xmrig | 6785aa498ade36e74bae3d02aa444e70d59b2f57a5838669ef79e8448984de08

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
Size

1.4MB
MD5

7686d5abcb082c1ce6500ba112bc85b0
SHA1

32f31206385964a17595e8e56524df5254166ead
SHA256

6785aa498ade36e74bae3d02aa444e70d59b2f57a5838669ef79e8448984de08
SHA512

8f4a9754a10a1bb5eece681fd767469516d70332af98116eec1869ab4086799770479e2f4986de5ad3265f50c18bf9a260f4196d4aaf6215f3ce1bf9ace930af
SSDEEP

24576:zv3/fTLF671TilQFG4P5PmK/lzapbU4w2DyA7lO1e6wrQqdeT:Lz071uv4BPm6lgVJ66Q8G

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/3012-22-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2420-211-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2668-182-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2976-208-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/272-202-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2460-199-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2520-196-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2500-193-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2728-191-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/2532-190-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/2604-187-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2548-186-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2604-4788-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2668-5304-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2728-5332-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/2420-5436-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2548-5463-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/272-5664-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2532-5675-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/2460-5883-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2976-5939-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2500-5979-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/3012-5980-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2656	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3012	JQYAvbY.exe
2668	kDOfRDW.exe
2548	AsYokjA.exe
2604	hEAsdpl.exe
2532	WaRHtEF.exe
2728	DjFrnlJ.exe
2500	kLrPnwV.exe
2520	bVGPdgv.exe
2460	mARkHUB.exe
272	rvZuWqC.exe
2976	dcOwtWN.exe
2420	hukpLQU.exe
2700	qFJKtVt.exe
2776	AdbcFxk.exe
2800	riUaXpT.exe
344	tkSmHuk.exe
760	TxfDaFS.exe
2152	yRXBxCz.exe
1580	pxhvBEn.exe
1804	AmdewNx.exe
1988	rLvPkGh.exe
2540	xIiOgZa.exe
2240	uMKmIgZ.exe
1244	oDbHAWN.exe
2164	NMValCX.exe
776	smzGRqw.exe
648	nsLjhzY.exe
1728	LRPlrBg.exe
2908	YulfzDs.exe
2224	KdgCYFr.exe
1664	TLNBseE.exe
828	SeBAaVD.exe
1412	VvIGmcT.exe
1788	cvFfmxE.exe
1252	dNVPHrn.exe
2336	GUJUbok.exe
2416	QPtEPvW.exe
328	iJohDha.exe
860	AzfYSoA.exe
2252	HCuUZUC.exe
1880	rRSbFSf.exe
1132	qUNqdqD.exe
2676	XsJsXaB.exe
896	EziDmfj.exe
2028	DFlInsq.exe
2308	wVLYHJB.exe
3060	afullqe.exe
1712	lNwqUYg.exe
796	qAoXlqA.exe
2292	GUuyCPv.exe
1748	qjDzckY.exe
1264	uVeKhRb.exe
2060	jqqZItJ.exe
2480	uhWOsjK.exe
2168	PiqRRrc.exe
1488	HOUcAFh.exe
2392	bLYquAM.exe
1652	PlutACS.exe
2440	QrbxoIl.exe
2508	bxMZFnv.exe
2544	RJXPEnB.exe
2512	AlIgYkr.exe
2148	kzfSbon.exe
1176	sQNsfUi.exe

