xmrig | aaa1a57b70972692cab390d8ef6f06a42c76dafb3d4a5a98cf26ce48b750d45c

Analysis

max time kernel
129s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
Size

1.5MB
MD5

ad03846f9b284bb17ed9e752cbf7f8c0
SHA1

03597c369134b352891117ae1c3ae4b472fd2983
SHA256

aaa1a57b70972692cab390d8ef6f06a42c76dafb3d4a5a98cf26ce48b750d45c
SHA512

3c81c8ac13a3addf6c5bcd4b8acb89c0296db59effd52b1f05e9f424b55a03d681d9681ff561f21a2087beed5e3ba519d744b1a2dd1130e92915e14ddb243d5a
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvj7NaVNqd9OeSZXCdzvd4/iooIXsLq9Ua:Lz071uv4BPMkHC0IaSEzQR4iRLUUa

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/1200-369-0x00007FF7AFB10000-0x00007FF7AFF02000-memory.dmp	xmrig
behavioral2/memory/1868-466-0x00007FF719AD0000-0x00007FF719EC2000-memory.dmp	xmrig
behavioral2/memory/1864-547-0x00007FF70A640000-0x00007FF70AA32000-memory.dmp	xmrig
behavioral2/memory/1876-549-0x00007FF766E40000-0x00007FF767232000-memory.dmp	xmrig
behavioral2/memory/3036-552-0x00007FF7D02E0000-0x00007FF7D06D2000-memory.dmp	xmrig
behavioral2/memory/1108-680-0x00007FF7BBD60000-0x00007FF7BC152000-memory.dmp	xmrig
behavioral2/memory/1636-914-0x00007FF7A7090000-0x00007FF7A7482000-memory.dmp	xmrig
behavioral2/memory/3436-1179-0x00007FF6E78D0000-0x00007FF6E7CC2000-memory.dmp	xmrig
behavioral2/memory/4896-1844-0x00007FF60CB60000-0x00007FF60CF52000-memory.dmp	xmrig
behavioral2/memory/2632-1102-0x00007FF7F84D0000-0x00007FF7F88C2000-memory.dmp	xmrig
behavioral2/memory/1172-727-0x00007FF6D0560000-0x00007FF6D0952000-memory.dmp	xmrig
behavioral2/memory/4104-726-0x00007FF629330000-0x00007FF629722000-memory.dmp	xmrig
behavioral2/memory/3312-579-0x00007FF7DBD70000-0x00007FF7DC162000-memory.dmp	xmrig
behavioral2/memory/2988-554-0x00007FF6C0040000-0x00007FF6C0432000-memory.dmp	xmrig
behavioral2/memory/4732-553-0x00007FF73E910000-0x00007FF73ED02000-memory.dmp	xmrig
behavioral2/memory/4804-551-0x00007FF7DE100000-0x00007FF7DE4F2000-memory.dmp	xmrig
behavioral2/memory/860-550-0x00007FF7A6280000-0x00007FF7A6672000-memory.dmp	xmrig
behavioral2/memory/4852-548-0x00007FF6495B0000-0x00007FF6499A2000-memory.dmp	xmrig
behavioral2/memory/3636-297-0x00007FF6305E0000-0x00007FF6309D2000-memory.dmp	xmrig
behavioral2/memory/2776-228-0x00007FF68ACD0000-0x00007FF68B0C2000-memory.dmp	xmrig
behavioral2/memory/2272-2684-0x00007FF670550000-0x00007FF670942000-memory.dmp	xmrig
behavioral2/memory/2252-2786-0x00007FF6B2290000-0x00007FF6B2682000-memory.dmp	xmrig
behavioral2/memory/2776-2785-0x00007FF68ACD0000-0x00007FF68B0C2000-memory.dmp	xmrig
behavioral2/memory/1200-2790-0x00007FF7AFB10000-0x00007FF7AFF02000-memory.dmp	xmrig
behavioral2/memory/1864-2789-0x00007FF70A640000-0x00007FF70AA32000-memory.dmp	xmrig
behavioral2/memory/3636-2792-0x00007FF6305E0000-0x00007FF6309D2000-memory.dmp	xmrig
behavioral2/memory/4104-2799-0x00007FF629330000-0x00007FF629722000-memory.dmp	xmrig
behavioral2/memory/328-2802-0x00007FF65C290000-0x00007FF65C682000-memory.dmp	xmrig
behavioral2/memory/1868-2804-0x00007FF719AD0000-0x00007FF719EC2000-memory.dmp	xmrig
behavioral2/memory/3036-2807-0x00007FF7D02E0000-0x00007FF7D06D2000-memory.dmp	xmrig
behavioral2/memory/2988-2808-0x00007FF6C0040000-0x00007FF6C0432000-memory.dmp	xmrig
behavioral2/memory/4732-2810-0x00007FF73E910000-0x00007FF73ED02000-memory.dmp	xmrig
behavioral2/memory/4852-2801-0x00007FF6495B0000-0x00007FF6499A2000-memory.dmp	xmrig
behavioral2/memory/4804-2797-0x00007FF7DE100000-0x00007FF7DE4F2000-memory.dmp	xmrig
behavioral2/memory/1876-2795-0x00007FF766E40000-0x00007FF767232000-memory.dmp	xmrig
behavioral2/memory/2632-2842-0x00007FF7F84D0000-0x00007FF7F88C2000-memory.dmp	xmrig
behavioral2/memory/860-2845-0x00007FF7A6280000-0x00007FF7A6672000-memory.dmp	xmrig
behavioral2/memory/1108-2836-0x00007FF7BBD60000-0x00007FF7BC152000-memory.dmp	xmrig
behavioral2/memory/3312-2835-0x00007FF7DBD70000-0x00007FF7DC162000-memory.dmp	xmrig
behavioral2/memory/3436-2840-0x00007FF6E78D0000-0x00007FF6E7CC2000-memory.dmp	xmrig
behavioral2/memory/4896-2818-0x00007FF60CB60000-0x00007FF60CF52000-memory.dmp	xmrig
behavioral2/memory/1172-2817-0x00007FF6D0560000-0x00007FF6D0952000-memory.dmp	xmrig
behavioral2/memory/1636-2830-0x00007FF7A7090000-0x00007FF7A7482000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4952	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2252	zKoJcqH.exe
2776	GVHzXgI.exe
328	QmCkfZZ.exe
3636	NcOfRuk.exe
1200	WbxrHAW.exe
1868	hqgrsVw.exe
1864	cEzwuBW.exe
4852	DGCZiwB.exe
1876	PylCUtw.exe
860	SBhwafk.exe
4804	dIIJTne.exe
3036	xVPhbUv.exe
4732	rheCxGc.exe
2988	MDPsVef.exe
3312	dDxSkPO.exe
1108	WambYyV.exe
4104	vnEQZJP.exe
1172	EUBDfRM.exe
1636	aEFEHyU.exe
2632	NESIusr.exe
3436	sUyPTHx.exe
4896	ZhzRfDY.exe
4064	SBwZXUd.exe
2516	MuuqHxq.exe
5080	rtXyadW.exe
3732	txyFAcf.exe
2684	RCqhXLV.exe
2576	PYpwfrG.exe
3972	XbChJaZ.exe
4052	rZPrMhE.exe
4160	PFxDlfw.exe
3616	fBzRQVU.exe
4688	LMwCELF.exe
3460	zmhdoKX.exe
3604	wfraXvh.exe
4408	UoHBmDS.exe
2196	DSxeLti.exe
1244	OqMRgEQ.exe
2604	rMIZDxO.exe
3956	IsJMnPK.exe
888	DSzajGx.exe
1800	LmlVqAQ.exe
2156	diypuUl.exe
1672	TngfXUk.exe
4832	nRVwSho.exe
2628	GkdijoI.exe
4548	NpmrzQS.exe
2812	xiSQOBz.exe
3020	PefSrAA.exe
4456	fkFdBWo.exe
4696	WJREBRn.exe
4016	CaUcLub.exe
3160	GHxVKPq.exe
1804	vVdVDVR.exe
2708	CMmbEmm.exe
2972	AHMWPXT.exe
3000	THAdGIy.exe
3200	SMXKNNM.exe
1904	qXUjaVn.exe
2528	gvhwybr.exe
3600	RXrrIde.exe
3248	ztYIpmT.exe
692	whwHvBM.exe
4304	msIStIu.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2272-0-0x00007FF670550000-0x00007FF670942000-memory.dmp	upx
behavioral2/files/0x000b000000023b84-7.dat	upx
behavioral2/files/0x000a000000023b88-11.dat	upx
behavioral2/files/0x000a000000023b9a-140.dat	upx
behavioral2/files/0x000a000000023ba3-141.dat	upx
behavioral2/files/0x000a000000023bb0-184.dat	upx
behavioral2/files/0x000a000000023baf-180.dat	upx
behavioral2/files/0x000a000000023b9d-187.dat	upx
behavioral2/memory/1200-369-0x00007FF7AFB10000-0x00007FF7AFF02000-memory.dmp	upx
behavioral2/memory/1868-466-0x00007FF719AD0000-0x00007FF719EC2000-memory.dmp	upx
behavioral2/memory/1864-547-0x00007FF70A640000-0x00007FF70AA32000-memory.dmp	upx
behavioral2/memory/1876-549-0x00007FF766E40000-0x00007FF767232000-memory.dmp	upx
behavioral2/memory/3036-552-0x00007FF7D02E0000-0x00007FF7D06D2000-memory.dmp	upx
behavioral2/memory/1108-680-0x00007FF7BBD60000-0x00007FF7BC152000-memory.dmp	upx
behavioral2/memory/1636-914-0x00007FF7A7090000-0x00007FF7A7482000-memory.dmp	upx
behavioral2/memory/3436-1179-0x00007FF6E78D0000-0x00007FF6E7CC2000-memory.dmp	upx
behavioral2/memory/4896-1844-0x00007FF60CB60000-0x00007FF60CF52000-memory.dmp	upx
behavioral2/memory/2632-1102-0x00007FF7F84D0000-0x00007FF7F88C2000-memory.dmp	upx
behavioral2/memory/1172-727-0x00007FF6D0560000-0x00007FF6D0952000-memory.dmp	upx
behavioral2/memory/4104-726-0x00007FF629330000-0x00007FF629722000-memory.dmp	upx
behavioral2/memory/3312-579-0x00007FF7DBD70000-0x00007FF7DC162000-memory.dmp	upx
behavioral2/memory/2988-554-0x00007FF6C0040000-0x00007FF6C0432000-memory.dmp	upx
behavioral2/memory/4732-553-0x00007FF73E910000-0x00007FF73ED02000-memory.dmp	upx
behavioral2/memory/4804-551-0x00007FF7DE100000-0x00007FF7DE4F2000-memory.dmp	upx
behavioral2/memory/860-550-0x00007FF7A6280000-0x00007FF7A6672000-memory.dmp	upx
behavioral2/memory/4852-548-0x00007FF6495B0000-0x00007FF6499A2000-memory.dmp	upx
behavioral2/memory/3636-297-0x00007FF6305E0000-0x00007FF6309D2000-memory.dmp	upx
behavioral2/memory/2776-228-0x00007FF68ACD0000-0x00007FF68B0C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9e-200.dat	upx
behavioral2/files/0x000a000000023b95-194.dat	upx
behavioral2/files/0x000a000000023bb3-193.dat	upx
behavioral2/files/0x000a000000023bb2-192.dat	upx
behavioral2/files/0x000a000000023bb1-191.dat	upx
behavioral2/files/0x000a000000023bae-172.dat	upx
behavioral2/files/0x000a000000023bad-171.dat	upx
behavioral2/files/0x000a000000023b98-170.dat	upx
behavioral2/files/0x000a000000023bac-169.dat	upx
behavioral2/files/0x000a000000023bab-166.dat	upx
behavioral2/files/0x000a000000023baa-163.dat	upx
behavioral2/files/0x000a000000023ba9-162.dat	upx
behavioral2/files/0x000a000000023b96-156.dat	upx
behavioral2/files/0x000a000000023ba6-154.dat	upx
behavioral2/files/0x000a000000023ba5-153.dat	upx
behavioral2/files/0x000a000000023b8f-149.dat	upx
behavioral2/files/0x000a000000023b93-130.dat	upx
behavioral2/files/0x000a000000023ba2-128.dat	upx
behavioral2/files/0x000a000000023b92-122.dat	upx
behavioral2/files/0x000a000000023ba1-117.dat	upx
behavioral2/files/0x000a000000023ba0-113.dat	upx
behavioral2/files/0x000a000000023b9f-112.dat	upx
behavioral2/files/0x000a000000023ba8-159.dat	upx
behavioral2/files/0x000a000000023ba7-155.dat	upx
behavioral2/files/0x000a000000023b89-103.dat	upx
behavioral2/files/0x000a000000023b8c-99.dat	upx
behavioral2/files/0x000a000000023b9c-95.dat	upx
behavioral2/files/0x000a000000023b9b-94.dat	upx
behavioral2/files/0x000a000000023b94-143.dat	upx
behavioral2/files/0x000a000000023ba4-142.dat	upx
behavioral2/files/0x000a000000023b99-90.dat	upx
behavioral2/files/0x000a000000023b8d-85.dat	upx
behavioral2/files/0x000a000000023b97-82.dat	upx
behavioral2/files/0x000a000000023b90-109.dat	upx
behavioral2/files/0x000a000000023b8e-64.dat	upx
behavioral2/files/0x000a000000023b8b-63.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kytcXvK.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\XwuvRex.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\SxcPKVE.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\dNzXRoR.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\uWgRpSK.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\muWFyIy.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\FFIzCoA.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\BKkfWZv.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\YZfMsys.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\cGYjDQZ.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\cqRRFfY.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\ANYsEHo.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\jodrvyp.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\knFQyZW.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\JSRNuBO.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\KQvtvgo.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\lCcxbZb.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\PogPcku.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\kLuoDEx.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\NdmtLVj.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\NMqpMgh.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\TwBxLGQ.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\pFQYMAS.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\WQHYZNk.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\kORElVY.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\wWetAPo.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\zSMDJDD.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\vysFgWc.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\VvrYbiY.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\PqqGMqk.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\hyBhyub.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\JVEeCOW.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\DdwJPBo.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\WwgqTNL.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\FRWrDQq.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\osAdTuL.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\jfwtxLt.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\sWrADPr.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\igRArSD.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\wZNyrfs.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\PFxDlfw.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\yoPwSdh.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\sYSnJyf.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\dyOeccE.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\FuaENBS.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\pYoCEOc.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\aSWsTfm.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\SGnBqsc.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\tCEZXjq.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\GpYmWoo.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\KBngdpt.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\XSFSgsl.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\VeAxVRE.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\yTyWeof.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\Qowmevp.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\RnvpRMS.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\VCKJblo.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\jgzJdFv.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\knVvPQi.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\VJTKJjX.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\JrTNtim.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\NNrWAlY.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\HLfaIBv.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
File created	C:\Windows\System\jCnsSkC.exe	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeLockMemoryPrivilege	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
Token: SeLockMemoryPrivilege	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 4952	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	84
PID 2272 wrote to memory of 4952	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	84
PID 2272 wrote to memory of 2252	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	85
PID 2272 wrote to memory of 2252	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	85
PID 2272 wrote to memory of 2776	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	86
PID 2272 wrote to memory of 2776	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	86
PID 2272 wrote to memory of 328	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	87
PID 2272 wrote to memory of 328	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	87
PID 2272 wrote to memory of 3636	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	88
PID 2272 wrote to memory of 3636	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	88
PID 2272 wrote to memory of 1200	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	89
PID 2272 wrote to memory of 1200	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	89
PID 2272 wrote to memory of 1868	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	90
PID 2272 wrote to memory of 1868	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	90
PID 2272 wrote to memory of 1876	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	91
PID 2272 wrote to memory of 1876	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	91
PID 2272 wrote to memory of 1864	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	92
PID 2272 wrote to memory of 1864	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	92
PID 2272 wrote to memory of 2988	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	93
PID 2272 wrote to memory of 2988	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	93
PID 2272 wrote to memory of 4852	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	94
PID 2272 wrote to memory of 4852	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	94
PID 2272 wrote to memory of 860	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	95
PID 2272 wrote to memory of 860	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	95
PID 2272 wrote to memory of 4804	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	96
PID 2272 wrote to memory of 4804	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	96
PID 2272 wrote to memory of 3036	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	97
PID 2272 wrote to memory of 3036	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	97
PID 2272 wrote to memory of 4732	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	98
PID 2272 wrote to memory of 4732	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	98
PID 2272 wrote to memory of 3312	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	99
PID 2272 wrote to memory of 3312	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	99
PID 2272 wrote to memory of 1108	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	100
PID 2272 wrote to memory of 1108	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	100
PID 2272 wrote to memory of 4104	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	101
PID 2272 wrote to memory of 4104	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	101
PID 2272 wrote to memory of 1172	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	102
PID 2272 wrote to memory of 1172	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	102
PID 2272 wrote to memory of 1636	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	103
PID 2272 wrote to memory of 1636	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	103
PID 2272 wrote to memory of 2576	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	104
PID 2272 wrote to memory of 2576	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	104
PID 2272 wrote to memory of 2632	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	105
PID 2272 wrote to memory of 2632	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	105
PID 2272 wrote to memory of 3436	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	106
PID 2272 wrote to memory of 3436	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	106
PID 2272 wrote to memory of 4896	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	107
PID 2272 wrote to memory of 4896	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	107
PID 2272 wrote to memory of 4064	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	108
PID 2272 wrote to memory of 4064	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	108
PID 2272 wrote to memory of 2516	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	109
PID 2272 wrote to memory of 2516	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	109
PID 2272 wrote to memory of 5080	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	110
PID 2272 wrote to memory of 5080	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	110
PID 2272 wrote to memory of 3732	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	111
PID 2272 wrote to memory of 3732	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	111
PID 2272 wrote to memory of 2684	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	112
PID 2272 wrote to memory of 2684	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	112
PID 2272 wrote to memory of 3972	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	113
PID 2272 wrote to memory of 3972	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	113
PID 2272 wrote to memory of 4052	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	114
PID 2272 wrote to memory of 4052	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	114
PID 2272 wrote to memory of 4160	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	115
PID 2272 wrote to memory of 4160	2272	ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe	115

