xmrig | c2025fd3f7373af256904ba6808071b55de8f5e458739fd4cc815d5680822b87

Analysis

max time kernel
120s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
Size

1.2MB
MD5

10e55f66bfae9e277a66bfff810c42d0
SHA1

35810a49cc213153286afd266715ef26cd65a517
SHA256

c2025fd3f7373af256904ba6808071b55de8f5e458739fd4cc815d5680822b87
SHA512

b78f4b2c80e765cfe32eedb39108ee68188d2f0b38517189919ffee738015fa7420b2712598cefd497ac9bb8ad61ccd6bf92b327482a49f549d7f6efa4262dd2
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRj:Lz071uv4BPMkHC0IlnASEx/Rt

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/4688-613-0x00007FF625B00000-0x00007FF625EF2000-memory.dmp	xmrig
behavioral2/memory/4960-618-0x00007FF7D2330000-0x00007FF7D2722000-memory.dmp	xmrig
behavioral2/memory/2584-624-0x00007FF7EF710000-0x00007FF7EFB02000-memory.dmp	xmrig
behavioral2/memory/2700-629-0x00007FF635AE0000-0x00007FF635ED2000-memory.dmp	xmrig
behavioral2/memory/2076-628-0x00007FF635B80000-0x00007FF635F72000-memory.dmp	xmrig
behavioral2/memory/2752-627-0x00007FF604FA0000-0x00007FF605392000-memory.dmp	xmrig
behavioral2/memory/1976-626-0x00007FF7AF6D0000-0x00007FF7AFAC2000-memory.dmp	xmrig
behavioral2/memory/4680-625-0x00007FF6309D0000-0x00007FF630DC2000-memory.dmp	xmrig
behavioral2/memory/4092-623-0x00007FF7BF850000-0x00007FF7BFC42000-memory.dmp	xmrig
behavioral2/memory/3156-622-0x00007FF762950000-0x00007FF762D42000-memory.dmp	xmrig
behavioral2/memory/4568-621-0x00007FF6F83E0000-0x00007FF6F87D2000-memory.dmp	xmrig
behavioral2/memory/4276-620-0x00007FF789990000-0x00007FF789D82000-memory.dmp	xmrig
behavioral2/memory/3432-619-0x00007FF72C550000-0x00007FF72C942000-memory.dmp	xmrig
behavioral2/memory/4456-617-0x00007FF653D60000-0x00007FF654152000-memory.dmp	xmrig
behavioral2/memory/2112-616-0x00007FF7ACE80000-0x00007FF7AD272000-memory.dmp	xmrig
behavioral2/memory/4576-615-0x00007FF6DC9B0000-0x00007FF6DCDA2000-memory.dmp	xmrig
behavioral2/memory/4484-551-0x00007FF6C6860000-0x00007FF6C6C52000-memory.dmp	xmrig
behavioral2/memory/1800-455-0x00007FF746480000-0x00007FF746872000-memory.dmp	xmrig
behavioral2/memory/508-399-0x00007FF7D4D20000-0x00007FF7D5112000-memory.dmp	xmrig
behavioral2/memory/2144-347-0x00007FF6EBFE0000-0x00007FF6EC3D2000-memory.dmp	xmrig
behavioral2/memory/1508-209-0x00007FF6C2430000-0x00007FF6C2822000-memory.dmp	xmrig
behavioral2/memory/4492-145-0x00007FF650960000-0x00007FF650D52000-memory.dmp	xmrig
behavioral2/memory/3936-2149-0x00007FF62C5A0000-0x00007FF62C992000-memory.dmp	xmrig
behavioral2/memory/2700-2151-0x00007FF635AE0000-0x00007FF635ED2000-memory.dmp	xmrig
behavioral2/memory/2112-2155-0x00007FF7ACE80000-0x00007FF7AD272000-memory.dmp	xmrig
behavioral2/memory/4484-2154-0x00007FF6C6860000-0x00007FF6C6C52000-memory.dmp	xmrig
behavioral2/memory/1508-2160-0x00007FF6C2430000-0x00007FF6C2822000-memory.dmp	xmrig
behavioral2/memory/2144-2163-0x00007FF6EBFE0000-0x00007FF6EC3D2000-memory.dmp	xmrig
behavioral2/memory/508-2162-0x00007FF7D4D20000-0x00007FF7D5112000-memory.dmp	xmrig
behavioral2/memory/4492-2158-0x00007FF650960000-0x00007FF650D52000-memory.dmp	xmrig
behavioral2/memory/2584-2181-0x00007FF7EF710000-0x00007FF7EFB02000-memory.dmp	xmrig
behavioral2/memory/4276-2186-0x00007FF789990000-0x00007FF789D82000-memory.dmp	xmrig
behavioral2/memory/1976-2187-0x00007FF7AF6D0000-0x00007FF7AFAC2000-memory.dmp	xmrig
behavioral2/memory/3432-2179-0x00007FF72C550000-0x00007FF72C942000-memory.dmp	xmrig
behavioral2/memory/4576-2177-0x00007FF6DC9B0000-0x00007FF6DCDA2000-memory.dmp	xmrig
behavioral2/memory/4960-2176-0x00007FF7D2330000-0x00007FF7D2722000-memory.dmp	xmrig
behavioral2/memory/4568-2174-0x00007FF6F83E0000-0x00007FF6F87D2000-memory.dmp	xmrig
behavioral2/memory/4092-2170-0x00007FF7BF850000-0x00007FF7BFC42000-memory.dmp	xmrig
behavioral2/memory/4456-2167-0x00007FF653D60000-0x00007FF654152000-memory.dmp	xmrig
behavioral2/memory/4688-2166-0x00007FF625B00000-0x00007FF625EF2000-memory.dmp	xmrig
behavioral2/memory/1800-2172-0x00007FF746480000-0x00007FF746872000-memory.dmp	xmrig
behavioral2/memory/5072-2216-0x00007FF78AD10000-0x00007FF78B102000-memory.dmp	xmrig
behavioral2/memory/4680-2213-0x00007FF6309D0000-0x00007FF630DC2000-memory.dmp	xmrig
behavioral2/memory/2752-2212-0x00007FF604FA0000-0x00007FF605392000-memory.dmp	xmrig
behavioral2/memory/3156-2196-0x00007FF762950000-0x00007FF762D42000-memory.dmp	xmrig
behavioral2/memory/2076-2195-0x00007FF635B80000-0x00007FF635F72000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
9	4440	powershell.exe
11	4440	powershell.exe
40	4440	powershell.exe
41	4440	powershell.exe
42	4440	powershell.exe
44	4440	powershell.exe
45	4440	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4440	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3936	ssEvmQn.exe
4492	gxMCNwX.exe
2700	AKWvNlC.exe
1508	iawazCV.exe
5072	jhAwfZP.exe
2144	PpJUZJq.exe
508	luQmILg.exe
1800	jgRGdih.exe
4484	VpZHccE.exe
4688	klNAnNy.exe
4576	IauBFlb.exe
2112	lRjrNXg.exe
4456	UlkYFec.exe
4960	KsGrtyH.exe
3432	IyAHJWJ.exe
4276	ACdAyFN.exe
4568	VqRavcl.exe
3156	haDaoaU.exe
4092	zKvkGHe.exe
2584	TPThNiy.exe
4680	GjgeOiY.exe
1976	YOPxdLe.exe
2752	fnRJbFv.exe
2076	ohOELtm.exe
3376	SCAHjgh.exe
1160	wghDBGY.exe
2124	hDeYBYt.exe
2528	XhetJXj.exe
2068	mCYJonH.exe
4600	AqdjLUd.exe
3040	bmxfwvi.exe
1896	KhaSxSq.exe
2040	bVdVzVV.exe
744	WjKkyWN.exe
1760	THtHUnr.exe
3508	tTEzMML.exe
4528	BNXOGxd.exe
1488	SkBaotv.exe
3576	duKawqB.exe
3636	ktbGWhR.exe
4064	haGxnMc.exe
3940	EqRtKTK.exe
1980	EJrHlgG.exe
3420	QJXJGUp.exe
3268	JplxIBd.exe
2080	xWNWiho.exe
2736	qupcqKp.exe
1996	aDqAuGP.exe
5088	IWmHVbA.exe
1500	QvspHlR.exe
3192	GOnDKtJ.exe
4056	IHFwBtW.exe
1608	ObSfZsL.exe
3308	WqmTmCL.exe
4220	ZNJHCWd.exe
3516	yJqBTeX.exe
4368	jckGLpV.exe
740	ilSZEwh.exe
4404	SEPGgJJ.exe
2424	IycNTTe.exe
436	ncWymHY.exe
2428	YhYUuHL.exe
2932	fIQPuji.exe
3328	YvODSPi.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2748-0-0x00007FF654090000-0x00007FF654482000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-85.dat	upx
behavioral2/files/0x000a000000023bb0-81.dat	upx
behavioral2/files/0x000a000000023bce-186.dat	upx
behavioral2/memory/4688-613-0x00007FF625B00000-0x00007FF625EF2000-memory.dmp	upx
behavioral2/memory/4960-618-0x00007FF7D2330000-0x00007FF7D2722000-memory.dmp	upx
behavioral2/memory/2584-624-0x00007FF7EF710000-0x00007FF7EFB02000-memory.dmp	upx
behavioral2/memory/2700-629-0x00007FF635AE0000-0x00007FF635ED2000-memory.dmp	upx
behavioral2/memory/2076-628-0x00007FF635B80000-0x00007FF635F72000-memory.dmp	upx
behavioral2/memory/2752-627-0x00007FF604FA0000-0x00007FF605392000-memory.dmp	upx
behavioral2/memory/1976-626-0x00007FF7AF6D0000-0x00007FF7AFAC2000-memory.dmp	upx
behavioral2/memory/4680-625-0x00007FF6309D0000-0x00007FF630DC2000-memory.dmp	upx
behavioral2/memory/4092-623-0x00007FF7BF850000-0x00007FF7BFC42000-memory.dmp	upx
behavioral2/memory/3156-622-0x00007FF762950000-0x00007FF762D42000-memory.dmp	upx
behavioral2/memory/4568-621-0x00007FF6F83E0000-0x00007FF6F87D2000-memory.dmp	upx
behavioral2/memory/4276-620-0x00007FF789990000-0x00007FF789D82000-memory.dmp	upx
behavioral2/memory/3432-619-0x00007FF72C550000-0x00007FF72C942000-memory.dmp	upx
behavioral2/memory/4456-617-0x00007FF653D60000-0x00007FF654152000-memory.dmp	upx
behavioral2/memory/2112-616-0x00007FF7ACE80000-0x00007FF7AD272000-memory.dmp	upx
behavioral2/memory/4576-615-0x00007FF6DC9B0000-0x00007FF6DCDA2000-memory.dmp	upx
behavioral2/memory/4484-551-0x00007FF6C6860000-0x00007FF6C6C52000-memory.dmp	upx
behavioral2/memory/1800-455-0x00007FF746480000-0x00007FF746872000-memory.dmp	upx
behavioral2/memory/508-399-0x00007FF7D4D20000-0x00007FF7D5112000-memory.dmp	upx
behavioral2/memory/2144-347-0x00007FF6EBFE0000-0x00007FF6EC3D2000-memory.dmp	upx
behavioral2/memory/5072-300-0x00007FF78AD10000-0x00007FF78B102000-memory.dmp	upx
behavioral2/files/0x000a000000023bd4-212.dat	upx
behavioral2/memory/1508-209-0x00007FF6C2430000-0x00007FF6C2822000-memory.dmp	upx
behavioral2/files/0x000a000000023bd2-203.dat	upx
behavioral2/files/0x000a000000023bd1-197.dat	upx
behavioral2/files/0x000a000000023bc5-194.dat	upx
behavioral2/files/0x000a000000023bd0-192.dat	upx
behavioral2/files/0x000a000000023bbb-187.dat	upx
behavioral2/files/0x000a000000023bc3-185.dat	upx
behavioral2/files/0x000a000000023bcd-184.dat	upx
behavioral2/files/0x000a000000023bcc-183.dat	upx
behavioral2/files/0x000a000000023bc1-180.dat	upx
behavioral2/files/0x000a000000023bcb-179.dat	upx
behavioral2/files/0x000a000000023bca-177.dat	upx
behavioral2/files/0x0031000000023bb7-170.dat	upx
behavioral2/files/0x000a000000023bc9-168.dat	upx
behavioral2/files/0x0031000000023bb6-161.dat	upx
behavioral2/files/0x000a000000023bc8-158.dat	upx
behavioral2/files/0x000a000000023bbd-155.dat	upx
behavioral2/files/0x000a000000023bd3-205.dat	upx
behavioral2/files/0x000a000000023bc4-134.dat	upx
behavioral2/files/0x000a000000023bb3-131.dat	upx
behavioral2/files/0x000a000000023bc2-125.dat	upx
behavioral2/files/0x000a000000023bbe-171.dat	upx
behavioral2/files/0x0031000000023bb8-114.dat	upx
behavioral2/files/0x000a000000023bbf-112.dat	upx
behavioral2/files/0x000a000000023bc7-154.dat	upx
behavioral2/files/0x000a000000023bb4-102.dat	upx
behavioral2/files/0x000a000000023bb1-101.dat	upx
behavioral2/files/0x000a000000023bbc-97.dat	upx
behavioral2/memory/4492-145-0x00007FF650960000-0x00007FF650D52000-memory.dmp	upx
behavioral2/files/0x000a000000023bb9-80.dat	upx
behavioral2/files/0x000a000000023bc0-115.dat	upx
behavioral2/files/0x000a000000023bab-75.dat	upx
behavioral2/files/0x000a000000023baf-68.dat	upx
behavioral2/files/0x000a000000023bb5-67.dat	upx
behavioral2/files/0x000a000000023bb2-108.dat	upx
behavioral2/files/0x000a000000023bae-61.dat	upx
behavioral2/files/0x000a000000023bac-60.dat	upx
behavioral2/files/0x000a000000023bad-36.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xWNWiho.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\IGTYSHZ.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\bwqOlqh.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\vrWIOPS.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\efCbNUv.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\wtxIVdL.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\judMuZf.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\LzZTPGv.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\luQmILg.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\EqRtKTK.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\xAwumam.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\cFEMEtX.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\ciNhEdG.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\ZZvmIDy.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\cWUmjES.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\ZXrUDYt.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\wYPklCB.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\bTczmCm.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\Vhzbgrz.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\HQFlEaw.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\YFmYkFt.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\pKcKBmO.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\iZdUXmk.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\qxftlAz.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\GTuBVyR.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\cFvGQqU.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\TFAGyWV.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\WqmTmCL.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\HADqdrj.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\ibcOvuP.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\ZcFAqqU.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\JWsmRye.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\NSRzVhV.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\GQIoWZy.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\MSXAfSd.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\cNxxzhZ.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\mYjonqg.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\THYpkRV.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\uKAGMXq.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\VhjXkqt.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\qIkbgMK.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\KvBMdoJ.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\BXEuwZY.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\OTIsyKn.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\PcJvIuy.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\ivsCUxV.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\bgfmJbZ.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\Olyhppo.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\fBnMzKZ.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\JplxIBd.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\jckGLpV.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\VGPbCJF.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\TFIYWaT.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\DHZKecq.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\XEuHZCk.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\xeKKgBr.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\JfDvZct.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\BhSgHtO.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\BJBWmWT.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\ajjNkPw.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\TPThNiy.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\PflLXmq.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\ycWiEIK.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
File created	C:\Windows\System\UqzUKTU.exe	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4440	powershell.exe
4440	powershell.exe
4440	powershell.exe
4440	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeLockMemoryPrivilege	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4440	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	85
PID 2748 wrote to memory of 4440	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	85
PID 2748 wrote to memory of 3936	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	86
PID 2748 wrote to memory of 3936	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	86
PID 2748 wrote to memory of 4492	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	87
PID 2748 wrote to memory of 4492	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	87
PID 2748 wrote to memory of 2144	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	88
PID 2748 wrote to memory of 2144	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	88
PID 2748 wrote to memory of 2700	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	89
PID 2748 wrote to memory of 2700	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	89
PID 2748 wrote to memory of 1508	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	90
PID 2748 wrote to memory of 1508	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	90
PID 2748 wrote to memory of 5072	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	91
PID 2748 wrote to memory of 5072	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	91
PID 2748 wrote to memory of 4484	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	92
PID 2748 wrote to memory of 4484	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	92
PID 2748 wrote to memory of 508	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	93
PID 2748 wrote to memory of 508	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	93
PID 2748 wrote to memory of 1800	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	94
PID 2748 wrote to memory of 1800	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	94
PID 2748 wrote to memory of 4688	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	95
PID 2748 wrote to memory of 4688	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	95
PID 2748 wrote to memory of 4576	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	96
PID 2748 wrote to memory of 4576	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	96
PID 2748 wrote to memory of 3156	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	97
PID 2748 wrote to memory of 3156	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	97
PID 2748 wrote to memory of 2112	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	98
PID 2748 wrote to memory of 2112	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	98
PID 2748 wrote to memory of 4456	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	99
PID 2748 wrote to memory of 4456	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	99
PID 2748 wrote to memory of 1976	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	100
PID 2748 wrote to memory of 1976	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	100
PID 2748 wrote to memory of 2752	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	101
PID 2748 wrote to memory of 2752	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	101
PID 2748 wrote to memory of 4960	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	102
PID 2748 wrote to memory of 4960	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	102
PID 2748 wrote to memory of 3432	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	103
PID 2748 wrote to memory of 3432	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	103
PID 2748 wrote to memory of 4276	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	104
PID 2748 wrote to memory of 4276	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	104
PID 2748 wrote to memory of 4568	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	105
PID 2748 wrote to memory of 4568	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	105
PID 2748 wrote to memory of 4092	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	106
PID 2748 wrote to memory of 4092	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	106
PID 2748 wrote to memory of 2584	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	107
PID 2748 wrote to memory of 2584	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	107
PID 2748 wrote to memory of 4680	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	108
PID 2748 wrote to memory of 4680	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	108
PID 2748 wrote to memory of 2076	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	109
PID 2748 wrote to memory of 2076	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	109
PID 2748 wrote to memory of 2040	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	110
PID 2748 wrote to memory of 2040	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	110
PID 2748 wrote to memory of 3376	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	111
PID 2748 wrote to memory of 3376	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	111
PID 2748 wrote to memory of 3508	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	112
PID 2748 wrote to memory of 3508	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	112
PID 2748 wrote to memory of 1160	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	113
PID 2748 wrote to memory of 1160	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	113
PID 2748 wrote to memory of 2124	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	114
PID 2748 wrote to memory of 2124	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	114
PID 2748 wrote to memory of 1980	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	115
PID 2748 wrote to memory of 1980	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	115
PID 2748 wrote to memory of 2528	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	116
PID 2748 wrote to memory of 2528	2748	10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe	116