Loads dropped DLL 64 IoCs

pid	Process
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1644-0-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/files/0x000b000000012274-3.dat	upx
behavioral1/files/0x0038000000014c0b-11.dat	upx
behavioral1/files/0x0007000000004e76-15.dat	upx
behavioral1/memory/3012-22-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/files/0x0009000000015c6f-41.dat	upx
behavioral1/files/0x0006000000015d7f-60.dat	upx
behavioral1/files/0x0007000000015c7f-55.dat	upx
behavioral1/files/0x0006000000015ff4-82.dat	upx
behavioral1/files/0x0006000000016255-89.dat	upx
behavioral1/files/0x0006000000016d34-153.dat	upx
behavioral1/files/0x0006000000016310-98.dat	upx
behavioral1/files/0x00060000000164a9-103.dat	upx
behavioral1/files/0x000600000001686d-134.dat	upx
behavioral1/files/0x0006000000016c7a-129.dat	upx
behavioral1/files/0x0006000000016c56-121.dat	upx
behavioral1/files/0x00060000000165a8-116.dat	upx
behavioral1/memory/2420-211-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/2668-182-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2976-208-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/272-202-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/2460-199-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/2520-196-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2500-193-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2728-191-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/2532-190-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/memory/2604-187-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2548-186-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/files/0x0006000000016d4e-163.dat	upx
behavioral1/files/0x0006000000016d3d-155.dat	upx
behavioral1/files/0x0006000000016d2c-147.dat	upx
behavioral1/files/0x0006000000016ce7-139.dat	upx
behavioral1/files/0x0006000000016d45-160.dat	upx
behavioral1/files/0x0006000000016d1b-146.dat	upx
behavioral1/files/0x0006000000016cc3-137.dat	upx
behavioral1/files/0x0006000000016c71-127.dat	upx
behavioral1/files/0x0006000000016103-88.dat	upx
behavioral1/files/0x0006000000016abb-119.dat	upx
behavioral1/files/0x000600000001663f-108.dat	upx
behavioral1/files/0x0006000000015f71-77.dat	upx
behavioral1/files/0x0006000000015e5b-68.dat	upx
behavioral1/files/0x0006000000015d77-66.dat	upx
behavioral1/files/0x0006000000015f05-71.dat	upx
behavioral1/files/0x0009000000015682-36.dat	upx
behavioral1/files/0x0007000000015678-35.dat	upx
behavioral1/files/0x0007000000015d6b-50.dat	upx
behavioral1/files/0x000800000001562a-27.dat	upx
behavioral1/memory/2604-4788-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2668-5304-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2728-5332-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/2420-5436-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/2548-5463-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/memory/272-5664-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/2532-5675-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/memory/2460-5883-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/2976-5939-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2500-5979-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/3012-5980-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yRXBxCz.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\DEPwoqP.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\lNDNRnh.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\pCyMfzY.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\jmtGLYX.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\pELyidr.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\epYxMkO.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\eurCFCC.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\xyqHLvu.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\yFKMZnz.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\RcbIWna.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\dvcUPjI.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\lnyJiwO.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\YQhkhfp.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\XZivYmk.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\hhYZVTp.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\xdvsrlE.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\HmGmMHP.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\XGMDqwe.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\GrBVlRa.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\LDxlQaB.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\kYcvtFw.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\RTqBiPR.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\HBauufO.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\TnRfgnI.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\pPGkutZ.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\ZJKXAyn.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\phoDRDg.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\SouKzOd.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\UvNhLdQ.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\IBLSqJV.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\lMZdjCi.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\ntgsbQA.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\xSgHxRG.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\oJcYFnu.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\gcDKsni.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\zMkhrcm.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\akRAGXa.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\FMlSFzo.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\DeLmPTF.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\pXNXNzQ.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\mfTGhqP.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\StSydit.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\IzSAyxD.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\fRIayul.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\DWTlIHk.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\nhIFWPh.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\EtwOKPu.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\iDBbNOK.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\tMdkKSI.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\ATyXOhi.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\WpyWnZz.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\gkIWrqf.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\KIjPapw.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\kmGJTcx.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\ImJNuRZ.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\lKCQqUv.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\iOYzPzn.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\BCTaWNZ.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\NasdXoh.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\hlyJbXu.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\FDgVPPG.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\coJmWVK.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
File created	C:\Windows\System\OUXsomV.exe	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2656	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeLockMemoryPrivilege	5432	dCBwPNZ.exe
Token: SeLockMemoryPrivilege	5432	dCBwPNZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2656	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	29
PID 1644 wrote to memory of 2656	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	29
PID 1644 wrote to memory of 2656	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	29
PID 1644 wrote to memory of 3012	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	30
PID 1644 wrote to memory of 3012	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	30
PID 1644 wrote to memory of 3012	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	30
PID 1644 wrote to memory of 2668	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	31
PID 1644 wrote to memory of 2668	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	31
PID 1644 wrote to memory of 2668	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	31
PID 1644 wrote to memory of 2548	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	32
PID 1644 wrote to memory of 2548	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	32
PID 1644 wrote to memory of 2548	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	32
PID 1644 wrote to memory of 2604	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	33
PID 1644 wrote to memory of 2604	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	33
PID 1644 wrote to memory of 2604	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	33
PID 1644 wrote to memory of 2532	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	34
PID 1644 wrote to memory of 2532	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	34
PID 1644 wrote to memory of 2532	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	34
PID 1644 wrote to memory of 2728	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	35
PID 1644 wrote to memory of 2728	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	35
PID 1644 wrote to memory of 2728	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	35
PID 1644 wrote to memory of 2500	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	36
PID 1644 wrote to memory of 2500	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	36
PID 1644 wrote to memory of 2500	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	36
PID 1644 wrote to memory of 2460	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	37
PID 1644 wrote to memory of 2460	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	37
PID 1644 wrote to memory of 2460	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	37
PID 1644 wrote to memory of 2520	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	38
PID 1644 wrote to memory of 2520	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	38
PID 1644 wrote to memory of 2520	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	38
PID 1644 wrote to memory of 2976	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	39
PID 1644 wrote to memory of 2976	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	39
PID 1644 wrote to memory of 2976	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	39
PID 1644 wrote to memory of 272	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	40
PID 1644 wrote to memory of 272	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	40
PID 1644 wrote to memory of 272	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	40
PID 1644 wrote to memory of 2420	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	41
PID 1644 wrote to memory of 2420	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	41
PID 1644 wrote to memory of 2420	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	41
PID 1644 wrote to memory of 2700	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	42
PID 1644 wrote to memory of 2700	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	42
PID 1644 wrote to memory of 2700	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	42
PID 1644 wrote to memory of 2776	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	43
PID 1644 wrote to memory of 2776	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	43
PID 1644 wrote to memory of 2776	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	43
PID 1644 wrote to memory of 2800	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	44
PID 1644 wrote to memory of 2800	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	44
PID 1644 wrote to memory of 2800	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	44
PID 1644 wrote to memory of 344	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	45
PID 1644 wrote to memory of 344	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	45
PID 1644 wrote to memory of 344	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	45
PID 1644 wrote to memory of 760	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	46
PID 1644 wrote to memory of 760	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	46
PID 1644 wrote to memory of 760	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	46
PID 1644 wrote to memory of 2152	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	47
PID 1644 wrote to memory of 2152	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	47
PID 1644 wrote to memory of 2152	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	47
PID 1644 wrote to memory of 1580	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	48
PID 1644 wrote to memory of 1580	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	48
PID 1644 wrote to memory of 1580	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	48
PID 1644 wrote to memory of 1988	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	49
PID 1644 wrote to memory of 1988	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	49
PID 1644 wrote to memory of 1988	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	49
PID 1644 wrote to memory of 1804	1644	7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7686d5abcb082c1ce6500ba112bc85b0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\System\JQYAvbY.exe
  C:\Windows\System\JQYAvbY.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\kDOfRDW.exe
  C:\Windows\System\kDOfRDW.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\AsYokjA.exe
  C:\Windows\System\AsYokjA.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\hEAsdpl.exe
  C:\Windows\System\hEAsdpl.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\WaRHtEF.exe
  C:\Windows\System\WaRHtEF.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\DjFrnlJ.exe
  C:\Windows\System\DjFrnlJ.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\kLrPnwV.exe
  C:\Windows\System\kLrPnwV.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\mARkHUB.exe
  C:\Windows\System\mARkHUB.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\bVGPdgv.exe
  C:\Windows\System\bVGPdgv.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\dcOwtWN.exe
  C:\Windows\System\dcOwtWN.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\rvZuWqC.exe
  C:\Windows\System\rvZuWqC.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\hukpLQU.exe
  C:\Windows\System\hukpLQU.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\qFJKtVt.exe
  C:\Windows\System\qFJKtVt.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\AdbcFxk.exe
  C:\Windows\System\AdbcFxk.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\riUaXpT.exe
  C:\Windows\System\riUaXpT.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\tkSmHuk.exe
  C:\Windows\System\tkSmHuk.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\TxfDaFS.exe
  C:\Windows\System\TxfDaFS.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\yRXBxCz.exe
  C:\Windows\System\yRXBxCz.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\pxhvBEn.exe
  C:\Windows\System\pxhvBEn.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\rLvPkGh.exe
  C:\Windows\System\rLvPkGh.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\AmdewNx.exe
  C:\Windows\System\AmdewNx.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\oDbHAWN.exe
  C:\Windows\System\oDbHAWN.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\xIiOgZa.exe
  C:\Windows\System\xIiOgZa.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\YulfzDs.exe
  C:\Windows\System\YulfzDs.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\uMKmIgZ.exe
  C:\Windows\System\uMKmIgZ.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\KdgCYFr.exe
  C:\Windows\System\KdgCYFr.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\NMValCX.exe
  C:\Windows\System\NMValCX.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\TLNBseE.exe
  C:\Windows\System\TLNBseE.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\smzGRqw.exe
  C:\Windows\System\smzGRqw.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\VvIGmcT.exe