C:\Users\Admin\AppData\Local\Temp\ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\ad03846f9b284bb17ed9e752cbf7f8c0_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\System\zKoJcqH.exe
  C:\Windows\System\zKoJcqH.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\GVHzXgI.exe
  C:\Windows\System\GVHzXgI.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\QmCkfZZ.exe
  C:\Windows\System\QmCkfZZ.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\NcOfRuk.exe
  C:\Windows\System\NcOfRuk.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\WbxrHAW.exe
  C:\Windows\System\WbxrHAW.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\hqgrsVw.exe
  C:\Windows\System\hqgrsVw.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\PylCUtw.exe
  C:\Windows\System\PylCUtw.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\cEzwuBW.exe
  C:\Windows\System\cEzwuBW.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\MDPsVef.exe
  C:\Windows\System\MDPsVef.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\DGCZiwB.exe
  C:\Windows\System\DGCZiwB.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\SBhwafk.exe
  C:\Windows\System\SBhwafk.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\dIIJTne.exe
  C:\Windows\System\dIIJTne.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\xVPhbUv.exe
  C:\Windows\System\xVPhbUv.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\rheCxGc.exe
  C:\Windows\System\rheCxGc.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\dDxSkPO.exe
  C:\Windows\System\dDxSkPO.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\WambYyV.exe
  C:\Windows\System\WambYyV.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\vnEQZJP.exe
  C:\Windows\System\vnEQZJP.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\EUBDfRM.exe
  C:\Windows\System\EUBDfRM.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\aEFEHyU.exe
  C:\Windows\System\aEFEHyU.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\PYpwfrG.exe
  C:\Windows\System\PYpwfrG.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\NESIusr.exe
  C:\Windows\System\NESIusr.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\sUyPTHx.exe
  C:\Windows\System\sUyPTHx.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\ZhzRfDY.exe
  C:\Windows\System\ZhzRfDY.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\SBwZXUd.exe
  C:\Windows\System\SBwZXUd.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\MuuqHxq.exe
  C:\Windows\System\MuuqHxq.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\rtXyadW.exe
  C:\Windows\System\rtXyadW.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\txyFAcf.exe
  C:\Windows\System\txyFAcf.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\RCqhXLV.exe
  C:\Windows\System\RCqhXLV.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\XbChJaZ.exe
  C:\Windows\System\XbChJaZ.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\rZPrMhE.exe
  C:\Windows\System\rZPrMhE.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\PFxDlfw.exe
  C:\Windows\System\PFxDlfw.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\fBzRQVU.exe
  C:\Windows\System\fBzRQVU.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\LMwCELF.exe
  C:\Windows\System\LMwCELF.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\zmhdoKX.exe
  C:\Windows\System\zmhdoKX.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\wfraXvh.exe
  C:\Windows\System\wfraXvh.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\UoHBmDS.exe
  C:\Windows\System\UoHBmDS.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\DSxeLti.exe
  C:\Windows\System\DSxeLti.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\OqMRgEQ.exe
  C:\Windows\System\OqMRgEQ.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\rMIZDxO.exe
  C:\Windows\System\rMIZDxO.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\IsJMnPK.exe
  C:\Windows\System\IsJMnPK.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\DSzajGx.exe
  C:\Windows\System\DSzajGx.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\LmlVqAQ.exe
  C:\Windows\System\LmlVqAQ.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\diypuUl.exe
  C:\Windows\System\diypuUl.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\TngfXUk.exe
  C:\Windows\System\TngfXUk.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\nRVwSho.exe
  C:\Windows\System\nRVwSho.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\GkdijoI.exe
  C:\Windows\System\GkdijoI.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\NpmrzQS.exe
  C:\Windows\System\NpmrzQS.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\qXUjaVn.exe
  C:\Windows\System\qXUjaVn.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\gvhwybr.exe
  C:\Windows\System\gvhwybr.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\xiSQOBz.exe
  C:\Windows\System\xiSQOBz.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\PefSrAA.exe
  C:\Windows\System\PefSrAA.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\fkFdBWo.exe
  C:\Windows\System\fkFdBWo.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\WJREBRn.exe
  C:\Windows\System\WJREBRn.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\CaUcLub.exe
  C:\Windows\System\CaUcLub.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\GHxVKPq.exe
  C:\Windows\System\GHxVKPq.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\vVdVDVR.exe
  C:\Windows\System\vVdVDVR.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\CMmbEmm.exe
  C:\Windows\System\CMmbEmm.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\AHMWPXT.exe
  C:\Windows\System\AHMWPXT.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\THAdGIy.exe
  C:\Windows\System\THAdGIy.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\SMXKNNM.exe
  C:\Windows\System\SMXKNNM.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\RXrrIde.exe
  C:\Windows\System\RXrrIde.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\ztYIpmT.exe
  C:\Windows\System\ztYIpmT.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\whwHvBM.exe
  C:\Windows\System\whwHvBM.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\msIStIu.exe
  C:\Windows\System\msIStIu.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\iHsGOqq.exe
  C:\Windows\System\iHsGOqq.exe
  2⤵
  PID:4360
- C:\Windows\System\WGzyvFk.exe
  C:\Windows\System\WGzyvFk.exe
  2⤵
  PID:4344
- C:\Windows\System\FqAzKLF.exe
  C:\Windows\System\FqAzKLF.exe
  2⤵
  PID:4568
- C:\Windows\System\BFBOEaH.exe
  C:\Windows\System\BFBOEaH.exe
  2⤵
  PID:1980
- C:\Windows\System\MeQkTvT.exe
  C:\Windows\System\MeQkTvT.exe
  2⤵
  PID:3808
- C:\Windows\System\hrodZQi.exe
  C:\Windows\System\hrodZQi.exe
  2⤵
  PID:3188
- C:\Windows\System\omfgSDa.exe
  C:\Windows\System\omfgSDa.exe
  2⤵
  PID:4780
- C:\Windows\System\jMsOdZp.exe
  C:\Windows\System\jMsOdZp.exe
  2⤵
  PID:4840
- C:\Windows\System\hQgrzsk.exe
  C:\Windows\System\hQgrzsk.exe
  2⤵
  PID:400
- C:\Windows\System\YpIGeSl.exe
  C:\Windows\System\YpIGeSl.exe
  2⤵
  PID:1920
- C:\Windows\System\HYhPQuK.exe
  C:\Windows\System\HYhPQuK.exe
  2⤵
  PID:3008
- C:\Windows\System\uHEbSOL.exe
  C:\Windows\System\uHEbSOL.exe
  2⤵
  PID:2300
- C:\Windows\System\jyqqhoG.exe
  C:\Windows\System\jyqqhoG.exe
  2⤵
  PID:1020
- C:\Windows\System\sRtmGib.exe
  C:\Windows\System\sRtmGib.exe
  2⤵
  PID:948
- C:\Windows\System\pVdZcVQ.exe
  C:\Windows\System\pVdZcVQ.exe
  2⤵
  PID:2168
- C:\Windows\System\wnmwkvw.exe
  C:\Windows\System\wnmwkvw.exe
  2⤵
  PID:3432
- C:\Windows\System\NqapZcp.exe
  C:\Windows\System\NqapZcp.exe
  2⤵
  PID:4704
- C:\Windows\System\WwgqTNL.exe
  C:\Windows\System\WwgqTNL.exe
  2⤵
  PID:3840
- C:\Windows\System\CwWhQFo.exe
  C:\Windows\System\CwWhQFo.exe
  2⤵
  PID:4892
- C:\Windows\System\ASUMWEb.exe
  C:\Windows\System\ASUMWEb.exe
  2⤵
  PID:4012
- C:\Windows\System\ZtYwtNB.exe
  C:\Windows\System\ZtYwtNB.exe
  2⤵
  PID:4136
- C:\Windows\System\TsYJqBv.exe
  C:\Windows\System\TsYJqBv.exe
  2⤵
  PID:5128
- C:\Windows\System\vbPcbdI.exe
  C:\Windows\System\vbPcbdI.exe
  2⤵
  PID:5148
- C:\Windows\System\oPRgSAS.exe
  C:\Windows\System\oPRgSAS.exe
  2⤵
  PID:5164
- C:\Windows\System\pORSFTP.exe
  C:\Windows\System\pORSFTP.exe
  2⤵
  PID:5188
- C:\Windows\System\GEyQvel.exe
  C:\Windows\System\GEyQvel.exe
  2⤵
  PID:5212
- C:\Windows\System\lHHtQgB.exe
  C:\Windows\System\lHHtQgB.exe
  2⤵
  PID:5236
- C:\Windows\System\ecEcZSP.exe
  C:\Windows\System\ecEcZSP.exe
  2⤵
  PID:5252
- C:\Windows\System\qHZqgAG.exe
  C:\Windows\System\qHZqgAG.exe
  2⤵
  PID:5272
- C:\Windows\System\YZsHLsP.exe
  C:\Windows\System\YZsHLsP.exe
  2⤵
  PID:5288
- C:\Windows\System\ahjhPUj.exe
  C:\Windows\System\ahjhPUj.exe
  2⤵
  PID:5312
- C:\Windows\System\xUHFokh.exe
  C:\Windows\System\xUHFokh.exe
  2⤵
  PID:5336
- C:\Windows\System\XXdkorm.exe
  C:\Windows\System\XXdkorm.exe
  2⤵
  PID:5356
- C:\Windows\System\RbPSuLr.exe
  C:\Windows\System\RbPSuLr.exe
  2⤵
  PID:5380
- C:\Windows\System\bqwboFc.exe
  C:\Windows\System\bqwboFc.exe
  2⤵
  PID:5408
- C:\Windows\System\gLkxfeg.exe
  C:\Windows\System\gLkxfeg.exe
  2⤵
  PID:5428
- C:\Windows\System\hHQUkWI.exe
  C:\Windows\System\hHQUkWI.exe
  2⤵
  PID:5448
- C:\Windows\System\bplAiCQ.exe
  C:\Windows\System\bplAiCQ.exe
  2⤵
  PID:5472
- C:\Windows\System\bItWkxV.exe
  C:\Windows\System\bItWkxV.exe
  2⤵
  PID:5492
- C:\Windows\System\dXIBMbz.exe
  C:\Windows\System\dXIBMbz.exe
  2⤵
  PID:5536
- C:\Windows\System\yULoVam.exe
  C:\Windows\System\yULoVam.exe
  2⤵
  PID:5560
- C:\Windows\System\vvjyfrg.exe
  C:\Windows\System\vvjyfrg.exe
  2⤵
  PID:5580
- C:\Windows\System\FyKcBqI.exe
  C:\Windows\System\FyKcBqI.exe
  2⤵
  PID:5604
- C:\Windows\System\emDRKNo.exe
  C:\Windows\System\emDRKNo.exe
  2⤵
  PID:5620
- C:\Windows\System\TaqrLQd.exe
  C:\Windows\System\TaqrLQd.exe
  2⤵
  PID:5656
- C:\Windows\System\pILtPyq.exe
  C:\Windows\System\pILtPyq.exe
  2⤵
  PID:5680
- C:\Windows\System\OszrEiz.exe
  C:\Windows\System\OszrEiz.exe
  2⤵
  PID:5696
- C:\Windows\System\LisIHXz.exe
  C:\Windows\System\LisIHXz.exe
  2⤵
  PID:5724
- C:\Windows\System\DdwJPBo.exe
  C:\Windows\System\DdwJPBo.exe
  2⤵
  PID:5748
- C:\Windows\System\FNEAFyp.exe
  C:\Windows\System\FNEAFyp.exe
  2⤵
  PID:5764
- C:\Windows\System\lVqVXXY.exe
  C:\Windows\System\lVqVXXY.exe
  2⤵
  PID:5788
- C:\Windows\System\pzBWaSA.exe
  C:\Windows\System\pzBWaSA.exe
  2⤵
  PID:5808
- C:\Windows\System\dTrAJoO.exe
  C:\Windows\System\dTrAJoO.exe
  2⤵
  PID:5828
- C:\Windows\System\lkaWPbz.exe
  C:\Windows\System\lkaWPbz.exe
  2⤵
  PID:5856
- C:\Windows\System\iOgSeyW.exe
  C:\Windows\System\iOgSeyW.exe
  2⤵
  PID:5872
- C:\Windows\System\JXcCNcR.exe
  C:\Windows\System\JXcCNcR.exe
  2⤵
  PID:5896
- C:\Windows\System\VAMSdCD.exe
  C:\Windows\System\VAMSdCD.exe
  2⤵
  PID:5916
- C:\Windows\System\YDCUprn.exe
  C:\Windows\System\YDCUprn.exe
  2⤵
  PID:5936
- C:\Windows\System\ijVNWCl.exe
  C:\Windows\System\ijVNWCl.exe
  2⤵
  PID:5952
- C:\Windows\System\KmYAvea.exe
  C:\Windows\System\KmYAvea.exe
  2⤵
  PID:5980
- C:\Windows\System\WzkJlwd.exe
  C:\Windows\System\WzkJlwd.exe
  2⤵
  PID:5996
- C:\Windows\System\GpFroPG.exe
  C:\Windows\System\GpFroPG.exe
  2⤵
  PID:6020
- C:\Windows\System\QLaGbhF.exe
  C:\Windows\System\QLaGbhF.exe
  2⤵
  PID:6040
- C:\Windows\System\EcrqFpw.exe
  C:\Windows\System\EcrqFpw.exe
  2⤵
  PID:6060
- C:\Windows\System\KtvYbiJ.exe
  C:\Windows\System\KtvYbiJ.exe
  2⤵
  PID:6088
- C:\Windows\System\hinYxbX.exe
  C:\Windows\System\hinYxbX.exe
  2⤵
  PID:6124
