xmrig | cbadab8bf269b316f2f5d608829ad2d41fed41e952c770853e6e2d24203dafd8

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
Size

1.5MB
MD5

daa173d32ac3a438da8c8b1ff3d77fe0
SHA1

48c40d9c8e845b974523ea869631adee4496c42e
SHA256

cbadab8bf269b316f2f5d608829ad2d41fed41e952c770853e6e2d24203dafd8
SHA512

de7f54618f83070d12aba031c4a5e445005d1657b1f6f61455d4e13f02b347cc54824ae116d23fcd3661c32032f7d1205e93b833ab7c990f109d7c8a377f4025
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW7r+kQQ7dXQARBa5eSh0eKITNEZ:Lz071uv4BPMkyW10/wKV7hjSeShTw

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/2080-13-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2492-108-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/2568-103-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2540-100-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2800-2313-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2336-2305-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2080-2312-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2540-2367-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2568-2311-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2492-2310-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/2372-2309-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2360-3068-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2380-3077-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2464-3095-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2376-3090-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig
behavioral1/memory/2188-3089-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2216	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2080	NHUhiWn.exe
2540	pjFzvSL.exe
2568	NQeDmQt.exe
2464	CbQkFmE.exe
2492	ILSJZpq.exe
2360	XnowkUi.exe
2372	BTdjxOX.exe
2380	eAAalyI.exe
2336	vaGCzXZ.exe
2376	ybNeItC.exe
2800	dRmTxMI.exe
2188	TZFWJVR.exe
2784	aCkbdjg.exe
680	PZXTJzV.exe
1848	KZACtxI.exe
812	nWRARxe.exe
1348	FlSLTft.exe
552	qcBrTjx.exe
1212	AcbtzNU.exe
1488	ttLbIvw.exe
1996	PaxtChV.exe
1368	SIBUgyd.exe
2164	hljeQXE.exe
2176	MXqTwXG.exe
2280	EsYHedd.exe
1592	CNAfePj.exe
884	nlabZCT.exe
2588	QBSxGua.exe
2584	bzBYvnc.exe
2652	uVvSiDo.exe
2788	ScGQdPJ.exe
2156	fmiAimQ.exe
2256	ziMrAjS.exe
2668	AWWwCDd.exe
2708	vvjXafs.exe
1128	pmFCDMb.exe
436	nCAhENG.exe
920	xFRiAvE.exe
1572	pcycdlE.exe
2208	gAeztSX.exe
1580	JAGkKDO.exe
1068	XEFpIjh.exe
1948	ERNFLZs.exe
3036	wklzLme.exe
1740	rdjFaDl.exe
2836	vUzKyyC.exe
872	odJoEGY.exe
2732	eWAsoUN.exe
2296	rzlmTgQ.exe
1536	fWbDVAE.exe
2416	KTWpKul.exe
1684	VasBStg.exe
2820	EwfBnqf.exe
1608	pkuHgTI.exe
2412	YmlALEO.exe
1896	qfyEVzx.exe
2436	QTlmjxB.exe
2484	vdlzUXJ.exe
2872	CTtJifN.exe
2496	weSdujB.exe
2364	cYgZXQP.exe
2100	mYwdZNO.exe
324	GUADkeT.exe
1052	CXiaycr.exe

