windows\System\lHpsANP.exe
  2⤵
  PID:9000
- C:\Windows\System\BGjfCnk.exe
  C:\Windows\System\BGjfCnk.exe
  2⤵
  PID:8404
- C:\Windows\System\FleUgLG.exe
  C:\Windows\System\FleUgLG.exe
  2⤵
  PID:8972
- C:\Windows\System\ljYxmVN.exe
  C:\Windows\System\ljYxmVN.exe
  2⤵
  PID:9044
- C:\Windows\System\YGWvTOX.exe
  C:\Windows\System\YGWvTOX.exe
  2⤵
  PID:9092
- C:\Windows\System\zDqqPhh.exe
  C:\Windows\System\zDqqPhh.exe
  2⤵
  PID:9144
- C:\Windows\System\PFQeAYS.exe
  C:\Windows\System\PFQeAYS.exe
  2⤵
  PID:9168
- C:\Windows\System\MJRuDUh.exe
  C:\Windows\System\MJRuDUh.exe
  2⤵
  PID:9200
- C:\Windows\System\GIiGGDL.exe
  C:\Windows\System\GIiGGDL.exe
  2⤵
  PID:8196
- C:\Windows\System\ikDrqJs.exe
  C:\Windows\System\ikDrqJs.exe
  2⤵
  PID:7524
- C:\Windows\System\agmGdbg.exe
  C:\Windows\System\agmGdbg.exe
  2⤵
  PID:7244
- C:\Windows\System\DwcGOoa.exe
  C:\Windows\System\DwcGOoa.exe
  2⤵
  PID:8304
- C:\Windows\System\omeLAVK.exe
  C:\Windows\System\omeLAVK.exe
  2⤵
  PID:8356
- C:\Windows\System\iiOhjvd.exe
  C:\Windows\System\iiOhjvd.exe
  2⤵
  PID:8448
- C:\Windows\System\iJPxSSF.exe
  C:\Windows\System\iJPxSSF.exe
  2⤵
  PID:7816
- C:\Windows\System\brfUnHf.exe
  C:\Windows\System\brfUnHf.exe
  2⤵
  PID:8580
- C:\Windows\System\yYtklgh.exe
  C:\Windows\System\yYtklgh.exe
  2⤵
  PID:8596
- C:\Windows\System\qQLlEmj.exe
  C:\Windows\System\qQLlEmj.exe
  2⤵
  PID:8600
- C:\Windows\System\nasqauI.exe
  C:\Windows\System\nasqauI.exe
  2⤵
  PID:8752
- C:\Windows\System\qOMPhUg.exe
  C:\Windows\System\qOMPhUg.exe
  2⤵
  PID:8800
- C:\Windows\System\YqcjlIO.exe
  C:\Windows\System\YqcjlIO.exe
  2⤵
  PID:8772
- C:\Windows\System\SfRWMpE.exe
  C:\Windows\System\SfRWMpE.exe
  2⤵
  PID:8924
- C:\Windows\System\WePuUKX.exe
  C:\Windows\System\WePuUKX.exe
  2⤵
  PID:8996
- C:\Windows\System\NURYCHa.exe
  C:\Windows\System\NURYCHa.exe
  2⤵
  PID:8908
- C:\Windows\System\PCBPKqQ.exe
  C:\Windows\System\PCBPKqQ.exe
  2⤵
  PID:9088
- C:\Windows\System\iDUfxnX.exe
  C:\Windows\System\iDUfxnX.exe
  2⤵
  PID:8224
- C:\Windows\System\tYNDvft.exe
  C:\Windows\System\tYNDvft.exe
  2⤵
  PID:9160
- C:\Windows\System\dtVoMVr.exe
  C:\Windows\System\dtVoMVr.exe
  2⤵
  PID:7248
- C:\Windows\System\NMbFLEW.exe
  C:\Windows\System\NMbFLEW.exe
  2⤵
  PID:8272
- C:\Windows\System\QjRcsIm.exe
  C:\Windows\System\QjRcsIm.exe
  2⤵
  PID:8392
- C:\Windows\System\gwOtGEV.exe
  C:\Windows\System\gwOtGEV.exe
  2⤵
  PID:8484
- C:\Windows\System\zNlTqbU.exe
  C:\Windows\System\zNlTqbU.exe
  2⤵
  PID:8416
- C:\Windows\System\XsrnlXi.exe
  C:\Windows\System\XsrnlXi.exe
  2⤵
  PID:8468
- C:\Windows\System\LElJfcM.exe
  C:\Windows\System\LElJfcM.exe
  2⤵
  PID:8816
- C:\Windows\System\XuExbwh.exe
  C:\Windows\System\XuExbwh.exe
  2⤵
  PID:9072
- C:\Windows\System\fAFtQux.exe
  C:\Windows\System\fAFtQux.exe
  2⤵
  PID:8696
- C:\Windows\System\KTbwygy.exe
  C:\Windows\System\KTbwygy.exe
  2⤵
  PID:8892
- C:\Windows\System\pSrMlfU.exe
  C:\Windows\System\pSrMlfU.exe
  2⤵
  PID:8764
- C:\Windows\System\LPAKnGd.exe
  C:\Windows\System\LPAKnGd.exe
  2⤵
  PID:7944
- C:\Windows\System\dIGWuFa.exe
  C:\Windows\System\dIGWuFa.exe
  2⤵
  PID:8428
- C:\Windows\System\qckyERh.exe
  C:\Windows\System\qckyERh.exe
  2⤵
  PID:8564
- C:\Windows\System\cQgNnAu.exe
  C:\Windows\System\cQgNnAu.exe
  2⤵
  PID:8532
- C:\Windows\System\oQKgFEH.exe
  C:\Windows\System\oQKgFEH.exe
  2⤵
  PID:8344
- C:\Windows\System\KFTqYOK.exe
  C:\Windows\System\KFTqYOK.exe
  2⤵
  PID:8260
- C:\Windows\System\HALYpWD.exe
  C:\Windows\System\HALYpWD.exe
  2⤵
  PID:9052
- C:\Windows\System\amRNOXN.exe
  C:\Windows\System\amRNOXN.exe