- C:\Windows\System\lEjyKNn.exe
  C:\Windows\System\lEjyKNn.exe
  2⤵
  PID:6140
- C:\Windows\System\avfanoP.exe
  C:\Windows\System\avfanoP.exe
  2⤵
  PID:4484
- C:\Windows\System\SQvhwKR.exe
  C:\Windows\System\SQvhwKR.exe
  2⤵
  PID:4572
- C:\Windows\System\ONmBoCM.exe
  C:\Windows\System\ONmBoCM.exe
  2⤵
  PID:724
- C:\Windows\System\muuwWbl.exe
  C:\Windows\System\muuwWbl.exe
  2⤵
  PID:3352
- C:\Windows\System\KKhRVuJ.exe
  C:\Windows\System\KKhRVuJ.exe
  2⤵
  PID:3824
- C:\Windows\System\aujIVWw.exe
  C:\Windows\System\aujIVWw.exe
  2⤵
  PID:2896
- C:\Windows\System\knVvPQi.exe
  C:\Windows\System\knVvPQi.exe
  2⤵
  PID:3256
- C:\Windows\System\rBBWTmv.exe
  C:\Windows\System\rBBWTmv.exe
  2⤵
  PID:2784
- C:\Windows\System\Aeqwxlw.exe
  C:\Windows\System\Aeqwxlw.exe
  2⤵
  PID:540
- C:\Windows\System\jjdyIMy.exe
  C:\Windows\System\jjdyIMy.exe
  2⤵
  PID:5104
- C:\Windows\System\iuvLdlW.exe
  C:\Windows\System\iuvLdlW.exe
  2⤵
  PID:4080
- C:\Windows\System\GLTpryy.exe
  C:\Windows\System\GLTpryy.exe
  2⤵
  PID:5392
- C:\Windows\System\gjycOrF.exe
  C:\Windows\System\gjycOrF.exe
  2⤵
  PID:3552
- C:\Windows\System\dyeKoiQ.exe
  C:\Windows\System\dyeKoiQ.exe
  2⤵
  PID:2612
- C:\Windows\System\zXsUBCP.exe
  C:\Windows\System\zXsUBCP.exe
  2⤵
  PID:2700
- C:\Windows\System\yTyWeof.exe
  C:\Windows\System\yTyWeof.exe
  2⤵
  PID:5672
- C:\Windows\System\jURqsTd.exe
  C:\Windows\System\jURqsTd.exe
  2⤵
  PID:6160
- C:\Windows\System\rQuYCKZ.exe
  C:\Windows\System\rQuYCKZ.exe
  2⤵
  PID:6224
- C:\Windows\System\wMrMomV.exe
  C:\Windows\System\wMrMomV.exe
  2⤵
  PID:6244
- C:\Windows\System\JjxAqFs.exe
  C:\Windows\System\JjxAqFs.exe
  2⤵
  PID:6284
- C:\Windows\System\csWGfAW.exe
  C:\Windows\System\csWGfAW.exe
  2⤵
  PID:6300
- C:\Windows\System\frPrZot.exe
  C:\Windows\System\frPrZot.exe
  2⤵
  PID:6324
- C:\Windows\System\JSRNuBO.exe
  C:\Windows\System\JSRNuBO.exe
  2⤵
  PID:6340
- C:\Windows\System\ZwsFwkN.exe
  C:\Windows\System\ZwsFwkN.exe
  2⤵
  PID:6360
- C:\Windows\System\wvVwPsh.exe
  C:\Windows\System\wvVwPsh.exe
  2⤵
  PID:6388
- C:\Windows\System\ZKMqAst.exe
  C:\Windows\System\ZKMqAst.exe
  2⤵
  PID:6408
- C:\Windows\System\WpIJFPT.exe
  C:\Windows\System\WpIJFPT.exe
  2⤵
  PID:6428
- C:\Windows\System\jRmJQbB.exe
  C:\Windows\System\jRmJQbB.exe
  2⤵
  PID:6448
- C:\Windows\System\qFmscfI.exe
  C:\Windows\System\qFmscfI.exe
  2⤵
  PID:6472
- C:\Windows\System\IkZfSeO.exe
  C:\Windows\System\IkZfSeO.exe
  2⤵
  PID:6488
- C:\Windows\System\mWRpKlA.exe
  C:\Windows\System\mWRpKlA.exe
  2⤵
  PID:6508
- C:\Windows\System\oPUDfzd.exe
  C:\Windows\System\oPUDfzd.exe
  2⤵
  PID:6528
- C:\Windows\System\ysLCTQS.exe
  C:\Windows\System\ysLCTQS.exe
  2⤵
  PID:6556
- C:\Windows\System\SGnBqsc.exe
  C:\Windows\System\SGnBqsc.exe
  2⤵
  PID:6572
- C:\Windows\System\ANYsEHo.exe
  C:\Windows\System\ANYsEHo.exe
  2⤵
  PID:6600
- C:\Windows\System\bcrQkGT.exe
  C:\Windows\System\bcrQkGT.exe
  2⤵
  PID:6620
- C:\Windows\System\hAjVjRX.exe
  C:\Windows\System\hAjVjRX.exe
  2⤵
  PID:6644
- C:\Windows\System\qSdsboa.exe
  C:\Windows\System\qSdsboa.exe
  2⤵
  PID:6672
- C:\Windows\System\WSonAYy.exe
  C:\Windows\System\WSonAYy.exe
  2⤵
  PID:6688
- C:\Windows\System\BVCPhEi.exe
  C:\Windows\System\BVCPhEi.exe
  2⤵
  PID:6712
- C:\Windows\System\jWggcpe.exe
  C:\Windows\System\jWggcpe.exe
  2⤵
  PID:6728
- C:\Windows\System\dVchRZc.exe
  C:\Windows\System\dVchRZc.exe
  2⤵
  PID:6748
- C:\Windows\System\NNYJuKt.exe
  C:\Windows\System\NNYJuKt.exe
  2⤵
  PID:6764
- C:\Windows\System\wtuYhqf.exe
  C:\Windows\System\wtuYhqf.exe
  2⤵
  PID:6784
- C:\Windows\System\PTUdFit.exe
  C:\Windows\System\PTUdFit.exe
  2⤵
  PID:6808
- C:\Windows\System\ffugDbN.exe
  C:\Windows\System\ffugDbN.exe
  2⤵
  PID:6824
- C:\Windows\System\fvqoyHx.exe
  C:\Windows\System\fvqoyHx.exe
  2⤵
  PID:6852
- C:\Windows\System\rXYDMyp.exe
  C:\Windows\System\rXYDMyp.exe
  2⤵
  PID:6868
- C:\Windows\System\ckjZesY.exe
  C:\Windows\System\ckjZesY.exe
  2⤵
  PID:6888
- C:\Windows\System\fchoibr.exe
  C:\Windows\System\fchoibr.exe
  2⤵
  PID:6912
- C:\Windows\System\WujCrLz.exe
  C:\Windows\System\WujCrLz.exe
  2⤵
  PID:6928
- C:\Windows\System\rKVJJTe.exe
  C:\Windows\System\rKVJJTe.exe
  2⤵
  PID:6952
- C:\Windows\System\HLfaIBv.exe
  C:\Windows\System\HLfaIBv.exe
  2⤵
  PID:6980
- C:\Windows\System\ZuNqNwV.exe
  C:\Windows\System\ZuNqNwV.exe
  2⤵
  PID:7012
- C:\Windows\System\eytpQzp.exe
  C:\Windows\System\eytpQzp.exe
  2⤵
  PID:7028
- C:\Windows\System\NdmtLVj.exe
  C:\Windows\System\NdmtLVj.exe
  2⤵
  PID:7052
- C:\Windows\System\qdXgcJo.exe
  C:\Windows\System\qdXgcJo.exe
  2⤵
  PID:7068
- C:\Windows\System\qtCPrkn.exe
  C:\Windows\System\qtCPrkn.exe
  2⤵
  PID:7092
- C:\Windows\System\LVcoajq.exe
  C:\Windows\System\LVcoajq.exe
  2⤵
  PID:7108
- C:\Windows\System\dNzXRoR.exe
  C:\Windows\System\dNzXRoR.exe
  2⤵
  PID:7132
- C:\Windows\System\RDzxqiY.exe
  C:\Windows\System\RDzxqiY.exe
  2⤵
  PID:7164
- C:\Windows\System\fMAwrAz.exe
  C:\Windows\System\fMAwrAz.exe
  2⤵
  PID:3440
- C:\Windows\System\vEqyHxX.exe
  C:\Windows\System\vEqyHxX.exe
  2⤵
  PID:2312
- C:\Windows\System\sAtgPMg.exe
  C:\Windows\System\sAtgPMg.exe
  2⤵
  PID:2448
- C:\Windows\System\UuvwgFH.exe
  C:\Windows\System\UuvwgFH.exe
  2⤵
  PID:684
- C:\Windows\System\HsOKSGy.exe
  C:\Windows\System\HsOKSGy.exe
  2⤵
  PID:4428
- C:\Windows\System\JryeoaG.exe
  C:\Windows\System\JryeoaG.exe
  2⤵
  PID:3252
- C:\Windows\System\ivsOeio.exe
  C:\Windows\System\ivsOeio.exe
  2⤵
  PID:5180
- C:\Windows\System\rjWnqUk.exe
  C:\Windows\System\rjWnqUk.exe
  2⤵
  PID:5204
- C:\Windows\System\pgkzmSs.exe
  C:\Windows\System\pgkzmSs.exe
  2⤵
  PID:440
- C:\Windows\System\ngnXavR.exe
  C:\Windows\System\ngnXavR.exe
  2⤵
  PID:3356
- C:\Windows\System\PeNZMHm.exe
  C:\Windows\System\PeNZMHm.exe
  2⤵
  PID:5324
- C:\Windows\System\nqKCCxd.exe
  C:\Windows\System\nqKCCxd.exe
  2⤵
  PID:5264
- C:\Windows\System\rCFKlEA.exe
  C:\Windows\System\rCFKlEA.exe
  2⤵
  PID:5404
- C:\Windows\System\obGKoGt.exe
  C:\Windows\System\obGKoGt.exe
  2⤵
  PID:5572
- C:\Windows\System\pqnoyxB.exe
  C:\Windows\System\pqnoyxB.exe
  2⤵
  PID:5596
- C:\Windows\System\EhmNpxM.exe
  C:\Windows\System\EhmNpxM.exe
  2⤵
  PID:5648
- C:\Windows\System\NrASmTP.exe
  C:\Windows\System\NrASmTP.exe
  2⤵
  PID:5308
- C:\Windows\System\joIJzEC.exe
  C:\Windows\System\joIJzEC.exe
  2⤵
  PID:5732
- C:\Windows\System\ZIvOesb.exe
  C:\Windows\System\ZIvOesb.exe
  2⤵
  PID:5800
- C:\Windows\System\aLwVOBj.exe
  C:\Windows\System\aLwVOBj.exe
  2⤵
  PID:5888
- C:\Windows\System\wCUkrYX.exe
  C:\Windows\System\wCUkrYX.exe
  2⤵
  PID:5924
- C:\Windows\System\ZUtxRhn.exe
  C:\Windows\System\ZUtxRhn.exe
  2⤵
  PID:6008
- C:\Windows\System\MDyuNcf.exe
  C:\Windows\System\MDyuNcf.exe
  2⤵
  PID:6048
- C:\Windows\System\TLTAcwr.exe
  C:\Windows\System\TLTAcwr.exe
  2⤵
  PID:6096
- C:\Windows\System\OwrqxoG.exe
  C:\Windows\System\OwrqxoG.exe
  2⤵
  PID:6136
- C:\Windows\System\uaHTxjF.exe
  C:\Windows\System\uaHTxjF.exe
  2⤵
  PID:4820
- C:\Windows\System\DEVRCIH.exe
  C:\Windows\System\DEVRCIH.exe
  2⤵
  PID:548
- C:\Windows\System\MKfzHIL.exe
  C:\Windows\System\MKfzHIL.exe
  2⤵
  PID:3232
- C:\Windows\System\WoQiwMN.exe
  C:\Windows\System\WoQiwMN.exe
  2⤵
  PID:2748
- C:\Windows\System\lJmQLsL.exe
  C:\Windows\System\lJmQLsL.exe
  2⤵
  PID:1648
- C:\Windows\System\VmcLEhY.exe
  C:\Windows\System\VmcLEhY.exe
  2⤵
  PID:6212
- C:\Windows\System\rBBbuqt.exe
  C:\Windows\System\rBBbuqt.exe
  2⤵
  PID:6348
- C:\Windows\System\BdPsQbz.exe
  C:\Windows\System\BdPsQbz.exe
  2⤵
  PID:6652
- C:\Windows\System\KQvtvgo.exe
  C:\Windows\System\KQvtvgo.exe
  2⤵
  PID:6876
- C:\Windows\System\VfRobCI.exe
  C:\Windows\System\VfRobCI.exe
  2⤵
  PID:7036
- C:\Windows\System\FtIRGUH.exe
  C:\Windows\System\FtIRGUH.exe
  2⤵
  PID:6272
- C:\Windows\System\zHLVcGN.exe
  C:\Windows\System\zHLVcGN.exe
  2⤵
  PID:6440
- C:\Windows\System\jKRLwPg.exe
  C:\Windows\System\jKRLwPg.exe
  2⤵
  PID:6544
- C:\Windows\System\tCEZXjq.exe
  C:\Windows\System\tCEZXjq.exe
  2⤵
  PID:6660
- C:\Windows\System\gcGNrrt.exe
  C:\Windows\System\gcGNrrt.exe
  2⤵
  PID:6724
- C:\Windows\System\HJthDCD.exe
  C:\Windows\System\HJthDCD.exe
  2⤵
  PID:7176
- C:\Windows\System\FwGnXJT.exe
  C:\Windows\System\FwGnXJT.exe
  2⤵
  PID:7196
- C:\Windows\System\orOdOfu.exe
  C:\Windows\System\orOdOfu.exe
  2⤵
  PID:7212
- C:\Windows\System\dqnNdLz.exe
  C:\Windows\System\dqnNdLz.exe
  2⤵
  PID:7232
- C:\Windows\System\SMVvkiC.exe
  C:\Windows\System\SMVvkiC.exe
  2⤵
  PID:7256
- C:\Windows\System\XryWUlY.exe
  C:\Windows\System\XryWUlY.exe
  2⤵
  PID:7276
- C:\Windows\System\vKLzFwY.exe
  C:\Windows\System\vKLzFwY.exe
  2⤵
  PID:7292
- C:\Windows\System\raFhxyK.exe
  C:\Windows\System\raFhxyK.exe
  2⤵
  PID:7316
- C:\Windows\System\kytcXvK.exe
  C:\Windows\System\kytcXvK.exe
  2⤵
  PID:7336
- C:\Windows\System\hUwzfpr.exe
  C:\Windows\System\hUwzfpr.exe
  2⤵
  PID:7352
- C:\Windows\System\DUzSmPt.exe
  C:\Windows\System\DUzSmPt.exe
  2⤵
  PID:7372
- C:\Windows\System\wdohMJU.exe
  C:\Windows\System\wdohMJU.exe
  2⤵
  PID:7388
- C:\Windows\System\krfTMQK.exe
  C:\Windows\System\krfTMQK.exe
  2⤵
  PID:7412
- C:\Windows\System\RZlghiQ.exe
  C:\Windows\System\RZlghiQ.exe
  2⤵
  PID:7824
- C:\Windows\System\JCMenLJ.exe
  C:\Windows\System\JCMenLJ.exe
  2⤵
  PID:7848
- C:\Windows\System\YCuNcuM.exe
  C:\Windows\System\YCuNcuM.exe
  2⤵
  PID:7864
- C:\Windows\System\PfIooRW.exe
  C:\Windows\System\PfIooRW.exe
  2⤵
  PID:7888
- C:\Windows\System\fbgKMlF.exe
  C:\Windows\System\fbgKMlF.exe
  2⤵
  PID:7908
- C:\Windows\System\jCnsSkC.exe
  C:\Windows\System\jCnsSkC.exe
  2⤵
  PID:7928
- C:\Windows\System\tMVVgyT.exe
  C:\Windows\System\tMVVgyT.exe
  2⤵
  PID:7952
- C:\Windows\System\FyrBbMX.exe
  C:\Windows\System\FyrBbMX.exe
  2⤵
  PID:7976
- C:\Windows\System\QqNSvKC.exe
  C:\Windows\System\QqNSvKC.exe
  2⤵
  PID:8000
- C:\Windows\System\PcCdDRu.exe
  C:\Windows\System\PcCdDRu.exe
  2⤵
  PID:8016
- C:\Windows\System\pwWotUG.exe
  C:\Windows\System\pwWotUG.exe
  2⤵
  PID:8040
- C:\Windows\System\urnGWsy.exe
  C:\Windows\System\urnGWsy.exe
  2⤵
  PID:8064
- C:\Windows\System\FRWrDQq.exe
  C:\Windows\System\FRWrDQq.exe
  2⤵
  PID:8084
- C:\Windows\System\nEEuenO.exe
  C:\Windows\System\nEEuenO.exe
  2⤵
  PID:8100
- C:\Windows\System\UVFkdJX.exe
  C:\Windows\System\UVFkdJX.exe
  2⤵
  PID:8124
- C:\Windows\System\ffxuVHl.exe
  C:\Windows\System\ffxuVHl.exe
  2⤵
  PID:8140
- C:\Windows\System\EyAZeps.exe
  C:\Windows\System\EyAZeps.exe
  2⤵
  PID:8164
- C:\Windows\System\edEpJAz.exe
  C:\Windows\System\edEpJAz.exe
  2⤵
  PID:6804
- C:\Windows\System\YGvdxqN.exe
  C:\Windows\System\YGvdxqN.exe
  2⤵
  PID:7048
- C:\Windows\System\NbkzCAJ.exe
  C:\Windows\System\NbkzCAJ.exe
  2⤵
  PID:5232
- C:\Windows\System\lblfxSb.exe
  C:\Windows\System\lblfxSb.exe
  2⤵
  PID:6684
- C:\Windows\System\BwlTGsf.exe
  C:\Windows\System\BwlTGsf.exe
  2⤵
  PID:6836
- C:\Windows\System\jKINvNe.exe
  C:\Windows\System\jKINvNe.exe
  2⤵
  PID:6924
- C:\Windows\System\GzxCjuR.exe
  C:\Windows\System\GzxCjuR.exe
  2⤵
  PID:6988
- C:\Windows\System\cxkSGbA.exe
  C:\Windows\System\cxkSGbA.exe
  2⤵
  PID:7424
- C:\Windows\System\hNRTnrX.exe
  C:\Windows\System\hNRTnrX.exe
  2⤵
  PID:5688
- C:\Windows\System\fOvBFzy.exe
  C:\Windows\System\fOvBFzy.exe
  2⤵
  PID:5904
- C:\Windows\System\jodrvyp.exe
  C:\Windows\System\jodrvyp.exe
  2⤵
  PID:6012
- C:\Windows\System\SgAabCH.exe