Loads dropped DLL 64 IoCs

pid	Process
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2808-0-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x000b000000014fe1-3.dat	upx
behavioral1/memory/2080-13-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/files/0x00090000000155d9-16.dat	upx
behavioral1/files/0x0009000000015c23-23.dat	upx
behavioral1/files/0x0007000000015c2f-28.dat	upx
behavioral1/files/0x0007000000015c3c-33.dat	upx
behavioral1/files/0x0009000000015c52-36.dat	upx
behavioral1/files/0x0006000000016042-42.dat	upx
behavioral1/files/0x0006000000016283-52.dat	upx
behavioral1/files/0x0006000000016332-56.dat	upx
behavioral1/files/0x0006000000016476-58.dat	upx
behavioral1/files/0x000600000001663d-68.dat	upx
behavioral1/files/0x00060000000167db-72.dat	upx
behavioral1/files/0x0006000000016b5e-75.dat	upx
behavioral1/files/0x0006000000016c10-85.dat	upx
behavioral1/files/0x0006000000016d36-158.dat	upx
behavioral1/files/0x0006000000016d4a-168.dat	upx
behavioral1/files/0x0006000000016d41-164.dat	upx
behavioral1/files/0x0006000000016d24-156.dat	upx
behavioral1/files/0x000900000001560a-152.dat	upx
behavioral1/files/0x0006000000016cd4-144.dat	upx
behavioral1/files/0x0006000000016ca9-143.dat	upx
behavioral1/files/0x0006000000016d01-140.dat	upx
behavioral1/files/0x0006000000016d11-148.dat	upx
behavioral1/memory/2336-119-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2380-117-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2372-114-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2360-110-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2492-108-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/2464-106-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/files/0x0006000000016cf0-139.dat	upx
behavioral1/memory/2188-130-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2800-128-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/files/0x0006000000016ccf-127.dat	upx
behavioral1/memory/2376-122-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/memory/2568-103-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/memory/2540-100-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x0006000000016c90-97.dat	upx
behavioral1/files/0x0006000000016c23-93.dat	upx
behavioral1/files/0x0006000000016c1a-89.dat	upx
behavioral1/files/0x0006000000016b96-81.dat	upx
behavioral1/files/0x00060000000165ae-64.dat	upx
behavioral1/files/0x000600000001604b-48.dat	upx
behavioral1/files/0x0009000000015ec0-40.dat	upx
behavioral1/memory/2800-2313-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2336-2305-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2080-2312-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2540-2367-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2568-2311-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/memory/2492-2310-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/2372-2309-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2360-3068-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2380-3077-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2464-3095-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/memory/2376-3090-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/memory/2188-3089-0x000000013F710000-0x000000013FB02000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kNicmnA.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\EbCqQVX.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\xjphGCl.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\iVEgoLZ.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\YFHgIOq.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\rZYQsKO.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\BoZHBEJ.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\xIPjlbh.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\LkYArDh.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\CIOldHB.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\KzSPHNI.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\vjcojFn.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\mOobgEA.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\UBDjugA.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\hKLsTHC.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\fTebngO.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\tZTPdsJ.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\IvjVhqq.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\qUciAJh.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\UsQEmYv.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\TsQMUUr.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\XuhGVSh.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\hDssFfv.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\FtWnKWq.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\TZFWJVR.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\IbdvfME.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\klByRBH.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\HRdJdxs.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\ZOgKhUF.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\czPunZz.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\CXVKMdV.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\rhLOlBr.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\odkkmAV.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\juoLbWe.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\ipEiBlB.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\WIGqASr.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\kmlNtIp.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\oavgxqY.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\aollVlu.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\tUHXoJZ.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\mYWHHVp.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\zfauTvK.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\kUYCPkV.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\JTntHAR.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\HFoFEiF.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\GzFgKAD.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\YJBfeZN.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\hIYEFuv.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\xROZWoK.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\ILSJZpq.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\pcycdlE.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\mUBnrAa.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\kFhmWIw.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\OPyUJVP.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\heaMcWo.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\riUQFmH.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\gvdnCfR.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\YeUSJLj.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\WPyxtYK.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\ebTpZDe.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\rjkyEiD.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\RUBmKmP.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\zVYgFru.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\aBAItLQ.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2216	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2216	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2216	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	29
PID 2808 wrote to memory of 2216	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	29
PID 2808 wrote to memory of 2216	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	29
PID 2808 wrote to memory of 2080	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	30
PID 2808 wrote to memory of 2080	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	30
PID 2808 wrote to memory of 2080	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	30
PID 2808 wrote to memory of 2540	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	31
PID 2808 wrote to memory of 2540	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	31
PID 2808 wrote to memory of 2540	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	31
PID 2808 wrote to memory of 2568	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	32
PID 2808 wrote to memory of 2568	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	32
PID 2808 wrote to memory of 2568	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	32
PID 2808 wrote to memory of 2464	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	33
PID 2808 wrote to memory of 2464	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	33
PID 2808 wrote to memory of 2464	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	33
PID 2808 wrote to memory of 2492	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	34
PID 2808 wrote to memory of 2492	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	34
PID 2808 wrote to memory of 2492	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	34
PID 2808 wrote to memory of 2360	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	35
PID 2808 wrote to memory of 2360	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	35
PID 2808 wrote to memory of 2360	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	35
PID 2808 wrote to memory of 2372	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	36
PID 2808 wrote to memory of 2372	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	36
PID 2808 wrote to memory of 2372	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	36
PID 2808 wrote to memory of 2380	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	37
PID 2808 wrote to memory of 2380	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	37
PID 2808 wrote to memory of 2380	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	37
PID 2808 wrote to memory of 2336	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	38
PID 2808 wrote to memory of 2336	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	38
PID 2808 wrote to memory of 2336	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	38
PID 2808 wrote to memory of 2376	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	39
PID 2808 wrote to memory of 2376	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	39
PID 2808 wrote to memory of 2376	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	39
PID 2808 wrote to memory of 2800	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	40
PID 2808 wrote to memory of 2800	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	40
PID 2808 wrote to memory of 2800	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	40
PID 2808 wrote to memory of 2188	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	41
PID 2808 wrote to memory of 2188	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	41
PID 2808 wrote to memory of 2188	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	41
PID 2808 wrote to memory of 2784	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	42
PID 2808 wrote to memory of 2784	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	42
PID 2808 wrote to memory of 2784	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	42
PID 2808 wrote to memory of 680	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	43
PID 2808 wrote to memory of 680	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	43
PID 2808 wrote to memory of 680	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	43
PID 2808 wrote to memory of 1848	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	44
PID 2808 wrote to memory of 1848	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	44
PID 2808 wrote to memory of 1848	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	44
PID 2808 wrote to memory of 812	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	45
PID 2808 wrote to memory of 812	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	45
PID 2808 wrote to memory of 812	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	45
PID 2808 wrote to memory of 1348	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	46
PID 2808 wrote to memory of 1348	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	46
PID 2808 wrote to memory of 1348	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	46
PID 2808 wrote to memory of 552	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	47
PID 2808 wrote to memory of 552	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	47
PID 2808 wrote to memory of 552	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	47
PID 2808 wrote to memory of 1212	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	48
PID 2808 wrote to memory of 1212	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	48
PID 2808 wrote to memory of 1212	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	48
PID 2808 wrote to memory of 1488	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	49
PID 2808 wrote to memory of 1488	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	49
PID 2808 wrote to memory of 1488	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	49
PID 2808 wrote to memory of 1996	2808	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\System\NHUhiWn.exe
  C:\Windows\System\NHUhiWn.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\pjFzvSL.exe
  C:\Windows\System\pjFzvSL.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\NQeDmQt.exe
  C:\Windows\System\NQeDmQt.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\CbQkFmE.exe
  C:\Windows\System\CbQkFmE.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\ILSJZpq.exe
  C:\Windows\System\ILSJZpq.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\XnowkUi.exe
  C:\Windows\System\XnowkUi.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\BTdjxOX.exe
  C:\Windows\System\BTdjxOX.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\eAAalyI.exe
  C:\Windows\System\eAAalyI.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\vaGCzXZ.exe
  C:\Windows\System\vaGCzXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\ybNeItC.exe
  C:\Windows\System\ybNeItC.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\dRmTxMI.exe
  C:\Windows\System\dRmTxMI.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\TZFWJVR.exe
  C:\Windows\System\TZFWJVR.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\aCkbdjg.exe
  C:\Windows\System\aCkbdjg.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\PZXTJzV.exe
  C:\Windows\System\PZXTJzV.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\KZACtxI.exe
  C:\Windows\System\KZACtxI.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\nWRARxe.exe
  C:\Windows\System\nWRARxe.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\FlSLTft.exe
  C:\Windows\System\FlSLTft.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\qcBrTjx.exe
  C:\Windows\System\qcBrTjx.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\AcbtzNU.exe
  C:\Windows\System\AcbtzNU.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\ttLbIvw.exe
  C:\Windows\System\ttLbIvw.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\PaxtChV.exe
  C:\Windows\System\PaxtChV.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\MXqTwXG.exe
  C:\Windows\System\MXqTwXG.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\SIBUgyd.exe
  C:\Windows\System\SIBUgyd.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\EsYHedd.exe
  C:\Windows\System\EsYHedd.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\hljeQXE.exe
  C:\Windows\System\hljeQXE.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\nlabZCT.exe
  C:\Windows\System\nlabZCT.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\CNAfePj.exe
  C:\Windows\System\CNAfePj.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\QBSxGua.exe
  C:\Windows\System\QBSxGua.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\bzBYvnc.exe
  C:\Windows\System\bzBYvnc.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\uVvSiDo.exe
  C:\Windows\System\uVvSiDo.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\ScGQdPJ.exe
