xmrig | 0d40cdec1af7d84bd85b29a7d620c1849881f2bc7841596314c8a156f82df3e9

Analysis

max time kernel
122s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
Size 2.2MB
Sample240524-hlqqeagh48
SHA256 0d40cdec1af7d84bd85b29a7d620c1849881f2bc7841596314c8a156f82df3e9
MD5 06aa33f7d91018b6062d4455fb173e60
SHA1 29a293777cc1b0ddbe11a1e3b6a7a4196f182417
SHA512 599cb327c6faeb3e80a3b6758e62085cccacbff0fdaa03c82b7b50aad6d6c6f791358b2e835774d7067b1c5c8d65d5d1489975b7fc1e5dd3fbd6f7b8fcc719c1
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqz:NABu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/4472-218-0x00007FF6C28C0000-0x00007FF6C2CB2000-memory.dmp	xmrig
behavioral2/memory/2788-253-0x00007FF71BC50000-0x00007FF71C042000-memory.dmp	xmrig
behavioral2/memory/4676-444-0x00007FF746FE0000-0x00007FF7473D2000-memory.dmp	xmrig
behavioral2/memory/668-492-0x00007FF6A04E0000-0x00007FF6A08D2000-memory.dmp	xmrig
behavioral2/memory/2176-555-0x00007FF669580000-0x00007FF669972000-memory.dmp	xmrig
behavioral2/memory/1808-443-0x00007FF6C50E0000-0x00007FF6C54D2000-memory.dmp	xmrig
behavioral2/memory/3784-395-0x00007FF6A8630000-0x00007FF6A8A22000-memory.dmp	xmrig
behavioral2/memory/2968-394-0x00007FF74B8F0000-0x00007FF74BCE2000-memory.dmp	xmrig
behavioral2/memory/4172-324-0x00007FF6B5F40000-0x00007FF6B6332000-memory.dmp	xmrig
behavioral2/memory/3980-317-0x00007FF62DD10000-0x00007FF62E102000-memory.dmp	xmrig
behavioral2/memory/5068-316-0x00007FF76E1D0000-0x00007FF76E5C2000-memory.dmp	xmrig
behavioral2/memory/1944-262-0x00007FF770820000-0x00007FF770C12000-memory.dmp	xmrig
behavioral2/memory/3524-261-0x00007FF711510000-0x00007FF711902000-memory.dmp	xmrig
behavioral2/memory/4012-231-0x00007FF7253A0000-0x00007FF725792000-memory.dmp	xmrig
behavioral2/memory/3204-229-0x00007FF708790000-0x00007FF708B82000-memory.dmp	xmrig
behavioral2/memory/792-167-0x00007FF763A50000-0x00007FF763E42000-memory.dmp	xmrig
behavioral2/memory/1208-163-0x00007FF656D20000-0x00007FF657112000-memory.dmp	xmrig
behavioral2/memory/5024-116-0x00007FF764DA0000-0x00007FF765192000-memory.dmp	xmrig
behavioral2/memory/4484-15-0x00007FF6945D0000-0x00007FF6949C2000-memory.dmp	xmrig
behavioral2/memory/4352-4636-0x00007FF721F90000-0x00007FF722382000-memory.dmp	xmrig
behavioral2/memory/5000-4637-0x00007FF7F7A70000-0x00007FF7F7E62000-memory.dmp	xmrig
behavioral2/memory/2384-4640-0x00007FF7E1F80000-0x00007FF7E2372000-memory.dmp	xmrig
behavioral2/memory/2672-4639-0x00007FF6A0470000-0x00007FF6A0862000-memory.dmp	xmrig
behavioral2/memory/1208-4641-0x00007FF656D20000-0x00007FF657112000-memory.dmp	xmrig
behavioral2/memory/3416-4638-0x00007FF6DE1B0000-0x00007FF6DE5A2000-memory.dmp	xmrig
behavioral2/memory/4484-4643-0x00007FF6945D0000-0x00007FF6949C2000-memory.dmp	xmrig
behavioral2/memory/4352-4646-0x00007FF721F90000-0x00007FF722382000-memory.dmp	xmrig
behavioral2/memory/2968-4647-0x00007FF74B8F0000-0x00007FF74BCE2000-memory.dmp	xmrig
behavioral2/memory/5000-4649-0x00007FF7F7A70000-0x00007FF7F7E62000-memory.dmp	xmrig
behavioral2/memory/3416-4655-0x00007FF6DE1B0000-0x00007FF6DE5A2000-memory.dmp	xmrig
behavioral2/memory/4676-4654-0x00007FF746FE0000-0x00007FF7473D2000-memory.dmp	xmrig
behavioral2/memory/5024-4652-0x00007FF764DA0000-0x00007FF765192000-memory.dmp	xmrig
behavioral2/memory/4472-4660-0x00007FF6C28C0000-0x00007FF6C2CB2000-memory.dmp	xmrig
behavioral2/memory/3784-4663-0x00007FF6A8630000-0x00007FF6A8A22000-memory.dmp	xmrig
behavioral2/memory/3524-4681-0x00007FF711510000-0x00007FF711902000-memory.dmp	xmrig
behavioral2/memory/1808-4677-0x00007FF6C50E0000-0x00007FF6C54D2000-memory.dmp	xmrig
behavioral2/memory/1944-4676-0x00007FF770820000-0x00007FF770C12000-memory.dmp	xmrig
behavioral2/memory/2672-4672-0x00007FF6A0470000-0x00007FF6A0862000-memory.dmp	xmrig
behavioral2/memory/792-4680-0x00007FF763A50000-0x00007FF763E42000-memory.dmp	xmrig
behavioral2/memory/4172-4670-0x00007FF6B5F40000-0x00007FF6B6332000-memory.dmp	xmrig
behavioral2/memory/2176-4685-0x00007FF669580000-0x00007FF669972000-memory.dmp	xmrig
behavioral2/memory/4012-4707-0x00007FF7253A0000-0x00007FF725792000-memory.dmp	xmrig
behavioral2/memory/3980-4754-0x00007FF62DD10000-0x00007FF62E102000-memory.dmp	xmrig
behavioral2/memory/668-4683-0x00007FF6A04E0000-0x00007FF6A08D2000-memory.dmp	xmrig
behavioral2/memory/3204-4666-0x00007FF708790000-0x00007FF708B82000-memory.dmp	xmrig
behavioral2/memory/2384-4662-0x00007FF7E1F80000-0x00007FF7E2372000-memory.dmp	xmrig
behavioral2/memory/2788-4658-0x00007FF71BC50000-0x00007FF71C042000-memory.dmp	xmrig
behavioral2/memory/5068-4674-0x00007FF76E1D0000-0x00007FF76E5C2000-memory.dmp	xmrig
behavioral2/memory/1208-4668-0x00007FF656D20000-0x00007FF657112000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4980	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4484	yLUjyDR.exe
4352	jSPyNnB.exe
2968	jWSIiYW.exe
5000	TUcHnZE.exe
3416	RHSJbBO.exe
2672	juSDIPK.exe
3784	tWHkyPi.exe
2384	YljvOap.exe
1808	BHSfCmn.exe
4676	umLceJE.exe
5024	ijaPBrg.exe
1208	bifvUnF.exe
792	IgadNYu.exe
4472	reUIpmQ.exe
668	pqSzPjU.exe
3204	IQeZeqH.exe
4012	JPygTYp.exe
2788	bgZCicH.exe
3524	ktAMKvy.exe
1944	wDwfXlN.exe
5068	AyBHmZY.exe
2176	pCyyXLP.exe
3980	UQBDEgq.exe
4172	YtPknJW.exe
4784	TTvvOaH.exe
3292	TKCYDgN.exe
4520	iCYtHqU.exe
2780	iQPIjBd.exe
4312	EdMxJOg.exe
4112	MDDOULb.exe
3236	UniOzng.exe
3208	aDtMmaW.exe
812	egxDxXg.exe
1140	hejiqDA.exe
4256	kiqXBlS.exe
2860	hWccayd.exe
3000	rHWflgK.exe
3536	sqoUfXn.exe
2928	hGTRaWX.exe
1780	HxNBieg.exe
4820	eFAqLiQ.exe
3144	bzWPwEt.exe
3608	ItAftkx.exe
4292	JYinVNk.exe
1644	NzzDbDe.exe
1836	BrcbwsO.exe
4612	fqEhfdo.exe
1476	vFmqQXH.exe
4252	LsWBATe.exe
1152	GLEIlKE.exe
4828	GLWGxpa.exe
4328	yWfKryE.exe
4324	ILzAprr.exe
3692	yQvTpxT.exe
3624	HNyaYwB.exe
4844	caBKTXm.exe
4456	bmVZQOz.exe
4680	LZbPonr.exe
4744	CuHwWUb.exe
2848	furPNQJ.exe
1064	eWjYyZu.exe
4840	rxqKWEW.exe
1452	pFoFbeQ.exe
4508	jCkVIel.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4064-0-0x00007FF618920000-0x00007FF618D12000-memory.dmp	upx
behavioral2/files/0x0007000000023431-9.dat	upx
behavioral2/files/0x000800000002342d-6.dat	upx
behavioral2/files/0x0007000000023432-8.dat	upx
behavioral2/files/0x0007000000023436-49.dat	upx
behavioral2/files/0x000700000002343d-95.dat	upx
behavioral2/files/0x0007000000023449-136.dat	upx
behavioral2/files/0x0007000000023442-154.dat	upx
behavioral2/memory/4472-218-0x00007FF6C28C0000-0x00007FF6C2CB2000-memory.dmp	upx
behavioral2/memory/2788-253-0x00007FF71BC50000-0x00007FF71C042000-memory.dmp	upx
behavioral2/memory/4676-444-0x00007FF746FE0000-0x00007FF7473D2000-memory.dmp	upx
behavioral2/memory/668-492-0x00007FF6A04E0000-0x00007FF6A08D2000-memory.dmp	upx
behavioral2/memory/2176-555-0x00007FF669580000-0x00007FF669972000-memory.dmp	upx
behavioral2/memory/1808-443-0x00007FF6C50E0000-0x00007FF6C54D2000-memory.dmp	upx
behavioral2/memory/3784-395-0x00007FF6A8630000-0x00007FF6A8A22000-memory.dmp	upx
behavioral2/memory/2968-394-0x00007FF74B8F0000-0x00007FF74BCE2000-memory.dmp	upx
behavioral2/memory/4172-324-0x00007FF6B5F40000-0x00007FF6B6332000-memory.dmp	upx
behavioral2/memory/3980-317-0x00007FF62DD10000-0x00007FF62E102000-memory.dmp	upx
behavioral2/memory/5068-316-0x00007FF76E1D0000-0x00007FF76E5C2000-memory.dmp	upx
behavioral2/memory/1944-262-0x00007FF770820000-0x00007FF770C12000-memory.dmp	upx
behavioral2/memory/3524-261-0x00007FF711510000-0x00007FF711902000-memory.dmp	upx
behavioral2/memory/4012-231-0x00007FF7253A0000-0x00007FF725792000-memory.dmp	upx
behavioral2/memory/3204-229-0x00007FF708790000-0x00007FF708B82000-memory.dmp	upx
behavioral2/files/0x0007000000023456-189.dat	upx
behavioral2/files/0x0007000000023448-187.dat	upx
behavioral2/files/0x0007000000023455-186.dat	upx
behavioral2/files/0x0007000000023451-185.dat	upx
behavioral2/files/0x0007000000023454-184.dat	upx
behavioral2/files/0x0007000000023450-183.dat	upx
behavioral2/files/0x0007000000023453-177.dat	upx
behavioral2/files/0x0007000000023440-175.dat	upx
behavioral2/files/0x000700000002344f-172.dat	upx
behavioral2/files/0x0007000000023445-170.dat	upx
behavioral2/memory/792-167-0x00007FF763A50000-0x00007FF763E42000-memory.dmp	upx
behavioral2/memory/1208-163-0x00007FF656D20000-0x00007FF657112000-memory.dmp	upx
behavioral2/files/0x0007000000023441-149.dat	upx
behavioral2/files/0x000700000002343f-146.dat	upx
behavioral2/files/0x000700000002343e-142.dat	upx
behavioral2/files/0x000700000002344d-140.dat	upx
behavioral2/files/0x000700000002344c-139.dat	upx
behavioral2/files/0x000700000002344b-138.dat	upx
behavioral2/files/0x000700000002344a-137.dat	upx
behavioral2/files/0x000700000002343c-128.dat	upx
behavioral2/files/0x0007000000023447-127.dat	upx
behavioral2/files/0x000700000002343b-126.dat	upx
behavioral2/memory/5024-116-0x00007FF764DA0000-0x00007FF765192000-memory.dmp	upx
behavioral2/memory/2384-113-0x00007FF7E1F80000-0x00007FF7E2372000-memory.dmp	upx
behavioral2/files/0x0007000000023444-108.dat	upx
behavioral2/files/0x0007000000023443-105.dat	upx
behavioral2/files/0x000700000002344e-141.dat	upx
behavioral2/files/0x0007000000023435-123.dat	upx
behavioral2/files/0x0007000000023438-84.dat	upx
behavioral2/files/0x0007000000023446-122.dat	upx
behavioral2/memory/2672-76-0x00007FF6A0470000-0x00007FF6A0862000-memory.dmp	upx
behavioral2/files/0x0007000000023437-61.dat	upx
behavioral2/files/0x000700000002343a-57.dat	upx
behavioral2/memory/3416-50-0x00007FF6DE1B0000-0x00007FF6DE5A2000-memory.dmp	upx
behavioral2/files/0x0007000000023433-43.dat	upx
behavioral2/files/0x0007000000023439-68.dat	upx
behavioral2/files/0x0007000000023434-33.dat	upx
behavioral2/memory/4352-30-0x00007FF721F90000-0x00007FF722382000-memory.dmp	upx
behavioral2/memory/5000-34-0x00007FF7F7A70000-0x00007FF7F7E62000-memory.dmp	upx
behavioral2/memory/4484-15-0x00007FF6945D0000-0x00007FF6949C2000-memory.dmp	upx
behavioral2/memory/4352-4636-0x00007FF721F90000-0x00007FF722382000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yKKlTHO.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\LgQkPxE.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\ioCNnpN.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\pwXzzaz.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\qZPsPzu.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\OVkOnIj.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\ocOLTxs.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\sHbJlrZ.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\NHhaAeu.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\ImsaIal.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\rhQcQhQ.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\kkyiSEp.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\BcLxLhq.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\lzwskko.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\IjwrTGC.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\wtuYMgg.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\eKxFmYt.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\DwzNTBh.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\SandhbV.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\vjOZlop.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\zXMhvab.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\flboyNM.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\BfCGoLE.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\YITFEDW.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\anPhcMo.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\sWRKNFY.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\evLGJZk.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\kDYsyCu.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\kppxmVJ.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\bbcHcIO.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\YEvWUBY.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\CVDUOPy.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\fEuRrCp.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\FfusfPM.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\YcIuRVs.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\EQFETEt.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\dwVHSKP.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\BLpQnBd.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\GkDLznZ.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\cPwtYJI.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\IwpPjAQ.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\NgqqvvX.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\voDerwj.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\hhpaZio.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\ThGpUAI.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\VrCuADB.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\zlZryGr.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\hosCiKP.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\YLJKLCT.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\bqSoygO.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\TKLnLjL.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\gnfyGaC.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\ivmdEic.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\AXSDNks.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\LjPhckk.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\BIgBhjI.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\kaVuDkf.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\kQFQHEm.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\TMuekdz.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\WkxltRt.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\lNnBMwo.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\ChpITSv.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\saJEkFw.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