  2⤵
  PID:8852
- C:\Windows\System\qYwTcRO.exe
  C:\Windows\System\qYwTcRO.exe
  2⤵
  PID:8500
- C:\Windows\System\jusmgwM.exe
  C:\Windows\System\jusmgwM.exe
  2⤵
  PID:9232
- C:\Windows\System\YfwQWfT.exe
  C:\Windows\System\YfwQWfT.exe
  2⤵
  PID:9248
- C:\Windows\System\ONVvXlL.exe
  C:\Windows\System\ONVvXlL.exe
  2⤵
  PID:9264
- C:\Windows\System\AeuVzCp.exe
  C:\Windows\System\AeuVzCp.exe
  2⤵
  PID:9280
- C:\Windows\System\UYQOTRf.exe
  C:\Windows\System\UYQOTRf.exe
  2⤵
  PID:9296
- C:\Windows\System\KxXfkDv.exe
  C:\Windows\System\KxXfkDv.exe
  2⤵
  PID:9316
- C:\Windows\System\NSZwgyU.exe
  C:\Windows\System\NSZwgyU.exe
  2⤵
  PID:9332
- C:\Windows\System\ymrceeR.exe
  C:\Windows\System\ymrceeR.exe
  2⤵
  PID:9380
- C:\Windows\System\pyJVULj.exe
  C:\Windows\System\pyJVULj.exe
  2⤵
  PID:9400
- C:\Windows\System\PTeRAhe.exe
  C:\Windows\System\PTeRAhe.exe
  2⤵
  PID:9416
- C:\Windows\System\ZRLgLTx.exe
  C:\Windows\System\ZRLgLTx.exe
  2⤵
  PID:9436
- C:\Windows\System\pxkVWZn.exe
  C:\Windows\System\pxkVWZn.exe
  2⤵
  PID:9456
- C:\Windows\System\jMZxtpK.exe
  C:\Windows\System\jMZxtpK.exe
  2⤵
  PID:9472
- C:\Windows\System\DRmaHYT.exe
  C:\Windows\System\DRmaHYT.exe
  2⤵
  PID:9488
- C:\Windows\System\YUKHLcW.exe
  C:\Windows\System\YUKHLcW.exe
  2⤵
  PID:9504
- C:\Windows\System\Vtsbmpu.exe
  C:\Windows\System\Vtsbmpu.exe
  2⤵
  PID:9524
- C:\Windows\System\PfytcnI.exe
  C:\Windows\System\PfytcnI.exe
  2⤵
  PID:9540
- C:\Windows\System\fBaURPb.exe
  C:\Windows\System\fBaURPb.exe
  2⤵
  PID:9556
- C:\Windows\System\lmaMtLp.exe
  C:\Windows\System\lmaMtLp.exe
  2⤵
  PID:9576
- C:\Windows\System\OiKWGvc.exe
  C:\Windows\System\OiKWGvc.exe
  2⤵
  PID:9592
- C:\Windows\System\PKZfpSm.exe
  C:\Windows\System\PKZfpSm.exe
  2⤵
  PID:9608
- C:\Windows\System\qDoqgzf.exe
  C:\Windows\System\qDoqgzf.exe
  2⤵
  PID:9624
- C:\Windows\System\abnTEFN.exe
  C:\Windows\System\abnTEFN.exe
  2⤵
  PID:9640
- C:\Windows\System\DarwGjl.exe
  C:\Windows\System\DarwGjl.exe
  2⤵
  PID:9656
- C:\Windows\System\jvUCTfE.exe
  C:\Windows\System\jvUCTfE.exe
  2⤵
  PID:9672
- C:\Windows\System\uqigbZn.exe
  C:\Windows\System\uqigbZn.exe
  2⤵
  PID:9688
- C:\Windows\System\uqKaQHQ.exe
  C:\Windows\System\uqKaQHQ.exe
  2⤵
  PID:9704
- C:\Windows\System\nbqnzLn.exe
  C:\Windows\System\nbqnzLn.exe
  2⤵
  PID:9720
- C:\Windows\System\qdrbrGv.exe
  C:\Windows\System\qdrbrGv.exe
  2⤵
  PID:9736
- C:\Windows\System\bGPQLEc.exe
  C:\Windows\System\bGPQLEc.exe
  2⤵
  PID:9752
- C:\Windows\System\ThRdhsJ.exe
  C:\Windows\System\ThRdhsJ.exe
  2⤵
  PID:9780
- C:\Windows\System\mtFIccU.exe
  C:\Windows\System\mtFIccU.exe
  2⤵
  PID:9796
- C:\Windows\System\XpoWuUO.exe
  C:\Windows\System\XpoWuUO.exe
  2⤵
  PID:9816
- C:\Windows\System\dApRzPg.exe
  C:\Windows\System\dApRzPg.exe
  2⤵
  PID:9848
- C:\Windows\System\rtJCEKR.exe
  C:\Windows\System\rtJCEKR.exe
  2⤵
  PID:9868
- C:\Windows\System\uzNajYD.exe
  C:\Windows\System\uzNajYD.exe
  2⤵
  PID:9884
- C:\Windows\System\FxaSqHO.exe
  C:\Windows\System\FxaSqHO.exe
  2⤵
  PID:9900
- C:\Windows\System\TZudTgz.exe
  C:\Windows\System\TZudTgz.exe
  2⤵
  PID:9916
- C:\Windows\System\BWyAlqh.exe
  C:\Windows\System\BWyAlqh.exe
  2⤵
  PID:9932
- C:\Windows\System\LsPfqWT.exe
  C:\Windows\System\LsPfqWT.exe
  2⤵
  PID:9948
- C:\Windows\System\UzLDGNw.exe
  C:\Windows\System\UzLDGNw.exe
  2⤵
  PID:9968
- C:\Windows\System\nefdasP.exe
  C:\Windows\System\nefdasP.exe
  2⤵
  PID:9984
- C:\Windows\System\DDYjVxN.exe
  C:\Windows\System\DDYjVxN.exe
  2⤵
  PID:10000
- C:\Windows\System\hECjQXL.exe
  C:\Windows\System\hECjQXL.exe
  2⤵