  C:\Windows\System\ScGQdPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\fmiAimQ.exe
  C:\Windows\System\fmiAimQ.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\ziMrAjS.exe
  C:\Windows\System\ziMrAjS.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\AWWwCDd.exe
  C:\Windows\System\AWWwCDd.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\vvjXafs.exe
  C:\Windows\System\vvjXafs.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\pmFCDMb.exe
  C:\Windows\System\pmFCDMb.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\nCAhENG.exe
  C:\Windows\System\nCAhENG.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\pcycdlE.exe
  C:\Windows\System\pcycdlE.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\xFRiAvE.exe
  C:\Windows\System\xFRiAvE.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\JAGkKDO.exe
  C:\Windows\System\JAGkKDO.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\gAeztSX.exe
  C:\Windows\System\gAeztSX.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\ERNFLZs.exe
  C:\Windows\System\ERNFLZs.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\XEFpIjh.exe
  C:\Windows\System\XEFpIjh.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\wklzLme.exe
  C:\Windows\System\wklzLme.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\rdjFaDl.exe
  C:\Windows\System\rdjFaDl.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\eWAsoUN.exe
  C:\Windows\System\eWAsoUN.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\vUzKyyC.exe
  C:\Windows\System\vUzKyyC.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\rzlmTgQ.exe
  C:\Windows\System\rzlmTgQ.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\odJoEGY.exe
  C:\Windows\System\odJoEGY.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\fWbDVAE.exe
  C:\Windows\System\fWbDVAE.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\KTWpKul.exe
  C:\Windows\System\KTWpKul.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\VasBStg.exe
  C:\Windows\System\VasBStg.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\EwfBnqf.exe
  C:\Windows\System\EwfBnqf.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\pkuHgTI.exe
  C:\Windows\System\pkuHgTI.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\YmlALEO.exe
  C:\Windows\System\YmlALEO.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\qfyEVzx.exe
  C:\Windows\System\qfyEVzx.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\QTlmjxB.exe
  C:\Windows\System\QTlmjxB.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\vdlzUXJ.exe
  C:\Windows\System\vdlzUXJ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\CTtJifN.exe
  C:\Windows\System\CTtJifN.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\weSdujB.exe
  C:\Windows\System\weSdujB.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\cYgZXQP.exe
  C:\Windows\System\cYgZXQP.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\mYwdZNO.exe
  C:\Windows\System\mYwdZNO.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\GUADkeT.exe
  C:\Windows\System\GUADkeT.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\CXiaycr.exe
  C:\Windows\System\CXiaycr.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\zfLkCKD.exe
  C:\Windows\System\zfLkCKD.exe
  2⤵
  PID:1428
- C:\Windows\System\FIVwkuH.exe
  C:\Windows\System\FIVwkuH.exe
  2⤵
  PID:1704
- C:\Windows\System\UBGmLNP.exe
  C:\Windows\System\UBGmLNP.exe
  2⤵
  PID:1632
- C:\Windows\System\NncTFwI.exe
  C:\Windows\System\NncTFwI.exe
  2⤵
  PID:1932
- C:\Windows\System\QaSijuV.exe
  C:\Windows\System\QaSijuV.exe
  2⤵
  PID:2008
- C:\Windows\System\sXigoyg.exe
  C:\Windows\System\sXigoyg.exe
  2⤵
  PID:952
- C:\Windows\System\ipEiBlB.exe
  C:\Windows\System\ipEiBlB.exe
  2⤵
  PID:2400
- C:\Windows\System\lgrLTFn.exe
  C:\Windows\System\lgrLTFn.exe
  2⤵
  PID:2748
- C:\Windows\System\eteMbHU.exe
  C:\Windows\System\eteMbHU.exe
  2⤵
  PID:2244
- C:\Windows\System\DZUiMQi.exe
  C:\Windows\System\DZUiMQi.exe
  2⤵
  PID:1100
- C:\Windows\System\jARukhR.exe
  C:\Windows\System\jARukhR.exe
  2⤵
  PID:1064
- C:\Windows\System\iMapwxQ.exe
  C:\Windows\System\iMapwxQ.exe
  2⤵
  PID:2352
- C:\Windows\System\AerzJiS.exe
  C:\Windows\System\AerzJiS.exe
  2⤵
  PID:1844
- C:\Windows\System\zNZVnhg.exe
  C:\Windows\System\zNZVnhg.exe
  2⤵
  PID:1636
- C:\Windows\System\mrXqzDD.exe
  C:\Windows\System\mrXqzDD.exe
  2⤵
  PID:2120
- C:\Windows\System\XqMIsKn.exe
  C:\Windows\System\XqMIsKn.exe
  2⤵
  PID:328
- C:\Windows\System\RUBmKmP.exe
  C:\Windows\System\RUBmKmP.exe
  2⤵
  PID:1992
- C:\Windows\System\GdEVfmi.exe
  C:\Windows\System\GdEVfmi.exe
  2⤵
  PID:1976
- C:\Windows\System\JHEWAzh.exe
  C:\Windows\System\JHEWAzh.exe
  2⤵
  PID:1564
- C:\Windows\System\YyJfKfM.exe
  C:\Windows\System\YyJfKfM.exe
  2⤵
  PID:2596
- C:\Windows\System\OCvZmkV.exe
  C:\Windows\System\OCvZmkV.exe
  2⤵
  PID:2852
- C:\Windows\System\qFEnlwe.exe
  C:\Windows\System\qFEnlwe.exe
  2⤵
  PID:2440
- C:\Windows\System\riUQFmH.exe
  C:\Windows\System\riUQFmH.exe
  2⤵
  PID:2520
- C:\Windows\System\HAdVmwF.exe
  C:\Windows\System\HAdVmwF.exe
  2⤵
  PID:2432
- C:\Windows\System\SzJocEi.exe
  C:\Windows\System\SzJocEi.exe
  2⤵
  PID:3008
- C:\Windows\System\QylBQpB.exe
  C:\Windows\System\QylBQpB.exe
  2⤵
  PID:368
- C:\Windows\System\qVWclsj.exe
  C:\Windows\System\qVWclsj.exe
  2⤵
  PID:1604
- C:\Windows\System\SBXFTus.exe
  C:\Windows\System\SBXFTus.exe
  2⤵
  PID:1196
- C:\Windows\System\CCeUyOg.exe
  C:\Windows\System\CCeUyOg.exe
  2⤵
  PID:1436
- C:\Windows\System\VZrdGcv.exe
  C:\Windows\System\VZrdGcv.exe
  2⤵
  PID:1216
- C:\Windows\System\AdVIvQH.exe
  C:\Windows\System\AdVIvQH.exe
  2⤵
  PID:1716
- C:\Windows\System\XFybHaN.exe
  C:\Windows\System\XFybHaN.exe
  2⤵
  PID:2424
- C:\Windows\System\Laowykd.exe
  C:\Windows\System\Laowykd.exe
  2⤵
  PID:2868
- C:\Windows\System\GsFszgp.exe
  C:\Windows\System\GsFszgp.exe
  2⤵
  PID:2552
- C:\Windows\System\ohCMuxG.exe
  C:\Windows\System\ohCMuxG.exe
  2⤵
  PID:2516
- C:\Windows\System\ixCfJXu.exe
  C:\Windows\System\ixCfJXu.exe
  2⤵
  PID:2448
- C:\Windows\System\cfBSDks.exe
  C:\Windows\System\cfBSDks.exe
  2⤵
  PID:2772
- C:\Windows\System\XLJSzkx.exe
  C:\Windows\System\XLJSzkx.exe
  2⤵
  PID:760
- C:\Windows\System\nZUAQhj.exe
  C:\Windows\System\nZUAQhj.exe
  2⤵
  PID:2096
- C:\Windows\System\PpfUIgh.exe
  C:\Windows\System\PpfUIgh.exe
  2⤵
  PID:1476
- C:\Windows\System\uomVREz.exe
  C:\Windows\System\uomVREz.exe
  2⤵
  PID:2456
- C:\Windows\System\xARSsHi.exe
  C:\Windows\System\xARSsHi.exe
  2⤵
  PID:1752
- C:\Windows\System\qaNdpjN.exe
  C:\Windows\System\qaNdpjN.exe
  2⤵
  PID:800
- C:\Windows\System\XxWiHlW.exe
  C:\Windows\System\XxWiHlW.exe
  2⤵
  PID:2780
- C:\Windows\System\MxgxhMj.exe
  C:\Windows\System\MxgxhMj.exe
  2⤵
  PID:576
- C:\Windows\System\SjvVjom.exe
  C:\Windows\System\SjvVjom.exe
  2⤵
  PID:1816
- C:\Windows\System\UBDjugA.exe
  C:\Windows\System\UBDjugA.exe
  2⤵
  PID:1828
- C:\Windows\System\AxqjkwP.exe
  C:\Windows\System\AxqjkwP.exe
  2⤵
  PID:2452
- C:\Windows\System\JYKteKu.exe
  C:\Windows\System\JYKteKu.exe
  2⤵
  PID:2036
- C:\Windows\System\OHprwtZ.exe
  C:\Windows\System\OHprwtZ.exe
  2⤵
  PID:2160
- C:\Windows\System\pidVTVy.exe
  C:\Windows\System\pidVTVy.exe
  2⤵
  PID:572
- C:\Windows\System\KSjDfBs.exe
  C:\Windows\System\KSjDfBs.exe
  2⤵
  PID:1512
- C:\Windows\System\YASywJU.exe
  C:\Windows\System\YASywJU.exe
  2⤵
  PID:1724
- C:\Windows\System\uReMORn.exe
  C:\Windows\System\uReMORn.exe
  2⤵
  PID:1484
- C:\Windows\System\zVkwIid.exe
  C:\Windows\System\zVkwIid.exe
  2⤵
  PID:3004
- C:\Windows\System\IrytiPt.exe
  C:\Windows\System\IrytiPt.exe
  2⤵
  PID:2752
- C:\Windows\System\RbuEMEM.exe
  C:\Windows\System\RbuEMEM.exe
  2⤵
  PID:1964
- C:\Windows\System\hphxFOR.exe
  C:\Windows\System\hphxFOR.exe
  2⤵
  PID:1768
- C:\Windows\System\uxpTzUu.exe
  C:\Windows\System\uxpTzUu.exe
  2⤵
  PID:2896
- C:\Windows\System\SekJbht.exe
  C:\Windows\System\SekJbht.exe
  2⤵
  PID:2408
- C:\Windows\System\RnDRZAT.exe
  C:\Windows\System\RnDRZAT.exe
  2⤵
  PID:1424
- C:\Windows\System\dmUPVNW.exe
  C:\Windows\System\dmUPVNW.exe
  2⤵
  PID:1784
- C:\Windows\System\SQIotvQ.exe
  C:\Windows\System\SQIotvQ.exe
  2⤵
  PID:2320
- C:\Windows\System\DoUHkPe.exe
  C:\Windows\System\DoUHkPe.exe
  2⤵
  PID:876
- C:\Windows\System\gvdnCfR.exe
  C:\Windows\System\gvdnCfR.exe
  2⤵
  PID:2468
- C:\Windows\System\XirDfon.exe
  C:\Windows\System\XirDfon.exe
  2⤵
  PID:2636
- C:\Windows\System\EPYaDQF.exe
  C:\Windows\System\EPYaDQF.exe
  2⤵
  PID:2300
- C:\Windows\System\gpIBVTW.exe
  C:\Windows\System\gpIBVTW.exe
  2⤵
  PID:1748
- C:\Windows\System\FNRVsVd.exe
  C:\Windows\System\FNRVsVd.exe
  2⤵
  PID:2072
- C:\Windows\System\gFUftgT.exe
  C:\Windows\System\gFUftgT.exe
  2⤵
  PID:2832
- C:\Windows\System\jxSVSNu.exe
  C:\Windows\System\jxSVSNu.exe
  2⤵
  PID:2212
- C:\Windows\System\ZNPnJXJ.exe
  C:\Windows\System\ZNPnJXJ.exe
  2⤵
  PID:904
- C:\Windows\System\PqKNHoN.exe
  C:\Windows\System\PqKNHoN.exe
  2⤵
  PID:1088
- C:\Windows\System\MvVzHRv.exe
  C:\Windows\System\MvVzHRv.exe
  2⤵
  PID:2404
- C:\Windows\System\TIJuScb.exe
  C:\Windows\System\TIJuScb.exe
  2⤵
  PID:2712
- C:\Windows\System\gKzIcmo.exe
  C:\Windows\System\gKzIcmo.exe
  2⤵
  PID:1168
- C:\Windows\System\MOLhHQh.exe
  C:\Windows\System\MOLhHQh.exe
  2⤵
  PID:2012
- C:\Windows\System\LcYWHbu.exe
  C:\Windows\System\LcYWHbu.exe
  2⤵
  PID:1136
- C:\Windows\System\xnRByBF.exe
  C:\Windows\System\xnRByBF.exe
  2⤵
  PID:2512
- C:\Windows\System\pPmSaej.exe
  C:\Windows\System\pPmSaej.exe
  2⤵
  PID:1988
- C:\Windows\System\MyUBXOc.exe
  C:\Windows\System\MyUBXOc.exe
  2⤵
  PID:964
- C:\Windows\System\giJMdof.exe
  C:\Windows\System\giJMdof.exe
  2⤵
  PID:1924
- C:\Windows\System\fKqVxEW.exe
  C:\Windows\System\fKqVxEW.exe
  2⤵
  PID:2392
- C:\Windows\System\uxfrlzL.exe
  C:\Windows\System\uxfrlzL.exe
  2⤵
  PID:1528
- C:\Windows\System\uMwnNhd.exe
  C:\Windows\System\uMwnNhd.exe
  2⤵
  PID:696
- C:\Windows\System\YlmDyOE.exe
  C:\Windows\System\YlmDyOE.exe
  2⤵
  PID:2848
- C:\Windows\System\uuQTzGD.exe
  C:\Windows\System\uuQTzGD.exe
  2⤵
  PID:1796
- C:\Windows\System\kQApHVR.exe
  C:\Windows\System\kQApHVR.exe
  2⤵
  PID:1696
- C:\Windows\System\vMeCuBX.exe
  C:\Windows\System\vMeCuBX.exe
  2⤵
  PID:1164
- C:\Windows\System\nlOUjvU.exe
  C:\Windows\System\nlOUjvU.exe
  2⤵
  PID:1056
- C:\Windows\System\DpWCrgz.exe
  C:\Windows\System\DpWCrgz.exe
  2⤵
  PID:2656
- C:\Windows\System\TausojQ.exe
  C:\Windows\System\TausojQ.exe
  2⤵
  PID:3020
- C:\Windows\System\iRITTbE.exe
  C:\Windows\System\iRITTbE.exe
  2⤵
  PID:2288
- C:\Windows\System\wfPjrWY.exe
  C:\Windows\System\wfPjrWY.exe
  2⤵
  PID:720
- C:\Windows\System\JErTeBf.exe
  C:\Windows\System\JErTeBf.exe
  2⤵
  PID:564
- C:\Windows\System\EQhMfRZ.exe
  C:\Windows\System\EQhMfRZ.exe
  2⤵
  PID:2608
- C:\Windows\System\lpNFhdb.exe
  C:\Windows\System\lpNFhdb.exe
  2⤵
  PID:2004
- C:\Windows\System\CyLhmAF.exe
  C:\Windows\System\CyLhmAF.exe
  2⤵
  PID:1772
- C:\Windows\System\XIPzZGg.exe
  C:\Windows\System\XIPzZGg.exe
  2⤵
  PID:1808
- C:\Windows\System\qTIfRmD.exe
  C:\Windows\System\qTIfRmD.exe
  2⤵
  PID:1288
- C:\Windows\System\FEdtaXS.exe
  C:\Windows\System\FEdtaXS.exe
  2⤵
  PID:2728
- C:\Windows\System\lQlHnvD.exe
  C:\Windows\System\lQlHnvD.exe
  2⤵
  PID:1320
- C:\Windows\System\PDPPqrl.exe
  C:\Windows\System\PDPPqrl.exe
  2⤵
  PID:3000
- C:\Windows\System\hajbpqE.exe
  C:\Windows\System\hajbpqE.exe
  2⤵
  PID:892
- C:\Windows\System\DXuiWoW.exe
  C:\Windows\System\DXuiWoW.exe
  2⤵
  PID:1276
- C:\Windows\System\vtLlFHl.exe
  C:\Windows\System\vtLlFHl.exe
  2⤵
  PID:2600
- C:\Windows\System\OkKyQmF.exe
  C:\Windows\System\OkKyQmF.exe
  2⤵
  PID:2688
- C:\Windows\System\xAjkwUf.exe
  C:\Windows\System\xAjkwUf.exe
  2⤵
  PID:2996
- C:\Windows\System\KlbVUje.exe
  C:\Windows\System\KlbVUje.exe
  2⤵
  PID:668
- C:\Windows\System\ZQmqoYc.exe
  C:\Windows\System\ZQmqoYc.exe
  2⤵
  PID:568
- C:\Windows\System\dZsQPbl.exe
  C:\Windows\System\dZsQPbl.exe
  2⤵
  PID:840
- C:\Windows\System\yIYxfTp.exe
  C:\Windows\System\yIYxfTp.exe
  2⤵
  PID:948
- C:\Windows\System\FRWlyCy.exe
  C:\Windows\System\FRWlyCy.exe
  2⤵
  PID:3084
- C:\Windows\System\GIJViwj.exe
  C:\Windows\System\GIJViwj.exe
  2⤵
  PID:3100
- C:\Windows\System\CGLXHEU.exe
  C:\Windows\System\CGLXHEU.exe
  2⤵
  PID:3116
- C:\Windows\System\yYXJYmG.exe
  C:\Windows\System\yYXJYmG.exe
  2⤵
  PID:3132
- C:\Windows\System\ZfoolVO.exe
  C:\Windows\System\ZfoolVO.exe
  2⤵
  PID:3148
- C:\Windows\System\hBaSarM.exe
  C:\Windows\System\hBaSarM.exe
  2⤵
  PID:3164
- C:\Windows\System\GqMzvdG.exe
  C:\Windows\System\GqMzvdG.exe
  2⤵
  PID:3180
- C:\Windows\System\bHQoBKl.exe
  C:\Windows\System\bHQoBKl.exe
  2⤵
  PID:3196
- C:\Windows\System\pOoyWrO.exe
  C:\Windows\System\pOoyWrO.exe
  2⤵
  PID:3212
- C:\Windows\System\klrhNyq.exe
  C:\Windows\System\klrhNyq.exe
  2⤵
  PID:3228
- C:\Windows\System\cDyGeEh.exe
  C:\Windows\System\cDyGeEh.exe
  2⤵
  PID:3244
- C:\Windows\System\qRDkZVa.exe
  C:\Windows\System\qRDkZVa.exe
  2⤵
  PID:3500
- C:\Windows\System\kbRKiDb.exe
  C:\Windows\System\kbRKiDb.exe
  2⤵
  PID:3552
- C:\Windows\System\jyPxPVo.exe
  C:\Windows\System\jyPxPVo.exe
  2⤵
  PID:3568
- C:\Windows\System\IudxWJz.exe
  C:\Windows\System\IudxWJz.exe
  2⤵
  PID:3584
- C:\Windows\System\sVLFaco.exe
  C:\Windows\System\sVLFaco.exe
  2⤵
  PID:3600
- C:\Windows\System\UlEZskx.exe
  C:\Windows\System\UlEZskx.exe
  2⤵
  PID:3616
- C:\Windows\System\FEQfqRU.exe
  C:\Windows\System\FEQfqRU.exe
  2⤵
  PID:3636
- C:\Windows\System\JWwYdOc.exe
  C:\Windows\System\JWwYdOc.exe
  2⤵
  PID:3652
- C:\Windows\System\VuQrXDy.exe
  C:\Windows\System\VuQrXDy.exe
  2⤵
  PID:3668
- C:\Windows\System\MlelduR.exe
  C:\Windows\System\MlelduR.exe
  2⤵
  PID:3684
- C:\Windows\System\HROGnUx.exe
  C:\Windows\System\HROGnUx.exe
  2⤵
  PID:3700
- C:\Windows\System\yZJPgSw.exe
  C:\Windows\System\yZJPgSw.exe
  2⤵
  PID:3720
- C:\Windows\System\zDiUVTk.exe
  C:\Windows\System\zDiUVTk.exe
  2⤵
  PID:3736
- C:\Windows\System\QGDuRCB.exe
  C:\Windows\System\QGDuRCB.exe
  2⤵
  PID:3752
- C:\Windows\System\CKEuhZz.exe
  C:\Windows\System\CKEuhZz.exe
  2⤵
  PID:3800
- C:\Windows\System\HFoFEiF.exe
  C:\Windows\System\HFoFEiF.exe
  2⤵
  PID:3816
- C:\Windows\System\izwWpPX.exe
  C:\Windows\System\izwWpPX.exe
  2⤵
  PID:3836
- C:\Windows\System\gXVBNxM.exe
  C:\Windows\System\gXVBNxM.exe
  2⤵
  PID:3852
- C:\Windows\System\eSjnshJ.exe
  C:\Windows\System\eSjnshJ.exe
  2⤵
  PID:3868
- C:\Windows\System\cHYsGcA.exe
  C:\Windows\System\cHYsGcA.exe
  2⤵
  PID:3884
- C:\Windows\System\btFJvAg.exe
  C:\Windows\System\btFJvAg.exe
  2⤵
  PID:3900
- C:\Windows\System\KPCrNaT.exe
  C:\Windows\System\KPCrNaT.exe
  2⤵
  PID:3920
- C:\Windows\System\eLcsDVo.exe
  C:\Windows\System\eLcsDVo.exe
  2⤵
  PID:3936
- C:\Windows\System\LmnFksf.exe
  C:\Windows\System\LmnFksf.exe
  2⤵
  PID:3952
- C:\Windows\System\cXxTNAE.exe
  C:\Windows\System\cXxTNAE.exe
  2⤵
  PID:3968
- C:\Windows\System\IqSOHFp.exe
  C:\Windows\System\IqSOHFp.exe
  2⤵
  PID:3988
- C:\Windows\System\xcwqgoA.exe
  C:\Windows\System\xcwqgoA.exe
  2⤵
  PID:4004
- C:\Windows\System\RZQuLbV.exe
  C:\Windows\System\RZQuLbV.exe
  2⤵
  PID:4020
- C:\Windows\System\VpeuuJt.exe
  C:\Windows\System\VpeuuJt.exe
  2⤵
  PID:2032
- C:\Windows\System\mEMQtLq.exe
  C:\Windows\System\mEMQtLq.exe
  2⤵
  PID:2684
- C:\Windows\System\mnlcsbe.exe
  C:\Windows\System\mnlcsbe.exe
  2⤵
  PID:2500
- C:\Windows\System\NhkmoPf.exe
  C:\Windows\System\NhkmoPf.exe
  2⤵
  PID:2060
- C:\Windows\System\rjUfLVi.exe
  C:\Windows\System\rjUfLVi.exe
  2⤵
  PID:3124
- C:\Windows\System\PNBCwEM.exe
  C:\Windows\System\PNBCwEM.exe
  2⤵
  PID:3192
- C:\Windows\System\BAKFVRP.exe
  C:\Windows\System\BAKFVRP.exe
  2⤵
  PID:3260
- C:\Windows\System\heSOCPN.exe
  C:\Windows\System\heSOCPN.exe
  2⤵
  PID:3276
- C:\Windows\System\mvOTphO.exe
  C:\Windows\System\mvOTphO.exe
  2⤵
  PID:3300
- C:\Windows\System\zOexaqO.exe