File created	C:\Windows\System\ExhfjLk.exe	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4980	powershell.exe
4980	powershell.exe
4980	powershell.exe
4980	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
Token: SeDebugPrivilege	4980	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4980	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	86
PID 4064 wrote to memory of 4980	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	86
PID 4064 wrote to memory of 4484	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	87
PID 4064 wrote to memory of 4484	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	87
PID 4064 wrote to memory of 4352	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	88
PID 4064 wrote to memory of 4352	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	88
PID 4064 wrote to memory of 2968	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	89
PID 4064 wrote to memory of 2968	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	89
PID 4064 wrote to memory of 5000	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	90
PID 4064 wrote to memory of 5000	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	90
PID 4064 wrote to memory of 3416	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	91
PID 4064 wrote to memory of 3416	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	91
PID 4064 wrote to memory of 2672	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	92
PID 4064 wrote to memory of 2672	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	92
PID 4064 wrote to memory of 1808	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	93
PID 4064 wrote to memory of 1808	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	93
PID 4064 wrote to memory of 5024	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	94
PID 4064 wrote to memory of 5024	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	94
PID 4064 wrote to memory of 3784	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	95
PID 4064 wrote to memory of 3784	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	95
PID 4064 wrote to memory of 2384	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	96
PID 4064 wrote to memory of 2384	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	96
PID 4064 wrote to memory of 4676	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	97
PID 4064 wrote to memory of 4676	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	97
PID 4064 wrote to memory of 1208	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	98
PID 4064 wrote to memory of 1208	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	98
PID 4064 wrote to memory of 792	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	99
PID 4064 wrote to memory of 792	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	99
PID 4064 wrote to memory of 4472	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	100
PID 4064 wrote to memory of 4472	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	100
PID 4064 wrote to memory of 668	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	101
PID 4064 wrote to memory of 668	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	101
PID 4064 wrote to memory of 3204	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	102
PID 4064 wrote to memory of 3204	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	102
PID 4064 wrote to memory of 4012	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	103
PID 4064 wrote to memory of 4012	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	103
PID 4064 wrote to memory of 2788	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	104
PID 4064 wrote to memory of 2788	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	104
PID 4064 wrote to memory of 3524	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	105
PID 4064 wrote to memory of 3524	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	105
PID 4064 wrote to memory of 1944	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	106
PID 4064 wrote to memory of 1944	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	106
PID 4064 wrote to memory of 5068	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	107
PID 4064 wrote to memory of 5068	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	107
PID 4064 wrote to memory of 2176	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	108
PID 4064 wrote to memory of 2176	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	108
PID 4064 wrote to memory of 3980	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	109
PID 4064 wrote to memory of 3980	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	109
PID 4064 wrote to memory of 4172	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	110
PID 4064 wrote to memory of 4172	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	110
PID 4064 wrote to memory of 4784	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	111
PID 4064 wrote to memory of 4784	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	111
PID 4064 wrote to memory of 3292	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	112
PID 4064 wrote to memory of 3292	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	112
PID 4064 wrote to memory of 4520	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	113
PID 4064 wrote to memory of 4520	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	113
PID 4064 wrote to memory of 2780	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	114
PID 4064 wrote to memory of 2780	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	114
PID 4064 wrote to memory of 4312	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	115
PID 4064 wrote to memory of 4312	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	115
PID 4064 wrote to memory of 4112	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	116
PID 4064 wrote to memory of 4112	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	116
PID 4064 wrote to memory of 3236	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	117
PID 4064 wrote to memory of 3236	4064	06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\06aa33f7d91018b6062d4455fb173e60_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4980
- C:\Windows\System\yLUjyDR.exe
  C:\Windows\System\yLUjyDR.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\jSPyNnB.exe
  C:\Windows\System\jSPyNnB.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\jWSIiYW.exe
  C:\Windows\System\jWSIiYW.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\TUcHnZE.exe
  C:\Windows\System\TUcHnZE.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\RHSJbBO.exe
  C:\Windows\System\RHSJbBO.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\juSDIPK.exe
  C:\Windows\System\juSDIPK.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\BHSfCmn.exe
  C:\Windows\System\BHSfCmn.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\ijaPBrg.exe
  C:\Windows\System\ijaPBrg.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\tWHkyPi.exe
  C:\Windows\System\tWHkyPi.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\YljvOap.exe
  C:\Windows\System\YljvOap.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\umLceJE.exe
  C:\Windows\System\umLceJE.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\bifvUnF.exe
  C:\Windows\System\bifvUnF.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\IgadNYu.exe
  C:\Windows\System\IgadNYu.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\reUIpmQ.exe
  C:\Windows\System\reUIpmQ.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\pqSzPjU.exe
  C:\Windows\System\pqSzPjU.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\IQeZeqH.exe
  C:\Windows\System\IQeZeqH.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\JPygTYp.exe
  C:\Windows\System\JPygTYp.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\bgZCicH.exe
  C:\Windows\System\bgZCicH.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\ktAMKvy.exe
  C:\Windows\System\ktAMKvy.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\wDwfXlN.exe
  C:\Windows\System\wDwfXlN.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\AyBHmZY.exe
  C:\Windows\System\AyBHmZY.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\pCyyXLP.exe
  C:\Windows\System\pCyyXLP.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\UQBDEgq.exe
  C:\Windows\System\UQBDEgq.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\YtPknJW.exe
  C:\Windows\System\YtPknJW.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\TTvvOaH.exe
  C:\Windows\System\TTvvOaH.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\TKCYDgN.exe
  C:\Windows\System\TKCYDgN.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\iCYtHqU.exe
  C:\Windows\System\iCYtHqU.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\iQPIjBd.exe
  C:\Windows\System\iQPIjBd.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\EdMxJOg.exe
  C:\Windows\System\EdMxJOg.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\MDDOULb.exe
  C:\Windows\System\MDDOULb.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\UniOzng.exe
  C:\Windows\System\UniOzng.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\aDtMmaW.exe
  C:\Windows\System\aDtMmaW.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\hejiqDA.exe
  C:\Windows\System\hejiqDA.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\hWccayd.exe
  C:\Windows\System\hWccayd.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\HxNBieg.exe
  C:\Windows\System\HxNBieg.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\egxDxXg.exe
  C:\Windows\System\egxDxXg.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\kiqXBlS.exe
  C:\Windows\System\kiqXBlS.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\rHWflgK.exe
  C:\Windows\System\rHWflgK.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\sqoUfXn.exe
  C:\Windows\System\sqoUfXn.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\hGTRaWX.exe
  C:\Windows\System\hGTRaWX.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\eFAqLiQ.exe
  C:\Windows\System\eFAqLiQ.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\bzWPwEt.exe
  C:\Windows\System\bzWPwEt.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\ItAftkx.exe
  C:\Windows\System\ItAftkx.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\JYinVNk.exe
  C:\Windows\System\JYinVNk.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\NzzDbDe.exe
  C:\Windows\System\NzzDbDe.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\BrcbwsO.exe
  C:\Windows\System\BrcbwsO.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\fqEhfdo.exe
  C:\Windows\System\fqEhfdo.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\vFmqQXH.exe
  C:\Windows\System\vFmqQXH.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\LsWBATe.exe
  C:\Windows\System\LsWBATe.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\GLEIlKE.exe
  C:\Windows\System\GLEIlKE.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\GLWGxpa.exe
  C:\Windows\System\GLWGxpa.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\yWfKryE.exe
  C:\Windows\System\yWfKryE.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\ILzAprr.exe
  C:\Windows\System\ILzAprr.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\yQvTpxT.exe
  C:\Windows\System\yQvTpxT.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\HNyaYwB.exe
  C:\Windows\System\HNyaYwB.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\caBKTXm.exe
  C:\Windows\System\caBKTXm.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\bmVZQOz.exe
  C:\Windows\System\bmVZQOz.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\LZbPonr.exe
  C:\Windows\System\LZbPonr.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\CuHwWUb.exe
  C:\Windows\System\CuHwWUb.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\furPNQJ.exe
  C:\Windows\System\furPNQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\eWjYyZu.exe
  C:\Windows\System\eWjYyZu.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\rxqKWEW.exe
  C:\Windows\System\rxqKWEW.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\pFoFbeQ.exe
  C:\Windows\System\pFoFbeQ.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\jCkVIel.exe
  C:\Windows\System\jCkVIel.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\HcUFNlQ.exe
  C:\Windows\System\HcUFNlQ.exe
  2⤵
  PID:2844
- C:\Windows\System\CHIoIdY.exe
  C:\Windows\System\CHIoIdY.exe
  2⤵
  PID:804
- C:\Windows\System\mBMvcgB.exe
  C:\Windows\System\mBMvcgB.exe