  C:\Windows\System\SgAabCH.exe
  2⤵
  PID:6316
- C:\Windows\System\EokiXRK.exe
  C:\Windows\System\EokiXRK.exe
  2⤵
  PID:6356
- C:\Windows\System\XeWaWxV.exe
  C:\Windows\System\XeWaWxV.exe
  2⤵
  PID:2860
- C:\Windows\System\BnHLKjs.exe
  C:\Windows\System\BnHLKjs.exe
  2⤵
  PID:6252
- C:\Windows\System\cGUXkmZ.exe
  C:\Windows\System\cGUXkmZ.exe
  2⤵
  PID:6632
- C:\Windows\System\BgsefVD.exe
  C:\Windows\System\BgsefVD.exe
  2⤵
  PID:8216
- C:\Windows\System\OBkCjmi.exe
  C:\Windows\System\OBkCjmi.exe
  2⤵
  PID:8232
- C:\Windows\System\mnpnoGA.exe
  C:\Windows\System\mnpnoGA.exe
  2⤵
  PID:8256
- C:\Windows\System\HNasyDu.exe
  C:\Windows\System\HNasyDu.exe
  2⤵
  PID:8280
- C:\Windows\System\ozOcReb.exe
  C:\Windows\System\ozOcReb.exe
  2⤵
  PID:8296
- C:\Windows\System\sJYraDu.exe
  C:\Windows\System\sJYraDu.exe
  2⤵
  PID:8320
- C:\Windows\System\DYAJWMk.exe
  C:\Windows\System\DYAJWMk.exe
  2⤵
  PID:8340
- C:\Windows\System\RSaRPUz.exe
  C:\Windows\System\RSaRPUz.exe
  2⤵
  PID:8360
- C:\Windows\System\wsAajyz.exe
  C:\Windows\System\wsAajyz.exe
  2⤵
  PID:8376
- C:\Windows\System\jMxSVes.exe
  C:\Windows\System\jMxSVes.exe
  2⤵
  PID:8396
- C:\Windows\System\MaHSxDA.exe
  C:\Windows\System\MaHSxDA.exe
  2⤵
  PID:8432
- C:\Windows\System\FJxcJrp.exe
  C:\Windows\System\FJxcJrp.exe
  2⤵
  PID:8464
- C:\Windows\System\BGOrMmF.exe
  C:\Windows\System\BGOrMmF.exe
  2⤵
  PID:8504
- C:\Windows\System\ViDZgMG.exe
  C:\Windows\System\ViDZgMG.exe
  2⤵
  PID:8520
- C:\Windows\System\ugaZsJh.exe
  C:\Windows\System\ugaZsJh.exe
  2⤵
  PID:8548
- C:\Windows\System\PUcLgZI.exe
  C:\Windows\System\PUcLgZI.exe
  2⤵
  PID:8600
- C:\Windows\System\cIznaOl.exe
  C:\Windows\System\cIznaOl.exe
  2⤵
  PID:8648
- C:\Windows\System\jvmVMNF.exe
  C:\Windows\System\jvmVMNF.exe
  2⤵
  PID:8704
- C:\Windows\System\aooYqin.exe
  C:\Windows\System\aooYqin.exe
  2⤵
  PID:8720
- C:\Windows\System\vNUTbqi.exe
  C:\Windows\System\vNUTbqi.exe
  2⤵
  PID:8736
- C:\Windows\System\anOjAmA.exe
  C:\Windows\System\anOjAmA.exe
  2⤵
  PID:8752
- C:\Windows\System\jLAnJoA.exe
  C:\Windows\System\jLAnJoA.exe
  2⤵
  PID:8772
- C:\Windows\System\LZrAdUR.exe
  C:\Windows\System\LZrAdUR.exe
  2⤵
  PID:8792
- C:\Windows\System\VJTKJjX.exe
  C:\Windows\System\VJTKJjX.exe
  2⤵
  PID:8808
- C:\Windows\System\ngWQcFI.exe
  C:\Windows\System\ngWQcFI.exe
  2⤵
  PID:8844
- C:\Windows\System\xdtwZuw.exe
  C:\Windows\System\xdtwZuw.exe
  2⤵
  PID:8872
- C:\Windows\System\iCfymlO.exe
  C:\Windows\System\iCfymlO.exe
  2⤵
  PID:8888
- C:\Windows\System\KnWeBXn.exe
  C:\Windows\System\KnWeBXn.exe
  2⤵
  PID:8908
- C:\Windows\System\DfuXdbP.exe
  C:\Windows\System\DfuXdbP.exe
  2⤵
  PID:8932
- C:\Windows\System\uiCfahQ.exe
  C:\Windows\System\uiCfahQ.exe
  2⤵
  PID:8956
- C:\Windows\System\YFaaPJg.exe
  C:\Windows\System\YFaaPJg.exe
  2⤵
  PID:8980
- C:\Windows\System\ARaTLPM.exe
  C:\Windows\System\ARaTLPM.exe
  2⤵
  PID:8996
- C:\Windows\System\QTNFUql.exe
  C:\Windows\System\QTNFUql.exe
  2⤵
  PID:9016
- C:\Windows\System\MzFxVwG.exe
  C:\Windows\System\MzFxVwG.exe
  2⤵
  PID:9036
- C:\Windows\System\SeFPPRw.exe
  C:\Windows\System\SeFPPRw.exe
  2⤵
  PID:9056
- C:\Windows\System\XQjvyKv.exe
  C:\Windows\System\XQjvyKv.exe
  2⤵
  PID:9076
- C:\Windows\System\zSMDJDD.exe
  C:\Windows\System\zSMDJDD.exe
  2⤵
  PID:9100
- C:\Windows\System\wMksHvZ.exe
  C:\Windows\System\wMksHvZ.exe
  2⤵
  PID:9116
- C:\Windows\System\kqFiHBx.exe
  C:\Windows\System\kqFiHBx.exe
  2⤵
  PID:9132
- C:\Windows\System\jHgaXLi.exe
  C:\Windows\System\jHgaXLi.exe
  2⤵
  PID:9152
- C:\Windows\System\TEzJsRS.exe
  C:\Windows\System\TEzJsRS.exe
  2⤵
  PID:9168
- C:\Windows\System\UgKmsai.exe
  C:\Windows\System\UgKmsai.exe
  2⤵
  PID:9188
- C:\Windows\System\VfcZVjN.exe
  C:\Windows\System\VfcZVjN.exe
  2⤵
  PID:9212
- C:\Windows\System\VtnkvUK.exe
  C:\Windows\System\VtnkvUK.exe
  2⤵
  PID:6840
- C:\Windows\System\sBDgpzy.exe
  C:\Windows\System\sBDgpzy.exe
  2⤵
  PID:7548
- C:\Windows\System\kJxBsIn.exe
  C:\Windows\System\kJxBsIn.exe
  2⤵
  PID:7672
- C:\Windows\System\xhtKKEu.exe
  C:\Windows\System\xhtKKEu.exe
  2⤵
  PID:7820
- C:\Windows\System\FyoyjTT.exe
  C:\Windows\System\FyoyjTT.exe
  2⤵
  PID:6056
- C:\Windows\System\nzVinZe.exe
  C:\Windows\System\nzVinZe.exe
  2⤵
  PID:5716
- C:\Windows\System\UQJCcFo.exe
  C:\Windows\System\UQJCcFo.exe
  2⤵
  PID:5284
- C:\Windows\System\SftVpyG.exe
  C:\Windows\System\SftVpyG.exe
  2⤵
  PID:5116
- C:\Windows\System\aZHrWen.exe
  C:\Windows\System\aZHrWen.exe
  2⤵
  PID:2840
- C:\Windows\System\zSRpxmC.exe
  C:\Windows\System\zSRpxmC.exe
  2⤵
  PID:4844
- C:\Windows\System\RzsfHrU.exe
  C:\Windows\System\RzsfHrU.exe
  2⤵
  PID:5200
- C:\Windows\System\wcgRScP.exe
  C:\Windows\System\wcgRScP.exe
  2⤵
  PID:7972
- C:\Windows\System\xEQVHdn.exe
  C:\Windows\System\xEQVHdn.exe
  2⤵
  PID:8080
- C:\Windows\System\alOYcIq.exe
  C:\Windows\System\alOYcIq.exe
  2⤵
  PID:8136
- C:\Windows\System\dmYQSBF.exe
  C:\Windows\System\dmYQSBF.exe
  2⤵
  PID:8176
- C:\Windows\System\yCfuDER.exe
  C:\Windows\System\yCfuDER.exe
  2⤵
  PID:5552
- C:\Windows\System\kiQzctn.exe
  C:\Windows\System\kiQzctn.exe
  2⤵
  PID:5720
- C:\Windows\System\diFOUCn.exe
  C:\Windows\System\diFOUCn.exe
  2⤵
  PID:6084
- C:\Windows\System\VCyxVNL.exe
  C:\Windows\System\VCyxVNL.exe
  2⤵
  PID:7348
- C:\Windows\System\NqVeVaf.exe
  C:\Windows\System\NqVeVaf.exe
  2⤵
  PID:5100
- C:\Windows\System\AnawfXM.exe
  C:\Windows\System\AnawfXM.exe
  2⤵
  PID:5988
- C:\Windows\System\vtcfDeL.exe
  C:\Windows\System\vtcfDeL.exe
  2⤵
  PID:6480
- C:\Windows\System\vOOzDss.exe
  C:\Windows\System\vOOzDss.exe
  2⤵
  PID:7116
- C:\Windows\System\XtpROLq.exe
  C:\Windows\System\XtpROLq.exe
  2⤵
  PID:7188
- C:\Windows\System\nzpUMbN.exe
  C:\Windows\System\nzpUMbN.exe
  2⤵
  PID:7244
- C:\Windows\System\RkrimsS.exe
  C:\Windows\System\RkrimsS.exe
  2⤵
  PID:9228
- C:\Windows\System\ieaclZM.exe
  C:\Windows\System\ieaclZM.exe
  2⤵
  PID:9248
- C:\Windows\System\LnzBqJF.exe
  C:\Windows\System\LnzBqJF.exe
  2⤵
  PID:9264
- C:\Windows\System\ewFgHib.exe
  C:\Windows\System\ewFgHib.exe
  2⤵
  PID:9280
- C:\Windows\System\wCmGCpp.exe
  C:\Windows\System\wCmGCpp.exe
  2⤵
  PID:9300
- C:\Windows\System\xtFBCLl.exe
  C:\Windows\System\xtFBCLl.exe
  2⤵
  PID:9324
- C:\Windows\System\BgZrVtx.exe
  C:\Windows\System\BgZrVtx.exe
  2⤵
  PID:9344
- C:\Windows\System\bUTXsPx.exe
  C:\Windows\System\bUTXsPx.exe
  2⤵
  PID:9368
- C:\Windows\System\oLLfGSZ.exe
  C:\Windows\System\oLLfGSZ.exe
  2⤵
  PID:9388
- C:\Windows\System\WEEnFtU.exe
  C:\Windows\System\WEEnFtU.exe
  2⤵
  PID:9408
- C:\Windows\System\tzGZdgQ.exe
  C:\Windows\System\tzGZdgQ.exe
  2⤵
  PID:9424
- C:\Windows\System\UqlAraN.exe
  C:\Windows\System\UqlAraN.exe
  2⤵
  PID:9444
- C:\Windows\System\AaAXjwI.exe
  C:\Windows\System\AaAXjwI.exe
  2⤵
  PID:9464
- C:\Windows\System\ktdoSMz.exe
  C:\Windows\System\ktdoSMz.exe
  2⤵
  PID:9484
- C:\Windows\System\dsRRdgE.exe
  C:\Windows\System\dsRRdgE.exe
  2⤵
  PID:9504
- C:\Windows\System\TAmOUVW.exe
  C:\Windows\System\TAmOUVW.exe
  2⤵
  PID:9528
- C:\Windows\System\wWetAPo.exe
  C:\Windows\System\wWetAPo.exe
  2⤵
  PID:9548
- C:\Windows\System\jwbDsHm.exe
  C:\Windows\System\jwbDsHm.exe
  2⤵
  PID:9568
- C:\Windows\System\OEJNOOf.exe
  C:\Windows\System\OEJNOOf.exe
  2⤵
  PID:9592
- C:\Windows\System\sUGryHe.exe
  C:\Windows\System\sUGryHe.exe
  2⤵
  PID:9616
- C:\Windows\System\waESSZB.exe
  C:\Windows\System\waESSZB.exe
  2⤵
  PID:9636
- C:\Windows\System\HCiAizV.exe
  C:\Windows\System\HCiAizV.exe
  2⤵
  PID:9656
- C:\Windows\System\aSOOviI.exe
  C:\Windows\System\aSOOviI.exe
  2⤵
  PID:9680
- C:\Windows\System\SJQxFKJ.exe
  C:\Windows\System\SJQxFKJ.exe
  2⤵
  PID:9704
- C:\Windows\System\CRRVlVj.exe
  C:\Windows\System\CRRVlVj.exe
  2⤵
  PID:9724
- C:\Windows\System\QdvnLUY.exe
  C:\Windows\System\QdvnLUY.exe
  2⤵
  PID:9744
- C:\Windows\System\vysFgWc.exe
  C:\Windows\System\vysFgWc.exe
  2⤵
  PID:9768
- C:\Windows\System\kpFMniI.exe
  C:\Windows\System\kpFMniI.exe
  2⤵
  PID:9784
- C:\Windows\System\kJlVgse.exe
  C:\Windows\System\kJlVgse.exe
  2⤵
  PID:9800
- C:\Windows\System\HHhoMOX.exe
  C:\Windows\System\HHhoMOX.exe
  2⤵
  PID:9824
- C:\Windows\System\tRIIEPe.exe
  C:\Windows\System\tRIIEPe.exe
  2⤵
  PID:9844
- C:\Windows\System\PyWHgxn.exe
  C:\Windows\System\PyWHgxn.exe
  2⤵
  PID:9872
- C:\Windows\System\TUOyKkX.exe
  C:\Windows\System\TUOyKkX.exe
  2⤵
  PID:9888
- C:\Windows\System\QRSwtCH.exe
  C:\Windows\System\QRSwtCH.exe
  2⤵
  PID:9904
- C:\Windows\System\RATHVKV.exe
  C:\Windows\System\RATHVKV.exe
  2⤵
  PID:9920
- C:\Windows\System\HZtHqvC.exe
  C:\Windows\System\HZtHqvC.exe
  2⤵
  PID:9944
- C:\Windows\System\IRGOIDn.exe
  C:\Windows\System\IRGOIDn.exe
  2⤵
  PID:9960
- C:\Windows\System\OXqhZNA.exe
  C:\Windows\System\OXqhZNA.exe
  2⤵
  PID:9988
- C:\Windows\System\KvDmqlc.exe
  C:\Windows\System\KvDmqlc.exe
  2⤵
  PID:10008
- C:\Windows\System\BYvZBwh.exe
  C:\Windows\System\BYvZBwh.exe
  2⤵
  PID:10028
- C:\Windows\System\JumVqMp.exe
  C:\Windows\System\JumVqMp.exe
  2⤵
  PID:10056
- C:\Windows\System\mRPcvhr.exe
  C:\Windows\System\mRPcvhr.exe
  2⤵
  PID:10076
- C:\Windows\System\EFUmHSh.exe
  C:\Windows\System\EFUmHSh.exe
  2⤵
  PID:10092
- C:\Windows\System\uKfwHXV.exe
  C:\Windows\System\uKfwHXV.exe
  2⤵
  PID:10116
- C:\Windows\System\COVsoox.exe
  C:\Windows\System\COVsoox.exe
  2⤵
  PID:10132
- C:\Windows\System\XZWzpsB.exe
  C:\Windows\System\XZWzpsB.exe
  2⤵
  PID:10156
- C:\Windows\System\UvpcnRT.exe
  C:\Windows\System\UvpcnRT.exe
  2⤵
  PID:10176
- C:\Windows\System\yRJSPCc.exe
  C:\Windows\System\yRJSPCc.exe
  2⤵
  PID:10196
- C:\Windows\System\QaVTVEf.exe
  C:\Windows\System\QaVTVEf.exe
  2⤵
  PID:10216
- C:\Windows\System\TlmtSkF.exe
  C:\Windows\System\TlmtSkF.exe
  2⤵
  PID:10232
- C:\Windows\System\daEUOSI.exe
  C:\Windows\System\daEUOSI.exe
  2⤵
  PID:8368
- C:\Windows\System\DnmMTfK.exe
  C:\Windows\System\DnmMTfK.exe
  2⤵
  PID:8384
- C:\Windows\System\jygnYTl.exe
  C:\Windows\System\jygnYTl.exe
  2⤵
  PID:8440
- C:\Windows\System\GUoLEhP.exe
  C:\Windows\System\GUoLEhP.exe
  2⤵
  PID:7580
- C:\Windows\System\GpYmWoo.exe
  C:\Windows\System\GpYmWoo.exe
  2⤵
  PID:8528
- C:\Windows\System\Sfhwiwo.exe
  C:\Windows\System\Sfhwiwo.exe
  2⤵
  PID:7640
- C:\Windows\System\BzKVTcW.exe
  C:\Windows\System\BzKVTcW.exe
  2⤵
  PID:7720
- C:\Windows\System\IHXZIeK.exe
  C:\Windows\System\IHXZIeK.exe
  2⤵
  PID:7760
- C:\Windows\System\AAUIeuP.exe
  C:\Windows\System\AAUIeuP.exe
  2⤵
  PID:8712
- C:\Windows\System\xyGRKOW.exe
  C:\Windows\System\xyGRKOW.exe
  2⤵
  PID:8768
- C:\Windows\System\mnvijwQ.exe
  C:\Windows\System\mnvijwQ.exe
  2⤵
  PID:8804
- C:\Windows\System\YZfMsys.exe
  C:\Windows\System\YZfMsys.exe
  2⤵
  PID:8076
- C:\Windows\System\dFTNfng.exe
  C:\Windows\System\dFTNfng.exe
  2⤵
  PID:10252
- C:\Windows\System\aDshCEy.exe
  C:\Windows\System\aDshCEy.exe
  2⤵
  PID:10276
- C:\Windows\System\osAdTuL.exe
  C:\Windows\System\osAdTuL.exe
  2⤵
  PID:10296
- C:\Windows\System\lKDwDxj.exe
  C:\Windows\System\lKDwDxj.exe
  2⤵
  PID:10324
- C:\Windows\System\ikrvmfl.exe
  C:\Windows\System\ikrvmfl.exe
  2⤵
  PID:10340
- C:\Windows\System\lOtgeUo.exe
  C:\Windows\System\lOtgeUo.exe
  2⤵
  PID:10364
- C:\Windows\System\dZOtHLU.exe
  C:\Windows\System\dZOtHLU.exe
  2⤵
  PID:10396
- C:\Windows\System\vpUTDVo.exe
  C:\Windows\System\vpUTDVo.exe
  2⤵
  PID:10412
- C:\Windows\System\KntoUGi.exe
  C:\Windows\System\KntoUGi.exe