  C:\Windows\System\VvIGmcT.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\nsLjhzY.exe
  C:\Windows\System\nsLjhzY.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\cvFfmxE.exe
  C:\Windows\System\cvFfmxE.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\LRPlrBg.exe
  C:\Windows\System\LRPlrBg.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\dNVPHrn.exe
  C:\Windows\System\dNVPHrn.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\SeBAaVD.exe
  C:\Windows\System\SeBAaVD.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\GUJUbok.exe
  C:\Windows\System\GUJUbok.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\QPtEPvW.exe
  C:\Windows\System\QPtEPvW.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\lNwqUYg.exe
  C:\Windows\System\lNwqUYg.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\iJohDha.exe
  C:\Windows\System\iJohDha.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\qAoXlqA.exe
  C:\Windows\System\qAoXlqA.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\AzfYSoA.exe
  C:\Windows\System\AzfYSoA.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\GUuyCPv.exe
  C:\Windows\System\GUuyCPv.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\HCuUZUC.exe
  C:\Windows\System\HCuUZUC.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\qjDzckY.exe
  C:\Windows\System\qjDzckY.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\rRSbFSf.exe
  C:\Windows\System\rRSbFSf.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\uVeKhRb.exe
  C:\Windows\System\uVeKhRb.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\qUNqdqD.exe
  C:\Windows\System\qUNqdqD.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\jqqZItJ.exe
  C:\Windows\System\jqqZItJ.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\XsJsXaB.exe
  C:\Windows\System\XsJsXaB.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\PiqRRrc.exe
  C:\Windows\System\PiqRRrc.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\EziDmfj.exe
  C:\Windows\System\EziDmfj.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\HOUcAFh.exe
  C:\Windows\System\HOUcAFh.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\DFlInsq.exe
  C:\Windows\System\DFlInsq.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\bLYquAM.exe
  C:\Windows\System\bLYquAM.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\wVLYHJB.exe
  C:\Windows\System\wVLYHJB.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\PlutACS.exe
  C:\Windows\System\PlutACS.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\afullqe.exe
  C:\Windows\System\afullqe.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\QrbxoIl.exe
  C:\Windows\System\QrbxoIl.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\uhWOsjK.exe
  C:\Windows\System\uhWOsjK.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\bxMZFnv.exe
  C:\Windows\System\bxMZFnv.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\RJXPEnB.exe
  C:\Windows\System\RJXPEnB.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\AlIgYkr.exe
  C:\Windows\System\AlIgYkr.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\kzfSbon.exe
  C:\Windows\System\kzfSbon.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\sQNsfUi.exe
  C:\Windows\System\sQNsfUi.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\mqjztFr.exe
  C:\Windows\System\mqjztFr.exe
  2⤵
  PID:2884
- C:\Windows\System\vuPPmlb.exe
  C:\Windows\System\vuPPmlb.exe
  2⤵
  PID:1960
- C:\Windows\System\CHhTSiK.exe
  C:\Windows\System\CHhTSiK.exe
  2⤵
  PID:2848
- C:\Windows\System\TFBuvlb.exe
  C:\Windows\System\TFBuvlb.exe
  2⤵
  PID:2128
- C:\Windows\System\mVDqPeh.exe
  C:\Windows\System\mVDqPeh.exe
  2⤵
  PID:836
- C:\Windows\System\QAcyUqv.exe
  C:\Windows\System\QAcyUqv.exe
  2⤵
  PID:1216
- C:\Windows\System\EXNqPkN.exe
  C:\Windows\System\EXNqPkN.exe
  2⤵
  PID:2736
- C:\Windows\System\QBooThh.exe
  C:\Windows\System\QBooThh.exe
  2⤵
  PID:2472
- C:\Windows\System\gojDZIh.exe
  C:\Windows\System\gojDZIh.exe
  2⤵
  PID:1684
- C:\Windows\System\iFaQWKu.exe
  C:\Windows\System\iFaQWKu.exe
  2⤵
  PID:1360
- C:\Windows\System\IcOImjB.exe
  C:\Windows\System\IcOImjB.exe
  2⤵
  PID:2748
- C:\Windows\System\QIgYJtW.exe
  C:\Windows\System\QIgYJtW.exe
  2⤵
  PID:2992
- C:\Windows\System\RgOnDJo.exe
  C:\Windows\System\RgOnDJo.exe
  2⤵
  PID:2236
- C:\Windows\System\vuIWPmZ.exe
  C:\Windows\System\vuIWPmZ.exe
  2⤵
  PID:1900
- C:\Windows\System\FQOUTZY.exe
  C:\Windows\System\FQOUTZY.exe
  2⤵
  PID:2200
- C:\Windows\System\JdmQsbC.exe
  C:\Windows\System\JdmQsbC.exe
  2⤵
  PID:1312
- C:\Windows\System\yleEjIh.exe
  C:\Windows\System\yleEjIh.exe
  2⤵
  PID:2104
- C:\Windows\System\UsEOZqR.exe
  C:\Windows\System\UsEOZqR.exe
  2⤵
  PID:2452
- C:\Windows\System\bOPUAjP.exe
  C:\Windows\System\bOPUAjP.exe
  2⤵
  PID:668
- C:\Windows\System\RgtNXYl.exe
  C:\Windows\System\RgtNXYl.exe
  2⤵
  PID:2792
- C:\Windows\System\qktMgdL.exe
  C:\Windows\System\qktMgdL.exe
  2⤵
  PID:2204
- C:\Windows\System\jSNYfDT.exe
  C:\Windows\System\jSNYfDT.exe
  2⤵
  PID:2772
- C:\Windows\System\pDQUwmn.exe
  C:\Windows\System\pDQUwmn.exe
  2⤵
  PID:2276
- C:\Windows\System\BrvzXzU.exe
  C:\Windows\System\BrvzXzU.exe
  2⤵
  PID:940
- C:\Windows\System\qCkUomw.exe
  C:\Windows\System\qCkUomw.exe
  2⤵
  PID:1940
- C:\Windows\System\DvNPNop.exe
  C:\Windows\System\DvNPNop.exe
  2⤵
  PID:880
- C:\Windows\System\eODqZLP.exe
  C:\Windows\System\eODqZLP.exe
  2⤵
  PID:1632
- C:\Windows\System\BDGqyMD.exe
  C:\Windows\System\BDGqyMD.exe
  2⤵
  PID:1528
- C:\Windows\System\ldEgnIv.exe
  C:\Windows\System\ldEgnIv.exe
  2⤵
  PID:2652
- C:\Windows\System\keJzvfI.exe
  C:\Windows\System\keJzvfI.exe
  2⤵
  PID:2732
- C:\Windows\System\bEFyEHh.exe
  C:\Windows\System\bEFyEHh.exe
  2⤵
  PID:2008
- C:\Windows\System\RmwgVYm.exe
  C:\Windows\System\RmwgVYm.exe
  2⤵
  PID:1440
- C:\Windows\System\ugXeUJN.exe
  C:\Windows\System\ugXeUJN.exe
  2⤵
  PID:2768
- C:\Windows\System\TSUeAgf.exe
  C:\Windows\System\TSUeAgf.exe
  2⤵
  PID:580
- C:\Windows\System\TzHekbk.exe
  C:\Windows\System\TzHekbk.exe
  2⤵
  PID:1564
- C:\Windows\System\uHDExxt.exe
  C:\Windows\System\uHDExxt.exe
  2⤵
  PID:2012
- C:\Windows\System\GqezLya.exe
  C:\Windows\System\GqezLya.exe
  2⤵
  PID:3040
- C:\Windows\System\sjTmBHl.exe
  C:\Windows\System\sjTmBHl.exe
  2⤵
  PID:1508
- C:\Windows\System\qtgsAwO.exe
  C:\Windows\System\qtgsAwO.exe
  2⤵
  PID:1844
- C:\Windows\System\LTAWOii.exe
  C:\Windows\System\LTAWOii.exe
  2⤵
  PID:2428
- C:\Windows\System\pJnLnEq.exe
  C:\Windows\System\pJnLnEq.exe
  2⤵
  PID:2560
- C:\Windows\System\AhGnCsp.exe
  C:\Windows\System\AhGnCsp.exe
  2⤵
  PID:684
- C:\Windows\System\mPbSvPh.exe
  C:\Windows\System\mPbSvPh.exe
  2⤵
  PID:1764
- C:\Windows\System\yAyZrJn.exe
  C:\Windows\System\yAyZrJn.exe
  2⤵
  PID:2828
- C:\Windows\System\FCtbQBQ.exe
  C:\Windows\System\FCtbQBQ.exe
  2⤵
  PID:2740
- C:\Windows\System\OgFQorn.exe
  C:\Windows\System\OgFQorn.exe
  2⤵
  PID:2868
- C:\Windows\System\SoQOJgN.exe
  C:\Windows\System\SoQOJgN.exe
  2⤵
  PID:1500
- C:\Windows\System\IDnnDQo.exe
  C:\Windows\System\IDnnDQo.exe
  2⤵
  PID:2304
- C:\Windows\System\QZoajOa.exe
  C:\Windows\System\QZoajOa.exe
  2⤵
  PID:2904
- C:\Windows\System\EHoUhBI.exe
  C:\Windows\System\EHoUhBI.exe
  2⤵
  PID:1112
- C:\Windows\System\ieuPSWK.exe
  C:\Windows\System\ieuPSWK.exe
  2⤵
  PID:624
- C:\Windows\System\HVzkmNr.exe
  C:\Windows\System\HVzkmNr.exe
  2⤵
  PID:1936
- C:\Windows\System\HrqLRRZ.exe
  C:\Windows\System\HrqLRRZ.exe
  2⤵
  PID:296
- C:\Windows\System\JrzcYHo.exe
  C:\Windows\System\JrzcYHo.exe
  2⤵
  PID:1016
- C:\Windows\System\UDcagmm.exe
  C:\Windows\System\UDcagmm.exe
  2⤵
  PID:1232
- C:\Windows\System\HMrxMtN.exe
  C:\Windows\System\HMrxMtN.exe
  2⤵
  PID:864
- C:\Windows\System\egDPzrl.exe
  C:\Windows\System\egDPzrl.exe
  2⤵
  PID:1856
- C:\Windows\System\OgcXbZQ.exe
  C:\Windows\System\OgcXbZQ.exe
  2⤵
  PID:1588
- C:\Windows\System\MPXiGtD.exe
  C:\Windows\System\MPXiGtD.exe
  2⤵
  PID:1848
- C:\Windows\System\asrOANf.exe
  C:\Windows\System\asrOANf.exe
  2⤵
  PID:408
- C:\Windows\System\yOWfLFP.exe
  C:\Windows\System\yOWfLFP.exe
  2⤵
  PID:572
- C:\Windows\System\gjwxnfI.exe
  C:\Windows\System\gjwxnfI.exe
  2⤵
  PID:2316
- C:\Windows\System\jFZXGtN.exe
  C:\Windows\System\jFZXGtN.exe
  2⤵
  PID:1720
- C:\Windows\System\XzVCsMM.exe
  C:\Windows\System\XzVCsMM.exe
  2⤵
  PID:1912
- C:\Windows\System\LnolOwS.exe
  C:\Windows\System\LnolOwS.exe
  2⤵
  PID:3028
- C:\Windows\System\pVcQkID.exe
  C:\Windows\System\pVcQkID.exe
  2⤵
  PID:2780
- C:\Windows\System\CrFntuy.exe
  C:\Windows\System\CrFntuy.exe
  2⤵
  PID:1428
- C:\Windows\System\ChHrhFV.exe
  C:\Windows\System\ChHrhFV.exe
  2⤵
  PID:3080
- C:\Windows\System\acACdnJ.exe
  C:\Windows\System\acACdnJ.exe
  2⤵
  PID:3108
- C:\Windows\System\tHBMvrd.exe
  C:\Windows\System\tHBMvrd.exe
  2⤵
  PID:3124
- C:\Windows\System\MqIBuTd.exe
  C:\Windows\System\MqIBuTd.exe
  2⤵
  PID:3144
- C:\Windows\System\ReelhTy.exe
  C:\Windows\System\ReelhTy.exe
  2⤵
  PID:3160
- C:\Windows\System\VprZIEj.exe
  C:\Windows\System\VprZIEj.exe
  2⤵
  PID:3176
- C:\Windows\System\ZdaucoA.exe
  C:\Windows\System\ZdaucoA.exe
  2⤵
  PID:3196
- C:\Windows\System\UMOfubx.exe
  C:\Windows\System\UMOfubx.exe
  2⤵
  PID:3216
- C:\Windows\System\svadibB.exe
  C:\Windows\System\svadibB.exe
  2⤵
  PID:3240
- C:\Windows\System\Xszuvfs.exe
  C:\Windows\System\Xszuvfs.exe
  2⤵
  PID:3256
- C:\Windows\System\MAWowAR.exe
  C:\Windows\System\MAWowAR.exe
  2⤵
  PID:3272
- C:\Windows\System\jdyieMY.exe
  C:\Windows\System\jdyieMY.exe
  2⤵
  PID:3304
- C:\Windows\System\jJjeFbC.exe
  C:\Windows\System\jJjeFbC.exe
  2⤵
  PID:3344
- C:\Windows\System\qzWnDGY.exe
  C:\Windows\System\qzWnDGY.exe
  2⤵
  PID:3368
- C:\Windows\System\ArBzBMh.exe
  C:\Windows\System\ArBzBMh.exe
  2⤵
  PID:3384
- C:\Windows\System\EYZaLAG.exe
  C:\Windows\System\EYZaLAG.exe
  2⤵
  PID:3404
- C:\Windows\System\sklqFyd.exe
  C:\Windows\System\sklqFyd.exe
  2⤵
  PID:3420
- C:\Windows\System\LaavhXz.exe
  C:\Windows\System\LaavhXz.exe
  2⤵
  PID:3436
- C:\Windows\System\eKtbNAx.exe
  C:\Windows\System\eKtbNAx.exe
  2⤵
  PID:3456
- C:\Windows\System\RcACrCs.exe
  C:\Windows\System\RcACrCs.exe
  2⤵
  PID:3472
- C:\Windows\System\EwltQAp.exe
  C:\Windows\System\EwltQAp.exe
  2⤵
  PID:3488
- C:\Windows\System\OVUeWHX.exe
  C:\Windows\System\OVUeWHX.exe
  2⤵
  PID:3504
- C:\Windows\System\mQpODmd.exe
  C:\Windows\System\mQpODmd.exe
  2⤵
  PID:3524
- C:\Windows\System\RkoWGiw.exe
  C:\Windows\System\RkoWGiw.exe
  2⤵
  PID:3540
- C:\Windows\System\QaUrWCi.exe
  C:\Windows\System\QaUrWCi.exe
  2⤵
  PID:3556
- C:\Windows\System\exxvaVE.exe
  C:\Windows\System\exxvaVE.exe
  2⤵
  PID:3576
- C:\Windows\System\vzwfHZF.exe
  C:\Windows\System\vzwfHZF.exe
  2⤵
  PID:3592
- C:\Windows\System\sCYlmqV.exe
  C:\Windows\System\sCYlmqV.exe
  2⤵
  PID:3608
- C:\Windows\System\JmrmFdF.exe
  C:\Windows\System\JmrmFdF.exe
  2⤵
  PID:3624
- C:\Windows\System\OyctEWa.exe
  C:\Windows\System\OyctEWa.exe
  2⤵
  PID:3664
- C:\Windows\System\UfHqBqx.exe
  C:\Windows\System\UfHqBqx.exe
  2⤵
  PID:3688
- C:\Windows\System\DBRsnjD.exe
  C:\Windows\System\DBRsnjD.exe
  2⤵
  PID:3708
- C:\Windows\System\HEyTuLQ.exe
  C:\Windows\System\HEyTuLQ.exe
  2⤵
  PID:3724
- C:\Windows\System\KpokggX.exe
  C:\Windows\System\KpokggX.exe
  2⤵
  PID:3740
- C:\Windows\System\UXpezWV.exe
  C:\Windows\System\UXpezWV.exe
  2⤵
  PID:3756
- C:\Windows\System\bWuCRsK.exe
  C:\Windows\System\bWuCRsK.exe
  2⤵
  PID:3772
- C:\Windows\System\nqMqYUS.exe
  C:\Windows\System\nqMqYUS.exe
  2⤵
  PID:3788
- C:\Windows\System\jmJZngI.exe
  C:\Windows\System\jmJZngI.exe
  2⤵
  PID:3804
- C:\Windows\System\tGdtSfk.exe
  C:\Windows\System\tGdtSfk.exe
  2⤵
  PID:3820
- C:\Windows\System\rsTuWLe.exe
  C:\Windows\System\rsTuWLe.exe
  2⤵
  PID:3840
- C:\Windows\System\yrPyZuI.exe
  C:\Windows\System\yrPyZuI.exe
  2⤵
  PID:3856
- C:\Windows\System\uwMYcGz.exe
  C:\Windows\System\uwMYcGz.exe
  2⤵
  PID:3872
- C:\Windows\System\HSuGKRC.exe
  C:\Windows\System\HSuGKRC.exe
  2⤵
  PID:3888
- C:\Windows\System\DhIcHZo.exe
  C:\Windows\System\DhIcHZo.exe
  2⤵
  PID:3904
- C:\Windows\System\kbHybQA.exe
  C:\Windows\System\kbHybQA.exe
  2⤵
  PID:3920
- C:\Windows\System\GodzWjv.exe
  C:\Windows\System\GodzWjv.exe
  2⤵
  PID:3936
- C:\Windows\System\TobMeOb.exe
  C:\Windows\System\TobMeOb.exe
  2⤵
  PID:3952
- C:\Windows\System\WGawaGP.exe
  C:\Windows\System\WGawaGP.exe
  2⤵
  PID:3968
- C:\Windows\System\QNXHsBY.exe
  C:\Windows\System\QNXHsBY.exe
  2⤵
  PID:3984
- C:\Windows\System\NxebIMC.exe
  C:\Windows\System\NxebIMC.exe
  2⤵
  PID:4000
- C:\Windows\System\DwMuSiI.exe
  C:\Windows\System\DwMuSiI.exe
  2⤵
  PID:4016
- C:\Windows\System\YrLbEyy.exe
  C:\Windows\System\YrLbEyy.exe
  2⤵
  PID:4032
- C:\Windows\System\ywiZRBB.exe
  C:\Windows\System\ywiZRBB.exe
  2⤵
  PID:4048
- C:\Windows\System\iCCgyFf.exe
  C:\Windows\System\iCCgyFf.exe
  2⤵
  PID:4064
- C:\Windows\System\aqsXvYE.exe
  C:\Windows\System\aqsXvYE.exe
  2⤵
  PID:4080
- C:\Windows\System\tdpLhdh.exe
  C:\Windows\System\tdpLhdh.exe
  2⤵
  PID:1576
- C:\Windows\System\JxESGPF.exe
  C:\Windows\System\JxESGPF.exe
  2⤵
  PID:1432
- C:\Windows\System\hQMUZhD.exe
  C:\Windows\System\hQMUZhD.exe
  2⤵
  PID:2528
- C:\Windows\System\jjNVAqg.exe
  C:\Windows\System\jjNVAqg.exe
  2⤵
  PID:1396
- C:\Windows\System\SUFcvmg.exe
  C:\Windows\System\SUFcvmg.exe
  2⤵
  PID:2352
- C:\Windows\System\EPAEWaU.exe
  C:\Windows\System\EPAEWaU.exe
  2⤵
  PID:2388
- C:\Windows\System\dxfCViR.exe
  C:\Windows\System\dxfCViR.exe
  2⤵
  PID:2972
- C:\Windows\System\tYMXeas.exe
  C:\Windows\System\tYMXeas.exe
  2⤵
  PID:2948
- C:\Windows\System\BWtQUOn.exe
  C:\Windows\System\BWtQUOn.exe
  2⤵
  PID:3120
- C:\Windows\System\hrLUgZS.exe
  C:\Windows\System\hrLUgZS.exe
  2⤵
  PID:3192
- C:\Windows\System\HvRrVaU.exe
  C:\Windows\System\HvRrVaU.exe
  2⤵
  PID:3236
- C:\Windows\System\rkrxdcj.exe
  C:\Windows\System\rkrxdcj.exe
  2⤵
  PID:3264
- C:\Windows\System\uKViQHN.exe
  C:\Windows\System\uKViQHN.exe
  2⤵
  PID:324
- C:\Windows\System\VvjYvMs.exe
  C:\Windows\System\VvjYvMs.exe
  2⤵
  PID:2688
- C:\Windows\System\nIQPFww.exe
  C:\Windows\System\nIQPFww.exe
  2⤵
  PID:3100
- C:\Windows\System\AqpgCVc.exe
  C:\Windows\System\AqpgCVc.exe
  2⤵
  PID:3140
- C:\Windows\System\uZmgvQa.exe
  C:\Windows\System\uZmgvQa.exe
  2⤵
  PID:3208
- C:\Windows\System\MdeWGQu.exe
  C:\Windows\System\MdeWGQu.exe
  2⤵
  PID:3320
- C:\Windows\System\PnrpjzO.exe
  C:\Windows\System\PnrpjzO.exe
  2⤵
  PID:3380
- C:\Windows\System\ZRhFHqk.exe
  C:\Windows\System\ZRhFHqk.exe
  2⤵
  PID:3452
- C:\Windows\System\yAzmYLE.exe
  C:\Windows\System\yAzmYLE.exe
  2⤵
  PID:3512
- C:\Windows\System\QqLCzIr.exe
  C:\Windows\System\QqLCzIr.exe
  2⤵
  PID:3552
- C:\Windows\System\ynkyohL.exe
  C:\Windows\System\ynkyohL.exe
  2⤵
  PID:3620
- C:\Windows\System\HKFyXIS.exe
  C:\Windows\System\HKFyXIS.exe
  2⤵
  PID:3280
- C:\Windows\System\gJPOcQl.exe
  C:\Windows\System\gJPOcQl.exe
  2⤵
  PID:3464
- C:\Windows\System\bVueyos.exe
  C:\Windows\System\bVueyos.exe
  2⤵
  PID:1464
- C:\Windows\System\GUiTKXZ.exe
  C:\Windows\System\GUiTKXZ.exe
  2⤵
  PID:536
- C:\Windows\System\adPeimH.exe
  C:\Windows\System\adPeimH.exe
  2⤵
  PID:3360
- C:\Windows\System\hzxSsTh.exe
  C:\Windows\System\hzxSsTh.exe
  2⤵
  PID:3400
- C:\Windows\System\eWrAhwU.exe
  C:\Windows\System\eWrAhwU.exe
  2⤵
  PID:3500
- C:\Windows\System\fvxSvoN.exe
  C:\Windows\System\fvxSvoN.exe
  2⤵
  PID:3568
- C:\Windows\System\kulmZGy.exe
  C:\Windows\System\kulmZGy.exe
  2⤵
  PID:3632
- C:\Windows\System\QRZEjXL.exe
  C:\Windows\System\QRZEjXL.exe
  2⤵
  PID:3676
- C:\Windows\System\suMKFYp.exe
  C:\Windows\System\suMKFYp.exe
  2⤵
  PID:3660
- C:\Windows\System\FQdCBcW.exe
  C:\Windows\System\FQdCBcW.exe
  2⤵
  PID:2556
- C:\Windows\System\XGMDqwe.exe
  C:\Windows\System\XGMDqwe.exe
  2⤵
  PID:3704
- C:\Windows\System\hzpnWlp.exe
  C:\Windows\System\hzpnWlp.exe
  2⤵
  PID:2488