  2⤵
  PID:1368
- C:\Windows\System\nQJTGSs.exe
  C:\Windows\System\nQJTGSs.exe
  2⤵
  PID:4904
- C:\Windows\System\jWYtBbZ.exe
  C:\Windows\System\jWYtBbZ.exe
  2⤵
  PID:1448
- C:\Windows\System\MsSvISZ.exe
  C:\Windows\System\MsSvISZ.exe
  2⤵
  PID:4304
- C:\Windows\System\YXHMFds.exe
  C:\Windows\System\YXHMFds.exe
  2⤵
  PID:2828
- C:\Windows\System\ZNBuUCM.exe
  C:\Windows\System\ZNBuUCM.exe
  2⤵
  PID:1864
- C:\Windows\System\OTpEYHG.exe
  C:\Windows\System\OTpEYHG.exe
  2⤵
  PID:5132
- C:\Windows\System\lgpmCLN.exe
  C:\Windows\System\lgpmCLN.exe
  2⤵
  PID:5156
- C:\Windows\System\BdMrOXJ.exe
  C:\Windows\System\BdMrOXJ.exe
  2⤵
  PID:5180
- C:\Windows\System\EFetHxA.exe
  C:\Windows\System\EFetHxA.exe
  2⤵
  PID:5196
- C:\Windows\System\kHRUFaK.exe
  C:\Windows\System\kHRUFaK.exe
  2⤵
  PID:5220
- C:\Windows\System\CLnBCBm.exe
  C:\Windows\System\CLnBCBm.exe
  2⤵
  PID:5240
- C:\Windows\System\WQOgGls.exe
  C:\Windows\System\WQOgGls.exe
  2⤵
  PID:5260
- C:\Windows\System\NIqWVhL.exe
  C:\Windows\System\NIqWVhL.exe
  2⤵
  PID:5276
- C:\Windows\System\wtXfFVI.exe
  C:\Windows\System\wtXfFVI.exe
  2⤵
  PID:5300
- C:\Windows\System\NQcLhHD.exe
  C:\Windows\System\NQcLhHD.exe
  2⤵
  PID:5324
- C:\Windows\System\cYcIlWj.exe
  C:\Windows\System\cYcIlWj.exe
  2⤵
  PID:5348
- C:\Windows\System\geDuLrI.exe
  C:\Windows\System\geDuLrI.exe
  2⤵
  PID:5380
- C:\Windows\System\wWmIPqD.exe
  C:\Windows\System\wWmIPqD.exe
  2⤵
  PID:5396
- C:\Windows\System\IEuaHIa.exe
  C:\Windows\System\IEuaHIa.exe
  2⤵
  PID:5412
- C:\Windows\System\mOHCrLk.exe
  C:\Windows\System\mOHCrLk.exe
  2⤵
  PID:5432
- C:\Windows\System\qpuxBZb.exe
  C:\Windows\System\qpuxBZb.exe
  2⤵
  PID:5564
- C:\Windows\System\EiZZoRV.exe
  C:\Windows\System\EiZZoRV.exe
  2⤵
  PID:5604
- C:\Windows\System\hQfzbOz.exe
  C:\Windows\System\hQfzbOz.exe
  2⤵
  PID:5620
- C:\Windows\System\lNyVwGb.exe
  C:\Windows\System\lNyVwGb.exe
  2⤵
  PID:5636
- C:\Windows\System\LwTXjaB.exe
  C:\Windows\System\LwTXjaB.exe
  2⤵
  PID:5652
- C:\Windows\System\wmgTMhh.exe
  C:\Windows\System\wmgTMhh.exe
  2⤵
  PID:5668
- C:\Windows\System\XcPsFFf.exe
  C:\Windows\System\XcPsFFf.exe
  2⤵
  PID:5684
- C:\Windows\System\kRVsFbU.exe
  C:\Windows\System\kRVsFbU.exe
  2⤵
  PID:5700
- C:\Windows\System\txQjflS.exe
  C:\Windows\System\txQjflS.exe
  2⤵
  PID:5716
- C:\Windows\System\eWBvOBa.exe
  C:\Windows\System\eWBvOBa.exe
  2⤵
  PID:5732
- C:\Windows\System\xqQCWEo.exe
  C:\Windows\System\xqQCWEo.exe
  2⤵
  PID:5768
- C:\Windows\System\Xravluq.exe
  C:\Windows\System\Xravluq.exe
  2⤵
  PID:5788
- C:\Windows\System\xLzfpLg.exe
  C:\Windows\System\xLzfpLg.exe
  2⤵
  PID:5812
- C:\Windows\System\YeUIHMD.exe
  C:\Windows\System\YeUIHMD.exe
  2⤵
  PID:5828
- C:\Windows\System\nTcmFBT.exe
  C:\Windows\System\nTcmFBT.exe
  2⤵
  PID:5844
- C:\Windows\System\AjUiMrg.exe
  C:\Windows\System\AjUiMrg.exe
  2⤵
  PID:5864
- C:\Windows\System\hQlyyhH.exe
  C:\Windows\System\hQlyyhH.exe
  2⤵
  PID:5892
- C:\Windows\System\QGJrveF.exe
  C:\Windows\System\QGJrveF.exe
  2⤵
  PID:5912
- C:\Windows\System\LjRUHuf.exe
  C:\Windows\System\LjRUHuf.exe
  2⤵
  PID:5936
- C:\Windows\System\miWYIgw.exe
  C:\Windows\System\miWYIgw.exe
  2⤵
  PID:5956
- C:\Windows\System\ogwViVA.exe
  C:\Windows\System\ogwViVA.exe
  2⤵
  PID:5972
- C:\Windows\System\SQdngBj.exe
  C:\Windows\System\SQdngBj.exe
  2⤵
  PID:5996
- C:\Windows\System\erLkkQh.exe
  C:\Windows\System\erLkkQh.exe
  2⤵
  PID:6020
- C:\Windows\System\fuBFWmi.exe
  C:\Windows\System\fuBFWmi.exe
  2⤵
  PID:6044
- C:\Windows\System\mOOtCYd.exe
  C:\Windows\System\mOOtCYd.exe
  2⤵
  PID:6068
- C:\Windows\System\FYlyvDc.exe
  C:\Windows\System\FYlyvDc.exe
  2⤵
  PID:6084
- C:\Windows\System\VtplWas.exe
  C:\Windows\System\VtplWas.exe
  2⤵
  PID:6100
- C:\Windows\System\flVVpAn.exe
  C:\Windows\System\flVVpAn.exe
  2⤵
  PID:6116
- C:\Windows\System\GKskEnV.exe
  C:\Windows\System\GKskEnV.exe
  2⤵
  PID:6132
- C:\Windows\System\nAlvhmY.exe
  C:\Windows\System\nAlvhmY.exe
  2⤵
  PID:4996
- C:\Windows\System\lolCdZp.exe
  C:\Windows\System\lolCdZp.exe
  2⤵
  PID:5176
- C:\Windows\System\DfktSwA.exe
  C:\Windows\System\DfktSwA.exe
  2⤵
  PID:3700
- C:\Windows\System\TiLmSPP.exe
  C:\Windows\System\TiLmSPP.exe
  2⤵
  PID:224
- C:\Windows\System\JdbToyJ.exe
  C:\Windows\System\JdbToyJ.exe
  2⤵
  PID:4480
- C:\Windows\System\TAEccIv.exe
  C:\Windows\System\TAEccIv.exe
  2⤵
  PID:2128
- C:\Windows\System\sOVJFxY.exe
  C:\Windows\System\sOVJFxY.exe
  2⤵
  PID:5124
- C:\Windows\System\BzfLrXK.exe
  C:\Windows\System\BzfLrXK.exe
  2⤵
  PID:4368
- C:\Windows\System\qayCSQn.exe
  C:\Windows\System\qayCSQn.exe
  2⤵
  PID:5140
- C:\Windows\System\YKSJOfW.exe
  C:\Windows\System\YKSJOfW.exe
  2⤵
  PID:5308
- C:\Windows\System\wVqBien.exe
  C:\Windows\System\wVqBien.exe
  2⤵
  PID:5368
- C:\Windows\System\kdHyEQT.exe
  C:\Windows\System\kdHyEQT.exe
  2⤵
  PID:5488
- C:\Windows\System\WXZVFqY.exe
  C:\Windows\System\WXZVFqY.exe
  2⤵
  PID:5356
- C:\Windows\System\uDghOjD.exe
  C:\Windows\System\uDghOjD.exe
  2⤵
  PID:5228
- C:\Windows\System\CyHRMIv.exe
  C:\Windows\System\CyHRMIv.exe
  2⤵
  PID:5784
- C:\Windows\System\pIVBuGO.exe
  C:\Windows\System\pIVBuGO.exe
  2⤵
  PID:5948
- C:\Windows\System\lTjMWMv.exe
  C:\Windows\System\lTjMWMv.exe
  2⤵
  PID:6008
- C:\Windows\System\HOBlVWo.exe
  C:\Windows\System\HOBlVWo.exe
  2⤵
  PID:6168
- C:\Windows\System\VEUGQSz.exe
  C:\Windows\System\VEUGQSz.exe
  2⤵
  PID:6188
- C:\Windows\System\dBqjxKz.exe
  C:\Windows\System\dBqjxKz.exe
  2⤵
  PID:6212
- C:\Windows\System\dRqKWsE.exe
  C:\Windows\System\dRqKWsE.exe
  2⤵
  PID:6236
- C:\Windows\System\wMmUIPR.exe
  C:\Windows\System\wMmUIPR.exe
  2⤵
  PID:6252
- C:\Windows\System\cLWewli.exe
  C:\Windows\System\cLWewli.exe
  2⤵
  PID:6280
- C:\Windows\System\kNJgHVd.exe
  C:\Windows\System\kNJgHVd.exe
  2⤵
  PID:6304
- C:\Windows\System\SrxLLYn.exe
  C:\Windows\System\SrxLLYn.exe
  2⤵
  PID:6324
- C:\Windows\System\lcycNZu.exe
  C:\Windows\System\lcycNZu.exe
  2⤵
  PID:6340
- C:\Windows\System\xOiqrOG.exe
  C:\Windows\System\xOiqrOG.exe
  2⤵
  PID:6360
- C:\Windows\System\eTTqqUs.exe
  C:\Windows\System\eTTqqUs.exe
  2⤵
  PID:6396
- C:\Windows\System\KTjDcgV.exe
  C:\Windows\System\KTjDcgV.exe
  2⤵
  PID:6416
- C:\Windows\System\gCETDiX.exe
  C:\Windows\System\gCETDiX.exe
  2⤵
  PID:6436
- C:\Windows\System\dWiLKJM.exe
  C:\Windows\System\dWiLKJM.exe
  2⤵
  PID:6464
- C:\Windows\System\roNqsTs.exe
  C:\Windows\System\roNqsTs.exe
  2⤵
  PID:6480
- C:\Windows\System\pJENbXq.exe
  C:\Windows\System\pJENbXq.exe
  2⤵
  PID:6508
- C:\Windows\System\WSxIHrK.exe
  C:\Windows\System\WSxIHrK.exe
  2⤵
  PID:6524
- C:\Windows\System\DnYFTEs.exe
  C:\Windows\System\DnYFTEs.exe
  2⤵
  PID:6544
- C:\Windows\System\tgoJKhz.exe
  C:\Windows\System\tgoJKhz.exe
  2⤵
  PID:6608
- C:\Windows\System\HVDnqnw.exe
  C:\Windows\System\HVDnqnw.exe
  2⤵
  PID:6628
- C:\Windows\System\bEsGCFd.exe
  C:\Windows\System\bEsGCFd.exe
  2⤵
  PID:6664
- C:\Windows\System\NOdTGCa.exe
  C:\Windows\System\NOdTGCa.exe
  2⤵
  PID:6688
- C:\Windows\System\axfkfeX.exe
  C:\Windows\System\axfkfeX.exe
  2⤵
  PID:6708
- C:\Windows\System\pWNNuce.exe
  C:\Windows\System\pWNNuce.exe
  2⤵
  PID:6728
- C:\Windows\System\hSvAAJY.exe
  C:\Windows\System\hSvAAJY.exe
  2⤵
  PID:6752
- C:\Windows\System\OkFeIWy.exe
  C:\Windows\System\OkFeIWy.exe
  2⤵
  PID:6776
- C:\Windows\System\VmNdbxC.exe
  C:\Windows\System\VmNdbxC.exe
  2⤵
  PID:6800
- C:\Windows\System\oOPNSVW.exe
  C:\Windows\System\oOPNSVW.exe
  2⤵
  PID:6820
- C:\Windows\System\hdHOBzq.exe
  C:\Windows\System\hdHOBzq.exe
  2⤵
  PID:6848
- C:\Windows\System\rvkReSc.exe
  C:\Windows\System\rvkReSc.exe
  2⤵
  PID:6868
- C:\Windows\System\bdavZeV.exe
  C:\Windows\System\bdavZeV.exe
  2⤵
  PID:6892
- C:\Windows\System\UVkZHLz.exe
  C:\Windows\System\UVkZHLz.exe
  2⤵
  PID:6916
- C:\Windows\System\Rvxmvht.exe
  C:\Windows\System\Rvxmvht.exe
  2⤵
  PID:6936
- C:\Windows\System\LPRdSmM.exe
  C:\Windows\System\LPRdSmM.exe
  2⤵
  PID:6956
- C:\Windows\System\VrorBcC.exe
  C:\Windows\System\VrorBcC.exe
  2⤵
  PID:6980
- C:\Windows\System\BAOBcBr.exe
  C:\Windows\System\BAOBcBr.exe
  2⤵
  PID:7008
- C:\Windows\System\sQvIxBd.exe
  C:\Windows\System\sQvIxBd.exe
  2⤵
  PID:7040
- C:\Windows\System\cggVCYe.exe
  C:\Windows\System\cggVCYe.exe
  2⤵
  PID:7056
- C:\Windows\System\dwzxISF.exe
  C:\Windows\System\dwzxISF.exe
  2⤵
  PID:5924
- C:\Windows\System\ksdhcvv.exe
  C:\Windows\System\ksdhcvv.exe
  2⤵
  PID:5360
- C:\Windows\System\ComfMtC.exe
  C:\Windows\System\ComfMtC.exe
  2⤵
  PID:5440
- C:\Windows\System\ujvFbBy.exe
  C:\Windows\System\ujvFbBy.exe
  2⤵
  PID:5612
- C:\Windows\System\qWMKDiX.exe
  C:\Windows\System\qWMKDiX.exe
  2⤵
  PID:5616
- C:\Windows\System\PgjBWNM.exe
  C:\Windows\System\PgjBWNM.exe
  2⤵
  PID:5648
- C:\Windows\System\MesJQZM.exe
  C:\Windows\System\MesJQZM.exe
  2⤵
  PID:5680
- C:\Windows\System\wyBwkIs.exe
  C:\Windows\System\wyBwkIs.exe
  2⤵
  PID:5712
- C:\Windows\System\gLYGJHl.exe
  C:\Windows\System\gLYGJHl.exe
  2⤵
  PID:5760
- C:\Windows\System\iUUmQWo.exe
  C:\Windows\System\iUUmQWo.exe
  2⤵
  PID:5904
- C:\Windows\System\mBObhsg.exe
  C:\Windows\System\mBObhsg.exe
  2⤵
  PID:5128
- C:\Windows\System\dcZmYal.exe
  C:\Windows\System\dcZmYal.exe
  2⤵
  PID:4624
- C:\Windows\System\WEjiZEz.exe
  C:\Windows\System\WEjiZEz.exe
  2⤵
  PID:5164
- C:\Windows\System\VXpmlsd.exe
  C:\Windows\System\VXpmlsd.exe
  2⤵
  PID:2712
- C:\Windows\System\INvUKQC.exe
  C:\Windows\System\INvUKQC.exe
  2⤵
  PID:5172
- C:\Windows\System\qANxvvA.exe
  C:\Windows\System\qANxvvA.exe
  2⤵
  PID:5344
- C:\Windows\System\izzIBUZ.exe
  C:\Windows\System\izzIBUZ.exe
  2⤵
  PID:6096
- C:\Windows\System\bopTmzc.exe
  C:\Windows\System\bopTmzc.exe
  2⤵
  PID:6176
- C:\Windows\System\ngGhHsI.exe
  C:\Windows\System\ngGhHsI.exe
  2⤵
  PID:6244
- C:\Windows\System\RdDmpcM.exe
  C:\Windows\System\RdDmpcM.exe
  2⤵
  PID:6312
- C:\Windows\System\aKtNMpN.exe
  C:\Windows\System\aKtNMpN.exe
  2⤵
  PID:6392
- C:\Windows\System\wptRitC.exe
  C:\Windows\System\wptRitC.exe
  2⤵
  PID:6504
- C:\Windows\System\LsFCnWm.exe
  C:\Windows\System\LsFCnWm.exe
  2⤵
  PID:6540
- C:\Windows\System\yxwvHQp.exe
  C:\Windows\System\yxwvHQp.exe
  2⤵
  PID:6624
- C:\Windows\System\apRAGsW.exe
  C:\Windows\System\apRAGsW.exe
  2⤵
  PID:6700
- C:\Windows\System\tqYmeFC.exe
  C:\Windows\System\tqYmeFC.exe
  2⤵
  PID:6772
- C:\Windows\System\ZUofDZO.exe
  C:\Windows\System\ZUofDZO.exe
  2⤵
  PID:6844
- C:\Windows\System\hlIltqf.exe
  C:\Windows\System\hlIltqf.exe
  2⤵
  PID:6912
- C:\Windows\System\lsQfhVf.exe
  C:\Windows\System\lsQfhVf.exe
  2⤵
  PID:6952
- C:\Windows\System\vbCohUv.exe
  C:\Windows\System\vbCohUv.exe
  2⤵
  PID:7028
- C:\Windows\System\jiAyNgx.exe
  C:\Windows\System\jiAyNgx.exe
  2⤵
  PID:7048
- C:\Windows\System\BGVotDm.exe
  C:\Windows\System\BGVotDm.exe
  2⤵
  PID:1796
- C:\Windows\System\vYDhjbo.exe
  C:\Windows\System\vYDhjbo.exe
  2⤵
  PID:7188
- C:\Windows\System\MSTZDaa.exe
  C:\Windows\System\MSTZDaa.exe
  2⤵
  PID:7212
- C:\Windows\System\alRXkMT.exe
  C:\Windows\System\alRXkMT.exe
  2⤵
  PID:7228
- C:\Windows\System\vpBincB.exe
  C:\Windows\System\vpBincB.exe
  2⤵
  PID:7248
- C:\Windows\System\lAWtWMj.exe
  C:\Windows\System\lAWtWMj.exe
  2⤵
  PID:7328
- C:\Windows\System\DNjswBE.exe
  C:\Windows\System\DNjswBE.exe
  2⤵
  PID:7344
- C:\Windows\System\MKlCnOu.exe
  C:\Windows\System\MKlCnOu.exe
  2⤵
  PID:7360
- C:\Windows\System\TdOdHIp.exe
  C:\Windows\System\TdOdHIp.exe
  2⤵
  PID:7384
- C:\Windows\System\xHXwmej.exe
  C:\Windows\System\xHXwmej.exe
  2⤵
  PID:7404
- C:\Windows\System\OakZZlY.exe
  C:\Windows\System\OakZZlY.exe
  2⤵
  PID:7428
- C:\Windows\System\OMITEMA.exe
  C:\Windows\System\OMITEMA.exe
  2⤵
  PID:7448
- C:\Windows\System\SxKqgvS.exe
  C:\Windows\System\SxKqgvS.exe
  2⤵
  PID:7468
- C:\Windows\System\dtSJeST.exe
  C:\Windows\System\dtSJeST.exe
  2⤵
  PID:7484
- C:\Windows\System\NEhnlWg.exe
  C:\Windows\System\NEhnlWg.exe
  2⤵
  PID:7508
- C:\Windows\System\WSQfcbD.exe
  C:\Windows\System\WSQfcbD.exe
  2⤵
  PID:7532
- C:\Windows\System\WZSZkWc.exe
  C:\Windows\System\WZSZkWc.exe
  2⤵
  PID:7548
- C:\Windows\System\ZGylbED.exe
  C:\Windows\System\ZGylbED.exe
  2⤵
  PID:7564
- C:\Windows\System\aTzdakr.exe
  C:\Windows\System\aTzdakr.exe
  2⤵
  PID:7580
- C:\Windows\System\CEPNrkD.exe
  C:\Windows\System\CEPNrkD.exe
  2⤵
  PID:7604
- C:\Windows\System\PKImALR.exe
  C:\Windows\System\PKImALR.exe
  2⤵
  PID:7628
- C:\Windows\System\hwfWSIC.exe
  C:\Windows\System\hwfWSIC.exe
  2⤵
  PID:7652
- C:\Windows\System\eSZZLPT.exe
  C:\Windows\System\eSZZLPT.exe
  2⤵
  PID:7676
- C:\Windows\System\CJyGvJN.exe
  C:\Windows\System\CJyGvJN.exe
  2⤵
  PID:7692
- C:\Windows\System\cRUGmHx.exe
  C:\Windows\System\cRUGmHx.exe
  2⤵
  PID:7732
- C:\Windows\System\rkIxOrn.exe
  C:\Windows\System\rkIxOrn.exe
  2⤵
  PID:7772
- C:\Windows\System\ixSVODz.exe
  C:\Windows\System\ixSVODz.exe
  2⤵
  PID:7812
- C:\Windows\System\yEKopDW.exe
  C:\Windows\System\yEKopDW.exe
  2⤵
  PID:7840