  2⤵
  PID:10444
- C:\Windows\System\QhmVJQD.exe
  C:\Windows\System\QhmVJQD.exe
  2⤵
  PID:10460
- C:\Windows\System\bHQOpvz.exe
  C:\Windows\System\bHQOpvz.exe
  2⤵
  PID:10476
- C:\Windows\System\MffXKCm.exe
  C:\Windows\System\MffXKCm.exe
  2⤵
  PID:10500
- C:\Windows\System\yMJVPgE.exe
  C:\Windows\System\yMJVPgE.exe
  2⤵
  PID:10528
- C:\Windows\System\jwtfdCp.exe
  C:\Windows\System\jwtfdCp.exe
  2⤵
  PID:10544
- C:\Windows\System\RRPMQkL.exe
  C:\Windows\System\RRPMQkL.exe
  2⤵
  PID:10560
- C:\Windows\System\ssBrdMD.exe
  C:\Windows\System\ssBrdMD.exe
  2⤵
  PID:10576
- C:\Windows\System\eNHzvNF.exe
  C:\Windows\System\eNHzvNF.exe
  2⤵
  PID:10592
- C:\Windows\System\zKQVOXh.exe
  C:\Windows\System\zKQVOXh.exe
  2⤵
  PID:10612
- C:\Windows\System\obuGwfG.exe
  C:\Windows\System\obuGwfG.exe
  2⤵
  PID:10632
- C:\Windows\System\lCcxbZb.exe
  C:\Windows\System\lCcxbZb.exe
  2⤵
  PID:10652
- C:\Windows\System\tKbyoJq.exe
  C:\Windows\System\tKbyoJq.exe
  2⤵
  PID:10676
- C:\Windows\System\hwXldpi.exe
  C:\Windows\System\hwXldpi.exe
  2⤵
  PID:10692
- C:\Windows\System\nJLlEkO.exe
  C:\Windows\System\nJLlEkO.exe
  2⤵
  PID:10712
- C:\Windows\System\LJnrJlo.exe
  C:\Windows\System\LJnrJlo.exe
  2⤵
  PID:10740
- C:\Windows\System\KLQDsuR.exe
  C:\Windows\System\KLQDsuR.exe
  2⤵
  PID:10764
- C:\Windows\System\VdKTlGe.exe
  C:\Windows\System\VdKTlGe.exe
  2⤵
  PID:10788
- C:\Windows\System\ExYynPF.exe
  C:\Windows\System\ExYynPF.exe
  2⤵
  PID:10820
- C:\Windows\System\sEqALZM.exe
  C:\Windows\System\sEqALZM.exe
  2⤵
  PID:10840
- C:\Windows\System\KBngdpt.exe
  C:\Windows\System\KBngdpt.exe
  2⤵
  PID:10872
- C:\Windows\System\aWaXDxR.exe
  C:\Windows\System\aWaXDxR.exe
  2⤵
  PID:10896
- C:\Windows\System\OjqeQgy.exe
  C:\Windows\System\OjqeQgy.exe
  2⤵
  PID:10920
- C:\Windows\System\iiRHbRe.exe
  C:\Windows\System\iiRHbRe.exe
  2⤵
  PID:10936
- C:\Windows\System\etaTJws.exe
  C:\Windows\System\etaTJws.exe
  2⤵
  PID:10960
- C:\Windows\System\aoBvDAi.exe
  C:\Windows\System\aoBvDAi.exe
  2⤵
  PID:10980
- C:\Windows\System\jpbgkVR.exe
  C:\Windows\System\jpbgkVR.exe
  2⤵
  PID:11004
- C:\Windows\System\ZOGmaMO.exe
  C:\Windows\System\ZOGmaMO.exe
  2⤵
  PID:11024
- C:\Windows\System\ylZMcss.exe
  C:\Windows\System\ylZMcss.exe
  2⤵
  PID:11052
- C:\Windows\System\UcRCVZH.exe
  C:\Windows\System\UcRCVZH.exe
  2⤵
  PID:11068
- C:\Windows\System\NqjdnVY.exe
  C:\Windows\System\NqjdnVY.exe
  2⤵
  PID:11092
- C:\Windows\System\MgFrTFY.exe
  C:\Windows\System\MgFrTFY.exe
  2⤵
  PID:11116
- C:\Windows\System\QQkhnur.exe
  C:\Windows\System\QQkhnur.exe
  2⤵
  PID:11136
- C:\Windows\System\EVbJMVW.exe
  C:\Windows\System\EVbJMVW.exe
  2⤵
  PID:11152
- C:\Windows\System\pxpGsZm.exe
  C:\Windows\System\pxpGsZm.exe
  2⤵
  PID:11172
- C:\Windows\System\lCndtMw.exe
  C:\Windows\System\lCndtMw.exe
  2⤵
  PID:11196
- C:\Windows\System\dkgNKcH.exe
  C:\Windows\System\dkgNKcH.exe
  2⤵
  PID:11212
- C:\Windows\System\ZbHQLKc.exe
  C:\Windows\System\ZbHQLKc.exe
  2⤵
  PID:11236
- C:\Windows\System\VxcFcSM.exe
  C:\Windows\System\VxcFcSM.exe
  2⤵
  PID:11256
- C:\Windows\System\hsYXHYh.exe
  C:\Windows\System\hsYXHYh.exe
  2⤵
  PID:6880
- C:\Windows\System\rUbVkgc.exe
  C:\Windows\System\rUbVkgc.exe
  2⤵
  PID:7156
- C:\Windows\System\iwPxqkE.exe
  C:\Windows\System\iwPxqkE.exe
  2⤵
  PID:6908
- C:\Windows\System\cZiwunm.exe
  C:\Windows\System\cZiwunm.exe
  2⤵
  PID:6080
- C:\Windows\System\nsiSQPz.exe
  C:\Windows\System\nsiSQPz.exe
  2⤵
  PID:8224
- C:\Windows\System\qckqHtb.exe
  C:\Windows\System\qckqHtb.exe
  2⤵
  PID:8264
- C:\Windows\System\yXGeOrR.exe
  C:\Windows\System\yXGeOrR.exe
  2⤵
  PID:8304
- C:\Windows\System\HjZMftY.exe
  C:\Windows\System\HjZMftY.exe
  2⤵
  PID:9276
- C:\Windows\System\aBdyXQD.exe
  C:\Windows\System\aBdyXQD.exe
  2⤵
  PID:9340
- C:\Windows\System\zITkpHH.exe
  C:\Windows\System\zITkpHH.exe
  2⤵
  PID:11268
- C:\Windows\System\mjhoFQj.exe
  C:\Windows\System\mjhoFQj.exe
  2⤵
  PID:11284
- C:\Windows\System\VvrYbiY.exe
  C:\Windows\System\VvrYbiY.exe
  2⤵
  PID:11332
- C:\Windows\System\QsnnGro.exe
  C:\Windows\System\QsnnGro.exe
  2⤵
  PID:11356
- C:\Windows\System\GBDPMXW.exe
  C:\Windows\System\GBDPMXW.exe
  2⤵
  PID:11376
- C:\Windows\System\vFMdfPh.exe
  C:\Windows\System\vFMdfPh.exe
  2⤵
  PID:11396
- C:\Windows\System\haoqOCM.exe
  C:\Windows\System\haoqOCM.exe
  2⤵
  PID:11420
- C:\Windows\System\knFQyZW.exe
  C:\Windows\System\knFQyZW.exe
  2⤵
  PID:11440
- C:\Windows\System\lZAqfdW.exe
  C:\Windows\System\lZAqfdW.exe
  2⤵
  PID:11484
- C:\Windows\System\VCjwjVy.exe
  C:\Windows\System\VCjwjVy.exe
  2⤵
  PID:11500
- C:\Windows\System\XSqPFyR.exe
  C:\Windows\System\XSqPFyR.exe
  2⤵
  PID:11532
- C:\Windows\System\NMqpMgh.exe
  C:\Windows\System\NMqpMgh.exe
  2⤵
  PID:11556
- C:\Windows\System\MNTOLVe.exe
  C:\Windows\System\MNTOLVe.exe
  2⤵
  PID:11576
- C:\Windows\System\glMOIHQ.exe
  C:\Windows\System\glMOIHQ.exe
  2⤵
  PID:11604
- C:\Windows\System\sEsRsUD.exe
  C:\Windows\System\sEsRsUD.exe
  2⤵
  PID:11628
- C:\Windows\System\sUQkOjp.exe
  C:\Windows\System\sUQkOjp.exe
  2⤵
  PID:11668
- C:\Windows\System\sOokCyw.exe
  C:\Windows\System\sOokCyw.exe
  2⤵
  PID:11688
- C:\Windows\System\BKkfWZv.exe
  C:\Windows\System\BKkfWZv.exe
  2⤵
  PID:11712
- C:\Windows\System\AFalFde.exe
  C:\Windows\System\AFalFde.exe
  2⤵
  PID:11736
- C:\Windows\System\wqgMhlQ.exe
  C:\Windows\System\wqgMhlQ.exe
  2⤵
  PID:11772
- C:\Windows\System\jpVMfNG.exe
  C:\Windows\System\jpVMfNG.exe
  2⤵
  PID:11804
- C:\Windows\System\WYSkeUe.exe
  C:\Windows\System\WYSkeUe.exe
  2⤵
  PID:11832
- C:\Windows\System\fpMHInf.exe
  C:\Windows\System\fpMHInf.exe
  2⤵
  PID:11848
- C:\Windows\System\gXkNuQC.exe
  C:\Windows\System\gXkNuQC.exe
  2⤵
  PID:11872
- C:\Windows\System\oWQTIBG.exe
  C:\Windows\System\oWQTIBG.exe
  2⤵
  PID:11888
- C:\Windows\System\CaCgObK.exe
  C:\Windows\System\CaCgObK.exe
  2⤵
  PID:11904
- C:\Windows\System\TzzjCRW.exe
  C:\Windows\System\TzzjCRW.exe
  2⤵
  PID:11920
- C:\Windows\System\LxEwhNJ.exe
  C:\Windows\System\LxEwhNJ.exe
  2⤵
  PID:11936
- C:\Windows\System\jjpCgYA.exe
  C:\Windows\System\jjpCgYA.exe
  2⤵
  PID:11952
- C:\Windows\System\LceGgXB.exe
  C:\Windows\System\LceGgXB.exe
  2⤵
  PID:11968
- C:\Windows\System\OtZTsdH.exe
  C:\Windows\System\OtZTsdH.exe
  2⤵
  PID:11984
- C:\Windows\System\jfwtxLt.exe
  C:\Windows\System\jfwtxLt.exe
  2⤵
  PID:12000
- C:\Windows\System\gFoScIO.exe
  C:\Windows\System\gFoScIO.exe
  2⤵
  PID:12016
- C:\Windows\System\TwBxLGQ.exe
  C:\Windows\System\TwBxLGQ.exe
  2⤵
  PID:12056
- C:\Windows\System\ZcLqVCV.exe
  C:\Windows\System\ZcLqVCV.exe
  2⤵
  PID:12092
- C:\Windows\System\wbzaLsV.exe
  C:\Windows\System\wbzaLsV.exe
  2⤵
  PID:12128
- C:\Windows\System\HjqmYgp.exe
  C:\Windows\System\HjqmYgp.exe
  2⤵
  PID:12144
- C:\Windows\System\VHtXyqm.exe
  C:\Windows\System\VHtXyqm.exe
  2⤵
  PID:12168
- C:\Windows\System\ceWKnSK.exe
  C:\Windows\System\ceWKnSK.exe
  2⤵
  PID:12192
- C:\Windows\System\PnUBoAT.exe
  C:\Windows\System\PnUBoAT.exe
  2⤵
  PID:12208
- C:\Windows\System\UhBHUjy.exe
  C:\Windows\System\UhBHUjy.exe
  2⤵
  PID:12228
- C:\Windows\System\PogPcku.exe
  C:\Windows\System\PogPcku.exe
  2⤵
  PID:12252
- C:\Windows\System\xRlSnKA.exe
  C:\Windows\System\xRlSnKA.exe
  2⤵
  PID:12268
- C:\Windows\System\ggsCDYl.exe
  C:\Windows\System\ggsCDYl.exe
  2⤵
  PID:8816
- C:\Windows\System\tQzQMnw.exe
  C:\Windows\System\tQzQMnw.exe
  2⤵
  PID:936
- C:\Windows\System\KTqzKqn.exe
  C:\Windows\System\KTqzKqn.exe
  2⤵
  PID:9692
- C:\Windows\System\kIWetoF.exe
  C:\Windows\System\kIWetoF.exe
  2⤵
  PID:9756
- C:\Windows\System\wMRcetT.exe
  C:\Windows\System\wMRcetT.exe
  2⤵
  PID:9928
- C:\Windows\System\HyIxjBL.exe
  C:\Windows\System\HyIxjBL.exe
  2⤵
  PID:9200
- C:\Windows\System\iIsBoHR.exe
  C:\Windows\System\iIsBoHR.exe
  2⤵
  PID:10208
- C:\Windows\System\YLxuino.exe
  C:\Windows\System\YLxuino.exe
  2⤵
  PID:6700
- C:\Windows\System\lcuPGTQ.exe
  C:\Windows\System\lcuPGTQ.exe
  2⤵
  PID:10144
- C:\Windows\System\NaIIaba.exe
  C:\Windows\System\NaIIaba.exe
  2⤵
  PID:5912
- C:\Windows\System\RBiulMz.exe
  C:\Windows\System\RBiulMz.exe
  2⤵
  PID:2356
- C:\Windows\System\ShMKAuY.exe
  C:\Windows\System\ShMKAuY.exe
  2⤵
  PID:8852
- C:\Windows\System\KmKsOhC.exe
  C:\Windows\System\KmKsOhC.exe
  2⤵
  PID:12304
- C:\Windows\System\rWPwhVR.exe
  C:\Windows\System\rWPwhVR.exe
  2⤵
  PID:12336
- C:\Windows\System\JGlLeFa.exe
  C:\Windows\System\JGlLeFa.exe
  2⤵
  PID:12360
- C:\Windows\System\faqgIXv.exe
  C:\Windows\System\faqgIXv.exe
  2⤵
  PID:12380
- C:\Windows\System\AjxYZNB.exe
  C:\Windows\System\AjxYZNB.exe
  2⤵
  PID:12400
- C:\Windows\System\hMUdJRg.exe
  C:\Windows\System\hMUdJRg.exe
  2⤵
  PID:12424
- C:\Windows\System\DjIRQdd.exe
  C:\Windows\System\DjIRQdd.exe
  2⤵
  PID:12444
- C:\Windows\System\nZsORhf.exe
  C:\Windows\System\nZsORhf.exe
  2⤵
  PID:12460
- C:\Windows\System\ewawjlV.exe
  C:\Windows\System\ewawjlV.exe
  2⤵
  PID:12480
- C:\Windows\System\doQYuBC.exe
  C:\Windows\System\doQYuBC.exe
  2⤵
  PID:12500
- C:\Windows\System\GNScOZR.exe
  C:\Windows\System\GNScOZR.exe
  2⤵
  PID:12524
- C:\Windows\System\UdteMZb.exe
  C:\Windows\System\UdteMZb.exe
  2⤵
  PID:12540
- C:\Windows\System\RqpeDWf.exe
  C:\Windows\System\RqpeDWf.exe
  2⤵
  PID:12556
- C:\Windows\System\bUGUPsf.exe
  C:\Windows\System\bUGUPsf.exe
  2⤵
  PID:12580
- C:\Windows\System\uBMOfEw.exe
  C:\Windows\System\uBMOfEw.exe
  2⤵
  PID:12596
- C:\Windows\System\PVCQYyA.exe
  C:\Windows\System\PVCQYyA.exe
  2⤵
  PID:12612
- C:\Windows\System\nwHcVdC.exe
  C:\Windows\System\nwHcVdC.exe
  2⤵
  PID:12628
- C:\Windows\System\leuJOGk.exe
  C:\Windows\System\leuJOGk.exe
  2⤵
  PID:12648
- C:\Windows\System\OjDwIvn.exe
  C:\Windows\System\OjDwIvn.exe
  2⤵
  PID:12664
- C:\Windows\System\JrTNtim.exe
  C:\Windows\System\JrTNtim.exe
  2⤵
  PID:12692
- C:\Windows\System\qGfTcSU.exe
  C:\Windows\System\qGfTcSU.exe
  2⤵
  PID:12716
- C:\Windows\System\dbAYqMK.exe
  C:\Windows\System\dbAYqMK.exe
  2⤵
  PID:12740
- C:\Windows\System\JRYJJCt.exe
  C:\Windows\System\JRYJJCt.exe
  2⤵
  PID:12760
- C:\Windows\System\jcoGYvD.exe
  C:\Windows\System\jcoGYvD.exe
  2⤵
  PID:12780
- C:\Windows\System\IxIyZJF.exe
  C:\Windows\System\IxIyZJF.exe
  2⤵
  PID:12800
- C:\Windows\System\cqktoZF.exe
  C:\Windows\System\cqktoZF.exe
  2⤵
  PID:12816
- C:\Windows\System\sVndhHV.exe
  C:\Windows\System\sVndhHV.exe
  2⤵
  PID:12832
- C:\Windows\System\kCbzfHY.exe
  C:\Windows\System\kCbzfHY.exe
  2⤵
  PID:12852
- C:\Windows\System\ciEboSn.exe
  C:\Windows\System\ciEboSn.exe
  2⤵
  PID:12868
- C:\Windows\System\nLpXvOX.exe
  C:\Windows\System\nLpXvOX.exe
  2⤵
  PID:12884
- C:\Windows\System\HkGGixH.exe
  C:\Windows\System\HkGGixH.exe
  2⤵
  PID:12904
- C:\Windows\System\jxfbPtq.exe
  C:\Windows\System\jxfbPtq.exe
  2⤵
  PID:12924
- C:\Windows\System\rsUXTdO.exe
  C:\Windows\System\rsUXTdO.exe
  2⤵
  PID:12944
- C:\Windows\System\TkjJgIM.exe
  C:\Windows\System\TkjJgIM.exe
  2⤵
  PID:12960
- C:\Windows\System\xhBbSPx.exe
  C:\Windows\System\xhBbSPx.exe
  2⤵
  PID:12980
- C:\Windows\System\OKQMRTd.exe
  C:\Windows\System\OKQMRTd.exe
  2⤵
  PID:12996
- C:\Windows\System\CIJVhNL.exe
  C:\Windows\System\CIJVhNL.exe
  2⤵
  PID:13016
- C:\Windows\System\kPLmNws.exe
  C:\Windows\System\kPLmNws.exe
  2⤵
  PID:13040
- C:\Windows\System\KFjomvx.exe
  C:\Windows\System\KFjomvx.exe
  2⤵
  PID:13064
- C:\Windows\System\nVdWIlY.exe