- C:\Windows\System\IhOBtsp.exe
  C:\Windows\System\IhOBtsp.exe
  2⤵
  PID:2504
- C:\Windows\System\WdQUfOe.exe
  C:\Windows\System\WdQUfOe.exe
  2⤵
  PID:3764
- C:\Windows\System\vwBbwjJ.exe
  C:\Windows\System\vwBbwjJ.exe
  2⤵
  PID:2788
- C:\Windows\System\ZmnszBX.exe
  C:\Windows\System\ZmnszBX.exe
  2⤵
  PID:3800
- C:\Windows\System\QTuBZVj.exe
  C:\Windows\System\QTuBZVj.exe
  2⤵
  PID:1020
- C:\Windows\System\lIhFywD.exe
  C:\Windows\System\lIhFywD.exe
  2⤵
  PID:3848
- C:\Windows\System\omDBBtc.exe
  C:\Windows\System\omDBBtc.exe
  2⤵
  PID:3868
- C:\Windows\System\NOGzIMF.exe
  C:\Windows\System\NOGzIMF.exe
  2⤵
  PID:2100
- C:\Windows\System\yNUvjkA.exe
  C:\Windows\System\yNUvjkA.exe
  2⤵
  PID:3884
- C:\Windows\System\JodqmhR.exe
  C:\Windows\System\JodqmhR.exe
  2⤵
  PID:1196
- C:\Windows\System\BrAAelk.exe
  C:\Windows\System\BrAAelk.exe
  2⤵
  PID:3944
- C:\Windows\System\jBDvxuV.exe
  C:\Windows\System\jBDvxuV.exe
  2⤵
  PID:2208
- C:\Windows\System\bIlKqge.exe
  C:\Windows\System\bIlKqge.exe
  2⤵
  PID:3976
- C:\Windows\System\yNOiolA.exe
  C:\Windows\System\yNOiolA.exe
  2⤵
  PID:3996
- C:\Windows\System\oNMyWny.exe
  C:\Windows\System\oNMyWny.exe
  2⤵
  PID:4024
- C:\Windows\System\BaeqQKy.exe
  C:\Windows\System\BaeqQKy.exe
  2⤵
  PID:4056
- C:\Windows\System\OkunbvC.exe
  C:\Windows\System\OkunbvC.exe
  2⤵
  PID:4088
- C:\Windows\System\xNgELET.exe
  C:\Windows\System\xNgELET.exe
  2⤵
  PID:1104
- C:\Windows\System\uVBNzuX.exe
  C:\Windows\System\uVBNzuX.exe
  2⤵
  PID:2140
- C:\Windows\System\RKRtmFZ.exe
  C:\Windows\System\RKRtmFZ.exe
  2⤵
  PID:2832
- C:\Windows\System\qMhVLtl.exe
  C:\Windows\System\qMhVLtl.exe
  2⤵
  PID:2596
- C:\Windows\System\KICQUFB.exe
  C:\Windows\System\KICQUFB.exe
  2⤵
  PID:3184
- C:\Windows\System\lYuWqyj.exe
  C:\Windows\System\lYuWqyj.exe
  2⤵
  PID:2492
- C:\Windows\System\ABHrmLT.exe
  C:\Windows\System\ABHrmLT.exe
  2⤵
  PID:2644
- C:\Windows\System\IPWqLwn.exe
  C:\Windows\System\IPWqLwn.exe
  2⤵
  PID:3136
- C:\Windows\System\HLOYFCR.exe
  C:\Windows\System\HLOYFCR.exe
  2⤵
  PID:3316
- C:\Windows\System\KoYLQRm.exe
  C:\Windows\System\KoYLQRm.exe
  2⤵
  PID:3444
- C:\Windows\System\VedZwMN.exe
  C:\Windows\System\VedZwMN.exe
  2⤵
  PID:3548
- C:\Windows\System\pxvlnlw.exe
  C:\Windows\System\pxvlnlw.exe
  2⤵
  PID:3616
- C:\Windows\System\IVKWpGk.exe
  C:\Windows\System\IVKWpGk.exe
  2⤵
  PID:3296
- C:\Windows\System\whAMINt.exe
  C:\Windows\System\whAMINt.exe
  2⤵
  PID:1048
- C:\Windows\System\BGrADsK.exe
  C:\Windows\System\BGrADsK.exe
  2⤵
  PID:3496
- C:\Windows\System\kuekRat.exe
  C:\Windows\System\kuekRat.exe
  2⤵
  PID:3604
- C:\Windows\System\cSjivBn.exe
  C:\Windows\System\cSjivBn.exe
  2⤵
  PID:3656
- C:\Windows\System\UnMqEtq.exe
  C:\Windows\System\UnMqEtq.exe
  2⤵
  PID:2096
- C:\Windows\System\zawbovO.exe
  C:\Windows\System\zawbovO.exe
  2⤵
  PID:3748
- C:\Windows\System\VbwUHtY.exe
  C:\Windows\System\VbwUHtY.exe
  2⤵
  PID:1904
- C:\Windows\System\sSSOtuY.exe
  C:\Windows\System\sSSOtuY.exe
  2⤵
  PID:3828
- C:\Windows\System\uzTlCGw.exe
  C:\Windows\System\uzTlCGw.exe
  2⤵
  PID:3864
- C:\Windows\System\wZcbgzE.exe
  C:\Windows\System\wZcbgzE.exe
  2⤵
  PID:3896
- C:\Windows\System\PYhLyjF.exe
  C:\Windows\System\PYhLyjF.exe
  2⤵
  PID:3932
- C:\Windows\System\FZWktRl.exe
  C:\Windows\System\FZWktRl.exe
  2⤵
  PID:3964
- C:\Windows\System\xrbERQR.exe
  C:\Windows\System\xrbERQR.exe
  2⤵
  PID:1908
- C:\Windows\System\weWxRsm.exe
  C:\Windows\System\weWxRsm.exe
  2⤵
  PID:4076
- C:\Windows\System\xlzqIVo.exe
  C:\Windows\System\xlzqIVo.exe
  2⤵
  PID:2796
- C:\Windows\System\GarSklS.exe
  C:\Windows\System\GarSklS.exe
  2⤵
  PID:3076
- C:\Windows\System\OYqpRgL.exe
  C:\Windows\System\OYqpRgL.exe
  2⤵
  PID:3232
- C:\Windows\System\upCRIrU.exe
  C:\Windows\System\upCRIrU.exe
  2⤵
  PID:3092
- C:\Windows\System\MOuneQm.exe
  C:\Windows\System\MOuneQm.exe
  2⤵
  PID:3376
- C:\Windows\System\PVsMxsZ.exe
  C:\Windows\System\PVsMxsZ.exe
  2⤵
  PID:3252
- C:\Windows\System\UCFKACF.exe
  C:\Windows\System\UCFKACF.exe
  2⤵
  PID:3292
- C:\Windows\System\GPACBOL.exe
  C:\Windows\System\GPACBOL.exe
  2⤵
  PID:3600
- C:\Windows\System\jdMSBqT.exe
  C:\Windows\System\jdMSBqT.exe
  2⤵
  PID:3696
- C:\Windows\System\sHWRFGN.exe
  C:\Windows\System\sHWRFGN.exe
  2⤵
  PID:3736
- C:\Windows\System\ruGQdTo.exe
  C:\Windows\System\ruGQdTo.exe
  2⤵
  PID:3812
- C:\Windows\System\aYUiwkh.exe
  C:\Windows\System\aYUiwkh.exe
  2⤵
  PID:2328
- C:\Windows\System\rjUMvBh.exe
  C:\Windows\System\rjUMvBh.exe
  2⤵
  PID:4012
- C:\Windows\System\UjYavKH.exe
  C:\Windows\System\UjYavKH.exe
  2⤵
  PID:4044
- C:\Windows\System\MIVCIdJ.exe
  C:\Windows\System\MIVCIdJ.exe
  2⤵
  PID:1628
- C:\Windows\System\xDtrgfU.exe
  C:\Windows\System\xDtrgfU.exe
  2⤵
  PID:2332
- C:\Windows\System\wdmhfnv.exe
  C:\Windows\System\wdmhfnv.exe
  2⤵
  PID:3356
- C:\Windows\System\aPdjdVu.exe
  C:\Windows\System\aPdjdVu.exe
  2⤵
  PID:3228
- C:\Windows\System\YjZWcUO.exe
  C:\Windows\System\YjZWcUO.exe
  2⤵
  PID:4112
- C:\Windows\System\nCzlFVZ.exe
  C:\Windows\System\nCzlFVZ.exe
  2⤵
  PID:4128
- C:\Windows\System\lhtJSZD.exe
  C:\Windows\System\lhtJSZD.exe
  2⤵
  PID:4144
- C:\Windows\System\XvhmgLr.exe
  C:\Windows\System\XvhmgLr.exe
  2⤵
  PID:4160
- C:\Windows\System\VlahDZe.exe
  C:\Windows\System\VlahDZe.exe
  2⤵
  PID:4176
- C:\Windows\System\moQFDuw.exe
  C:\Windows\System\moQFDuw.exe
  2⤵
  PID:4192
- C:\Windows\System\jooTLQq.exe
  C:\Windows\System\jooTLQq.exe
  2⤵
  PID:4208
- C:\Windows\System\bjdYoyc.exe
  C:\Windows\System\bjdYoyc.exe
  2⤵
  PID:4224
- C:\Windows\System\dSkuFNT.exe
  C:\Windows\System\dSkuFNT.exe
  2⤵
  PID:4240
- C:\Windows\System\nIPnVok.exe
  C:\Windows\System\nIPnVok.exe
  2⤵
  PID:4256
- C:\Windows\System\vZXZiGf.exe
  C:\Windows\System\vZXZiGf.exe
  2⤵
  PID:4272
- C:\Windows\System\AUjfjNa.exe
  C:\Windows\System\AUjfjNa.exe
  2⤵
  PID:4288
- C:\Windows\System\ToGMMhH.exe
  C:\Windows\System\ToGMMhH.exe
  2⤵
  PID:4304
- C:\Windows\System\heeuNjJ.exe
  C:\Windows\System\heeuNjJ.exe
  2⤵
  PID:4320
- C:\Windows\System\ALhRedz.exe
  C:\Windows\System\ALhRedz.exe
  2⤵
  PID:4336
- C:\Windows\System\AnIZJXu.exe
  C:\Windows\System\AnIZJXu.exe
  2⤵
  PID:4352
- C:\Windows\System\qnIlGNB.exe
  C:\Windows\System\qnIlGNB.exe
  2⤵
  PID:4368
- C:\Windows\System\TAuTIoE.exe
  C:\Windows\System\TAuTIoE.exe
  2⤵
  PID:4384
- C:\Windows\System\LBaYQfi.exe
  C:\Windows\System\LBaYQfi.exe
  2⤵
  PID:4400
- C:\Windows\System\wkUTLoz.exe
  C:\Windows\System\wkUTLoz.exe
  2⤵
  PID:4416
- C:\Windows\System\iTawlzx.exe
  C:\Windows\System\iTawlzx.exe
  2⤵
  PID:4432
- C:\Windows\System\XJBJfSx.exe
  C:\Windows\System\XJBJfSx.exe
  2⤵
  PID:4448
- C:\Windows\System\MgMuWRW.exe
  C:\Windows\System\MgMuWRW.exe
  2⤵
  PID:4464
- C:\Windows\System\xOxuUJN.exe
  C:\Windows\System\xOxuUJN.exe
  2⤵
  PID:4480
- C:\Windows\System\xGaypZK.exe
  C:\Windows\System\xGaypZK.exe
  2⤵
  PID:4496
- C:\Windows\System\GBlKgIj.exe
  C:\Windows\System\GBlKgIj.exe
  2⤵
  PID:4512
- C:\Windows\System\gWFQBEW.exe
  C:\Windows\System\gWFQBEW.exe
  2⤵
  PID:4532
- C:\Windows\System\tmQXCwD.exe
  C:\Windows\System\tmQXCwD.exe
  2⤵
  PID:4548
- C:\Windows\System\PaHQWha.exe
  C:\Windows\System\PaHQWha.exe
  2⤵
  PID:4564
- C:\Windows\System\fduFIwf.exe
  C:\Windows\System\fduFIwf.exe
  2⤵
  PID:4580
- C:\Windows\System\SnIDSIu.exe
  C:\Windows\System\SnIDSIu.exe
  2⤵
  PID:4596
- C:\Windows\System\BbwWtSm.exe
  C:\Windows\System\BbwWtSm.exe
  2⤵
  PID:4612
- C:\Windows\System\FlcjDkI.exe
  C:\Windows\System\FlcjDkI.exe
  2⤵
  PID:4628
- C:\Windows\System\GySSFRH.exe
  C:\Windows\System\GySSFRH.exe
  2⤵
  PID:4644
- C:\Windows\System\WKJBgko.exe
  C:\Windows\System\WKJBgko.exe
  2⤵
  PID:4660
- C:\Windows\System\jhhOrEd.exe
  C:\Windows\System\jhhOrEd.exe
  2⤵
  PID:4676
- C:\Windows\System\VCYHPza.exe
  C:\Windows\System\VCYHPza.exe
  2⤵
  PID:4692
- C:\Windows\System\viraIOy.exe
  C:\Windows\System\viraIOy.exe
  2⤵
  PID:4708
- C:\Windows\System\VBvvspA.exe
  C:\Windows\System\VBvvspA.exe
  2⤵
  PID:4724
- C:\Windows\System\reiRNti.exe
  C:\Windows\System\reiRNti.exe
  2⤵
  PID:4740
- C:\Windows\System\ONgoVDd.exe
  C:\Windows\System\ONgoVDd.exe
  2⤵
  PID:4756
- C:\Windows\System\eKMjPij.exe
  C:\Windows\System\eKMjPij.exe
  2⤵
  PID:4772
- C:\Windows\System\TKOwlJO.exe
  C:\Windows\System\TKOwlJO.exe
  2⤵
  PID:4788
- C:\Windows\System\UJuMoyu.exe
  C:\Windows\System\UJuMoyu.exe
  2⤵
  PID:4804
- C:\Windows\System\ggpIxQA.exe
  C:\Windows\System\ggpIxQA.exe
  2⤵
  PID:4820
- C:\Windows\System\LXVoHuH.exe
  C:\Windows\System\LXVoHuH.exe
  2⤵
  PID:4836
- C:\Windows\System\DoClsfA.exe
  C:\Windows\System\DoClsfA.exe
  2⤵
  PID:4852
- C:\Windows\System\cyXXZqH.exe
  C:\Windows\System\cyXXZqH.exe
  2⤵
  PID:4868
- C:\Windows\System\sUFsRXa.exe
  C:\Windows\System\sUFsRXa.exe
  2⤵
  PID:4884
- C:\Windows\System\jhbsvGo.exe
  C:\Windows\System\jhbsvGo.exe
  2⤵
  PID:4900
- C:\Windows\System\GrBVlRa.exe
  C:\Windows\System\GrBVlRa.exe
  2⤵
  PID:4916
- C:\Windows\System\giRVYKG.exe
  C:\Windows\System\giRVYKG.exe
  2⤵
  PID:4932
- C:\Windows\System\olVLHbC.exe
  C:\Windows\System\olVLHbC.exe
  2⤵
  PID:4948
- C:\Windows\System\XFdwCCF.exe
  C:\Windows\System\XFdwCCF.exe
  2⤵
  PID:4964
- C:\Windows\System\MjBUKFe.exe
  C:\Windows\System\MjBUKFe.exe
  2⤵
  PID:4980
- C:\Windows\System\NZxbnqW.exe
  C:\Windows\System\NZxbnqW.exe
  2⤵
  PID:4996
- C:\Windows\System\dlOKbJl.exe
  C:\Windows\System\dlOKbJl.exe
  2⤵
  PID:5012
- C:\Windows\System\APdAGck.exe
  C:\Windows\System\APdAGck.exe
  2⤵
  PID:5028
- C:\Windows\System\SplIGhX.exe
  C:\Windows\System\SplIGhX.exe
  2⤵
  PID:5048
- C:\Windows\System\eFNxxQF.exe
  C:\Windows\System\eFNxxQF.exe
  2⤵
  PID:5084
- C:\Windows\System\LyIwUhd.exe
  C:\Windows\System\LyIwUhd.exe
  2⤵
  PID:5100
- C:\Windows\System\AiOPvoG.exe
  C:\Windows\System\AiOPvoG.exe
  2⤵
  PID:5116
- C:\Windows\System\hWxHDBV.exe
  C:\Windows\System\hWxHDBV.exe
  2⤵
  PID:3780
- C:\Windows\System\fDIdmcE.exe
  C:\Windows\System\fDIdmcE.exe
  2⤵
  PID:3960
- C:\Windows\System\CPULcPl.exe
  C:\Windows\System\CPULcPl.exe
  2⤵
  PID:2860
- C:\Windows\System\GaMJeZR.exe
  C:\Windows\System\GaMJeZR.exe
  2⤵
  PID:3416
- C:\Windows\System\tRjHboH.exe
  C:\Windows\System\tRjHboH.exe
  2⤵
  PID:4104
- C:\Windows\System\ADzjQgC.exe
  C:\Windows\System\ADzjQgC.exe
  2⤵
  PID:4140
- C:\Windows\System\mTAYSWx.exe
  C:\Windows\System\mTAYSWx.exe
  2⤵
  PID:4172
- C:\Windows\System\eqVCjsU.exe
  C:\Windows\System\eqVCjsU.exe
  2⤵
  PID:4204
- C:\Windows\System\VPMrjOh.exe
  C:\Windows\System\VPMrjOh.exe
  2⤵
  PID:4236
- C:\Windows\System\jPlEXKe.exe
  C:\Windows\System\jPlEXKe.exe
  2⤵
  PID:4252
- C:\Windows\System\DkWTvkO.exe
  C:\Windows\System\DkWTvkO.exe
  2⤵
  PID:4296
- C:\Windows\System\CLinhLb.exe
  C:\Windows\System\CLinhLb.exe
  2⤵
  PID:4328
- C:\Windows\System\TEyktnz.exe
  C:\Windows\System\TEyktnz.exe
  2⤵
  PID:4364
- C:\Windows\System\zfquDGu.exe
  C:\Windows\System\zfquDGu.exe
  2⤵
  PID:4396
- C:\Windows\System\UdMRVXL.exe
  C:\Windows\System\UdMRVXL.exe
  2⤵
  PID:4456
- C:\Windows\System\SXlZqCX.exe
  C:\Windows\System\SXlZqCX.exe
  2⤵
  PID:1540
- C:\Windows\System\mUTsQLI.exe
  C:\Windows\System\mUTsQLI.exe
  2⤵
  PID:2424
- C:\Windows\System\lMZdjCi.exe
  C:\Windows\System\lMZdjCi.exe
  2⤵
  PID:4524
- C:\Windows\System\FnacvUn.exe
  C:\Windows\System\FnacvUn.exe
  2⤵
  PID:4940
- C:\Windows\System\CUkHSKJ.exe
  C:\Windows\System\CUkHSKJ.exe
  2⤵
  PID:5036
- C:\Windows\System\XhRfpGf.exe
  C:\Windows\System\XhRfpGf.exe
  2⤵
  PID:3732
- C:\Windows\System\DSeaVBj.exe
  C:\Windows\System\DSeaVBj.exe
  2⤵
  PID:4072
- C:\Windows\System\qUAkYqk.exe
  C:\Windows\System\qUAkYqk.exe
  2⤵
  PID:4168
- C:\Windows\System\jRnZBJv.exe
  C:\Windows\System\jRnZBJv.exe
  2⤵
  PID:4280
- C:\Windows\System\TLBGfdT.exe
  C:\Windows\System\TLBGfdT.exe
  2⤵
  PID:1460
- C:\Windows\System\DAUJNyL.exe
  C:\Windows\System\DAUJNyL.exe
  2⤵
  PID:4376
- C:\Windows\System\EmnsedN.exe
  C:\Windows\System\EmnsedN.exe
  2⤵
  PID:1480
- C:\Windows\System\QLkcfJa.exe
  C:\Windows\System\QLkcfJa.exe
  2⤵
  PID:1552
- C:\Windows\System\ieYAYfD.exe
  C:\Windows\System\ieYAYfD.exe
  2⤵
  PID:1800
- C:\Windows\System\kPbahto.exe
  C:\Windows\System\kPbahto.exe
  2⤵
  PID:5072
- C:\Windows\System\ssejgiD.exe
  C:\Windows\System\ssejgiD.exe
  2⤵
  PID:4476
- C:\Windows\System\oDmZdeq.exe
  C:\Windows\System\oDmZdeq.exe
  2⤵
  PID:4300
- C:\Windows\System\reaUTHb.exe
  C:\Windows\System\reaUTHb.exe
  2⤵
  PID:4520
- C:\Windows\System\oZxyaEj.exe
  C:\Windows\System\oZxyaEj.exe
  2⤵
  PID:4392
- C:\Windows\System\eIOcRsQ.exe
  C:\Windows\System\eIOcRsQ.exe
  2⤵
  PID:3204
- C:\Windows\System\nwnYCvB.exe
  C:\Windows\System\nwnYCvB.exe
  2⤵
  PID:2756
- C:\Windows\System\sWDHExw.exe
  C:\Windows\System\sWDHExw.exe
  2⤵
  PID:5068
- C:\Windows\System\rWocWrK.exe
  C:\Windows\System\rWocWrK.exe
  2⤵
  PID:5020
- C:\Windows\System\RqXJPXc.exe
  C:\Windows\System\RqXJPXc.exe
  2⤵
  PID:4956
- C:\Windows\System\iSmqxYN.exe
  C:\Windows\System\iSmqxYN.exe
  2⤵
  PID:4608
- C:\Windows\System\KWXooyJ.exe
  C:\Windows\System\KWXooyJ.exe
  2⤵
  PID:4544
- C:\Windows\System\BNSZWup.exe
  C:\Windows\System\BNSZWup.exe
  2⤵
  PID:4860
- C:\Windows\System\SUrbTRi.exe
  C:\Windows\System\SUrbTRi.exe
  2⤵
  PID:4864
- C:\Windows\System\aNCyczZ.exe
  C:\Windows\System\aNCyczZ.exe
  2⤵
  PID:4800
- C:\Windows\System\LkmiCkq.exe
  C:\Windows\System\LkmiCkq.exe
  2⤵
  PID:4732
- C:\Windows\System\siQrdqK.exe
  C:\Windows\System\siQrdqK.exe
  2⤵
  PID:4652
- C:\Windows\System\iFPCFfF.exe
  C:\Windows\System\iFPCFfF.exe
  2⤵
  PID:4720
- C:\Windows\System\mZsYuid.exe
  C:\Windows\System\mZsYuid.exe
  2⤵
  PID:4912
- C:\Windows\System\hkqfgkV.exe
  C:\Windows\System\hkqfgkV.exe
  2⤵
  PID:4848
- C:\Windows\System\AqWyjol.exe
  C:\Windows\System\AqWyjol.exe
  2⤵
  PID:4972
- C:\Windows\System\TbSmEJk.exe
  C:\Windows\System\TbSmEJk.exe
  2⤵
  PID:1888
- C:\Windows\System\wGpVNeP.exe
  C:\Windows\System\wGpVNeP.exe
  2⤵
  PID:4360
- C:\Windows\System\fUoNpFM.exe
  C:\Windows\System\fUoNpFM.exe
  2⤵
  PID:4556
- C:\Windows\System\ecUBmNc.exe
  C:\Windows\System\ecUBmNc.exe
  2⤵
  PID:2284
- C:\Windows\System\PEYpahw.exe
  C:\Windows\System\PEYpahw.exe
  2⤵
  PID:5056
- C:\Windows\System\PTGLAEK.exe
  C:\Windows\System\PTGLAEK.exe
  2⤵
  PID:1688
- C:\Windows\System\NCjufDQ.exe
  C:\Windows\System\NCjufDQ.exe
  2⤵
  PID:5092
- C:\Windows\System\cwMLehQ.exe
  C:\Windows\System\cwMLehQ.exe
  2⤵
  PID:2412
- C:\Windows\System\fexaACi.exe
  C:\Windows\System\fexaACi.exe
  2⤵
  PID:944
- C:\Windows\System\OBDSLeE.exe
  C:\Windows\System\OBDSLeE.exe
  2⤵
  PID:4508
- C:\Windows\System\EylbRLT.exe
  C:\Windows\System\EylbRLT.exe
  2⤵
  PID:3396
- C:\Windows\System\VBHGSZS.exe
  C:\Windows\System\VBHGSZS.exe
  2⤵
  PID:4908
- C:\Windows\System\hpLbQvf.exe
  C:\Windows\System\hpLbQvf.exe
  2⤵
  PID:4268
- C:\Windows\System\akRAGXa.exe
  C:\Windows\System\akRAGXa.exe
  2⤵
  PID:4248
- C:\Windows\System\ThmTuMa.exe
  C:\Windows\System\ThmTuMa.exe
  2⤵
  PID:4120
- C:\Windows\System\uvfkzhT.exe
  C:\Windows\System\uvfkzhT.exe
  2⤵
  PID:4960
- C:\Windows\System\sMJYqKI.exe
  C:\Windows\System\sMJYqKI.exe
  2⤵
  PID:4716
- C:\Windows\System\xRxMbNs.exe
  C:\Windows\System\xRxMbNs.exe
  2⤵
  PID:4444
- C:\Windows\System\jdUNZtc.exe
  C:\Windows\System\jdUNZtc.exe
  2⤵
  PID:4832
- C:\Windows\System\HJTjXxa.exe
  C:\Windows\System\HJTjXxa.exe
  2⤵
  PID:1200
- C:\Windows\System\CsRdKxe.exe
  C:\Windows\System\CsRdKxe.exe
  2⤵
  PID:4200
- C:\Windows\System\okFKtBl.exe
  C:\Windows\System\okFKtBl.exe
  2⤵
  PID:1452
- C:\Windows\System\VdFvOED.exe
  C:\Windows\System\VdFvOED.exe
  2⤵
  PID:4828
- C:\Windows\System\qOFBHcK.exe
  C:\Windows\System\qOFBHcK.exe
  2⤵
  PID:5004
- C:\Windows\System\RxuvREZ.exe
  C:\Windows\System\RxuvREZ.exe
  2⤵
  PID:4988
- C:\Windows\System\tJnhYgF.exe
  C:\Windows\System\tJnhYgF.exe
  2⤵
  PID:4736
- C:\Windows\System\mssQmFq.exe