- C:\Windows\System\gMVplmZ.exe
  C:\Windows\System\gMVplmZ.exe
  2⤵
  PID:7860
- C:\Windows\System\ZgFzakh.exe
  C:\Windows\System\ZgFzakh.exe
  2⤵
  PID:7884
- C:\Windows\System\sajUdqj.exe
  C:\Windows\System\sajUdqj.exe
  2⤵
  PID:7908
- C:\Windows\System\poFfNQu.exe
  C:\Windows\System\poFfNQu.exe
  2⤵
  PID:7932
- C:\Windows\System\uZBQqQU.exe
  C:\Windows\System\uZBQqQU.exe
  2⤵
  PID:7960
- C:\Windows\System\dztmPFg.exe
  C:\Windows\System\dztmPFg.exe
  2⤵
  PID:7976
- C:\Windows\System\WWKTilW.exe
  C:\Windows\System\WWKTilW.exe
  2⤵
  PID:7996
- C:\Windows\System\oJQwiNo.exe
  C:\Windows\System\oJQwiNo.exe
  2⤵
  PID:8016
- C:\Windows\System\HPEfgjg.exe
  C:\Windows\System\HPEfgjg.exe
  2⤵
  PID:8064
- C:\Windows\System\XgwHqLl.exe
  C:\Windows\System\XgwHqLl.exe
  2⤵
  PID:8092
- C:\Windows\System\DUoIeFl.exe
  C:\Windows\System\DUoIeFl.exe
  2⤵
  PID:8116
- C:\Windows\System\MZkfCkf.exe
  C:\Windows\System\MZkfCkf.exe
  2⤵
  PID:8140
- C:\Windows\System\CowpSXU.exe
  C:\Windows\System\CowpSXU.exe
  2⤵
  PID:8156
- C:\Windows\System\pTsuHsO.exe
  C:\Windows\System\pTsuHsO.exe
  2⤵
  PID:8176
- C:\Windows\System\daNYeNw.exe
  C:\Windows\System\daNYeNw.exe
  2⤵
  PID:6648
- C:\Windows\System\uJPUCIl.exe
  C:\Windows\System\uJPUCIl.exe
  2⤵
  PID:6792
- C:\Windows\System\CyWPDiT.exe
  C:\Windows\System\CyWPDiT.exe
  2⤵
  PID:6900
- C:\Windows\System\qsptysT.exe
  C:\Windows\System\qsptysT.exe
  2⤵
  PID:7064
- C:\Windows\System\FvmTTwa.exe
  C:\Windows\System\FvmTTwa.exe
  2⤵
  PID:572
- C:\Windows\System\mQDrHBW.exe
  C:\Windows\System\mQDrHBW.exe
  2⤵
  PID:2320
- C:\Windows\System\JdbAQOx.exe
  C:\Windows\System\JdbAQOx.exe
  2⤵
  PID:4684
- C:\Windows\System\mwqfQDZ.exe
  C:\Windows\System\mwqfQDZ.exe
  2⤵
  PID:7588
- C:\Windows\System\ExzLTKw.exe
  C:\Windows\System\ExzLTKw.exe
  2⤵
  PID:4496
- C:\Windows\System\RCdaMTc.exe
  C:\Windows\System\RCdaMTc.exe
  2⤵
  PID:5152
- C:\Windows\System\hWcgJwq.exe
  C:\Windows\System\hWcgJwq.exe
  2⤵
  PID:7832
- C:\Windows\System\FaELqyG.exe
  C:\Windows\System\FaELqyG.exe
  2⤵
  PID:7876
- C:\Windows\System\tPsLbiC.exe
  C:\Windows\System\tPsLbiC.exe
  2⤵
  PID:5428
- C:\Windows\System\gUHtGsQ.exe
  C:\Windows\System\gUHtGsQ.exe
  2⤵
  PID:5980
- C:\Windows\System\nfTrEJO.exe
  C:\Windows\System\nfTrEJO.exe
  2⤵
  PID:5676
- C:\Windows\System\aZNEMUo.exe
  C:\Windows\System\aZNEMUo.exe
  2⤵
  PID:5756
- C:\Windows\System\kIeEUHD.exe
  C:\Windows\System\kIeEUHD.exe
  2⤵
  PID:5052
- C:\Windows\System\xOznJyt.exe
  C:\Windows\System\xOznJyt.exe
  2⤵
  PID:832
- C:\Windows\System\sdUGizh.exe
  C:\Windows\System\sdUGizh.exe
  2⤵
  PID:8196
- C:\Windows\System\acQLcVZ.exe
  C:\Windows\System\acQLcVZ.exe
  2⤵
  PID:8212
- C:\Windows\System\wdXooeM.exe
  C:\Windows\System\wdXooeM.exe
  2⤵
  PID:8232
- C:\Windows\System\yjTDFQY.exe
  C:\Windows\System\yjTDFQY.exe
  2⤵
  PID:8252
- C:\Windows\System\BEmhMlO.exe
  C:\Windows\System\BEmhMlO.exe
  2⤵
  PID:8272
- C:\Windows\System\kMhSUoT.exe
  C:\Windows\System\kMhSUoT.exe
  2⤵
  PID:8300
- C:\Windows\System\SXnerZa.exe
  C:\Windows\System\SXnerZa.exe
  2⤵
  PID:8320
- C:\Windows\System\ZiPcftS.exe
  C:\Windows\System\ZiPcftS.exe
  2⤵
  PID:8344
- C:\Windows\System\wnDCUJV.exe
  C:\Windows\System\wnDCUJV.exe
  2⤵
  PID:8368
- C:\Windows\System\kPuYFzX.exe
  C:\Windows\System\kPuYFzX.exe
  2⤵
  PID:8392
- C:\Windows\System\CErOkZo.exe
  C:\Windows\System\CErOkZo.exe
  2⤵
  PID:8416
- C:\Windows\System\BEQAdtN.exe
  C:\Windows\System\BEQAdtN.exe
  2⤵
  PID:8448
- C:\Windows\System\lvbCWsd.exe
  C:\Windows\System\lvbCWsd.exe
  2⤵
  PID:8468
- C:\Windows\System\JlhWAWf.exe
  C:\Windows\System\JlhWAWf.exe
  2⤵
  PID:8484
- C:\Windows\System\sdOUyDN.exe
  C:\Windows\System\sdOUyDN.exe
  2⤵
  PID:8500
- C:\Windows\System\JiCDRbT.exe
  C:\Windows\System\JiCDRbT.exe
  2⤵
  PID:8524
- C:\Windows\System\dDXgNoF.exe
  C:\Windows\System\dDXgNoF.exe
  2⤵
  PID:8552
- C:\Windows\System\xcPXMzj.exe
  C:\Windows\System\xcPXMzj.exe
  2⤵
  PID:8572
- C:\Windows\System\dLWApby.exe
  C:\Windows\System\dLWApby.exe
  2⤵
  PID:8596
- C:\Windows\System\eOJnMSA.exe
  C:\Windows\System\eOJnMSA.exe
  2⤵
  PID:8620
- C:\Windows\System\DnwyUyy.exe
  C:\Windows\System\DnwyUyy.exe
  2⤵
  PID:8640
- C:\Windows\System\yztgIME.exe
  C:\Windows\System\yztgIME.exe
  2⤵
  PID:8664
- C:\Windows\System\HKYdtPM.exe
  C:\Windows\System\HKYdtPM.exe
  2⤵
  PID:8688
- C:\Windows\System\ZqinfwH.exe
  C:\Windows\System\ZqinfwH.exe
  2⤵
  PID:8712
- C:\Windows\System\GZWONDa.exe
  C:\Windows\System\GZWONDa.exe
  2⤵
  PID:8736
- C:\Windows\System\SFXGXbi.exe
  C:\Windows\System\SFXGXbi.exe
  2⤵
  PID:8764
- C:\Windows\System\WriBpaJ.exe
  C:\Windows\System\WriBpaJ.exe
  2⤵
  PID:8792
- C:\Windows\System\YUohzjT.exe
  C:\Windows\System\YUohzjT.exe
  2⤵
  PID:8820
- C:\Windows\System\ZdtCFby.exe
  C:\Windows\System\ZdtCFby.exe
  2⤵
  PID:8844
- C:\Windows\System\WiJXrSA.exe
  C:\Windows\System\WiJXrSA.exe
  2⤵
  PID:8864
- C:\Windows\System\YvVIoGL.exe
  C:\Windows\System\YvVIoGL.exe
  2⤵
  PID:8888
- C:\Windows\System\ycKObXM.exe
  C:\Windows\System\ycKObXM.exe
  2⤵
  PID:8912
- C:\Windows\System\YpxqUlb.exe
  C:\Windows\System\YpxqUlb.exe
  2⤵
  PID:8936
- C:\Windows\System\XYknyLM.exe
  C:\Windows\System\XYknyLM.exe
  2⤵
  PID:8956
- C:\Windows\System\ugzwXpl.exe
  C:\Windows\System\ugzwXpl.exe
  2⤵
  PID:8976
- C:\Windows\System\XZmZUKb.exe
  C:\Windows\System\XZmZUKb.exe
  2⤵
  PID:9000
- C:\Windows\System\qMPvhBm.exe
  C:\Windows\System\qMPvhBm.exe
  2⤵
  PID:9024
- C:\Windows\System\YrrQePV.exe
  C:\Windows\System\YrrQePV.exe
  2⤵
  PID:9048
- C:\Windows\System\FWkDngW.exe
  C:\Windows\System\FWkDngW.exe
  2⤵
  PID:9072
- C:\Windows\System\NqapIrY.exe
  C:\Windows\System\NqapIrY.exe
  2⤵
  PID:9096
- C:\Windows\System\XYMGtrc.exe
  C:\Windows\System\XYMGtrc.exe
  2⤵
  PID:9116
- C:\Windows\System\YEVTAwW.exe
  C:\Windows\System\YEVTAwW.exe
  2⤵
  PID:9140
- C:\Windows\System\uoKFjAY.exe
  C:\Windows\System\uoKFjAY.exe
  2⤵
  PID:9160
- C:\Windows\System\BnWRSQq.exe
  C:\Windows\System\BnWRSQq.exe
  2⤵
  PID:9176
- C:\Windows\System\cRgWyOM.exe
  C:\Windows\System\cRgWyOM.exe
  2⤵
  PID:9192
- C:\Windows\System\VUvTGQh.exe
  C:\Windows\System\VUvTGQh.exe
  2⤵
  PID:9208
- C:\Windows\System\tSsguRw.exe
  C:\Windows\System\tSsguRw.exe
  2⤵
  PID:3592
- C:\Windows\System\whPDcyP.exe
  C:\Windows\System\whPDcyP.exe
  2⤵
  PID:5248
- C:\Windows\System\yoXhyUn.exe
  C:\Windows\System\yoXhyUn.exe
  2⤵
  PID:6160
- C:\Windows\System\GekThJn.exe
  C:\Windows\System\GekThJn.exe
  2⤵
  PID:6260
- C:\Windows\System\qiXAVPd.exe
  C:\Windows\System\qiXAVPd.exe
  2⤵
  PID:6488
- C:\Windows\System\UlxZzuV.exe
  C:\Windows\System\UlxZzuV.exe
  2⤵
  PID:6660
- C:\Windows\System\szymEAo.exe
  C:\Windows\System\szymEAo.exe
  2⤵
  PID:6816
- C:\Windows\System\EtQOoco.exe
  C:\Windows\System\EtQOoco.exe
  2⤵
  PID:7836
- C:\Windows\System\eTSHsCx.exe
  C:\Windows\System\eTSHsCx.exe
  2⤵
  PID:7200
- C:\Windows\System\tsItCVR.exe
  C:\Windows\System\tsItCVR.exe
  2⤵
  PID:7256
- C:\Windows\System\kTUAyeO.exe
  C:\Windows\System\kTUAyeO.exe
  2⤵
  PID:8008
- C:\Windows\System\IIQVLDc.exe
  C:\Windows\System\IIQVLDc.exe
  2⤵
  PID:7560
- C:\Windows\System\wtfaRdQ.exe
  C:\Windows\System\wtfaRdQ.exe
  2⤵
  PID:3496
- C:\Windows\System\qZUULfd.exe
  C:\Windows\System\qZUULfd.exe
  2⤵
  PID:7380
- C:\Windows\System\haPuYFf.exe
  C:\Windows\System\haPuYFf.exe
  2⤵
  PID:7420
- C:\Windows\System\cqBJtKX.exe
  C:\Windows\System\cqBJtKX.exe
  2⤵
  PID:7464
- C:\Windows\System\dTOshhV.exe
  C:\Windows\System\dTOshhV.exe
  2⤵
  PID:7524
- C:\Windows\System\sNdgwBe.exe
  C:\Windows\System\sNdgwBe.exe
  2⤵
  PID:7648
- C:\Windows\System\hyQcTjM.exe
  C:\Windows\System\hyQcTjM.exe
  2⤵
  PID:4320
- C:\Windows\System\jrmehII.exe
  C:\Windows\System\jrmehII.exe
  2⤵
  PID:4216
- C:\Windows\System\UbfpVuC.exe
  C:\Windows\System\UbfpVuC.exe
  2⤵
  PID:3476
- C:\Windows\System\PyFSztb.exe
  C:\Windows\System\PyFSztb.exe
  2⤵
  PID:8152
- C:\Windows\System\zYBhKbS.exe
  C:\Windows\System\zYBhKbS.exe
  2⤵
  PID:8172
- C:\Windows\System\UYLNKLB.exe
  C:\Windows\System\UYLNKLB.exe
  2⤵
  PID:8580
- C:\Windows\System\xelatTZ.exe
  C:\Windows\System\xelatTZ.exe
  2⤵
  PID:7920
- C:\Windows\System\jPBKjUP.exe
  C:\Windows\System\jPBKjUP.exe
  2⤵
  PID:8632
- C:\Windows\System\LSSkGYI.exe
  C:\Windows\System\LSSkGYI.exe
  2⤵
  PID:8680
- C:\Windows\System\jQchLam.exe
  C:\Windows\System\jQchLam.exe
  2⤵
  PID:9232
- C:\Windows\System\AWeJBei.exe
  C:\Windows\System\AWeJBei.exe
  2⤵
  PID:9248
- C:\Windows\System\OJZOnts.exe
  C:\Windows\System\OJZOnts.exe
  2⤵
  PID:9264
- C:\Windows\System\EfSmMbl.exe
  C:\Windows\System\EfSmMbl.exe
  2⤵
  PID:9280
- C:\Windows\System\ssSezts.exe
  C:\Windows\System\ssSezts.exe
  2⤵
  PID:9296
- C:\Windows\System\SaZvqYf.exe
  C:\Windows\System\SaZvqYf.exe
  2⤵
  PID:9316
- C:\Windows\System\LhQgDpg.exe
  C:\Windows\System\LhQgDpg.exe
  2⤵
  PID:9340
- C:\Windows\System\StnjfzC.exe
  C:\Windows\System\StnjfzC.exe
  2⤵
  PID:9368
- C:\Windows\System\KBxJdfu.exe
  C:\Windows\System\KBxJdfu.exe
  2⤵
  PID:9396
- C:\Windows\System\cGbSxvy.exe
  C:\Windows\System\cGbSxvy.exe
  2⤵
  PID:9420
- C:\Windows\System\CoXXvZR.exe
  C:\Windows\System\CoXXvZR.exe
  2⤵
  PID:9436
- C:\Windows\System\IiVObHs.exe
  C:\Windows\System\IiVObHs.exe
  2⤵
  PID:9464
- C:\Windows\System\ZcMEiCj.exe
  C:\Windows\System\ZcMEiCj.exe
  2⤵
  PID:9484
- C:\Windows\System\KMxMPuo.exe
  C:\Windows\System\KMxMPuo.exe
  2⤵
  PID:9516
- C:\Windows\System\TxVyDeZ.exe
  C:\Windows\System\TxVyDeZ.exe
  2⤵
  PID:9536
- C:\Windows\System\gcxMWIJ.exe
  C:\Windows\System\gcxMWIJ.exe
  2⤵
  PID:9568
- C:\Windows\System\knYJXnt.exe
  C:\Windows\System\knYJXnt.exe
  2⤵
  PID:9588
- C:\Windows\System\NDXuzRW.exe
  C:\Windows\System\NDXuzRW.exe
  2⤵
  PID:9624
- C:\Windows\System\mBTQuiU.exe
  C:\Windows\System\mBTQuiU.exe
  2⤵
  PID:9648
- C:\Windows\System\DkMBiIP.exe
  C:\Windows\System\DkMBiIP.exe
  2⤵
  PID:9668
- C:\Windows\System\PJnLtHa.exe
  C:\Windows\System\PJnLtHa.exe
  2⤵
  PID:9696
- C:\Windows\System\msOWgSO.exe
  C:\Windows\System\msOWgSO.exe
  2⤵
  PID:9716
- C:\Windows\System\wESJSZj.exe
  C:\Windows\System\wESJSZj.exe
  2⤵
  PID:9736
- C:\Windows\System\nWYEAmr.exe
  C:\Windows\System\nWYEAmr.exe
  2⤵
  PID:9764
- C:\Windows\System\NilJJrW.exe
  C:\Windows\System\NilJJrW.exe
  2⤵
  PID:9784
- C:\Windows\System\vjaBFCs.exe
  C:\Windows\System\vjaBFCs.exe
  2⤵
  PID:9804
- C:\Windows\System\lFomxZY.exe
  C:\Windows\System\lFomxZY.exe
  2⤵
  PID:9832
- C:\Windows\System\FJakaFE.exe
  C:\Windows\System\FJakaFE.exe
  2⤵
  PID:9852
- C:\Windows\System\JvAvSnL.exe
  C:\Windows\System\JvAvSnL.exe
  2⤵
  PID:9876
- C:\Windows\System\YUwviGo.exe
  C:\Windows\System\YUwviGo.exe
  2⤵
  PID:9900
- C:\Windows\System\sAEraLq.exe
  C:\Windows\System\sAEraLq.exe
  2⤵
  PID:9932
- C:\Windows\System\apgKwQR.exe
  C:\Windows\System\apgKwQR.exe
  2⤵
  PID:9948
- C:\Windows\System\hewCVmH.exe
  C:\Windows\System\hewCVmH.exe
  2⤵
  PID:9976
- C:\Windows\System\HdPrQoB.exe
  C:\Windows\System\HdPrQoB.exe
  2⤵
  PID:10000
- C:\Windows\System\uGJKsgo.exe
  C:\Windows\System\uGJKsgo.exe
  2⤵
  PID:10024
- C:\Windows\System\oEVmVSk.exe
  C:\Windows\System\oEVmVSk.exe
  2⤵
  PID:10040
- C:\Windows\System\rdzZdpd.exe
  C:\Windows\System\rdzZdpd.exe
  2⤵
  PID:10064
- C:\Windows\System\KMAExBr.exe
  C:\Windows\System\KMAExBr.exe
  2⤵
  PID:10088
- C:\Windows\System\lSzfiLX.exe
  C:\Windows\System\lSzfiLX.exe
  2⤵
  PID:10108
- C:\Windows\System\UWPZWoh.exe
  C:\Windows\System\UWPZWoh.exe
  2⤵
  PID:10132
- C:\Windows\System\nelwUOW.exe
  C:\Windows\System\nelwUOW.exe
  2⤵
  PID:10152
- C:\Windows\System\DdUPrnC.exe
  C:\Windows\System\DdUPrnC.exe
  2⤵
  PID:10176
- C:\Windows\System\GIIGFXH.exe
  C:\Windows\System\GIIGFXH.exe
  2⤵
  PID:10200
- C:\Windows\System\oHHcaWQ.exe
  C:\Windows\System\oHHcaWQ.exe
  2⤵
  PID:10220
- C:\Windows\System\lSHCIXT.exe
  C:\Windows\System\lSHCIXT.exe
  2⤵
  PID:4836
- C:\Windows\System\BQeNvts.exe
  C:\Windows\System\BQeNvts.exe
  2⤵
  PID:6684
- C:\Windows\System\sbflhMA.exe
  C:\Windows\System\sbflhMA.exe
  2⤵
  PID:8004
- C:\Windows\System\hHYAwfD.exe
  C:\Windows\System\hHYAwfD.exe
  2⤵
  PID:9040
- C:\Windows\System\YbHWmll.exe
  C:\Windows\System\YbHWmll.exe
  2⤵
  PID:8060
- C:\Windows\System\eEKaPmv.exe
  C:\Windows\System\eEKaPmv.exe
  2⤵
  PID:8124
- C:\Windows\System\pJudgaL.exe
  C:\Windows\System\pJudgaL.exe
  2⤵
  PID:8352
- C:\Windows\System\TvRVjyv.exe
  C:\Windows\System\TvRVjyv.exe
  2⤵
  PID:8508
- C:\Windows\System\tDkgMyU.exe
  C:\Windows\System\tDkgMyU.exe
  2⤵
  PID:7416
- C:\Windows\System\itwQZfe.exe
  C:\Windows\System\itwQZfe.exe
  2⤵
  PID:6760
- C:\Windows\System\mrfeDek.exe
  C:\Windows\System\mrfeDek.exe
  2⤵
  PID:7900
- C:\Windows\System\NXLyqdd.exe
  C:\Windows\System\NXLyqdd.exe
  2⤵
  PID:7972
- C:\Windows\System\WwNoJMi.exe
  C:\Windows\System\WwNoJMi.exe
  2⤵
  PID:8700
- C:\Windows\System\iWCnpAm.exe
  C:\Windows\System\iWCnpAm.exe
  2⤵
  PID:2184
- C:\Windows\System\XTYFUKS.exe