  C:\Windows\System\zOexaqO.exe
  2⤵
  PID:3316
- C:\Windows\System\TUyUkuu.exe
  C:\Windows\System\TUyUkuu.exe
  2⤵
  PID:3336
- C:\Windows\System\bDnIHyj.exe
  C:\Windows\System\bDnIHyj.exe
  2⤵
  PID:3352
- C:\Windows\System\BYKylej.exe
  C:\Windows\System\BYKylej.exe
  2⤵
  PID:3368
- C:\Windows\System\YTTiQrE.exe
  C:\Windows\System\YTTiQrE.exe
  2⤵
  PID:3392
- C:\Windows\System\xYaAnuA.exe
  C:\Windows\System\xYaAnuA.exe
  2⤵
  PID:3408
- C:\Windows\System\yPSZkeA.exe
  C:\Windows\System\yPSZkeA.exe
  2⤵
  PID:3424
- C:\Windows\System\JkRWdAj.exe
  C:\Windows\System\JkRWdAj.exe
  2⤵
  PID:3444
- C:\Windows\System\vETnsYi.exe
  C:\Windows\System\vETnsYi.exe
  2⤵
  PID:3464
- C:\Windows\System\RewFICj.exe
  C:\Windows\System\RewFICj.exe
  2⤵
  PID:3476
- C:\Windows\System\DLaScEd.exe
  C:\Windows\System\DLaScEd.exe
  2⤵
  PID:2044
- C:\Windows\System\aqUCVcP.exe
  C:\Windows\System\aqUCVcP.exe
  2⤵
  PID:3108
- C:\Windows\System\lutQNRJ.exe
  C:\Windows\System\lutQNRJ.exe
  2⤵
  PID:3176
- C:\Windows\System\oKEPhhR.exe
  C:\Windows\System\oKEPhhR.exe
  2⤵
  PID:2204
- C:\Windows\System\BEcFRCH.exe
  C:\Windows\System\BEcFRCH.exe
  2⤵
  PID:3080
- C:\Windows\System\xcQKycY.exe
  C:\Windows\System\xcQKycY.exe
  2⤵
  PID:3520
- C:\Windows\System\JVzBCfz.exe
  C:\Windows\System\JVzBCfz.exe
  2⤵
  PID:1360
- C:\Windows\System\wmLdTXQ.exe
  C:\Windows\System\wmLdTXQ.exe
  2⤵
  PID:3056
- C:\Windows\System\RebWiFJ.exe
  C:\Windows\System\RebWiFJ.exe
  2⤵
  PID:3536
- C:\Windows\System\clbGrvC.exe
  C:\Windows\System\clbGrvC.exe
  2⤵
  PID:3484
- C:\Windows\System\nIDdZBF.exe
  C:\Windows\System\nIDdZBF.exe
  2⤵
  PID:3784
- C:\Windows\System\vPeGTmb.exe
  C:\Windows\System\vPeGTmb.exe
  2⤵
  PID:3796
- C:\Windows\System\QjwWPIZ.exe
  C:\Windows\System\QjwWPIZ.exe
  2⤵
  PID:3644
- C:\Windows\System\zMBgAfN.exe
  C:\Windows\System\zMBgAfN.exe
  2⤵
  PID:3828
- C:\Windows\System\YjRsCMq.exe
  C:\Windows\System\YjRsCMq.exe
  2⤵
  PID:3928
- C:\Windows\System\oPLeUWe.exe
  C:\Windows\System\oPLeUWe.exe
  2⤵
  PID:3648
- C:\Windows\System\qDJiNyn.exe
  C:\Windows\System\qDJiNyn.exe
  2⤵
  PID:3708
- C:\Windows\System\GHVLdFB.exe
  C:\Windows\System\GHVLdFB.exe
  2⤵
  PID:3744
- C:\Windows\System\LHJtSRC.exe
  C:\Windows\System\LHJtSRC.exe
  2⤵
  PID:4028
- C:\Windows\System\cQfiaig.exe
  C:\Windows\System\cQfiaig.exe
  2⤵
  PID:4040
- C:\Windows\System\GwxBRXE.exe
  C:\Windows\System\GwxBRXE.exe
  2⤵
  PID:4052
- C:\Windows\System\GzFgKAD.exe
  C:\Windows\System\GzFgKAD.exe
  2⤵
  PID:4076
- C:\Windows\System\zBfPvWc.exe
  C:\Windows\System\zBfPvWc.exe
  2⤵
  PID:3844
- C:\Windows\System\wjCBEZY.exe
  C:\Windows\System\wjCBEZY.exe
  2⤵
  PID:3908
- C:\Windows\System\oJzwfDG.exe
  C:\Windows\System\oJzwfDG.exe
  2⤵
  PID:3948
- C:\Windows\System\iuoZGgp.exe
  C:\Windows\System\iuoZGgp.exe
  2⤵
  PID:2628
- C:\Windows\System\zRluEWx.exe
  C:\Windows\System\zRluEWx.exe
  2⤵
  PID:3432
- C:\Windows\System\tkkNSPc.exe
  C:\Windows\System\tkkNSPc.exe
  2⤵
  PID:3292
- C:\Windows\System\FSklHvZ.exe
  C:\Windows\System\FSklHvZ.exe
  2⤵
  PID:3156
- C:\Windows\System\ZtrSByT.exe
  C:\Windows\System\ZtrSByT.exe
  2⤵
  PID:3348
- C:\Windows\System\URXbzNC.exe
  C:\Windows\System\URXbzNC.exe
  2⤵
  PID:3328
- C:\Windows\System\lNKfCHE.exe
  C:\Windows\System\lNKfCHE.exe
  2⤵
  PID:2192
- C:\Windows\System\VOJVcTg.exe
  C:\Windows\System\VOJVcTg.exe
  2⤵
  PID:3208
- C:\Windows\System\baGDISw.exe
  C:\Windows\System\baGDISw.exe
  2⤵
  PID:2572
- C:\Windows\System\ugGGycm.exe
  C:\Windows\System\ugGGycm.exe
  2⤵
  PID:3076
- C:\Windows\System\XGOTWFn.exe
  C:\Windows\System\XGOTWFn.exe
  2⤵
  PID:2532
- C:\Windows\System\tVqzfUi.exe
  C:\Windows\System\tVqzfUi.exe
  2⤵
  PID:3160
- C:\Windows\System\DfaXHpF.exe
  C:\Windows\System\DfaXHpF.exe
  2⤵
  PID:4036
- C:\Windows\System\XaFBAUI.exe
  C:\Windows\System\XaFBAUI.exe
  2⤵
  PID:3880
- C:\Windows\System\eZBnrFy.exe
  C:\Windows\System\eZBnrFy.exe
  2⤵
  PID:1556
- C:\Windows\System\zmmvPyp.exe
  C:\Windows\System\zmmvPyp.exe
  2⤵
  PID:1584
- C:\Windows\System\YMnXamP.exe
  C:\Windows\System\YMnXamP.exe
  2⤵
  PID:3344
- C:\Windows\System\eVqPtcZ.exe
  C:\Windows\System\eVqPtcZ.exe
  2⤵
  PID:3456
- C:\Windows\System\hmSMcUy.exe
  C:\Windows\System\hmSMcUy.exe
  2⤵
  PID:2168
- C:\Windows\System\CbkRHoJ.exe
  C:\Windows\System\CbkRHoJ.exe
  2⤵
  PID:3628
- C:\Windows\System\gKRxgER.exe
  C:\Windows\System\gKRxgER.exe
  2⤵
  PID:3580
- C:\Windows\System\ZWZeRBD.exe
  C:\Windows\System\ZWZeRBD.exe
  2⤵
  PID:1980
- C:\Windows\System\jXCqRKx.exe
  C:\Windows\System\jXCqRKx.exe
  2⤵
  PID:3692
- C:\Windows\System\oLUzNsb.exe
  C:\Windows\System\oLUzNsb.exe
  2⤵
  PID:3760
- C:\Windows\System\LeiGTIz.exe
  C:\Windows\System\LeiGTIz.exe
  2⤵
  PID:3896
- C:\Windows\System\ZtsQYKL.exe
  C:\Windows\System\ZtsQYKL.exe
  2⤵
  PID:4048
- C:\Windows\System\SUCmhph.exe
  C:\Windows\System\SUCmhph.exe
  2⤵
  PID:3808
- C:\Windows\System\IXoYTCZ.exe
  C:\Windows\System\IXoYTCZ.exe
  2⤵
  PID:3096
- C:\Windows\System\dzpYztj.exe
  C:\Windows\System\dzpYztj.exe
  2⤵
  PID:2144
- C:\Windows\System\IaDYbVb.exe
  C:\Windows\System\IaDYbVb.exe
  2⤵
  PID:3416
- C:\Windows\System\dUoZqji.exe
  C:\Windows\System\dUoZqji.exe
  2⤵
  PID:3384
- C:\Windows\System\kaYOVHt.exe
  C:\Windows\System\kaYOVHt.exe
  2⤵
  PID:1188
- C:\Windows\System\jHMuXvM.exe
  C:\Windows\System\jHMuXvM.exe
  2⤵
  PID:3272
- C:\Windows\System\sZnRBTm.exe
  C:\Windows\System\sZnRBTm.exe
  2⤵
  PID:3984
- C:\Windows\System\FiilFzH.exe
  C:\Windows\System\FiilFzH.exe
  2⤵
  PID:3592
- C:\Windows\System\QWluUWi.exe
  C:\Windows\System\QWluUWi.exe
  2⤵
  PID:3660
- C:\Windows\System\OCdYAsa.exe
  C:\Windows\System\OCdYAsa.exe
  2⤵
  PID:3320
- C:\Windows\System\LMADHcl.exe
  C:\Windows\System\LMADHcl.exe
  2⤵
  PID:1756
- C:\Windows\System\dXXaPDm.exe
  C:\Windows\System\dXXaPDm.exe
  2⤵
  PID:4068
- C:\Windows\System\FOoKeMR.exe
  C:\Windows\System\FOoKeMR.exe
  2⤵
  PID:3288
- C:\Windows\System\nvljQwN.exe
  C:\Windows\System\nvljQwN.exe
  2⤵
  PID:3772
- C:\Windows\System\CcoAKpM.exe
  C:\Windows\System\CcoAKpM.exe
  2⤵
  PID:3780
- C:\Windows\System\lccvMrM.exe
  C:\Windows\System\lccvMrM.exe
  2⤵
  PID:3452
- C:\Windows\System\ktFVpSI.exe
  C:\Windows\System\ktFVpSI.exe
  2⤵
  PID:3996
- C:\Windows\System\ygTgUhH.exe
  C:\Windows\System\ygTgUhH.exe
  2⤵
  PID:3144
- C:\Windows\System\MncVkov.exe
  C:\Windows\System\MncVkov.exe
  2⤵
  PID:3420
- C:\Windows\System\yNDOLDq.exe
  C:\Windows\System\yNDOLDq.exe
  2⤵
  PID:3364
- C:\Windows\System\EvpOowL.exe
  C:\Windows\System\EvpOowL.exe
  2⤵
  PID:112
- C:\Windows\System\GFXwDNg.exe
  C:\Windows\System\GFXwDNg.exe
  2⤵
  PID:4156
- C:\Windows\System\ytATvHz.exe
  C:\Windows\System\ytATvHz.exe
  2⤵
  PID:4176
- C:\Windows\System\hwHzBZw.exe
  C:\Windows\System\hwHzBZw.exe
  2⤵
  PID:4196
- C:\Windows\System\GVMQEwX.exe
  C:\Windows\System\GVMQEwX.exe
  2⤵
  PID:4216
- C:\Windows\System\wWLuiPF.exe
  C:\Windows\System\wWLuiPF.exe
  2⤵
  PID:4232
- C:\Windows\System\SiDdScg.exe
  C:\Windows\System\SiDdScg.exe
  2⤵
  PID:4248
- C:\Windows\System\hktVHYf.exe
  C:\Windows\System\hktVHYf.exe
  2⤵
  PID:4264
- C:\Windows\System\GSqArnV.exe
  C:\Windows\System\GSqArnV.exe
  2⤵
  PID:4284
- C:\Windows\System\NvHBRdr.exe
  C:\Windows\System\NvHBRdr.exe
  2⤵
  PID:4300
- C:\Windows\System\kEXlmRq.exe
  C:\Windows\System\kEXlmRq.exe
  2⤵
  PID:4316
- C:\Windows\System\MJQQKQG.exe
  C:\Windows\System\MJQQKQG.exe
  2⤵
  PID:4332
- C:\Windows\System\bMOSpbk.exe
  C:\Windows\System\bMOSpbk.exe
  2⤵
  PID:4348
- C:\Windows\System\iBpWuDO.exe
  C:\Windows\System\iBpWuDO.exe
  2⤵
  PID:4364
- C:\Windows\System\KgOhLpA.exe
  C:\Windows\System\KgOhLpA.exe
  2⤵
  PID:4384
- C:\Windows\System\tuXMJUh.exe
  C:\Windows\System\tuXMJUh.exe
  2⤵
  PID:4404
- C:\Windows\System\ftrpEWd.exe
  C:\Windows\System\ftrpEWd.exe
  2⤵
  PID:4420
- C:\Windows\System\ZpECjEx.exe
  C:\Windows\System\ZpECjEx.exe
  2⤵
  PID:4436
- C:\Windows\System\DzCCbRa.exe
  C:\Windows\System\DzCCbRa.exe
  2⤵
  PID:4456
- C:\Windows\System\OSvfDEq.exe
  C:\Windows\System\OSvfDEq.exe
  2⤵
  PID:4480
- C:\Windows\System\nbnWjNc.exe
  C:\Windows\System\nbnWjNc.exe
  2⤵
  PID:4500
- C:\Windows\System\xYuDrbW.exe
  C:\Windows\System\xYuDrbW.exe
  2⤵
  PID:4516
- C:\Windows\System\XiAjfsq.exe
  C:\Windows\System\XiAjfsq.exe
  2⤵
  PID:4532
- C:\Windows\System\WJyWmcJ.exe
  C:\Windows\System\WJyWmcJ.exe
  2⤵
  PID:4548
- C:\Windows\System\gsEaUCC.exe
  C:\Windows\System\gsEaUCC.exe
  2⤵
  PID:4572
- C:\Windows\System\yovxjIn.exe
  C:\Windows\System\yovxjIn.exe
  2⤵
  PID:4592
- C:\Windows\System\JeENDCx.exe
  C:\Windows\System\JeENDCx.exe
  2⤵
  PID:4608
- C:\Windows\System\EdhPCUT.exe
  C:\Windows\System\EdhPCUT.exe
  2⤵
  PID:4624
- C:\Windows\System\WVpVZEW.exe
  C:\Windows\System\WVpVZEW.exe
  2⤵
  PID:4644
- C:\Windows\System\ANeZTYC.exe
  C:\Windows\System\ANeZTYC.exe
  2⤵
  PID:4660
- C:\Windows\System\LMAOVxT.exe
  C:\Windows\System\LMAOVxT.exe
  2⤵
  PID:4676
- C:\Windows\System\bsEWfHn.exe
  C:\Windows\System\bsEWfHn.exe
  2⤵
  PID:4692
- C:\Windows\System\JErzxzv.exe
  C:\Windows\System\JErzxzv.exe
  2⤵
  PID:4708
- C:\Windows\System\XbZGlsE.exe
  C:\Windows\System\XbZGlsE.exe
  2⤵
  PID:4728
- C:\Windows\System\CcdKFpF.exe
  C:\Windows\System\CcdKFpF.exe
  2⤵
  PID:4744
- C:\Windows\System\MagDkTq.exe
  C:\Windows\System\MagDkTq.exe
  2⤵
  PID:4760
- C:\Windows\System\PrgTgaL.exe
  C:\Windows\System\PrgTgaL.exe
  2⤵
  PID:4780
- C:\Windows\System\UADSCZR.exe
  C:\Windows\System\UADSCZR.exe
  2⤵
  PID:4796
- C:\Windows\System\zbbbaAG.exe
  C:\Windows\System\zbbbaAG.exe
  2⤵
  PID:4816
- C:\Windows\System\ZXdiJoc.exe
  C:\Windows\System\ZXdiJoc.exe
  2⤵
  PID:4832
- C:\Windows\System\ktPWcQU.exe
  C:\Windows\System\ktPWcQU.exe
  2⤵
  PID:4848
- C:\Windows\System\hAYcfGN.exe
  C:\Windows\System\hAYcfGN.exe
  2⤵
  PID:4868
- C:\Windows\System\IbdvfME.exe
  C:\Windows\System\IbdvfME.exe
  2⤵
  PID:4884
- C:\Windows\System\pjbjddg.exe
  C:\Windows\System\pjbjddg.exe
  2⤵
  PID:4900
- C:\Windows\System\rqLqGNn.exe
  C:\Windows\System\rqLqGNn.exe
  2⤵
  PID:4916
- C:\Windows\System\FAySoLE.exe
  C:\Windows\System\FAySoLE.exe
  2⤵
  PID:4932
- C:\Windows\System\UsQEmYv.exe
  C:\Windows\System\UsQEmYv.exe
  2⤵
  PID:4948
- C:\Windows\System\gcPjKXP.exe
  C:\Windows\System\gcPjKXP.exe
  2⤵
  PID:4964
- C:\Windows\System\SzbyCcI.exe
  C:\Windows\System\SzbyCcI.exe
  2⤵
  PID:4980
- C:\Windows\System\UoOJOoM.exe
  C:\Windows\System\UoOJOoM.exe
  2⤵
  PID:5004
- C:\Windows\System\pNBFVJQ.exe
  C:\Windows\System\pNBFVJQ.exe
  2⤵
  PID:5020
- C:\Windows\System\IrKJYMP.exe
  C:\Windows\System\IrKJYMP.exe
  2⤵
  PID:5040
- C:\Windows\System\CoYctiG.exe
  C:\Windows\System\CoYctiG.exe
  2⤵
  PID:5060
- C:\Windows\System\MCTTeHh.exe
  C:\Windows\System\MCTTeHh.exe
  2⤵
  PID:5084
- C:\Windows\System\unprkmh.exe
  C:\Windows\System\unprkmh.exe
  2⤵
  PID:5100
- C:\Windows\System\vKLFhQB.exe
  C:\Windows\System\vKLFhQB.exe
  2⤵
  PID:5116
- C:\Windows\System\tHQdzXm.exe
  C:\Windows\System\tHQdzXm.exe
  2⤵
  PID:3440
- C:\Windows\System\eyPQJFh.exe
  C:\Windows\System\eyPQJFh.exe
  2⤵
  PID:4108
- C:\Windows\System\bOWdFoD.exe
  C:\Windows\System\bOWdFoD.exe
  2⤵
  PID:3624
- C:\Windows\System\tUHXoJZ.exe
  C:\Windows\System\tUHXoJZ.exe
  2⤵
  PID:3092
- C:\Windows\System\zlaVeSj.exe
  C:\Windows\System\zlaVeSj.exe
  2⤵
  PID:4120
- C:\Windows\System\DxEfUcO.exe
  C:\Windows\System\DxEfUcO.exe
  2⤵
  PID:4136
- C:\Windows\System\dUlIHyW.exe
  C:\Windows\System\dUlIHyW.exe
  2⤵
  PID:4144
- C:\Windows\System\xEJYDCf.exe
  C:\Windows\System\xEJYDCf.exe
  2⤵
  PID:4164
- C:\Windows\System\gwxleTY.exe
  C:\Windows\System\gwxleTY.exe
  2⤵
  PID:4224
- C:\Windows\System\TwQMcXQ.exe
  C:\Windows\System\TwQMcXQ.exe
  2⤵
  PID:4292
- C:\Windows\System\mCUKFAh.exe
  C:\Windows\System\mCUKFAh.exe
  2⤵
  PID:4208
- C:\Windows\System\NYbHYhA.exe
  C:\Windows\System\NYbHYhA.exe
  2⤵
  PID:4280
- C:\Windows\System\ensuCwW.exe
  C:\Windows\System\ensuCwW.exe
  2⤵
  PID:4328
- C:\Windows\System\PAgBHpl.exe
  C:\Windows\System\PAgBHpl.exe
  2⤵
  PID:4400
- C:\Windows\System\wgxaAuM.exe
  C:\Windows\System\wgxaAuM.exe
  2⤵
  PID:4340
- C:\Windows\System\vfZKgpo.exe
  C:\Windows\System\vfZKgpo.exe
  2⤵
  PID:4416
- C:\Windows\System\CrmEsGc.exe
  C:\Windows\System\CrmEsGc.exe
  2⤵
  PID:4448
- C:\Windows\System\rKGHOPj.exe
  C:\Windows\System\rKGHOPj.exe
  2⤵
  PID:4488
- C:\Windows\System\VZXPsUz.exe
  C:\Windows\System\VZXPsUz.exe
  2⤵
  PID:4444
- C:\Windows\System\rtYsjOD.exe
  C:\Windows\System\rtYsjOD.exe
  2⤵
  PID:4588
- C:\Windows\System\reLKSOF.exe
  C:\Windows\System\reLKSOF.exe
  2⤵
  PID:4620
- C:\Windows\System\PgwhMZl.exe
  C:\Windows\System\PgwhMZl.exe
  2⤵
  PID:4556
- C:\Windows\System\DOpqoQT.exe
  C:\Windows\System\DOpqoQT.exe
  2⤵
  PID:4564
- C:\Windows\System\bjqdFQN.exe
  C:\Windows\System\bjqdFQN.exe
  2⤵
  PID:4636
- C:\Windows\System\caenZAr.exe
  C:\Windows\System\caenZAr.exe
  2⤵
  PID:4724
- C:\Windows\System\YKsiACI.exe
  C:\Windows\System\YKsiACI.exe
  2⤵
  PID:4752
- C:\Windows\System\ZsBbIOW.exe
  C:\Windows\System\ZsBbIOW.exe
  2⤵
  PID:4756
- C:\Windows\System\OaJFkRm.exe
  C:\Windows\System\OaJFkRm.exe
  2⤵
  PID:4792
- C:\Windows\System\waOrQIB.exe
  C:\Windows\System\waOrQIB.exe
  2⤵
  PID:4828
- C:\Windows\System\JfXBhfa.exe
  C:\Windows\System\JfXBhfa.exe
  2⤵
  PID:4844
- C:\Windows\System\GmtjYvb.exe
  C:\Windows\System\GmtjYvb.exe
  2⤵
  PID:4876
- C:\Windows\System\zVMGqnK.exe
  C:\Windows\System\zVMGqnK.exe
  2⤵
  PID:4928
- C:\Windows\System\wqtuvwd.exe
  C:\Windows\System\wqtuvwd.exe
  2⤵
  PID:4988
- C:\Windows\System\xRZGcME.exe
  C:\Windows\System\xRZGcME.exe
  2⤵
  PID:5028
- C:\Windows\System\BxdJSCR.exe
  C:\Windows\System\BxdJSCR.exe
  2⤵
  PID:5012
- C:\Windows\System\YGMbGRB.exe
  C:\Windows\System\YGMbGRB.exe
  2⤵
  PID:5048
- C:\Windows\System\iJQbsFD.exe
  C:\Windows\System\iJQbsFD.exe
  2⤵
  PID:5072
- C:\Windows\System\ucICZGb.exe
  C:\Windows\System\ucICZGb.exe
  2⤵
  PID:5112
- C:\Windows\System\WcbbywM.exe
  C:\Windows\System\WcbbywM.exe
  2⤵
  PID:4032
- C:\Windows\System\dbKwmrl.exe
  C:\Windows\System\dbKwmrl.exe
  2⤵
  PID:3732
- C:\Windows\System\kNicmnA.exe
  C:\Windows\System\kNicmnA.exe
  2⤵
  PID:2796
- C:\Windows\System\WkLcdTP.exe
  C:\Windows\System\WkLcdTP.exe
  2⤵
  PID:4272
- C:\Windows\System\nYCHBpu.exe
  C:\Windows\System\nYCHBpu.exe
  2⤵
  PID:4132
- C:\Windows\System\WdDIOUF.exe
  C:\Windows\System\WdDIOUF.exe
  2⤵
  PID:4256
- C:\Windows\System\vSYZjdQ.exe
  C:\Windows\System\vSYZjdQ.exe
  2⤵
  PID:4360
- C:\Windows\System\tvjoWkR.exe
  C:\Windows\System\tvjoWkR.exe
  2⤵
  PID:4376
- C:\Windows\System\kCVooIH.exe
  C:\Windows\System\kCVooIH.exe
  2⤵
  PID:4412
- C:\Windows\System\AgSMQoX.exe
  C:\Windows\System\AgSMQoX.exe
  2⤵
  PID:4616
- C:\Windows\System\RTIHHTE.exe
  C:\Windows\System\RTIHHTE.exe
  2⤵
  PID:4688
- C:\Windows\System\XoLWhCm.exe
  C:\Windows\System\XoLWhCm.exe
  2⤵
  PID:4672
- C:\Windows\System\ccNQBMo.exe
  C:\Windows\System\ccNQBMo.exe
  2⤵
  PID:4380
- C:\Windows\System\EUbkvte.exe
  C:\Windows\System\EUbkvte.exe
  2⤵
  PID:4528
- C:\Windows\System\YwOgxVU.exe
  C:\Windows\System\YwOgxVU.exe
  2⤵
  PID:4840
- C:\Windows\System\DpVKNsN.exe
  C:\Windows\System\DpVKNsN.exe
  2⤵
  PID:4860
- C:\Windows\System\jqJLNHx.exe
  C:\Windows\System\jqJLNHx.exe
  2⤵
  PID:4960
- C:\Windows\System\ZQlbelc.exe
  C:\Windows\System\ZQlbelc.exe
  2⤵
  PID:4972
- C:\Windows\System\FgRQBjv.exe
  C:\Windows\System\FgRQBjv.exe
  2⤵
  PID:5052
- C:\Windows\System\xxVvNul.exe
  C:\Windows\System\xxVvNul.exe
  2⤵
  PID:3728
- C:\Windows\System\LZRTIqj.exe
  C:\Windows\System\LZRTIqj.exe
  2⤵
  PID:4172
- C:\Windows\System\OTDJkFb.exe
  C:\Windows\System\OTDJkFb.exe
  2⤵
  PID:5108
- C:\Windows\System\XVbdHzE.exe
  C:\Windows\System\XVbdHzE.exe
  2⤵
  PID:4192
- C:\Windows\System\gxHoMYs.exe
  C:\Windows\System\gxHoMYs.exe
  2⤵
  PID:4168
- C:\Windows\System\TwVvBAA.exe