  C:\Windows\System\nVdWIlY.exe
  2⤵
  PID:13080
- C:\Windows\System\mIZLSuU.exe
  C:\Windows\System\mIZLSuU.exe
  2⤵
  PID:13104
- C:\Windows\System\XfuqjFw.exe
  C:\Windows\System\XfuqjFw.exe
  2⤵
  PID:13128
- C:\Windows\System\gmIzOHp.exe
  C:\Windows\System\gmIzOHp.exe
  2⤵
  PID:13148
- C:\Windows\System\pujfJdQ.exe
  C:\Windows\System\pujfJdQ.exe
  2⤵
  PID:13168
- C:\Windows\System\STmjVvR.exe
  C:\Windows\System\STmjVvR.exe
  2⤵
  PID:13188
- C:\Windows\System\oQxjTTD.exe
  C:\Windows\System\oQxjTTD.exe
  2⤵
  PID:13208
- C:\Windows\System\MayJQpK.exe
  C:\Windows\System\MayJQpK.exe
  2⤵
  PID:13228
- C:\Windows\System\EicOkwH.exe
  C:\Windows\System\EicOkwH.exe
  2⤵
  PID:13244
- C:\Windows\System\jjEXCQK.exe
  C:\Windows\System\jjEXCQK.exe
  2⤵
  PID:13264
- C:\Windows\System\cWPNfJM.exe
  C:\Windows\System\cWPNfJM.exe
  2⤵
  PID:13292
- C:\Windows\System\sLHqaYF.exe
  C:\Windows\System\sLHqaYF.exe
  2⤵
  PID:13308
- C:\Windows\System\ifOTPge.exe
  C:\Windows\System\ifOTPge.exe
  2⤵
  PID:4336
- C:\Windows\System\sKIziLE.exe
  C:\Windows\System\sKIziLE.exe
  2⤵
  PID:8108
- C:\Windows\System\IuNUxKj.exe
  C:\Windows\System\IuNUxKj.exe
  2⤵
  PID:1836
- C:\Windows\System\BLeNrqo.exe
  C:\Windows\System\BLeNrqo.exe
  2⤵
  PID:10468
- C:\Windows\System\sWrADPr.exe
  C:\Windows\System\sWrADPr.exe
  2⤵
  PID:5244
- C:\Windows\System\AWCpmyH.exe
  C:\Windows\System\AWCpmyH.exe
  2⤵
  PID:2180
- C:\Windows\System\DQBLayi.exe
  C:\Windows\System\DQBLayi.exe
  2⤵
  PID:6524
- C:\Windows\System\TvxcFdW.exe
  C:\Windows\System\TvxcFdW.exe
  2⤵
  PID:6400
- C:\Windows\System\KjYHOld.exe
  C:\Windows\System\KjYHOld.exe
  2⤵
  PID:10704
- C:\Windows\System\iuyqCcV.exe
  C:\Windows\System\iuyqCcV.exe
  2⤵
  PID:7208
- C:\Windows\System\gyEPzrY.exe
  C:\Windows\System\gyEPzrY.exe
  2⤵
  PID:9240
- C:\Windows\System\mjPNTkK.exe
  C:\Windows\System\mjPNTkK.exe
  2⤵
  PID:9068
- C:\Windows\System\gCmeKNT.exe
  C:\Windows\System\gCmeKNT.exe
  2⤵
  PID:9272
- C:\Windows\System\WyMHqSm.exe
  C:\Windows\System\WyMHqSm.exe
  2⤵
  PID:11064
- C:\Windows\System\rgpwHrx.exe
  C:\Windows\System\rgpwHrx.exe
  2⤵
  PID:12356
- C:\Windows\System\OolNVwj.exe
  C:\Windows\System\OolNVwj.exe
  2⤵
  PID:12876
- C:\Windows\System\VbEoaXC.exe
  C:\Windows\System\VbEoaXC.exe
  2⤵
  PID:12748
- C:\Windows\System\FuaENBS.exe
  C:\Windows\System\FuaENBS.exe
  2⤵
  PID:12636
- C:\Windows\System\WKorcCs.exe
  C:\Windows\System\WKorcCs.exe
  2⤵
  PID:11124
- C:\Windows\System\sYbQOJJ.exe
  C:\Windows\System\sYbQOJJ.exe
  2⤵
  PID:9236
- C:\Windows\System\wuVXHTM.exe
  C:\Windows\System\wuVXHTM.exe
  2⤵
  PID:10384
- C:\Windows\System\pYoCEOc.exe
  C:\Windows\System\pYoCEOc.exe
  2⤵
  PID:10456
- C:\Windows\System\Yrgahca.exe
  C:\Windows\System\Yrgahca.exe
  2⤵
  PID:10540
- C:\Windows\System\gIsUJJd.exe
  C:\Windows\System\gIsUJJd.exe
  2⤵
  PID:12788
- C:\Windows\System\DekqiIX.exe
  C:\Windows\System\DekqiIX.exe
  2⤵
  PID:12844
- C:\Windows\System\ouzQeyK.exe
  C:\Windows\System\ouzQeyK.exe
  2⤵
  PID:12968
- C:\Windows\System\NiAozdL.exe
  C:\Windows\System\NiAozdL.exe
  2⤵
  PID:13088
- C:\Windows\System\XQDzrbt.exe
  C:\Windows\System\XQDzrbt.exe
  2⤵
  PID:12896
- C:\Windows\System\IUMNeWK.exe
  C:\Windows\System\IUMNeWK.exe
  2⤵
  PID:13272
- C:\Windows\System\cxPacCx.exe
  C:\Windows\System\cxPacCx.exe
  2⤵
  PID:13096
- C:\Windows\System\tUbOOkc.exe
  C:\Windows\System\tUbOOkc.exe
  2⤵
  PID:12972
- C:\Windows\System\vyuTXUX.exe
  C:\Windows\System\vyuTXUX.exe
  2⤵
  PID:11896
- C:\Windows\System\lUhAGxk.exe
  C:\Windows\System\lUhAGxk.exe
  2⤵
  PID:11780
- C:\Windows\System\XkFfeSu.exe
  C:\Windows\System\XkFfeSu.exe
  2⤵
  PID:11428
- C:\Windows\System\yDwFnkK.exe
  C:\Windows\System\yDwFnkK.exe
  2⤵
  PID:2216
- C:\Windows\System\nsvGBrE.exe
  C:\Windows\System\nsvGBrE.exe
  2⤵
  PID:8252
- C:\Windows\System\fXvKlbN.exe
  C:\Windows\System\fXvKlbN.exe
  2⤵
  PID:13260
- C:\Windows\System\YzpiBWI.exe
  C:\Windows\System\YzpiBWI.exe
  2⤵
  PID:1080
- C:\Windows\System\kgroHjC.exe
  C:\Windows\System\kgroHjC.exe
  2⤵
  PID:7536
- C:\Windows\System\QbQvPjN.exe
  C:\Windows\System\QbQvPjN.exe
  2⤵
  PID:12772
- C:\Windows\System\XnyjEmi.exe
  C:\Windows\System\XnyjEmi.exe
  2⤵
  PID:12352
- C:\Windows\System\igRArSD.exe
  C:\Windows\System\igRArSD.exe
  2⤵
  PID:7172
- C:\Windows\System\duVvLSA.exe
  C:\Windows\System\duVvLSA.exe
  2⤵
  PID:2164
- C:\Windows\System\ubkQYxl.exe
  C:\Windows\System\ubkQYxl.exe
  2⤵
  PID:9672
- C:\Windows\System\JikjqxY.exe
  C:\Windows\System\JikjqxY.exe
  2⤵
  PID:8800
- C:\Windows\System\wZNyrfs.exe
  C:\Windows\System\wZNyrfs.exe
  2⤵
  PID:11384
- C:\Windows\System\SHYXPIB.exe
  C:\Windows\System\SHYXPIB.exe
  2⤵
  PID:10072
- C:\Windows\System\UMyiwRP.exe
  C:\Windows\System\UMyiwRP.exe
  2⤵
  PID:10356
- C:\Windows\System\JUBKZYo.exe
  C:\Windows\System\JUBKZYo.exe
  2⤵
  PID:10668
- C:\Windows\System\nhKNIia.exe
  C:\Windows\System\nhKNIia.exe
  2⤵
  PID:6960
- C:\Windows\System\hoeYIpH.exe
  C:\Windows\System\hoeYIpH.exe
  2⤵
  PID:12332
- C:\Windows\System\EulHbZY.exe
  C:\Windows\System\EulHbZY.exe
  2⤵
  PID:12572
- C:\Windows\System\gmnGQKn.exe
  C:\Windows\System\gmnGQKn.exe
  2⤵
  PID:11208
- C:\Windows\System\FNiVytT.exe
  C:\Windows\System\FNiVytT.exe
  2⤵
  PID:4816
- C:\Windows\System\MomMqyI.exe
  C:\Windows\System\MomMqyI.exe
  2⤵
  PID:12080
- C:\Windows\System\qJkuyYc.exe
  C:\Windows\System\qJkuyYc.exe
  2⤵
  PID:11344
- C:\Windows\System\dUAbgQm.exe
  C:\Windows\System\dUAbgQm.exe
  2⤵
  PID:10512
- C:\Windows\System\uXhkbvN.exe
  C:\Windows\System\uXhkbvN.exe
  2⤵
  PID:12916
- C:\Windows\System\scqxdSc.exe
  C:\Windows\System\scqxdSc.exe
  2⤵
  PID:13032
- C:\Windows\System\ttgHeTN.exe
  C:\Windows\System\ttgHeTN.exe
  2⤵
  PID:13644
- C:\Windows\System\XwuvRex.exe
  C:\Windows\System\XwuvRex.exe
  2⤵
  PID:13664
- C:\Windows\System\WZmjtsf.exe
  C:\Windows\System\WZmjtsf.exe
  2⤵
  PID:13828
- C:\Windows\System\oWAenLu.exe
  C:\Windows\System\oWAenLu.exe
  2⤵
  PID:13844
- C:\Windows\System\HYvuCew.exe
  C:\Windows\System\HYvuCew.exe
  2⤵
  PID:13864
- C:\Windows\System\CWvYelx.exe
  C:\Windows\System\CWvYelx.exe
  2⤵
  PID:13892
- C:\Windows\System\dSEOvzs.exe
  C:\Windows\System\dSEOvzs.exe
  2⤵
  PID:13908
- C:\Windows\System\yrYVhIb.exe
  C:\Windows\System\yrYVhIb.exe
  2⤵
  PID:13940
- C:\Windows\System\YXaqYiS.exe
  C:\Windows\System\YXaqYiS.exe
  2⤵
  PID:13960
- C:\Windows\System\GEASTus.exe
  C:\Windows\System\GEASTus.exe
  2⤵
  PID:14240
- C:\Windows\System\ERWmwWN.exe
  C:\Windows\System\ERWmwWN.exe
  2⤵
  PID:1176
- C:\Windows\System\ykeKYnT.exe
  C:\Windows\System\ykeKYnT.exe
  2⤵
  PID:11084
- C:\Windows\System\SxcPKVE.exe
  C:\Windows\System\SxcPKVE.exe
  2⤵
  PID:12588
- C:\Windows\System\WtGnmjM.exe
  C:\Windows\System\WtGnmjM.exe
  2⤵
  PID:13416
- C:\Windows\System\cTCaFAZ.exe
  C:\Windows\System\cTCaFAZ.exe
  2⤵
  PID:12920
- C:\Windows\System\EMEcQpz.exe
  C:\Windows\System\EMEcQpz.exe
  2⤵
  PID:10916
- C:\Windows\System\YFQTYOg.exe
  C:\Windows\System\YFQTYOg.exe
  2⤵
  PID:13408
- C:\Windows\System\YClZUZZ.exe
  C:\Windows\System\YClZUZZ.exe
  2⤵
  PID:4592
- C:\Windows\System\xWQuVDN.exe
  C:\Windows\System\xWQuVDN.exe
  2⤵
  PID:2192
- C:\Windows\System\RbJpMQM.exe
  C:\Windows\System\RbJpMQM.exe
  2⤵
  PID:11684
- C:\Windows\System\KDClSdO.exe
  C:\Windows\System\KDClSdO.exe
  2⤵
  PID:13484
- C:\Windows\System\tckWDIh.exe
  C:\Windows\System\tckWDIh.exe
  2⤵
  PID:13300
- C:\Windows\System\TNzPJIQ.exe
  C:\Windows\System\TNzPJIQ.exe
  2⤵
  PID:10968
- C:\Windows\System\pCDGUec.exe
  C:\Windows\System\pCDGUec.exe
  2⤵
  PID:7624
- C:\Windows\System\JxNnaaC.exe
  C:\Windows\System\JxNnaaC.exe
  2⤵
  PID:13464
- C:\Windows\System\QeRRjbb.exe
  C:\Windows\System\QeRRjbb.exe
  2⤵
  PID:2412
- C:\Windows\System\VeAxVRE.exe
  C:\Windows\System\VeAxVRE.exe
  2⤵
  PID:14272
- C:\Windows\System\DnHQvJa.exe
  C:\Windows\System\DnHQvJa.exe
  2⤵
  PID:14288
- C:\Windows\System\eEIRPHY.exe
  C:\Windows\System\eEIRPHY.exe
  2⤵
  PID:4452
- C:\Windows\System\tqxJIZi.exe
  C:\Windows\System\tqxJIZi.exe
  2⤵
  PID:14304
- C:\Windows\System\vItKIhr.exe
  C:\Windows\System\vItKIhr.exe
  2⤵
  PID:11620
- C:\Windows\System\GrFYnxH.exe
  C:\Windows\System\GrFYnxH.exe
  2⤵
  PID:14216
- C:\Windows\System\jTGpyAm.exe
  C:\Windows\System\jTGpyAm.exe
  2⤵
  PID:14260
- C:\Windows\System\eAoLaDB.exe
  C:\Windows\System\eAoLaDB.exe
  2⤵
  PID:14332
- C:\Windows\System\WOkMcCV.exe
  C:\Windows\System\WOkMcCV.exe
  2⤵
  PID:1592
- C:\Windows\System\EzzIdqP.exe
  C:\Windows\System\EzzIdqP.exe
  2⤵
  PID:12732
- C:\Windows\System\otmvccb.exe
  C:\Windows\System\otmvccb.exe
  2⤵
  PID:13544
- C:\Windows\System\wCcsNci.exe
  C:\Windows\System\wCcsNci.exe
  2⤵
  PID:13556
- C:\Windows\System\hDsKaZM.exe
  C:\Windows\System\hDsKaZM.exe
  2⤵
  PID:12936
- C:\Windows\System\vagYoMQ.exe
  C:\Windows\System\vagYoMQ.exe
  2⤵
  PID:11724
- C:\Windows\System\gZaaCrF.exe
  C:\Windows\System\gZaaCrF.exe
  2⤵
  PID:9740
- C:\Windows\System\bznWLDh.exe
  C:\Windows\System\bznWLDh.exe
  2⤵
  PID:7240
- C:\Windows\System\vmYukHg.exe
  C:\Windows\System\vmYukHg.exe
  2⤵
  PID:8784
- C:\Windows\System\fAkSdCa.exe
  C:\Windows\System\fAkSdCa.exe
  2⤵
  PID:8240
- C:\Windows\System\RjKhnJe.exe
  C:\Windows\System\RjKhnJe.exe
  2⤵
  PID:13316
- C:\Windows\System\HNLXkwe.exe
  C:\Windows\System\HNLXkwe.exe
  2⤵
  PID:8728
- C:\Windows\System\BDoWcUZ.exe
  C:\Windows\System\BDoWcUZ.exe
  2⤵
  PID:10608
- C:\Windows\System\RtnPClA.exe
  C:\Windows\System\RtnPClA.exe
  2⤵
  PID:13420
- C:\Windows\System\tROtCMO.exe
  C:\Windows\System\tROtCMO.exe
  2⤵
  PID:14092
- C:\Windows\System\qfusZbJ.exe
  C:\Windows\System\qfusZbJ.exe
  2⤵
  PID:13404
- C:\Windows\System\RmranyT.exe
  C:\Windows\System\RmranyT.exe
  2⤵
  PID:12992
- C:\Windows\System\uhVQPET.exe
  C:\Windows\System\uhVQPET.exe
  2⤵
  PID:1860
- C:\Windows\System\tDqzGHx.exe
  C:\Windows\System\tDqzGHx.exe
  2⤵
  PID:7964
- C:\Windows\System\yDVbfwD.exe
  C:\Windows\System\yDVbfwD.exe
  2⤵
  PID:9900
- C:\Windows\System\OtOchFe.exe
  C:\Windows\System\OtOchFe.exe
  2⤵
  PID:13956
- C:\Windows\System\AdSIkWa.exe
  C:\Windows\System\AdSIkWa.exe
  2⤵
  PID:852
- C:\Windows\System\DwerlcN.exe
  C:\Windows\System\DwerlcN.exe
  2⤵
  PID:14136
- C:\Windows\System\ikhdQHT.exe
  C:\Windows\System\ikhdQHT.exe
  2⤵
  PID:1268
- C:\Windows\System\MQBJUyV.exe
  C:\Windows\System\MQBJUyV.exe
  2⤵
  PID:9696
- C:\Windows\System\OLzfkRE.exe
  C:\Windows\System\OLzfkRE.exe
  2⤵
  PID:10664
- C:\Windows\System\NQmOAAt.exe
  C:\Windows\System\NQmOAAt.exe
  2⤵
  PID:14168
- C:\Windows\System\aZMjwWM.exe
  C:\Windows\System\aZMjwWM.exe
  2⤵
  PID:10808
- C:\Windows\System\FirpQhH.exe
  C:\Windows\System\FirpQhH.exe
  2⤵
  PID:13332
- C:\Windows\System\UDcecCr.exe
  C:\Windows\System\UDcecCr.exe
  2⤵
  PID:13388
- C:\Windows\System\hGynJjf.exe
  C:\Windows\System\hGynJjf.exe
  2⤵
  PID:13056
- C:\Windows\System\utqDWGJ.exe
  C:\Windows\System\utqDWGJ.exe
  2⤵
  PID:5740
- C:\Windows\System\HHBQooF.exe
  C:\Windows\System\HHBQooF.exe
  2⤵
  PID:13748
- C:\Windows\System\MVzpJdp.exe
  C:\Windows\System\MVzpJdp.exe
  2⤵
  PID:556
- C:\Windows\System\uTZLLRX.exe
  C:\Windows\System\uTZLLRX.exe
  2⤵
  PID:14124
- C:\Windows\System\VjnEDHF.exe
  C:\Windows\System\VjnEDHF.exe
  2⤵
  PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qpshqc5d.lk2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DGCZiwB.exe