  C:\Windows\System\mssQmFq.exe
  2⤵
  PID:4472
- C:\Windows\System\fzapiDW.exe
  C:\Windows\System\fzapiDW.exe
  2⤵
  PID:5128
- C:\Windows\System\LqmPYbg.exe
  C:\Windows\System\LqmPYbg.exe
  2⤵
  PID:5144
- C:\Windows\System\mQIFLHi.exe
  C:\Windows\System\mQIFLHi.exe
  2⤵
  PID:5164
- C:\Windows\System\tnCmMoc.exe
  C:\Windows\System\tnCmMoc.exe
  2⤵
  PID:5180
- C:\Windows\System\teCjtso.exe
  C:\Windows\System\teCjtso.exe
  2⤵
  PID:5196
- C:\Windows\System\UFNCAuN.exe
  C:\Windows\System\UFNCAuN.exe
  2⤵
  PID:5212
- C:\Windows\System\tXzSvMi.exe
  C:\Windows\System\tXzSvMi.exe
  2⤵
  PID:5228
- C:\Windows\System\duvjIPV.exe
  C:\Windows\System\duvjIPV.exe
  2⤵
  PID:5244
- C:\Windows\System\IaWEebO.exe
  C:\Windows\System\IaWEebO.exe
  2⤵
  PID:5260
- C:\Windows\System\ceNooYt.exe
  C:\Windows\System\ceNooYt.exe
  2⤵
  PID:5276
- C:\Windows\System\ahKmUCK.exe
  C:\Windows\System\ahKmUCK.exe
  2⤵
  PID:5292
- C:\Windows\System\mIIRmGP.exe
  C:\Windows\System\mIIRmGP.exe
  2⤵
  PID:5308
- C:\Windows\System\QDXBPOC.exe
  C:\Windows\System\QDXBPOC.exe
  2⤵
  PID:5324
- C:\Windows\System\pELyidr.exe
  C:\Windows\System\pELyidr.exe
  2⤵
  PID:5340
- C:\Windows\System\DgJOmmB.exe
  C:\Windows\System\DgJOmmB.exe
  2⤵
  PID:5356
- C:\Windows\System\ziexYsW.exe
  C:\Windows\System\ziexYsW.exe
  2⤵
  PID:5376
- C:\Windows\System\LKELLjN.exe
  C:\Windows\System\LKELLjN.exe
  2⤵
  PID:5392
- C:\Windows\System\jPVWimC.exe
  C:\Windows\System\jPVWimC.exe
  2⤵
  PID:5408
- C:\Windows\System\LRlvinX.exe
  C:\Windows\System\LRlvinX.exe
  2⤵
  PID:5424
- C:\Windows\System\BEVFTFR.exe
  C:\Windows\System\BEVFTFR.exe
  2⤵
  PID:5440
- C:\Windows\System\veaITph.exe
  C:\Windows\System\veaITph.exe
  2⤵
  PID:5456
- C:\Windows\System\BQeAhvH.exe
  C:\Windows\System\BQeAhvH.exe
  2⤵
  PID:5476
- C:\Windows\System\sgWhxJR.exe
  C:\Windows\System\sgWhxJR.exe
  2⤵
  PID:5492
- C:\Windows\System\AakCUbL.exe
  C:\Windows\System\AakCUbL.exe
  2⤵
  PID:5508
- C:\Windows\System\HVRecms.exe
  C:\Windows\System\HVRecms.exe
  2⤵
  PID:5524
- C:\Windows\System\wVqMYRH.exe
  C:\Windows\System\wVqMYRH.exe
  2⤵
  PID:5540
- C:\Windows\System\nasMrTM.exe
  C:\Windows\System\nasMrTM.exe
  2⤵
  PID:5560
- C:\Windows\System\gINpCWt.exe
  C:\Windows\System\gINpCWt.exe
  2⤵
  PID:5576
- C:\Windows\System\lxqnYCK.exe
  C:\Windows\System\lxqnYCK.exe
  2⤵
  PID:5592
- C:\Windows\System\uechMKm.exe
  C:\Windows\System\uechMKm.exe
  2⤵
  PID:5608
- C:\Windows\System\lyCUMnr.exe
  C:\Windows\System\lyCUMnr.exe
  2⤵
  PID:5624
- C:\Windows\System\xVqlylL.exe
  C:\Windows\System\xVqlylL.exe
  2⤵
  PID:5640
- C:\Windows\System\AKQlBPG.exe
  C:\Windows\System\AKQlBPG.exe
  2⤵
  PID:5660
- C:\Windows\System\LTFVugv.exe
  C:\Windows\System\LTFVugv.exe
  2⤵
  PID:5676
- C:\Windows\System\bSyppIG.exe
  C:\Windows\System\bSyppIG.exe
  2⤵
  PID:5692
- C:\Windows\System\UCEQNSx.exe
  C:\Windows\System\UCEQNSx.exe
  2⤵
  PID:5708
- C:\Windows\System\XmlKWBq.exe
  C:\Windows\System\XmlKWBq.exe
  2⤵
  PID:5728
- C:\Windows\System\DhMLenG.exe
  C:\Windows\System\DhMLenG.exe
  2⤵
  PID:5744
- C:\Windows\System\luFaNeC.exe
  C:\Windows\System\luFaNeC.exe
  2⤵
  PID:5760
- C:\Windows\System\OZuhBHn.exe
  C:\Windows\System\OZuhBHn.exe
  2⤵
  PID:5776
- C:\Windows\System\gZERnhR.exe
  C:\Windows\System\gZERnhR.exe
  2⤵
  PID:5792
- C:\Windows\System\wgjpxGP.exe
  C:\Windows\System\wgjpxGP.exe
  2⤵
  PID:5808
- C:\Windows\System\ZBGXrQk.exe
  C:\Windows\System\ZBGXrQk.exe
  2⤵
  PID:5824
- C:\Windows\System\PMKHeda.exe
  C:\Windows\System\PMKHeda.exe
  2⤵
  PID:5840
- C:\Windows\System\CCusqhl.exe
  C:\Windows\System\CCusqhl.exe
  2⤵
  PID:5856
- C:\Windows\System\yplJDAO.exe
  C:\Windows\System\yplJDAO.exe
  2⤵
  PID:5872
- C:\Windows\System\FsrbPLH.exe
  C:\Windows\System\FsrbPLH.exe
  2⤵
  PID:5888
- C:\Windows\System\ZARmRfw.exe
  C:\Windows\System\ZARmRfw.exe
  2⤵
  PID:5904
- C:\Windows\System\lbLbdLy.exe
  C:\Windows\System\lbLbdLy.exe
  2⤵
  PID:5920
- C:\Windows\System\JvVHNoL.exe
  C:\Windows\System\JvVHNoL.exe
  2⤵
  PID:5936
- C:\Windows\System\DmFaVdE.exe
  C:\Windows\System\DmFaVdE.exe
  2⤵
  PID:5952
- C:\Windows\System\pygfIDb.exe
  C:\Windows\System\pygfIDb.exe
  2⤵
  PID:5972
- C:\Windows\System\vzeBcMg.exe
  C:\Windows\System\vzeBcMg.exe
  2⤵
  PID:5988
- C:\Windows\System\GMEQgCr.exe
  C:\Windows\System\GMEQgCr.exe
  2⤵
  PID:6004
- C:\Windows\System\BGJfOMW.exe
  C:\Windows\System\BGJfOMW.exe
  2⤵
  PID:6020
- C:\Windows\System\wZetAhv.exe
  C:\Windows\System\wZetAhv.exe
  2⤵
  PID:6036
- C:\Windows\System\xKtCwGh.exe
  C:\Windows\System\xKtCwGh.exe
  2⤵
  PID:6052
- C:\Windows\System\PamqbWE.exe
  C:\Windows\System\PamqbWE.exe
  2⤵
  PID:6068
- C:\Windows\System\EOimjvP.exe
  C:\Windows\System\EOimjvP.exe
  2⤵
  PID:6084
- C:\Windows\System\pEoVUzh.exe
  C:\Windows\System\pEoVUzh.exe
  2⤵
  PID:6100
- C:\Windows\System\gOZnrgs.exe
  C:\Windows\System\gOZnrgs.exe
  2⤵
  PID:6120
- C:\Windows\System\MMDvVIn.exe
  C:\Windows\System\MMDvVIn.exe
  2⤵
  PID:6136
- C:\Windows\System\Ohxndgb.exe
  C:\Windows\System\Ohxndgb.exe
  2⤵
  PID:4572
- C:\Windows\System\bwWuPxi.exe
  C:\Windows\System\bwWuPxi.exe
  2⤵
  PID:5156
- C:\Windows\System\fOAbTky.exe
  C:\Windows\System\fOAbTky.exe
  2⤵
  PID:4752
- C:\Windows\System\RDwDjlP.exe
  C:\Windows\System\RDwDjlP.exe
  2⤵
  PID:5224
- C:\Windows\System\kmKDpCL.exe
  C:\Windows\System\kmKDpCL.exe
  2⤵
  PID:5284
- C:\Windows\System\YlDGjOs.exe
  C:\Windows\System\YlDGjOs.exe
  2⤵
  PID:5352
- C:\Windows\System\PQTNQgz.exe
  C:\Windows\System\PQTNQgz.exe
  2⤵
  PID:5136
- C:\Windows\System\MJGzfNv.exe
  C:\Windows\System\MJGzfNv.exe
  2⤵
  PID:5420
- C:\Windows\System\ZzMlTKy.exe
  C:\Windows\System\ZzMlTKy.exe
  2⤵
  PID:5452
- C:\Windows\System\ugFTuSq.exe
  C:\Windows\System\ugFTuSq.exe
  2⤵
  PID:1320
- C:\Windows\System\pLjFiIJ.exe
  C:\Windows\System\pLjFiIJ.exe
  2⤵
  PID:5520
- C:\Windows\System\QPxyHnL.exe
  C:\Windows\System\QPxyHnL.exe
  2⤵
  PID:5336
- C:\Windows\System\jVcVfJn.exe
  C:\Windows\System\jVcVfJn.exe
  2⤵
  PID:5648
- C:\Windows\System\LDhYhie.exe
  C:\Windows\System\LDhYhie.exe
  2⤵
  PID:5688
- C:\Windows\System\riFbtYA.exe
  C:\Windows\System\riFbtYA.exe
  2⤵
  PID:5720
- C:\Windows\System\GQEPAMJ.exe
  C:\Windows\System\GQEPAMJ.exe
  2⤵
  PID:5208
- C:\Windows\System\mCwCfjk.exe
  C:\Windows\System\mCwCfjk.exe
  2⤵
  PID:5272
- C:\Windows\System\jekyQny.exe
  C:\Windows\System\jekyQny.exe
  2⤵
  PID:5372
- C:\Windows\System\bzHocZG.exe
  C:\Windows\System\bzHocZG.exe
  2⤵
  PID:5436
- C:\Windows\System\htzXGnG.exe
  C:\Windows\System\htzXGnG.exe
  2⤵
  PID:5532
- C:\Windows\System\FnsGAmZ.exe
  C:\Windows\System\FnsGAmZ.exe
  2⤵
  PID:5600
- C:\Windows\System\bYLkuYm.exe
  C:\Windows\System\bYLkuYm.exe
  2⤵
  PID:5672
- C:\Windows\System\Tsffmns.exe
  C:\Windows\System\Tsffmns.exe
  2⤵
  PID:5740
- C:\Windows\System\IDbUXjG.exe
  C:\Windows\System\IDbUXjG.exe
  2⤵
  PID:5832
- C:\Windows\System\WSWhrPS.exe
  C:\Windows\System\WSWhrPS.exe
  2⤵
  PID:5896
- C:\Windows\System\KiRiVIu.exe
  C:\Windows\System\KiRiVIu.exe
  2⤵
  PID:5784
- C:\Windows\System\EfkCRZU.exe
  C:\Windows\System\EfkCRZU.exe
  2⤵
  PID:5848
- C:\Windows\System\xFwIVdo.exe
  C:\Windows\System\xFwIVdo.exe
  2⤵
  PID:5916
- C:\Windows\System\vimvRtC.exe
  C:\Windows\System\vimvRtC.exe
  2⤵
  PID:5984
- C:\Windows\System\OBNKnvI.exe
  C:\Windows\System\OBNKnvI.exe
  2⤵
  PID:6016
- C:\Windows\System\IBBOqPQ.exe
  C:\Windows\System\IBBOqPQ.exe
  2⤵
  PID:5932
- C:\Windows\System\PaGVjUW.exe
  C:\Windows\System\PaGVjUW.exe
  2⤵
  PID:4768
- C:\Windows\System\WlnFXDB.exe
  C:\Windows\System\WlnFXDB.exe
  2⤵
  PID:4976
- C:\Windows\System\djGJYFi.exe
  C:\Windows\System\djGJYFi.exe
  2⤵
  PID:5388
- C:\Windows\System\todaUMZ.exe
  C:\Windows\System\todaUMZ.exe
  2⤵
  PID:5488
- C:\Windows\System\eomJbYr.exe
  C:\Windows\System\eomJbYr.exe
  2⤵
  PID:5332
- C:\Windows\System\DvgDVMf.exe
  C:\Windows\System\DvgDVMf.exe
  2⤵
  PID:5516
- C:\Windows\System\QTcAqMB.exe
  C:\Windows\System\QTcAqMB.exe
  2⤵
  PID:4188
- C:\Windows\System\NOzrNwU.exe
  C:\Windows\System\NOzrNwU.exe
  2⤵
  PID:5404
- C:\Windows\System\nkfMOCw.exe
  C:\Windows\System\nkfMOCw.exe
  2⤵
  PID:5316
- C:\Windows\System\UHTmYKg.exe
  C:\Windows\System\UHTmYKg.exe
  2⤵
  PID:5724
- C:\Windows\System\kmgSHjp.exe
  C:\Windows\System\kmgSHjp.exe
  2⤵
  PID:5504
- C:\Windows\System\IUWbqcq.exe
  C:\Windows\System\IUWbqcq.exe
  2⤵
  PID:5772
- C:\Windows\System\cotJWRZ.exe
  C:\Windows\System\cotJWRZ.exe
  2⤵
  PID:5880
- C:\Windows\System\enOkPyE.exe
  C:\Windows\System\enOkPyE.exe
  2⤵
  PID:5864
- C:\Windows\System\JcrPrMg.exe
  C:\Windows\System\JcrPrMg.exe
  2⤵
  PID:4784
- C:\Windows\System\nJtiXor.exe
  C:\Windows\System\nJtiXor.exe
  2⤵
  PID:6048
- C:\Windows\System\FKfYBmG.exe
  C:\Windows\System\FKfYBmG.exe
  2⤵
  PID:5320
- C:\Windows\System\hGoTSAN.exe
  C:\Windows\System\hGoTSAN.exe
  2⤵
  PID:6080
- C:\Windows\System\UqdKFxQ.exe
  C:\Windows\System\UqdKFxQ.exe
  2⤵
  PID:5996
- C:\Windows\System\RXMgctr.exe
  C:\Windows\System\RXMgctr.exe
  2⤵
  PID:5448
- C:\Windows\System\ctjtDTc.exe
  C:\Windows\System\ctjtDTc.exe
  2⤵
  PID:6092
- C:\Windows\System\iJwGGJX.exe
  C:\Windows\System\iJwGGJX.exe
  2⤵
  PID:5620
- C:\Windows\System\wFcbseI.exe
  C:\Windows\System\wFcbseI.exe
  2⤵
  PID:5188
- C:\Windows\System\XPNCTVq.exe
  C:\Windows\System\XPNCTVq.exe
  2⤵
  PID:5820
- C:\Windows\System\NCIsgyq.exe
  C:\Windows\System\NCIsgyq.exe
  2⤵
  PID:6032
- C:\Windows\System\dCBwPNZ.exe
  C:\Windows\System\dCBwPNZ.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5432
- C:\Windows\System\gNjiLnM.exe
  C:\Windows\System\gNjiLnM.exe
  2⤵
  PID:5240
- C:\Windows\System\doEErQf.exe
  C:\Windows\System\doEErQf.exe
  2⤵
  PID:5668
- C:\Windows\System\MLCtFOQ.exe
  C:\Windows\System\MLCtFOQ.exe
  2⤵
  PID:5572
- C:\Windows\System\kYhXpUw.exe
  C:\Windows\System\kYhXpUw.exe
  2⤵
  PID:5928
- C:\Windows\System\BaljAGC.exe
  C:\Windows\System\BaljAGC.exe
  2⤵
  PID:5192
- C:\Windows\System\Qewmnez.exe
  C:\Windows\System\Qewmnez.exe
  2⤵
  PID:5472
- C:\Windows\System\IoOVzUQ.exe
  C:\Windows\System\IoOVzUQ.exe
  2⤵
  PID:5756
- C:\Windows\System\SEJcGQR.exe
  C:\Windows\System\SEJcGQR.exe
  2⤵
  PID:1996
- C:\Windows\System\LgMBsUn.exe
  C:\Windows\System\LgMBsUn.exe
  2⤵
  PID:5140
- C:\Windows\System\FDYcDlR.exe
  C:\Windows\System\FDYcDlR.exe
  2⤵
  PID:6116
- C:\Windows\System\mttjftE.exe
  C:\Windows\System\mttjftE.exe
  2⤵
  PID:5632
- C:\Windows\System\lHMarHW.exe
  C:\Windows\System\lHMarHW.exe
  2⤵
  PID:5948
- C:\Windows\System\gdumpgA.exe
  C:\Windows\System\gdumpgA.exe
  2⤵
  PID:5484
- C:\Windows\System\AizxkSk.exe
  C:\Windows\System\AizxkSk.exe
  2⤵
  PID:5816
- C:\Windows\System\ooYmAzg.exe
  C:\Windows\System\ooYmAzg.exe
  2⤵
  PID:6160
- C:\Windows\System\eOGulwT.exe
  C:\Windows\System\eOGulwT.exe
  2⤵
  PID:6176
- C:\Windows\System\ZpTNqbo.exe
  C:\Windows\System\ZpTNqbo.exe
  2⤵
  PID:6192
- C:\Windows\System\ijuBRxP.exe
  C:\Windows\System\ijuBRxP.exe
  2⤵
  PID:6208
- C:\Windows\System\LNttsVw.exe
  C:\Windows\System\LNttsVw.exe
  2⤵
  PID:6224
- C:\Windows\System\kOhIXyO.exe
  C:\Windows\System\kOhIXyO.exe
  2⤵
  PID:6240
- C:\Windows\System\fgDtKXq.exe
  C:\Windows\System\fgDtKXq.exe
  2⤵
  PID:6256
- C:\Windows\System\RJTtUIW.exe
  C:\Windows\System\RJTtUIW.exe
  2⤵
  PID:6272
- C:\Windows\System\MPWPGor.exe
  C:\Windows\System\MPWPGor.exe
  2⤵
  PID:6288
- C:\Windows\System\yvMKfNi.exe
  C:\Windows\System\yvMKfNi.exe
  2⤵
  PID:6304
- C:\Windows\System\CGZBlMU.exe
  C:\Windows\System\CGZBlMU.exe
  2⤵
  PID:6320
- C:\Windows\System\bzvfknC.exe
  C:\Windows\System\bzvfknC.exe
  2⤵
  PID:6336
- C:\Windows\System\FkhZdrZ.exe
  C:\Windows\System\FkhZdrZ.exe
  2⤵
  PID:6352
- C:\Windows\System\euXmbil.exe
  C:\Windows\System\euXmbil.exe
  2⤵
  PID:6368
- C:\Windows\System\nneXgTq.exe
  C:\Windows\System\nneXgTq.exe
  2⤵
  PID:6384
- C:\Windows\System\fGbTAHN.exe
  C:\Windows\System\fGbTAHN.exe
  2⤵
  PID:6412
- C:\Windows\System\fMSvJyE.exe
  C:\Windows\System\fMSvJyE.exe
  2⤵
  PID:6428
- C:\Windows\System\FyslgxW.exe
  C:\Windows\System\FyslgxW.exe
  2⤵
  PID:6444
- C:\Windows\System\HaKjWag.exe
  C:\Windows\System\HaKjWag.exe
  2⤵
  PID:6460
- C:\Windows\System\makuMdh.exe
  C:\Windows\System\makuMdh.exe
  2⤵
  PID:6476
- C:\Windows\System\RJOtDAb.exe
  C:\Windows\System\RJOtDAb.exe
  2⤵
  PID:6492
- C:\Windows\System\aKgLkxZ.exe
  C:\Windows\System\aKgLkxZ.exe
  2⤵
  PID:6508
- C:\Windows\System\hzftiIf.exe
  C:\Windows\System\hzftiIf.exe
  2⤵
  PID:6524
- C:\Windows\System\VlQdZOF.exe
  C:\Windows\System\VlQdZOF.exe
  2⤵
  PID:6540
- C:\Windows\System\JwaZBqi.exe
  C:\Windows\System\JwaZBqi.exe
  2⤵
  PID:6556
- C:\Windows\System\jeFCtjK.exe
  C:\Windows\System\jeFCtjK.exe
  2⤵
  PID:6572
- C:\Windows\System\YpSCZjO.exe
  C:\Windows\System\YpSCZjO.exe
  2⤵
  PID:6588
- C:\Windows\System\uQzPRtk.exe
  C:\Windows\System\uQzPRtk.exe
  2⤵
  PID:6604
- C:\Windows\System\wCrqpRl.exe
  C:\Windows\System\wCrqpRl.exe
  2⤵
  PID:6620
- C:\Windows\System\phWGqKj.exe
  C:\Windows\System\phWGqKj.exe
  2⤵
  PID:6636
- C:\Windows\System\suBMtaU.exe
  C:\Windows\System\suBMtaU.exe
  2⤵
  PID:6652
- C:\Windows\System\FiNKNtn.exe
  C:\Windows\System\FiNKNtn.exe
  2⤵
  PID:6668
- C:\Windows\System\TVlPtNF.exe
  C:\Windows\System\TVlPtNF.exe
  2⤵
  PID:6684
- C:\Windows\System\jPiZRCy.exe
  C:\Windows\System\jPiZRCy.exe
  2⤵
  PID:6704
- C:\Windows\System\xDSpEFg.exe
  C:\Windows\System\xDSpEFg.exe
  2⤵
  PID:6720
- C:\Windows\System\UZOBLzS.exe
  C:\Windows\System\UZOBLzS.exe
  2⤵
  PID:6736
- C:\Windows\System\bYXeXtI.exe
  C:\Windows\System\bYXeXtI.exe
  2⤵
  PID:6752
- C:\Windows\System\hNROXeV.exe
  C:\Windows\System\hNROXeV.exe
  2⤵
  PID:6768
- C:\Windows\System\dvaKsPh.exe
  C:\Windows\System\dvaKsPh.exe
  2⤵
  PID:6784
- C:\Windows\System\ugShYxK.exe
  C:\Windows\System\ugShYxK.exe
  2⤵
  PID:6800
- C:\Windows\System\dSuKyAN.exe
  C:\Windows\System\dSuKyAN.exe
  2⤵
  PID:6816
- C:\Windows\System\RiEKntM.exe
  C:\Windows\System\RiEKntM.exe
  2⤵
  PID:6832
- C:\Windows\System\eAwwCFw.exe
  C:\Windows\System\eAwwCFw.exe
  2⤵
  PID:6848
- C:\Windows\System\BWDbYXX.exe
  C:\Windows\System\BWDbYXX.exe
  2⤵
  PID:6864
- C:\Windows\System\OgtflIL.exe
  C:\Windows\System\OgtflIL.exe
  2⤵
  PID:6880
- C:\Windows\System\QzbqjjA.exe
  C:\Windows\System\QzbqjjA.exe
  2⤵
  PID:6896
- C:\Windows\System\TiiRzRg.exe
  C:\Windows\System\TiiRzRg.exe
  2⤵
  PID:6912
- C:\Windows\System\SbvcuVO.exe
  C:\Windows\System\SbvcuVO.exe
  2⤵
  PID:6928
- C:\Windows\System\tGSimhA.exe
  C:\Windows\System\tGSimhA.exe
  2⤵
  PID:6944
- C:\Windows\System\mPUdrdC.exe
  C:\Windows\System\mPUdrdC.exe
  2⤵
  PID:6960
- C:\Windows\System\PVPXTKm.exe
  C:\Windows\System\PVPXTKm.exe
  2⤵
  PID:6976
- C:\Windows\System\llKpKVR.exe
  C:\Windows\System\llKpKVR.exe
  2⤵
  PID:6992
- C:\Windows\System\TpuNrHt.exe
  C:\Windows\System\TpuNrHt.exe
  2⤵
  PID:7008
- C:\Windows\System\KvBxRXx.exe
  C:\Windows\System\KvBxRXx.exe
  2⤵
  PID:7024
- C:\Windows\System\DuTUXdv.exe
  C:\Windows\System\DuTUXdv.exe
  2⤵
  PID:7040
- C:\Windows\System\bKiHNvs.exe
  C:\Windows\System\bKiHNvs.exe
  2⤵
  PID:7056
- C:\Windows\System\YDrOAYq.exe
  C:\Windows\System\YDrOAYq.exe
  2⤵
  PID:7072
- C:\Windows\System\AIbwYlG.exe
  C:\Windows\System\AIbwYlG.exe
  2⤵
  PID:7088
- C:\Windows\System\hMZEPRr.exe
  C:\Windows\System\hMZEPRr.exe
  2⤵
  PID:7104
- C:\Windows\System\ummoNGI.exe
  C:\Windows\System\ummoNGI.exe
  2⤵
  PID:7120
- C:\Windows\System\dDdtbXW.exe
  C:\Windows\System\dDdtbXW.exe
  2⤵
  PID:7136
- C:\Windows\System\FJmZaia.exe
  C:\Windows\System\FJmZaia.exe
  2⤵
  PID:7152
- C:\Windows\System\tqidSqv.exe
  C:\Windows\System\tqidSqv.exe
  2⤵
  PID:5568
- C:\Windows\System\XAveQSG.exe
  C:\Windows\System\XAveQSG.exe
  2⤵
  PID:6156
- C:\Windows\System\dQtuICR.exe
  C:\Windows\System\dQtuICR.exe
  2⤵
  PID:6204
- C:\Windows\System\XDqjtaH.exe
  C:\Windows\System\XDqjtaH.exe