C:\Users\Admin\AppData\Local\Temp\10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\10e55f66bfae9e277a66bfff810c42d0_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\System\ssEvmQn.exe
  C:\Windows\System\ssEvmQn.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\gxMCNwX.exe
  C:\Windows\System\gxMCNwX.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\PpJUZJq.exe
  C:\Windows\System\PpJUZJq.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\AKWvNlC.exe
  C:\Windows\System\AKWvNlC.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\iawazCV.exe
  C:\Windows\System\iawazCV.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\jhAwfZP.exe
  C:\Windows\System\jhAwfZP.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\VpZHccE.exe
  C:\Windows\System\VpZHccE.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\luQmILg.exe
  C:\Windows\System\luQmILg.exe
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Windows\System\jgRGdih.exe
  C:\Windows\System\jgRGdih.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\klNAnNy.exe
  C:\Windows\System\klNAnNy.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\IauBFlb.exe
  C:\Windows\System\IauBFlb.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\haDaoaU.exe
  C:\Windows\System\haDaoaU.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\lRjrNXg.exe
  C:\Windows\System\lRjrNXg.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\UlkYFec.exe
  C:\Windows\System\UlkYFec.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\YOPxdLe.exe
  C:\Windows\System\YOPxdLe.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\fnRJbFv.exe
  C:\Windows\System\fnRJbFv.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\KsGrtyH.exe
  C:\Windows\System\KsGrtyH.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\IyAHJWJ.exe
  C:\Windows\System\IyAHJWJ.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\ACdAyFN.exe
  C:\Windows\System\ACdAyFN.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\VqRavcl.exe
  C:\Windows\System\VqRavcl.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\zKvkGHe.exe
  C:\Windows\System\zKvkGHe.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\TPThNiy.exe
  C:\Windows\System\TPThNiy.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\GjgeOiY.exe
  C:\Windows\System\GjgeOiY.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\ohOELtm.exe
  C:\Windows\System\ohOELtm.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\bVdVzVV.exe
  C:\Windows\System\bVdVzVV.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\SCAHjgh.exe
  C:\Windows\System\SCAHjgh.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\tTEzMML.exe
  C:\Windows\System\tTEzMML.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\wghDBGY.exe
  C:\Windows\System\wghDBGY.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\hDeYBYt.exe
  C:\Windows\System\hDeYBYt.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\EJrHlgG.exe
  C:\Windows\System\EJrHlgG.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\XhetJXj.exe
  C:\Windows\System\XhetJXj.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\mCYJonH.exe
  C:\Windows\System\mCYJonH.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\AqdjLUd.exe
  C:\Windows\System\AqdjLUd.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\bmxfwvi.exe
  C:\Windows\System\bmxfwvi.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\KhaSxSq.exe
  C:\Windows\System\KhaSxSq.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\WjKkyWN.exe
  C:\Windows\System\WjKkyWN.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\THtHUnr.exe
  C:\Windows\System\THtHUnr.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\BNXOGxd.exe
  C:\Windows\System\BNXOGxd.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\ObSfZsL.exe
  C:\Windows\System\ObSfZsL.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\SkBaotv.exe
  C:\Windows\System\SkBaotv.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\duKawqB.exe
  C:\Windows\System\duKawqB.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\ktbGWhR.exe
  C:\Windows\System\ktbGWhR.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\haGxnMc.exe
  C:\Windows\System\haGxnMc.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\EqRtKTK.exe
  C:\Windows\System\EqRtKTK.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\QJXJGUp.exe
  C:\Windows\System\QJXJGUp.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\JplxIBd.exe
  C:\Windows\System\JplxIBd.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\xWNWiho.exe
  C:\Windows\System\xWNWiho.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\qupcqKp.exe
  C:\Windows\System\qupcqKp.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\aDqAuGP.exe
  C:\Windows\System\aDqAuGP.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\IWmHVbA.exe
  C:\Windows\System\IWmHVbA.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\QvspHlR.exe
  C:\Windows\System\QvspHlR.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\zjWUNRv.exe
  C:\Windows\System\zjWUNRv.exe
  2⤵
  PID:3840
- C:\Windows\System\GOnDKtJ.exe
  C:\Windows\System\GOnDKtJ.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\IHFwBtW.exe
  C:\Windows\System\IHFwBtW.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\WqmTmCL.exe
  C:\Windows\System\WqmTmCL.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\ZNJHCWd.exe
  C:\Windows\System\ZNJHCWd.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\yJqBTeX.exe
  C:\Windows\System\yJqBTeX.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\jckGLpV.exe
  C:\Windows\System\jckGLpV.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\ilSZEwh.exe
  C:\Windows\System\ilSZEwh.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\SEPGgJJ.exe
  C:\Windows\System\SEPGgJJ.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\IycNTTe.exe
  C:\Windows\System\IycNTTe.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\ncWymHY.exe
  C:\Windows\System\ncWymHY.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\YhYUuHL.exe
  C:\Windows\System\YhYUuHL.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\fIQPuji.exe
  C:\Windows\System\fIQPuji.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\OOWCKkw.exe
  C:\Windows\System\OOWCKkw.exe
  2⤵
  PID:4736
- C:\Windows\System\YvODSPi.exe
  C:\Windows\System\YvODSPi.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\TJvhSRa.exe
  C:\Windows\System\TJvhSRa.exe
  2⤵
  PID:4872
- C:\Windows\System\wYPklCB.exe
  C:\Windows\System\wYPklCB.exe
  2⤵
  PID:3732
- C:\Windows\System\NPZyvUl.exe
  C:\Windows\System\NPZyvUl.exe
  2⤵
  PID:5116
- C:\Windows\System\UymfqNR.exe
  C:\Windows\System\UymfqNR.exe
  2⤵
  PID:624
- C:\Windows\System\EZRRfKh.exe
  C:\Windows\System\EZRRfKh.exe
  2⤵
  PID:864
- C:\Windows\System\eXwObHY.exe
  C:\Windows\System\eXwObHY.exe
  2⤵
  PID:4536
- C:\Windows\System\pKcKBmO.exe
  C:\Windows\System\pKcKBmO.exe
  2⤵
  PID:708
- C:\Windows\System\nuDvEIb.exe
  C:\Windows\System\nuDvEIb.exe
  2⤵
  PID:2980
- C:\Windows\System\qdWSTwG.exe
  C:\Windows\System\qdWSTwG.exe
  2⤵
  PID:384
- C:\Windows\System\KPaGtXD.exe
  C:\Windows\System\KPaGtXD.exe
  2⤵
  PID:1728
- C:\Windows\System\kRgCpbv.exe
  C:\Windows\System\kRgCpbv.exe
  2⤵
  PID:3276
- C:\Windows\System\gqcuchw.exe
  C:\Windows\System\gqcuchw.exe
  2⤵
  PID:2264
- C:\Windows\System\UcmACsc.exe
  C:\Windows\System\UcmACsc.exe
  2⤵
  PID:2604
- C:\Windows\System\rmEzZuR.exe
  C:\Windows\System\rmEzZuR.exe
  2⤵
  PID:876
- C:\Windows\System\OYUHDfS.exe
  C:\Windows\System\OYUHDfS.exe
  2⤵
  PID:2508
- C:\Windows\System\qUrAVQS.exe
  C:\Windows\System\qUrAVQS.exe
  2⤵
  PID:5136
- C:\Windows\System\ohbKTOl.exe
  C:\Windows\System\ohbKTOl.exe
  2⤵
  PID:5156
- C:\Windows\System\Iwplbon.exe
  C:\Windows\System\Iwplbon.exe
  2⤵
  PID:5180
- C:\Windows\System\LDwJoDn.exe
  C:\Windows\System\LDwJoDn.exe
  2⤵
  PID:5196
- C:\Windows\System\BuzxEid.exe
  C:\Windows\System\BuzxEid.exe
  2⤵
  PID:5224
- C:\Windows\System\AeupIGX.exe
  C:\Windows\System\AeupIGX.exe
  2⤵
  PID:5240
- C:\Windows\System\gCQrUZk.exe
  C:\Windows\System\gCQrUZk.exe
  2⤵
  PID:5260
- C:\Windows\System\UmGmDHN.exe
  C:\Windows\System\UmGmDHN.exe
  2⤵
  PID:5280
- C:\Windows\System\BJUWQrR.exe
  C:\Windows\System\BJUWQrR.exe
  2⤵
  PID:5296
- C:\Windows\System\utKZSfh.exe
  C:\Windows\System\utKZSfh.exe
  2⤵
  PID:5320
- C:\Windows\System\LhvJlpH.exe
  C:\Windows\System\LhvJlpH.exe
  2⤵
  PID:5336
- C:\Windows\System\yfYylXS.exe
  C:\Windows\System\yfYylXS.exe
  2⤵
  PID:5360
- C:\Windows\System\jBojPZS.exe
  C:\Windows\System\jBojPZS.exe
  2⤵
  PID:5384
- C:\Windows\System\aWSdQLT.exe
  C:\Windows\System\aWSdQLT.exe
  2⤵
  PID:5400
- C:\Windows\System\QcsOYbR.exe
  C:\Windows\System\QcsOYbR.exe
  2⤵
  PID:5420
- C:\Windows\System\lKzBuEk.exe
  C:\Windows\System\lKzBuEk.exe
  2⤵
  PID:5440
- C:\Windows\System\KjcJlvD.exe
  C:\Windows\System\KjcJlvD.exe
  2⤵
  PID:5456
- C:\Windows\System\phJKROT.exe
  C:\Windows\System\phJKROT.exe
  2⤵
  PID:5476
- C:\Windows\System\THPHgmp.exe
  C:\Windows\System\THPHgmp.exe
  2⤵
  PID:5504
- C:\Windows\System\nhodiDo.exe
  C:\Windows\System\nhodiDo.exe
  2⤵
  PID:5520
- C:\Windows\System\ItWckkZ.exe
  C:\Windows\System\ItWckkZ.exe
  2⤵
  PID:5544
- C:\Windows\System\VTIhUbn.exe
  C:\Windows\System\VTIhUbn.exe
  2⤵
  PID:5560
- C:\Windows\System\pUOqaKZ.exe
  C:\Windows\System\pUOqaKZ.exe
  2⤵
  PID:5592