  PID:10016
- C:\Windows\System\hdPGFRs.exe
  C:\Windows\System\hdPGFRs.exe
  2⤵
  PID:10032
- C:\Windows\System\pAzdPhP.exe
  C:\Windows\System\pAzdPhP.exe
  2⤵
  PID:10048
- C:\Windows\System\WyFalnM.exe
  C:\Windows\System\WyFalnM.exe
  2⤵
  PID:10064
- C:\Windows\System\latGyjO.exe
  C:\Windows\System\latGyjO.exe
  2⤵
  PID:10080
- C:\Windows\System\BTcfNCt.exe
  C:\Windows\System\BTcfNCt.exe
  2⤵
  PID:10096
- C:\Windows\System\MViTXZc.exe
  C:\Windows\System\MViTXZc.exe
  2⤵
  PID:10112
- C:\Windows\System\vAGDfSp.exe
  C:\Windows\System\vAGDfSp.exe
  2⤵
  PID:10128
- C:\Windows\System\upkNvvc.exe
  C:\Windows\System\upkNvvc.exe
  2⤵
  PID:10144
- C:\Windows\System\lNOAINe.exe
  C:\Windows\System\lNOAINe.exe
  2⤵
  PID:10160
- C:\Windows\System\cJrAgum.exe
  C:\Windows\System\cJrAgum.exe
  2⤵
  PID:10176
- C:\Windows\System\zuaZiPu.exe
  C:\Windows\System\zuaZiPu.exe
  2⤵
  PID:10192
- C:\Windows\System\DUWMVHw.exe
  C:\Windows\System\DUWMVHw.exe
  2⤵
  PID:10208
- C:\Windows\System\OdhlQTi.exe
  C:\Windows\System\OdhlQTi.exe
  2⤵
  PID:10224
- C:\Windows\System\rvPKyph.exe
  C:\Windows\System\rvPKyph.exe
  2⤵
  PID:8548
- C:\Windows\System\pFwrour.exe
  C:\Windows\System\pFwrour.exe
  2⤵
  PID:9244
- C:\Windows\System\YLvhDNp.exe
  C:\Windows\System\YLvhDNp.exe
  2⤵
  PID:9056
- C:\Windows\System\wpDWdwl.exe
  C:\Windows\System\wpDWdwl.exe
  2⤵
  PID:9308
- C:\Windows\System\hawITdi.exe
  C:\Windows\System\hawITdi.exe
  2⤵
  PID:9340
- C:\Windows\System\zOoTWiG.exe
  C:\Windows\System\zOoTWiG.exe
  2⤵
  PID:9328
- C:\Windows\System\LbdSJrv.exe
  C:\Windows\System\LbdSJrv.exe
  2⤵
  PID:9344
- C:\Windows\System\utzZJPS.exe
  C:\Windows\System\utzZJPS.exe
  2⤵
  PID:9376
- C:\Windows\System\tnixZLV.exe
  C:\Windows\System\tnixZLV.exe
  2⤵
  PID:9396
- C:\Windows\System\TPyRQXs.exe
  C:\Windows\System\TPyRQXs.exe
  2⤵
  PID:9468
- C:\Windows\System\clODCWI.exe
  C:\Windows\System\clODCWI.exe
  2⤵
  PID:9500
- C:\Windows\System\odJvCnx.exe
  C:\Windows\System\odJvCnx.exe
  2⤵
  PID:9568
- C:\Windows\System\RgzuTdL.exe
  C:\Windows\System\RgzuTdL.exe
  2⤵
  PID:9636
- C:\Windows\System\LJnulXP.exe
  C:\Windows\System\LJnulXP.exe
  2⤵
  PID:9444
- C:\Windows\System\ulAiVWM.exe
  C:\Windows\System\ulAiVWM.exe
  2⤵
  PID:9700
- C:\Windows\System\ajzGnkT.exe
  C:\Windows\System\ajzGnkT.exe
  2⤵
  PID:9760
- C:\Windows\System\IVvtPOe.exe
  C:\Windows\System\IVvtPOe.exe
  2⤵
  PID:9480
- C:\Windows\System\YNIrixo.exe
  C:\Windows\System\YNIrixo.exe
  2⤵
  PID:9520
- C:\Windows\System\EAGRLir.exe
  C:\Windows\System\EAGRLir.exe
  2⤵
  PID:9748
- C:\Windows\System\mXozexh.exe
  C:\Windows\System\mXozexh.exe
  2⤵
  PID:9620
- C:\Windows\System\tYKpdNm.exe
  C:\Windows\System\tYKpdNm.exe
  2⤵
  PID:9772
- C:\Windows\System\zINPxis.exe
  C:\Windows\System\zINPxis.exe
  2⤵
  PID:9812
- C:\Windows\System\wSTmtTQ.exe
  C:\Windows\System\wSTmtTQ.exe
  2⤵
  PID:9824
- C:\Windows\System\txTBAvp.exe
  C:\Windows\System\txTBAvp.exe
  2⤵
  PID:9864
- C:\Windows\System\rdqsDOr.exe
  C:\Windows\System\rdqsDOr.exe
  2⤵
  PID:9896
- C:\Windows\System\xfdkxPN.exe
  C:\Windows\System\xfdkxPN.exe
  2⤵
  PID:9960
- C:\Windows\System\afdVFYD.exe
  C:\Windows\System\afdVFYD.exe
  2⤵
  PID:9912
- C:\Windows\System\eEMQjLP.exe
  C:\Windows\System\eEMQjLP.exe
  2⤵
  PID:10056
- C:\Windows\System\veOPbKe.exe
  C:\Windows\System\veOPbKe.exe
  2⤵
  PID:10088
- C:\Windows\System\SKfIIVm.exe
  C:\Windows\System\SKfIIVm.exe
  2⤵
  PID:10120
- C:\Windows\System\yHPXRiX.exe
  C:\Windows\System\yHPXRiX.exe
  2⤵
  PID:9908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AJvyVFF.exe