  C:\Windows\System\TwVvBAA.exe
  2⤵
  PID:4776
- C:\Windows\System\lgKmlyY.exe
  C:\Windows\System\lgKmlyY.exe
  2⤵
  PID:4432
- C:\Windows\System\tbSRrEC.exe
  C:\Windows\System\tbSRrEC.exe
  2⤵
  PID:4544
- C:\Windows\System\gAodSfE.exe
  C:\Windows\System\gAodSfE.exe
  2⤵
  PID:4740
- C:\Windows\System\GFpQgiG.exe
  C:\Windows\System\GFpQgiG.exe
  2⤵
  PID:4584
- C:\Windows\System\NfKrowk.exe
  C:\Windows\System\NfKrowk.exe
  2⤵
  PID:4128
- C:\Windows\System\ccPRLvA.exe
  C:\Windows\System\ccPRLvA.exe
  2⤵
  PID:4188
- C:\Windows\System\qzOAZJl.exe
  C:\Windows\System\qzOAZJl.exe
  2⤵
  PID:4476
- C:\Windows\System\CQvbutW.exe
  C:\Windows\System\CQvbutW.exe
  2⤵
  PID:4492
- C:\Windows\System\qzJtZQB.exe
  C:\Windows\System\qzJtZQB.exe
  2⤵
  PID:3492
- C:\Windows\System\SCDJaAW.exe
  C:\Windows\System\SCDJaAW.exe
  2⤵
  PID:4956
- C:\Windows\System\Pxotiia.exe
  C:\Windows\System\Pxotiia.exe
  2⤵
  PID:4700
- C:\Windows\System\YdqDubo.exe
  C:\Windows\System\YdqDubo.exe
  2⤵
  PID:4944
- C:\Windows\System\BCsjRSq.exe
  C:\Windows\System\BCsjRSq.exe
  2⤵
  PID:4824
- C:\Windows\System\CjsEVRI.exe
  C:\Windows\System\CjsEVRI.exe
  2⤵
  PID:5096
- C:\Windows\System\WTnODSN.exe
  C:\Windows\System\WTnODSN.exe
  2⤵
  PID:5124
- C:\Windows\System\AVzHzIG.exe
  C:\Windows\System\AVzHzIG.exe
  2⤵
  PID:5140
- C:\Windows\System\PewMNph.exe
  C:\Windows\System\PewMNph.exe
  2⤵
  PID:5156
- C:\Windows\System\YXEWwou.exe
  C:\Windows\System\YXEWwou.exe
  2⤵
  PID:5212
- C:\Windows\System\dccpBJE.exe
  C:\Windows\System\dccpBJE.exe
  2⤵
  PID:5244
- C:\Windows\System\QXSmmpL.exe
  C:\Windows\System\QXSmmpL.exe
  2⤵
  PID:5264
- C:\Windows\System\tfAJdNZ.exe
  C:\Windows\System\tfAJdNZ.exe
  2⤵
  PID:5280
- C:\Windows\System\ijQNIvI.exe
  C:\Windows\System\ijQNIvI.exe
  2⤵
  PID:5296
- C:\Windows\System\RcwdCxE.exe
  C:\Windows\System\RcwdCxE.exe
  2⤵
  PID:5312
- C:\Windows\System\sLAvWok.exe
  C:\Windows\System\sLAvWok.exe
  2⤵
  PID:5328
- C:\Windows\System\eYXgxYu.exe
  C:\Windows\System\eYXgxYu.exe
  2⤵
  PID:5364
- C:\Windows\System\pLSowNm.exe
  C:\Windows\System\pLSowNm.exe
  2⤵
  PID:5384
- C:\Windows\System\muYTeIJ.exe
  C:\Windows\System\muYTeIJ.exe
  2⤵
  PID:5400
- C:\Windows\System\QvatpSr.exe
  C:\Windows\System\QvatpSr.exe
  2⤵
  PID:5416
- C:\Windows\System\ORcTXfk.exe
  C:\Windows\System\ORcTXfk.exe
  2⤵
  PID:5432
- C:\Windows\System\FwdcHfk.exe
  C:\Windows\System\FwdcHfk.exe
  2⤵
  PID:5452
- C:\Windows\System\zzHcyWh.exe
  C:\Windows\System\zzHcyWh.exe
  2⤵
  PID:5472
- C:\Windows\System\rdSbmTT.exe
  C:\Windows\System\rdSbmTT.exe
  2⤵
  PID:5492
- C:\Windows\System\avrrctn.exe
  C:\Windows\System\avrrctn.exe
  2⤵
  PID:5508
- C:\Windows\System\dJIKxFD.exe
  C:\Windows\System\dJIKxFD.exe
  2⤵
  PID:5524
- C:\Windows\System\DgCSCgQ.exe
  C:\Windows\System\DgCSCgQ.exe
  2⤵
  PID:5540
- C:\Windows\System\GEozZds.exe
  C:\Windows\System\GEozZds.exe
  2⤵
  PID:5572
- C:\Windows\System\nuUefWN.exe
  C:\Windows\System\nuUefWN.exe
  2⤵
  PID:5588
- C:\Windows\System\RKTsMiY.exe
  C:\Windows\System\RKTsMiY.exe
  2⤵
  PID:5604
- C:\Windows\System\eATEjDY.exe
  C:\Windows\System\eATEjDY.exe
  2⤵
  PID:5620
- C:\Windows\System\BjroEzD.exe
  C:\Windows\System\BjroEzD.exe
  2⤵
  PID:5636
- C:\Windows\System\cPFXsSb.exe
  C:\Windows\System\cPFXsSb.exe
  2⤵
  PID:5652
- C:\Windows\System\cAnPahG.exe
  C:\Windows\System\cAnPahG.exe
  2⤵
  PID:5668
- C:\Windows\System\sFOOFmB.exe
  C:\Windows\System\sFOOFmB.exe
  2⤵
  PID:5688
- C:\Windows\System\NYtErIO.exe
  C:\Windows\System\NYtErIO.exe
  2⤵
  PID:5704
- C:\Windows\System\HjaiJVW.exe
  C:\Windows\System\HjaiJVW.exe
  2⤵
  PID:5720
- C:\Windows\System\unkDnUC.exe
  C:\Windows\System\unkDnUC.exe
  2⤵
  PID:5736
- C:\Windows\System\zGhsSnR.exe
  C:\Windows\System\zGhsSnR.exe
  2⤵
  PID:5760
- C:\Windows\System\YBzoUpC.exe
  C:\Windows\System\YBzoUpC.exe
  2⤵
  PID:5776
- C:\Windows\System\oZKrvnS.exe
  C:\Windows\System\oZKrvnS.exe
  2⤵
  PID:5792
- C:\Windows\System\UzCdMMB.exe
  C:\Windows\System\UzCdMMB.exe
  2⤵
  PID:5808
- C:\Windows\System\gfSjkuN.exe
  C:\Windows\System\gfSjkuN.exe
  2⤵
  PID:5832
- C:\Windows\System\xTquvHs.exe
  C:\Windows\System\xTquvHs.exe
  2⤵
  PID:5848
- C:\Windows\System\uHbUSvd.exe
  C:\Windows\System\uHbUSvd.exe
  2⤵
  PID:5868
- C:\Windows\System\xgNluCm.exe
  C:\Windows\System\xgNluCm.exe
  2⤵
  PID:5884
- C:\Windows\System\hYXvcXG.exe
  C:\Windows\System\hYXvcXG.exe
  2⤵
  PID:5908
- C:\Windows\System\lZOJynp.exe
  C:\Windows\System\lZOJynp.exe
  2⤵
  PID:5932
- C:\Windows\System\mRpIlWs.exe
  C:\Windows\System\mRpIlWs.exe
  2⤵
  PID:5948
- C:\Windows\System\pNJXMxy.exe
  C:\Windows\System\pNJXMxy.exe
  2⤵
  PID:5964
- C:\Windows\System\MgXduNt.exe
  C:\Windows\System\MgXduNt.exe
  2⤵
  PID:5980
- C:\Windows\System\aWkGXtZ.exe
  C:\Windows\System\aWkGXtZ.exe
  2⤵
  PID:5996
- C:\Windows\System\nBsANLk.exe
  C:\Windows\System\nBsANLk.exe
  2⤵
  PID:6012
- C:\Windows\System\XImZqUE.exe
  C:\Windows\System\XImZqUE.exe
  2⤵
  PID:6028
- C:\Windows\System\cKmCUko.exe
  C:\Windows\System\cKmCUko.exe
  2⤵
  PID:6048
- C:\Windows\System\IUnyEyV.exe
  C:\Windows\System\IUnyEyV.exe
  2⤵
  PID:6068
- C:\Windows\System\oIXVpsX.exe
  C:\Windows\System\oIXVpsX.exe
  2⤵
  PID:6084
- C:\Windows\System\LdGSXwT.exe
  C:\Windows\System\LdGSXwT.exe
  2⤵
  PID:6100
- C:\Windows\System\SZGlEmE.exe
  C:\Windows\System\SZGlEmE.exe
  2⤵
  PID:6124
- C:\Windows\System\RdDVine.exe
  C:\Windows\System\RdDVine.exe
  2⤵
  PID:6140
- C:\Windows\System\QwdienR.exe
  C:\Windows\System\QwdienR.exe
  2⤵
  PID:4908
- C:\Windows\System\cJMkGpH.exe
  C:\Windows\System\cJMkGpH.exe
  2⤵
  PID:5164
- C:\Windows\System\ytHzAdI.exe
  C:\Windows\System\ytHzAdI.exe
  2⤵
  PID:5180
- C:\Windows\System\iPcmMhY.exe
  C:\Windows\System\iPcmMhY.exe
  2⤵
  PID:4308
- C:\Windows\System\sMIvzNr.exe
  C:\Windows\System\sMIvzNr.exe
  2⤵
  PID:5220
- C:\Windows\System\IxruWHk.exe
  C:\Windows\System\IxruWHk.exe
  2⤵
  PID:5288
- C:\Windows\System\XUQNZaq.exe
  C:\Windows\System\XUQNZaq.exe
  2⤵
  PID:5208
- C:\Windows\System\WXmOflK.exe
  C:\Windows\System\WXmOflK.exe
  2⤵
  PID:5376
- C:\Windows\System\ovUqSrp.exe
  C:\Windows\System\ovUqSrp.exe
  2⤵
  PID:5412
- C:\Windows\System\YeUSJLj.exe
  C:\Windows\System\YeUSJLj.exe
  2⤵
  PID:5336
- C:\Windows\System\jPQteuK.exe
  C:\Windows\System\jPQteuK.exe
  2⤵
  PID:5484
- C:\Windows\System\YRtPnLj.exe
  C:\Windows\System\YRtPnLj.exe
  2⤵
  PID:5352
- C:\Windows\System\zVYgFru.exe
  C:\Windows\System\zVYgFru.exe
  2⤵
  PID:5424
- C:\Windows\System\vNAxbFZ.exe
  C:\Windows\System\vNAxbFZ.exe
  2⤵
  PID:5360
- C:\Windows\System\lEzWcXM.exe
  C:\Windows\System\lEzWcXM.exe
  2⤵
  PID:5504
- C:\Windows\System\omiMPxT.exe
  C:\Windows\System\omiMPxT.exe
  2⤵
  PID:5536
- C:\Windows\System\jENpEtG.exe
  C:\Windows\System\jENpEtG.exe
  2⤵
  PID:5600
- C:\Windows\System\MjJcTQq.exe
  C:\Windows\System\MjJcTQq.exe
  2⤵
  PID:5700
- C:\Windows\System\IYWPrIT.exe
  C:\Windows\System\IYWPrIT.exe
  2⤵
  PID:5616
- C:\Windows\System\AGIjJhj.exe
  C:\Windows\System\AGIjJhj.exe
  2⤵
  PID:5684
- C:\Windows\System\OlqUXib.exe
  C:\Windows\System\OlqUXib.exe
  2⤵
  PID:5752
- C:\Windows\System\IBBKKgB.exe
  C:\Windows\System\IBBKKgB.exe
  2⤵
  PID:5784
- C:\Windows\System\TMNDCXk.exe
  C:\Windows\System\TMNDCXk.exe
  2⤵
  PID:5844
- C:\Windows\System\riaNNJz.exe
  C:\Windows\System\riaNNJz.exe
  2⤵
  PID:5864
- C:\Windows\System\pnDsmRZ.exe
  C:\Windows\System\pnDsmRZ.exe
  2⤵
  PID:5920
- C:\Windows\System\QIZQHDV.exe
  C:\Windows\System\QIZQHDV.exe
  2⤵
  PID:5960
- C:\Windows\System\uccxePZ.exe
  C:\Windows\System\uccxePZ.exe
  2⤵
  PID:6024
- C:\Windows\System\vCXedEV.exe
  C:\Windows\System\vCXedEV.exe
  2⤵
  PID:5904
- C:\Windows\System\WMWDiik.exe
  C:\Windows\System\WMWDiik.exe
  2⤵
  PID:5976
- C:\Windows\System\XpFhOgi.exe
  C:\Windows\System\XpFhOgi.exe
  2⤵
  PID:6040
- C:\Windows\System\ZOgKhUF.exe
  C:\Windows\System\ZOgKhUF.exe
  2⤵
  PID:6076
- C:\Windows\System\kEJLGjz.exe
  C:\Windows\System\kEJLGjz.exe
  2⤵
  PID:6108
- C:\Windows\System\eRXBWIr.exe
  C:\Windows\System\eRXBWIr.exe
  2⤵
  PID:6132
- C:\Windows\System\zjipiEO.exe
  C:\Windows\System\zjipiEO.exe
  2⤵
  PID:5148
- C:\Windows\System\OVxDLzh.exe
  C:\Windows\System\OVxDLzh.exe
  2⤵
  PID:5272
- C:\Windows\System\eZaksmh.exe
  C:\Windows\System\eZaksmh.exe
  2⤵
  PID:5256
- C:\Windows\System\NMTIxkJ.exe
  C:\Windows\System\NMTIxkJ.exe
  2⤵
  PID:5324
- C:\Windows\System\VjqPNuw.exe
  C:\Windows\System\VjqPNuw.exe
  2⤵
  PID:5480
- C:\Windows\System\hscUPWo.exe
  C:\Windows\System\hscUPWo.exe
  2⤵
  PID:5396
- C:\Windows\System\YeSAdVv.exe
  C:\Windows\System\YeSAdVv.exe
  2⤵
  PID:5344
- C:\Windows\System\jjknhmo.exe
  C:\Windows\System\jjknhmo.exe
  2⤵
  PID:5732
- C:\Windows\System\kzpwwUH.exe
  C:\Windows\System\kzpwwUH.exe
  2⤵
  PID:5696
- C:\Windows\System\eGMmpsi.exe
  C:\Windows\System\eGMmpsi.exe
  2⤵
  PID:5816
- C:\Windows\System\zttMUiU.exe
  C:\Windows\System\zttMUiU.exe
  2⤵
  PID:5880
- C:\Windows\System\dfvzgEN.exe
  C:\Windows\System\dfvzgEN.exe
  2⤵
  PID:5928
- C:\Windows\System\nHzhxom.exe
  C:\Windows\System\nHzhxom.exe
  2⤵
  PID:5956
- C:\Windows\System\AgEYBPm.exe
  C:\Windows\System\AgEYBPm.exe
  2⤵
  PID:5900
- C:\Windows\System\gyKSnwI.exe
  C:\Windows\System\gyKSnwI.exe
  2⤵
  PID:5260
- C:\Windows\System\TSUcZsT.exe
  C:\Windows\System\TSUcZsT.exe
  2⤵
  PID:6004
- C:\Windows\System\tzMysff.exe
  C:\Windows\System\tzMysff.exe
  2⤵
  PID:5556
- C:\Windows\System\deiGfOP.exe
  C:\Windows\System\deiGfOP.exe
  2⤵
  PID:6136
- C:\Windows\System\TsQMUUr.exe
  C:\Windows\System\TsQMUUr.exe
  2⤵
  PID:5408
- C:\Windows\System\NvPALhZ.exe
  C:\Windows\System\NvPALhZ.exe
  2⤵
  PID:5584
- C:\Windows\System\HvLYOeJ.exe
  C:\Windows\System\HvLYOeJ.exe
  2⤵
  PID:5664
- C:\Windows\System\feCjpAv.exe
  C:\Windows\System\feCjpAv.exe
  2⤵
  PID:5716
- C:\Windows\System\HrETobA.exe
  C:\Windows\System\HrETobA.exe
  2⤵
  PID:6064
- C:\Windows\System\buUXveP.exe
  C:\Windows\System\buUXveP.exe
  2⤵
  PID:6148
- C:\Windows\System\xFqJqGW.exe
  C:\Windows\System\xFqJqGW.exe
  2⤵
  PID:6164
- C:\Windows\System\xbSCkfP.exe
  C:\Windows\System\xbSCkfP.exe
  2⤵
  PID:6180
- C:\Windows\System\cKkNvNM.exe
  C:\Windows\System\cKkNvNM.exe
  2⤵
  PID:6204
- C:\Windows\System\NQiZBAS.exe
  C:\Windows\System\NQiZBAS.exe
  2⤵
  PID:6220
- C:\Windows\System\KrRmZuo.exe
  C:\Windows\System\KrRmZuo.exe
  2⤵
  PID:6236
- C:\Windows\System\LIUZoFP.exe
  C:\Windows\System\LIUZoFP.exe
  2⤵
  PID:6252
- C:\Windows\System\iFngUSl.exe
  C:\Windows\System\iFngUSl.exe
  2⤵
  PID:6268
- C:\Windows\System\qwRdKng.exe
  C:\Windows\System\qwRdKng.exe
  2⤵
  PID:6284
- C:\Windows\System\YwpnmkI.exe
  C:\Windows\System\YwpnmkI.exe
  2⤵
  PID:6300
- C:\Windows\System\CsKQGEX.exe
  C:\Windows\System\CsKQGEX.exe
  2⤵
  PID:6316
- C:\Windows\System\pMBwatt.exe
  C:\Windows\System\pMBwatt.exe
  2⤵
  PID:6332
- C:\Windows\System\nVxGMgd.exe
  C:\Windows\System\nVxGMgd.exe
  2⤵
  PID:6352
- C:\Windows\System\EtxKlFq.exe
  C:\Windows\System\EtxKlFq.exe
  2⤵
  PID:6368
- C:\Windows\System\JjZxGmJ.exe
  C:\Windows\System\JjZxGmJ.exe
  2⤵
  PID:6384
- C:\Windows\System\eTomuGR.exe
  C:\Windows\System\eTomuGR.exe
  2⤵
  PID:6400
- C:\Windows\System\STlRFNj.exe
  C:\Windows\System\STlRFNj.exe
  2⤵
  PID:6416
- C:\Windows\System\ifZfKNR.exe
  C:\Windows\System\ifZfKNR.exe
  2⤵
  PID:6432
- C:\Windows\System\dDjiJEK.exe
  C:\Windows\System\dDjiJEK.exe
  2⤵
  PID:6448
- C:\Windows\System\XznTIet.exe
  C:\Windows\System\XznTIet.exe
  2⤵
  PID:6468
- C:\Windows\System\RevBIYb.exe
  C:\Windows\System\RevBIYb.exe
  2⤵
  PID:6484
- C:\Windows\System\HnVlCok.exe
  C:\Windows\System\HnVlCok.exe
  2⤵
  PID:6500
- C:\Windows\System\JHKDBia.exe
  C:\Windows\System\JHKDBia.exe
  2⤵
  PID:6520
- C:\Windows\System\tZVjLgs.exe
  C:\Windows\System\tZVjLgs.exe
  2⤵
  PID:6540
- C:\Windows\System\TMNFhpJ.exe
  C:\Windows\System\TMNFhpJ.exe
  2⤵
  PID:6556
- C:\Windows\System\GxrvvZa.exe
  C:\Windows\System\GxrvvZa.exe
  2⤵
  PID:6580
- C:\Windows\System\EhXvvtG.exe
  C:\Windows\System\EhXvvtG.exe
  2⤵
  PID:6596
- C:\Windows\System\PzLXWGE.exe
  C:\Windows\System\PzLXWGE.exe
  2⤵
  PID:6612
- C:\Windows\System\DXPahDQ.exe
  C:\Windows\System\DXPahDQ.exe
  2⤵
  PID:6628
- C:\Windows\System\ggKiMGE.exe
  C:\Windows\System\ggKiMGE.exe
  2⤵
  PID:6652
- C:\Windows\System\LhWSHbt.exe
  C:\Windows\System\LhWSHbt.exe
  2⤵
  PID:6668
- C:\Windows\System\kxzzYWc.exe
  C:\Windows\System\kxzzYWc.exe
  2⤵
  PID:6688
- C:\Windows\System\yfBtjoL.exe
  C:\Windows\System\yfBtjoL.exe
  2⤵
  PID:6704
- C:\Windows\System\jbEwXLM.exe
  C:\Windows\System\jbEwXLM.exe
  2⤵
  PID:6720
- C:\Windows\System\aBAItLQ.exe
  C:\Windows\System\aBAItLQ.exe
  2⤵
  PID:6736
- C:\Windows\System\rdIQyKZ.exe
  C:\Windows\System\rdIQyKZ.exe
  2⤵
  PID:6752
- C:\Windows\System\nXWoKuV.exe
  C:\Windows\System\nXWoKuV.exe
  2⤵
  PID:6768
- C:\Windows\System\XKxdSGl.exe
  C:\Windows\System\XKxdSGl.exe
  2⤵
  PID:6784
- C:\Windows\System\hLySRel.exe
  C:\Windows\System\hLySRel.exe
  2⤵
  PID:6804
- C:\Windows\System\nckknHn.exe
  C:\Windows\System\nckknHn.exe
  2⤵
  PID:6820
- C:\Windows\System\rSTkWew.exe
  C:\Windows\System\rSTkWew.exe
  2⤵
  PID:6836
- C:\Windows\System\AaxWUPO.exe
  C:\Windows\System\AaxWUPO.exe
  2⤵
  PID:6852
- C:\Windows\System\HemgPFi.exe
  C:\Windows\System\HemgPFi.exe
  2⤵
  PID:6868
- C:\Windows\System\vyWMZrw.exe
  C:\Windows\System\vyWMZrw.exe
  2⤵
  PID:6884
- C:\Windows\System\WFiiWdz.exe
  C:\Windows\System\WFiiWdz.exe
  2⤵
  PID:6900
- C:\Windows\System\MasFYtu.exe
  C:\Windows\System\MasFYtu.exe
  2⤵
  PID:6916
- C:\Windows\System\wdvKKri.exe
  C:\Windows\System\wdvKKri.exe
  2⤵
  PID:6932
- C:\Windows\System\EzFhOxE.exe
  C:\Windows\System\EzFhOxE.exe
  2⤵
  PID:6952
- C:\Windows\System\XCPEuMt.exe
  C:\Windows\System\XCPEuMt.exe
  2⤵
  PID:6968
- C:\Windows\System\FOxxGti.exe
  C:\Windows\System\FOxxGti.exe
  2⤵
  PID:6984
- C:\Windows\System\XuPZHnP.exe
  C:\Windows\System\XuPZHnP.exe
  2⤵
  PID:7008
- C:\Windows\System\WVDEuzE.exe
  C:\Windows\System\WVDEuzE.exe
  2⤵
  PID:7024
- C:\Windows\System\jaDKMsR.exe
  C:\Windows\System\jaDKMsR.exe
  2⤵
  PID:7040
- C:\Windows\System\EfiKNDb.exe
  C:\Windows\System\EfiKNDb.exe
  2⤵
  PID:7056
- C:\Windows\System\XpXZild.exe
  C:\Windows\System\XpXZild.exe
  2⤵
  PID:7072
- C:\Windows\System\cZrUmQF.exe
  C:\Windows\System\cZrUmQF.exe
  2⤵
  PID:7092
- C:\Windows\System\PHJPqnz.exe
  C:\Windows\System\PHJPqnz.exe
  2⤵
  PID:7108
- C:\Windows\System\kdQDWJG.exe
  C:\Windows\System\kdQDWJG.exe
  2⤵
  PID:7128
- C:\Windows\System\eJwbMel.exe
  C:\Windows\System\eJwbMel.exe
  2⤵
  PID:7144
- C:\Windows\System\HxVVDWL.exe
  C:\Windows\System\HxVVDWL.exe
  2⤵
  PID:7160
- C:\Windows\System\ERYAozG.exe
  C:\Windows\System\ERYAozG.exe
  2⤵
  PID:6080
- C:\Windows\System\VODaXpI.exe
  C:\Windows\System\VODaXpI.exe
  2⤵
  PID:5712
- C:\Windows\System\YOApUwb.exe
  C:\Windows\System\YOApUwb.exe
  2⤵
  PID:6044
- C:\Windows\System\QlTCBPv.exe
  C:\Windows\System\QlTCBPv.exe
  2⤵
  PID:6188
- C:\Windows\System\yVpafxQ.exe
  C:\Windows\System\yVpafxQ.exe
  2⤵
  PID:6112
- C:\Windows\System\UyRBjJP.exe
  C:\Windows\System\UyRBjJP.exe
  2⤵
  PID:5660
- C:\Windows\System\kUVozEX.exe
  C:\Windows\System\kUVozEX.exe
  2⤵
  PID:6096
- C:\Windows\System\rXVwgVF.exe
  C:\Windows\System\rXVwgVF.exe
  2⤵
  PID:5756
- C:\Windows\System\qZkzTvK.exe
  C:\Windows\System\qZkzTvK.exe
  2⤵
  PID:6244
- C:\Windows\System\qFNrvwF.exe
  C:\Windows\System\qFNrvwF.exe
  2⤵
  PID:6280
- C:\Windows\System\beKxQQD.exe
  C:\Windows\System\beKxQQD.exe
  2⤵
  PID:6340
- C:\Windows\System\ICekcTN.exe
  C:\Windows\System\ICekcTN.exe
  2⤵
  PID:6292
- C:\Windows\System\zDFriYi.exe
  C:\Windows\System\zDFriYi.exe
  2⤵
  PID:6264
- C:\Windows\System\DbLdbDT.exe
  C:\Windows\System\DbLdbDT.exe
  2⤵
  PID:6364
- C:\Windows\System\czPunZz.exe
  C:\Windows\System\czPunZz.exe