- C:\Windows\System\mtrmZoV.exe
  C:\Windows\System\mtrmZoV.exe
  2⤵
  PID:5616
- C:\Windows\System\IIsfOGa.exe
  C:\Windows\System\IIsfOGa.exe
  2⤵
  PID:5640
- C:\Windows\System\brJcjNj.exe
  C:\Windows\System\brJcjNj.exe
  2⤵
  PID:5656
- C:\Windows\System\ElvyMZx.exe
  C:\Windows\System\ElvyMZx.exe
  2⤵
  PID:5676
- C:\Windows\System\SAZdSIW.exe
  C:\Windows\System\SAZdSIW.exe
  2⤵
  PID:5692
- C:\Windows\System\MSXAfSd.exe
  C:\Windows\System\MSXAfSd.exe
  2⤵
  PID:5716
- C:\Windows\System\frFkhIH.exe
  C:\Windows\System\frFkhIH.exe
  2⤵
  PID:5800
- C:\Windows\System\vGYJWif.exe
  C:\Windows\System\vGYJWif.exe
  2⤵
  PID:5836
- C:\Windows\System\UBdvoSs.exe
  C:\Windows\System\UBdvoSs.exe
  2⤵
  PID:5856
- C:\Windows\System\okjoFWX.exe
  C:\Windows\System\okjoFWX.exe
  2⤵
  PID:5884
- C:\Windows\System\EtAjwzH.exe
  C:\Windows\System\EtAjwzH.exe
  2⤵
  PID:5904
- C:\Windows\System\MMHvgFr.exe
  C:\Windows\System\MMHvgFr.exe
  2⤵
  PID:5924
- C:\Windows\System\PoTPNIH.exe
  C:\Windows\System\PoTPNIH.exe
  2⤵
  PID:5944
- C:\Windows\System\ZpSfShf.exe
  C:\Windows\System\ZpSfShf.exe
  2⤵
  PID:5964
- C:\Windows\System\Xdergvq.exe
  C:\Windows\System\Xdergvq.exe
  2⤵
  PID:5984
- C:\Windows\System\DekBXOV.exe
  C:\Windows\System\DekBXOV.exe
  2⤵
  PID:6012
- C:\Windows\System\CIlnfya.exe
  C:\Windows\System\CIlnfya.exe
  2⤵
  PID:6028
- C:\Windows\System\vBombbN.exe
  C:\Windows\System\vBombbN.exe
  2⤵
  PID:6064
- C:\Windows\System\UcskbZf.exe
  C:\Windows\System\UcskbZf.exe
  2⤵
  PID:6084
- C:\Windows\System\CVoppNb.exe
  C:\Windows\System\CVoppNb.exe
  2⤵
  PID:6108
- C:\Windows\System\IGTYSHZ.exe
  C:\Windows\System\IGTYSHZ.exe
  2⤵
  PID:6128
- C:\Windows\System\OBNTZdj.exe
  C:\Windows\System\OBNTZdj.exe
  2⤵
  PID:2184
- C:\Windows\System\AQMrDkI.exe
  C:\Windows\System\AQMrDkI.exe
  2⤵
  PID:3644
- C:\Windows\System\dsTGvNx.exe
  C:\Windows\System\dsTGvNx.exe
  2⤵
  PID:3656
- C:\Windows\System\wFsUzHl.exe
  C:\Windows\System\wFsUzHl.exe
  2⤵
  PID:4280
- C:\Windows\System\VrbRDoC.exe
  C:\Windows\System\VrbRDoC.exe
  2⤵
  PID:5556
- C:\Windows\System\xAwumam.exe
  C:\Windows\System\xAwumam.exe
  2⤵
  PID:2224
- C:\Windows\System\bTczmCm.exe
  C:\Windows\System\bTczmCm.exe
  2⤵
  PID:5372
- C:\Windows\System\xDkpOUS.exe
  C:\Windows\System\xDkpOUS.exe
  2⤵
  PID:5980
- C:\Windows\System\dcusYYV.exe
  C:\Windows\System\dcusYYV.exe
  2⤵
  PID:4344
- C:\Windows\System\aqZQmHM.exe
  C:\Windows\System\aqZQmHM.exe
  2⤵
  PID:1956
- C:\Windows\System\Zbfudll.exe
  C:\Windows\System\Zbfudll.exe
  2⤵
  PID:3976
- C:\Windows\System\qSrwnCm.exe
  C:\Windows\System\qSrwnCm.exe
  2⤵
  PID:1124
- C:\Windows\System\oDbtKgk.exe
  C:\Windows\System\oDbtKgk.exe
  2⤵
  PID:5176
- C:\Windows\System\lowgQnV.exe
  C:\Windows\System\lowgQnV.exe
  2⤵
  PID:5252
- C:\Windows\System\KiDdDDy.exe
  C:\Windows\System\KiDdDDy.exe
  2⤵
  PID:5304
- C:\Windows\System\ZfLCFMD.exe
  C:\Windows\System\ZfLCFMD.exe
  2⤵
  PID:5396
- C:\Windows\System\HADqdrj.exe
  C:\Windows\System\HADqdrj.exe
  2⤵
  PID:5164
- C:\Windows\System\ZgxyXjR.exe
  C:\Windows\System\ZgxyXjR.exe
  2⤵
  PID:6156
- C:\Windows\System\JrxOjJj.exe
  C:\Windows\System\JrxOjJj.exe
  2⤵
  PID:6180
- C:\Windows\System\CVQpbvB.exe
  C:\Windows\System\CVQpbvB.exe
  2⤵
  PID:6204
- C:\Windows\System\uRWANcU.exe
  C:\Windows\System\uRWANcU.exe
  2⤵
  PID:6220
- C:\Windows\System\rjMwYQR.exe
  C:\Windows\System\rjMwYQR.exe
  2⤵
  PID:6240
- C:\Windows\System\nbeGwzV.exe
  C:\Windows\System\nbeGwzV.exe
  2⤵
  PID:6268
- C:\Windows\System\JfDvZct.exe
  C:\Windows\System\JfDvZct.exe
  2⤵
  PID:6292
- C:\Windows\System\sunvvyw.exe
  C:\Windows\System\sunvvyw.exe
  2⤵
  PID:6340
- C:\Windows\System\BWMaTxl.exe
  C:\Windows\System\BWMaTxl.exe
  2⤵
  PID:6364
- C:\Windows\System\lWYKlyj.exe
  C:\Windows\System\lWYKlyj.exe
  2⤵
  PID:6380
- C:\Windows\System\UBIicgj.exe
  C:\Windows\System\UBIicgj.exe
  2⤵
  PID:6396
- C:\Windows\System\BbbYezK.exe
  C:\Windows\System\BbbYezK.exe
  2⤵
  PID:6416
- C:\Windows\System\Vhzbgrz.exe
  C:\Windows\System\Vhzbgrz.exe
  2⤵
  PID:6440
- C:\Windows\System\aUeZLSs.exe
  C:\Windows\System\aUeZLSs.exe
  2⤵
  PID:6456
- C:\Windows\System\FOZZrzD.exe
  C:\Windows\System\FOZZrzD.exe
  2⤵
  PID:6480
- C:\Windows\System\lSOdXtz.exe
  C:\Windows\System\lSOdXtz.exe
  2⤵
  PID:6508
- C:\Windows\System\AcjfgTW.exe
  C:\Windows\System\AcjfgTW.exe
  2⤵
  PID:6556
- C:\Windows\System\zpCmkAE.exe
  C:\Windows\System\zpCmkAE.exe
  2⤵
  PID:6576
- C:\Windows\System\QQeimDS.exe
  C:\Windows\System\QQeimDS.exe
  2⤵
  PID:6608
- C:\Windows\System\RruOiAB.exe
  C:\Windows\System\RruOiAB.exe
  2⤵
  PID:6628
- C:\Windows\System\KMEjgAy.exe
  C:\Windows\System\KMEjgAy.exe
  2⤵
  PID:6656
- C:\Windows\System\HQFlEaw.exe
  C:\Windows\System\HQFlEaw.exe
  2⤵
  PID:6736
- C:\Windows\System\Mzvjbhp.exe
  C:\Windows\System\Mzvjbhp.exe
  2⤵
  PID:6764
- C:\Windows\System\eNqoZHH.exe
  C:\Windows\System\eNqoZHH.exe
  2⤵
  PID:6780
- C:\Windows\System\bwqOlqh.exe
  C:\Windows\System\bwqOlqh.exe
  2⤵
  PID:6800
- C:\Windows\System\HzCunko.exe
  C:\Windows\System\HzCunko.exe
  2⤵
  PID:6820
- C:\Windows\System\cNxxzhZ.exe
  C:\Windows\System\cNxxzhZ.exe
  2⤵
  PID:6836
- C:\Windows\System\aOnbZhc.exe
  C:\Windows\System\aOnbZhc.exe
  2⤵
  PID:6856
- C:\Windows\System\AzvICTT.exe
  C:\Windows\System\AzvICTT.exe
  2⤵
  PID:6876
- C:\Windows\System\IEmqTTj.exe
  C:\Windows\System\IEmqTTj.exe
  2⤵
  PID:6896
- C:\Windows\System\ZeJMuaI.exe
  C:\Windows\System\ZeJMuaI.exe
  2⤵
  PID:6912
- C:\Windows\System\XRBJcVH.exe
  C:\Windows\System\XRBJcVH.exe
  2⤵
  PID:6932
- C:\Windows\System\lJYJFfm.exe
  C:\Windows\System\lJYJFfm.exe
  2⤵
  PID:6956
- C:\Windows\System\KRgKOrV.exe
  C:\Windows\System\KRgKOrV.exe
  2⤵
  PID:6972
- C:\Windows\System\iZdUXmk.exe
  C:\Windows\System\iZdUXmk.exe
  2⤵
  PID:6996
- C:\Windows\System\jcPkZbI.exe
  C:\Windows\System\jcPkZbI.exe
  2⤵
  PID:7028
- C:\Windows\System\hCatgRK.exe
  C:\Windows\System\hCatgRK.exe
  2⤵
  PID:7048
- C:\Windows\System\ltEnMLx.exe
  C:\Windows\System\ltEnMLx.exe
  2⤵
  PID:7064
- C:\Windows\System\hSurIwe.exe
  C:\Windows\System\hSurIwe.exe
  2⤵
  PID:7080
- C:\Windows\System\lULQkZP.exe
  C:\Windows\System\lULQkZP.exe
  2⤵
  PID:7100
- C:\Windows\System\xezNkvj.exe
  C:\Windows\System\xezNkvj.exe
  2⤵
  PID:7124
- C:\Windows\System\TmlYAoa.exe
  C:\Windows\System\TmlYAoa.exe
  2⤵
  PID:7144
- C:\Windows\System\jzdXRZo.exe
  C:\Windows\System\jzdXRZo.exe
  2⤵
  PID:7160
- C:\Windows\System\IUaXBtO.exe
  C:\Windows\System\IUaXBtO.exe
  2⤵
  PID:6000
- C:\Windows\System\svkYfIq.exe
  C:\Windows\System\svkYfIq.exe
  2⤵
  PID:5528
- C:\Windows\System\BYtqIgn.exe
  C:\Windows\System\BYtqIgn.exe
  2⤵
  PID:5624
- C:\Windows\System\uRxmhQB.exe
  C:\Windows\System\uRxmhQB.exe
  2⤵
  PID:5700
- C:\Windows\System\sDdyOnE.exe
  C:\Windows\System\sDdyOnE.exe
  2⤵
  PID:5780
- C:\Windows\System\MtGEqHU.exe
  C:\Windows\System\MtGEqHU.exe
  2⤵
  PID:5848
- C:\Windows\System\SytcFMo.exe
  C:\Windows\System\SytcFMo.exe
  2⤵
  PID:3248
- C:\Windows\System\mYjonqg.exe
  C:\Windows\System\mYjonqg.exe
  2⤵
  PID:5236
- C:\Windows\System\DGmyraG.exe
  C:\Windows\System\DGmyraG.exe
  2⤵
  PID:4104
- C:\Windows\System\YTYvhkT.exe
  C:\Windows\System\YTYvhkT.exe
  2⤵
  PID:316
- C:\Windows\System\JuijlFm.exe
  C:\Windows\System\JuijlFm.exe
  2⤵
  PID:5956
- C:\Windows\System\TGhptUE.exe
  C:\Windows\System\TGhptUE.exe
  2⤵
  PID:6216
- C:\Windows\System\tgqMXGI.exe
  C:\Windows\System\tgqMXGI.exe
  2⤵
  PID:3372
- C:\Windows\System\soyGMne.exe
  C:\Windows\System\soyGMne.exe
  2⤵
  PID:6024
- C:\Windows\System\hFkKKgG.exe
  C:\Windows\System\hFkKKgG.exe
  2⤵
  PID:6080
- C:\Windows\System\LHkzesF.exe
  C:\Windows\System\LHkzesF.exe
  2⤵
  PID:6140
- C:\Windows\System\DOykGZq.exe
  C:\Windows\System\DOykGZq.exe
  2⤵
  PID:6404
- C:\Windows\System\mitaesd.exe
  C:\Windows\System\mitaesd.exe
  2⤵
  PID:7176
- C:\Windows\System\mTIhopv.exe
  C:\Windows\System\mTIhopv.exe
  2⤵
  PID:7400
- C:\Windows\System\HFcRUGz.exe
  C:\Windows\System\HFcRUGz.exe
  2⤵
  PID:7416
- C:\Windows\System\ijgtrMh.exe
  C:\Windows\System\ijgtrMh.exe
  2⤵
  PID:7436
- C:\Windows\System\NlOebtl.exe
  C:\Windows\System\NlOebtl.exe
  2⤵
  PID:7452
- C:\Windows\System\xfRUYZt.exe
  C:\Windows\System\xfRUYZt.exe
  2⤵
  PID:7468
- C:\Windows\System\tnItJrN.exe
  C:\Windows\System\tnItJrN.exe
  2⤵
  PID:7484
- C:\Windows\System\rFKxBJK.exe
  C:\Windows\System\rFKxBJK.exe
  2⤵
  PID:7500
- C:\Windows\System\qcbuATO.exe
  C:\Windows\System\qcbuATO.exe
  2⤵
  PID:7516
- C:\Windows\System\WLnqLNY.exe
  C:\Windows\System\WLnqLNY.exe
  2⤵
  PID:7532
- C:\Windows\System\EdiNSzY.exe
  C:\Windows\System\EdiNSzY.exe
  2⤵
  PID:7548
- C:\Windows\System\GQUXVts.exe
  C:\Windows\System\GQUXVts.exe
  2⤵
  PID:7564
- C:\Windows\System\GfntgPO.exe
  C:\Windows\System\GfntgPO.exe
  2⤵
  PID:7580
- C:\Windows\System\navBZEv.exe
  C:\Windows\System\navBZEv.exe
  2⤵
  PID:7596
- C:\Windows\System\hFSDigF.exe
  C:\Windows\System\hFSDigF.exe
  2⤵
  PID:7612
- C:\Windows\System\QQZzGJT.exe
  C:\Windows\System\QQZzGJT.exe
  2⤵
  PID:7628
- C:\Windows\System\RNrUpon.exe
  C:\Windows\System\RNrUpon.exe
  2⤵
  PID:7644
- C:\Windows\System\JLRDfbo.exe
  C:\Windows\System\JLRDfbo.exe
  2⤵
  PID:7660
- C:\Windows\System\GtsEuUy.exe
  C:\Windows\System\GtsEuUy.exe
  2⤵
  PID:7676
- C:\Windows\System\qYcNJoU.exe