  C:\Windows\System\XTYFUKS.exe
  2⤵
  PID:9272
- C:\Windows\System\RiawnSZ.exe
  C:\Windows\System\RiawnSZ.exe
  2⤵
  PID:9432
- C:\Windows\System\WQwhQzc.exe
  C:\Windows\System\WQwhQzc.exe
  2⤵
  PID:8992
- C:\Windows\System\ZvIhqmM.exe
  C:\Windows\System\ZvIhqmM.exe
  2⤵
  PID:9016
- C:\Windows\System\UIjFItt.exe
  C:\Windows\System\UIjFItt.exe
  2⤵
  PID:9064
- C:\Windows\System\pNEeFpw.exe
  C:\Windows\System\pNEeFpw.exe
  2⤵
  PID:9092
- C:\Windows\System\TjwyaqB.exe
  C:\Windows\System\TjwyaqB.exe
  2⤵
  PID:5664
- C:\Windows\System\FVVxzmy.exe
  C:\Windows\System\FVVxzmy.exe
  2⤵
  PID:10444
- C:\Windows\System\PDnKOYC.exe
  C:\Windows\System\PDnKOYC.exe
  2⤵
  PID:10468
- C:\Windows\System\DdmeIXI.exe
  C:\Windows\System\DdmeIXI.exe
  2⤵
  PID:10492
- C:\Windows\System\yXzmXeD.exe
  C:\Windows\System\yXzmXeD.exe
  2⤵
  PID:10516
- C:\Windows\System\JRaUUOQ.exe
  C:\Windows\System\JRaUUOQ.exe
  2⤵
  PID:10532
- C:\Windows\System\bsSWaov.exe
  C:\Windows\System\bsSWaov.exe
  2⤵
  PID:10556
- C:\Windows\System\RjzDRMw.exe
  C:\Windows\System\RjzDRMw.exe
  2⤵
  PID:10580
- C:\Windows\System\bAsllYx.exe
  C:\Windows\System\bAsllYx.exe
  2⤵
  PID:10604
- C:\Windows\System\GSnZeVs.exe
  C:\Windows\System\GSnZeVs.exe
  2⤵
  PID:10624
- C:\Windows\System\vhMdogV.exe
  C:\Windows\System\vhMdogV.exe
  2⤵
  PID:10648
- C:\Windows\System\fcuFsbB.exe
  C:\Windows\System\fcuFsbB.exe
  2⤵
  PID:10672
- C:\Windows\System\bZaJQzc.exe
  C:\Windows\System\bZaJQzc.exe
  2⤵
  PID:10696
- C:\Windows\System\hwlCXeD.exe
  C:\Windows\System\hwlCXeD.exe
  2⤵
  PID:10716
- C:\Windows\System\TXfaovd.exe
  C:\Windows\System\TXfaovd.exe
  2⤵
  PID:10740
- C:\Windows\System\kuiLrPl.exe
  C:\Windows\System\kuiLrPl.exe
  2⤵
  PID:10760
- C:\Windows\System\KQrHaan.exe
  C:\Windows\System\KQrHaan.exe
  2⤵
  PID:10784
- C:\Windows\System\eEklCFs.exe
  C:\Windows\System\eEklCFs.exe
  2⤵
  PID:10808
- C:\Windows\System\lkcFolR.exe
  C:\Windows\System\lkcFolR.exe
  2⤵
  PID:10832
- C:\Windows\System\uFZnCUs.exe
  C:\Windows\System\uFZnCUs.exe
  2⤵
  PID:10848
- C:\Windows\System\MIsssXZ.exe
  C:\Windows\System\MIsssXZ.exe
  2⤵
  PID:10872
- C:\Windows\System\qPgPrqx.exe
  C:\Windows\System\qPgPrqx.exe
  2⤵
  PID:10900
- C:\Windows\System\JROmeFs.exe
  C:\Windows\System\JROmeFs.exe
  2⤵
  PID:10924
- C:\Windows\System\MTsbYdl.exe
  C:\Windows\System\MTsbYdl.exe
  2⤵
  PID:10944
- C:\Windows\System\DxvGGvo.exe
  C:\Windows\System\DxvGGvo.exe
  2⤵
  PID:10972
- C:\Windows\System\nRacEtF.exe
  C:\Windows\System\nRacEtF.exe
  2⤵
  PID:10996
- C:\Windows\System\drAvFwY.exe
  C:\Windows\System\drAvFwY.exe
  2⤵
  PID:11020
- C:\Windows\System\aMbJWJR.exe
  C:\Windows\System\aMbJWJR.exe
  2⤵
  PID:11044
- C:\Windows\System\RfqoDoA.exe
  C:\Windows\System\RfqoDoA.exe
  2⤵
  PID:11064
- C:\Windows\System\scKuEFf.exe
  C:\Windows\System\scKuEFf.exe
  2⤵
  PID:11088
- C:\Windows\System\WVdrpVx.exe
  C:\Windows\System\WVdrpVx.exe
  2⤵
  PID:11116
- C:\Windows\System\neoIOMg.exe
  C:\Windows\System\neoIOMg.exe
  2⤵
  PID:11140
- C:\Windows\System\YvsUoLc.exe
  C:\Windows\System\YvsUoLc.exe
  2⤵
  PID:11160
- C:\Windows\System\DerBejg.exe
  C:\Windows\System\DerBejg.exe
  2⤵
  PID:11184
- C:\Windows\System\YLuWlLS.exe
  C:\Windows\System\YLuWlLS.exe
  2⤵
  PID:11204
- C:\Windows\System\HFcBXOH.exe
  C:\Windows\System\HFcBXOH.exe
  2⤵
  PID:11224
- C:\Windows\System\QmtQddj.exe
  C:\Windows\System\QmtQddj.exe
  2⤵
  PID:11248
- C:\Windows\System\ckCDaxV.exe
  C:\Windows\System\ckCDaxV.exe
  2⤵
  PID:1280
- C:\Windows\System\tOWzJBd.exe
  C:\Windows\System\tOWzJBd.exe
  2⤵
  PID:8228
- C:\Windows\System\hofpPzw.exe
  C:\Windows\System\hofpPzw.exe
  2⤵
  PID:8288
- C:\Windows\System\VgnEwvJ.exe
  C:\Windows\System\VgnEwvJ.exe
  2⤵
  PID:8428
- C:\Windows\System\CUcyOyE.exe
  C:\Windows\System\CUcyOyE.exe
  2⤵
  PID:8464
- C:\Windows\System\yyGGyUe.exe
  C:\Windows\System\yyGGyUe.exe
  2⤵
  PID:7340
- C:\Windows\System\VWiBKhn.exe
  C:\Windows\System\VWiBKhn.exe
  2⤵
  PID:9800
- C:\Windows\System\EPFMYth.exe
  C:\Windows\System\EPFMYth.exe
  2⤵
  PID:9868
- C:\Windows\System\EPBzApY.exe
  C:\Windows\System\EPBzApY.exe
  2⤵
  PID:6600
- C:\Windows\System\SBRdICJ.exe
  C:\Windows\System\SBRdICJ.exe
  2⤵
  PID:9224
- C:\Windows\System\toYNCVG.exe
  C:\Windows\System\toYNCVG.exe
  2⤵
  PID:8744
- C:\Windows\System\RlqaEbx.exe
  C:\Windows\System\RlqaEbx.exe
  2⤵
  PID:9276
- C:\Windows\System\HLFTOdY.exe
  C:\Windows\System\HLFTOdY.exe
  2⤵
  PID:9312
- C:\Windows\System\cLpqaMc.exe
  C:\Windows\System\cLpqaMc.exe
  2⤵
  PID:8836
- C:\Windows\System\mTtvwTY.exe
  C:\Windows\System\mTtvwTY.exe
  2⤵
  PID:8884
- C:\Windows\System\IQmHnRi.exe
  C:\Windows\System\IQmHnRi.exe
  2⤵
  PID:8920
- C:\Windows\System\DtjfzIC.exe
  C:\Windows\System\DtjfzIC.exe
  2⤵
  PID:8952
- C:\Windows\System\COstfdU.exe
  C:\Windows\System\COstfdU.exe
  2⤵
  PID:9504
- C:\Windows\System\PNCeYBE.exe
  C:\Windows\System\PNCeYBE.exe
  2⤵
  PID:8520
- C:\Windows\System\VbedEIT.exe
  C:\Windows\System\VbedEIT.exe
  2⤵
  PID:9124
- C:\Windows\System\eQByPUE.exe
  C:\Windows\System\eQByPUE.exe
  2⤵
  PID:7764
- C:\Windows\System\ZSkvfbM.exe
  C:\Windows\System\ZSkvfbM.exe
  2⤵
  PID:11284
- C:\Windows\System\saQDmwQ.exe
  C:\Windows\System\saQDmwQ.exe
  2⤵
  PID:11304
- C:\Windows\System\DkBRfuJ.exe
  C:\Windows\System\DkBRfuJ.exe
  2⤵
  PID:11324
- C:\Windows\System\xuYkFEO.exe
  C:\Windows\System\xuYkFEO.exe
  2⤵
  PID:11348
- C:\Windows\System\XGMNmMV.exe
  C:\Windows\System\XGMNmMV.exe
  2⤵
  PID:11372
- C:\Windows\System\tMhuMnF.exe
  C:\Windows\System\tMhuMnF.exe
  2⤵
  PID:11392
- C:\Windows\System\IZlBBWT.exe
  C:\Windows\System\IZlBBWT.exe
  2⤵
  PID:11408
- C:\Windows\System\wXbfhUf.exe
  C:\Windows\System\wXbfhUf.exe
  2⤵
  PID:11432
- C:\Windows\System\ePXCFkA.exe
  C:\Windows\System\ePXCFkA.exe
  2⤵
  PID:11452
- C:\Windows\System\klAEDzf.exe
  C:\Windows\System\klAEDzf.exe
  2⤵
  PID:11472
- C:\Windows\System\eSUUXIM.exe
  C:\Windows\System\eSUUXIM.exe
  2⤵
  PID:11492
- C:\Windows\System\NmhZRAs.exe
  C:\Windows\System\NmhZRAs.exe
  2⤵
  PID:11516
- C:\Windows\System\aucihSL.exe
  C:\Windows\System\aucihSL.exe
  2⤵
  PID:11540
- C:\Windows\System\DdjsggU.exe
  C:\Windows\System\DdjsggU.exe
  2⤵
  PID:11568
- C:\Windows\System\JmCFLhg.exe
  C:\Windows\System\JmCFLhg.exe
  2⤵
  PID:11960
- C:\Windows\System\iBryMUD.exe
  C:\Windows\System\iBryMUD.exe
  2⤵
  PID:11976
- C:\Windows\System\xTKfIXt.exe
  C:\Windows\System\xTKfIXt.exe
  2⤵
  PID:12000
- C:\Windows\System\ufCjUEe.exe
  C:\Windows\System\ufCjUEe.exe
  2⤵
  PID:12040
- C:\Windows\System\kiMrDBu.exe
  C:\Windows\System\kiMrDBu.exe
  2⤵
  PID:12060
- C:\Windows\System\kNOrOOC.exe
  C:\Windows\System\kNOrOOC.exe
  2⤵
  PID:12076
- C:\Windows\System\WJBfKai.exe
  C:\Windows\System\WJBfKai.exe
  2⤵
  PID:12112
- C:\Windows\System\DBIzCxr.exe
  C:\Windows\System\DBIzCxr.exe
  2⤵
  PID:12136
- C:\Windows\System\xrsNHie.exe
  C:\Windows\System\xrsNHie.exe
  2⤵
  PID:12160
- C:\Windows\System\qhoRFff.exe
  C:\Windows\System\qhoRFff.exe
  2⤵
  PID:12176
- C:\Windows\System\NJqxEoO.exe
  C:\Windows\System\NJqxEoO.exe
  2⤵
  PID:12192
- C:\Windows\System\tPcgNRs.exe
  C:\Windows\System\tPcgNRs.exe
  2⤵
  PID:12208
- C:\Windows\System\izcicoG.exe
  C:\Windows\System\izcicoG.exe
  2⤵
  PID:12224
- C:\Windows\System\CXYzIev.exe
  C:\Windows\System\CXYzIev.exe
  2⤵
  PID:12240
- C:\Windows\System\JqtQnnr.exe
  C:\Windows\System\JqtQnnr.exe
  2⤵
  PID:12256
- C:\Windows\System\gcWcqCA.exe
  C:\Windows\System\gcWcqCA.exe
  2⤵
  PID:12284
- C:\Windows\System\yTKjSHh.exe
  C:\Windows\System\yTKjSHh.exe
  2⤵
  PID:8972
- C:\Windows\System\FEtkomr.exe
  C:\Windows\System\FEtkomr.exe
  2⤵
  PID:9080
- C:\Windows\System\sDxaILU.exe
  C:\Windows\System\sDxaILU.exe
  2⤵
  PID:10248
- C:\Windows\System\jRqhFeq.exe
  C:\Windows\System\jRqhFeq.exe
  2⤵
  PID:10276
- C:\Windows\System\zUWpgoV.exe
  C:\Windows\System\zUWpgoV.exe
  2⤵
  PID:10300
- C:\Windows\System\xyqAggN.exe
  C:\Windows\System\xyqAggN.exe
  2⤵
  PID:10328
- C:\Windows\System\LzWHRpu.exe
  C:\Windows\System\LzWHRpu.exe
  2⤵
  PID:10348
- C:\Windows\System\nbnWeSs.exe
  C:\Windows\System\nbnWeSs.exe
  2⤵
  PID:10368
- C:\Windows\System\vpadqBE.exe
  C:\Windows\System\vpadqBE.exe
  2⤵
  PID:10392
- C:\Windows\System\aWzFlUj.exe
  C:\Windows\System\aWzFlUj.exe
  2⤵
  PID:4288
- C:\Windows\System\nvNZdTQ.exe
  C:\Windows\System\nvNZdTQ.exe
  2⤵
  PID:6204
- C:\Windows\System\AhJzfCK.exe
  C:\Windows\System\AhJzfCK.exe
  2⤵
  PID:6588
- C:\Windows\System\rvMxKnb.exe
  C:\Windows\System\rvMxKnb.exe
  2⤵
  PID:6948
- C:\Windows\System\WntNDRE.exe
  C:\Windows\System\WntNDRE.exe
  2⤵
  PID:10564
- C:\Windows\System\nPSNZWU.exe
  C:\Windows\System\nPSNZWU.exe
  2⤵
  PID:10632
- C:\Windows\System\QvrLIHx.exe
  C:\Windows\System\QvrLIHx.exe
  2⤵
  PID:9744
- C:\Windows\System\LdvowYL.exe
  C:\Windows\System\LdvowYL.exe
  2⤵
  PID:7444
- C:\Windows\System\QkADSfo.exe
  C:\Windows\System\QkADSfo.exe
  2⤵
  PID:9872
- C:\Windows\System\elMtRdj.exe
  C:\Windows\System\elMtRdj.exe
  2⤵
  PID:7704
- C:\Windows\System\iPmsarV.exe
  C:\Windows\System\iPmsarV.exe
  2⤵
  PID:8364
- C:\Windows\System\yNWzeoM.exe
  C:\Windows\System\yNWzeoM.exe
  2⤵
  PID:4360
- C:\Windows\System\cUNQslr.exe
  C:\Windows\System\cUNQslr.exe
  2⤵
  PID:1144
- C:\Windows\System\ywvDceP.exe
  C:\Windows\System\ywvDceP.exe
  2⤵
  PID:1692
- C:\Windows\System\jhvIEuX.exe
  C:\Windows\System\jhvIEuX.exe
  2⤵
  PID:10880
- C:\Windows\System\GFAMQEV.exe
  C:\Windows\System\GFAMQEV.exe
  2⤵
  PID:7928
- C:\Windows\System\apfxGui.exe
  C:\Windows\System\apfxGui.exe
  2⤵
  PID:10016
- C:\Windows\System\YbSKIzE.exe
  C:\Windows\System\YbSKIzE.exe
  2⤵
  PID:10032
- C:\Windows\System\ilSYYoT.exe
  C:\Windows\System\ilSYYoT.exe
  2⤵
  PID:10056
- C:\Windows\System\OlBEaRy.exe
  C:\Windows\System\OlBEaRy.exe
  2⤵
  PID:11100
- C:\Windows\System\FfkpwvH.exe
  C:\Windows\System\FfkpwvH.exe
  2⤵
  PID:11156
- C:\Windows\System\ttNJIya.exe
  C:\Windows\System\ttNJIya.exe
  2⤵
  PID:9388
- C:\Windows\System\cyEjAjg.exe
  C:\Windows\System\cyEjAjg.exe
  2⤵
  PID:3076
- C:\Windows\System\MkIthQJ.exe
  C:\Windows\System\MkIthQJ.exe
  2⤵
  PID:8728
- C:\Windows\System\KnImFHL.exe
  C:\Windows\System\KnImFHL.exe
  2⤵
  PID:1404
- C:\Windows\System\DbiohdV.exe
  C:\Windows\System\DbiohdV.exe
  2⤵
  PID:11280
- C:\Windows\System\PgjYkvS.exe
  C:\Windows\System\PgjYkvS.exe
  2⤵
  PID:11320
- C:\Windows\System\jRxjuvc.exe
  C:\Windows\System\jRxjuvc.exe
  2⤵
  PID:11484
- C:\Windows\System\eUTdrzA.exe
  C:\Windows\System\eUTdrzA.exe
  2⤵
  PID:9656
- C:\Windows\System\JXdOsZW.exe
  C:\Windows\System\JXdOsZW.exe
  2⤵
  PID:1516
- C:\Windows\System\IfybkBE.exe
  C:\Windows\System\IfybkBE.exe
  2⤵
  PID:11684
- C:\Windows\System\JAUkeuZ.exe
  C:\Windows\System\JAUkeuZ.exe
  2⤵
  PID:11708
- C:\Windows\System\mSlRcwu.exe
  C:\Windows\System\mSlRcwu.exe
  2⤵
  PID:10592
- C:\Windows\System\NGxpmsx.exe
  C:\Windows\System\NGxpmsx.exe
  2⤵
  PID:11780
- C:\Windows\System\UgIiMrG.exe
  C:\Windows\System\UgIiMrG.exe
  2⤵
  PID:10712
- C:\Windows\System\ZZkncZf.exe
  C:\Windows\System\ZZkncZf.exe
  2⤵
  PID:9924
- C:\Windows\System\VeFUoqc.exe
  C:\Windows\System\VeFUoqc.exe
  2⤵
  PID:10816
- C:\Windows\System\kNFeVud.exe
  C:\Windows\System\kNFeVud.exe
  2⤵
  PID:12304
- C:\Windows\System\Agamktu.exe
  C:\Windows\System\Agamktu.exe
  2⤵
  PID:12320
- C:\Windows\System\IVoUIuO.exe
  C:\Windows\System\IVoUIuO.exe
  2⤵
  PID:12336
- C:\Windows\System\lxbjmuo.exe
  C:\Windows\System\lxbjmuo.exe
  2⤵
  PID:12352
- C:\Windows\System\vcVUrWF.exe
  C:\Windows\System\vcVUrWF.exe
  2⤵
  PID:12368
- C:\Windows\System\lNrwXYu.exe
  C:\Windows\System\lNrwXYu.exe
  2⤵
  PID:12384
- C:\Windows\System\vHRHrau.exe
  C:\Windows\System\vHRHrau.exe
  2⤵
  PID:12404
- C:\Windows\System\AVJMEux.exe
  C:\Windows\System\AVJMEux.exe
  2⤵
  PID:12428
- C:\Windows\System\EEXykLN.exe
  C:\Windows\System\EEXykLN.exe
  2⤵
  PID:12456
- C:\Windows\System\JNxwBQn.exe
  C:\Windows\System\JNxwBQn.exe
  2⤵
  PID:12488
- C:\Windows\System\EcGBHej.exe
  C:\Windows\System\EcGBHej.exe
  2⤵
  PID:12524
- C:\Windows\System\MVQdBLM.exe
  C:\Windows\System\MVQdBLM.exe
  2⤵
  PID:12544
- C:\Windows\System\lcihPbm.exe
  C:\Windows\System\lcihPbm.exe
  2⤵
  PID:12572
- C:\Windows\System\ZYUNWGv.exe
  C:\Windows\System\ZYUNWGv.exe
  2⤵
  PID:12596
- C:\Windows\System\sOgxAMV.exe
  C:\Windows\System\sOgxAMV.exe
  2⤵
  PID:12620
- C:\Windows\System\SWWXFGd.exe
  C:\Windows\System\SWWXFGd.exe
  2⤵
  PID:12648
- C:\Windows\System\fnwKkrU.exe
  C:\Windows\System\fnwKkrU.exe
  2⤵
  PID:12680
- C:\Windows\System\iyppvlt.exe
  C:\Windows\System\iyppvlt.exe
  2⤵
  PID:12700
- C:\Windows\System\eMQLwvC.exe
  C:\Windows\System\eMQLwvC.exe
  2⤵
  PID:12728
- C:\Windows\System\FqvAhis.exe
  C:\Windows\System\FqvAhis.exe
  2⤵
  PID:12748
- C:\Windows\System\VhwJyLU.exe
  C:\Windows\System\VhwJyLU.exe
  2⤵
  PID:12764
- C:\Windows\System\JIvQKjW.exe
  C:\Windows\System\JIvQKjW.exe
  2⤵
  PID:12788
- C:\Windows\System\AQDEGLk.exe