Filesize
2.9MB

MD5
518405bf82610977c6141afd203bd05b

SHA1
4a9f9011f7ee27cef3a5c5f6cb46a65197e22e39

SHA256
1fae94c423cb60b71970910dd77b23ea7e84b6306bb86d71607d97b8f978b888

SHA512
aa42822afd2e83f04637ca0be09916b0fdb8883cd67ecc65200b8671c0a07b542f1cbac3a7ba53ea13e4cee951b5d0d6bb77b22aa9a7d220dffccaf13f3a7ecd

Download Submit
C:\Windows\system\BOwjjRk.exe

Filesize
2.9MB

MD5
96db36efd5921fd63ce0f7da47251706

SHA1
2a3c18bdb628290c8b3246422b333ae2833e922e

SHA256
76ed04266b700e7cd5811e25112d9860903c95a3ebe5f338034c82ed7e6fda70

SHA512
f2df1311d2a72de3a13487acfc7bf4df8d62f039420ae61e020f4be216385da16c745ce2bf5410134281192d774640b828ed067cdf0868c71420df49f9990b54

Download Submit
C:\Windows\system\BSEDSon.exe

Filesize
2.9MB

MD5
609a1a185cb4449234d4593aad921dde

SHA1
f3fb1a55ecd891c4750eb9a059f8500c07721ffd

SHA256
f65875f2a3effc0d9916710aa2c633d439d443b5774538f9d6cf666c41705e72

SHA512
ba251fdbe9606ade829974723f109337738cb013da14786a9a084ebcaef72ddb1e46c813f611708c8497bf651197fcd347d09a7dd6f47f00d030c4b7155010f9

Download Submit
C:\Windows\system\BVZQBME.exe

Filesize
2.9MB

MD5
821e193e750b95e82f0b42c9a908fd7f

SHA1
4ab27a5539a8de3350ce542753e6576cf68991a1

SHA256
91d5da4c8534af0a4fa1de3284b4f1b38f8b4f01c5c98efa0ffc51e83e4f5c5d

SHA512
98307bc63d847918c5323671cbbe781911696efa76501c4b8e8f476cf064ade9ec3d1ca2a8c4c006063c8371f25152a8df55898ded7ef5196c7890aeab4c26e9