  C:\Windows\System\qYcNJoU.exe
  2⤵
  PID:7692
- C:\Windows\System\OTIsyKn.exe
  C:\Windows\System\OTIsyKn.exe
  2⤵
  PID:7708
- C:\Windows\System\cqPjHeE.exe
  C:\Windows\System\cqPjHeE.exe
  2⤵
  PID:7724
- C:\Windows\System\ciNhEdG.exe
  C:\Windows\System\ciNhEdG.exe
  2⤵
  PID:7740
- C:\Windows\System\zyjgryw.exe
  C:\Windows\System\zyjgryw.exe
  2⤵
  PID:7760
- C:\Windows\System\MBBoIOd.exe
  C:\Windows\System\MBBoIOd.exe
  2⤵
  PID:7776
- C:\Windows\System\gCwdeZd.exe
  C:\Windows\System\gCwdeZd.exe
  2⤵
  PID:7792
- C:\Windows\System\GzrJrgf.exe
  C:\Windows\System\GzrJrgf.exe
  2⤵
  PID:7808
- C:\Windows\System\kPKbHRX.exe
  C:\Windows\System\kPKbHRX.exe
  2⤵
  PID:8004
- C:\Windows\System\dXhVrDP.exe
  C:\Windows\System\dXhVrDP.exe
  2⤵
  PID:8028
- C:\Windows\System\yFRKpPb.exe
  C:\Windows\System\yFRKpPb.exe
  2⤵
  PID:8044
- C:\Windows\System\FvceDlW.exe
  C:\Windows\System\FvceDlW.exe
  2⤵
  PID:8060
- C:\Windows\System\iDusrBr.exe
  C:\Windows\System\iDusrBr.exe
  2⤵
  PID:8076
- C:\Windows\System\ZPDECmA.exe
  C:\Windows\System\ZPDECmA.exe
  2⤵
  PID:8092
- C:\Windows\System\DhRzQvb.exe
  C:\Windows\System\DhRzQvb.exe
  2⤵
  PID:8108
- C:\Windows\System\vXoMxBq.exe
  C:\Windows\System\vXoMxBq.exe
  2⤵
  PID:8124
- C:\Windows\System\yYTtLgc.exe
  C:\Windows\System\yYTtLgc.exe
  2⤵
  PID:8140
- C:\Windows\System\rkVYAhm.exe
  C:\Windows\System\rkVYAhm.exe
  2⤵
  PID:8156
- C:\Windows\System\PPUKptU.exe
  C:\Windows\System\PPUKptU.exe
  2⤵
  PID:8172
- C:\Windows\System\PRFnbFS.exe
  C:\Windows\System\PRFnbFS.exe
  2⤵
  PID:8188
- C:\Windows\System\igFhIYI.exe
  C:\Windows\System\igFhIYI.exe
  2⤵
  PID:4296
- C:\Windows\System\vbfzYVx.exe
  C:\Windows\System\vbfzYVx.exe
  2⤵
  PID:6136
- C:\Windows\System\VUZWCsS.exe
  C:\Windows\System\VUZWCsS.exe
  2⤵
  PID:6968
- C:\Windows\System\VGPbCJF.exe
  C:\Windows\System\VGPbCJF.exe
  2⤵
  PID:7020
- C:\Windows\System\dEwrpnx.exe
  C:\Windows\System\dEwrpnx.exe
  2⤵
  PID:7060
- C:\Windows\System\mPIGyjT.exe
  C:\Windows\System\mPIGyjT.exe
  2⤵
  PID:7108
- C:\Windows\System\JtBPgvg.exe
  C:\Windows\System\JtBPgvg.exe
  2⤵
  PID:7152
- C:\Windows\System\fQWJkDN.exe
  C:\Windows\System\fQWJkDN.exe
  2⤵
  PID:5516
- C:\Windows\System\HDroUpk.exe
  C:\Windows\System\HDroUpk.exe
  2⤵
  PID:5724
- C:\Windows\System\VozUWnq.exe
  C:\Windows\System\VozUWnq.exe
  2⤵
  PID:5900
- C:\Windows\System\bkCNUSC.exe
  C:\Windows\System\bkCNUSC.exe
  2⤵
  PID:4996
- C:\Windows\System\ZbGJjey.exe
  C:\Windows\System\ZbGJjey.exe
  2⤵
  PID:6212
- C:\Windows\System\tiCXUrk.exe
  C:\Windows\System\tiCXUrk.exe
  2⤵
  PID:6040
- C:\Windows\System\IOnrfCz.exe
  C:\Windows\System\IOnrfCz.exe
  2⤵
  PID:3748
- C:\Windows\System\PodDCZw.exe
  C:\Windows\System\PodDCZw.exe
  2⤵
  PID:3616
- C:\Windows\System\jpHqQrJ.exe
  C:\Windows\System\jpHqQrJ.exe
  2⤵
  PID:8208
- C:\Windows\System\cFEMEtX.exe
  C:\Windows\System\cFEMEtX.exe
  2⤵
  PID:8288
- C:\Windows\System\BUPoAPc.exe
  C:\Windows\System\BUPoAPc.exe
  2⤵
  PID:8324
- C:\Windows\System\bvNSlgR.exe
  C:\Windows\System\bvNSlgR.exe
  2⤵
  PID:8344
- C:\Windows\System\WAZBfJS.exe
  C:\Windows\System\WAZBfJS.exe
  2⤵
  PID:8360
- C:\Windows\System\dQrFUTa.exe
  C:\Windows\System\dQrFUTa.exe
  2⤵
  PID:8384
- C:\Windows\System\ibcOvuP.exe
  C:\Windows\System\ibcOvuP.exe
  2⤵
  PID:8400
- C:\Windows\System\vXkSbPA.exe
  C:\Windows\System\vXkSbPA.exe
  2⤵
  PID:8448
- C:\Windows\System\UhJhnSW.exe
  C:\Windows\System\UhJhnSW.exe
  2⤵
  PID:8504
- C:\Windows\System\jRbnLHl.exe
  C:\Windows\System\jRbnLHl.exe
  2⤵
  PID:8520
- C:\Windows\System\pfAPKKK.exe
  C:\Windows\System\pfAPKKK.exe
  2⤵
  PID:8616
- C:\Windows\System\dUtENfD.exe
  C:\Windows\System\dUtENfD.exe
  2⤵
  PID:8640
- C:\Windows\System\LyZZntL.exe
  C:\Windows\System\LyZZntL.exe
  2⤵
  PID:8656
- C:\Windows\System\kblJmtu.exe
  C:\Windows\System\kblJmtu.exe
  2⤵
  PID:8680
- C:\Windows\System\MTLjwSj.exe
  C:\Windows\System\MTLjwSj.exe
  2⤵
  PID:8696
- C:\Windows\System\eLIvtdc.exe
  C:\Windows\System\eLIvtdc.exe
  2⤵
  PID:8720
- C:\Windows\System\IndLhtB.exe
  C:\Windows\System\IndLhtB.exe
  2⤵
  PID:8736
- C:\Windows\System\utieobC.exe
  C:\Windows\System\utieobC.exe
  2⤵
  PID:8760
- C:\Windows\System\MslUUTH.exe
  C:\Windows\System\MslUUTH.exe
  2⤵
  PID:8776
- C:\Windows\System\oIdXkGH.exe
  C:\Windows\System\oIdXkGH.exe
  2⤵
  PID:8800
- C:\Windows\System\JLSzeTE.exe
  C:\Windows\System\JLSzeTE.exe
  2⤵
  PID:8816
- C:\Windows\System\TmStQjY.exe
  C:\Windows\System\TmStQjY.exe
  2⤵
  PID:8840
- C:\Windows\System\LSjzuQt.exe
  C:\Windows\System\LSjzuQt.exe
  2⤵
  PID:8860
- C:\Windows\System\HRsAhrz.exe
  C:\Windows\System\HRsAhrz.exe
  2⤵
  PID:8880
- C:\Windows\System\oOtazEg.exe
  C:\Windows\System\oOtazEg.exe
  2⤵
  PID:8900
- C:\Windows\System\rBlaPzJ.exe
  C:\Windows\System\rBlaPzJ.exe
  2⤵
  PID:9024
- C:\Windows\System\TgpCNav.exe
  C:\Windows\System\TgpCNav.exe
  2⤵
  PID:9044
- C:\Windows\System\PcJvIuy.exe
  C:\Windows\System\PcJvIuy.exe
  2⤵
  PID:9064
- C:\Windows\System\cCiqwLB.exe
  C:\Windows\System\cCiqwLB.exe
  2⤵
  PID:9088
- C:\Windows\System\YAfngCv.exe
  C:\Windows\System\YAfngCv.exe
  2⤵
  PID:9104
- C:\Windows\System\zLKqJpv.exe
  C:\Windows\System\zLKqJpv.exe
  2⤵
  PID:9128
- C:\Windows\System\LJWgqlk.exe
  C:\Windows\System\LJWgqlk.exe
  2⤵
  PID:9144
- C:\Windows\System\ziNWgip.exe
  C:\Windows\System\ziNWgip.exe
  2⤵
  PID:9168
- C:\Windows\System\WcyKDxP.exe
  C:\Windows\System\WcyKDxP.exe
  2⤵
  PID:9188
- C:\Windows\System\kCRZPGt.exe
  C:\Windows\System\kCRZPGt.exe
  2⤵
  PID:9212
- C:\Windows\System\ICrvlaV.exe
  C:\Windows\System\ICrvlaV.exe
  2⤵
  PID:3068
- C:\Windows\System\iPvLnoG.exe
  C:\Windows\System\iPvLnoG.exe
  2⤵
  PID:7412
- C:\Windows\System\uyXUChq.exe
  C:\Windows\System\uyXUChq.exe
  2⤵
  PID:7460
- C:\Windows\System\XetJzQi.exe
  C:\Windows\System\XetJzQi.exe
  2⤵
  PID:7492
- C:\Windows\System\nXKuiIo.exe
  C:\Windows\System\nXKuiIo.exe
  2⤵
  PID:5068
- C:\Windows\System\qxftlAz.exe
  C:\Windows\System\qxftlAz.exe
  2⤵
  PID:7560
- C:\Windows\System\HwSFJBG.exe
  C:\Windows\System\HwSFJBG.exe
  2⤵
  PID:7608
- C:\Windows\System\VdygMvp.exe
  C:\Windows\System\VdygMvp.exe
  2⤵
  PID:7652
- C:\Windows\System\PflLXmq.exe
  C:\Windows\System\PflLXmq.exe
  2⤵
  PID:7700
- C:\Windows\System\JwSowFN.exe
  C:\Windows\System\JwSowFN.exe
  2⤵
  PID:7736
- C:\Windows\System\cFvGQqU.exe
  C:\Windows\System\cFvGQqU.exe
  2⤵
  PID:7772
- C:\Windows\System\QNaNnGa.exe
  C:\Windows\System\QNaNnGa.exe
  2⤵
  PID:7924
- C:\Windows\System\pIKTUVX.exe
  C:\Windows\System\pIKTUVX.exe
  2⤵
  PID:7944
- C:\Windows\System\QrWdJXq.exe
  C:\Windows\System\QrWdJXq.exe
  2⤵
  PID:7964
- C:\Windows\System\sHaerTW.exe
  C:\Windows\System\sHaerTW.exe
  2⤵
  PID:7992
- C:\Windows\System\wfulQSd.exe
  C:\Windows\System\wfulQSd.exe
  2⤵
  PID:8052
- C:\Windows\System\dYwOeRW.exe
  C:\Windows\System\dYwOeRW.exe
  2⤵
  PID:8088
- C:\Windows\System\fBrLMbd.exe
  C:\Windows\System\fBrLMbd.exe
  2⤵
  PID:8120
- C:\Windows\System\BhSgHtO.exe
  C:\Windows\System\BhSgHtO.exe
  2⤵
  PID:8168
- C:\Windows\System\aSqcFZB.exe
  C:\Windows\System\aSqcFZB.exe
  2⤵
  PID:5668
- C:\Windows\System\EUoDwCa.exe
  C:\Windows\System\EUoDwCa.exe
  2⤵
  PID:5992
- C:\Windows\System\KRUGlIo.exe
  C:\Windows\System\KRUGlIo.exe
  2⤵
  PID:5808
- C:\Windows\System\INStueG.exe
  C:\Windows\System\INStueG.exe
  2⤵
  PID:5368
- C:\Windows\System\DAwkEMa.exe
  C:\Windows\System\DAwkEMa.exe
  2⤵
  PID:5292
- C:\Windows\System\tNkmXbg.exe
  C:\Windows\System\tNkmXbg.exe
  2⤵
  PID:6252
- C:\Windows\System\XstklBz.exe
  C:\Windows\System\XstklBz.exe
  2⤵
  PID:6540
- C:\Windows\System\uKAGMXq.exe
  C:\Windows\System\uKAGMXq.exe
  2⤵
  PID:6744
- C:\Windows\System\XBeRZTw.exe
  C:\Windows\System\XBeRZTw.exe
  2⤵
  PID:5428
- C:\Windows\System\TFAGyWV.exe
  C:\Windows\System\TFAGyWV.exe
  2⤵
  PID:4416
- C:\Windows\System\XnvBSEe.exe
  C:\Windows\System\XnvBSEe.exe
  2⤵
  PID:6500
- C:\Windows\System\ivsCUxV.exe
  C:\Windows\System\ivsCUxV.exe
  2⤵
  PID:6964
- C:\Windows\System\woYtTDi.exe
  C:\Windows\System\woYtTDi.exe
  2⤵
  PID:7056
- C:\Windows\System\txdgnZG.exe
  C:\Windows\System\txdgnZG.exe
  2⤵
  PID:7132
- C:\Windows\System\LVMWRIm.exe
  C:\Windows\System\LVMWRIm.exe
  2⤵
  PID:8896
- C:\Windows\System\spIpWzn.exe
  C:\Windows\System\spIpWzn.exe
  2⤵
  PID:5212
- C:\Windows\System\EHCsklm.exe
  C:\Windows\System\EHCsklm.exe
  2⤵
  PID:6356
- C:\Windows\System\ycWiEIK.exe
  C:\Windows\System\ycWiEIK.exe
  2⤵
  PID:8216
- C:\Windows\System\lYqdurm.exe
  C:\Windows\System\lYqdurm.exe
  2⤵
  PID:8332
- C:\Windows\System\pvbXbTd.exe
  C:\Windows\System\pvbXbTd.exe
  2⤵
  PID:8372
- C:\Windows\System\BvjZbtz.exe
  C:\Windows\System\BvjZbtz.exe
  2⤵
  PID:8440
- C:\Windows\System\UKgcVgl.exe
  C:\Windows\System\UKgcVgl.exe
  2⤵
  PID:8528
- C:\Windows\System\NxjBCmJ.exe
  C:\Windows\System\NxjBCmJ.exe
  2⤵
  PID:9240
- C:\Windows\System\aNCgccV.exe
  C:\Windows\System\aNCgccV.exe
  2⤵
  PID:9260
- C:\Windows\System\reoziLA.exe
  C:\Windows\System\reoziLA.exe
  2⤵
  PID:9280
- C:\Windows\System\RCuKBbM.exe
  C:\Windows\System\RCuKBbM.exe
  2⤵
  PID:9296
- C:\Windows\System\vHmoOaS.exe
  C:\Windows\System\vHmoOaS.exe
  2⤵
  PID:9320
- C:\Windows\System\ijwOiPR.exe
  C:\Windows\System\ijwOiPR.exe
  2⤵
  PID:9344
- C:\Windows\System\PnSuMFy.exe
  C:\Windows\System\PnSuMFy.exe
  2⤵