  C:\Windows\System\AQDEGLk.exe
  2⤵
  PID:12812
- C:\Windows\System\avrpoTv.exe
  C:\Windows\System\avrpoTv.exe
  2⤵
  PID:12836
- C:\Windows\System\uQvRRAQ.exe
  C:\Windows\System\uQvRRAQ.exe
  2⤵
  PID:12860
- C:\Windows\System\pUapCKS.exe
  C:\Windows\System\pUapCKS.exe
  2⤵
  PID:12880
- C:\Windows\System\uuuSmfU.exe
  C:\Windows\System\uuuSmfU.exe
  2⤵
  PID:12904
- C:\Windows\System\fjPecbN.exe
  C:\Windows\System\fjPecbN.exe
  2⤵
  PID:12920
- C:\Windows\System\utBccfB.exe
  C:\Windows\System\utBccfB.exe
  2⤵
  PID:12936
- C:\Windows\System\RKUUiKo.exe
  C:\Windows\System\RKUUiKo.exe
  2⤵
  PID:12952
- C:\Windows\System\mYqyPXI.exe
  C:\Windows\System\mYqyPXI.exe
  2⤵
  PID:12976
- C:\Windows\System\gnWWVhq.exe
  C:\Windows\System\gnWWVhq.exe
  2⤵
  PID:12996
- C:\Windows\System\kIYRlJt.exe
  C:\Windows\System\kIYRlJt.exe
  2⤵
  PID:13024
- C:\Windows\System\WNeaeKH.exe
  C:\Windows\System\WNeaeKH.exe
  2⤵
  PID:13048
- C:\Windows\System\azlCmVN.exe
  C:\Windows\System\azlCmVN.exe
  2⤵
  PID:13072
- C:\Windows\System\cEMJPqC.exe
  C:\Windows\System\cEMJPqC.exe
  2⤵
  PID:13096
- C:\Windows\System\qLZkrXF.exe
  C:\Windows\System\qLZkrXF.exe
  2⤵
  PID:13120
- C:\Windows\System\kSsXLeT.exe
  C:\Windows\System\kSsXLeT.exe
  2⤵
  PID:13136
- C:\Windows\System\naMzwWM.exe
  C:\Windows\System\naMzwWM.exe
  2⤵
  PID:13160
- C:\Windows\System\BbSPTda.exe
  C:\Windows\System\BbSPTda.exe
  2⤵
  PID:13184
- C:\Windows\System\ZqRqhwK.exe
  C:\Windows\System\ZqRqhwK.exe
  2⤵
  PID:13204
- C:\Windows\System\BriwXMi.exe
  C:\Windows\System\BriwXMi.exe
  2⤵
  PID:13228
- C:\Windows\System\MXfXMut.exe
  C:\Windows\System\MXfXMut.exe
  2⤵
  PID:13256
- C:\Windows\System\wAwFGqe.exe
  C:\Windows\System\wAwFGqe.exe
  2⤵
  PID:13276
- C:\Windows\System\MiFBwaA.exe
  C:\Windows\System\MiFBwaA.exe
  2⤵
  PID:13304
- C:\Windows\System\eFtUCNP.exe
  C:\Windows\System\eFtUCNP.exe
  2⤵
  PID:10008
- C:\Windows\System\jCvefYA.exe
  C:\Windows\System\jCvefYA.exe
  2⤵
  PID:2216
- C:\Windows\System\QPeufpn.exe
  C:\Windows\System\QPeufpn.exe
  2⤵
  PID:11996
- C:\Windows\System\TYOrFut.exe
  C:\Windows\System\TYOrFut.exe
  2⤵
  PID:10144
- C:\Windows\System\QXrRYjC.exe
  C:\Windows\System\QXrRYjC.exe
  2⤵
  PID:10208
- C:\Windows\System\UbYIUwC.exe
  C:\Windows\System\UbYIUwC.exe
  2⤵
  PID:11132
- C:\Windows\System\qRRwKBy.exe
  C:\Windows\System\qRRwKBy.exe
  2⤵
  PID:4772
- C:\Windows\System\eCPNMoN.exe
  C:\Windows\System\eCPNMoN.exe
  2⤵
  PID:10432
- C:\Windows\System\XuFyidv.exe
  C:\Windows\System\XuFyidv.exe
  2⤵
  PID:10500
- C:\Windows\System\fFWdkaK.exe
  C:\Windows\System\fFWdkaK.exe
  2⤵
  PID:10464
- C:\Windows\System\IjMPGsn.exe
  C:\Windows\System\IjMPGsn.exe
  2⤵
  PID:10572
- C:\Windows\System\CMJLkHE.exe
  C:\Windows\System\CMJLkHE.exe
  2⤵
  PID:10688
- C:\Windows\System\UdiLUrh.exe
  C:\Windows\System\UdiLUrh.exe
  2⤵
  PID:12820
- C:\Windows\System\HCVmnDU.exe
  C:\Windows\System\HCVmnDU.exe
  2⤵
  PID:9204
- C:\Windows\System\WszATAw.exe
  C:\Windows\System\WszATAw.exe
  2⤵
  PID:10360
- C:\Windows\System\DPQdHSx.exe
  C:\Windows\System\DPQdHSx.exe
  2⤵
  PID:2420
- C:\Windows\System\gUYDLgt.exe
  C:\Windows\System\gUYDLgt.exe
  2⤵
  PID:12784
- C:\Windows\System\KlMVMGp.exe
  C:\Windows\System\KlMVMGp.exe
  2⤵
  PID:10508
- C:\Windows\System\vVDhNsI.exe
  C:\Windows\System\vVDhNsI.exe
  2⤵
  PID:11176
- C:\Windows\System\RlPcfse.exe
  C:\Windows\System\RlPcfse.exe
  2⤵
  PID:5820
- C:\Windows\System\rOPwska.exe
  C:\Windows\System\rOPwska.exe
  2⤵
  PID:12052
- C:\Windows\System\ZWRgotX.exe
  C:\Windows\System\ZWRgotX.exe
  2⤵
  PID:11524
- C:\Windows\System\WptNvjC.exe
  C:\Windows\System\WptNvjC.exe
  2⤵
  PID:11644
- C:\Windows\System\hpEgzmH.exe
  C:\Windows\System\hpEgzmH.exe
  2⤵
  PID:12236
- C:\Windows\System\yOFHYZw.exe
  C:\Windows\System\yOFHYZw.exe
  2⤵
  PID:11256
- C:\Windows\System\MxNvNKL.exe
  C:\Windows\System\MxNvNKL.exe
  2⤵
  PID:5748
- C:\Windows\System\FGrqdCp.exe
  C:\Windows\System\FGrqdCp.exe
  2⤵
  PID:10340
- C:\Windows\System\dPUdFbw.exe
  C:\Windows\System\dPUdFbw.exe
  2⤵
  PID:6812
- C:\Windows\System\SYdDBdl.exe
  C:\Windows\System\SYdDBdl.exe
  2⤵
  PID:9964
- C:\Windows\System\evdaNji.exe
  C:\Windows\System\evdaNji.exe
  2⤵
  PID:11828
- C:\Windows\System\OPYXgyy.exe
  C:\Windows\System\OPYXgyy.exe
  2⤵
  PID:10408
- C:\Windows\System\IdFnwiC.exe
  C:\Windows\System\IdFnwiC.exe
  2⤵
  PID:11860
- C:\Windows\System\DNxzovQ.exe
  C:\Windows\System\DNxzovQ.exe
  2⤵
  PID:12096
- C:\Windows\System\tQQLCtB.exe
  C:\Windows\System\tQQLCtB.exe
  2⤵
  PID:12156
- C:\Windows\System\IXXjrip.exe
  C:\Windows\System\IXXjrip.exe
  2⤵
  PID:5872
- C:\Windows\System\crtVJKM.exe
  C:\Windows\System\crtVJKM.exe
  2⤵
  PID:9332
- C:\Windows\System\UtiJOgf.exe
  C:\Windows\System\UtiJOgf.exe
  2⤵
  PID:9152
- C:\Windows\System\NYjoVcL.exe
  C:\Windows\System\NYjoVcL.exe
  2⤵
  PID:10296
- C:\Windows\System\qMHsOSi.exe
  C:\Windows\System\qMHsOSi.exe
  2⤵
  PID:11512
- C:\Windows\System\QEEXPFe.exe
  C:\Windows\System\QEEXPFe.exe
  2⤵
  PID:3512
- C:\Windows\System\bQMejVu.exe
  C:\Windows\System\bQMejVu.exe
  2⤵
  PID:9360
- C:\Windows\System\sdRAkYM.exe
  C:\Windows\System\sdRAkYM.exe
  2⤵
  PID:1640
- C:\Windows\System\LcUyPIq.exe
  C:\Windows\System\LcUyPIq.exe
  2⤵
  PID:12264
- C:\Windows\System\EqDfLTO.exe
  C:\Windows\System\EqDfLTO.exe
  2⤵
  PID:10388
- C:\Windows\System\huPIDHw.exe
  C:\Windows\System\huPIDHw.exe
  2⤵
  PID:9860
- C:\Windows\System\fIeSzBK.exe
  C:\Windows\System\fIeSzBK.exe
  2⤵
  PID:3664
- C:\Windows\System\rpFqEwm.exe
  C:\Windows\System\rpFqEwm.exe
  2⤵
  PID:12316
- C:\Windows\System\jdaaMqk.exe
  C:\Windows\System\jdaaMqk.exe
  2⤵
  PID:13132
- C:\Windows\System\UuBJsie.exe
  C:\Windows\System\UuBJsie.exe
  2⤵
  PID:1536
- C:\Windows\System\WicQLEs.exe
  C:\Windows\System\WicQLEs.exe
  2⤵
  PID:4940
- C:\Windows\System\zfgdUhv.exe
  C:\Windows\System\zfgdUhv.exe
  2⤵
  PID:2124
- C:\Windows\System\SHFZXaV.exe
  C:\Windows\System\SHFZXaV.exe
  2⤵
  PID:1008
- C:\Windows\System\dBhliuu.exe
  C:\Windows\System\dBhliuu.exe
  2⤵
  PID:7612
- C:\Windows\System\rokrLhI.exe
  C:\Windows\System\rokrLhI.exe
  2⤵
  PID:12032
- C:\Windows\System\XFPfJbx.exe
  C:\Windows\System\XFPfJbx.exe
  2⤵
  PID:12300
- C:\Windows\System\gKNCAqh.exe
  C:\Windows\System\gKNCAqh.exe
  2⤵
  PID:9812
- C:\Windows\System\koCVYUg.exe
  C:\Windows\System\koCVYUg.exe
  2⤵
  PID:12968
- C:\Windows\System\dkKTlFA.exe
  C:\Windows\System\dkKTlFA.exe
  2⤵
  PID:12664
- C:\Windows\System\eCvXeit.exe
  C:\Windows\System\eCvXeit.exe
  2⤵
  PID:12496
- C:\Windows\System\DdzgGXp.exe
  C:\Windows\System\DdzgGXp.exe
  2⤵
  PID:12380
- C:\Windows\System\DtEjaIr.exe
  C:\Windows\System\DtEjaIr.exe
  2⤵
  PID:12296
- C:\Windows\System\yqoTHtJ.exe
  C:\Windows\System\yqoTHtJ.exe
  2⤵
  PID:944
- C:\Windows\System\vjpeYuz.exe
  C:\Windows\System\vjpeYuz.exe
  2⤵
  PID:12028
- C:\Windows\System\QtAlYtc.exe
  C:\Windows\System\QtAlYtc.exe
  2⤵
  PID:11060
- C:\Windows\System\sPoHwzn.exe
  C:\Windows\System\sPoHwzn.exe
  2⤵
  PID:11760
- C:\Windows\System\yKXzlax.exe
  C:\Windows\System\yKXzlax.exe
  2⤵
  PID:12204
- C:\Windows\System\ggQJRos.exe
  C:\Windows\System\ggQJRos.exe
  2⤵
  PID:11468
- C:\Windows\System\zmYmTSE.exe
  C:\Windows\System\zmYmTSE.exe
  2⤵
  PID:12184
- C:\Windows\System\BCCcSee.exe
  C:\Windows\System\BCCcSee.exe
  2⤵
  PID:12992
- C:\Windows\System\UuLeILS.exe
  C:\Windows\System\UuLeILS.exe
  2⤵
  PID:3372
- C:\Windows\System\zxMGiFs.exe
  C:\Windows\System\zxMGiFs.exe
  2⤵
  PID:5272
- C:\Windows\System\ShKObeF.exe
  C:\Windows\System\ShKObeF.exe
  2⤵
  PID:10048
- C:\Windows\System\QnoCAdF.exe
  C:\Windows\System\QnoCAdF.exe
  2⤵
  PID:2972
- C:\Windows\System\TdrqsJu.exe
  C:\Windows\System\TdrqsJu.exe
  2⤵
  PID:11180
- C:\Windows\System\gyVwPAM.exe
  C:\Windows\System\gyVwPAM.exe
  2⤵
  PID:9532
- C:\Windows\System\lMIuJsV.exe
  C:\Windows\System\lMIuJsV.exe
  2⤵
  PID:10668
- C:\Windows\System\AbYIMqg.exe
  C:\Windows\System\AbYIMqg.exe
  2⤵
  PID:11488
- C:\Windows\System\ACtbdba.exe
  C:\Windows\System\ACtbdba.exe
  2⤵
  PID:10908
- C:\Windows\System\OrbSNOx.exe
  C:\Windows\System\OrbSNOx.exe
  2⤵
  PID:3728
- C:\Windows\System\qAUOpad.exe
  C:\Windows\System\qAUOpad.exe
  2⤵
  PID:5444
- C:\Windows\System\Atpbana.exe
  C:\Windows\System\Atpbana.exe
  2⤵
  PID:12512
- C:\Windows\System\DhKuMXr.exe
  C:\Windows\System\DhKuMXr.exe
  2⤵
  PID:12412
- C:\Windows\System\sBiaENk.exe
  C:\Windows\System\sBiaENk.exe
  2⤵
  PID:4408
- C:\Windows\System\AdNJStU.exe
  C:\Windows\System\AdNJStU.exe
  2⤵
  PID:13328
- C:\Windows\System\UUdZyuS.exe
  C:\Windows\System\UUdZyuS.exe
  2⤵
  PID:13352
- C:\Windows\System\aJNvIhU.exe
  C:\Windows\System\aJNvIhU.exe
  2⤵
  PID:13384
- C:\Windows\System\IunnopO.exe
  C:\Windows\System\IunnopO.exe
  2⤵
  PID:13404
- C:\Windows\System\zzFIXIu.exe
  C:\Windows\System\zzFIXIu.exe
  2⤵
  PID:13428
- C:\Windows\System\aFpOqpR.exe
  C:\Windows\System\aFpOqpR.exe
  2⤵
  PID:13448
- C:\Windows\System\pVwxgoa.exe
  C:\Windows\System\pVwxgoa.exe
  2⤵
  PID:13464
- C:\Windows\System\ooyyNbl.exe
  C:\Windows\System\ooyyNbl.exe
  2⤵
  PID:13484
- C:\Windows\System\oLionBS.exe
  C:\Windows\System\oLionBS.exe
  2⤵
  PID:13508
- C:\Windows\System\pJhxjDY.exe
  C:\Windows\System\pJhxjDY.exe
  2⤵
  PID:13540
- C:\Windows\System\plHoQOs.exe
  C:\Windows\System\plHoQOs.exe
  2⤵
  PID:13764
- C:\Windows\System\hTyGNlz.exe
  C:\Windows\System\hTyGNlz.exe
  2⤵
  PID:13792
- C:\Windows\System\xLbMIdE.exe
  C:\Windows\System\xLbMIdE.exe
  2⤵
  PID:12760
- C:\Windows\System\nmvTPJQ.exe
  C:\Windows\System\nmvTPJQ.exe
  2⤵
  PID:11080
- C:\Windows\System\KVoXCGc.exe
  C:\Windows\System\KVoXCGc.exe
  2⤵
  PID:13476
- C:\Windows\System\DeBmScO.exe
  C:\Windows\System\DeBmScO.exe
  2⤵
  PID:13588
- C:\Windows\System\yxuuVPI.exe
  C:\Windows\System\yxuuVPI.exe
  2⤵
  PID:13644
- C:\Windows\System\BieFDiG.exe
  C:\Windows\System\BieFDiG.exe
  2⤵
  PID:13880
- C:\Windows\System\PtmaRYp.exe
  C:\Windows\System\PtmaRYp.exe
  2⤵
  PID:13336
- C:\Windows\System\XFyLJOO.exe
  C:\Windows\System\XFyLJOO.exe
  2⤵
  PID:13156
- C:\Windows\System\hzhopVm.exe
  C:\Windows\System\hzhopVm.exe
  2⤵
  PID:13784
- C:\Windows\System\sGwhjBd.exe
  C:\Windows\System\sGwhjBd.exe
  2⤵
  PID:13604
- C:\Windows\System\gQwGxln.exe
  C:\Windows\System\gQwGxln.exe
  2⤵
  PID:13660
- C:\Windows\System\zTgEXHS.exe
  C:\Windows\System\zTgEXHS.exe
  2⤵
  PID:13748
- C:\Windows\System\QsmiTkj.exe
  C:\Windows\System\QsmiTkj.exe
  2⤵
  PID:3920
- C:\Windows\System\HXOhJxm.exe
  C:\Windows\System\HXOhJxm.exe
  2⤵
  PID:14020
- C:\Windows\System\fUvGonG.exe
  C:\Windows\System\fUvGonG.exe
  2⤵
  PID:14088
- C:\Windows\System\BdSvFTS.exe
  C:\Windows\System\BdSvFTS.exe
  2⤵
  PID:14032
- C:\Windows\System\MMIzoIC.exe
  C:\Windows\System\MMIzoIC.exe
  2⤵
  PID:14076
- C:\Windows\System\DAaJHTs.exe
  C:\Windows\System\DAaJHTs.exe
  2⤵
  PID:14008
- C:\Windows\System\yOHWiKI.exe
  C:\Windows\System\yOHWiKI.exe
  2⤵
  PID:14220
- C:\Windows\System\tIslTXX.exe
  C:\Windows\System\tIslTXX.exe
  2⤵
  PID:14224
- C:\Windows\System\HwiNhNI.exe
  C:\Windows\System\HwiNhNI.exe
  2⤵
  PID:14280
- C:\Windows\System\SVQQfGy.exe
  C:\Windows\System\SVQQfGy.exe
  2⤵
  PID:13992
- C:\Windows\System\dIUsfKx.exe
  C:\Windows\System\dIUsfKx.exe
  2⤵
  PID:14092
- C:\Windows\System\DpbnFnl.exe
  C:\Windows\System\DpbnFnl.exe
  2⤵
  PID:628
- C:\Windows\System\kmmogcB.exe
  C:\Windows\System\kmmogcB.exe
  2⤵
  PID:13904
- C:\Windows\System\lzMvXXY.exe
  C:\Windows\System\lzMvXXY.exe
  2⤵
  PID:14176
- C:\Windows\System\tRlnvuJ.exe
  C:\Windows\System\tRlnvuJ.exe
  2⤵
  PID:14212
- C:\Windows\System\pkShEbU.exe
  C:\Windows\System\pkShEbU.exe
  2⤵
  PID:13940
- C:\Windows\System\jBWmIvo.exe
  C:\Windows\System\jBWmIvo.exe
  2⤵
  PID:14284
- C:\Windows\System\JmXJsER.exe
  C:\Windows\System\JmXJsER.exe
  2⤵
  PID:11704
- C:\Windows\System\dxyKBur.exe
  C:\Windows\System\dxyKBur.exe
  2⤵
  PID:14208
- C:\Windows\System\mwQdbwo.exe
  C:\Windows\System\mwQdbwo.exe
  2⤵
  PID:13632
- C:\Windows\System\cTFmXjZ.exe
  C:\Windows\System\cTFmXjZ.exe
  2⤵
  PID:8028
- C:\Windows\System\HXojYyD.exe
  C:\Windows\System\HXojYyD.exe
  2⤵
  PID:11368
- C:\Windows\System\KUTBljA.exe
  C:\Windows\System\KUTBljA.exe
  2⤵
  PID:14056
- C:\Windows\System\PWRqIIp.exe
  C:\Windows\System\PWRqIIp.exe
  2⤵
  PID:4752
- C:\Windows\System\ERdhTqn.exe
  C:\Windows\System\ERdhTqn.exe
  2⤵
  PID:12888
- C:\Windows\System\CufdcQO.exe
  C:\Windows\System\CufdcQO.exe
  2⤵
  PID:12328
- C:\Windows\System\hSdRyDy.exe
  C:\Windows\System\hSdRyDy.exe
  2⤵
  PID:1000
- C:\Windows\System\AzPaFBI.exe
  C:\Windows\System\AzPaFBI.exe
  2⤵
  PID:4884
- C:\Windows\System\Sxlmlou.exe
  C:\Windows\System\Sxlmlou.exe
  2⤵
  PID:12948
- C:\Windows\System\AvpilJE.exe
  C:\Windows\System\AvpilJE.exe
  2⤵
  PID:8204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_33vtsclc.wzf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_33vtsclc.wzf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AyBHmZY.exe