  2⤵
  PID:6232
- C:\Windows\System\HGZtKCw.exe
  C:\Windows\System\HGZtKCw.exe
  2⤵
  PID:6252
- C:\Windows\System\QpmsOLh.exe
  C:\Windows\System\QpmsOLh.exe
  2⤵
  PID:6280
- C:\Windows\System\dvNdNJt.exe
  C:\Windows\System\dvNdNJt.exe
  2⤵
  PID:6332
- C:\Windows\System\iGfxjGi.exe
  C:\Windows\System\iGfxjGi.exe
  2⤵
  PID:6344
- C:\Windows\System\lYCCxAF.exe
  C:\Windows\System\lYCCxAF.exe
  2⤵
  PID:6400
- C:\Windows\System\dktBzOv.exe
  C:\Windows\System\dktBzOv.exe
  2⤵
  PID:6376
- C:\Windows\System\CfSvhAA.exe
  C:\Windows\System\CfSvhAA.exe
  2⤵
  PID:6424
- C:\Windows\System\aSCIZKw.exe
  C:\Windows\System\aSCIZKw.exe
  2⤵
  PID:6500
- C:\Windows\System\DuOZeLM.exe
  C:\Windows\System\DuOZeLM.exe
  2⤵
  PID:6520
- C:\Windows\System\wEluKKW.exe
  C:\Windows\System\wEluKKW.exe
  2⤵
  PID:6532
- C:\Windows\System\gOmAyhg.exe
  C:\Windows\System\gOmAyhg.exe
  2⤵
  PID:6632
- C:\Windows\System\ZRKPeJP.exe
  C:\Windows\System\ZRKPeJP.exe
  2⤵
  PID:6796
- C:\Windows\System\SHOtAma.exe
  C:\Windows\System\SHOtAma.exe
  2⤵
  PID:6856
- C:\Windows\System\JVDIUOs.exe
  C:\Windows\System\JVDIUOs.exe
  2⤵
  PID:6892
- C:\Windows\System\zvjZoKu.exe
  C:\Windows\System\zvjZoKu.exe
  2⤵
  PID:6988
- C:\Windows\System\kUXvkDi.exe
  C:\Windows\System\kUXvkDi.exe
  2⤵
  PID:6904
- C:\Windows\System\vHWupfX.exe
  C:\Windows\System\vHWupfX.exe
  2⤵
  PID:7080
- C:\Windows\System\IIKJJQd.exe
  C:\Windows\System\IIKJJQd.exe
  2⤵
  PID:6840
- C:\Windows\System\TZoAJYT.exe
  C:\Windows\System\TZoAJYT.exe
  2⤵
  PID:6648
- C:\Windows\System\nftUzvp.exe
  C:\Windows\System\nftUzvp.exe
  2⤵
  PID:6716
- C:\Windows\System\xkOvZku.exe
  C:\Windows\System\xkOvZku.exe
  2⤵
  PID:6780
- C:\Windows\System\pNzqdIm.exe
  C:\Windows\System\pNzqdIm.exe
  2⤵
  PID:7004
- C:\Windows\System\YQnYRER.exe
  C:\Windows\System\YQnYRER.exe
  2⤵
  PID:7068
- C:\Windows\System\ZtCFNoL.exe
  C:\Windows\System\ZtCFNoL.exe
  2⤵
  PID:7164
- C:\Windows\System\GfBUQHs.exe
  C:\Windows\System\GfBUQHs.exe
  2⤵
  PID:7096
- C:\Windows\System\dyMSIvv.exe
  C:\Windows\System\dyMSIvv.exe
  2⤵
  PID:7160
- C:\Windows\System\xffsQww.exe
  C:\Windows\System\xffsQww.exe
  2⤵
  PID:6200
- C:\Windows\System\SPUfDHs.exe
  C:\Windows\System\SPUfDHs.exe
  2⤵
  PID:6364
- C:\Windows\System\hHsGTcM.exe
  C:\Windows\System\hHsGTcM.exe
  2⤵
  PID:6188
- C:\Windows\System\zGbhlgd.exe
  C:\Windows\System\zGbhlgd.exe
  2⤵
  PID:6488
- C:\Windows\System\ZVEWjIS.exe
  C:\Windows\System\ZVEWjIS.exe
  2⤵
  PID:6360
- C:\Windows\System\eZvzVrk.exe
  C:\Windows\System\eZvzVrk.exe
  2⤵
  PID:6472
- C:\Windows\System\YFLdjSs.exe
  C:\Windows\System\YFLdjSs.exe
  2⤵
  PID:6552
- C:\Windows\System\gEbWMLm.exe
  C:\Windows\System\gEbWMLm.exe
  2⤵
  PID:6628
- C:\Windows\System\kLEREMY.exe
  C:\Windows\System\kLEREMY.exe
  2⤵
  PID:6700
- C:\Windows\System\TkdBnJk.exe
  C:\Windows\System\TkdBnJk.exe
  2⤵
  PID:6824
- C:\Windows\System\kXDkDCa.exe
  C:\Windows\System\kXDkDCa.exe
  2⤵
  PID:6920
- C:\Windows\System\ETMtywc.exe
  C:\Windows\System\ETMtywc.exe
  2⤵
  PID:6956
- C:\Windows\System\GrXKlyE.exe
  C:\Windows\System\GrXKlyE.exe
  2⤵
  PID:7052
- C:\Windows\System\CsYgKHV.exe
  C:\Windows\System\CsYgKHV.exe
  2⤵
  PID:7116
- C:\Windows\System\iKvGwff.exe
  C:\Windows\System\iKvGwff.exe
  2⤵
  PID:6712
- C:\Windows\System\HyodECu.exe
  C:\Windows\System\HyodECu.exe
  2⤵
  PID:6940
- C:\Windows\System\mPWLofE.exe
  C:\Windows\System\mPWLofE.exe
  2⤵
  PID:7036
- C:\Windows\System\liFAgLv.exe
  C:\Windows\System\liFAgLv.exe
  2⤵
  PID:6220
- C:\Windows\System\vJqOIgU.exe
  C:\Windows\System\vJqOIgU.exe
  2⤵
  PID:6380
- C:\Windows\System\HTgopWw.exe
  C:\Windows\System\HTgopWw.exe
  2⤵
  PID:6184
- C:\Windows\System\SIlfbZK.exe
  C:\Windows\System\SIlfbZK.exe
  2⤵
  PID:6484
- C:\Windows\System\oqEFCtU.exe
  C:\Windows\System\oqEFCtU.exe
  2⤵
  PID:6692
- C:\Windows\System\ciLacUi.exe
  C:\Windows\System\ciLacUi.exe
  2⤵
  PID:6580
- C:\Windows\System\FbMCrHv.exe
  C:\Windows\System\FbMCrHv.exe
  2⤵
  PID:6952
- C:\Windows\System\NnFKBDI.exe
  C:\Windows\System\NnFKBDI.exe
  2⤵
  PID:6876
- C:\Windows\System\nxEhgkd.exe
  C:\Windows\System\nxEhgkd.exe
  2⤵
  PID:6408
- C:\Windows\System\EjjcQfE.exe
  C:\Windows\System\EjjcQfE.exe
  2⤵
  PID:7000
- C:\Windows\System\NelUXlz.exe
  C:\Windows\System\NelUXlz.exe
  2⤵
  PID:6468
- C:\Windows\System\xMVjsYz.exe
  C:\Windows\System\xMVjsYz.exe
  2⤵
  PID:6568
- C:\Windows\System\KyCPapG.exe
  C:\Windows\System\KyCPapG.exe
  2⤵
  PID:7176
- C:\Windows\System\KgSdaMj.exe
  C:\Windows\System\KgSdaMj.exe
  2⤵
  PID:7192
- C:\Windows\System\dfBjWfe.exe
  C:\Windows\System\dfBjWfe.exe
  2⤵
  PID:7208
- C:\Windows\System\jMxQskm.exe
  C:\Windows\System\jMxQskm.exe
  2⤵
  PID:7224
- C:\Windows\System\XfXqqwQ.exe
  C:\Windows\System\XfXqqwQ.exe
  2⤵
  PID:7240
- C:\Windows\System\KaEzVgy.exe
  C:\Windows\System\KaEzVgy.exe
  2⤵
  PID:7256
- C:\Windows\System\FnuvJYO.exe
  C:\Windows\System\FnuvJYO.exe
  2⤵
  PID:7272
- C:\Windows\System\fLiknJq.exe
  C:\Windows\System\fLiknJq.exe
  2⤵
  PID:7288
- C:\Windows\System\RSsSdUC.exe
  C:\Windows\System\RSsSdUC.exe
  2⤵
  PID:7304
- C:\Windows\System\IYSxnAt.exe
  C:\Windows\System\IYSxnAt.exe
  2⤵
  PID:7320
- C:\Windows\System\nFseZgn.exe
  C:\Windows\System\nFseZgn.exe
  2⤵
  PID:7336
- C:\Windows\System\GVdePbZ.exe
  C:\Windows\System\GVdePbZ.exe
  2⤵
  PID:7352
- C:\Windows\System\wbTLwvA.exe
  C:\Windows\System\wbTLwvA.exe
  2⤵
  PID:7368
- C:\Windows\System\HFPufVf.exe
  C:\Windows\System\HFPufVf.exe
  2⤵
  PID:7384
- C:\Windows\System\tXKCcWd.exe
  C:\Windows\System\tXKCcWd.exe
  2⤵
  PID:7400
- C:\Windows\System\duoJgdx.exe
  C:\Windows\System\duoJgdx.exe
  2⤵
  PID:7420
- C:\Windows\System\cbSmScK.exe
  C:\Windows\System\cbSmScK.exe
  2⤵
  PID:7436
- C:\Windows\System\jaTGcBR.exe
  C:\Windows\System\jaTGcBR.exe
  2⤵
  PID:7452
- C:\Windows\System\CYtonMl.exe
  C:\Windows\System\CYtonMl.exe
  2⤵
  PID:7468
- C:\Windows\System\lhIsvtm.exe
  C:\Windows\System\lhIsvtm.exe
  2⤵
  PID:7484
- C:\Windows\System\jTMdySi.exe
  C:\Windows\System\jTMdySi.exe
  2⤵
  PID:7500
- C:\Windows\System\TZgmrdG.exe
  C:\Windows\System\TZgmrdG.exe
  2⤵
  PID:7516
- C:\Windows\System\eLyKEGR.exe
  C:\Windows\System\eLyKEGR.exe
  2⤵
  PID:7532
- C:\Windows\System\QUVybOb.exe
  C:\Windows\System\QUVybOb.exe
  2⤵
  PID:7548
- C:\Windows\System\sFsMqGF.exe
  C:\Windows\System\sFsMqGF.exe
  2⤵
  PID:7564
- C:\Windows\System\xjmhAiw.exe
  C:\Windows\System\xjmhAiw.exe
  2⤵
  PID:7584
- C:\Windows\System\LXNjeoU.exe
  C:\Windows\System\LXNjeoU.exe
  2⤵
  PID:7600
- C:\Windows\System\lxlLEXN.exe
  C:\Windows\System\lxlLEXN.exe
  2⤵
  PID:7616
- C:\Windows\System\nHNegjU.exe
  C:\Windows\System\nHNegjU.exe
  2⤵
  PID:7632
- C:\Windows\System\VrSpCBh.exe
  C:\Windows\System\VrSpCBh.exe
  2⤵
  PID:7648
- C:\Windows\System\AdFMxMG.exe
  C:\Windows\System\AdFMxMG.exe
  2⤵
  PID:7664
- C:\Windows\System\PSqCgnw.exe
  C:\Windows\System\PSqCgnw.exe
  2⤵
  PID:7680
- C:\Windows\System\PPYsHVM.exe
  C:\Windows\System\PPYsHVM.exe
  2⤵
  PID:7696
- C:\Windows\System\aWPgrQg.exe
  C:\Windows\System\aWPgrQg.exe
  2⤵
  PID:7712
- C:\Windows\System\DCyZDEN.exe
  C:\Windows\System\DCyZDEN.exe
  2⤵
  PID:7728
- C:\Windows\System\gxjcHGJ.exe
  C:\Windows\System\gxjcHGJ.exe
  2⤵
  PID:7744
- C:\Windows\System\lEpwFGn.exe
  C:\Windows\System\lEpwFGn.exe
  2⤵
  PID:7760
- C:\Windows\System\nmhojbS.exe
  C:\Windows\System\nmhojbS.exe
  2⤵
  PID:7776
- C:\Windows\System\lvVBKVA.exe
  C:\Windows\System\lvVBKVA.exe
  2⤵
  PID:7792
- C:\Windows\System\rGwgDDa.exe
  C:\Windows\System\rGwgDDa.exe
  2⤵
  PID:7808
- C:\Windows\System\ulVUsfF.exe
  C:\Windows\System\ulVUsfF.exe
  2⤵
  PID:7824
- C:\Windows\System\yeEVSYm.exe
  C:\Windows\System\yeEVSYm.exe
  2⤵
  PID:7840
- C:\Windows\System\ldaxLKF.exe
  C:\Windows\System\ldaxLKF.exe
  2⤵
  PID:7856
- C:\Windows\System\YgeFWRT.exe
  C:\Windows\System\YgeFWRT.exe
  2⤵
  PID:7872
- C:\Windows\System\ciLKtJB.exe
  C:\Windows\System\ciLKtJB.exe
  2⤵
  PID:7888
- C:\Windows\System\BqtaUdO.exe
  C:\Windows\System\BqtaUdO.exe
  2⤵
  PID:7904
- C:\Windows\System\QWRLMCO.exe
  C:\Windows\System\QWRLMCO.exe
  2⤵
  PID:7920
- C:\Windows\System\jbNyDYb.exe
  C:\Windows\System\jbNyDYb.exe
  2⤵
  PID:7936
- C:\Windows\System\DAHCQhP.exe
  C:\Windows\System\DAHCQhP.exe
  2⤵
  PID:7952
- C:\Windows\System\htOqmIb.exe
  C:\Windows\System\htOqmIb.exe
  2⤵
  PID:7980
- C:\Windows\System\RlOXagK.exe
  C:\Windows\System\RlOXagK.exe
  2⤵
  PID:7996
- C:\Windows\System\JuDTDMm.exe
  C:\Windows\System\JuDTDMm.exe
  2⤵
  PID:8016
- C:\Windows\System\sFLPWxb.exe
  C:\Windows\System\sFLPWxb.exe
  2⤵
  PID:8032
- C:\Windows\System\ojfPIzY.exe
  C:\Windows\System\ojfPIzY.exe
  2⤵
  PID:8048
- C:\Windows\System\XcZRmOz.exe
  C:\Windows\System\XcZRmOz.exe
  2⤵
  PID:8068
- C:\Windows\System\zMuUXZH.exe
  C:\Windows\System\zMuUXZH.exe
  2⤵
  PID:8084
- C:\Windows\System\SYigrGV.exe
  C:\Windows\System\SYigrGV.exe
  2⤵
  PID:8100
- C:\Windows\System\jbzjlsc.exe
  C:\Windows\System\jbzjlsc.exe
  2⤵
  PID:8116
- C:\Windows\System\fkAxaEJ.exe
  C:\Windows\System\fkAxaEJ.exe
  2⤵
  PID:8132
- C:\Windows\System\OFsIZwR.exe
  C:\Windows\System\OFsIZwR.exe
  2⤵
  PID:8148
- C:\Windows\System\SQueZTG.exe
  C:\Windows\System\SQueZTG.exe
  2⤵
  PID:8164
- C:\Windows\System\rjkbknE.exe
  C:\Windows\System\rjkbknE.exe
  2⤵
  PID:8180
- C:\Windows\System\lODLdCT.exe
  C:\Windows\System\lODLdCT.exe
  2⤵
  PID:6168
- C:\Windows\System\GktDOAP.exe
  C:\Windows\System\GktDOAP.exe
  2⤵
  PID:6676
- C:\Windows\System\QjTRVaH.exe
  C:\Windows\System\QjTRVaH.exe
  2⤵
  PID:6984
- C:\Windows\System\iwqbFla.exe
  C:\Windows\System\iwqbFla.exe
  2⤵
  PID:6968
- C:\Windows\System\cuqtCBY.exe
  C:\Windows\System\cuqtCBY.exe
  2⤵
  PID:7236
- C:\Windows\System\gKdoOTQ.exe
  C:\Windows\System\gKdoOTQ.exe
  2⤵
  PID:7216
- C:\Windows\System\owcYeMw.exe
  C:\Windows\System\owcYeMw.exe
  2⤵
  PID:7284
- C:\Windows\System\wkfdaPs.exe
  C:\Windows\System\wkfdaPs.exe
  2⤵
  PID:7312
- C:\Windows\System\ihWTqsg.exe
  C:\Windows\System\ihWTqsg.exe
  2⤵
  PID:7348
- C:\Windows\System\pUGRtoq.exe
  C:\Windows\System\pUGRtoq.exe
  2⤵
  PID:7376
- C:\Windows\System\brvRjfV.exe
  C:\Windows\System\brvRjfV.exe
  2⤵
  PID:7428
- C:\Windows\System\nBSacPI.exe
  C:\Windows\System\nBSacPI.exe
  2⤵
  PID:7496
- C:\Windows\System\ecEwgal.exe
  C:\Windows\System\ecEwgal.exe
  2⤵
  PID:6744
- C:\Windows\System\Jzspura.exe
  C:\Windows\System\Jzspura.exe
  2⤵
  PID:7572
- C:\Windows\System\fzgyizE.exe
  C:\Windows\System\fzgyizE.exe
  2⤵
  PID:7560
- C:\Windows\System\OdmIIum.exe
  C:\Windows\System\OdmIIum.exe
  2⤵
  PID:7592
- C:\Windows\System\KKvcMEs.exe
  C:\Windows\System\KKvcMEs.exe
  2⤵
  PID:7672
- C:\Windows\System\difyVBe.exe
  C:\Windows\System\difyVBe.exe
  2⤵
  PID:7656
- C:\Windows\System\FSfPaif.exe
  C:\Windows\System\FSfPaif.exe
  2⤵
  PID:7692
- C:\Windows\System\ZGsRXUQ.exe
  C:\Windows\System\ZGsRXUQ.exe
  2⤵
  PID:7752
- C:\Windows\System\sCexiOo.exe
  C:\Windows\System\sCexiOo.exe
  2⤵
  PID:7772
- C:\Windows\System\KMoNJHl.exe
  C:\Windows\System\KMoNJHl.exe
  2⤵
  PID:7816
- C:\Windows\System\zyyJeuj.exe
  C:\Windows\System\zyyJeuj.exe
  2⤵
  PID:7852
- C:\Windows\System\MWQOApK.exe
  C:\Windows\System\MWQOApK.exe
  2⤵
  PID:7916
- C:\Windows\System\tyxJsVH.exe
  C:\Windows\System\tyxJsVH.exe
  2⤵
  PID:7864
- C:\Windows\System\abQKUKN.exe
  C:\Windows\System\abQKUKN.exe
  2⤵
  PID:7928
- C:\Windows\System\hvrBSYc.exe
  C:\Windows\System\hvrBSYc.exe
  2⤵
  PID:7988
- C:\Windows\System\GECOrDu.exe
  C:\Windows\System\GECOrDu.exe
  2⤵
  PID:8056
- C:\Windows\System\vdKYpQM.exe
  C:\Windows\System\vdKYpQM.exe
  2⤵
  PID:7976
- C:\Windows\System\gZCgLjA.exe
  C:\Windows\System\gZCgLjA.exe
  2⤵
  PID:8008
- C:\Windows\System\ugKZQJA.exe
  C:\Windows\System\ugKZQJA.exe
  2⤵
  PID:8080
- C:\Windows\System\KIIGZLz.exe
  C:\Windows\System\KIIGZLz.exe
  2⤵
  PID:8124
- C:\Windows\System\ydvsSJL.exe
  C:\Windows\System\ydvsSJL.exe
  2⤵
  PID:8140
- C:\Windows\System\nGXgGRu.exe
  C:\Windows\System\nGXgGRu.exe
  2⤵
  PID:6600
- C:\Windows\System\yDzOsZg.exe
  C:\Windows\System\yDzOsZg.exe
  2⤵
  PID:7248
- C:\Windows\System\JoaYLZF.exe
  C:\Windows\System\JoaYLZF.exe
  2⤵
  PID:7360
- C:\Windows\System\rcVHwqH.exe
  C:\Windows\System\rcVHwqH.exe
  2⤵
  PID:7268
- C:\Windows\System\irrYXaT.exe
  C:\Windows\System\irrYXaT.exe
  2⤵
  PID:7188
- C:\Windows\System\UWJzkif.exe
  C:\Windows\System\UWJzkif.exe
  2⤵
  PID:7328
- C:\Windows\System\tTXBKZN.exe
  C:\Windows\System\tTXBKZN.exe
  2⤵
  PID:7460
- C:\Windows\System\dDGXwAY.exe
  C:\Windows\System\dDGXwAY.exe
  2⤵
  PID:7416
- C:\Windows\System\pGToRCG.exe
  C:\Windows\System\pGToRCG.exe
  2⤵
  PID:7512
- C:\Windows\System\HvFBlAi.exe
  C:\Windows\System\HvFBlAi.exe
  2⤵
  PID:2632
- C:\Windows\System\jABrhVa.exe
  C:\Windows\System\jABrhVa.exe
  2⤵
  PID:7612
- C:\Windows\System\fFKMkeR.exe
  C:\Windows\System\fFKMkeR.exe
  2⤵
  PID:7556
- C:\Windows\System\CwfGNVH.exe
  C:\Windows\System\CwfGNVH.exe
  2⤵
  PID:7740
- C:\Windows\System\TFeLLEL.exe
  C:\Windows\System\TFeLLEL.exe
  2⤵
  PID:7848
- C:\Windows\System\eyAyMsa.exe
  C:\Windows\System\eyAyMsa.exe
  2⤵
  PID:7724
- C:\Windows\System\zpFNPBD.exe
  C:\Windows\System\zpFNPBD.exe
  2⤵
  PID:7960
- C:\Windows\System\lFBVjXh.exe
  C:\Windows\System\lFBVjXh.exe
  2⤵
  PID:7784
- C:\Windows\System\pGLaxWg.exe
  C:\Windows\System\pGLaxWg.exe
  2⤵
  PID:8044
- C:\Windows\System\fPofJPV.exe
  C:\Windows\System\fPofJPV.exe
  2⤵
  PID:7972
- C:\Windows\System\rueHvzR.exe
  C:\Windows\System\rueHvzR.exe
  2⤵
  PID:7204
- C:\Windows\System\zsElAHm.exe
  C:\Windows\System\zsElAHm.exe
  2⤵
  PID:6396
- C:\Windows\System\OEgrZZs.exe
  C:\Windows\System\OEgrZZs.exe
  2⤵
  PID:8096
- C:\Windows\System\ZqhOLnD.exe
  C:\Windows\System\ZqhOLnD.exe
  2⤵
  PID:7408
- C:\Windows\System\mcKHfsA.exe
  C:\Windows\System\mcKHfsA.exe
  2⤵
  PID:7576
- C:\Windows\System\ByQIKpY.exe
  C:\Windows\System\ByQIKpY.exe
  2⤵
  PID:8144
- C:\Windows\System\lwxSDmm.exe
  C:\Windows\System\lwxSDmm.exe
  2⤵
  PID:6776
- C:\Windows\System\yjOseyT.exe
  C:\Windows\System\yjOseyT.exe
  2⤵
  PID:7628
- C:\Windows\System\QXqElqi.exe
  C:\Windows\System\QXqElqi.exe
  2⤵
  PID:7476
- C:\Windows\System\pArHRcD.exe
  C:\Windows\System\pArHRcD.exe
  2⤵
  PID:7528
- C:\Windows\System\IzIwyUR.exe
  C:\Windows\System\IzIwyUR.exe
  2⤵
  PID:8028
- C:\Windows\System\WKXBHqA.exe
  C:\Windows\System\WKXBHqA.exe
  2⤵
  PID:6764
- C:\Windows\System\rWIvUtB.exe
  C:\Windows\System\rWIvUtB.exe
  2⤵
  PID:7900
- C:\Windows\System\YJLKTxU.exe
  C:\Windows\System\YJLKTxU.exe
  2⤵
  PID:7804
- C:\Windows\System\UOFCEHn.exe
  C:\Windows\System\UOFCEHn.exe
  2⤵
  PID:7332
- C:\Windows\System\AlqyxMK.exe
  C:\Windows\System\AlqyxMK.exe
  2⤵
  PID:8024
- C:\Windows\System\YQwjIWe.exe
  C:\Windows\System\YQwjIWe.exe
  2⤵
  PID:8064
- C:\Windows\System\LsJVQPb.exe
  C:\Windows\System\LsJVQPb.exe
  2⤵
  PID:8112
- C:\Windows\System\UmwsbJt.exe
  C:\Windows\System\UmwsbJt.exe
  2⤵
  PID:2640
- C:\Windows\System\idspTln.exe
  C:\Windows\System\idspTln.exe
  2⤵
  PID:8208
- C:\Windows\System\BwsbkCf.exe
  C:\Windows\System\BwsbkCf.exe
  2⤵
  PID:8224
- C:\Windows\System\QOHmlMq.exe
  C:\Windows\System\QOHmlMq.exe
  2⤵
  PID:8244
- C:\Windows\System\GGcrnBc.exe
  C:\Windows\System\GGcrnBc.exe
  2⤵
  PID:8260
- C:\Windows\System\JTTlCtI.exe
  C:\Windows\System\JTTlCtI.exe
  2⤵
  PID:8276
- C:\Windows\System\WYxckEi.exe
  C:\Windows\System\WYxckEi.exe
  2⤵
  PID:8292
- C:\Windows\System\nteIpaR.exe
  C:\Windows\System\nteIpaR.exe
  2⤵
  PID:8308
- C:\Windows\System\eAsWQxp.exe
  C:\Windows\System\eAsWQxp.exe
  2⤵
  PID:8324
- C:\Windows\System\hKHCUDn.exe
  C:\Windows\System\hKHCUDn.exe
  2⤵
  PID:8340
- C:\Windows\System\TlUPece.exe
  C:\Windows\System\TlUPece.exe
  2⤵
  PID:8356
- C:\Windows\System\lRYzJpq.exe
  C:\Windows\System\lRYzJpq.exe
  2⤵
  PID:8372
- C:\Windows\System\wvqbsXc.exe
  C:\Windows\System\wvqbsXc.exe
  2⤵