  PID:9364
- C:\Windows\System\qKsPfaQ.exe
  C:\Windows\System\qKsPfaQ.exe
  2⤵
  PID:9384
- C:\Windows\System\gsOCuLA.exe
  C:\Windows\System\gsOCuLA.exe
  2⤵
  PID:9400
- C:\Windows\System\ZyIRpsm.exe
  C:\Windows\System\ZyIRpsm.exe
  2⤵
  PID:9424
- C:\Windows\System\vhXmCoL.exe
  C:\Windows\System\vhXmCoL.exe
  2⤵
  PID:9444
- C:\Windows\System\JWUjNsD.exe
  C:\Windows\System\JWUjNsD.exe
  2⤵
  PID:9464
- C:\Windows\System\UFJYpPX.exe
  C:\Windows\System\UFJYpPX.exe
  2⤵
  PID:9488
- C:\Windows\System\NRsZXnY.exe
  C:\Windows\System\NRsZXnY.exe
  2⤵
  PID:9508
- C:\Windows\System\qJikqxn.exe
  C:\Windows\System\qJikqxn.exe
  2⤵
  PID:9536
- C:\Windows\System\tdVhXlM.exe
  C:\Windows\System\tdVhXlM.exe
  2⤵
  PID:9552
- C:\Windows\System\MPShJPE.exe
  C:\Windows\System\MPShJPE.exe
  2⤵
  PID:9572
- C:\Windows\System\xADfQnd.exe
  C:\Windows\System\xADfQnd.exe
  2⤵
  PID:9588
- C:\Windows\System\AkVHqKJ.exe
  C:\Windows\System\AkVHqKJ.exe
  2⤵
  PID:9636
- C:\Windows\System\THYpkRV.exe
  C:\Windows\System\THYpkRV.exe
  2⤵
  PID:9660
- C:\Windows\System\xyVhWOn.exe
  C:\Windows\System\xyVhWOn.exe
  2⤵
  PID:9684
- C:\Windows\System\TFIYWaT.exe
  C:\Windows\System\TFIYWaT.exe
  2⤵
  PID:9704
- C:\Windows\System\yaTfRCd.exe
  C:\Windows\System\yaTfRCd.exe
  2⤵
  PID:9732
- C:\Windows\System\kiLfavA.exe
  C:\Windows\System\kiLfavA.exe
  2⤵
  PID:9752
- C:\Windows\System\UeRRTVZ.exe
  C:\Windows\System\UeRRTVZ.exe
  2⤵
  PID:9772
- C:\Windows\System\TmBifpA.exe
  C:\Windows\System\TmBifpA.exe
  2⤵
  PID:9788
- C:\Windows\System\wDaQVId.exe
  C:\Windows\System\wDaQVId.exe
  2⤵
  PID:9816
- C:\Windows\System\BQWPLBA.exe
  C:\Windows\System\BQWPLBA.exe
  2⤵
  PID:9836
- C:\Windows\System\GNvORrq.exe
  C:\Windows\System\GNvORrq.exe
  2⤵
  PID:9864
- C:\Windows\System\NfKHrHi.exe
  C:\Windows\System\NfKHrHi.exe
  2⤵
  PID:9888
- C:\Windows\System\JDTcSEi.exe
  C:\Windows\System\JDTcSEi.exe
  2⤵
  PID:9904
- C:\Windows\System\aCqELJs.exe
  C:\Windows\System\aCqELJs.exe
  2⤵
  PID:9924
- C:\Windows\System\GLmMiRF.exe
  C:\Windows\System\GLmMiRF.exe
  2⤵
  PID:9944
- C:\Windows\System\SnLGuHv.exe
  C:\Windows\System\SnLGuHv.exe
  2⤵
  PID:9960
- C:\Windows\System\dyggRKU.exe
  C:\Windows\System\dyggRKU.exe
  2⤵
  PID:9980
- C:\Windows\System\gULAylv.exe
  C:\Windows\System\gULAylv.exe
  2⤵
  PID:9996
- C:\Windows\System\hmgopwV.exe
  C:\Windows\System\hmgopwV.exe
  2⤵
  PID:10024
- C:\Windows\System\fJVHybs.exe
  C:\Windows\System\fJVHybs.exe
  2⤵
  PID:10052
- C:\Windows\System\WpZXMMZ.exe
  C:\Windows\System\WpZXMMZ.exe
  2⤵
  PID:10068
- C:\Windows\System\xUKZbhA.exe
  C:\Windows\System\xUKZbhA.exe
  2⤵
  PID:10084
- C:\Windows\System\KgWnqbB.exe
  C:\Windows\System\KgWnqbB.exe
  2⤵
  PID:10100
- C:\Windows\System\YHNvGpV.exe
  C:\Windows\System\YHNvGpV.exe
  2⤵
  PID:10120
- C:\Windows\System\yqtxqXv.exe
  C:\Windows\System\yqtxqXv.exe
  2⤵
  PID:7384
- C:\Windows\System\YdJWYTV.exe
  C:\Windows\System\YdJWYTV.exe
  2⤵
  PID:7952
- C:\Windows\System\lkVQYMy.exe
  C:\Windows\System\lkVQYMy.exe
  2⤵
  PID:8024
- C:\Windows\System\GecDApp.exe
  C:\Windows\System\GecDApp.exe
  2⤵
  PID:8136
- C:\Windows\System\wcJgWmH.exe
  C:\Windows\System\wcJgWmH.exe
  2⤵
  PID:8184
- C:\Windows\System\TQbZeEN.exe
  C:\Windows\System\TQbZeEN.exe
  2⤵
  PID:6408
- C:\Windows\System\xcHLOtg.exe
  C:\Windows\System\xcHLOtg.exe
  2⤵
  PID:9460
- C:\Windows\System\HPiXxKP.exe
  C:\Windows\System\HPiXxKP.exe
  2⤵
  PID:8396
- C:\Windows\System\ylNAhYH.exe
  C:\Windows\System\ylNAhYH.exe
  2⤵
  PID:6476
- C:\Windows\System\UBtdXpO.exe
  C:\Windows\System\UBtdXpO.exe
  2⤵
  PID:9356
- C:\Windows\System\sfcwKUN.exe
  C:\Windows\System\sfcwKUN.exe
  2⤵
  PID:9432
- C:\Windows\System\hfUErCL.exe
  C:\Windows\System\hfUErCL.exe
  2⤵
  PID:9580
- C:\Windows\System\wofuZAl.exe
  C:\Windows\System\wofuZAl.exe
  2⤵
  PID:8584
- C:\Windows\System\XcFrrGm.exe
  C:\Windows\System\XcFrrGm.exe
  2⤵
  PID:8624
- C:\Windows\System\edpenfV.exe
  C:\Windows\System\edpenfV.exe
  2⤵
  PID:8652
- C:\Windows\System\rsqPKny.exe
  C:\Windows\System\rsqPKny.exe
  2⤵
  PID:8676
- C:\Windows\System\ZcFAqqU.exe
  C:\Windows\System\ZcFAqqU.exe
  2⤵
  PID:8732
- C:\Windows\System\XQXrtjx.exe
  C:\Windows\System\XQXrtjx.exe
  2⤵
  PID:8784
- C:\Windows\System\ZcILGzA.exe
  C:\Windows\System\ZcILGzA.exe
  2⤵
  PID:8808
- C:\Windows\System\AkqCDzJ.exe
  C:\Windows\System\AkqCDzJ.exe
  2⤵
  PID:8852
- C:\Windows\System\nWXIvpV.exe
  C:\Windows\System\nWXIvpV.exe
  2⤵
  PID:7684
- C:\Windows\System\fqvPOhq.exe
  C:\Windows\System\fqvPOhq.exe
  2⤵
  PID:9804
- C:\Windows\System\MwFJMLX.exe
  C:\Windows\System\MwFJMLX.exe
  2⤵
  PID:9832
- C:\Windows\System\YXIpXfq.exe
  C:\Windows\System\YXIpXfq.exe
  2⤵
  PID:7980
- C:\Windows\System\OiKNrjD.exe
  C:\Windows\System\OiKNrjD.exe
  2⤵
  PID:9912
- C:\Windows\System\GTuBVyR.exe
  C:\Windows\System\GTuBVyR.exe
  2⤵
  PID:10244
- C:\Windows\System\xBEvIzH.exe
  C:\Windows\System\xBEvIzH.exe
  2⤵
  PID:10264
- C:\Windows\System\wRJnpjK.exe
  C:\Windows\System\wRJnpjK.exe
  2⤵
  PID:10284
- C:\Windows\System\IaOIvbA.exe
  C:\Windows\System\IaOIvbA.exe
  2⤵
  PID:10300
- C:\Windows\System\nifdPZn.exe
  C:\Windows\System\nifdPZn.exe
  2⤵
  PID:10328
- C:\Windows\System\ksssFVF.exe
  C:\Windows\System\ksssFVF.exe
  2⤵
  PID:10344
- C:\Windows\System\qTrDPoP.exe
  C:\Windows\System\qTrDPoP.exe
  2⤵
  PID:10360
- C:\Windows\System\rigYYDw.exe
  C:\Windows\System\rigYYDw.exe
  2⤵
  PID:10396
- C:\Windows\System\JfTntRc.exe
  C:\Windows\System\JfTntRc.exe
  2⤵
  PID:10416
- C:\Windows\System\LUJXwkY.exe
  C:\Windows\System\LUJXwkY.exe
  2⤵
  PID:10432
- C:\Windows\System\DPZVmkv.exe
  C:\Windows\System\DPZVmkv.exe
  2⤵
  PID:10456
- C:\Windows\System\UaJfaqI.exe
  C:\Windows\System\UaJfaqI.exe
  2⤵
  PID:10480
- C:\Windows\System\nMyykvL.exe
  C:\Windows\System\nMyykvL.exe
  2⤵
  PID:10496
- C:\Windows\System\KzaRTjE.exe
  C:\Windows\System\KzaRTjE.exe
  2⤵
  PID:10520
- C:\Windows\System\VCvWHkF.exe
  C:\Windows\System\VCvWHkF.exe
  2⤵
  PID:10540
- C:\Windows\System\JnsNVrG.exe
  C:\Windows\System\JnsNVrG.exe
  2⤵
  PID:10560
- C:\Windows\System\BJBWmWT.exe
  C:\Windows\System\BJBWmWT.exe
  2⤵
  PID:10588
- C:\Windows\System\zsXOpCb.exe
  C:\Windows\System\zsXOpCb.exe
  2⤵
  PID:10608
- C:\Windows\System\xdICScM.exe
  C:\Windows\System\xdICScM.exe
  2⤵
  PID:10628
- C:\Windows\System\ZRAILkS.exe
  C:\Windows\System\ZRAILkS.exe
  2⤵
  PID:10648
- C:\Windows\System\bgfmJbZ.exe
  C:\Windows\System\bgfmJbZ.exe
  2⤵
  PID:10668
- C:\Windows\System\QAuUfrt.exe
  C:\Windows\System\QAuUfrt.exe
  2⤵
  PID:10684
- C:\Windows\System\wbfvSMU.exe
  C:\Windows\System\wbfvSMU.exe
  2⤵
  PID:10712
- C:\Windows\System\ZZvmIDy.exe
  C:\Windows\System\ZZvmIDy.exe
  2⤵
  PID:10732
- C:\Windows\System\JDALXgC.exe
  C:\Windows\System\JDALXgC.exe
  2⤵
  PID:10796
- C:\Windows\System\SJTdSkU.exe
  C:\Windows\System\SJTdSkU.exe
  2⤵
  PID:10816
- C:\Windows\System\WpMERCC.exe
  C:\Windows\System\WpMERCC.exe
  2⤵
  PID:10832
- C:\Windows\System\oMPwAXd.exe
  C:\Windows\System\oMPwAXd.exe
  2⤵
  PID:10856
- C:\Windows\System\QCDsRbA.exe
  C:\Windows\System\QCDsRbA.exe
  2⤵
  PID:10888
- C:\Windows\System\MapAhcx.exe
  C:\Windows\System\MapAhcx.exe
  2⤵
  PID:10912
- C:\Windows\System\UqzUKTU.exe
  C:\Windows\System\UqzUKTU.exe
  2⤵
  PID:10932
- C:\Windows\System\iJvBspF.exe
  C:\Windows\System\iJvBspF.exe
  2⤵
  PID:10952
- C:\Windows\System\ajjNkPw.exe
  C:\Windows\System\ajjNkPw.exe
  2⤵
  PID:10968
- C:\Windows\System\VyKizMv.exe
  C:\Windows\System\VyKizMv.exe
  2⤵
  PID:10988
- C:\Windows\System\kCLMMwv.exe
  C:\Windows\System\kCLMMwv.exe
  2⤵
  PID:11176
- C:\Windows\System\pjpSDjW.exe
  C:\Windows\System\pjpSDjW.exe
  2⤵
  PID:11216
- C:\Windows\System\cuqOSod.exe
  C:\Windows\System\cuqOSod.exe
  2⤵
  PID:11240
- C:\Windows\System\bqDkbnP.exe
  C:\Windows\System\bqDkbnP.exe
  2⤵
  PID:8148
- C:\Windows\System\WyYhAlf.exe
  C:\Windows\System\WyYhAlf.exe
  2⤵
  PID:5488
- C:\Windows\System\qvQTggy.exe
  C:\Windows\System\qvQTggy.exe
  2⤵
  PID:6392
- C:\Windows\System\DaRhnhB.exe
  C:\Windows\System\DaRhnhB.exe
  2⤵
  PID:9224
- C:\Windows\System\YIUZkvm.exe
  C:\Windows\System\YIUZkvm.exe
  2⤵
  PID:9500
- C:\Windows\System\KvBMdoJ.exe
  C:\Windows\System\KvBMdoJ.exe
  2⤵
  PID:8116
- C:\Windows\System\yqfAMFY.exe
  C:\Windows\System\yqfAMFY.exe
  2⤵
  PID:8972
- C:\Windows\System\MrSSknE.exe
  C:\Windows\System\MrSSknE.exe
  2⤵
  PID:9016
- C:\Windows\System\OPbSLeL.exe
  C:\Windows\System\OPbSLeL.exe
  2⤵
  PID:9040
- C:\Windows\System\cVYjxYP.exe
  C:\Windows\System\cVYjxYP.exe
  2⤵
  PID:9084
- C:\Windows\System\cWUmjES.exe
  C:\Windows\System\cWUmjES.exe
  2⤵
  PID:9124
- C:\Windows\System\TUhcGJQ.exe
  C:\Windows\System\TUhcGJQ.exe
  2⤵
  PID:9164
- C:\Windows\System\AbZsQfy.exe
  C:\Windows\System\AbZsQfy.exe
  2⤵
  PID:7444
- C:\Windows\System\DHZKecq.exe
  C:\Windows\System\DHZKecq.exe
  2⤵
  PID:7556
- C:\Windows\System\CrSQvjw.exe
  C:\Windows\System\CrSQvjw.exe
  2⤵
  PID:7804
- C:\Windows\System\YFmYkFt.exe
  C:\Windows\System\YFmYkFt.exe
  2⤵
  PID:5272
- C:\Windows\System\iRiGQot.exe
  C:\Windows\System\iRiGQot.exe
  2⤵
  PID:9392
- C:\Windows\System\eTkrkCA.exe
  C:\Windows\System\eTkrkCA.exe
  2⤵
  PID:7788
- C:\Windows\System\WOwWSHY.exe
  C:\Windows\System\WOwWSHY.exe
  2⤵
  PID:10292
- C:\Windows\System\yYLHBuV.exe
  C:\Windows\System\yYLHBuV.exe