  2⤵
  PID:6440
- C:\Windows\System\ILLhZRI.exe
  C:\Windows\System\ILLhZRI.exe
  2⤵
  PID:6512
- C:\Windows\System\nODjQKX.exe
  C:\Windows\System\nODjQKX.exe
  2⤵
  PID:6428
- C:\Windows\System\xJmOzCI.exe
  C:\Windows\System\xJmOzCI.exe
  2⤵
  PID:6528
- C:\Windows\System\vweAPvu.exe
  C:\Windows\System\vweAPvu.exe
  2⤵
  PID:6460
- C:\Windows\System\LHEkEhU.exe
  C:\Windows\System\LHEkEhU.exe
  2⤵
  PID:6588
- C:\Windows\System\DRKsEcr.exe
  C:\Windows\System\DRKsEcr.exe
  2⤵
  PID:6696
- C:\Windows\System\bbKPpMx.exe
  C:\Windows\System\bbKPpMx.exe
  2⤵
  PID:6604
- C:\Windows\System\EMwgaRf.exe
  C:\Windows\System\EMwgaRf.exe
  2⤵
  PID:6648
- C:\Windows\System\RPeGCuG.exe
  C:\Windows\System\RPeGCuG.exe
  2⤵
  PID:6684
- C:\Windows\System\YDIdGXR.exe
  C:\Windows\System\YDIdGXR.exe
  2⤵
  PID:6760
- C:\Windows\System\RimcTmH.exe
  C:\Windows\System\RimcTmH.exe
  2⤵
  PID:6792
- C:\Windows\System\Xplvfqm.exe
  C:\Windows\System\Xplvfqm.exe
  2⤵
  PID:6828
- C:\Windows\System\rFFHGxY.exe
  C:\Windows\System\rFFHGxY.exe
  2⤵
  PID:6860
- C:\Windows\System\vmOoKam.exe
  C:\Windows\System\vmOoKam.exe
  2⤵
  PID:6816
- C:\Windows\System\WjwtdDU.exe
  C:\Windows\System\WjwtdDU.exe
  2⤵
  PID:6924
- C:\Windows\System\JjNpaFu.exe
  C:\Windows\System\JjNpaFu.exe
  2⤵
  PID:7100
- C:\Windows\System\JIHnjoX.exe
  C:\Windows\System\JIHnjoX.exe
  2⤵
  PID:7140
- C:\Windows\System\xOWatSR.exe
  C:\Windows\System\xOWatSR.exe
  2⤵
  PID:7120
- C:\Windows\System\lzpTlCX.exe
  C:\Windows\System\lzpTlCX.exe
  2⤵
  PID:5648
- C:\Windows\System\bEyGIPU.exe
  C:\Windows\System\bEyGIPU.exe
  2⤵
  PID:6020
- C:\Windows\System\mOjzySp.exe
  C:\Windows\System\mOjzySp.exe
  2⤵
  PID:5308
- C:\Windows\System\PSomRMX.exe
  C:\Windows\System\PSomRMX.exe
  2⤵
  PID:6216
- C:\Windows\System\sFssVkG.exe
  C:\Windows\System\sFssVkG.exe
  2⤵
  PID:6308
- C:\Windows\System\DPhcsWo.exe
  C:\Windows\System\DPhcsWo.exe
  2⤵
  PID:6408
- C:\Windows\System\mcKvvsb.exe
  C:\Windows\System\mcKvvsb.exe
  2⤵
  PID:6424
- C:\Windows\System\dGUGqQD.exe
  C:\Windows\System\dGUGqQD.exe
  2⤵
  PID:6324
- C:\Windows\System\LKurtbE.exe
  C:\Windows\System\LKurtbE.exe
  2⤵
  PID:6328
- C:\Windows\System\kGEOGAq.exe
  C:\Windows\System\kGEOGAq.exe
  2⤵
  PID:6480
- C:\Windows\System\gJxfnyy.exe
  C:\Windows\System\gJxfnyy.exe
  2⤵
  PID:7136
- C:\Windows\System\EqPaOtC.exe
  C:\Windows\System\EqPaOtC.exe
  2⤵
  PID:6348
- C:\Windows\System\kkdGEOg.exe
  C:\Windows\System\kkdGEOg.exe
  2⤵
  PID:6620
- C:\Windows\System\qMMHutA.exe
  C:\Windows\System\qMMHutA.exe
  2⤵
  PID:6196
- C:\Windows\System\XktsvQu.exe
  C:\Windows\System\XktsvQu.exe
  2⤵
  PID:6492
- C:\Windows\System\YbIytgt.exe
  C:\Windows\System\YbIytgt.exe
  2⤵
  PID:6680
- C:\Windows\System\znYJtTw.exe
  C:\Windows\System\znYJtTw.exe
  2⤵
  PID:6728
- C:\Windows\System\MaGTmQt.exe
  C:\Windows\System\MaGTmQt.exe
  2⤵
  PID:7176
- C:\Windows\System\OSOcaMF.exe
  C:\Windows\System\OSOcaMF.exe
  2⤵
  PID:7192
- C:\Windows\System\yIyUwDY.exe
  C:\Windows\System\yIyUwDY.exe
  2⤵
  PID:7208
- C:\Windows\System\aDyKJCD.exe
  C:\Windows\System\aDyKJCD.exe
  2⤵
  PID:7228
- C:\Windows\System\EbfiUaD.exe
  C:\Windows\System\EbfiUaD.exe
  2⤵
  PID:7380
- C:\Windows\System\zjCfZSZ.exe
  C:\Windows\System\zjCfZSZ.exe
  2⤵
  PID:7396
- C:\Windows\System\rFFiMPQ.exe
  C:\Windows\System\rFFiMPQ.exe
  2⤵
  PID:7412
- C:\Windows\System\CAjJsQc.exe
  C:\Windows\System\CAjJsQc.exe
  2⤵
  PID:7428
- C:\Windows\System\hjapVTS.exe
  C:\Windows\System\hjapVTS.exe
  2⤵
  PID:7448
- C:\Windows\System\wmjXhvK.exe
  C:\Windows\System\wmjXhvK.exe
  2⤵
  PID:7464
- C:\Windows\System\XuhGVSh.exe
  C:\Windows\System\XuhGVSh.exe
  2⤵
  PID:7480
- C:\Windows\System\iGPjuMj.exe
  C:\Windows\System\iGPjuMj.exe
  2⤵
  PID:7496
- C:\Windows\System\LZcpFOi.exe
  C:\Windows\System\LZcpFOi.exe
  2⤵
  PID:7512
- C:\Windows\System\ngHfbMt.exe
  C:\Windows\System\ngHfbMt.exe
  2⤵
  PID:7528
- C:\Windows\System\JoGPQMY.exe
  C:\Windows\System\JoGPQMY.exe
  2⤵
  PID:7548
- C:\Windows\System\FCpvYrr.exe
  C:\Windows\System\FCpvYrr.exe
  2⤵
  PID:7564
- C:\Windows\System\JxjSAEa.exe
  C:\Windows\System\JxjSAEa.exe
  2⤵
  PID:7584
- C:\Windows\System\bgEudPO.exe
  C:\Windows\System\bgEudPO.exe
  2⤵
  PID:7604
- C:\Windows\System\hkqYrts.exe
  C:\Windows\System\hkqYrts.exe
  2⤵
  PID:7624
- C:\Windows\System\dJZcxYt.exe
  C:\Windows\System\dJZcxYt.exe
  2⤵
  PID:7640
- C:\Windows\System\sLybIkz.exe
  C:\Windows\System\sLybIkz.exe
  2⤵
  PID:7668
- C:\Windows\System\uPbiyiw.exe
  C:\Windows\System\uPbiyiw.exe
  2⤵
  PID:7692
- C:\Windows\System\VCHyoAN.exe
  C:\Windows\System\VCHyoAN.exe
  2⤵
  PID:7708
- C:\Windows\System\HtUNIfS.exe
  C:\Windows\System\HtUNIfS.exe
  2⤵
  PID:7724
- C:\Windows\System\OzYEaoe.exe
  C:\Windows\System\OzYEaoe.exe
  2⤵
  PID:7740
- C:\Windows\System\PvCRrwQ.exe
  C:\Windows\System\PvCRrwQ.exe
  2⤵
  PID:7756
- C:\Windows\System\TslpDZV.exe
  C:\Windows\System\TslpDZV.exe
  2⤵
  PID:7772
- C:\Windows\System\cMsbOGx.exe
  C:\Windows\System\cMsbOGx.exe
  2⤵
  PID:7788
- C:\Windows\System\kHzxENW.exe
  C:\Windows\System\kHzxENW.exe
  2⤵
  PID:7804
- C:\Windows\System\NxJHNOQ.exe
  C:\Windows\System\NxJHNOQ.exe
  2⤵
  PID:7844
- C:\Windows\System\IgAybep.exe
  C:\Windows\System\IgAybep.exe
  2⤵
  PID:7860
- C:\Windows\System\bxFBEpn.exe
  C:\Windows\System\bxFBEpn.exe
  2⤵
  PID:7876
- C:\Windows\System\zHrvyVA.exe
  C:\Windows\System\zHrvyVA.exe
  2⤵
  PID:7896
- C:\Windows\System\FIikWXn.exe
  C:\Windows\System\FIikWXn.exe
  2⤵
  PID:7912
- C:\Windows\System\jazOhbl.exe
  C:\Windows\System\jazOhbl.exe
  2⤵
  PID:7944
- C:\Windows\System\XSyoBrn.exe
  C:\Windows\System\XSyoBrn.exe
  2⤵
  PID:7964
- C:\Windows\System\IdXbvdw.exe
  C:\Windows\System\IdXbvdw.exe
  2⤵
  PID:7984
- C:\Windows\System\qjglNuF.exe
  C:\Windows\System\qjglNuF.exe
  2⤵
  PID:8000
- C:\Windows\System\YQndDJK.exe
  C:\Windows\System\YQndDJK.exe
  2⤵
  PID:8020
- C:\Windows\System\rZYQsKO.exe
  C:\Windows\System\rZYQsKO.exe
  2⤵
  PID:8040
- C:\Windows\System\NpAwGKJ.exe
  C:\Windows\System\NpAwGKJ.exe
  2⤵
  PID:8056
- C:\Windows\System\HaQJchJ.exe
  C:\Windows\System\HaQJchJ.exe
  2⤵
  PID:8072
- C:\Windows\System\KTXnpLh.exe
  C:\Windows\System\KTXnpLh.exe
  2⤵
  PID:8096
- C:\Windows\System\SCxHHeU.exe
  C:\Windows\System\SCxHHeU.exe
  2⤵
  PID:8112
- C:\Windows\System\gduEwcS.exe
  C:\Windows\System\gduEwcS.exe
  2⤵
  PID:8128
- C:\Windows\System\ObOCSOM.exe
  C:\Windows\System\ObOCSOM.exe
  2⤵
  PID:8144
- C:\Windows\System\YBvjxFS.exe
  C:\Windows\System\YBvjxFS.exe
  2⤵
  PID:8160
- C:\Windows\System\EbCqQVX.exe
  C:\Windows\System\EbCqQVX.exe
  2⤵
  PID:8180
- C:\Windows\System\RLrcHzF.exe
  C:\Windows\System\RLrcHzF.exe
  2⤵
  PID:6744
- C:\Windows\System\WnFQElm.exe
  C:\Windows\System\WnFQElm.exe
  2⤵
  PID:6568
- C:\Windows\System\brUeUYG.exe
  C:\Windows\System\brUeUYG.exe
  2⤵
  PID:6912
- C:\Windows\System\tJgLMet.exe
  C:\Windows\System\tJgLMet.exe
  2⤵
  PID:6732
- C:\Windows\System\umpilLI.exe
  C:\Windows\System\umpilLI.exe
  2⤵
  PID:6948
- C:\Windows\System\XpbtyGE.exe
  C:\Windows\System\XpbtyGE.exe
  2⤵
  PID:7204
- C:\Windows\System\ZWkqJMU.exe
  C:\Windows\System\ZWkqJMU.exe
  2⤵
  PID:7052
- C:\Windows\System\VwaaMOD.exe
  C:\Windows\System\VwaaMOD.exe
  2⤵
  PID:7116
- C:\Windows\System\rceFsGK.exe
  C:\Windows\System\rceFsGK.exe
  2⤵
  PID:6192
- C:\Windows\System\NDMjGUi.exe
  C:\Windows\System\NDMjGUi.exe
  2⤵
  PID:7236
- C:\Windows\System\rgnsgNH.exe
  C:\Windows\System\rgnsgNH.exe
  2⤵
  PID:7256
- C:\Windows\System\MAYipqB.exe
  C:\Windows\System\MAYipqB.exe
  2⤵
  PID:7268
- C:\Windows\System\GGAIkBG.exe
  C:\Windows\System\GGAIkBG.exe
  2⤵
  PID:7284
- C:\Windows\System\iSdDulu.exe
  C:\Windows\System\iSdDulu.exe
  2⤵
  PID:7300
- C:\Windows\System\wyAUgtv.exe
  C:\Windows\System\wyAUgtv.exe
  2⤵
  PID:7312
- C:\Windows\System\kYVKmgr.exe
  C:\Windows\System\kYVKmgr.exe
  2⤵
  PID:7332
- C:\Windows\System\isBIbmv.exe
  C:\Windows\System\isBIbmv.exe
  2⤵
  PID:7352
- C:\Windows\System\cRlVRNO.exe
  C:\Windows\System\cRlVRNO.exe
  2⤵
  PID:7304
- C:\Windows\System\DQhIDfl.exe
  C:\Windows\System\DQhIDfl.exe
  2⤵
  PID:7488
- C:\Windows\System\NfPKxwK.exe
  C:\Windows\System\NfPKxwK.exe
  2⤵
  PID:7524
- C:\Windows\System\zhRoAPk.exe
  C:\Windows\System\zhRoAPk.exe
  2⤵
  PID:7560
- C:\Windows\System\ULAiEUx.exe
  C:\Windows\System\ULAiEUx.exe
  2⤵
  PID:7408
- C:\Windows\System\nhhTHQY.exe
  C:\Windows\System\nhhTHQY.exe
  2⤵
  PID:7472
- C:\Windows\System\BqjGrgl.exe
  C:\Windows\System\BqjGrgl.exe
  2⤵
  PID:7544
- C:\Windows\System\HBGlQxi.exe
  C:\Windows\System\HBGlQxi.exe
  2⤵
  PID:7612
- C:\Windows\System\SetInAq.exe
  C:\Windows\System\SetInAq.exe
  2⤵
  PID:7648
- C:\Windows\System\JQiRgSN.exe
  C:\Windows\System\JQiRgSN.exe
  2⤵
  PID:7368
- C:\Windows\System\PAvDEja.exe
  C:\Windows\System\PAvDEja.exe
  2⤵
  PID:7680
- C:\Windows\System\qGSFBjY.exe
  C:\Windows\System\qGSFBjY.exe
  2⤵
  PID:7748
- C:\Windows\System\GmRgIGp.exe
  C:\Windows\System\GmRgIGp.exe
  2⤵
  PID:7700
- C:\Windows\System\TEObQAh.exe
  C:\Windows\System\TEObQAh.exe
  2⤵
  PID:7736
- C:\Windows\System\euFoTHO.exe
  C:\Windows\System\euFoTHO.exe
  2⤵
  PID:7828
- C:\Windows\System\lOOCqti.exe
  C:\Windows\System\lOOCqti.exe
  2⤵
  PID:7892
- C:\Windows\System\bPuQwgJ.exe
  C:\Windows\System\bPuQwgJ.exe
  2⤵
  PID:8012
- C:\Windows\System\asQKZqS.exe
  C:\Windows\System\asQKZqS.exe
  2⤵
  PID:8088
- C:\Windows\System\hWFHpky.exe
  C:\Windows\System\hWFHpky.exe
  2⤵
  PID:7156
- C:\Windows\System\pBUMhzv.exe
  C:\Windows\System\pBUMhzv.exe
  2⤵
  PID:7972
- C:\Windows\System\zdkjePC.exe
  C:\Windows\System\zdkjePC.exe
  2⤵
  PID:7048
- C:\Windows\System\BoZHBEJ.exe
  C:\Windows\System\BoZHBEJ.exe
  2⤵
  PID:8176
- C:\Windows\System\hNZVMWr.exe
  C:\Windows\System\hNZVMWr.exe
  2⤵
  PID:8036
- C:\Windows\System\YiiDVBv.exe
  C:\Windows\System\YiiDVBv.exe
  2⤵
  PID:6644
- C:\Windows\System\rRcFKyg.exe
  C:\Windows\System\rRcFKyg.exe
  2⤵
  PID:7184
- C:\Windows\System\yYdfqTn.exe
  C:\Windows\System\yYdfqTn.exe
  2⤵
  PID:7360
- C:\Windows\System\ZIuFJLF.exe
  C:\Windows\System\ZIuFJLF.exe
  2⤵
  PID:7200
- C:\Windows\System\gsYbjgC.exe
  C:\Windows\System\gsYbjgC.exe
  2⤵
  PID:7248
- C:\Windows\System\Smukfcf.exe
  C:\Windows\System\Smukfcf.exe
  2⤵
  PID:7344
- C:\Windows\System\yfbztdw.exe
  C:\Windows\System\yfbztdw.exe
  2⤵
  PID:7460
- C:\Windows\System\GypZUbt.exe
  C:\Windows\System\GypZUbt.exe
  2⤵
  PID:7596
- C:\Windows\System\bFESmbF.exe
  C:\Windows\System\bFESmbF.exe
  2⤵
  PID:7720
- C:\Windows\System\EtjlDLS.exe
  C:\Windows\System\EtjlDLS.exe
  2⤵
  PID:7856
- C:\Windows\System\HhxwnrJ.exe
  C:\Windows\System\HhxwnrJ.exe
  2⤵
  PID:7764
- C:\Windows\System\ObzXpbT.exe
  C:\Windows\System\ObzXpbT.exe
  2⤵
  PID:8016
- C:\Windows\System\xjRInfB.exe
  C:\Windows\System\xjRInfB.exe
  2⤵
  PID:4808
- C:\Windows\System\OpTUaMe.exe
  C:\Windows\System\OpTUaMe.exe
  2⤵
  PID:8168
- C:\Windows\System\FKksXWM.exe
  C:\Windows\System\FKksXWM.exe
  2⤵
  PID:6780
- C:\Windows\System\eaYRANB.exe
  C:\Windows\System\eaYRANB.exe
  2⤵
  PID:7664
- C:\Windows\System\yIXDOfh.exe
  C:\Windows\System\yIXDOfh.exe
  2⤵
  PID:8068
- C:\Windows\System\HrNphYa.exe
  C:\Windows\System\HrNphYa.exe
  2⤵
  PID:6476
- C:\Windows\System\ELQNRGO.exe
  C:\Windows\System\ELQNRGO.exe
  2⤵
  PID:7840
- C:\Windows\System\ZwbpLaO.exe
  C:\Windows\System\ZwbpLaO.exe
  2⤵
  PID:6176
- C:\Windows\System\zsJEGpV.exe
  C:\Windows\System\zsJEGpV.exe
  2⤵
  PID:7960
- C:\Windows\System\mIeFqxc.exe
  C:\Windows\System\mIeFqxc.exe
  2⤵
  PID:6764
- C:\Windows\System\xdDWIpo.exe
  C:\Windows\System\xdDWIpo.exe
  2⤵
  PID:6376
- C:\Windows\System\zfauTvK.exe
  C:\Windows\System\zfauTvK.exe
  2⤵
  PID:8028
- C:\Windows\System\uXsPbRN.exe
  C:\Windows\System\uXsPbRN.exe
  2⤵
  PID:7264
- C:\Windows\System\WwpiQKr.exe
  C:\Windows\System\WwpiQKr.exe
  2⤵
  PID:7244
- C:\Windows\System\ubXOBhL.exe
  C:\Windows\System\ubXOBhL.exe
  2⤵
  PID:7436
- C:\Windows\System\tUwasID.exe
  C:\Windows\System\tUwasID.exe
  2⤵
  PID:7280
- C:\Windows\System\BxXaqnY.exe
  C:\Windows\System\BxXaqnY.exe
  2⤵
  PID:7404
- C:\Windows\System\AwVqyym.exe
  C:\Windows\System\AwVqyym.exe
  2⤵
  PID:7620
- C:\Windows\System\hKLsTHC.exe
  C:\Windows\System\hKLsTHC.exe
  2⤵
  PID:6776
- C:\Windows\System\YuEXlAG.exe
  C:\Windows\System\YuEXlAG.exe
  2⤵
  PID:6496
- C:\Windows\System\BgsDMtU.exe
  C:\Windows\System\BgsDMtU.exe
  2⤵
  PID:7980
- C:\Windows\System\AxCdwYS.exe
  C:\Windows\System\AxCdwYS.exe
  2⤵
  PID:7576
- C:\Windows\System\WarxDdh.exe
  C:\Windows\System\WarxDdh.exe
  2⤵
  PID:8092
- C:\Windows\System\azQxLfM.exe
  C:\Windows\System\azQxLfM.exe
  2⤵
  PID:7580
- C:\Windows\System\iVfSBDP.exe
  C:\Windows\System\iVfSBDP.exe
  2⤵
  PID:8064
- C:\Windows\System\sWpGSfk.exe
  C:\Windows\System\sWpGSfk.exe
  2⤵
  PID:6276
- C:\Windows\System\FtWnKWq.exe
  C:\Windows\System\FtWnKWq.exe
  2⤵
  PID:8208
- C:\Windows\System\FVxJVTV.exe
  C:\Windows\System\FVxJVTV.exe
  2⤵
  PID:8224
- C:\Windows\System\LqwkKMz.exe
  C:\Windows\System\LqwkKMz.exe
  2⤵
  PID:8240
- C:\Windows\System\EgXTzVX.exe
  C:\Windows\System\EgXTzVX.exe
  2⤵
  PID:8256
- C:\Windows\System\EfFAwrZ.exe
  C:\Windows\System\EfFAwrZ.exe
  2⤵
  PID:8340
- C:\Windows\System\cJYRuWX.exe
  C:\Windows\System\cJYRuWX.exe
  2⤵
  PID:8356
- C:\Windows\System\STiAPKt.exe
  C:\Windows\System\STiAPKt.exe
  2⤵
  PID:8372
- C:\Windows\System\ADPQBQr.exe
  C:\Windows\System\ADPQBQr.exe
  2⤵
  PID:8388
- C:\Windows\System\pJfPtkH.exe
  C:\Windows\System\pJfPtkH.exe
  2⤵
  PID:8404
- C:\Windows\System\RAApQuG.exe
  C:\Windows\System\RAApQuG.exe
  2⤵
  PID:8424
- C:\Windows\System\PZJFtRf.exe
  C:\Windows\System\PZJFtRf.exe
  2⤵
  PID:8440
- C:\Windows\System\dglnkQv.exe
  C:\Windows\System\dglnkQv.exe
  2⤵
  PID:8456
- C:\Windows\System\LhXoQaz.exe
  C:\Windows\System\LhXoQaz.exe
  2⤵
  PID:8472
- C:\Windows\System\fmueyTn.exe
  C:\Windows\System\fmueyTn.exe
  2⤵
  PID:8488
- C:\Windows\System\nTSmQQW.exe
  C:\Windows\System\nTSmQQW.exe
  2⤵
  PID:8548
- C:\Windows\System\wXLFveY.exe
  C:\Windows\System\wXLFveY.exe
  2⤵
  PID:8568
- C:\Windows\System\CENZumn.exe
  C:\Windows\System\CENZumn.exe
  2⤵
  PID:8584
- C:\Windows\System\gucQayS.exe
  C:\Windows\System\gucQayS.exe
  2⤵
  PID:8600
- C:\Windows\System\MGVfoXJ.exe
  C:\Windows\System\MGVfoXJ.exe
  2⤵
  PID:8616
- C:\Windows\System\YDDPKBs.exe
  C:\Windows\System\YDDPKBs.exe
  2⤵
  PID:8632
- C:\Windows\System\DcpAsHp.exe
  C:\Windows\System\DcpAsHp.exe
  2⤵
  PID:8792
- C:\Windows\System\Mupuahk.exe
  C:\Windows\System\Mupuahk.exe
  2⤵
  PID:8812
- C:\Windows\System\PRRyCUT.exe
  C:\Windows\System\PRRyCUT.exe
  2⤵
  PID:8828
- C:\Windows\System\kmORuYR.exe
  C:\Windows\System\kmORuYR.exe
  2⤵
  PID:8844
- C:\Windows\System\inEGoHI.exe
  C:\Windows\System\inEGoHI.exe
  2⤵
  PID:8880
- C:\Windows\System\RtoXTrQ.exe
  C:\Windows\System\RtoXTrQ.exe
  2⤵
  PID:8908
- C:\Windows\System\FfciRLK.exe
  C:\Windows\System\FfciRLK.exe
  2⤵
  PID:8928
- C:\Windows\System\ooZWAos.exe
  C:\Windows\System\ooZWAos.exe
  2⤵
  PID:8944
- C:\Windows\System\wqNUtWX.exe
  C:\Windows\System\wqNUtWX.exe
  2⤵
  PID:8972
- C:\Windows\System\BezaGcO.exe
  C:\Windows\System\BezaGcO.exe
  2⤵
  PID:8988
- C:\Windows\System\NRQVWhC.exe
  C:\Windows\System\NRQVWhC.exe
  2⤵
  PID:9008
- C:\Windows\System\hmAAGHA.exe
  C:\Windows\System\hmAAGHA.exe
  2⤵
  PID:9036
- C:\Windows\System\NjUZePW.exe
  C:\Windows\System\NjUZePW.exe
  2⤵
  PID:9060
- C:\Windows\System\mYULjoI.exe
  C:\Windows\System\mYULjoI.exe
  2⤵
  PID:9076
- C:\Windows\System\OmdULWE.exe
  C:\Windows\System\OmdULWE.exe
  2⤵
  PID:7884
- C:\Windows\System\ofFECCV.exe
  C:\Windows\System\ofFECCV.exe
  2⤵
  PID:8280
- C:\Windows\System\FXeVizg.exe
  C:\Windows\System\FXeVizg.exe
  2⤵
  PID:8296
- C:\Windows\System\IvITjcp.exe
  C:\Windows\System\IvITjcp.exe
  2⤵
  PID:8316
- C:\Windows\System\vOQnKIO.exe