Path C:\Windows\System\AyBHmZY.exe
Size 2.2MB
SHA256 04ff97f251528fa03053120b4b8867fab2a9afe87f5cb4d8c9e40b38f8bc60d0
MD5 28f67ccbe90380e7fd71f53a1d119061
SHA1 8316cd8221715f88ef15b81ed7518c5767ebb499
SHA512 9649493625a811f19775e2b4a811b1fcd1f7e6209c97155e7b05d824121294acc3da9395ad5b4d25038e396853fb4869cbfaa2d9d24b2166693e245d57dcab5c
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqx:NABQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

BHSfCmn.exe

Path C:\Windows\System\BHSfCmn.exe
Size 2.2MB
SHA256 8e8b39f2e4fae30b95553dd42f10413ea6fb36e4f2de5c445a7ca828ad84b983
MD5 f9428532d09b590ddb62a656141e2e63
SHA1 afa03fab032bf9d771d388b054a352f6b9edfd99
SHA512 a5c7c5decb20236701d1d1069a5cc09f399c4f5c52d07650cae97f71e1d921c4d7b328fd3b10c5ca3d092eedbb00569264d6700b9e81628c863ff9b1251c0516
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiq8:NABR
MD5 SHA1 SHA512 SSDEEP

Submit Download

EdMxJOg.exe

Path C:\Windows\System\EdMxJOg.exe
Size 2.2MB
SHA256 6d10bc4f7e9184216c3441d402d8c05110a33160016bb5d092b6fd758f93fa3f
MD5 117d9b980d1e3fea7fe636fef9dcb710
SHA1 099fb2f7d4507fe603b991c1011c5311248bf208
SHA512 ce2c6a1b98620529ce216ee26ac8117eadaa5d555cf7fb0f87eee76d97c6b1446b0cd791a79cc7fde0a019d39cd582f971d81c85fb0059ef8a2a175868eed852
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqw:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

IQeZeqH.exe

Path C:\Windows\System\IQeZeqH.exe
Size 2.2MB
SHA256 253bab6605a8afea5108d067dd88d07715b0d98f5e861fd3ac9eda66d73728fb
MD5 8e544bb9e57eaa5cb6bc884a3dc4427e
SHA1 245721d2e7e9d808f4dfa5a397e75ed569608b66
SHA512 4dec59faef43be17ce21e7f478ed4aede5c6fba1bb5ee7b406a84634d2beff0f923267d296934a725146b7586b54fc62a9425e6519dd154262d210d3af20b2aa
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiq1:NAB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

IgadNYu.exe

Path C:\Windows\System\IgadNYu.exe
Size 2.2MB
SHA256 a419abc60c5f8ef8427609c212e1ecf5e189aa99112fe1ba26a2e4c8c9fc1ec4
MD5 409a0996ef749ae1c78d9a2811d19f4a
SHA1 198646d6d9bc18be6d4f56b859a844ff837cc006
SHA512 d4f69707fa398f194df8ddbf3ee72a60d06a6e09fbfc13b80519ed97a0fe59bbd7a2f3273f65c64686bc7c43683b8cc5e14d2013c544f4d8c849b14153421717
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqO:NABn
MD5 SHA1 SHA512 SSDEEP

Submit Download

JPygTYp.exe

Path C:\Windows\System\JPygTYp.exe
Size 2.2MB
SHA256 0b47b28b2028913b6bde7ee7586529b277650b0624b07fc21cae3d1377598b3a
MD5 d7dc1d5e7202118a1f2ccbeda036a29d
SHA1 e3138ab88b9bb67aec3bf75b74e6671ed3ed4805
SHA512 56239244c409e3a117764e67f1289cba422e71c393b41115eadd9684bb4c6ecb2dac549967b8c2809f6fc2b0f60dd14d83060e8a4ec2b43fc2efb20d873fb156
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqV:NABI
MD5 SHA1 SHA512 SSDEEP

Submit Download

MDDOULb.exe

Path C:\Windows\System\MDDOULb.exe
Size 2.2MB
SHA256 52dc572382571301fcf1cb395fb36cbdc14c3d445b197fc60b2081bb95a0b91f
MD5 bb6a53ff6e7e783befb61eb50982cf37
SHA1 2c2e3401444dd4b41657c1d48c48e3d93aad50ed
SHA512 fc762786530e9b2f8ba18b51c33f853030fddf1696ef733cd90e4a0ae684f2c4719ed5401ed32251f79b2648e53526660f810eb3c653db0fef049dca707b1fc3
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqF:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

RHSJbBO.exe

Path C:\Windows\System\RHSJbBO.exe
Size 2.2MB
SHA256 6aa884ee224e2f1e96e42b80c05fe10d5b481b33f70b4f7d4179e8dcd4f1bcb6
MD5 233dd9f6b943fc6fd94e984b3bf99b29
SHA1 75b0dec838fdc13c85b51c6edef93a308d8d5ee4
SHA512 ea2f4d7b9622c1e6ad6d7ee64ba119358b11d787027562a816e81680f44c1c246ae2a5f7749e5449fd5f54b93c562c065a86d2bbbef14ecdc7cf0039b7714d3b
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiq3:NABi
MD5 SHA1 SHA512 SSDEEP

Submit Download

TKCYDgN.exe

Path C:\Windows\System\TKCYDgN.exe
Size 2.2MB
SHA256 6c61a8817a656eb55d1c0c428e71a1f875f8454c6a5d2980e71254f9032e946f
MD5 3a15f6aa488fdc7b950c733d62ababee
SHA1 75657e7f74517b286b4d622b9c4452d49aee7549
SHA512 4bfedc0de4e801cdf308e6b614ca0f9651c5d26eeb05de4c914ee8f7728f79d8b4fcbe3d5752ff3e6a5d08e3af30082005e7122462e0651198a786084f13cbd9
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqg:NABf
MD5 SHA1 SHA512 SSDEEP

Submit Download

TTvvOaH.exe

Path C:\Windows\System\TTvvOaH.exe
Size 2.2MB
SHA256 657d6eed5aaa0e2a7083e5062cce372e315e3b188d990e85bc4e811e86610978
MD5 b08f4a3dc123e7e46ab04f1a74846f42
SHA1 2536c139ded0ab1fa3f88bd9a5afe7f1e5cf6df0
SHA512 791b844eddecc4bd15a08aa4068b69e420cef18ce7d55e63f7546b57f26c5cd2e72b4be8906ab7309e3997e95c17582a41a01df13e5eadb8250c5112446a969c
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqY:NABB
MD5 SHA1 SHA512 SSDEEP

Submit Download

TUcHnZE.exe

Path C:\Windows\System\TUcHnZE.exe
Size 2.2MB
SHA256 ad4865760f9d7b333e7dc1754e7260b92e466cf359dcefae4b0e2b2e46ce3f8d
MD5 11d106b4f13824df69891e2f9b2ad0f0
SHA1 a18d95355c601b6b4947a7763673a7e8e58547cf
SHA512 048376b36a78cc0ba1c80b8cd70fc636e3ffaec5aaef04394bdf7c3a7ae855fb667be5d98c4841aaae63e3798897eed3fd0b66ae7b0e707490e5d035abae78ca
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqZ:NABy
MD5 SHA1 SHA512 SSDEEP

Submit Download

UQBDEgq.exe

Path C:\Windows\System\UQBDEgq.exe
Size 2.2MB
SHA256 cd31561011d3075c198414c18ccccfdb0cef89ef2e6773ed3db0e22e3832e293
MD5 ca0450379cb7f3950b49ff7ca578be55
SHA1 4ac438ce6648dbd1119e11b2ae39d270daa04979
SHA512 fac94a7d267154cf2bca3a9edd0bbd74922a0520338a071fe236d89a25ac4589f66f5f22ecf25e6646a6581d9c94b9b0bd08f7396660fb10d4537efafffebd17
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqd:NABk
MD5 SHA1 SHA512 SSDEEP

Submit Download

UniOzng.exe

Path C:\Windows\System\UniOzng.exe
Size 2.2MB
SHA256 a2f7b22ac3ae3a99f4a743221eefd97780a6c3b585ea13622858ecc410bb318c
MD5 052ff3bd6c05e7a998927513f3fcb057
SHA1 e747865fd59301b0febd1b67f6e8118ce19797bf
SHA512 494f289cb66a241168ad8795ceecbda17bb4d79eb3ef0c470215b8e4d1e224d18d57deb33303f4f381033591b3027f568fb7e77d6b46e74f40ff10e936a1f6a1
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqd:NABU
MD5 SHA1 SHA512 SSDEEP

Submit Download

YljvOap.exe

Path C:\Windows\System\YljvOap.exe
Size 2.2MB
SHA256 4b570b356366a1e6bb195917e64a22a7f230ef6710e3b1a5dd1b0b445fd7268e
MD5 c34492191c26301bf18c51c975d1ff37
SHA1 2ff79d6f68da9fb12376d4a3511c03b0ccc8ff93
SHA512 93edd54ec6ea4712c7235b185cfef5c275f63a7f37f53c3b35cc76db3e232f81c5ddbfe849fbead41fd751b1fdb6bdd3b9e238cccc23d66702842b7542c6774a
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqh:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

YtPknJW.exe

Path C:\Windows\System\YtPknJW.exe
Size 2.2MB
SHA256 5edc5b97a9ed0604513d9a9e8c9b3de08eeb1dd31ad236b45b620942fc4e2183
MD5 aa387de259b3c3c50bd1bea65a51358f
SHA1 0c3c12de0899315a7d7c8de0cbcc271478404109
SHA512 e5f33adb102d18fdb6e39c45f57365acb723422de167911d02a160db3d65156321da8e4f7c7e1e1de5050089426afdbcfccbcd0670dc3e7238f6920ca5ef47c6
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqg:NABj
MD5 SHA1 SHA512 SSDEEP

Submit Download

aDtMmaW.exe

Path C:\Windows\System\aDtMmaW.exe
Size 2.2MB
SHA256 0b607de5773b86e45f94c5ce07878053cee963d0fd7e340d354a6a96c0ab7c21
MD5 0fe81e48b8a532bf4d8df53c2fc5a4e6
SHA1 6b2fedd9cbf3d5875e491e0d2ef450b9bdbed377
SHA512 340161ef57a7f5fd00300d35fabffa01ca505ae3cfe0c1a062c33e99a85663c41da8beae611358cd7e937d7b1976c89157e4f98003d695a18984134eeaa93602
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiq8:NABb
MD5 SHA1 SHA512 SSDEEP

Submit Download

bgZCicH.exe

Path C:\Windows\System\bgZCicH.exe
Size 2.2MB
SHA256 0c5a51cef67ee7c315979e1e4a2a67c76d42cc752e661b5dda36dd4233bd0a9d
MD5 dc889152f1bf0972d285e5b914656a19
SHA1 5b4bcfe7738cca4ffed49ec14b2c50f82a2ec6b2
SHA512 00c43348a03ca3dc8d4042b954b2bf4669879fcf5961f9c0e45eb357942be13a23f27eaded6e9a00bec5b4990a4ac69385924a656a560b9f754d15e2d21da0c3
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiq5:NABe
MD5 SHA1 SHA512 SSDEEP

Submit Download

bifvUnF.exe

Path C:\Windows\System\bifvUnF.exe
Size 2.2MB
SHA256 48ba07fe3933de5ce66468aa454f7894178d0f260cddfde7db25cda927aaaeae
MD5 ae08e1d3a454b1cc9a69f3a59015b782
SHA1 efb88de880331223dff6973b5ed0d7d6d41a8521
SHA512 a7a69c1b6b26811fc48b98d95bf6a66f06e19bf8f12e551a0c459678ec18f2b3bc350c30e896ef5bf030d947a988ef61e0b077a042035bfa91e124064b026490
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqp:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ecvgQfc.exe

Path C:\Windows\System\ecvgQfc.exe
Size 8B
SHA256 c1d0a5469aea2b6129f1befd08eacde0c0a8692b1b5daa6dcde087be41f93473
MD5 b2496acc5e17e2c67abf0e50b34299c5
SHA1 e4d3a01a7b24014db52a37c4589da1d759e5cc01
SHA512 ef684a29718cef3f70c3e4fcbaeffb53bbda0c6389282a7b2bddfe4ab783804c217814821e0c2a754448b3cb6bb99b294f93749f85fd1748233def0d92fa8251
MD5 SHA1 SHA512

Submit Download

egxDxXg.exe

Path C:\Windows\System\egxDxXg.exe
Size 2.2MB
SHA256 04b1f7fa8d6cf7801e4ec685c229d845e886e136ce692a295985f603fcb1922d
MD5 0e7750f4d79c10aadf48589584b8df3d
SHA1 5bba4266f88c34b60336666ae2326ce1aecb11f1
SHA512 824d605c765108b7bf3e2d77880d26edcd83711d68026bcfc0ecb3c57c8a4a085493a8b852a3d99859c16f7cf4fe1ab1cf97139183b46f568767f4da35ef7fb4
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqb:NABk
MD5 SHA1 SHA512 SSDEEP