  PID:8388
- C:\Windows\System\aDoEaqp.exe
  C:\Windows\System\aDoEaqp.exe
  2⤵
  PID:8404
- C:\Windows\System\PaYVcZP.exe
  C:\Windows\System\PaYVcZP.exe
  2⤵
  PID:8420
- C:\Windows\System\cjpcvDd.exe
  C:\Windows\System\cjpcvDd.exe
  2⤵
  PID:8436
- C:\Windows\System\jZLpLXq.exe
  C:\Windows\System\jZLpLXq.exe
  2⤵
  PID:8452
- C:\Windows\System\dpWNEwh.exe
  C:\Windows\System\dpWNEwh.exe
  2⤵
  PID:8468
- C:\Windows\System\PIcllGD.exe
  C:\Windows\System\PIcllGD.exe
  2⤵
  PID:8484
- C:\Windows\System\oVmpITt.exe
  C:\Windows\System\oVmpITt.exe
  2⤵
  PID:8504
- C:\Windows\System\awrdqbv.exe
  C:\Windows\System\awrdqbv.exe
  2⤵
  PID:8520
- C:\Windows\System\iZFIfKS.exe
  C:\Windows\System\iZFIfKS.exe
  2⤵
  PID:8536
- C:\Windows\System\bptByov.exe
  C:\Windows\System\bptByov.exe
  2⤵
  PID:8552
- C:\Windows\System\PZXGEGN.exe
  C:\Windows\System\PZXGEGN.exe
  2⤵
  PID:8568
- C:\Windows\System\nVyJuxB.exe
  C:\Windows\System\nVyJuxB.exe
  2⤵
  PID:8584
- C:\Windows\System\PfcRXkZ.exe
  C:\Windows\System\PfcRXkZ.exe
  2⤵
  PID:8600
- C:\Windows\System\GtUUQBS.exe
  C:\Windows\System\GtUUQBS.exe
  2⤵
  PID:8616
- C:\Windows\System\bEVYSzs.exe
  C:\Windows\System\bEVYSzs.exe
  2⤵
  PID:8632
- C:\Windows\System\xYUjoCM.exe
  C:\Windows\System\xYUjoCM.exe
  2⤵
  PID:8648
- C:\Windows\System\vjkazPI.exe
  C:\Windows\System\vjkazPI.exe
  2⤵
  PID:8664
- C:\Windows\System\rhKQzbt.exe
  C:\Windows\System\rhKQzbt.exe
  2⤵
  PID:8680
- C:\Windows\System\WpaSkrv.exe
  C:\Windows\System\WpaSkrv.exe
  2⤵
  PID:8696
- C:\Windows\System\IYlrfhl.exe
  C:\Windows\System\IYlrfhl.exe
  2⤵
  PID:8712
- C:\Windows\System\sKbxMPa.exe
  C:\Windows\System\sKbxMPa.exe
  2⤵
  PID:8728
- C:\Windows\System\LUCuCCq.exe
  C:\Windows\System\LUCuCCq.exe
  2⤵
  PID:8744
- C:\Windows\System\lQOdPJm.exe
  C:\Windows\System\lQOdPJm.exe
  2⤵
  PID:8760
- C:\Windows\System\ojXQRIi.exe
  C:\Windows\System\ojXQRIi.exe
  2⤵
  PID:8776
- C:\Windows\System\Saheqwz.exe
  C:\Windows\System\Saheqwz.exe
  2⤵
  PID:8796
- C:\Windows\System\JOUvsCH.exe
  C:\Windows\System\JOUvsCH.exe
  2⤵
  PID:8812
- C:\Windows\System\bgnUYWU.exe
  C:\Windows\System\bgnUYWU.exe
  2⤵
  PID:8828
- C:\Windows\System\hUgyxNv.exe
  C:\Windows\System\hUgyxNv.exe
  2⤵
  PID:8844
- C:\Windows\System\bNSqHzm.exe
  C:\Windows\System\bNSqHzm.exe
  2⤵
  PID:8860
- C:\Windows\System\BBadLCx.exe
  C:\Windows\System\BBadLCx.exe
  2⤵
  PID:8876
- C:\Windows\System\IJPXCRT.exe
  C:\Windows\System\IJPXCRT.exe
  2⤵
  PID:8892
- C:\Windows\System\cekKVAJ.exe
  C:\Windows\System\cekKVAJ.exe
  2⤵
  PID:8908
- C:\Windows\System\PiGZBTE.exe
  C:\Windows\System\PiGZBTE.exe
  2⤵
  PID:8924
- C:\Windows\System\iZwbShv.exe
  C:\Windows\System\iZwbShv.exe
  2⤵
  PID:8940
- C:\Windows\System\vQskwYT.exe
  C:\Windows\System\vQskwYT.exe
  2⤵
  PID:8956
- C:\Windows\System\aHtIYns.exe
  C:\Windows\System\aHtIYns.exe
  2⤵
  PID:8972
- C:\Windows\System\LQhJsqq.exe
  C:\Windows\System\LQhJsqq.exe
  2⤵
  PID:8988
- C:\Windows\System\bhfaggz.exe
  C:\Windows\System\bhfaggz.exe
  2⤵
  PID:9004
- C:\Windows\System\fvhafaZ.exe
  C:\Windows\System\fvhafaZ.exe
  2⤵
  PID:9020
- C:\Windows\System\NpDQafW.exe
  C:\Windows\System\NpDQafW.exe
  2⤵
  PID:9036
- C:\Windows\System\eEGmxjY.exe
  C:\Windows\System\eEGmxjY.exe
  2⤵
  PID:9052
- C:\Windows\System\vEuypoG.exe
  C:\Windows\System\vEuypoG.exe
  2⤵
  PID:9068
- C:\Windows\System\uuBLBGD.exe
  C:\Windows\System\uuBLBGD.exe
  2⤵
  PID:9084
- C:\Windows\System\IeqikoV.exe
  C:\Windows\System\IeqikoV.exe
  2⤵
  PID:9100
- C:\Windows\System\uigXJdc.exe
  C:\Windows\System\uigXJdc.exe
  2⤵
  PID:9116
- C:\Windows\System\pfGAwuc.exe
  C:\Windows\System\pfGAwuc.exe
  2⤵
  PID:9132
- C:\Windows\System\LkiffRT.exe
  C:\Windows\System\LkiffRT.exe
  2⤵
  PID:9148
- C:\Windows\System\YqtnFse.exe
  C:\Windows\System\YqtnFse.exe
  2⤵
  PID:9164
- C:\Windows\System\phOzGNs.exe
  C:\Windows\System\phOzGNs.exe
  2⤵
  PID:9180
- C:\Windows\System\MLgDJkU.exe
  C:\Windows\System\MLgDJkU.exe
  2⤵
  PID:9196
- C:\Windows\System\tmIfLaU.exe
  C:\Windows\System\tmIfLaU.exe
  2⤵
  PID:9212
- C:\Windows\System\GJQsYBE.exe
  C:\Windows\System\GJQsYBE.exe
  2⤵
  PID:8160
- C:\Windows\System\ZbDxOsw.exe
  C:\Windows\System\ZbDxOsw.exe
  2⤵
  PID:8216
- C:\Windows\System\jLngPvQ.exe
  C:\Windows\System\jLngPvQ.exe
  2⤵
  PID:8268
- C:\Windows\System\nPhFEzG.exe
  C:\Windows\System\nPhFEzG.exe
  2⤵
  PID:8256
- C:\Windows\System\ybOsPoe.exe
  C:\Windows\System\ybOsPoe.exe
  2⤵
  PID:8316
- C:\Windows\System\OtrMoBC.exe
  C:\Windows\System\OtrMoBC.exe
  2⤵
  PID:8384
- C:\Windows\System\jLUIAaG.exe
  C:\Windows\System\jLUIAaG.exe
  2⤵
  PID:8416
- C:\Windows\System\HoNpEaN.exe
  C:\Windows\System\HoNpEaN.exe
  2⤵
  PID:8400
- C:\Windows\System\jlcDLRf.exe
  C:\Windows\System\jlcDLRf.exe
  2⤵
  PID:8448
- C:\Windows\System\NuRICJB.exe
  C:\Windows\System\NuRICJB.exe
  2⤵
  PID:8464
- C:\Windows\System\qpofkPF.exe
  C:\Windows\System\qpofkPF.exe
  2⤵
  PID:8496
- C:\Windows\System\SKrjzOV.exe
  C:\Windows\System\SKrjzOV.exe
  2⤵
  PID:8544
- C:\Windows\System\fnyOdxd.exe
  C:\Windows\System\fnyOdxd.exe
  2⤵
  PID:8564
- C:\Windows\System\yfrpCWz.exe
  C:\Windows\System\yfrpCWz.exe
  2⤵
  PID:8612
- C:\Windows\System\WYttYEd.exe
  C:\Windows\System\WYttYEd.exe
  2⤵
  PID:8628
- C:\Windows\System\eKZjemw.exe
  C:\Windows\System\eKZjemw.exe
  2⤵
  PID:8660
- C:\Windows\System\cZMbRSO.exe
  C:\Windows\System\cZMbRSO.exe
  2⤵
  PID:8692
- C:\Windows\System\vBNPngv.exe
  C:\Windows\System\vBNPngv.exe
  2⤵
  PID:8740
- C:\Windows\System\kLKLLhI.exe
  C:\Windows\System\kLKLLhI.exe
  2⤵
  PID:8808
- C:\Windows\System\ugNTari.exe
  C:\Windows\System\ugNTari.exe
  2⤵
  PID:8724
- C:\Windows\System\cfJwweh.exe
  C:\Windows\System\cfJwweh.exe
  2⤵
  PID:8792
- C:\Windows\System\ABIPAQM.exe
  C:\Windows\System\ABIPAQM.exe
  2⤵
  PID:8856
- C:\Windows\System\AHRweox.exe
  C:\Windows\System\AHRweox.exe
  2⤵
  PID:8920
- C:\Windows\System\sqjNpXc.exe
  C:\Windows\System\sqjNpXc.exe
  2⤵
  PID:8900
- C:\Windows\System\PCizMIo.exe
  C:\Windows\System\PCizMIo.exe
  2⤵
  PID:8964
- C:\Windows\System\RpuwANC.exe
  C:\Windows\System\RpuwANC.exe
  2⤵
  PID:6696
- C:\Windows\System\IWNdWXW.exe
  C:\Windows\System\IWNdWXW.exe
  2⤵
  PID:9000
- C:\Windows\System\cxBwFCq.exe
  C:\Windows\System\cxBwFCq.exe
  2⤵
  PID:9064
- C:\Windows\System\aczTvnf.exe
  C:\Windows\System\aczTvnf.exe
  2⤵
  PID:9044
- C:\Windows\System\bZxBEjp.exe
  C:\Windows\System\bZxBEjp.exe
  2⤵
  PID:8980
- C:\Windows\System\LrJQipu.exe
  C:\Windows\System\LrJQipu.exe
  2⤵
  PID:9108
- C:\Windows\System\ZcRdRDV.exe
  C:\Windows\System\ZcRdRDV.exe
  2⤵
  PID:9156
- C:\Windows\System\ELpoXaB.exe
  C:\Windows\System\ELpoXaB.exe
  2⤵
  PID:9172
- C:\Windows\System\rfsowmk.exe
  C:\Windows\System\rfsowmk.exe
  2⤵
  PID:9188
- C:\Windows\System\xYmqdNa.exe
  C:\Windows\System\xYmqdNa.exe
  2⤵
  PID:8204
- C:\Windows\System\wQwgDpd.exe
  C:\Windows\System\wQwgDpd.exe
  2⤵
  PID:8252
- C:\Windows\System\SuWTYBH.exe
  C:\Windows\System\SuWTYBH.exe
  2⤵
  PID:8300
- C:\Windows\System\kMhjOQa.exe
  C:\Windows\System\kMhjOQa.exe
  2⤵
  PID:8444
- C:\Windows\System\sOkcPSu.exe
  C:\Windows\System\sOkcPSu.exe
  2⤵
  PID:8380
- C:\Windows\System\HZXDcNz.exe
  C:\Windows\System\HZXDcNz.exe
  2⤵
  PID:8532
- C:\Windows\System\NDFicwp.exe
  C:\Windows\System\NDFicwp.exe
  2⤵
  PID:8624
- C:\Windows\System\lStEcbd.exe
  C:\Windows\System\lStEcbd.exe
  2⤵
  PID:8608
- C:\Windows\System\NoelnOJ.exe
  C:\Windows\System\NoelnOJ.exe
  2⤵
  PID:8708
- C:\Windows\System\HvfhjkR.exe
  C:\Windows\System\HvfhjkR.exe
  2⤵
  PID:8752
- C:\Windows\System\MBoxLCV.exe
  C:\Windows\System\MBoxLCV.exe
  2⤵
  PID:8720
- C:\Windows\System\WEHodSB.exe
  C:\Windows\System\WEHodSB.exe
  2⤵
  PID:8852
- C:\Windows\System\OuTGgUd.exe
  C:\Windows\System\OuTGgUd.exe
  2⤵
  PID:8968
- C:\Windows\System\uXUkGUu.exe
  C:\Windows\System\uXUkGUu.exe
  2⤵
  PID:9096
- C:\Windows\System\xWOmEYJ.exe
  C:\Windows\System\xWOmEYJ.exe
  2⤵
  PID:9144
- C:\Windows\System\GUjXUKk.exe
  C:\Windows\System\GUjXUKk.exe
  2⤵
  PID:7464
- C:\Windows\System\XCHCaaD.exe
  C:\Windows\System\XCHCaaD.exe
  2⤵
  PID:9128
- C:\Windows\System\adHUKCZ.exe
  C:\Windows\System\adHUKCZ.exe
  2⤵
  PID:8492
- C:\Windows\System\dlRQjgi.exe
  C:\Windows\System\dlRQjgi.exe
  2⤵
  PID:8200
- C:\Windows\System\eFEqMRu.exe
  C:\Windows\System\eFEqMRu.exe
  2⤵
  PID:8592
- C:\Windows\System\OTHHRKn.exe
  C:\Windows\System\OTHHRKn.exe
  2⤵
  PID:8460
- C:\Windows\System\jtsJWSV.exe
  C:\Windows\System\jtsJWSV.exe
  2⤵
  PID:8888
- C:\Windows\System\odUuWZD.exe
  C:\Windows\System\odUuWZD.exe
  2⤵
  PID:8868
- C:\Windows\System\WwyzNMj.exe
  C:\Windows\System\WwyzNMj.exe
  2⤵
  PID:9060
- C:\Windows\System\hPyadpK.exe
  C:\Windows\System\hPyadpK.exe
  2⤵
  PID:8352
- C:\Windows\System\iyndJqX.exe
  C:\Windows\System\iyndJqX.exe
  2⤵
  PID:8428
- C:\Windows\System\EpHSBdG.exe
  C:\Windows\System\EpHSBdG.exe
  2⤵
  PID:9032
- C:\Windows\System\hWVEbhb.exe
  C:\Windows\System\hWVEbhb.exe
  2⤵
  PID:9048
- C:\Windows\System\dJaTxed.exe
  C:\Windows\System\dJaTxed.exe
  2⤵
  PID:8984
- C:\Windows\System\xtyeSHi.exe
  C:\Windows\System\xtyeSHi.exe
  2⤵
  PID:8580
- C:\Windows\System\qjQhbPo.exe
  C:\Windows\System\qjQhbPo.exe
  2⤵
  PID:9080
- C:\Windows\System\xfPDrGq.exe
  C:\Windows\System\xfPDrGq.exe
  2⤵
  PID:7756
- C:\Windows\System\QFFiqqH.exe
  C:\Windows\System\QFFiqqH.exe
  2⤵
  PID:8872
- C:\Windows\System\rqeAJuJ.exe
  C:\Windows\System\rqeAJuJ.exe
  2⤵
  PID:9228
- C:\Windows\System\yfClhTk.exe
  C:\Windows\System\yfClhTk.exe
  2⤵
  PID:9244
- C:\Windows\System\tXCNIjy.exe
  C:\Windows\System\tXCNIjy.exe
  2⤵
  PID:9260
- C:\Windows\System\sHVzCkS.exe
  C:\Windows\System\sHVzCkS.exe
  2⤵
  PID:9276
- C:\Windows\System\SiHzxAb.exe
  C:\Windows\System\SiHzxAb.exe
  2⤵
  PID:9292
- C:\Windows\System\fSDtKjQ.exe
  C:\Windows\System\fSDtKjQ.exe
  2⤵
  PID:9308
- C:\Windows\System\dkVoSam.exe
  C:\Windows\System\dkVoSam.exe
  2⤵
  PID:9328
- C:\Windows\System\bsMUaQp.exe
  C:\Windows\System\bsMUaQp.exe
  2⤵
  PID:9344
- C:\Windows\System\zFPiUnB.exe
  C:\Windows\System\zFPiUnB.exe
  2⤵
  PID:9360
- C:\Windows\System\icEJUkJ.exe
  C:\Windows\System\icEJUkJ.exe
  2⤵
  PID:9376
- C:\Windows\System\YgvWKce.exe
  C:\Windows\System\YgvWKce.exe
  2⤵
  PID:9392
- C:\Windows\System\qYzjcvn.exe
  C:\Windows\System\qYzjcvn.exe
  2⤵
  PID:9408
- C:\Windows\System\KBsESSo.exe
  C:\Windows\System\KBsESSo.exe
  2⤵
  PID:9424
- C:\Windows\System\dMcxbwc.exe
  C:\Windows\System\dMcxbwc.exe
  2⤵
  PID:9440
- C:\Windows\System\ScpIQUd.exe
  C:\Windows\System\ScpIQUd.exe
  2⤵
  PID:9456
- C:\Windows\System\DCEOGaH.exe
  C:\Windows\System\DCEOGaH.exe
  2⤵
  PID:9472
- C:\Windows\System\OCCJDnq.exe
  C:\Windows\System\OCCJDnq.exe
  2⤵
  PID:9488
- C:\Windows\System\vMAaIhT.exe
  C:\Windows\System\vMAaIhT.exe
  2⤵
  PID:9504
- C:\Windows\System\ZCunpHH.exe
  C:\Windows\System\ZCunpHH.exe
  2⤵
  PID:9520
- C:\Windows\System\dnLjNYP.exe
  C:\Windows\System\dnLjNYP.exe
  2⤵
  PID:9536
- C:\Windows\System\HWPlSaJ.exe
  C:\Windows\System\HWPlSaJ.exe
  2⤵
  PID:9552
- C:\Windows\System\GbVtigh.exe
  C:\Windows\System\GbVtigh.exe
  2⤵
  PID:9568
- C:\Windows\System\MohCTDj.exe
  C:\Windows\System\MohCTDj.exe
  2⤵
  PID:9584
- C:\Windows\System\aaOQJAc.exe
  C:\Windows\System\aaOQJAc.exe
  2⤵
  PID:9696
- C:\Windows\System\SDvuDVn.exe
  C:\Windows\System\SDvuDVn.exe
  2⤵
  PID:9712
- C:\Windows\System\LSEWgMy.exe
  C:\Windows\System\LSEWgMy.exe
  2⤵
  PID:9728
- C:\Windows\System\uoqFqCv.exe
  C:\Windows\System\uoqFqCv.exe
  2⤵
  PID:9744
- C:\Windows\System\hQtHDfX.exe
  C:\Windows\System\hQtHDfX.exe
  2⤵
  PID:9760
- C:\Windows\System\LuIcTBU.exe
  C:\Windows\System\LuIcTBU.exe
  2⤵
  PID:9776
- C:\Windows\System\qVNqjli.exe
  C:\Windows\System\qVNqjli.exe
  2⤵
  PID:9792
- C:\Windows\System\XfPeTRB.exe
  C:\Windows\System\XfPeTRB.exe
  2⤵
  PID:9808
- C:\Windows\System\JNSClzr.exe
  C:\Windows\System\JNSClzr.exe
  2⤵
  PID:9824
- C:\Windows\System\RifaOMI.exe
  C:\Windows\System\RifaOMI.exe
  2⤵
  PID:9840
- C:\Windows\System\tmjlhaC.exe
  C:\Windows\System\tmjlhaC.exe
  2⤵
  PID:9856
- C:\Windows\System\xickobT.exe
  C:\Windows\System\xickobT.exe
  2⤵
  PID:9872
- C:\Windows\System\QbGQpeU.exe
  C:\Windows\System\QbGQpeU.exe
  2⤵
  PID:9888
- C:\Windows\System\hlrLxTc.exe
  C:\Windows\System\hlrLxTc.exe
  2⤵
  PID:9904
- C:\Windows\System\kWCKkFA.exe
  C:\Windows\System\kWCKkFA.exe
  2⤵
  PID:9924
- C:\Windows\System\wlBCgKI.exe
  C:\Windows\System\wlBCgKI.exe
  2⤵
  PID:9944
- C:\Windows\System\UYBHose.exe
  C:\Windows\System\UYBHose.exe
  2⤵
  PID:9960
- C:\Windows\System\PzYxwvG.exe
  C:\Windows\System\PzYxwvG.exe
  2⤵
  PID:9976
- C:\Windows\System\IdErkxZ.exe
  C:\Windows\System\IdErkxZ.exe
  2⤵
  PID:9992
- C:\Windows\System\cPtIafr.exe
  C:\Windows\System\cPtIafr.exe
  2⤵
  PID:10008
- C:\Windows\System\HpwQkXH.exe
  C:\Windows\System\HpwQkXH.exe
  2⤵
  PID:10024
- C:\Windows\System\rqnpohP.exe
  C:\Windows\System\rqnpohP.exe
  2⤵
  PID:10040
- C:\Windows\System\ryDJlHf.exe
  C:\Windows\System\ryDJlHf.exe
  2⤵
  PID:10056
- C:\Windows\System\FmLkzyG.exe
  C:\Windows\System\FmLkzyG.exe
  2⤵
  PID:10072
- C:\Windows\System\GrfDNaB.exe
  C:\Windows\System\GrfDNaB.exe
  2⤵
  PID:10088
- C:\Windows\System\dWGBtXp.exe
  C:\Windows\System\dWGBtXp.exe
  2⤵
  PID:10104
- C:\Windows\System\SvCATdK.exe
  C:\Windows\System\SvCATdK.exe
  2⤵
  PID:10120
- C:\Windows\System\oqyWAtW.exe
  C:\Windows\System\oqyWAtW.exe
  2⤵
  PID:10136
- C:\Windows\System\yYmHPML.exe
  C:\Windows\System\yYmHPML.exe
  2⤵
  PID:10152
- C:\Windows\System\uHFrkcw.exe
  C:\Windows\System\uHFrkcw.exe
  2⤵
  PID:10168
- C:\Windows\System\hQZEZtm.exe
  C:\Windows\System\hQZEZtm.exe
  2⤵
  PID:10184
- C:\Windows\System\rpqvrYK.exe
  C:\Windows\System\rpqvrYK.exe
  2⤵
  PID:10200
- C:\Windows\System\fEfZKOA.exe
  C:\Windows\System\fEfZKOA.exe
  2⤵
  PID:10216
- C:\Windows\System\emBRqbu.exe
  C:\Windows\System\emBRqbu.exe
  2⤵
  PID:10232
- C:\Windows\System\JSCFXuZ.exe
  C:\Windows\System\JSCFXuZ.exe
  2⤵
  PID:8916
- C:\Windows\System\zPMClqU.exe
  C:\Windows\System\zPMClqU.exe
  2⤵
  PID:9240
- C:\Windows\System\zptdPwR.exe
  C:\Windows\System\zptdPwR.exe
  2⤵
  PID:9272
- C:\Windows\System\sTtTjGb.exe
  C:\Windows\System\sTtTjGb.exe
  2⤵
  PID:9304
- C:\Windows\System\SBPYZke.exe
  C:\Windows\System\SBPYZke.exe
  2⤵
  PID:9324
- C:\Windows\System\tGtNIhr.exe
  C:\Windows\System\tGtNIhr.exe
  2⤵
  PID:9388
- C:\Windows\System\HUCuSOv.exe
  C:\Windows\System\HUCuSOv.exe
  2⤵
  PID:9336
- C:\Windows\System\AAcGJSA.exe
  C:\Windows\System\AAcGJSA.exe
  2⤵
  PID:9432
- C:\Windows\System\jMMkpSm.exe
  C:\Windows\System\jMMkpSm.exe
  2⤵
  PID:9420
- C:\Windows\System\vJxzXHk.exe
  C:\Windows\System\vJxzXHk.exe
  2⤵
  PID:9500
- C:\Windows\System\yWrcHaq.exe
  C:\Windows\System\yWrcHaq.exe
  2⤵
  PID:9560
- C:\Windows\System\MBktypG.exe
  C:\Windows\System\MBktypG.exe
  2⤵
  PID:9512
- C:\Windows\System\CrmNWzm.exe
  C:\Windows\System\CrmNWzm.exe
  2⤵
  PID:9576
- C:\Windows\System\CYOnCIz.exe
  C:\Windows\System\CYOnCIz.exe
  2⤵
  PID:9600
- C:\Windows\System\YUjLqmj.exe
  C:\Windows\System\YUjLqmj.exe
  2⤵
  PID:9612
- C:\Windows\System\pPtIPEM.exe
  C:\Windows\System\pPtIPEM.exe
  2⤵
  PID:9628
- C:\Windows\System\fwkqCeZ.exe
  C:\Windows\System\fwkqCeZ.exe
  2⤵
  PID:9648
- C:\Windows\System\JxdpUAI.exe
  C:\Windows\System\JxdpUAI.exe
  2⤵
  PID:9664
- C:\Windows\System\PyDVdud.exe
  C:\Windows\System\PyDVdud.exe
  2⤵
  PID:9680
- C:\Windows\System\tRwJSFV.exe
  C:\Windows\System\tRwJSFV.exe
  2⤵
  PID:9720
- C:\Windows\System\MDFxGcT.exe
  C:\Windows\System\MDFxGcT.exe
  2⤵
  PID:9784
- C:\Windows\System\KhIRUMj.exe
  C:\Windows\System\KhIRUMj.exe
  2⤵
  PID:9880
- C:\Windows\System\JtWylOk.exe
  C:\Windows\System\JtWylOk.exe
  2⤵
  PID:9984
- C:\Windows\System\CCUeLke.exe
  C:\Windows\System\CCUeLke.exe
  2⤵
  PID:9836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AdbcFxk.exe