  C:\Windows\System\vOQnKIO.exe
  2⤵
  PID:8216
- C:\Windows\System\xhpCPtd.exe
  C:\Windows\System\xhpCPtd.exe
  2⤵
  PID:8268
- C:\Windows\System\TBrojxW.exe
  C:\Windows\System\TBrojxW.exe
  2⤵
  PID:8432
- C:\Windows\System\vuKcDro.exe
  C:\Windows\System\vuKcDro.exe
  2⤵
  PID:8464
- C:\Windows\System\GVDfoNg.exe
  C:\Windows\System\GVDfoNg.exe
  2⤵
  PID:8516
- C:\Windows\System\thQqylT.exe
  C:\Windows\System\thQqylT.exe
  2⤵
  PID:7780
- C:\Windows\System\FBFUeMl.exe
  C:\Windows\System\FBFUeMl.exe
  2⤵
  PID:8540
- C:\Windows\System\CFBSMSu.exe
  C:\Windows\System\CFBSMSu.exe
  2⤵
  PID:7928
- C:\Windows\System\QzqfCZZ.exe
  C:\Windows\System\QzqfCZZ.exe
  2⤵
  PID:6892
- C:\Windows\System\mYWHHVp.exe
  C:\Windows\System\mYWHHVp.exe
  2⤵
  PID:5444
- C:\Windows\System\jmRuCtl.exe
  C:\Windows\System\jmRuCtl.exe
  2⤵
  PID:6976
- C:\Windows\System\IgHYJba.exe
  C:\Windows\System\IgHYJba.exe
  2⤵
  PID:7956
- C:\Windows\System\PDZZAHq.exe
  C:\Windows\System\PDZZAHq.exe
  2⤵
  PID:7188
- C:\Windows\System\LmHnkZg.exe
  C:\Windows\System\LmHnkZg.exe
  2⤵
  PID:8576
- C:\Windows\System\xaOpSbm.exe
  C:\Windows\System\xaOpSbm.exe
  2⤵
  PID:8608
- C:\Windows\System\wdwkFbX.exe
  C:\Windows\System\wdwkFbX.exe
  2⤵
  PID:8644
- C:\Windows\System\SpPTdNk.exe
  C:\Windows\System\SpPTdNk.exe
  2⤵
  PID:8672
- C:\Windows\System\FPbDGuv.exe
  C:\Windows\System\FPbDGuv.exe
  2⤵
  PID:8680
- C:\Windows\System\PPMYQJU.exe
  C:\Windows\System\PPMYQJU.exe
  2⤵
  PID:8700
- C:\Windows\System\wRoOKAJ.exe
  C:\Windows\System\wRoOKAJ.exe
  2⤵
  PID:8724
- C:\Windows\System\pzTGoRk.exe
  C:\Windows\System\pzTGoRk.exe
  2⤵
  PID:8736
- C:\Windows\System\MchxRLW.exe
  C:\Windows\System\MchxRLW.exe
  2⤵
  PID:2272
- C:\Windows\System\ItrfcWG.exe
  C:\Windows\System\ItrfcWG.exe
  2⤵
  PID:7812
- C:\Windows\System\gMkgmMk.exe
  C:\Windows\System\gMkgmMk.exe
  2⤵
  PID:8352
- C:\Windows\System\khnSiXd.exe
  C:\Windows\System\khnSiXd.exe
  2⤵
  PID:8412
- C:\Windows\System\tRZQnWc.exe
  C:\Windows\System\tRZQnWc.exe
  2⤵
  PID:8760
- C:\Windows\System\zVSMShc.exe
  C:\Windows\System\zVSMShc.exe
  2⤵
  PID:8856
- C:\Windows\System\kjniMVc.exe
  C:\Windows\System\kjniMVc.exe
  2⤵
  PID:8820
- C:\Windows\System\oSLIJfd.exe
  C:\Windows\System\oSLIJfd.exe
  2⤵
  PID:8448
- C:\Windows\System\wtWCwHo.exe
  C:\Windows\System\wtWCwHo.exe
  2⤵
  PID:8596
- C:\Windows\System\oIITNra.exe
  C:\Windows\System\oIITNra.exe
  2⤵
  PID:8836
- C:\Windows\System\aeVNhVW.exe
  C:\Windows\System\aeVNhVW.exe
  2⤵
  PID:9052
- C:\Windows\System\byMqWUz.exe
  C:\Windows\System\byMqWUz.exe
  2⤵
  PID:8952
- C:\Windows\System\uROKEAH.exe
  C:\Windows\System\uROKEAH.exe
  2⤵
  PID:9000
- C:\Windows\System\oiTTKLT.exe
  C:\Windows\System\oiTTKLT.exe
  2⤵
  PID:9108
- C:\Windows\System\ODDNQvX.exe
  C:\Windows\System\ODDNQvX.exe
  2⤵
  PID:8900
- C:\Windows\System\TEEArhP.exe
  C:\Windows\System\TEEArhP.exe
  2⤵
  PID:9032
- C:\Windows\System\FKbXAuc.exe
  C:\Windows\System\FKbXAuc.exe
  2⤵
  PID:8984
- C:\Windows\System\jVoeiTU.exe
  C:\Windows\System\jVoeiTU.exe
  2⤵
  PID:9020
- C:\Windows\System\fSmhtvH.exe
  C:\Windows\System\fSmhtvH.exe
  2⤵
  PID:9140
- C:\Windows\System\QRwpKHk.exe
  C:\Windows\System\QRwpKHk.exe
  2⤵
  PID:9160
- C:\Windows\System\xjphGCl.exe
  C:\Windows\System\xjphGCl.exe
  2⤵
  PID:9152
- C:\Windows\System\GZyksmU.exe
  C:\Windows\System\GZyksmU.exe
  2⤵
  PID:9192
- C:\Windows\System\jgUBjwm.exe
  C:\Windows\System\jgUBjwm.exe
  2⤵
  PID:9208
- C:\Windows\System\nhsWEhd.exe
  C:\Windows\System\nhsWEhd.exe
  2⤵
  PID:9088
- C:\Windows\System\yPzcncD.exe
  C:\Windows\System\yPzcncD.exe
  2⤵
  PID:8288
- C:\Windows\System\veuVLBn.exe
  C:\Windows\System\veuVLBn.exe
  2⤵
  PID:8368
- C:\Windows\System\HpJsziZ.exe
  C:\Windows\System\HpJsziZ.exe
  2⤵
  PID:8504
- C:\Windows\System\mZlWdwT.exe
  C:\Windows\System\mZlWdwT.exe
  2⤵
  PID:7376
- C:\Windows\System\ruwmbzj.exe
  C:\Windows\System\ruwmbzj.exe
  2⤵
  PID:8528
- C:\Windows\System\MuCmXgg.exe
  C:\Windows\System\MuCmXgg.exe
  2⤵
  PID:6896
- C:\Windows\System\VexnuzK.exe
  C:\Windows\System\VexnuzK.exe
  2⤵
  PID:8312
- C:\Windows\System\CwrgKZD.exe
  C:\Windows\System\CwrgKZD.exe
  2⤵
  PID:8500
- C:\Windows\System\DnngUUM.exe
  C:\Windows\System\DnngUUM.exe
  2⤵
  PID:1332
- C:\Windows\System\uLhBWtF.exe
  C:\Windows\System\uLhBWtF.exe
  2⤵
  PID:8140
- C:\Windows\System\ZPVDnFi.exe
  C:\Windows\System\ZPVDnFi.exe
  2⤵
  PID:8452
- C:\Windows\System\oXlGwha.exe
  C:\Windows\System\oXlGwha.exe
  2⤵
  PID:7424
- C:\Windows\System\MsLZNKP.exe
  C:\Windows\System\MsLZNKP.exe
  2⤵
  PID:8656
- C:\Windows\System\qzAZzLV.exe
  C:\Windows\System\qzAZzLV.exe
  2⤵
  PID:8696
- C:\Windows\System\HndyNLq.exe
  C:\Windows\System\HndyNLq.exe
  2⤵
  PID:8748
- C:\Windows\System\YWGidJi.exe
  C:\Windows\System\YWGidJi.exe
  2⤵
  PID:8384
- C:\Windows\System\deSdNMk.exe
  C:\Windows\System\deSdNMk.exe
  2⤵
  PID:8708
- C:\Windows\System\PMDmOgY.exe
  C:\Windows\System\PMDmOgY.exe
  2⤵
  PID:8852
- C:\Windows\System\lhdaqJG.exe
  C:\Windows\System\lhdaqJG.exe
  2⤵
  PID:8416
- C:\Windows\System\nFKIIzT.exe
  C:\Windows\System\nFKIIzT.exe
  2⤵
  PID:8800
- C:\Windows\System\ElcsuMS.exe
  C:\Windows\System\ElcsuMS.exe
  2⤵
  PID:8784
- C:\Windows\System\bJwhFTY.exe
  C:\Windows\System\bJwhFTY.exe
  2⤵
  PID:8592
- C:\Windows\System\RoPpRTc.exe
  C:\Windows\System\RoPpRTc.exe
  2⤵
  PID:9096
- C:\Windows\System\pJCmGTo.exe
  C:\Windows\System\pJCmGTo.exe
  2⤵
  PID:9068
- C:\Windows\System\LzlRRNs.exe
  C:\Windows\System\LzlRRNs.exe
  2⤵
  PID:9156
- C:\Windows\System\llqBwYH.exe
  C:\Windows\System\llqBwYH.exe
  2⤵
  PID:8876
- C:\Windows\System\XNLnaGx.exe
  C:\Windows\System\XNLnaGx.exe
  2⤵
  PID:8968
- C:\Windows\System\CQhTSzZ.exe
  C:\Windows\System\CQhTSzZ.exe
  2⤵
  PID:8872
- C:\Windows\System\MXyVNdx.exe
  C:\Windows\System\MXyVNdx.exe
  2⤵
  PID:8324
- C:\Windows\System\JDEtTjT.exe
  C:\Windows\System\JDEtTjT.exe
  2⤵
  PID:9056
- C:\Windows\System\JyfgPil.exe
  C:\Windows\System\JyfgPil.exe
  2⤵
  PID:8936
- C:\Windows\System\zdXLfBe.exe
  C:\Windows\System\zdXLfBe.exe
  2⤵
  PID:9172
- C:\Windows\System\mZLIXEO.exe
  C:\Windows\System\mZLIXEO.exe
  2⤵
  PID:8232
- C:\Windows\System\aDykYhX.exe
  C:\Windows\System\aDykYhX.exe
  2⤵
  PID:7904
- C:\Windows\System\qaEyAaA.exe
  C:\Windows\System\qaEyAaA.exe
  2⤵
  PID:7456
- C:\Windows\System\DxKKAaA.exe
  C:\Windows\System\DxKKAaA.exe
  2⤵
  PID:8276
- C:\Windows\System\UMpAsut.exe
  C:\Windows\System\UMpAsut.exe
  2⤵
  PID:7652
- C:\Windows\System\JsbpliG.exe
  C:\Windows\System\JsbpliG.exe
  2⤵
  PID:7348
- C:\Windows\System\lJiiCPp.exe
  C:\Windows\System\lJiiCPp.exe
  2⤵
  PID:8688
- C:\Windows\System\JdZcKCa.exe
  C:\Windows\System\JdZcKCa.exe
  2⤵
  PID:8348
- C:\Windows\System\FUvTFAm.exe
  C:\Windows\System\FUvTFAm.exe
  2⤵
  PID:8864
- C:\Windows\System\xIPjlbh.exe
  C:\Windows\System\xIPjlbh.exe
  2⤵
  PID:8564
- C:\Windows\System\MBYXyGH.exe
  C:\Windows\System\MBYXyGH.exe
  2⤵
  PID:8196
- C:\Windows\System\ztCXtKL.exe
  C:\Windows\System\ztCXtKL.exe
  2⤵
  PID:9132
- C:\Windows\System\uLxidiu.exe
  C:\Windows\System\uLxidiu.exe
  2⤵
  PID:9168
- C:\Windows\System\ylZCOCH.exe
  C:\Windows\System\ylZCOCH.exe
  2⤵
  PID:9120
- C:\Windows\System\QmrYCCT.exe
  C:\Windows\System\QmrYCCT.exe
  2⤵
  PID:7832
- C:\Windows\System\PFKgqnV.exe
  C:\Windows\System\PFKgqnV.exe
  2⤵
  PID:9116
- C:\Windows\System\OKUUlwy.exe
  C:\Windows\System\OKUUlwy.exe
  2⤵
  PID:9124
- C:\Windows\System\wwwGohG.exe
  C:\Windows\System\wwwGohG.exe
  2⤵
  PID:8920
- C:\Windows\System\vqOQURI.exe
  C:\Windows\System\vqOQURI.exe
  2⤵
  PID:9204
- C:\Windows\System\dapxvNc.exe
  C:\Windows\System\dapxvNc.exe
  2⤵
  PID:7088
- C:\Windows\System\QppITVx.exe
  C:\Windows\System\QppITVx.exe
  2⤵
  PID:8480
- C:\Windows\System\okqWiYH.exe
  C:\Windows\System\okqWiYH.exe
  2⤵
  PID:8640
- C:\Windows\System\orlGgfl.exe
  C:\Windows\System\orlGgfl.exe
  2⤵
  PID:8744
- C:\Windows\System\ldQvipt.exe
  C:\Windows\System\ldQvipt.exe
  2⤵
  PID:6812
- C:\Windows\System\fFXNXvi.exe
  C:\Windows\System\fFXNXvi.exe
  2⤵
  PID:8776
- C:\Windows\System\vTiXMFS.exe
  C:\Windows\System\vTiXMFS.exe
  2⤵
  PID:8220
- C:\Windows\System\BRyAmQc.exe
  C:\Windows\System\BRyAmQc.exe
  2⤵
  PID:9044
- C:\Windows\System\WDEiPdG.exe
  C:\Windows\System\WDEiPdG.exe
  2⤵
  PID:8104
- C:\Windows\System\NRbxfCz.exe
  C:\Windows\System\NRbxfCz.exe
  2⤵
  PID:7888
- C:\Windows\System\YHhxNRG.exe
  C:\Windows\System\YHhxNRG.exe
  2⤵
  PID:8924
- C:\Windows\System\HyPLAQt.exe
  C:\Windows\System\HyPLAQt.exe
  2⤵
  PID:8328
- C:\Windows\System\omgmNEQ.exe
  C:\Windows\System\omgmNEQ.exe
  2⤵
  PID:9220
- C:\Windows\System\tEsrTZn.exe
  C:\Windows\System\tEsrTZn.exe
  2⤵
  PID:9236
- C:\Windows\System\GeoOAjj.exe
  C:\Windows\System\GeoOAjj.exe
  2⤵
  PID:9252
- C:\Windows\System\lXhyaEE.exe
  C:\Windows\System\lXhyaEE.exe
  2⤵
  PID:9268
- C:\Windows\System\OCOYTGf.exe
  C:\Windows\System\OCOYTGf.exe
  2⤵
  PID:9284
- C:\Windows\System\GMirilr.exe
  C:\Windows\System\GMirilr.exe
  2⤵
  PID:9300
- C:\Windows\System\LqaIhUM.exe
  C:\Windows\System\LqaIhUM.exe
  2⤵
  PID:9320
- C:\Windows\System\jcAIvRj.exe
  C:\Windows\System\jcAIvRj.exe
  2⤵
  PID:9336
- C:\Windows\System\hTWaIwi.exe
  C:\Windows\System\hTWaIwi.exe
  2⤵
  PID:9352
- C:\Windows\System\KTogEzQ.exe
  C:\Windows\System\KTogEzQ.exe
  2⤵
  PID:9368
- C:\Windows\System\CXVKMdV.exe
  C:\Windows\System\CXVKMdV.exe
  2⤵
  PID:9384
- C:\Windows\System\XGfcmjg.exe
  C:\Windows\System\XGfcmjg.exe
  2⤵
  PID:9412
- C:\Windows\System\nKZkVPS.exe
  C:\Windows\System\nKZkVPS.exe
  2⤵
  PID:9428
- C:\Windows\System\CJpUiiB.exe
  C:\Windows\System\CJpUiiB.exe
  2⤵
  PID:9444
- C:\Windows\System\XjReKac.exe
  C:\Windows\System\XjReKac.exe
  2⤵
  PID:9464
- C:\Windows\System\yupPTdN.exe
  C:\Windows\System\yupPTdN.exe
  2⤵
  PID:9480
- C:\Windows\System\dIDHMtF.exe
  C:\Windows\System\dIDHMtF.exe
  2⤵
  PID:9500
- C:\Windows\System\MlVLXgs.exe
  C:\Windows\System\MlVLXgs.exe
  2⤵
  PID:9516
- C:\Windows\System\zblLPyD.exe
  C:\Windows\System\zblLPyD.exe
  2⤵
  PID:9532
- C:\Windows\System\eOvtbjM.exe
  C:\Windows\System\eOvtbjM.exe
  2⤵
  PID:9548
- C:\Windows\System\LpeKpNd.exe
  C:\Windows\System\LpeKpNd.exe
  2⤵
  PID:9568
- C:\Windows\System\lCraifR.exe
  C:\Windows\System\lCraifR.exe
  2⤵
  PID:9584
- C:\Windows\System\fZEdLPq.exe
  C:\Windows\System\fZEdLPq.exe
  2⤵
  PID:9600
- C:\Windows\System\wJqsiqH.exe
  C:\Windows\System\wJqsiqH.exe
  2⤵
  PID:9616
- C:\Windows\System\MEOQeqn.exe
  C:\Windows\System\MEOQeqn.exe
  2⤵
  PID:9636
- C:\Windows\System\TKNOszl.exe
  C:\Windows\System\TKNOszl.exe
  2⤵
  PID:9656
- C:\Windows\System\dZXrDsC.exe
  C:\Windows\System\dZXrDsC.exe
  2⤵
  PID:9676
- C:\Windows\System\UrtLNwl.exe
  C:\Windows\System\UrtLNwl.exe
  2⤵
  PID:9692
- C:\Windows\System\tIDMtcZ.exe
  C:\Windows\System\tIDMtcZ.exe
  2⤵
  PID:9708
- C:\Windows\System\WcfDEyz.exe
  C:\Windows\System\WcfDEyz.exe
  2⤵
  PID:9736
- C:\Windows\System\FVOgYPB.exe
  C:\Windows\System\FVOgYPB.exe
  2⤵
  PID:9752
- C:\Windows\System\kUYCPkV.exe
  C:\Windows\System\kUYCPkV.exe
  2⤵
  PID:9768
- C:\Windows\System\CqAcypM.exe
  C:\Windows\System\CqAcypM.exe
  2⤵
  PID:9784
- C:\Windows\System\OkVUcFH.exe
  C:\Windows\System\OkVUcFH.exe
  2⤵
  PID:9804
- C:\Windows\System\DPdzYgy.exe
  C:\Windows\System\DPdzYgy.exe
  2⤵
  PID:9820
- C:\Windows\System\LkYArDh.exe
  C:\Windows\System\LkYArDh.exe
  2⤵
  PID:9836
- C:\Windows\System\eKivuaF.exe
  C:\Windows\System\eKivuaF.exe
  2⤵
  PID:9856
- C:\Windows\System\ezDljIm.exe
  C:\Windows\System\ezDljIm.exe
  2⤵
  PID:9872
- C:\Windows\System\ZPAfwVE.exe
  C:\Windows\System\ZPAfwVE.exe
  2⤵
  PID:9900
- C:\Windows\System\HRiwlRY.exe
  C:\Windows\System\HRiwlRY.exe
  2⤵
  PID:9916
- C:\Windows\System\kdMldzH.exe
  C:\Windows\System\kdMldzH.exe
  2⤵
  PID:9936
- C:\Windows\System\rEzGpwT.exe
  C:\Windows\System\rEzGpwT.exe
  2⤵
  PID:9956
- C:\Windows\System\BpfAHai.exe
  C:\Windows\System\BpfAHai.exe
  2⤵
  PID:9988
- C:\Windows\System\EvkuDdY.exe
  C:\Windows\System\EvkuDdY.exe
  2⤵
  PID:10004
- C:\Windows\System\QeTCYkp.exe
  C:\Windows\System\QeTCYkp.exe
  2⤵
  PID:10020
- C:\Windows\System\tLpUNSb.exe
  C:\Windows\System\tLpUNSb.exe
  2⤵
  PID:10116
- C:\Windows\System\SypbpXa.exe
  C:\Windows\System\SypbpXa.exe
  2⤵
  PID:10188
- C:\Windows\System\JCRcDBa.exe
  C:\Windows\System\JCRcDBa.exe
  2⤵
  PID:10204
- C:\Windows\System\SyyjLEc.exe
  C:\Windows\System\SyyjLEc.exe
  2⤵
  PID:10220
- C:\Windows\System\drkXRsb.exe
  C:\Windows\System\drkXRsb.exe
  2⤵
  PID:10236
- C:\Windows\System\CfPdAjP.exe
  C:\Windows\System\CfPdAjP.exe
  2⤵
  PID:9148
- C:\Windows\System\rhLOlBr.exe
  C:\Windows\System\rhLOlBr.exe
  2⤵
  PID:9248
- C:\Windows\System\YiAiUkp.exe
  C:\Windows\System\YiAiUkp.exe
  2⤵
  PID:9280
- C:\Windows\System\KUoeLmG.exe
  C:\Windows\System\KUoeLmG.exe
  2⤵
  PID:9376
- C:\Windows\System\FCCyhwL.exe
  C:\Windows\System\FCCyhwL.exe
  2⤵
  PID:9228
- C:\Windows\System\vPNZzNC.exe
  C:\Windows\System\vPNZzNC.exe
  2⤵
  PID:9292
- C:\Windows\System\HVUqafM.exe
  C:\Windows\System\HVUqafM.exe
  2⤵
  PID:9328
- C:\Windows\System\NQBINDH.exe
  C:\Windows\System\NQBINDH.exe
  2⤵
  PID:9404
- C:\Windows\System\qwfEsDL.exe
  C:\Windows\System\qwfEsDL.exe
  2⤵
  PID:9456
- C:\Windows\System\rPauXug.exe
  C:\Windows\System\rPauXug.exe
  2⤵
  PID:9496
- C:\Windows\System\GeudLBc.exe
  C:\Windows\System\GeudLBc.exe
  2⤵
  PID:9476
- C:\Windows\System\oGNoNAk.exe
  C:\Windows\System\oGNoNAk.exe
  2⤵
  PID:9560
- C:\Windows\System\eNiHoTo.exe
  C:\Windows\System\eNiHoTo.exe
  2⤵
  PID:9688
- C:\Windows\System\EAIzEnd.exe
  C:\Windows\System\EAIzEnd.exe
  2⤵
  PID:9724
- C:\Windows\System\JTntHAR.exe
  C:\Windows\System\JTntHAR.exe
  2⤵
  PID:9612
- C:\Windows\System\hmnvWmK.exe
  C:\Windows\System\hmnvWmK.exe
  2⤵
  PID:9748
- C:\Windows\System\UOyyPGm.exe
  C:\Windows\System\UOyyPGm.exe
  2⤵
  PID:9812
- C:\Windows\System\ifVImWx.exe
  C:\Windows\System\ifVImWx.exe
  2⤵
  PID:9764
- C:\Windows\System\PHZTlfE.exe
  C:\Windows\System\PHZTlfE.exe
  2⤵
  PID:9852
- C:\Windows\System\oJkTVVR.exe
  C:\Windows\System\oJkTVVR.exe
  2⤵
  PID:9884
- C:\Windows\System\XOgvSWQ.exe
  C:\Windows\System\XOgvSWQ.exe
  2⤵
  PID:9908
- C:\Windows\System\FWNejep.exe
  C:\Windows\System\FWNejep.exe
  2⤵
  PID:9968
- C:\Windows\System\YgsrkXI.exe
  C:\Windows\System\YgsrkXI.exe
  2⤵
  PID:10016
- C:\Windows\System\jnHivEZ.exe
  C:\Windows\System\jnHivEZ.exe
  2⤵
  PID:9996
- C:\Windows\System\iBCeLtX.exe
  C:\Windows\System\iBCeLtX.exe
  2⤵
  PID:9952
- C:\Windows\System\IsNMiyw.exe
  C:\Windows\System\IsNMiyw.exe
  2⤵
  PID:9932
- C:\Windows\System\oRbMRcS.exe
  C:\Windows\System\oRbMRcS.exe
  2⤵
  PID:10140
- C:\Windows\System\rUPoQew.exe
  C:\Windows\System\rUPoQew.exe
  2⤵
  PID:10148
- C:\Windows\System\ehVRZIi.exe
  C:\Windows\System\ehVRZIi.exe
  2⤵
  PID:10172
- C:\Windows\System\BuKawCI.exe
  C:\Windows\System\BuKawCI.exe
  2⤵
  PID:10216
- C:\Windows\System\JoVEUCq.exe
  C:\Windows\System\JoVEUCq.exe
  2⤵
  PID:10104
- C:\Windows\System\jBqPBHg.exe
  C:\Windows\System\jBqPBHg.exe
  2⤵
  PID:10108
- C:\Windows\System\rZfseAn.exe
  C:\Windows\System\rZfseAn.exe
  2⤵
  PID:8720
- C:\Windows\System\FykHEuB.exe
  C:\Windows\System\FykHEuB.exe
  2⤵
  PID:9360
- C:\Windows\System\VJMKliu.exe
  C:\Windows\System\VJMKliu.exe
  2⤵
  PID:8520
- C:\Windows\System\qfOvjfH.exe
  C:\Windows\System\qfOvjfH.exe
  2⤵
  PID:9564
- C:\Windows\System\ZhJasCc.exe
  C:\Windows\System\ZhJasCc.exe
  2⤵
  PID:9488
- C:\Windows\System\IoPMOgD.exe
  C:\Windows\System\IoPMOgD.exe
  2⤵
  PID:9832
- C:\Windows\System\JJhDaCg.exe
  C:\Windows\System\JJhDaCg.exe
  2⤵
  PID:9868
- C:\Windows\System\wyqkSUf.exe
  C:\Windows\System\wyqkSUf.exe
  2⤵
  PID:10028
- C:\Windows\System\jLFcPgU.exe
  C:\Windows\System\jLFcPgU.exe
  2⤵
  PID:9092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AcbtzNU.exe