Submit Download

hWccayd.exe

Path C:\Windows\System\hWccayd.exe
Size 2.2MB
SHA256 5c8eeae6690ff51df169cad0cbb965b7db30d7ba4d8f764fe4e6f12c09f20a36
MD5 2cb9681797857c78a572be450d2dc8f3
SHA1 95b5759516fb5732c86bf26e08f5b95319242bd3
SHA512 c724508e67536f48eac2aef95e171bc51c19683acaf8d3e04d59a62304ed7f7fa14ada633ca0c2ffdd82936161e82f0ffa76c2bcecb4d47e44768f1c9f0f5984
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqU:NABL
MD5 SHA1 SHA512 SSDEEP

Submit Download

hejiqDA.exe

Path C:\Windows\System\hejiqDA.exe
Size 2.2MB
SHA256 81e218f143be8819e06f54631aad6c2160f8422a506179d3162e9233aadc5080
MD5 d7d31732a9a73b8eb890d790ba4f5af2
SHA1 8aaa0c6360009b9dcd7466ee028eee13c11bb0c7
SHA512 3cd700f5d0d61d4da655cd52024251f4ce9a86326b5cb9a1dba419a6e065efc0faeec54f0e0b7ecb9e8512c2d0b04a81955a042d082cf5093c02548ff58a7f8b
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqI:NABR
MD5 SHA1 SHA512 SSDEEP

Submit Download

iCYtHqU.exe

Path C:\Windows\System\iCYtHqU.exe
Size 2.2MB
SHA256 1ab25b0a2150083f209bab06ab1ec844904c011b0805dc426f15b3ad2fe6af9c
MD5 72c1a12e9f56d166fd8dd3fb5e1aadbe
SHA1 36cbb40ff0e21a7091fc8227a8b69dc7a77e2506
SHA512 f8e568d4ba45b3c948971186f6ebccc75e332cad18d639c153c31ea2baade95da09f1b458e02093c3252659eda58bf8e06f0876e98a8a46932b8ea9400f95111
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqy:NABn
MD5 SHA1 SHA512 SSDEEP

Submit Download

iQPIjBd.exe

Path C:\Windows\System\iQPIjBd.exe
Size 2.2MB
SHA256 1311caaa289a53923e07003e8e8e4b681acef96e2cc147bc771e8cb20ee5d15b
MD5 2fe24d5ddeeec720969c4daa43c80f07
SHA1 6592708b4b3e957cd16dcdbe1038d3cda41ddb78
SHA512 09212fa2e1394ffa7c1b35beffee64b469d2ab051976d7ad35491d918256cbedefb28915af5744ce8c802d0942648a0017c682f135b5b93ff2c0672e2898bd47
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqT:NABs
MD5 SHA1 SHA512 SSDEEP

Submit Download

ijaPBrg.exe

Path C:\Windows\System\ijaPBrg.exe
Size 2.2MB
SHA256 5481684c443e82f82eb5ff2bc06ffa71405006e0da60cc2f37172af07dce45e8
MD5 9afea57acc89f1c85fe38e12318b6885
SHA1 5acad3787cb1709a70a74d8eecfb077831c3a986
SHA512 26141444660a411a839a1da7ba0bbc8d5d7f886dba17c102e12adcee4afa7bb51126122209b92a442801ebdc4447d11f64b5e63453ef574add91055d0044c929
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiq3:NAB4
MD5 SHA1 SHA512 SSDEEP

Submit Download

jSPyNnB.exe

Path C:\Windows\System\jSPyNnB.exe
Size 2.2MB
SHA256 f72ed5212c05b134ff66ba7bdb76602737da07f642e5154a8ae3e1506ad77cec
MD5 3b6aecb5f020d2f0b4310656c8508645
SHA1 9c423518f43a0aa62b19383526169963dbbec613
SHA512 d85c533f6245a7440f346a58f455a5ea9d14cc24dd35b5745c812f87c5409e0b1ea033c4e52fd2f7b4f09d994986b867832c686df5ac9f8e81c22ca5e31850ff
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiq0:NAB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

jWSIiYW.exe

Path C:\Windows\System\jWSIiYW.exe
Size 2.2MB
SHA256 8a3e736dfe845d3ab8f0dd44cbd50dd03adfa0c0b2774319be3002578d86621c
MD5 d1fada4431a3788ceb78f4224bd8d842
SHA1 ced8974027e13d85770d969eb793dbacb2737a7a
SHA512 907b86cb4c68f924f1ef3d74ba7a53d48bc4b39af06e98a63d79a067cd85ee4fed3b0136fa29ba7429eb08dfa74933475145b51680378db56e99a7d01fabf748
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqC:NABX
MD5 SHA1 SHA512 SSDEEP

Submit Download

juSDIPK.exe

Path C:\Windows\System\juSDIPK.exe
Size 2.2MB
SHA256 710cb0622352bc299eb08dc8e0c112bdc53d61b060462391c5cd7f479fd99482
MD5 abfa0a1ed07d294d0f96d013a999a61d
SHA1 085ebc15a9fc097692a10f3dab811336eb5d240e
SHA512 01f5458651726ca654b614b0c9df75da94b89ea27068ef4342ef09322ec4f9fc77b72d1f3058fe95dd0f291e4bd9875f30ff0a890e72f59ee3a5a3c1a32a710c
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqe:NABF
MD5 SHA1 SHA512 SSDEEP

Submit Download

kiqXBlS.exe

Path C:\Windows\System\kiqXBlS.exe
Size 2.2MB
SHA256 ce1d33950edbd98dec930145ffe37a9bb1aef61118707cb017571b3edd5c3090
MD5 b3e54209803a51247689e452f294b4b2
SHA1 38cbc32f66e20cb5d162d12ce8d94028552a0ad3
SHA512 fcd72b6c3c85f19a9404e36591e6bf0fecfee0e41190714c5716e2bf23e2ea21e1147f200714cc951b74fded0cfbb78c050da5e1e25e87c3b7bd45b866718a49
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqq:NABb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ktAMKvy.exe

Path C:\Windows\System\ktAMKvy.exe
Size 2.2MB
SHA256 3c0bcc2f9b7dc762d7c590f78e91d62973de23d4ea349a9e5662d10307e9237c
MD5 fca8fca5a113aa20f9ddc775281ba199
SHA1 1036a80f859d06eab7c2393d44fa0cc9dafb8ec6
SHA512 6dcff7b5c753ed9680018af9e76e445a8b18e36b4dbba75a16665971aded51c35838ac2cbc69f14ca30e1b7ea3df2eb020acd833f6b13e157cea67efdf44e2ec
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqy:NABf
MD5 SHA1 SHA512 SSDEEP

Submit Download

pCyyXLP.exe

Path C:\Windows\System\pCyyXLP.exe
Size 2.2MB
SHA256 8d38c18422cd27403d863a0724f60376f991aac01573aa1976f6afcf64e0d931
MD5 cc92c221aebc40e7cf247397951ef8dd
SHA1 1d51f1fda486107798ca709fbda898357699ce8b
SHA512 0b7c2061c4c2e86b0b10463c680bd3308b5b2cfc7182401802f14cfd63baf9d95db91811458b0a34cde74cd417d97ec8b058cef1b4c1dd5943ca05136dcc8754
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqn:NABg
MD5 SHA1 SHA512 SSDEEP

Submit Download

pqSzPjU.exe

Path C:\Windows\System\pqSzPjU.exe
Size 2.2MB
SHA256 ab677b63ad6eea72aed807961cf59ef4653a10eddcb2f28682795d47baeacfa5
MD5 2c7c1acdb3145cbcbd2184b6f6804f7b
SHA1 587c8d027f245d74b0fdcee61cdda73f348d541d
SHA512 66caa3c6bd02382f37b410bc59e6598b266f56dc1a329450381c51f4413479fa606ae02c667c238e55043b85f2de06ea8416fe27af9dff5e85c3bacf72016107
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqN:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

rHWflgK.exe

Path C:\Windows\System\rHWflgK.exe
Size 2.2MB
SHA256 f3348a215908a7e51f2a400814da7d8e4211177fc5e27fa673a5f6ac02c2efaf
MD5 d6725dd75d575ffe7ce770bd484b2acc
SHA1 258cbbc0c72eb04ae9270aad63a2ee674f8d3e9a
SHA512 0b2570af6c40e8b3ba26c766e0992ace4c272207f035e5b1e8427b95905ce6e9ceff0010459daa3c77343f3818a529e114e0967c58fe73f656ea4c483f9575c1
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqH:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

reUIpmQ.exe

Path C:\Windows\System\reUIpmQ.exe
Size 2.2MB
SHA256 64ad2f976ebfd745cda63e4bfe5a666731fef85a36fbf3981beec56e2b0df78c
MD5 3a21b6b91cce8c5c749691cd8113f476
SHA1 4657c51c256da7ac5f235b4f4524f629468e73f7
SHA512 3300c8d799e6a1ad86854cda84ac0955c4f0ef49750f81ef44f67e3cd779e439a28727bc5f3c13dc05bd8972481dcec8e6225e125dd9ce5128ea85ec743c2a2e
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiq5:NABe
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqoUfXn.exe

Path C:\Windows\System\sqoUfXn.exe
Size 2.2MB
SHA256 33e833f6e38ce151457191538589fa8e19c6258b7fdf6f01c90a06d7f00bf870
MD5 086073acdd6f4b69c324294bb568b8e7
SHA1 25b8669e1be7df70f9a3c0e435d50bae556daef5
SHA512 2e3f08892f027a34e4ee3694f0aebae0f0bd56479c378f4b3b2122cf407b93db7c44ff5b366537b8fb87f2256268d8c18c2e4966288570659729f62ec05c240c
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiq0:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tWHkyPi.exe

Path C:\Windows\System\tWHkyPi.exe
Size 2.2MB
SHA256 aeb4f4557bb79054838a39234d11c157bc4fa02fe3080ef70fc3f4c5a911bf94
MD5 48a33344aa38ab239e0c7759c66f4389
SHA1 7f7ad4cc12431dee5900964d719697d36a02e883
SHA512 7382a95cb95a3798a317d08a5382f0de91b96bb7973aadcbffb74519ee141d6289b7c8b859129c69ee4cd586478600a2a045081e3cfb03db06d064264b8c0b33
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqc:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

umLceJE.exe

Path C:\Windows\System\umLceJE.exe
Size 2.2MB
SHA256 3d5881953ac21b8f8c205da15ece7b4e2f0aca3fb0b3a367059152ed363d387d
MD5 f14e723e69c249f711a02b7d3c1dc1bc
SHA1 f354b44116ab09f57ef0d7ffd1b48a804947fac6
SHA512 05ce97d607a4eed4ed045d73e79c8f3f922d77d415e629a06f50227fb1ae82ef33734eeaa32666b429de5c5d480ed1c222bf8bd7c42dafa610cc65842d23e0a0
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqZ:NABs
MD5 SHA1 SHA512 SSDEEP

Submit Download

wDwfXlN.exe

Path C:\Windows\System\wDwfXlN.exe
Size 2.2MB
SHA256 2269f46ea430ba1deefd22cea3f9efa02a8540a066b220ce871afe915917a7fa
MD5 a369097a0d6fafa4811aab940e443b99
SHA1 2ca0cc8674c7bfd74d939f8a8aae9e33c677f93a
SHA512 36510796960ee84946b4772695233f406f9c5343cf74bbb05fd8eb9bda78eb8c958c4cc8994f60784d03c28d0007b3cee2ac1e30e1aaf3751982ab73c7ecb347
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqT:NAB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

yLUjyDR.exe

Path C:\Windows\System\yLUjyDR.exe
Size 2.2MB
SHA256 06623bee40e93ca506f109d79f797757f925c9a63c4b4d08aeee99c12a87ef64
MD5 d4f49ed06154bc7b007445e8eac7a03d
SHA1 1e84fe696e2710116eb0a7320c6019fd887ff816
SHA512 f62da8d0786ba4015594eb7b089515d8ecaac1eedb8687f090a5883ed0ee8ff2889ad069705b94e790c4a6c8d3ae77dc86ca39d5dabc9c54b3395af6783b8c33
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiq1:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/668-4683-0x00007FF6A04E0000-0x00007FF6A08D2000-memory.dmp

Download

memory/668-492-0x00007FF6A04E0000-0x00007FF6A08D2000-memory.dmp

Download

memory/792-4680-0x00007FF763A50000-0x00007FF763E42000-memory.dmp

Download

memory/792-167-0x00007FF763A50000-0x00007FF763E42000-memory.dmp

Download

memory/1208-4668-0x00007FF656D20000-0x00007FF657112000-memory.dmp

Download

memory/1208-4641-0x00007FF656D20000-0x00007FF657112000-memory.dmp

Download

memory/1208-163-0x00007FF656D20000-0x00007FF657112000-memory.dmp

Download

memory/1808-443-0x00007FF6C50E0000-0x00007FF6C54D2000-memory.dmp

Download

memory/1808-4677-0x00007FF6C50E0000-0x00007FF6C54D2000-memory.dmp

Download

memory/1944-262-0x00007FF770820000-0x00007FF770C12000-memory.dmp

Download

memory/1944-4676-0x00007FF770820000-0x00007FF770C12000-memory.dmp

Download

memory/2176-4685-0x00007FF669580000-0x00007FF669972000-memory.dmp

Download

memory/2176-555-0x00007FF669580000-0x00007FF669972000-memory.dmp

Download

memory/2384-113-0x00007FF7E1F80000-0x00007FF7E2372000-memory.dmp

Download

memory/2384-4640-0x00007FF7E1F80000-0x00007FF7E2372000-memory.dmp

Download

memory/2384-4662-0x00007FF7E1F80000-0x00007FF7E2372000-memory.dmp

Download

memory/2672-4672-0x00007FF6A0470000-0x00007FF6A0862000-memory.dmp

Download

memory/2672-4639-0x00007FF6A0470000-0x00007FF6A0862000-memory.dmp

Download

memory/2672-76-0x00007FF6A0470000-0x00007FF6A0862000-memory.dmp

Download

memory/2788-253-0x00007FF71BC50000-0x00007FF71C042000-memory.dmp

Download

memory/2788-4658-0x00007FF71BC50000-0x00007FF71C042000-memory.dmp

Download

memory/2968-4647-0x00007FF74B8F0000-0x00007FF74BCE2000-memory.dmp

Download

memory/2968-394-0x00007FF74B8F0000-0x00007FF74BCE2000-memory.dmp

Download

memory/3204-229-0x00007FF708790000-0x00007FF708B82000-memory.dmp

Download

memory/3204-4666-0x00007FF708790000-0x00007FF708B82000-memory.dmp

Download

memory/3416-4638-0x00007FF6DE1B0000-0x00007FF6DE5A2000-memory.dmp

Download

memory/3416-4655-0x00007FF6DE1B0000-0x00007FF6DE5A2000-memory.dmp

Download

memory/3416-50-0x00007FF6DE1B0000-0x00007FF6DE5A2000-memory.dmp

Download

memory/3524-4681-0x00007FF711510000-0x00007FF711902000-memory.dmp

Download

memory/3524-261-0x00007FF711510000-0x00007FF711902000-memory.dmp

Download

memory/3784-4663-0x00007FF6A8630000-0x00007FF6A8A22000-memory.dmp

Download

memory/3784-395-0x00007FF6A8630000-0x00007FF6A8A22000-memory.dmp

Download

memory/3980-317-0x00007FF62DD10000-0x00007FF62E102000-memory.dmp

Download

memory/3980-4754-0x00007FF62DD10000-0x00007FF62E102000-memory.dmp

Download

memory/4012-4707-0x00007FF7253A0000-0x00007FF725792000-memory.dmp

Download

memory/4012-231-0x00007FF7253A0000-0x00007FF725792000-memory.dmp

Download

memory/4064-0-0x00007FF618920000-0x00007FF618D12000-memory.dmp

Download

memory/4064-1-0x0000020055880000-0x0000020055890000-memory.dmp

Download

memory/4172-324-0x00007FF6B5F40000-0x00007FF6B6332000-memory.dmp

Download

memory/4172-4670-0x00007FF6B5F40000-0x00007FF6B6332000-memory.dmp

Download

memory/4352-30-0x00007FF721F90000-0x00007FF722382000-memory.dmp

Download

memory/4352-4646-0x00007FF721F90000-0x00007FF722382000-memory.dmp

Download

memory/4352-4636-0x00007FF721F90000-0x00007FF722382000-memory.dmp

Download

memory/4472-4660-0x00007FF6C28C0000-0x00007FF6C2CB2000-memory.dmp

Download

memory/4472-218-0x00007FF6C28C0000-0x00007FF6C2CB2000-memory.dmp

Download

memory/4484-15-0x00007FF6945D0000-0x00007FF6949C2000-memory.dmp

Download

memory/4484-4643-0x00007FF6945D0000-0x00007FF6949C2000-memory.dmp

Download

memory/4676-4654-0x00007FF746FE0000-0x00007FF7473D2000-memory.dmp

Download

memory/4676-444-0x00007FF746FE0000-0x00007FF7473D2000-memory.dmp

Download

memory/4980-1392-0x0000024AD24A0000-0x0000024AD24C2000-memory.dmp

Download

memory/5000-4649-0x00007FF7F7A70000-0x00007FF7F7E62000-memory.dmp

Download

memory/5000-34-0x00007FF7F7A70000-0x00007FF7F7E62000-memory.dmp

Download

memory/5000-4637-0x00007FF7F7A70000-0x00007FF7F7E62000-memory.dmp

Download

memory/5024-116-0x00007FF764DA0000-0x00007FF765192000-memory.dmp

Download

memory/5024-4652-0x00007FF764DA0000-0x00007FF765192000-memory.dmp

Download

memory/5068-316-0x00007FF76E1D0000-0x00007FF76E5C2000-memory.dmp

Download

memory/5068-4674-0x00007FF76E1D0000-0x00007FF76E5C2000-memory.dmp

Download