  2⤵
  PID:11272
- C:\Windows\System\VhjXkqt.exe
  C:\Windows\System\VhjXkqt.exe
  2⤵
  PID:11288
- C:\Windows\System\RITlmlG.exe
  C:\Windows\System\RITlmlG.exe
  2⤵
  PID:11312
- C:\Windows\System\qcTaDqA.exe
  C:\Windows\System\qcTaDqA.exe
  2⤵
  PID:11328
- C:\Windows\System\xDmspoe.exe
  C:\Windows\System\xDmspoe.exe
  2⤵
  PID:11348
- C:\Windows\System\xLtBiGt.exe
  C:\Windows\System\xLtBiGt.exe
  2⤵
  PID:11368
- C:\Windows\System\ZffIbwj.exe
  C:\Windows\System\ZffIbwj.exe
  2⤵
  PID:11392
- C:\Windows\System\YLJqFuZ.exe
  C:\Windows\System\YLJqFuZ.exe
  2⤵
  PID:11408
- C:\Windows\System\oANpFqG.exe
  C:\Windows\System\oANpFqG.exe
  2⤵
  PID:11432
- C:\Windows\System\TzPLofu.exe
  C:\Windows\System\TzPLofu.exe
  2⤵
  PID:11456
- C:\Windows\System\rhNBzBn.exe
  C:\Windows\System\rhNBzBn.exe
  2⤵
  PID:11480
- C:\Windows\System\CHAfenI.exe
  C:\Windows\System\CHAfenI.exe
  2⤵
  PID:11496
- C:\Windows\System\cKPBEsC.exe
  C:\Windows\System\cKPBEsC.exe
  2⤵
  PID:11516
- C:\Windows\System\tMpCcsm.exe
  C:\Windows\System\tMpCcsm.exe
  2⤵
  PID:11536
- C:\Windows\System\KRnUzkq.exe
  C:\Windows\System\KRnUzkq.exe
  2⤵
  PID:11564
- C:\Windows\System\fHCLreT.exe
  C:\Windows\System\fHCLreT.exe
  2⤵
  PID:11584
- C:\Windows\System\KTYWPES.exe
  C:\Windows\System\KTYWPES.exe
  2⤵
  PID:11604
- C:\Windows\System\Olyhppo.exe
  C:\Windows\System\Olyhppo.exe
  2⤵
  PID:11628
- C:\Windows\System\wtxIVdL.exe
  C:\Windows\System\wtxIVdL.exe
  2⤵
  PID:11644
- C:\Windows\System\KrPBhnq.exe
  C:\Windows\System\KrPBhnq.exe
  2⤵
  PID:11668
- C:\Windows\System\sowYKEa.exe
  C:\Windows\System\sowYKEa.exe
  2⤵
  PID:11692
- C:\Windows\System\BeXQPVJ.exe
  C:\Windows\System\BeXQPVJ.exe
  2⤵
  PID:11708
- C:\Windows\System\uhYaXTk.exe
  C:\Windows\System\uhYaXTk.exe
  2⤵
  PID:11728
- C:\Windows\System\JWsmRye.exe
  C:\Windows\System\JWsmRye.exe
  2⤵
  PID:11752
- C:\Windows\System\RalIAxp.exe
  C:\Windows\System\RalIAxp.exe
  2⤵
  PID:11772
- C:\Windows\System\BbEFdsO.exe
  C:\Windows\System\BbEFdsO.exe
  2⤵
  PID:11792
- C:\Windows\System\dNDIVaN.exe
  C:\Windows\System\dNDIVaN.exe
  2⤵
  PID:11812
- C:\Windows\System\ZkoGxTn.exe
  C:\Windows\System\ZkoGxTn.exe
  2⤵
  PID:11832
- C:\Windows\System\CHQyhLJ.exe
  C:\Windows\System\CHQyhLJ.exe
  2⤵
  PID:11852
- C:\Windows\System\VxlmqCK.exe
  C:\Windows\System\VxlmqCK.exe
  2⤵
  PID:11872
- C:\Windows\System\oVSCDOX.exe
  C:\Windows\System\oVSCDOX.exe
  2⤵
  PID:11896
- C:\Windows\System\WYhlYOa.exe
  C:\Windows\System\WYhlYOa.exe
  2⤵
  PID:11916
- C:\Windows\System\CKRbrks.exe
  C:\Windows\System\CKRbrks.exe
  2⤵
  PID:11932
- C:\Windows\System\BXEuwZY.exe
  C:\Windows\System\BXEuwZY.exe
  2⤵
  PID:11952
- C:\Windows\System\oLRVqqv.exe
  C:\Windows\System\oLRVqqv.exe
  2⤵
  PID:11976
- C:\Windows\System\IMuRejb.exe
  C:\Windows\System\IMuRejb.exe
  2⤵
  PID:11992
- C:\Windows\System\SbBiJEj.exe
  C:\Windows\System\SbBiJEj.exe
  2⤵
  PID:12016
- C:\Windows\System\vrWIOPS.exe
  C:\Windows\System\vrWIOPS.exe
  2⤵
  PID:12032
- C:\Windows\System\xGcAHef.exe
  C:\Windows\System\xGcAHef.exe
  2⤵
  PID:12052
- C:\Windows\System\iFCgxss.exe
  C:\Windows\System\iFCgxss.exe
  2⤵
  PID:12068
- C:\Windows\System\NSRzVhV.exe
  C:\Windows\System\NSRzVhV.exe
  2⤵
  PID:12084
- C:\Windows\System\pzZKunU.exe
  C:\Windows\System\pzZKunU.exe
  2⤵
  PID:12100
- C:\Windows\System\aWUxiaC.exe
  C:\Windows\System\aWUxiaC.exe
  2⤵
  PID:12116
- C:\Windows\System\yUYsGjc.exe
  C:\Windows\System\yUYsGjc.exe
  2⤵
  PID:12132
- C:\Windows\System\nxSZKWN.exe
  C:\Windows\System\nxSZKWN.exe
  2⤵
  PID:12152
- C:\Windows\System\arXcMhQ.exe
  C:\Windows\System\arXcMhQ.exe
  2⤵
  PID:12172
- C:\Windows\System\hzYUrUk.exe
  C:\Windows\System\hzYUrUk.exe
  2⤵
  PID:12208
- C:\Windows\System\GhQkFAB.exe
  C:\Windows\System\GhQkFAB.exe
  2⤵
  PID:12232
- C:\Windows\System\rtcVysZ.exe
  C:\Windows\System\rtcVysZ.exe
  2⤵
  PID:12276
- C:\Windows\System\fBnMzKZ.exe
  C:\Windows\System\fBnMzKZ.exe
  2⤵
  PID:5916
- C:\Windows\System\XOoRCsJ.exe
  C:\Windows\System\XOoRCsJ.exe
  2⤵
  PID:1012
- C:\Windows\System\hctkKVO.exe
  C:\Windows\System\hctkKVO.exe
  2⤵
  PID:6172
- C:\Windows\System\FjierSh.exe
  C:\Windows\System\FjierSh.exe
  2⤵
  PID:7096
- C:\Windows\System\MmWlklC.exe
  C:\Windows\System\MmWlklC.exe
  2⤵
  PID:6060
- C:\Windows\System\YZMklhJ.exe
  C:\Windows\System\YZMklhJ.exe
  2⤵
  PID:8516
- C:\Windows\System\XskmuQP.exe
  C:\Windows\System\XskmuQP.exe
  2⤵
  PID:9304
- C:\Windows\System\viQMSii.exe
  C:\Windows\System\viQMSii.exe
  2⤵
  PID:9380
- C:\Windows\System\gpLqwNy.exe
  C:\Windows\System\gpLqwNy.exe
  2⤵
  PID:9436
- C:\Windows\System\ZSCAlbV.exe
  C:\Windows\System\ZSCAlbV.exe
  2⤵
  PID:10440
- C:\Windows\System\upPWxGs.exe
  C:\Windows\System\upPWxGs.exe
  2⤵
  PID:10532
- C:\Windows\System\wingrMu.exe
  C:\Windows\System\wingrMu.exe
  2⤵
  PID:10616
- C:\Windows\System\oPgbZqy.exe
  C:\Windows\System\oPgbZqy.exe
  2⤵
  PID:460
- C:\Windows\System\AoTBLrY.exe
  C:\Windows\System\AoTBLrY.exe
  2⤵
  PID:9600
- C:\Windows\System\OSAKLvz.exe
  C:\Windows\System\OSAKLvz.exe
  2⤵
  PID:10944
- C:\Windows\System\euBAQql.exe
  C:\Windows\System\euBAQql.exe
  2⤵
  PID:12296
- C:\Windows\System\sviWbtF.exe
  C:\Windows\System\sviWbtF.exe
  2⤵
  PID:12316
- C:\Windows\System\UPvVNzL.exe
  C:\Windows\System\UPvVNzL.exe
  2⤵
  PID:12352
- C:\Windows\System\judMuZf.exe
  C:\Windows\System\judMuZf.exe
  2⤵
  PID:12388
- C:\Windows\System\XEuHZCk.exe
  C:\Windows\System\XEuHZCk.exe
  2⤵
  PID:12408
- C:\Windows\System\zQkxUyI.exe
  C:\Windows\System\zQkxUyI.exe
  2⤵
  PID:12448
- C:\Windows\System\inHVupd.exe
  C:\Windows\System\inHVupd.exe
  2⤵
  PID:12472
- C:\Windows\System\iRgskri.exe
  C:\Windows\System\iRgskri.exe
  2⤵
  PID:12496
- C:\Windows\System\QoOERMn.exe
  C:\Windows\System\QoOERMn.exe
  2⤵
  PID:12512
- C:\Windows\System\pbqOGOM.exe
  C:\Windows\System\pbqOGOM.exe
  2⤵
  PID:12544
- C:\Windows\System\RBHakPx.exe
  C:\Windows\System\RBHakPx.exe
  2⤵
  PID:12564
- C:\Windows\System\ykwmRkU.exe
  C:\Windows\System\ykwmRkU.exe
  2⤵
  PID:12584
- C:\Windows\System\AUAvkZy.exe
  C:\Windows\System\AUAvkZy.exe
  2⤵
  PID:12604
- C:\Windows\System\NmYFHMk.exe
  C:\Windows\System\NmYFHMk.exe
  2⤵
  PID:12628
- C:\Windows\System\eIvXteg.exe
  C:\Windows\System\eIvXteg.exe
  2⤵
  PID:12656
- C:\Windows\System\KuwNUHt.exe
  C:\Windows\System\KuwNUHt.exe
  2⤵
  PID:12672
- C:\Windows\System\JvgGeHp.exe
  C:\Windows\System\JvgGeHp.exe
  2⤵
  PID:12696
- C:\Windows\System\MeUFkde.exe
  C:\Windows\System\MeUFkde.exe
  2⤵
  PID:12720
- C:\Windows\System\KeUQIUD.exe
  C:\Windows\System\KeUQIUD.exe
  2⤵
  PID:12740
- C:\Windows\System\bmYHJOs.exe
  C:\Windows\System\bmYHJOs.exe
  2⤵
  PID:12768
- C:\Windows\System\ppqdqsT.exe
  C:\Windows\System\ppqdqsT.exe
  2⤵
  PID:12800
- C:\Windows\System\qIkbgMK.exe
  C:\Windows\System\qIkbgMK.exe
  2⤵
  PID:12820
- C:\Windows\System\ZNeVoaq.exe
  C:\Windows\System\ZNeVoaq.exe
  2⤵
  PID:12844
- C:\Windows\System\FfRJjhw.exe
  C:\Windows\System\FfRJjhw.exe
  2⤵
  PID:12868
- C:\Windows\System\CWDRdkg.exe
  C:\Windows\System\CWDRdkg.exe
  2⤵
  PID:12884
- C:\Windows\System\TDHrACP.exe
  C:\Windows\System\TDHrACP.exe
  2⤵
  PID:12920
- C:\Windows\System\LzZTPGv.exe
  C:\Windows\System\LzZTPGv.exe
  2⤵
  PID:12940
- C:\Windows\System\QFCfPfu.exe
  C:\Windows\System\QFCfPfu.exe
  2⤵
  PID:12964
- C:\Windows\System\IXixmpQ.exe
  C:\Windows\System\IXixmpQ.exe
  2⤵
  PID:12984
- C:\Windows\System\QdTxsLv.exe
  C:\Windows\System\QdTxsLv.exe
  2⤵
  PID:13004
- C:\Windows\System\kFhbxAF.exe
  C:\Windows\System\kFhbxAF.exe
  2⤵
  PID:13024
- C:\Windows\System\KwfyrPc.exe
  C:\Windows\System\KwfyrPc.exe
  2⤵
  PID:13044
- C:\Windows\System\GQIoWZy.exe
  C:\Windows\System\GQIoWZy.exe
  2⤵
  PID:13064
- C:\Windows\System\xeKKgBr.exe
  C:\Windows\System\xeKKgBr.exe
  2⤵
  PID:13088
- C:\Windows\System\jYQTjEl.exe
  C:\Windows\System\jYQTjEl.exe
  2⤵
  PID:13104
- C:\Windows\System\WPXlbIv.exe
  C:\Windows\System\WPXlbIv.exe
  2⤵
  PID:13124
- C:\Windows\System\QODuakV.exe
  C:\Windows\System\QODuakV.exe
  2⤵
  PID:13144
- C:\Windows\System\YEypcLU.exe
  C:\Windows\System\YEypcLU.exe
  2⤵
  PID:13160
- C:\Windows\System\mzyOill.exe
  C:\Windows\System\mzyOill.exe
  2⤵
  PID:13176
- C:\Windows\System\aiBRXlC.exe
  C:\Windows\System\aiBRXlC.exe
  2⤵
  PID:13192
- C:\Windows\System\tnBsvdH.exe
  C:\Windows\System\tnBsvdH.exe
  2⤵
  PID:13208
- C:\Windows\System\kehACST.exe
  C:\Windows\System\kehACST.exe
  2⤵
  PID:13224
- C:\Windows\System\KOIHXBu.exe
  C:\Windows\System\KOIHXBu.exe
  2⤵
  PID:13240
- C:\Windows\System\txqvUpj.exe
  C:\Windows\System\txqvUpj.exe
  2⤵
  PID:13256
- C:\Windows\System\JGnCYXX.exe
  C:\Windows\System\JGnCYXX.exe
  2⤵
  PID:13272
- C:\Windows\System\SySlpzT.exe
  C:\Windows\System\SySlpzT.exe
  2⤵
  PID:13288
- C:\Windows\System\zQZejmn.exe
  C:\Windows\System\zQZejmn.exe
  2⤵
  PID:13308
- C:\Windows\System\dJlfWfC.exe
  C:\Windows\System\dJlfWfC.exe
  2⤵
  PID:8576
- C:\Windows\System\MoBZcZi.exe
  C:\Windows\System\MoBZcZi.exe
  2⤵
  PID:3560
- C:\Windows\System\tvXNqMn.exe
  C:\Windows\System\tvXNqMn.exe
  2⤵
  PID:11052
- C:\Windows\System\eZGDjmy.exe
  C:\Windows\System\eZGDjmy.exe
  2⤵
  PID:9652
- C:\Windows\System\rFNZfGR.exe
  C:\Windows\System\rFNZfGR.exe
  2⤵
  PID:9692
- C:\Windows\System\GlvsXIm.exe
  C:\Windows\System\GlvsXIm.exe
  2⤵
  PID:9744