Filesize
1.5MB

MD5
198f5d2a362bff761a9672bd0cc9e3be

SHA1
51490f42f322c8b5d53d3f8a8bb997da31c78ce1

SHA256
abf6d3e60880c70bd946be9a0e1a9027dfb5fc29c1d17b069140d4dd2a405b38

SHA512
39b9bd3fa78394a67fddabe1956ce63bc0783420ea4d1f5d1b76bd17b8eb764c939d425cf4691483dc83946f22f63347f68b8b1aacb7002122f91ccbe9a01c03

Download Submit
C:\Windows\System\DSxeLti.exe

Filesize
1.5MB

MD5
a35b0aad00b0a238dcf93c48f52b3859

SHA1
689811a26658e5973b3f1ff76860e78be9b17f65

SHA256
3d2cac8d94608ff8918733f7c4f0e77808b2a241e466d0790d9ac9c3d759e868

SHA512
0a3e3d1014408dde3f1be298e041240275640dc2d9a60f754bf715fe5dfac4f57fb63ea0d0010b4bc33c913b58e1c09f5082eba4616b1c81a029e36e807591c1

Download Submit
C:\Windows\System\DSzajGx.exe

Filesize
1.5MB

MD5
72639b038b0538d425fd9fe04249ecfa

SHA1
848d4d83faa70a88cda4800e80014a81d253d155

SHA256
ee852aae44f05a43e4013a791a6eba25bbe8a177f1a138fb72c0b22cd1c82640

SHA512
f117213f329d24606a45d9fa8fda55a789d2ed80c88c39cb20673b54d3d7276239c4704ec272666e39ac8ff67c6c087c1a130aec4e4086141b897a3a27d782dd

Download Submit
C:\Windows\System\EUBDfRM.exe

Filesize
1.5MB

MD5
94812a236aa3bcdf2a707baa4fc7ec83

SHA1
f0d4081d18284c5ff6153a5c41da5312bee65cb5

SHA256
8464ada949e20ae09545631b492a6325f799ee1192a9568fefed2332e149ecd8

SHA512
847966be62537b6d7b7c39108bcf0b55975b215c8ecccae4680c4eb776c6bf7766bfbf311f6a56065993da148f652f9d4afc377eae7f3248fe23bfa4c7eb81ca

Download Submit
C:\Windows\System\GVHzXgI.exe

Filesize
1.5MB

MD5
9fa2c8f0b0081192575110ea239f34cb

SHA1
7f050df9dd49db6883f2257e37fe58b0f1326ee9

SHA256
7b23471e221d0041c8f9ec80a24754960577ae428b879a493745de43913757cc

SHA512
b22d4101f7e61a90fde9201375928d10669696c951ed2c8b46b4a8584666779ff6a638a1ee78e221f3880da13dba7d21c01c116bf02b9e517627a407ef99a684

Download Submit
C:\Windows\System\IsJMnPK.exe

Filesize
1.5MB

MD5
80f2f0723a63b6d98b4b8401448f9053

SHA1
0d9a49135e83bd37270256ce58e37a482c7b96e2

SHA256
ef2ae91bdf9d8d5fb3c960449b228a69d97353735991ed83075c8861a479c040

SHA512
600d25eae209559768805c2b0c808f07a16f2f5bf823671f20de9dda7a0e7a0e316a6f51d48831e2c60c389cc82641f751011277ac992de321ccf98d90bf3611

Download Submit
C:\Windows\System\LMwCELF.exe

Filesize
1.5MB

MD5
4bb4c7dafc933d903f1af45a4859b82b

SHA1
718e1a867095a6dfbb1011d95fb9d2c9997fe533

SHA256
b6a74a0a3a7db4d1062fd74b85b167652999e51c80e302b7d1d57f192f1eef5c

SHA512
6acd2b699e32c646fbe67123b1be9a5f7dc3435c8b837cd19c1de517addfe8b11997e1abbc4a81b8a61ca1e7a9b7e9c1aca8917bd085bbd938b583bb3eebd182

Download Submit
C:\Windows\System\LmlVqAQ.exe

Filesize
1.5MB

MD5
54084dc7404734dfed5825fbaea525b1

SHA1
85f2999ee952b211bf93552652c8bdd359b834fc

SHA256
7ae8339f3964a4580e0cd3eda66c4d84fde52dceadadba98a141a39f3e1a42a8

SHA512
26a2bf4be00faa3e5beda60de6a839a2e6eb4189fbdda0ace1e205ad2377cc5e1e5805e544663da400e9971034fd9a8adc328818ad0bc83f28f98f9f33c96c61

Download Submit
C:\Windows\System\MDPsVef.exe

Filesize
1.5MB

MD5
56503805b42413f501953462a3ea4283

SHA1
acd99a674c4dbcc02a008a695a054379d20dd727

SHA256
dd01ccbc69e1fbfbf115c8ce275e5fe2878964a5aeff4580944ece409a745887

SHA512
6b7f5ff79f901e9fe47541c323969fe7123d77e30b0cd03137af5eedd22bbf2da403d9ad7240f140cb6ff1ec90e1d164f0db5b61408da192c15afee3fc303bb2

Download Submit
C:\Windows\System\MuuqHxq.exe

Filesize
1.5MB

MD5
bb624efc91867bda5c4581e74cd05b24

SHA1
c91d07130010ff2e00a853aac7bbf6a830deaf61

SHA256
b3fc133a6cf50d69a8554c2e32998dcf0f1168207820d41f7097a0577135216f

SHA512
77585a95688d2772eee168f0476df5611aeff2d4c36faeda09e4cdddb0904d25b6fa31a2f136b820e423ffde5549c516827ab77fdfbeed7fd4ce0464d6a7dbe9

Download Submit
C:\Windows\System\NESIusr.exe

Filesize
1.5MB

MD5
3714324d61ee832c383f53a843c8e22e

SHA1
651684d1606c5e8cea421f343f1a149c47ce1a4f

SHA256
db8f484646a065cb1bc09fe8d47b4b1526fddce95bc92806a8f34067d2887786

SHA512
fd5b64f75d565aa5cd68acd8098b66f513f2efa3e9a444725a1a42cfcfc60b4504138ce2acd26bc2bfcc124c69682bb30c1e84499d1752fd4b60be310764d8a0

Download Submit
C:\Windows\System\NcOfRuk.exe

Filesize
1.5MB

MD5
0f8d8decd79a9abdbb0bc96d57a2f459

SHA1
5eff7cd48c1c4029244f31a8929391002491aca7

SHA256
5bbfe2437b8ef399f99f6f65b8679f97c25b62d9b360a1a6cba263a38c66a5c0

SHA512
3b5afd98e33ca05384fea153c2c8a36bae9e20aa2413fdadfd694d55fd92eae4096ee3eb4df3220f7cb6b0b68b44e40002f70bdc988dafca2f77be5488d0d3e9

Download Submit
C:\Windows\System\OqMRgEQ.exe

Filesize
1.5MB

MD5
2a482ee3a110c4bfabb9048330e9cc21

SHA1
6d10f0b31e827086057915996a8c5d69a304013f

SHA256
c3534943ea3d3b7d2663ed5c9bb9d0a093740d926760c10b42b52a1b360c76d6

SHA512
2fe7982dca0df6c1c3df3c02851c50de47ca8400397b479d2bcb319ba943cfc7b53fa060d146f9f1a40ad0a6242ec3f7a76ea3c6a81150994f09ed1d0babe79c

Download Submit
C:\Windows\System\PFxDlfw.exe

Filesize
1.5MB

MD5
eb9ceade333e5ab1c478f4d45913ae2c

SHA1
39470ec4fc03164d4b6f49145a4d84ea4179dcf9

SHA256
f50daabeb7d340f07b77e7a55de8c26688709e7e072aa92cbcde2bf7ad715f27

SHA512
cb61f6a5d9236e9e31cfe6a51909403fd3c3419d0d97de6de05b59ffc8103ce20aa12c7dd50d85822b3e18b9a12e7cbacbc6592b6c0bff86fe058fc24aade0b3

Download Submit
C:\Windows\System\PYpwfrG.exe

Filesize
1.5MB

MD5
b2fc18827c35309dcb702568117d6edc

SHA1
41fdf9360e7d62f55cbfd7311a3c730c46222390

SHA256
2fde486903652e111ea4acadbbe61e571385cecc42295a7a602497cfc305f259

SHA512
50a8082b6d0e21725e38cbed0ed8bf0263222c71ce6d99f3b6235f7f385e35c44c952a925132d1a18168ad33094fb3a2897bec4c23b388670243fb64259e5b56

Download Submit
C:\Windows\System\PylCUtw.exe

Filesize
1.5MB

MD5
a899ef5980e98b9b1a82b7634484f438

SHA1
7b3e0ffcafbee4435936f4002e5de2ef8fd8b65d

SHA256
a3f6c61d6e5142322314194e2f80a39699113615837636221dbd5b592617deff

SHA512
7d2ed80b2487ff3e80204a71000e89b1ab5afebe410c4441d75d223404c81fe9da3c9c16d391ca06ff91696d1bb03ed5a08bd53d1af34d3f5f4eb67a70b73b36

Download Submit
C:\Windows\System\QmCkfZZ.exe

Filesize
1.5MB

MD5
888187d52dcb9bcfe0fdf8e0853da7f0

SHA1
ca92ccd74647d587acbe1835ac5647bc4e5812f3

SHA256
689df33b5b089993e9b54265d548668ff33f0c8861b7f571d45964abfe916ec1

SHA512
bb4d4cfe8d643fff50b382a199cf4a3c0f17405ff380a4fc9254df3d9e59ab11fcfd73ae2b153172213acda70ea4fceaecbd61a62a958e08e2f942c759aff75b

Download Submit
C:\Windows\System\RCqhXLV.exe

Filesize
1.5MB

MD5
5d1711e2354ae16347f4d44ede4a87b6

SHA1
aa262b05a0faaab3916c90bb97c7deffca48c341

SHA256
bbf4982aa1212daa002d11403bba77b07d7b9db01a787ec8ac973efc1d6a3508

SHA512
10ecbfd1a6ec2adfd86e9a833dddfd24437f1cccf2f2490c4879e0bef82b1079416872e88036e5d11c0760821fad4320daf3667d932944069a8a09cf26152eae

Download Submit
C:\Windows\System\SBhwafk.exe

Filesize
1.5MB

MD5
758a57e6b0188adfa3932e9f3bcc6e6b

SHA1
0c2e413a8afa43e7012eeb207ac2958c98c44759

SHA256
9bc6123f833a7f30383f9116d886a16043569259bc48dc741c5c390a79c4b5eb

SHA512
a2b7a6a464ebd7c16dac8e3d98731ae77d5a11d36f1513a230544461be8429cf258b7d23faf703ade76f0404d4af25c0808bc59f97389a77d21dd511d0644b31

Download Submit
C:\Windows\System\SBwZXUd.exe

Filesize
1.5MB

MD5
91bc3ad42e8ad523000602dcb1d08a58

SHA1
7ebe54e6c5b6452e446e1ea964855e61847e7d45

SHA256
31b3a7e80ea6c9bfa71c3e43a33bbcee6cda2b8fe00ea663229a095c25251034

SHA512
8c7e70adf37a1e76d0cc6153ecad8be57bfa0c1a923a49f7671b7e1f4c8c865bd00ca3a1922401aa3fdaf447ecc24541897810c2f67aabe73125994dea027156