Download Submit
C:\Windows\system\BiHwzig.exe

Filesize
2.9MB

MD5
3161847d21e32750b2bd993d37a2325a

SHA1
18e79412e64b42194e1365838deb358d14da8bcc

SHA256
ff8a60c3fbe73a9c4e651ca2bf5532470327b3f11107968bdc5cb7f35a947b4a

SHA512
911a9805062e7fecfee09be8e7f4f7236178a36d71e32b1b4de85d3c27947dcad91d1d99cea8caf353ab7c20f5687177b644b4efb8b77b64b803078f30ebc81c

Download Submit
C:\Windows\system\CarSDre.exe

Filesize
2.9MB

MD5
4f433a698322b5755c128f4e2a0e13dc

SHA1
b0461d57a385d1261c0616d1e45c70810a32b025

SHA256
08f0cbfa9ca8d279615b133bd5abf08f2aa3ccb18ef2dcabede2067612f2623c

SHA512
08d7cfb2ae5a25d706309c46193a5d3979fb9f154e3af19f163260feb61911a3e44ba00c5d54ab954ec98feec6ab2151a32a5965bc4854ecb32194d80c7dd0c5

Download Submit
C:\Windows\system\DFPwzaC.exe

Filesize
2.9MB

MD5
690b083f4c787963d6202e4a1e5eb11f

SHA1
71a9d808984b9287229551e32de3493b16e439e6

SHA256
15039d25e703acd3331db8ccaabede86463e6ac2fc5dbd0b4e6b0fedb4a29751

SHA512
ee8bcf982934478ddb99b342d6e6b4ded31bed8125dde312bb4755ad19eb330d07c64f881cef46603bf60f80a07f71d2b30ab402241cc0acd50072ba4432038f

Download Submit
C:\Windows\system\IhlTxoI.exe

Filesize
2.9MB

MD5
f3cc8faa540e836edf574f597beff6f4

SHA1
c4342c121e7d364964ed280a70c537a153e83e04

SHA256
d8c89d70c2571279ee456205a829cd1f2fd051e1ca8f2d34d8c6bde69336fbfa

SHA512
96448156c32567509a5f6cdc2ffec14cdd8d8e61ca6850fd5c6303d818107be91e71dee296790b6fe557888d7babf0df0a88c59badb4054146f78d97f693495e

Download Submit
C:\Windows\system\KvYZGLn.exe

Filesize
2.9MB

MD5
f07318a668dbfb3b2603f35f6e3783f8

SHA1
28175b9e1121a52eb3b6ac3ed2e125d0938ccddf

SHA256
af7f4b30ee09c59d2e1a94ec8a85f8b2338d67e0e0e081627bcecaa31d687ccd

SHA512
f872c13a83ea19c9c0341e76b7d0635289e98de537aeb833c187ef627355cc9582e17cba81cb7156b9d585014ce567c853e5415651880c63b2b7d71a6c43b7dd

Download Submit
C:\Windows\system\MLuDLJs.exe

Filesize
2.9MB

MD5
84cb9f39bdffa365e35c955ef5b2b6f1

SHA1
da3ba09aeda31e6016b6e0f577e3427679eaf4f1

SHA256
3d59be9c71d05b941af6eccafb2d32937f27f8749cbc16d5887f9d946de2f889

SHA512
d0f5e7bb55dabf02b5522f30fc019cb07199fb18ae0634a94cc785989a2f6cde23ffdb0cf300f9f6261cb67a72277ec1ddb271f1870179bd06a2656dad65bcbe

Download Submit
C:\Windows\system\MggtRTg.exe

Filesize
2.9MB

MD5
06b72ce96453db5d6c797d8cc2412537

SHA1
c9ede3098706252a400250e687e5f29ed96bc7c1

SHA256
a81e529b1447fb137b6f9fd2249b925211979ccb9dca41f9e05e1458230474aa

SHA512
0ef268552bc053339e8c2e5801e6eed27f0bf0e3aa324c067e0fcab36e7ff8e1ea36e537ff576178b5e290901a360de6ae52a1783a7992962e239c02ad708655

Download Submit
C:\Windows\system\TkqZaRy.exe

Filesize
2.9MB

MD5
44747be353471fbceb7290ff957b040f

SHA1
b33184ae2d1370593f0bab2303de1b33d5a841b4

SHA256
f5124298284c81f1c129a5d3e83435c48efd4425fa3f8a1f4fd346de2dfd3454

SHA512
e19d757f492302a6ac8bedc3c37310896fbe8e2e86d446b8a979337236efa3d8b31404633119b39b8762af939e9f5dafc144b33b52a176c7db798fafce81aa19

Download Submit
C:\Windows\system\UtUCGOv.exe

Filesize
2.9MB

MD5
9829c6d541ac81331e954bb1a258a2fd

SHA1
6ffc275b23060f44a97071b4ab6d931fa9330980

SHA256
a7b69121a0324e019fe5d429fc7240dc31e3cd1322d136fad05fdd58a33a17a0

SHA512
cc49334d6b2d3d7f1912205f7616545da7acbe98dafeca7da6ba0c7c4bd1084461f09ed16d68ab43c753a72a6a9a2184338fa0b8d0c459292bbbc8c9a2c71659