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:11872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B91VJWSD\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ek5ocm2t.amg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ACdAyFN.exe

Filesize
1.2MB

MD5
0d2a8fa9ba885bb122e6661c87cc067f

SHA1
f8d07b369aa9dcf002d17ca0c3fabd7c93b950c2

SHA256
9f7d78a9f55e4adc9319cd764f78053e52adcc3880933899faa98b789a0bbe84

SHA512
095de1c81c92634a16e06ba9c81fbb68b5667b4b82573db8dc82dd3d02328c8efe4c19f3459f9d37060b3cccced1bb0de9c76bb2b2d2cc3a5f2ad6c739ec2c74

Download Submit
C:\Windows\System\AKWvNlC.exe

Filesize
1.2MB

MD5
0bb2f39d865c8d0747f77b6ad7dfb8e2

SHA1
96f5365e9ff5647434274716245bc1a783604b71

SHA256
04101530ab1650b9e09777ece0a5c15696f082f91803bbc88c1376e57a4baaf3

SHA512
c40e2f3d966cbbb12920e90c4ce000194a5d1baeffeb7192f2a49da3f3b0db60b38b28fc265a94fa7f024a37084d0f076922c6c7d4ec9b4a3310a8e374019c21

Download Submit
C:\Windows\System\AqdjLUd.exe

Filesize
1.2MB

MD5
14c2ee779a767a552ad7be00c450008b

SHA1
e68f6fcd0354d915114ba43048f90c68c374c2c7

SHA256
f922591065f52c38061995b8763b7e27c04d9840a740489f16243367b3920c1a

SHA512
f8ae696509d709f0797c69285d92cf5b9c492f6cbefa712dc8e06b947ae39f0206e17579f489adeec6c126ff6508168fef63a48a26e63cec2773c917919ce44f

Download Submit
C:\Windows\System\BNXOGxd.exe

Filesize
1.2MB

MD5
ead64a57dc297cf29da893903125193f

SHA1
c1523d608ed123e27bb13c0516e57a98f5feb1d9

SHA256
a384b4c562544f7377019bb60a597e9079e93aaa6318461549804f41791fd296

SHA512
41d31b10c09293e0c5ec14ed9e0c4c12e94ebabb6d89630b836c85c1ebb81335fbfb009047f1acf395a1b709f9eb5c3b267e1b4d1c5a12886fb4591f1798d5e6

Download Submit
C:\Windows\System\EqRtKTK.exe

Filesize
1.2MB

MD5
6e1c697629a4b6e4a1ac084f39ecb70b

SHA1
50d5e86ea190fd2d2f7db525156eeb49d6c0925b

SHA256
8750e6c93d573b730971b89017dfe1f8acad6e5f9bbe2c3a68015f0e92b2e4eb

SHA512
3d15632e0ff032a56b6febfb1218c43b7516f8546a834064ab98b290fd8f239ca46367533e2a99dce1f5d9500664b29c395403039f0b3d6fb99e7f27fdaf5f95

Download Submit
C:\Windows\System\GjgeOiY.exe

Filesize
1.2MB

MD5
8f9f999b74b9b7b7ec3fde1c1da62369

SHA1
4cbde7cf7d261a06ae1b2f8ea9540cbf969ede6f

SHA256
a7616f22a2058c50fda0b4a15be6bf3745b39522e7f78c75fb47e5effe3c00cb

SHA512
639d308d6216873391d5de41f46e7c0bc462f89f6c21a53c1651f52c7e75e38527c3bcdde36e6e2809bbed6b95b81943924645dc9a0671c23fa7c90d36625b7f

Download Submit
C:\Windows\System\IauBFlb.exe

Filesize
1.2MB

MD5
f50f8ad4f4d3ced27c6dd2c1c8c24003

SHA1
0dc0719d4fec868bd4acf2a02997cfec6a3ae5fb

SHA256
ca0718cc77f480df24cf26f9c9cd06faddf49bad2d6f207c77038959187603ef

SHA512
a972bd16e00f2912cca9efe625847400bf5b85e228748a8950683a1e3a9c15c6cc26fe09aa38803fb7b58bca78d7784d41a81f2a141d28d6c452855e24ec94f9

Download Submit
C:\Windows\System\IyAHJWJ.exe

Filesize
1.2MB

MD5
5718521df78e4cf83b1eef3350464d1d

SHA1
430aa953368e1ce560f244724cbccfb6bf4cb826

SHA256
a3ad5309356fd9a53bc5001fb3363d1be47e8db577190777a816b9d315817c0c

SHA512
0a73db74a1453b7a461706c20f16e3a178775c74749cfba6a23463fb779e96bef87c7a978120574344b0efe583188389763c615b00f38d8a7e7d708dca73add7

Download Submit
C:\Windows\System\KhaSxSq.exe

Filesize
1.2MB

MD5
a441ebd79721cf6d0a5736d50b0cd6aa

SHA1
9ab5f820228a0f99a12de41d3cbeedc50b442f3b

SHA256
1755620c1d101e70fce355040c44fedd9caa0d8673c9e3e768996e43900f07bc

SHA512
9a6ef5f946a9d091149ff5adec3b4b9f0e985544e45883a4c59bfba0bd9957a310f02d053531efcb833d9ae13b21ccb7bcdfc0257d4a55cfd9850ef7e215d80e

Download Submit
C:\Windows\System\KsGrtyH.exe

Filesize
1.2MB

MD5
fd6e25a7fa96154eee035083bbcc1610

SHA1
c9f41d3e9c77d375e5b11634a1811b8c4f9ac424

SHA256
a3799bf28ff9a6421c49808b71f2c6304c48a1b3334721081acb0fedb08f59db

SHA512
d89411256d9f7aa829f91751a2679678bc74dd9f436ae2607d9343176e81c4a5f6644cbc0172812f68f7d182970eeed441297d5616e3735cd791dbb482806d55

Download Submit
C:\Windows\System\PpJUZJq.exe

Filesize
1.2MB

MD5
11830f0c3a3bc08b580b0f61ca0f5ba4

SHA1
cf124c5b8d04a0074b75be11df5f9905fa10ee6e

SHA256
a83cf4f438697c988b44f563e76dbc2cebf6603114b189a7c65c9b823d00750a

SHA512
b38e828ffdbe24d197676c766c6257e4808eb158713edddf12133bec2cdaed2d4f350d7a50b7ed5d7878550c1386673e40a7c212f56050379ebce3053609f88c

Download Submit
C:\Windows\System\SCAHjgh.exe

Filesize
1.2MB

MD5
4ffae29690971dbe3e86dbdbb07a039a

SHA1
2f262cdc5b772c2eb68b555e397be4a301a2c117

SHA256
f55077c772d8eaf5d25abea028ddc2db88d02cc7ae4d663356998ca9c493f885

SHA512
7666d5ab8f3e297ef5a8b0d33da6e345d3b0d78033005d791303c3156401f97271701e7cd693312e424981d6eb1e7d57314e0084b628e201c5dc7b0287488a0d

Download Submit
C:\Windows\System\SkBaotv.exe

Filesize
1.2MB

MD5
61ba6d808c8b897d1ed2bb768065fd67

SHA1
48937b39bb2e4651d9bda8e571db7999555128cb

SHA256
7bfb7aacbc40cd5790570db7ad7e1c38c96cd463a7e75740aef6ac2521e02ee0

SHA512
78f91a5d03e88397614221b06e1f5bfb6ff04a69412549c441751815cc046bf0985d506d582a9a2a546f5c2c527c0de80b532425683767cc91eca8d14ddd0c7e

Download Submit
C:\Windows\System\THtHUnr.exe

Filesize
1.2MB

MD5
c6267ebc09ceaa97f9259b3129cef9e8

SHA1
0949ce1187a8cb78235d7407b68c79fd39e49d13

SHA256
7c171d061d0093ba7b0f67465787deac0bba6d203616ac6288ee6a83a15a099e

SHA512
a151bba29a3fb952198778e9dbb5916db96a294420b04cf8beb12b754aa09b7d3708e327cd5655364cc0a49a20dccc4b8561ae15b7055a536518d5fb68095013

Download Submit
C:\Windows\System\TPThNiy.exe

Filesize
1.2MB

MD5
082e119ed28dbdf66493ff601ef5a90f

SHA1
1ad13dda09406f61218ff19e80a3b2945cf7782a

SHA256
4feeccad10a95114174153b08e4e28c83b7ba8bf495ca4b869f03710752e2881

SHA512
53b9ed1c606ed5a9d1057553b2ad305b8e5dab08bddbf4022bdcc5e5fa01d9211d9b2c884ef8061fc47e95a5678f1fbeed6041778beab13e2d8ed19530e015ac

Download Submit
C:\Windows\System\UlkYFec.exe

Filesize
1.2MB

MD5
8715ce9374e7edb4bdbd432e4a882b86

SHA1
96d29ccf91b525082ac74c47f29670e87675c85b

SHA256
6f557bad5ad5a0a2ec521381c51b9b3041d56f02f6b29a6e828e7f29f3915c86

SHA512
2f0501af584ba12f8c46e2950c6c0109ddc21cbca190caadeee537d0fde248977bccfa966c8b03855e3423b61b06f15294da2ead90c93412505c0080b53dca21

Download Submit
C:\Windows\System\VpZHccE.exe

Filesize
1.2MB

MD5
2da4dac211f53e51e65aff7509933aa2

SHA1
3ff6033e9852372165194619f9589a8920b3d8ea

SHA256
cbfe7ae0b91a24f82320d3ca97e39c016ab034f9eeedf040ddfd5b7135c2df15

SHA512
1bb42ca3bb86f95cad8f7362a49840e01cc58e13e70c8a5255df29969bb481f9c61966111ba53a7df4e71f6e5b415cacb78cde5f88b4f9ddfad1058e358a5ac9

Download Submit
C:\Windows\System\VqRavcl.exe

Filesize
1.2MB

MD5
c4b3d2aa2743f3fdfc44c956a7351df5

SHA1
8be3851f501a10cbac77bc5bfe0550ec1e6428b4

SHA256
f436f434686d8c6fc2f788800321c303984da3c8c06ebae338b5bfb8f2d1c792

SHA512
898cdd68590d81b928bbba8043233ea289c1cd9caf7ff72cebf4444cc5b99f8bcf61f6d783b07f0ecb1e0819582c6c09cd251d5313101be02f687f37207b6938

Download Submit
C:\Windows\System\WjKkyWN.exe

Filesize
1.2MB

MD5
687afde77ca3e44504b249e2f69af8ac

SHA1
b8ab8a954445ee75cd3b9db85f8ac3c9a7a2af38

SHA256
efa25d51beb70ec44fe6219c45624952820bcdbba73801e0ac2dd43704b8c296

SHA512
baa3d8843bd7327b6930dba3af437de490f1cccdb6b8b8c04c07116ef158a8d7cce86010606e74f234ceec9c0066137e66f44a8ff879ad0f6735c2c31f6bbd66

Download Submit
C:\Windows\System\XhetJXj.exe

Filesize
1.2MB

MD5
8976ba49f4071a57f058ca627dfd6392

SHA1
76d5f7ef4f8767bae4919816ec86f1090676ecfd

SHA256
63aedf32922800d5b7c6d6a69ecf08d9c3bd384a9f00bae14c133549a7856c28

SHA512
150a0c4d1dc85d58ea21e8ba1d839a8123954ac1bf057b3a369a1ddd45501db3d6e87c99f2c765026d2a3d92e89973a7ac5eb46e9390389fce65e6ae642401bd

Download Submit
C:\Windows\System\YOPxdLe.exe

Filesize
1.2MB

MD5
43792cbe057da0a10b23df60d9d88d27

SHA1
a5e3d4115056f925ea9a76c0040e59ad2ab60acc

SHA256
4d218049b7ba2487570edcccb4190d09e330282000b40a066f634c34a324e8b3

SHA512
b7171ba07f61e75b2339c4baf2c6bb125709fda88ec2decc24bc201cf46c83bf42fe67c915000a32151d9fd89202f175ccbb93083c5cc4de9ab26a22df841768

Download Submit
C:\Windows\System\bVdVzVV.exe

Filesize
1.2MB

MD5
a41466518c2c14a162b09e7c4350bbcf

SHA1
73e709a07c5c8258f27da9eff4d836f5dc1d7488

SHA256
d8350a5fcb7e5b1c9dc1e329240c3ca578d2dc59e03dd76bb164ea6f5791c994

SHA512
662cf91e0764e70e55f104bd76dfa7bee720fe2166651631d4d47398893aea0d17c687ba8d01d457c6628f41a885cc364a0a2185e0fcc58878714e5407ab3f98

Download Submit
C:\Windows\System\bmxfwvi.exe

Filesize
1.2MB

MD5
c52f62b4f8c078621dcd27a8b7290eb4

SHA1
404db0881b9db9beea5aa62c52be4f3e094c1c97

SHA256
ec4fdf3a7460e4a29d180e001c8e064e56829a9ae257ceacb712fcf11325767b

SHA512
a5c96202768db56b850b99424a979b30ace95a23875dca3634ceba6b4e725712859988462272d35863b23da60ec467f4e7fbfd6a59e73785fe0ec6f02ead4c0f

Download Submit
C:\Windows\System\duKawqB.exe

Filesize
1.2MB

MD5
4ba00f831548f7227b25debbb319d7bf

SHA1
654ac41f29b112f5514f08f09e15e864efc6e312

SHA256
c9ec803f7d1e506ff0b1be61e040c55197a04af418aa64d947c119fbbf23d505

SHA512
5a1bc03fa90d15f1305639a218a049adcbb5082836135f2fafdd7f9182452f70267330e52b1a2ee7ff6950a5d4a1bd7d7d16e3b95fa9f3266310c0cc5da71b3e

Download Submit
C:\Windows\System\fnRJbFv.exe

Filesize
1.2MB

MD5
02b32c8e9f31ae06b32de0100a38676c

SHA1
1165bfdb2548b3d4c7ac6975631d4ca03fe0d23f

SHA256
000f89efc7b8f8a5b638e37c90d6ad2d9d1945b86b791b95a6e1219be79bb61c

SHA512
3c98b4879b4727a7d36fa522968d50772c983b853c5834b4a0ac944821f8477dbb7dad5276755375a47c52ed76a2931ca0e6d56e07c515255a717346821611f9

Download Submit
C:\Windows\System\gxMCNwX.exe

Filesize
1.2MB

MD5
c8f8427da2e90492da5d6cce668ee66a

SHA1
3b73a0448d11ca66a74298f22c3d30f4afc2363b

SHA256
a3d3e35e4fbed41c41d3954ff26bde07ac91ed4d5f9d0c39abc48b95ae4f1b83

SHA512
498860b71d033c66a80c9ca1aaca3696dc5e1de48cd2c4ff0fbe4c5f5b4e46de958fc0835868b10d23ddf603ed77f1bf9890408297535d0417b0ccac1c9418d9

Download Submit
C:\Windows\System\hDeYBYt.exe

Filesize
1.2MB

MD5
0edea4e9cc0052eb2e7e2afbe64623ee

SHA1
82782bd92af720c04ae64708b2a5687a69c6a768

SHA256
a30351615ef03158ce9920f034da085bee9cdf2f9308030030230021055a6232

SHA512
6b265d461a7216a7167403fecc7322fb002417848d248fc2a9c9b8a9460c289548d0b8026dd566890f4f62e2de5c55e86330dcd1ee8dec3cff524092c393eceb