Filesize
1.4MB

MD5
a5c6eed60094dfaae81d756c6774645b

SHA1
e91797f30653768d65f39c96148b4c8318b116fb

SHA256
d6e4cd6f6620fbffd203edeece184c4bd51597836fba3da622cc478f4194e4d1

SHA512
8b80913517d578fb8c547efb45d7548ac517df2664fe05f5c9c163fb795ca6672742ca0dd47889cd13dfed4dbce3f39241ba92e4159313197e79591b69b43aac

Download Submit
C:\Windows\system\AmdewNx.exe

Filesize
1.4MB

MD5
d57c7917d896f2634c41230f1d7f0c13

SHA1
65a76022908261d2763d9738589a9cdcdb3bc127

SHA256
8b016ec47a4912266ececab1c3e52fe02d2fce980968770720e0184254211850

SHA512
614262f0e646205dfa3dc719e113a47dc755b14dd8e819a335d47927e8a227c300649560974caf2a8b7157385c2f46cf16c68aedd0b1e2d5826d65b52a0d0a2f

Download Submit
C:\Windows\system\DjFrnlJ.exe

Filesize
1.4MB

MD5
182f19febc21df74968cdf381b3cc517

SHA1
485d35052ce30867f3e3fb4d05add3426b989f53

SHA256
63b4aea4a6d5abf581157b4b09b40934dc08d6dfae1697311b2e2843f273f7da

SHA512
216b6369396b9e420c20f0dd01add9de522c590b72a7868e20bb334c55b4c61fe7f2c0193beb11c32cbff09aee53a10c65f8b778db5d7fd2e65224d0479f85de

Download Submit
C:\Windows\system\LRPlrBg.exe

Filesize
1.4MB

MD5
3feacf4da4e5b144b5e83897f4d626de

SHA1
28454e1365bff02e56ff820d21e1dda6db304b0f

SHA256
7f0ae0c3566441ed43687099d404a909b421b57c9d72d57124c5c9b80f49ecae

SHA512
6afca83eb4dc0c03a2d31efb387c39fa18db703985931df8770cc2e6f2f2ca31ae08378abfb52578bc38bc70da87d83343615a0ab1ec98a7754c361f3bc2e230

Download Submit
C:\Windows\system\NMValCX.exe

Filesize
1.4MB

MD5
58eeb051dff36439287cd7d1001dc1b7

SHA1
05d2f63549e39f5c80a57dc883eb17f94de9c96a

SHA256
8e246ada72b01f5491332bbd11033712469ca99d1d6d4f545f3d86849177e5f2

SHA512
780c2fea8a3b0fb565ddf270d898ba99421e8f8b56b6ed2af34bfa4d07bff435064ee69350c97dbdd685dfdb6e08ae3c7169f7bd76ca4ee6f4a9baa0d6b35c6c

Download Submit
C:\Windows\system\WaRHtEF.exe

Filesize
1.4MB

MD5
e7bb440edb571695393c6e0f260a34be

SHA1
53b2c5c402e83701376d4723aa948c53a7c3c554

SHA256
5afe438864d4ae3c11d0c50ff09dbaa393775b3dfd5aed1a693fe941f6e487fe

SHA512
95c86c9697e1b581ab221689d3fbefd1955ed8a72d965f200b51c831a563e499b485a021e9401508d969b56492fd6a292757c0cc16c44d6f38a55a282ad01b0a

Download Submit
C:\Windows\system\bVGPdgv.exe

Filesize
1.4MB

MD5
13f74bccaf1919974bad00d7d7a6562f

SHA1
2a474ecbeaf36af8fa72e13d88816f02587e739c

SHA256
e819eee1913485734e1973474dfb0702cb210c7797a33e95cc9f07d905fd1474

SHA512
154d5c6e15aeaa7be5dad7bccab996cd09fa9874da428797d75ad832c9c9e9e51f004cdc656048dcce0e94e54933f4c20a3276b8d3a0b99770f9aaf239e64535

Download Submit
C:\Windows\system\bXKBifp.exe

Filesize
8B

MD5
91ec974571d27273c51a8e77a0aa31b6

SHA1
3db3fb75e9c67fd17da72615fa48171c4aad1d60

SHA256
620b103faa6297c5a0d3f3c3f3415a86d923217247e83b17e76d3d6011102ee9

SHA512
4cb4acfcbbde7536dc202631fdc61279571a3ed7bf99e66b59f7b365af28e9db46afeb846eb59bb67e7386ce441c308465b9cdab20507dc389a57a419970b57c

Download Submit
C:\Windows\system\dcOwtWN.exe

Filesize
1.4MB

MD5
4bb914e361c6804752fec3c21e156982

SHA1
9f698aba8343955fc294f4291d369f408fca6063

SHA256
c779267c925764c5145563c832f4945f8eb37b0f18996287a1899b340c4a0e63

SHA512
26afe834acd92b10eddac2b7bbbb24efe07df95f0bf718fdc1f7a8a9dee05b23dd1995d3a629636211e3b987e55a9a1d5b815e2f53d3c3efe96d847555ad66bc

Download Submit
C:\Windows\system\hEAsdpl.exe

Filesize
1.4MB

MD5
53adcf08fc30a02e6946ff79625e3eec

SHA1
0ef5708dd1465f0ffa0af6401e6c43e4bc8e4c26

SHA256
248a6e739f370993f1570ab69a74b95d8fad42d7a4b78f8dbbf10867b23ce3e9

SHA512
81052d8c98e62e6396bf1c4328f696214d01aff86c6d105a023b4210112451c736cefd965cbc08b284bc775c085c95745fcfca186ef0941999ccc815f7fc0185

Download Submit
C:\Windows\system\hukpLQU.exe

Filesize
1.4MB

MD5
04da249f65ae5771c5c738a891979fdb

SHA1
9bf1cddec59932471ca1ab19e6ff79ce0118aa84

SHA256
382271e16b9f705ccc428169ea97bdf8cd051a35793cc359a90564238b885368

SHA512
93cae04cd819322fc681389ee5a14c59b1e1692b96e559340ac91a6965b10863823f86fa41c1346f2f717f7b9c51322dead69df081af6f0e89e6b59c639d7df2

Download Submit
C:\Windows\system\kLrPnwV.exe

Filesize
1.4MB

MD5
a1c4634d868819c9b0f10c128d256d55

SHA1
1449d6177181536242f29bd3efda0aacf66be9fa

SHA256
435963260de580ec5c434127917a7a860c50644beba85623fc58c7882f518454

SHA512
fe039b8cd29841bf89378412a07bdabb5c56f14cabfb0ae48a253396ed8aa5245b9ffc0661585e043df02dfda0b1ca13a16422cba8dbd8757bceef5ec80f1fff

Download Submit
C:\Windows\system\mARkHUB.exe

Filesize
1.4MB

MD5
80e86649dbe727457727d3a8c56a2d17

SHA1
bb017ea53ed8ad1082225ab21e48cfab91b71b39

SHA256
47a6148c820fbdb58b6f9b11b0a865ce010cdd9395c57c53c1ca0ee4dbe7cc40

SHA512
5b350b3a3b37d0c2d0b02521115ece0da47df5692c86f775a9d457e1ab386565599da2eda2f3637fd163edab6ac8366aa9a06c7b0f30d57e50eb37ec1a442f54

Download Submit
C:\Windows\system\nsLjhzY.exe

Filesize
1.4MB

MD5
1f503a2f7d40ac23f999dcc262ad1122

SHA1
696c1ec89100305a92d40cb490a7393e20a550be

SHA256
1808abf2a6cded903371f612f52ac3ced412b015fd7551d11f2fe92e39afc4a8

SHA512
2b70909d306175a0f7bcf0a2447ada47976abb4da6d889cd97d0c6108da7940f728614efbc17bcb289d5ad25a649dd84f0719a757900b9e0c48e8a3500881fb5

Download Submit
C:\Windows\system\oDbHAWN.exe

Filesize
1.4MB

MD5
3984f278eea5a04e760759817346a447

SHA1
1dd5ff9d62d60ffcbb189cabfdf393022488f54b

SHA256
0c14cfb4acf8dc798a4823eb4f2f6eda10d727eaf2476056f0a992797801b79b

SHA512
b8b3b1952fa9a05a7634e8279da42fa9a189258fcb162f2200518c1a4fb31d903e192c4e37c5da559e625491991f9e4153e40fd162837e984a6b6d45027004d5

Download Submit
C:\Windows\system\pxhvBEn.exe

Filesize
1.4MB

MD5
92f06a4442abe34d26757b3537196543

SHA1
66e42bf8eeb03d80e4c1abd23586092c14a1d166

SHA256
78175f672df1e6c1b8f4ecf847db502ce83e408c5e63df0bee828deab53b1195

SHA512
4bb269de9a4721df39abba0a1380cd60343ad6f23658841d5905293bccd500b633c72d1c9390af31df1bc1f5c5977b2a3426e79f455c51d1ac257c879a910b75

Download Submit
C:\Windows\system\qFJKtVt.exe

Filesize
1.4MB

MD5
d012f0ff26383416d010a39782416e7b

SHA1
974a3b75ed79a6ce98b21ac64d17545c0a261494

SHA256
d22220761c2db508efd7a3760acc59ab6be96cf2b72058ef37d4adc2d1cf0b25

SHA512
fc616795c80bb00be8116b4a6acc45074f7243cc2e9826e81671ba2a612b77fd05c79222d8a3b2ee8e4aa90399e3e7f9e15edd9a457f968b32194cc8fa8743e5

Download Submit
C:\Windows\system\rLvPkGh.exe

Filesize
1.4MB

MD5
2f879426b8e981ffe39346c01ecb32ef

SHA1
3f9649944a335720d493ce715d58f7295b5cfb8c

SHA256
26b9922404f6212842a407c39c8b5b0cd158dbe61fd065d84feecf309220cbc4

SHA512
b2a83e28a9ff7d4af0ae953d1cad0cd66d3efe1871e748b7bddac9b45340a4f174fa789cf294e6bf41817f8542e300e357d9a7a63331bd8de9196e03f1effd66

Download Submit
C:\Windows\system\riUaXpT.exe

Filesize
1.4MB

MD5
c8d8890b291eefa9ac62a66178dde630

SHA1
6fd02f1966ba2fe3b05c79314711c9d8cad7de32

SHA256
1e198a674ffaceba7ecda7d02956f2b8892948753bbd3949a03b3d8a23f41172

SHA512
21cfd289251667c557dad10f37591c82edbe660e05fb587d3568bdf32b11fa4592f7043507a60f91f6bb1cf4282e3d934949839916ec1e13bf2b88cadade9084

Download Submit
C:\Windows\system\rvZuWqC.exe

Filesize
1.4MB

MD5
d85aa5d29c23e86a6c3b9c06209eee39

SHA1
63a636e78d1ac5b81aebdf048cb95430a1e2f346

SHA256
b83e8f84de1a56f9009b19075f5d43b528ad558a48e9f1436d6128603698ccb0

SHA512
6d5c5562c7d582ca8e10bce8f9b0ad73a538d9d6893bdefd1b283b07533615922ab8d93502b4e336f03c3795dde14e046e80285d360107f2b8c80c96cae23e70

Download Submit
C:\Windows\system\smzGRqw.exe

Filesize
1.4MB

MD5
7bfbfed9da405c665131ff1e9bcfb87d

SHA1
236dee89365d8912ffa745e60f76334b4d53c160

SHA256
26f2f630a745e679062f7e1d63fe33f161317a6096c8f48ba36c07ca6662afce

SHA512
e5e7dc223d50244aa108ec7a6005150831cca53b0db2b00fc47b3fe2fd16b31964bedc1addac1e3ced271e4919c2da5be2be6a9113ca2e7f5c49a096fba19290

Download Submit
C:\Windows\system\tkSmHuk.exe

Filesize
1.4MB

MD5
3f966f735e7cd3e61b2b9805e99ba7d7

SHA1
531cba609f9539499d0b9806e1b86055e513fd78

SHA256
42154665eeb3e2c706fa644a5b61c7c075ac733aa34a9be5776a0efa2b266a40

SHA512
c057ee62fd36fc29147be1df65938aede1509c36571b178ffec0fb421c93f4e0393de5a37d00b966b6cfe9dc6d513bcbc22714d256729d22a49bbbbbe1dbbb93

Download Submit
C:\Windows\system\uMKmIgZ.exe

Filesize
1.4MB

MD5
09a594fb928072f8b1a42eec5db83201

SHA1
06ffaec629b4ff486cdb6291f555edab5c267153

SHA256
d211051f1013330871efbc7cbaa71dd1eb5225a8618ec86f54db13b0d8d58403

SHA512
eb365cb6fa3664196a0dec692eeec57b8ec02aa90093840e128fd19502a32e36359a765be027cbaa07ace4dfcd87de32ebb1d6fdf426168884ad9fbf707067dd

Download Submit
C:\Windows\system\xIiOgZa.exe

Filesize
1.4MB

MD5
989448a565bd057165b7481c54cdae92

SHA1
5a4290a675e96b1a27ccb8c70196c1eb3df9d44b

SHA256
12592302686e98aab62dc46a904b28546ae4b26d51d9cf49184d44612f97b5ae

SHA512
12a3c8acb283ccaea3a0f8d47496c6dce643d5e62fc2ef2976b912d3ffa411a8c47e4f147e71b4140938185bbf5d779ed0d519bebb2be2d8b7f23b8ba15603da

Download Submit
C:\Windows\system\yRXBxCz.exe

Filesize
1.4MB

MD5
68d81b4b161965d998519684df0880fc

SHA1
af9f90c11592ba484f50411a358efa01ceb9a400

SHA256
f2d9ecf57a90ce737bf78fbca4ee66d5b2bc58c6dfd05a40ed4db18c13469afb

SHA512
97bc7a371f5be018ce2ce8a08cef590ad388ca901a2acbbbfd6ba5ff1aba7d91f720ca9fa242cdb910a72e7d19fab46465be69e0d7c705f75c57d5b0be64b972

Download Submit
\Windows\system\AsYokjA.exe

Filesize
1.4MB

MD5
7348dafcf7f65b2806b82927a7a1b687

SHA1
e075f6ecb1ebd5e50b7eedbc11eb846eefb93a76

SHA256
f8bf134e7e58c1381f35a2f02ad08048a0c08c9c2fb67f8b4a34f467522b59ea

SHA512
2889d18db1f05c0bbcdcf742caa12764fa4a7b61c64a65db6df8e8b873e019ac3ff3e23895811d0fb51b7e927f48fcdfb4dee8ff934e3e212e5afafab8f455f3

Download Submit
\Windows\system\JQYAvbY.exe

Filesize
1.4MB

MD5
e47a3d7d19e5256ab3c3b2dcef06d5fa

SHA1
763e8fc2d60dcb6a5e56c34f18027c341b448799

SHA256
e7f6996db938bbf9a5092c03f5880130597ef6e1769d3b8b7f44d08553273008

SHA512
195cf6bab794f245e4001a2416d0cdb866e4540dc38548132262eed0a459c23d3086fa2a43ad17e0916c3533f1ff7ec1ea8bb964e95b9ab000317387a38fa4ce

Download Submit
\Windows\system\KdgCYFr.exe

Filesize
1.4MB

MD5
2370059937f8300306af58458dd640d2

SHA1
5e889a99ad480fee4e4c55450eef98904ad8ef75

SHA256
b3d7ac28491bf87e90946523e683444ed8ba01d50dfc1318c2650c45e968de4f

SHA512
9e5663654b3d182812520927433d0ebdf40b2b5cf9eb583b482046ac840c591617f799888c1a02f8190633d4de92d2f5a64ba36ed585d001a2ef5f7dc56afc41

Download Submit
\Windows\system\TLNBseE.exe

Filesize
1.4MB

MD5
54b4ca3a74e6b4c1c9501f0dbce16e7e

SHA1
67e9be8f00ce89f63c449e72ed7cf09dd7d89bcc

SHA256
7d55a77d0ac1292afaeb6ea2f80d29a51899b8b4174f02019953b584314349e4

SHA512
c0de7deb2f6abb1f2107b58f59c7beb019c424a51096986c2a4cee38e5d1b26931758b82cc41134c68bb368487d4f181b830ae605f79f312a241e0c27239e945

Download Submit
\Windows\system\TxfDaFS.exe

Filesize
1.4MB

MD5
6c510d079c6d3a61ecc3f0af30f909a6

SHA1
c5b89f8b7556a2d714ee4546dadc21d77e0ed6c4

SHA256
19b0e7805d66fe5144be9434b441071bf463aaa4b29a2411335f56ac494c0b48

SHA512
558d29d01648ed9a85a719deac4c8811a03ee278e7fb2fa6dc941e805f12cd2d56177832ecb18d7a279644b8e80c5672c6371e76e96b80a4660f142fe8fc5ae6

Download Submit
\Windows\system\VvIGmcT.exe

Filesize
1.4MB

MD5
b933e616ca13368ece75b38842ede592

SHA1
03e7bcb5426845236a98993dc6db6c5ea4e86f17

SHA256
bcf4aee2f0b046191f0be31222d52df64f55367ee951e1863b9db249b64d34cc

SHA512
8df0c32e5ca80ab709e30c33a0dedb668bfb6fa58ba4517e4c1a99d262943dbe62adceb40ab4205b2621bdf8e78a65f643ea074ef26f6df1f5813bdde2693d52

Download Submit
\Windows\system\YulfzDs.exe

Filesize
1.4MB

MD5
ea0f36bf1b15861ee85dff5e3b9183ec

SHA1
f251fdab23a69501ec06c443724cbef43e002e87

SHA256
16e143f74ebb8325e96e6214e6a76bc784ea1eebb56075ff62bb07120f38fa7f

SHA512
dfc6862c90ef2a28efbcf77ae52103bbdd7b612df1dd37a3addc7baeaa29ce287b7fb49a2db4aa0d9fcaed016ad0d26acb35dbed5771300a23a1569b73bd542e

Download Submit
\Windows\system\cvFfmxE.exe

Filesize
1.4MB

MD5
4525c9a2203bb7ce8baf9599e3322a08

SHA1
4014af48acbd2e70b5cbcdcda95bf493820231cf

SHA256
c657349842e845ae08a45188298a98ed6d223c291a30de89d2e41bf695354c06

SHA512
87d83a0708a90d1b0f84837b1098dbf7f15e4903d222c5f053ecce876d536a9a7c2cd9f603c073e0985bbb9300dc70c836fc8b8cbc98d38c016bf6e6fe6abc6c

Download Submit
\Windows\system\dNVPHrn.exe

Filesize
1.4MB

MD5
36e2e54306d2cb8ec47c58fc264eab96

SHA1
9f1b130ea4f1889c6ed3eb61043d3657e65e5256

SHA256
de94f2d0ecda98b5d05d18f404ca99643a02a701bdf87cc439123624dcd7986a

SHA512
22232e206ef78c265292117b9da8e46898cda72759761b2478aec254f9c6f91bfebc8881796c3d8c9dcdf59d6ac1a5f57c70c7f0dc9c45e0c4e655d13d24d7c6

Download Submit
\Windows\system\kDOfRDW.exe

Filesize
1.4MB

MD5
b49a54fbb3476348aefc3d0d30999690

SHA1
ee1b86e366c0f7c8799df27ec7024605df9f53e7

SHA256
d5d44aa923a48670c70bf7ca5fd90dd6d1e68c14b9b06e28816c5a2869ad39fc

SHA512
4aca3312772cef7364e5e5e4cf5357fee765aad5e7277597af5fdefd86a909bbbf783b1e851e27aeeaf3b1a81ec098b081e624bb4ebcea269d9f707e6e5fb527

Download Submit
memory/272-5664-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/272-202-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/1644-188-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/1644-219-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/1644-189-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/1644-194-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/1644-185-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/1644-21-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/1644-0-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/1644-195-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/1644-203-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/1644-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1644-197-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1644-192-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/1644-201-0x0000000003500000-0x00000000038F2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-5436-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2420-211-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2460-199-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2460-5883-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2500-5979-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-193-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-196-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2532-5675-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-190-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-5463-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2548-186-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2604-4788-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2604-187-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2656-524-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2656-2079-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

Filesize
9.6MB

Download
memory/2656-23-0x000007FEF61AE000-0x000007FEF61AF000-memory.dmp

Filesize
4KB

Download
memory/2656-481-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2656-181-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

Filesize
9.6MB

Download
memory/2668-5304-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-182-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-5332-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/2728-191-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/2976-208-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2976-5939-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-22-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/3012-5980-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download