Download Submit
C:\Windows\system\VXaNsRD.exe

Filesize
2.9MB

MD5
12f9b759ca5b0b643c683e08a052f6bc

SHA1
354ace43298ef2784d78ac2d5fb46f21412e457b

SHA256
318ec9f436fd962433f7d26450b4d945d752c98aa681ff612e639058437e4c5a

SHA512
f63448c7a3242fb1d8fe76efbf5ace2c006d637dd5b20cbb45bff4a59a68d4311a78db6fd1c9d8fd9ffbd5ff59655a30b9ade297cb59203a1d578cb03c4cb79d

Download Submit
C:\Windows\system\aVAFHSx.exe

Filesize
2.9MB

MD5
85017febea6fe593f220da6eaa4ad3ff

SHA1
cd58b8924cf56f1b0a8a884a323a5afd4e14be9e

SHA256
9a7b04438e8b3e31ecd62b6de4c01bcaa373a92f14df860cb4e4c4e6d2707d6b

SHA512
e63c9d0c9205739f5509e990a0211f5f42e5576d641f1634a73eb8e90ab44317cd0546078c39c776b6f04b3a8e83703ddb5e8b32d04d4e6d88e7c21adbf8e885

Download Submit
C:\Windows\system\ftsceVk.exe

Filesize
2.9MB

MD5
749e79f98ba123b7db8bc784541f2d53

SHA1
edd48d126a7dae87ec67f7de49b110eee3b4b678

SHA256
715f964207561cd3f43698791148c6f61bfe41b8d3d84a79d0e6b262c63bfb19

SHA512
af040a027fae67a87ca817238b2fb63dfb683f18932f53de6e65459cb4f1fb3cbf1083642afdd6b1003b6caadf22066b7f76d1162ab348f221f6333d6046831a

Download Submit
C:\Windows\system\lzIsjDn.exe

Filesize
2.9MB

MD5
73909f8334ea4f896e459125d34257df

SHA1
9a1680d064b24cef0d2f290b56f32645ac87a7dc

SHA256
ba4b0d30b67986ae5a28dad0341728cfbcabf1e2b0ebad1375f95e1628f9430e

SHA512
a8873f0c7882aa101209e0a1ef274adaba19360831392100f31a9c0240bd6bf93fab4ace93f48a9e8b5960e94729dbd10ab58a79c6deebf2ca7c5472eb6d54ad

Download Submit
C:\Windows\system\mrIVrhV.exe

Filesize
2.9MB

MD5
8e4f41145d9e5315b1bf2916148e8934

SHA1
37780c53af16c36dc5ce963e1eaee752715e5e27

SHA256
939f85afaca6fccbd935a569f7fa6e5d08bd02854f46e7c96c9039b9240de684

SHA512
61c7f410266bd5d3d06bd34aae5a029c5c50681d745d04d9167891fb5aed37a534be6390cbb14d83fcdf1618bb3719cdfe61d9f4f742cbe03d2a0594c7a17162

Download Submit
C:\Windows\system\natTHmz.exe

Filesize
2.9MB

MD5
22bfc57f9f15ae8884d562df3c1b8f52

SHA1
5ce40ba304d1467799d2ae1d35d9e435de9956d2

SHA256
bfcb093489613883c0f306b355cb23868fc01b9a0fad043b694ddf4353f5ea28

SHA512
1afc7929b861ba37ab92e2e082cd21519056e5dd4fee7077547f2dffb189b23ffcd146207c51172cf5c3992e20e757c8c1610f282ec2275a00b517d5715fb8c6

Download Submit
C:\Windows\system\oDRQhoM.exe

Filesize
2.9MB

MD5
b92d893b4515e2518be22b0139df95d1

SHA1
506efc73091ed6184f3cbd08e5fb7ff38bee6d4b

SHA256
dca591e69386077333788208867718eb470608b5250c0b39482d2988440415e6

SHA512
07142fa6f73224fb1edf0b16a5ee57812ec66014764e31f423c908397d0254be638d5c45757f4b9fdda26c2ada6a62930a23a258b2d7b9d3259552a164bb536f

Download Submit
C:\Windows\system\rASFwvM.exe

Filesize
2.9MB

MD5
516d5d3710ffb395f296a01ee5a21e49

SHA1
76711c83c643a126f4fd4f7fb8bf7910067d9cfb

SHA256
7a4d3dd61d1b36abd11c7d28db27b243ae1880548be950bafcb2bd94f591c78f

SHA512
1b63bc355983263e33ae5145b1812cab13f6fd6b5bfe7416ea29a732789240d9358e88262143c397accb82920add096c63df06271f39c194021782b88465ccec

Download Submit
C:\Windows\system\rlRKwwW.exe

Filesize
2.9MB

MD5
2bfb628d2b2d39e3bf4c9b9ac0b34ab3

SHA1
f33f532224204b9587f3f1fef500308d9690614a

SHA256
8ded6148a0220812a05b4ac8c84ab180b036ea20dcd9ef568b6e8efae80c18b4

SHA512
c1131ff06a96d4f99c312136bc0b1050f1387838cd0bc2bc2777196672a398f7ee98676a108e0933eb73560380e13f05f8457599809f244ef17cc65cfc958f1c