Download Submit
C:\Windows\System\haDaoaU.exe

Filesize
1.2MB

MD5
57e51e6f60aa57a68dba38427b82a77c

SHA1
52bd3aa444ddd0be3f7423ffb3bc684abd804554

SHA256
87f6eeb83c5da56b21259ab1264f1c8745e9e2fb811261074174543153690b0c

SHA512
9185164b73e8dd5a4ff61e826d1b9231d8e18aefc5e9557108d28ab93e3b90b174fb80a7b558740e76e8c0e7b1a8628f1310c510977e514f4346e81ffe969d00

Download Submit
C:\Windows\System\haGxnMc.exe

Filesize
1.2MB

MD5
6c2793cb5b7764d279499bae7bda71c0

SHA1
b2d547bdd0e1b9a3a46a0d2231b59b42d48c1f28

SHA256
3be5fb5b6bc4d1f58e81df004bb2ae8510e5ba4825881f84d56f681717918253

SHA512
e3d48c926bcc684cd6aa754e1cae93e370a2f5cb6c85f4e21e497deb3fadde8591eaf18286c2c3dcf244ca78fbf83eb91266b09e8db467553268e9f2c9bd5cfb

Download Submit
C:\Windows\System\iawazCV.exe

Filesize
1.2MB

MD5
f90d3bab8438b5883da95b9de1b2607b

SHA1
04595b58c403ea5c8cce46a70e21e0536784e4b2

SHA256
619828602918e61b8da1eb9de9cf5569ada7f36db6ee6ca702602f86ad95732f

SHA512
4fa9ee63efd987cc211c96d81c94fe277eddc7debf0fa7875b327f50f7406feacbbd3ec0365a9306650699646a17d4519e77090ad68c7141d7ebcb1815c6aec0

Download Submit
C:\Windows\System\jgRGdih.exe

Filesize
1.2MB

MD5
8255e1c79d9379f4774e346b4cf0bddd

SHA1
bf5cc57a0e95531ab06f9850727c2c6cd5dbd4e9

SHA256
94fd6f367781a69e46bd80e6e08784cc8ba67728e01b55ac6532a2bb0ae3d58c

SHA512
e55eded9d7c118189a30c5e8242788169d88d78bf8d1a95c32bc3da07e701450e5bfcfbb4103385c47442a7372b68c1e8d815950464dcbb8ac3e7d8d6008017f

Download Submit
C:\Windows\System\jhAwfZP.exe

Filesize
1.2MB

MD5
ce4dee1ac458639675cbc276ae785016

SHA1
26885973abb602a86fb612196bdc02d7948d4a23

SHA256
a2a70b4072fd6261216e889114756cb8c75ec7ba8d0950fda594dc3545bad2d5

SHA512
8bf4d6a8ae998ec6abcd4d1f069bc27bad5c839da94055f5673827150622928562fd5c3c56ba593c7fa24c266cae3da2b63b017d98af9445473113e2ccf68c6e

Download Submit
C:\Windows\System\klNAnNy.exe

Filesize
1.2MB

MD5
9af7d08d23f97381f33ab587c08d7567

SHA1
03ab15404d3a0473af355676c898f1b76394d727

SHA256
f14f4c38154645408fa060559ccbcd762f7920cbf0280f621f0bae3a30eb039f

SHA512
5019ddf9b94556cda2d60524ca52eb1dfa92ae6e2725ed0a61bdc8bbdc7d840068fc76a79855f9136896a8372f2b13e972c5470dadd7900a0048a20504a4ba3b

Download Submit
C:\Windows\System\ktbGWhR.exe

Filesize
1.2MB

MD5
098d176ccb5a1d892cb64b361f027c5c

SHA1
7fb35fd07d5556462f2fe52f03774e64a5d09755

SHA256
d73dd24107549c04b95ed8603399a8b69f6f4e357d7c8edbc665383a33ed66c6

SHA512
ec6bea314fc78f25698f83c8546fac2311d59f3b6c1072acd3dc034bd2f7b0f8a281cdd93127c64b057bce1b64603244c30ac1fbe8f7ebae05c758402f906e01

Download Submit
C:\Windows\System\lRjrNXg.exe

Filesize
1.2MB

MD5
efa769a31b281556d5de0aa6ca1e56a0

SHA1
885a56ff38e23034f2f2f067b8052a87e56f8597

SHA256
ea50ad0d45ab11d242af441e7be95175e71f54cb970b18707ea061181c5b8f6f

SHA512
e753c708c461521e91af715cba793636fa8609048653649480a382e869a01706cc34fffbb5cb106dc27b7426060b9595590a6bce8ade1589dae557ff6749a8f5

Download Submit
C:\Windows\System\luQmILg.exe

Filesize
1.2MB

MD5
377484692ba53a5b9bb0330d443454de

SHA1
65f71d33e9572a690e8051f5aa9353f232d6d8cc

SHA256
add1b382650b2eb25261caa5bf252214c9eef903517cb98a359be5d57ed59666

SHA512
9706757f73640ac24305d4c92c17c5c39f15114b21c6c6a38cc4615020612654cae8adb1268ae83743f49c142a72b30b443e163420f9b79211cfdd482ce9a820

Download Submit
C:\Windows\System\mCYJonH.exe

Filesize
1.2MB

MD5
23b43270c4387dee6b984c8bfa8b0a63

SHA1
ea46bdce3420ed7d75772dda76daae114a58bfb8

SHA256
2024d39cbc5aaeec8f890056b7cccbaf00713ab241508ad24781e8c5a4bb0a5e

SHA512
3337cfbacf74ba491fba5a66e1e180e83abbc927c0e2319d329554f54f108a6ce70a5a5f8f95005d16a6cf69592a85ad48f5395f55e135f1406aad31631f7005

Download Submit
C:\Windows\System\ohOELtm.exe

Filesize
1.2MB

MD5
bd7949724a8b3bd322aa85faa8d97c20

SHA1
751c735ce94cfa873864e7b3bb173540dcfde2dd

SHA256
b29e029361607fd7ee410a751fb7710f89d1baf0b64d26c3c04ccc9264d205d6

SHA512
21164a4b93bf5bd7fc3c5d2e5a76699c11a3c06402a360d2edcd9dda742f86fd9e81aa8d23168d961bf673b28b6d806473399fcd219a0335d61890afccf0e4c9

Download Submit
C:\Windows\System\ssEvmQn.exe

Filesize
1.2MB

MD5
3cc019b19d289daf69b204ff9024f243

SHA1
94e17917cfe1f9a76ef7fcaef6860b128564d8b4

SHA256
a51dce6eee21eee4ad816ae8b7f5ecbf808eebd6feca06079f75e5547e996b42

SHA512
618d1e85930b97fb77b17b038d7817576ade8c443441f48eb75e08a4f0c2910dfe4e09364fe0b78c96ff7282c62cec01f8aed9b2995da2be26bc177f7983b68a

Download Submit
C:\Windows\System\tTEzMML.exe

Filesize
1.2MB

MD5
959fbc54b2c4165a8daf6a4b8117eeaa

SHA1
b392b22fc1cf23001a3bdfab51cc4bf307500c84

SHA256
357c6aeec0d7a9b548142f3a6b534784d35c801b1ff77952e259b428a3c52194

SHA512
19dc3b83034f4a7455512c67567e107522210898be153c5bede3732e40c2b600b156e36731abc451f62763cc3b4b1cc0d752502ecac13b99000c34e2be3b41d1

Download Submit
C:\Windows\System\wghDBGY.exe

Filesize
1.2MB

MD5
dfb496dfd08d562f603482e0d94dbd42

SHA1
8c592351b56d8cc010875716f3cfb60ebc54abde

SHA256
f8b271ae4d160ff16baed006295db46c9043dc635b1974787f53b19c7886a532

SHA512
e2bf112df7888d5d93cc0ae381be57cb17701ed836de47eba58df63532a4a7e65f6ae37829b6666ca24bcb4f66eaa2daff16c9b5c5d1fdd4f3da2cadc0f83ba6

Download Submit
C:\Windows\System\zKvkGHe.exe

Filesize
1.2MB

MD5
294eea5005da22fdc96c1d839b9d6ed9

SHA1
6e2517f6b2ea7da3878afbb6d90aa7486e7894d1

SHA256
f276757e4efc7a0c7a9e56076af715d105bb5dc52a02177dffe1da13356c03fa

SHA512
9023633d5a8be2be9de58913d396529157ea83cc78887268a4ecf74752ce71f152e302de250cadd1065e89f402962d1b89dab2f50547eeb8484b954e25117b20

Download Submit
memory/508-2162-0x00007FF7D4D20000-0x00007FF7D5112000-memory.dmp

Filesize
3.9MB

Download
memory/508-399-0x00007FF7D4D20000-0x00007FF7D5112000-memory.dmp

Filesize
3.9MB

Download
memory/1508-2160-0x00007FF6C2430000-0x00007FF6C2822000-memory.dmp

Filesize
3.9MB

Download
memory/1508-209-0x00007FF6C2430000-0x00007FF6C2822000-memory.dmp

Filesize
3.9MB

Download
memory/1800-455-0x00007FF746480000-0x00007FF746872000-memory.dmp

Filesize
3.9MB

Download
memory/1800-2172-0x00007FF746480000-0x00007FF746872000-memory.dmp

Filesize
3.9MB

Download
memory/1976-2187-0x00007FF7AF6D0000-0x00007FF7AFAC2000-memory.dmp

Filesize
3.9MB

Download
memory/1976-626-0x00007FF7AF6D0000-0x00007FF7AFAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2076-2195-0x00007FF635B80000-0x00007FF635F72000-memory.dmp

Filesize
3.9MB

Download
memory/2076-628-0x00007FF635B80000-0x00007FF635F72000-memory.dmp

Filesize
3.9MB

Download
memory/2112-2155-0x00007FF7ACE80000-0x00007FF7AD272000-memory.dmp

Filesize
3.9MB

Download
memory/2112-616-0x00007FF7ACE80000-0x00007FF7AD272000-memory.dmp

Filesize
3.9MB

Download
memory/2144-2163-0x00007FF6EBFE0000-0x00007FF6EC3D2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-347-0x00007FF6EBFE0000-0x00007FF6EC3D2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-2181-0x00007FF7EF710000-0x00007FF7EFB02000-memory.dmp

Filesize
3.9MB

Download
memory/2584-624-0x00007FF7EF710000-0x00007FF7EFB02000-memory.dmp

Filesize
3.9MB

Download
memory/2700-2151-0x00007FF635AE0000-0x00007FF635ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-629-0x00007FF635AE0000-0x00007FF635ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-0-0x00007FF654090000-0x00007FF654482000-memory.dmp

Filesize
3.9MB

Download
memory/2748-1-0x000001B2DB890000-0x000001B2DB8A0000-memory.dmp

Filesize
64KB

Download
memory/2752-627-0x00007FF604FA0000-0x00007FF605392000-memory.dmp

Filesize
3.9MB

Download
memory/2752-2212-0x00007FF604FA0000-0x00007FF605392000-memory.dmp

Filesize
3.9MB

Download
memory/3156-2196-0x00007FF762950000-0x00007FF762D42000-memory.dmp

Filesize
3.9MB

Download
memory/3156-622-0x00007FF762950000-0x00007FF762D42000-memory.dmp

Filesize
3.9MB

Download
memory/3432-2179-0x00007FF72C550000-0x00007FF72C942000-memory.dmp

Filesize
3.9MB

Download
memory/3432-619-0x00007FF72C550000-0x00007FF72C942000-memory.dmp

Filesize
3.9MB

Download
memory/3936-2149-0x00007FF62C5A0000-0x00007FF62C992000-memory.dmp

Filesize
3.9MB

Download
memory/3936-19-0x00007FF62C5A0000-0x00007FF62C992000-memory.dmp

Filesize
3.9MB

Download
memory/4092-2170-0x00007FF7BF850000-0x00007FF7BFC42000-memory.dmp

Filesize
3.9MB

Download
memory/4092-623-0x00007FF7BF850000-0x00007FF7BFC42000-memory.dmp

Filesize
3.9MB

Download
memory/4276-620-0x00007FF789990000-0x00007FF789D82000-memory.dmp

Filesize
3.9MB

Download
memory/4276-2186-0x00007FF789990000-0x00007FF789D82000-memory.dmp

Filesize
3.9MB

Download
memory/4440-614-0x00007FFDB73F0000-0x00007FFDB7EB1000-memory.dmp

Filesize
10.8MB

Download
memory/4440-95-0x00007FFDB73F0000-0x00007FFDB7EB1000-memory.dmp

Filesize
10.8MB

Download
memory/4440-20-0x00007FFDB73F3000-0x00007FFDB73F5000-memory.dmp

Filesize
8KB

Download
memory/4440-414-0x000002A155F60000-0x000002A155F82000-memory.dmp

Filesize
136KB

Download
memory/4440-2270-0x00007FFDB73F3000-0x00007FFDB73F5000-memory.dmp

Filesize
8KB

Download
memory/4440-2147-0x00007FFDB73F0000-0x00007FFDB7EB1000-memory.dmp

Filesize
10.8MB

Download
memory/4440-1811-0x000002A157690000-0x000002A157E36000-memory.dmp

Filesize
7.6MB

Download
memory/4456-2167-0x00007FF653D60000-0x00007FF654152000-memory.dmp

Filesize
3.9MB

Download
memory/4456-617-0x00007FF653D60000-0x00007FF654152000-memory.dmp

Filesize
3.9MB

Download
memory/4484-2154-0x00007FF6C6860000-0x00007FF6C6C52000-memory.dmp

Filesize
3.9MB

Download
memory/4484-551-0x00007FF6C6860000-0x00007FF6C6C52000-memory.dmp

Filesize
3.9MB

Download
memory/4492-2158-0x00007FF650960000-0x00007FF650D52000-memory.dmp

Filesize
3.9MB

Download
memory/4492-145-0x00007FF650960000-0x00007FF650D52000-memory.dmp

Filesize
3.9MB

Download
memory/4568-621-0x00007FF6F83E0000-0x00007FF6F87D2000-memory.dmp

Filesize
3.9MB

Download
memory/4568-2174-0x00007FF6F83E0000-0x00007FF6F87D2000-memory.dmp

Filesize
3.9MB

Download
memory/4576-615-0x00007FF6DC9B0000-0x00007FF6DCDA2000-memory.dmp

Filesize
3.9MB

Download
memory/4576-2177-0x00007FF6DC9B0000-0x00007FF6DCDA2000-memory.dmp

Filesize
3.9MB

Download
memory/4680-2213-0x00007FF6309D0000-0x00007FF630DC2000-memory.dmp

Filesize
3.9MB

Download
memory/4680-625-0x00007FF6309D0000-0x00007FF630DC2000-memory.dmp

Filesize
3.9MB

Download
memory/4688-2166-0x00007FF625B00000-0x00007FF625EF2000-memory.dmp

Filesize
3.9MB

Download
memory/4688-613-0x00007FF625B00000-0x00007FF625EF2000-memory.dmp

Filesize
3.9MB

Download
memory/4960-618-0x00007FF7D2330000-0x00007FF7D2722000-memory.dmp

Filesize
3.9MB

Download
memory/4960-2176-0x00007FF7D2330000-0x00007FF7D2722000-memory.dmp

Filesize
3.9MB

Download
memory/5072-300-0x00007FF78AD10000-0x00007FF78B102000-memory.dmp

Filesize
3.9MB

Download
memory/5072-2216-0x00007FF78AD10000-0x00007FF78B102000-memory.dmp

Filesize
3.9MB

Download