Filesize
1.5MB

MD5
545f6cee34cd224c74bbbf622973f3b6

SHA1
a949581e5212c69df40cce22c6bc45723f051f3d

SHA256
453b44cc36ac4fc6c24361901b2066fff82d219d9ea3303b3a9ba20623e46158

SHA512
af2c84b979c37911515778d806bc8f39a1f2856356d9b00372bcf46d68ef05ce126e631017e2e948131570dfeb4bdd26ad594a2a50ed5a065354b8fd78155355

Download Submit
C:\Windows\system\BTdjxOX.exe

Filesize
1.5MB

MD5
e01cbc1deee0075dc6e51a9394c62715

SHA1
a162ae00ac88a466aaf2f912b95ec95fff37254d

SHA256
771129a0aa620ff66bfafc7f3b1e5a668688b183c422271ac07af7f9f4907ac7

SHA512
6169f12cbb2991095acc89fac461692b340eacfc05392bea5d6d00a46dc6a6022960afbc5990c0b850f04a3c7001956b53f7fd9690a79f844d1df36934fd3ae9

Download Submit
C:\Windows\system\CNAfePj.exe

Filesize
1.5MB

MD5
83dc2ccb79a9123b5942d841f9798d82

SHA1
872a2198792a9998d91e4649fb7ed5508cd3a74e

SHA256
28c46d7f2d81cd667ca3faeb4fe9eb6583844cc2112e4f1a0f85e783a06b3af1

SHA512
efc800438af29cecf239e37db6c3ad4117c3a390dd4ba0277c92021b2316ce5270cad1d3877f0be84a9996b67af92bac420ce54317567cd0921eada32e8f0d78

Download Submit
C:\Windows\system\CbQkFmE.exe

Filesize
1.5MB

MD5
feabcdabf904814b90c827d15b809fcf

SHA1
301c60bd611c405c73c3f9f03f042830ec8b2e63

SHA256
f34b7d5f10ce41d170de0c9b0e2fa6c2e10f7e41cd7110f097cb787cdcf8565c

SHA512
98fdfe13017ee9ea04c2cd21e11b3a71292cebeeed046e6e8fc50244da0b687c52ee3754222dd843807b1202824bc061fb40778a38e120a8192e04d1fbe3eb9e

Download Submit
C:\Windows\system\EsYHedd.exe

Filesize
1.5MB

MD5
c92f4398301aa4efa3004ab01deae7fb

SHA1
e1d38f9248cae50d3a90f4efa4ed8dd4e9b3f726

SHA256
6f53859b6ce4e54e76a160dcd4466caf09af2131d808ecf0a2a68275a3da6136

SHA512
9fa8ea4e862663efbc5e4af1656f8086ae0f9c2eecfc0ed52d8bbb811c4721ff7b32134c85d0874113b4f82f6150f2b7e9108f28302fcdc27364f325051dd886

Download Submit
C:\Windows\system\FlSLTft.exe

Filesize
1.5MB

MD5
d3247cb6391e81095db7638b70b3c022

SHA1
13e4b600659300f13c8733574c88c9eb653a5845

SHA256
7186d96463f1f7a198e661a133a7cdb411543298fa9db189e87a90b06d5ac32d

SHA512
4c9336c69804d023472432c8176cee439066e26e75bff1f31c25b554cd40a04ac14c1ffc2cd8d835d4aae639854ea5183bdd4325612f1483411d882a9f0f67a3

Download Submit
C:\Windows\system\ILSJZpq.exe

Filesize
1.5MB

MD5
e451df85ba577a415343c91162da7b7e

SHA1
8343ff7f9fbe1e5b34e87ec546439ec354ae9da3

SHA256
9272543640895d23ef5c54014a8e18449db65f8e523ed4a387a0fa18d8287027

SHA512
7504c2a8a4df940d1664badfbc715e6a3418bd6c7ff60706e87c41d399ac8cfad15a5c3db7447866e06b3df6d296f7a86713de02dbf1063efea3073c616bc6fb

Download Submit
C:\Windows\system\KZACtxI.exe

Filesize
1.5MB

MD5
17cda6acde3342f167a32260d4be68f0

SHA1
e4d4e8b13b75863a0cbf629e74db635fa2960c8e

SHA256
8cd1fb4ee96e633d6a036b5efe58d127139c592a577f5efc18138ff2cc562479

SHA512
d6f0acd85562108be7c91f5b64d98214b49a876daea7ae68a5dc558e9fbf5949d4f24b27945fd0502c5476448cadd6a0e96adb30d6a1b9ec2ad7bafb03e579cd

Download Submit
C:\Windows\system\MXqTwXG.exe

Filesize
1.5MB

MD5
42a0f4c62d2cd116c2b066faebef8f8d

SHA1
d0d4988b3f2ed6dcca02ddec4bb336894b2b172c

SHA256
1366266effa57af7114beb274aba4fce6d399a65b76f6c4fc45a63268ce651f3

SHA512
55bf9b2f10dcc77821f281b2f796406e86421a7ffa07804f2044e56638aed40d88a0193875ff8d9cf8b8efe8b063b97724fd3423fa06e3562131e8cfc9c6767a

Download Submit
C:\Windows\system\NQeDmQt.exe

Filesize
1.5MB

MD5
fd7bb7c83fa5d7635b0bfebfbec8e73b

SHA1
95957caecc1c0d333bf3a403e0358cafe65e4db4

SHA256
b2361b418fd0e604055106b7b490837940b9ef5e9e7597ec5f86d90c1318c485

SHA512
10d3d8740a6b5bcc2f12540de86b807a8f5c4ac4565c83c013c20f512778b8c6889e62e3bb4ba5bb9a8af0691d6f024c99b4b391c4f19811ededeafae698bdc5

Download Submit
C:\Windows\system\PZXTJzV.exe

Filesize
1.5MB

MD5
bf614911087e019010a8637b94a6e95f

SHA1
dc0a7554cafe284c93b7d3f636bc2cf8143497b2

SHA256
1b72931da8e221e6b2a613f44ca7a0b0d6928d875bd7b9d0cbee20a9797d75c9

SHA512
579edaba3b884d20936a74a7235a8d119211bf87181b95328420a7271b5ab326e4a8628f6accc22d14fec0a60a10e79bf74cf32aef54be782c88e56b969bc42c

Download Submit
C:\Windows\system\PaxtChV.exe

Filesize
1.5MB

MD5
bdc13d8193b2254d5c7dafed2d80e777

SHA1
34970f7b46b35b5c5e0f68eb885af3478cdae85d

SHA256
a99ecbca5d378ec5dad0cc04b2176964f67910edc309d6906cc76aacebef2aa7

SHA512
27ffd620807f3fdbe9b4c449106cfed728839324c8995eea7cc15dac0c8aa2fa51c0a14be3591eaa728e8d02691de2d08413cd6b05faa822a4728321c9e1a555

Download Submit
C:\Windows\system\QBSxGua.exe

Filesize
1.5MB

MD5
4861825b4b5ef3c4895a3c3ccaa1be29

SHA1
f675a3ee51d27037f6f5b439e96130ccf6fd2c4d

SHA256
d4af9852dfcfaca0657e0021bb43258d60cd26c35091b0c0b0fe7d350e7ecb8d

SHA512
123935972092d4e43c3b4814332e2f740b3ca047318e6f0426daa4cf0032a8e375b3ed788d37274f8e022ab30830bef5c256e16a8428bd1eaba555f93488683e

Download Submit
C:\Windows\system\SIBUgyd.exe

Filesize
1.5MB

MD5
76c1b49fafb6d225d567293f20b2dcab

SHA1
64ba12d225584ab5b2e9d718347d1dab66e18fa2

SHA256
80692810f659de7eb6c2528acebb973e60adeb2d357d12fb68579b47e93ff57d

SHA512
d22c26bee5ece53356ac9274a0f14ae8dbaf6bd7b7d0460be756483a6a349a7729120f4a5ba8985660afe54bb005b2bbc99b2ed4c6968661002b0fccd9a8ce59

Download Submit
C:\Windows\system\ScGQdPJ.exe

Filesize
1.5MB

MD5
19f042fed7d4cb207f56e54b3bd47243

SHA1
9198c3f4b9b50965562f3e6ff4ea87930f961fdf

SHA256
e5ca9e7c2820fced1808d894158f8e2f33f1943b67fc249446d85f97531ddcd6

SHA512
24e75040c101665ffa0d73b22ce89950de04972a373710251b2d18bcc68c6281193cb6c3ac8caeae601b8e378500ab1c9ba8f8b6ef6360333228eb37c5c795d5

Download Submit
C:\Windows\system\XnowkUi.exe

Filesize
1.5MB

MD5
1f3b6834e1e7ee08c815fb2191b7f390

SHA1
8130a6a2cb5aca08ed1c7085c5d896b91eafc973

SHA256
dad83388768aa43aadba8fdb13a9d06feb62d7bf0b6e9bb0b205c019a6581af1

SHA512
aba0f6db7054297862448ef5c22b8f0ef5380225a605ed69ca6908ded6dbb06ffc1c52832f697b5d26f5fe19fbed4ab0b4933c92c92243382c59cfae7ac76e82

Download Submit
C:\Windows\system\aCkbdjg.exe

Filesize
1.5MB

MD5
52d921eca7111966c9580ca509ca7ef7

SHA1
6a1bb2a499740fd2eaee3cd715157e32c68398f5

SHA256
fe58bffcf70b9e32bad7074b7b91297f0f58748950e6001b79a87cc5c0a05801

SHA512
de73e55772997ed0bf3ee1864bd78b418a9f883ae26a5b197fa379e0f8a4475d721860b985354f8537683276526ba9f31b67ba093c78b81be1281dfb24c87c52

Download Submit
C:\Windows\system\bzBYvnc.exe

Filesize
1.5MB

MD5
8fd4ebf524a8c9485a035b2d642fffbf

SHA1
93157fc2ea3c1d4253c2864da471e7e0dacda2a0

SHA256
4716586f6dcc45628367bebfb711d3f0379e824bec0e24b521101a7cca18bd96

SHA512
9b66cc1a384984ffbfe1a30ba7b7c3c953c48cb5fbfb79cd7c73279e51ca2571b60a49402b9be396802601c932e435816870488dd23efa6439eec49eb027a825

Download Submit
C:\Windows\system\dRmTxMI.exe

Filesize
1.5MB

MD5
0d9a4d3f05b9a799d6c7d52441eb2a02

SHA1
eb79467b4078f1818a2732bef4c9a18b4136134b

SHA256
02d761e8f1066a8b67ca38b81e4bff261f20660e7c72e1d8029c04fca66d4b1f

SHA512
70114e242fd958eafbfb8745f204d224744b6afc5c12fdd1bf7b080c572e221831715d08a99ea081f8d860089820b099c119e4d2ea4b7bca83a99eba15b2f8d9

Download Submit
C:\Windows\system\fmiAimQ.exe

Filesize
1.5MB

MD5
a087baf1e684b55792b7570a9e6f4960

SHA1
808d3e5d53bd54a6c715d6765bbb7499aac0cfab

SHA256
ff7adac3b575438fa6769ff00f026d9cdd89978d8af419470ec9a7a3dee94257

SHA512
4b134ff16dbb4f79387bf48dbb83d0ec7b0cee3b9300e22d3158df235783f638d1b4d6cc55f414585a92bf6b04f1ca546b76eb0580c33ac5c4592791d97c38d6

Download Submit
C:\Windows\system\hljeQXE.exe

Filesize
1.5MB

MD5
8e67d870de7d42e1f11eadc228b8d09c

SHA1
5ae18ef1d0cc3d16821516281531c2fe906ad826

SHA256
455d50816e24c713b736d7b137a8d767e407847fc041518fb516b30acb3956ab

SHA512
6a39f6a74045f7477e816cbc7a9d702209381476af3342c2b4ce58d7c6c622b6d9edde788e7fbaf4ec5bedb7d5ed99334e783afa1442c06270da2f18dce28d46

Download Submit
C:\Windows\system\qcBrTjx.exe

Filesize
1.5MB

MD5
9a38e2ec0fad967f77990d0be059b207

SHA1
5ec14d170400054f6f470d91f4093b3d144f4184

SHA256
09c2223438f1f778fc0b7c4d78914a2b13eeebb37965f040315161d926d0bc14

SHA512
ddbdf43f0b065189c07423ebbf3b361640e51735d431f983b2f99b55c037d94d1935fd668c3e0bf51de5e88065bc0c4fceb86487776f7dc8615fe1e8ff43f2f5

Download Submit
C:\Windows\system\ttLbIvw.exe

Filesize
1.5MB

MD5
faf6c35c941bb89f43a550b807e35e92

SHA1
f0d584a842eddbea11312a1419daceb18ab3bbbe

SHA256
fc5b626ef8221a68e21ae327e49771d9938840935d3dfd7764fd5bf510731438

SHA512
0eb81305fd7d25fd76168efbf794039bfb55a6e6db14db31710d8d2014f7d086fca5cf5fea39e8568995977cac9ead72dd010a20d00419ba482d2bc044da8f41

Download Submit
C:\Windows\system\vaGCzXZ.exe

Filesize
1.5MB

MD5
74188176963de2c5a2a0758a1a23b589

SHA1
84a89ee28f0f4d937bd5a3af53a597a02f1aca20

SHA256
78fc84eba29d24e11a5b6de43a7a09480b03f4cd16b3b4033ae60be0b48773f8

SHA512
3d814ef11e0148a6d5b8041045a3e5e91ab5ee96ff2554f33a966edff7100f2b4302b25bb5695d5735fe8308b9f5a975a06b0cbddffa9122ef92a3293b40e6c4

Download Submit
C:\Windows\system\ybNeItC.exe

Filesize
1.5MB

MD5
7105c8574fe94fd7c779b7c2dcc13a1d

SHA1
c55ae36e38e3e8a2a63fc941ce08b5e1e43dd2e1

SHA256
ab89db6ddcf08d99dd5f09bb488e498ecf13e04dbcdd20b4c6c26652a9b1378a

SHA512
1e063c6fccc5d751095e27c9a7a14e46f952c1220a2b257d86a293b550121f80fa13001e2238a28b7cafff552bd2882cac641f186832502280cd6c096a06cca4

Download Submit
\Windows\system\NHUhiWn.exe

Filesize
1.5MB

MD5
91424f00bcfc7b161a4e16cba7caf590

SHA1
cae5eeba7ddf870fc8b748651631c18894dedc01

SHA256
cc41df3aa95511f9b6e1f46ae992f84edde906b4cf8005a471b92bbddea9ecbd

SHA512
8c760d8789f4db000fadd7419439e889e0871646389886652a2bb898252b06d3234950fc1120bcb1efb21fe1aeb58358eb6ee45ee7b3966105ce97520ff15074

Download Submit
\Windows\system\TZFWJVR.exe

Filesize
1.5MB

MD5
200767bcbed8b7869f3a840e04aead15

SHA1
bfa9a392b07e76228c00a3bac063f4355cafaca6

SHA256
265c94e647605f1f7f379bdc8935614076d0cbfd534334bd5b1e4728d41388f8

SHA512
fb76fa428b25e786522553db0fdee7eba64794c190efd0fc1306960b7b0b9104a4f730bca676e2087bd86c8f21e55863ba787ba7f307d22418b9c00e9a2920bf

Download Submit
\Windows\system\eAAalyI.exe

Filesize
1.5MB

MD5
845be9a8704dabe735004705422aa916

SHA1
b1127be231f789ee668c7313cca109bacc8d947d

SHA256
96ffa6f44a0a11715859532d91f0d4d9d1d3b2370bb6e30c9fd37d0dfb965219

SHA512
8f57b589d533d46ab84137c6f8831216594b3970c4aff532bb5132d049c86396f084456233bbda032b3c0fc08e115bcc62d9e09bc1c40e58af43ae8dbc9c3e46

Download Submit
\Windows\system\nWRARxe.exe

Filesize
1.5MB

MD5
004a8dc32259297454d077dcd28e2247

SHA1
121a92f6d2bda027890c349fa4fb966a8e6ea792

SHA256
365824399d9662fd627b89155ee761fba5d4f1f3d59bcbf9417d8110906cf25a

SHA512
07631452daf4763e4283df5676642e383062c07825fe0d1fbe5daaaad88a2846a1ed646524b1914ff1840b431773951cec50a8a2a31cf5ff449a9ace8c72452a

Download Submit
\Windows\system\nlabZCT.exe

Filesize
1.5MB

MD5
ea8c5b724090192ef867220180198e10

SHA1
5ba1c54ad58630c5d7c8f8390ca7499f4f61e907

SHA256
b5c1596571520cd19cf9eca73449ad75cfcb3ce33c58f3efccb972a6d8bd8f36

SHA512
9e14fee9f0841f401df47469049a381e86a890cdbc9757196d296d3331452c3c0db3608e23a1f245eddee2593341846ab75bb9f50768ca23c193ae75c809af1f

Download Submit
\Windows\system\pjFzvSL.exe

Filesize
1.5MB

MD5
07f670c65d5de9c991ed5d82b669e2bd

SHA1
45c42f18a95ffcd1629d3c60a3354088c8e0de2d

SHA256
17fe297965969c38da4b78ec964fe837b6cd65ac43b1edc4542c23561c387c78

SHA512
99dfaf226f929d4d7483345451344a9d60d16d29c223bed473981988cdc8b0dce68f531f4234bd2124134f6c6863c8c5ea75229c0877d592c2ffd8e7f794f35a

Download Submit
\Windows\system\uVvSiDo.exe

Filesize
1.5MB

MD5
4eb27fcf125c787e6b9171475d9e974b

SHA1
71bc7b02dc8b4f2965839ddb4e351295f126abb5

SHA256
6c47733d5c33d4de562092ef32ced2edee7f7f661cfa83e1a65fbfca18db1ffb

SHA512
e88091f120e82a7655f149ff8267483a4d63058771bf096dc09092a7922a9edc20dbd0aea00d79f96a3abc5f0ad665c48d0731a1015530e6e958bf59800ec888

Download Submit
memory/2080-2312-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2080-13-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2188-3089-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2188-130-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2216-14-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2216-15-0x000007FEF56DE000-0x000007FEF56DF000-memory.dmp

Filesize
4KB

Download
memory/2216-99-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

Filesize
9.6MB

Download
memory/2216-101-0x00000000022F0000-0x00000000022F8000-memory.dmp

Filesize
32KB

Download
memory/2216-74-0x000000001B4F0000-0x000000001B7D2000-memory.dmp

Filesize
2.9MB

Download
memory/2216-663-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

Filesize
9.6MB

Download
memory/2216-131-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

Filesize
9.6MB

Download
memory/2336-2305-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-119-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-3068-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-110-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-114-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-2309-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-3090-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2376-122-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2380-117-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2380-3077-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2464-106-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-3095-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-108-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2492-2310-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2540-100-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2540-2367-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2568-103-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-2311-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-2313-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-128-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-125-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/2808-129-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/2808-135-0x0000000002AC0000-0x0000000002EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-102-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-104-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-0-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2808-6-0x0000000002AC0000-0x0000000002EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2808-107-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2808-109-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/2808-111-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-116-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2808-118-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-120-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download