Download Submit
C:\Windows\system\venDMVa.exe

Filesize
2.9MB

MD5
5f586f2e8646bb679d339f53d3acec12

SHA1
1427bdf5f2d281ac6afb5eaea89481aa346cff39

SHA256
c1d207d18561d952f424641ee2d218401eed70227f1441f15bf410a489080d2a

SHA512
19ffd142995a3893818db041fed2dbd3fd38e5f360563be12f88a37ef91609c866b230caa3aa086107046c203ee0346a22f84fd8e2f8abdd1ceb6ffc028e5eb4

Download Submit
C:\Windows\system\yTaDNyb.exe

Filesize
2.9MB

MD5
dd39267337f1c7e3f9e3c0fa5f46e98d

SHA1
5210dc6e7134db40e7e5b0c32b656d7e71eaf967

SHA256
60f9ed011923ec741ac6a5bd1b5dd1e6831f21a37ad346f43107ed3dea964460

SHA512
c0b958c6caf17ab607145a68774847c1d76fe62c696f583e48abec4d7f9f04faba124cebe1c8076f909a4fb4c52ddd6adfc75bcc951df00c987e26c73c0dc872

Download Submit
\Windows\system\EnydPQA.exe

Filesize
2.9MB

MD5
4aab636f9a82ddedba84be84fbd1368b

SHA1
ada5fcb0e63a914cd20aa82a85b6d9fd4fb44f41

SHA256
654aa858239e49aa2c0884c451a68da6212b1da6c7a6594f01eafa60156f9269

SHA512
2425a6e1ec99d0d8105868a0113e8e14456bd282aa86f34dfc60087eae6e32e7705171e4d7a5fc1f558d80e941a50a2c5dd50f248078f7aa6e856c6ca914deb3

Download Submit
\Windows\system\LBIlOCv.exe

Filesize
2.9MB

MD5
81e36a07c3ebfc8f4302de977838f747

SHA1
441ca115495c34e59fabc10d4640ee2df51b9cc2

SHA256
a325c3adc44a13786e9fdc9cbccab8bc574f92cf68ed1c7206998ae33fe3f9f1

SHA512
168fdc668df4846868ffb7a3c240285998be2f7da8538bbe8d6e8c2aa05d21c31561b3840e1b41fbc6331452424232946e90bf1006911aed8d903a59475c5a9a

Download Submit
\Windows\system\PWCXMGi.exe

Filesize
2.9MB

MD5
1c08f77408b2ff98a01debd6854c4143

SHA1
3c03aca0f77cdb4391615c4047cb3107d2018667

SHA256
97cd62e538e260c7d5447bba6f7ccf052a5e473bc6572e07af8c7b427596a462

SHA512
959c7c684a06be79d380e39cddbbb64897f3a7a9124b472b5182a6a9de0efdb229fede234bef71b2688d484b39ae2af8129466704b85c69000457dfda2f5bed6

Download Submit
\Windows\system\QoXbBph.exe

Filesize
2.9MB

MD5
87f0f96b2182635e732d630cb8981fc9

SHA1
f4da8c422c97869459798dfc4be69ed8063a99d4

SHA256
1c3814fae2ee9ecbdc571b02613dc54df393f4db9cc5eeff779af38501064a0d

SHA512
bc4abbbfd888daae01a4234135a1e231b625ed59393b612e780e55dc239c49a10737c68e0492bc6f3cca2348f5c141e0b8f50307eb7f91239a02106f659473a0

Download Submit
\Windows\system\dwIjMWW.exe

Filesize
2.9MB

MD5
c9a272dbe98bd4108ebafb8c40f5108f

SHA1
25971c50d7dc5076b99aa6f24feb7dc1b8675af5

SHA256
a534a36a2735cf751cc12cd4d03956e7004c19276ed7ac4529df2b3aa199f466

SHA512
23aae206f940f3282308f411ea0ad7de9291882167f546557ebcbeef708d3478bf026670e5f3d95064e2b3b84dc4688548e8a85f81648696aaa97ec68bfe8dee

Download Submit
\Windows\system\iqnpzuf.exe

Filesize
2.9MB

MD5
c1c3f6c2f6104b08e1ed42e2ea8dd196

SHA1
6d65e7acb24695b9f22ab8b8e90d09346290078e

SHA256
fc659ab75bdbaa3ed0a5870bb16de5dee48652da9c67750f15efcaa2644bee43

SHA512
3aa970de667eeeed042d6d31f834c87bd84800fee37874c00c845841e8e0cfb79c3f4c6a75154f8fe1764be00af54507e93ebda02d3df07ae51ddd16fad00e6b

Download Submit
\Windows\system\sETrDVH.exe

Filesize
2.9MB

MD5
61bf484c0da184bff75b38e149445a3c

SHA1
383896907c97c37f686dafd7028e78f590f4197d

SHA256
71616fa0ad69ca8570992b21ae6b312f8633ff7ef1b273d00a07129c9221283b

SHA512
e48e8ae861bf747fc1f5134fdb5a1c3fa44b2c26ae51c8bedad362931d2eaf699ca0322cbbd9ee8a51fcaf82d5603b85dfab38fe2036a4edb90b043e44685d95

Download Submit
\Windows\system\sJklziX.exe

Filesize
2.9MB

MD5
2f440a3033da0a87e1947573d3560d21

SHA1
6ce97167e32104a5d8538f09b3b114ad4c9f7ed4

SHA256
ba68df5341f0425d8614dce77c052f7fed01abcfa5839bc2fb019fdaef37f939

SHA512
84715ca848f3c413be6d9db5241dab275e02ff7bfc1f85e34929be3d2cb8fb0d54bfd750ba9514b8e78b63272f8f3f8fb97ac463ee2d7fcc7d6d4fc0f11886ac

Download Submit
memory/1696-2365-0x000000013FD80000-0x0000000140176000-memory.dmp

Filesize
4.0MB

Download
memory/1696-13-0x000000013FD80000-0x0000000140176000-memory.dmp

Filesize
4.0MB

Download
memory/1736-232-0x000000013FB70000-0x000000013FF66000-memory.dmp

Filesize
4.0MB

Download
memory/1736-195-0x000000013FC30000-0x0000000140026000-memory.dmp

Filesize
4.0MB

Download
memory/1736-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1736-210-0x0000000002E20000-0x0000000003216000-memory.dmp

Filesize
4.0MB

Download
memory/1736-8-0x000000013FD80000-0x0000000140176000-memory.dmp

Filesize
4.0MB

Download
memory/1736-228-0x000000013FA50000-0x000000013FE46000-memory.dmp

Filesize
4.0MB

Download
memory/1736-1100-0x000000013F400000-0x000000013F7F6000-memory.dmp

Filesize
4.0MB

Download
memory/1736-237-0x0000000002E20000-0x0000000003216000-memory.dmp

Filesize
4.0MB

Download
memory/1736-0-0x000000013F400000-0x000000013F7F6000-memory.dmp

Filesize
4.0MB

Download
memory/1736-188-0x0000000002E20000-0x0000000003216000-memory.dmp

Filesize
4.0MB

Download
memory/1736-241-0x0000000002E20000-0x0000000003216000-memory.dmp

Filesize
4.0MB

Download
memory/1736-178-0x0000000002E20000-0x0000000003216000-memory.dmp

Filesize
4.0MB

Download
memory/1736-204-0x0000000002E20000-0x0000000003216000-memory.dmp

Filesize
4.0MB

Download
memory/1736-179-0x0000000002E20000-0x0000000003216000-memory.dmp

Filesize
4.0MB

Download
memory/2312-854-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/2312-377-0x000000001B190000-0x000000001B472000-memory.dmp

Filesize
2.9MB

Download
memory/2312-171-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/2312-177-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/2312-391-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2312-28-0x000007FEF561E000-0x000007FEF561F000-memory.dmp

Filesize
4KB

Download
memory/2368-2596-0x000000013FA50000-0x000000013FE46000-memory.dmp

Filesize
4.0MB

Download
memory/2368-231-0x000000013FA50000-0x000000013FE46000-memory.dmp

Filesize
4.0MB

Download
memory/2388-209-0x000000013F240000-0x000000013F636000-memory.dmp

Filesize
4.0MB

Download
memory/2388-2625-0x000000013F240000-0x000000013F636000-memory.dmp

Filesize
4.0MB

Download
memory/2400-2431-0x000000013FC30000-0x0000000140026000-memory.dmp

Filesize
4.0MB

Download
memory/2400-200-0x000000013FC30000-0x0000000140026000-memory.dmp

Filesize
4.0MB

Download
memory/2428-2623-0x000000013FB70000-0x000000013FF66000-memory.dmp

Filesize
4.0MB

Download
memory/2428-236-0x000000013FB70000-0x000000013FF66000-memory.dmp

Filesize
4.0MB

Download
memory/2520-2378-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/2520-176-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/2528-2624-0x000000013F0F0000-0x000000013F4E6000-memory.dmp

Filesize
4.0MB

Download
memory/2528-223-0x000000013F0F0000-0x000000013F4E6000-memory.dmp

Filesize
4.0MB

Download
memory/2596-2405-0x000000013F0A0000-0x000000013F496000-memory.dmp

Filesize
4.0MB

Download
memory/2596-194-0x000000013F0A0000-0x000000013F496000-memory.dmp

Filesize
4.0MB

Download
memory/2600-2383-0x000000013F1A0000-0x000000013F596000-memory.dmp

Filesize
4.0MB

Download
memory/2600-184-0x000000013F1A0000-0x000000013F596000-memory.dmp

Filesize
4.0MB

Download
memory/2784-2390-0x000000013F470000-0x000000013F866000-memory.dmp

Filesize
4.0MB

Download
memory/2784-246-0x000000013F470000-0x000000013F866000-memory.dmp

Filesize
4.0MB

Download
memory/2848-2502-0x000000013F2A0000-0x000000013F696000-memory.dmp

Filesize
4.0MB

Download
memory/2848-240-0x000000013F2A0000-0x000000013F696000-memory.dmp

Filesize
4.0MB

Download
memory/2952-2374-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/2952-27-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download