Download Submit
C:\Windows\System\TngfXUk.exe

Filesize
1.5MB

MD5
35856d234b5fc0d99468212d7bd80e40

SHA1
8dbad831f8f2d9ceae0f4a279b5c328e12a8b93f

SHA256
2e6c1c08e092221ff50325b3c875d4eeb87c4671f46bdc41b089ca3a13b010de

SHA512
de5cf4e0d65e1e6d608846d50549ddfe9b1518ce25e63fc32cfdc0c535dfd95d45984fdb8abe6a74bf00b0fee307a5cd5b523aaea1f6c3e0d58308dc8c176f55

Download Submit
C:\Windows\System\UoHBmDS.exe

Filesize
1.5MB

MD5
51dc93a2096bc713dae6533c67f316d9

SHA1
dcb328e38a5d47115853c26f3ef45b3cd672f7d8

SHA256
2cbfac833b1aa503ef3b57b1835d9ccef5d691fc2dbab2ce9d1a2a60ce1a80c9

SHA512
0cc7a13cfd0fc2454ffd1e2daa3b2dfc445ac3ecc8429b5139e3a44592926c6a6bc5c316d87bd98adb5f528284a72e2cb17ecac1e6d6447b0017f94b48ddf84d

Download Submit
C:\Windows\System\WambYyV.exe

Filesize
1.5MB

MD5
4e38962b50893e08ace609851898dd8c

SHA1
9ac104fa832f765fa71f529c72b16813524e54d9

SHA256
92037272822930c8a3b3a567774fc3411aafe6a5631d206fe053ac1677ce95fa

SHA512
2c0e3c4e862408640a0a51bbef8f2dd4b9a27f0a2f6b11f7cd275fd68be54e383d0da3f728ca1d1e3115358657e1f228b4120ea1043071e4d5434dfe207de2b2

Download Submit
C:\Windows\System\WbxrHAW.exe

Filesize
1.5MB

MD5
979da67dde0a9d7f8f2c146d698ecab1

SHA1
43e4a617186cbd849e75bea909c70c944b33add3

SHA256
aa98136bb44326bd226f947315c44414155d028e05c43105099e279cb7f6b532

SHA512
7688e8eb9b1825dc8f7c55a0a48c721139f66eb9940ea9e142b0b001456ee09d92cf277d4bf5bf31feae2e53dfc352d63d79931c4458d63c59e36fa6e04d7b1d

Download Submit
C:\Windows\System\XbChJaZ.exe

Filesize
1.5MB

MD5
4d7de4bad691e4c120f11708a23ad6d1

SHA1
88bcb68ad4757147f1b526892a1dc1ade6e73d9f

SHA256
c3ff57b4a86788ad6c917274734bd827a7d16b6cfbb5269fb82bec782eaaf0b5

SHA512
ee6bb92d9703f69cac4795049ed9448ddf364c7327f25a416e3873a53ef8fd8cf9fcb829d9a54001bc7fb37961453e67802f6d3a64b63225f8689a1a1025e4c9

Download Submit
C:\Windows\System\ZhzRfDY.exe

Filesize
1.5MB

MD5
22b7887f362e6ac4e58ece7d0142e310

SHA1
53ad75d081057891255e3451472aa64e7c5ce77e

SHA256
70bd678c6f9dd16eded387313ed6702bf52411e367979a595ed71b15b61762fa

SHA512
f9194dcd700233eef207cc4b926ad43298ee67db8f3e4114f1c54728cfb69a87dbcd8ccee3ca1eff0bf69d106599fb34c85ad8aa0fd1bdd04452c23cadcc3b06

Download Submit
C:\Windows\System\aEFEHyU.exe

Filesize
1.5MB

MD5
e73f6f086d827425dae586ffd1ede63e

SHA1
47a6f3f2cd98142f3150af150817419f0aa2c07e

SHA256
8057069030b316c636dec684b6909006092614bf075f91f1d4e9494361e76958

SHA512
cb286fc19e3939bd9a478aa602effe9bf8f35bac3047c6fd3c6d33ba276a247132bf87217d09f73bec611c416d782bd9cbce1ec1c0361d79973f5c78fcbdee39

Download Submit
C:\Windows\System\cEzwuBW.exe

Filesize
1.5MB

MD5
5d37410caf1562f685bf6a3fad6884b5

SHA1
5d35ae517543884b0f4b22703ecfe8d71d4db725

SHA256
a7b16007122074023941ec84591407970e29bc3e3e53943902f764727c0a6356

SHA512
c4c481b48dd1b777023f0b13ab745d2f941ac02b6e48f07e42d0c6131d43f86ba7d3a8df08b0b5a9bc07b8192b28ce29ff460627fdd1969e5542da0ee61a85eb

Download Submit
C:\Windows\System\dDxSkPO.exe

Filesize
1.5MB

MD5
0bc5fbd26770802b4469dc0af10ef819

SHA1
246c5f293e5d6c1b01c88f3f08b2dfd1075d2f89

SHA256
da5b8f22604f5df06ccf080806ab32300871efd35ddb408d6b66ede56a3a3842

SHA512
9aedd475aec80f693cb25e423fd2fb0fad57c31258071dcfb3d0ec8c882667df11562cd0482c33b2335004030585db47ae1be4be5675a0c736c9561cb0893c4e

Download Submit
C:\Windows\System\dIIJTne.exe

Filesize
1.5MB

MD5
41f6686d158358a885d3338a5bcc7852

SHA1
7679df0246050940d446fe439e7dfc6e64d6cb4d

SHA256
4a4bb310152dcebc47f05795c50a8e1c6055e0045b3cec5f425d8b2bf38fd47e

SHA512
6a1daeaf7c3c4522e370d15e7c6759560be98b0043bd8275a8e2346f41916d3e0e64c586b7184e279dbc4a3812f2fbba205f56697025ec9e5db4463f570022a5

Download Submit
C:\Windows\System\diypuUl.exe

Filesize
1.5MB

MD5
e24f0336c4d5260c90012316f0a9f36e

SHA1
fb4c459f9cd642c797f60f12e2702d46811485f2

SHA256
e6ceb508b5c10113935911a21e2dbeb8cef55aba72e6d90c27e9394775d52421

SHA512
b644133f80632708135be1963ba71bef73fc495b99a20783cf9b3b112ead1c259686bcc9ec6def92ed4002132e7546984d82ffffcad163a04431519736890702

Download Submit
C:\Windows\System\fBzRQVU.exe

Filesize
1.5MB

MD5
0927075f79ff03db1b88779c7b6563ae

SHA1
38418027552c98f0234704775a2595a5587e09cf

SHA256
fe750055db0f66a3316dc168d9d13bfc1cebe6cd39fa4f9ea92abc1507a0c602

SHA512
f65bad64c451626b6392122609cae375e80b6f7b16b4cc143167158b73524c60676950c1d74f0894ecf3682cf99f2687216b23c13a228932da6ca6b10f59015b

Download Submit
C:\Windows\System\hqgrsVw.exe

Filesize
1.5MB

MD5
eea735026cb3d5d5b334b79d61b85c31

SHA1
e67f431f7c55ba2934d26fbab21700fc7174028c

SHA256
4ac05fd7696bcf424b4bc984e3c9da9a79d3e4edc29639ba416f585de73fba23

SHA512
38913e36e48edaf648dcf83818fbc62c5cd294e2333e5097614ebb51f99f2c54ba2d3b2bda55c88f7018d7b9a3d97d763c1978b3e6692143b68825a054084297

Download Submit
C:\Windows\System\nRVwSho.exe

Filesize
1.5MB

MD5
658e4440bc5bf65d8ee4cf384db0260a

SHA1
5c47b9bc5af287f9f4030b5623a48b1b227b23d8

SHA256
c31098d6f591bfda80e86894f072afef52f42b0ccb03568f328012b2546c3114

SHA512
25ae7ec84728ec553ca54d20f28840500329983597ebb02b0ed3e9dce7b268cc3181c7b90c65a123e332f5620e3b7b939d81c4f239976797da7489af622ff688

Download Submit
C:\Windows\System\rMIZDxO.exe

Filesize
1.5MB

MD5
b2e4d9d2006cd2a58ff3899c92434191

SHA1
151aec4c849a6a1030ed15a31e63b9285f64cc03

SHA256
308c3fc06c3c3cfdf83a1f89b147db8b5fda9a693c412ac8da02e07886770791

SHA512
3c8864b6697c64fd990ceeecbcb8d67b4c8b8d638837f63fc77cd5dc6eb76442d98ff95b8bcd0f20f7754a54ce071e7c94889bf66b6f42acb5b46f1b4c84d6a2

Download Submit
C:\Windows\System\rZPrMhE.exe

Filesize
1.5MB

MD5
e2a17f1245fbd0238dd32316fcd7bce9

SHA1
0431b8a004906808883a2f19796c6518ceceb52f

SHA256
b1701b1bfcf4707c93725e41ffb2392ddf0f439e35eb41f86ae6d7dbfc2ab8be

SHA512
a724f6993e00f9fc8997ddf9f4c2f937f6eeef5c6054a11c4d0bb68f0c60f1a16d41690207d4b0cda457327ca35354062a4bfcd20026a5f6769d604477404e81

Download Submit
C:\Windows\System\rheCxGc.exe

Filesize
1.5MB

MD5
c6c1197fc4dbcee5e46d633dcaabbd19

SHA1
0cee3131bdb1cc3502a2dbd2eb39d2bd6fc2630e

SHA256
204fa353d1e346b54cfb881e9c3d40d78cb0dcbe2f4c6170cbc1c33de1a4e612

SHA512
8fcf73668f14e2884b8e13524387f7478320dbca2c66dc68d4b448a991ede5b0e66905126c34486ac73d89463843729896cd0830d96ff1e293931e817c12dc2d

Download Submit
C:\Windows\System\rtXyadW.exe

Filesize
1.5MB

MD5
ab3ff65d27143e717e4d4e0bfc70e2cb

SHA1
b993aa952acfd8dd09d6bc4059d80524336ba90b

SHA256
219a627f8eb7cbb345511ff2846c1bd1eb73fbf6d6452aea9926141674034d8c

SHA512
b4e929a48c7fcb60c5c870eb47bc930d84cdf5363236fc806b557c699323ff77253502e36a8e6809d672c8876e4599d6ad9f7da2aecd931df4d980451669c97e

Download Submit
C:\Windows\System\sUyPTHx.exe

Filesize
1.5MB

MD5
32ca0cf031d351ce853ae54364016103

SHA1
a41f9ec22f4e1f2a02e72160891c12d9d7842211

SHA256
44f5d6da8e712c8078840e5bcd97e7b41f48583fbe09bf4279c5f42b4231f539

SHA512
44be928325c34d717c43732d09d825087104a4e9fb8b9c0b7976d432e3fdfb257606fa00a86902d121ff83df9f43728dbb4a2f6e948177d142a070e3b272bace

Download Submit
C:\Windows\System\txyFAcf.exe

Filesize
1.5MB

MD5
13dd8d389d8b981e7c30ac8a7ca03f34

SHA1
e3af67758cb5808f9dc5f7654a96fc3a7126c887

SHA256
66dd560c6cd5241392f1f0d30fc738ad99aec3d94dee8c3df534aa01de0b1c80

SHA512
554ffccc2638d940e7d6f44faecaa68c9d227dfd14d6ce5f0b4f408cf675783b8afbeb4154bd31b7f75b44119e6b37b2481d0fcd06c5339db4cd6a8348d756e3

Download Submit
C:\Windows\System\vnEQZJP.exe

Filesize
1.5MB

MD5
9f2a1ada09b869258c4b092e3e7506d3

SHA1
01335d229fca5de42c66da9aba92b90f915609e6

SHA256
900a64ef3a074c45bec00906bd3ef58087d4c010614e2ba642dbc7fb4af91e97

SHA512
74185455386c9e8cd6cc0d3292594b40eb9b75b4b914cc4e976a16409b88fa4e21f2d7136fc998abd76119c647c92072b7f7e0efd5c9e221cc615b1c7211f582

Download Submit
C:\Windows\System\wfraXvh.exe

Filesize
1.5MB

MD5
1f454cb3db7c302184fb2c6d3e8e214d

SHA1
091250aa3d06021c3825fde007554fff991eda9a

SHA256
ab9637e4865964badc87943b934b16fb6c710ce19ba74f8e3978c111b69e8c72

SHA512
efafccd3e47eefbd04689c3393a99fb531998ad23dbaa87eaada4bb8309a9c5a59ac09ffc156fa506c0597b600c61aecdb06411bdc80a347c9f2f849971d9f29

Download Submit
C:\Windows\System\xVPhbUv.exe

Filesize
1.5MB

MD5
2ae28f31f55e6a14bb978eaeea4be1f9

SHA1
e3f9941a8e66ed3225d83e5e807daf5d282d547b

SHA256
a49e535fb5e011e686dad94c86efc0a4b250890035c24afef6a07a31b5049121

SHA512
7a617f99523947b9c450077cec43cf416728916bbd367a6931147d3318250130433e33d8744f2392bbd08eaaa3fe4bd9edc498866db257ddd5bd19ff4535ab59

Download Submit
C:\Windows\System\zKoJcqH.exe

Filesize
1.5MB

MD5
2956c94ca3729e7be4da8db99e1d5186

SHA1
ef1b951070759ed88b05c4dbabc4f46ab19a05e4

SHA256
848cae81fcb491e5c16ae484e8d00c2353835c0d3c315f504ef2ad125d4a137c

SHA512
45ec743b53305ea299d72db85fc6b111d6b318c44b9e8f3ec87bd86c92d1e28492a0f89dbcfcf617448c61c3cc88c0b22ae1a145c9840f3aaa67f74ea968ccd1

Download Submit
C:\Windows\System\zmhdoKX.exe

Filesize
1.5MB

MD5
69a8bed4b048891dfbe862cedbb2d7ed

SHA1
07e7b78fc162862fb64cb77abb0b8fd6748975b4

SHA256
7a4e5b295dddb4882048f4c39105a55f90184726666dd15fa6a8a22a9d848789

SHA512
17f6c54ff895af57a4cfd0ecf89f7f6bd296533454dd28a0a44e90bc6140d8320d26ee131accb13d0504f40d7a98bc77faf2f07d55a04b6fe82570fb7bfab349

Download Submit
memory/328-2802-0x00007FF65C290000-0x00007FF65C682000-memory.dmp

Filesize
3.9MB

Download
memory/860-2845-0x00007FF7A6280000-0x00007FF7A6672000-memory.dmp

Filesize
3.9MB

Download
memory/860-550-0x00007FF7A6280000-0x00007FF7A6672000-memory.dmp

Filesize
3.9MB

Download
memory/1108-680-0x00007FF7BBD60000-0x00007FF7BC152000-memory.dmp

Filesize
3.9MB

Download
memory/1108-2836-0x00007FF7BBD60000-0x00007FF7BC152000-memory.dmp

Filesize
3.9MB

Download
memory/1172-2817-0x00007FF6D0560000-0x00007FF6D0952000-memory.dmp

Filesize
3.9MB

Download
memory/1172-727-0x00007FF6D0560000-0x00007FF6D0952000-memory.dmp

Filesize
3.9MB

Download
memory/1200-2790-0x00007FF7AFB10000-0x00007FF7AFF02000-memory.dmp

Filesize
3.9MB

Download
memory/1200-369-0x00007FF7AFB10000-0x00007FF7AFF02000-memory.dmp

Filesize
3.9MB

Download
memory/1636-914-0x00007FF7A7090000-0x00007FF7A7482000-memory.dmp

Filesize
3.9MB

Download
memory/1636-2830-0x00007FF7A7090000-0x00007FF7A7482000-memory.dmp

Filesize
3.9MB

Download
memory/1864-547-0x00007FF70A640000-0x00007FF70AA32000-memory.dmp

Filesize
3.9MB

Download
memory/1864-2789-0x00007FF70A640000-0x00007FF70AA32000-memory.dmp

Filesize
3.9MB

Download
memory/1868-466-0x00007FF719AD0000-0x00007FF719EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1868-2804-0x00007FF719AD0000-0x00007FF719EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1876-549-0x00007FF766E40000-0x00007FF767232000-memory.dmp

Filesize
3.9MB

Download
memory/1876-2795-0x00007FF766E40000-0x00007FF767232000-memory.dmp

Filesize
3.9MB

Download
memory/2252-2786-0x00007FF6B2290000-0x00007FF6B2682000-memory.dmp

Filesize
3.9MB

Download
memory/2252-38-0x00007FF6B2290000-0x00007FF6B2682000-memory.dmp

Filesize
3.9MB

Download
memory/2272-2684-0x00007FF670550000-0x00007FF670942000-memory.dmp

Filesize
3.9MB

Download
memory/2272-1-0x000001E110CB0000-0x000001E110CC0000-memory.dmp

Filesize
64KB

Download
memory/2272-0-0x00007FF670550000-0x00007FF670942000-memory.dmp

Filesize
3.9MB

Download
memory/2632-2842-0x00007FF7F84D0000-0x00007FF7F88C2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-1102-0x00007FF7F84D0000-0x00007FF7F88C2000-memory.dmp

Filesize
3.9MB

Download
memory/2776-2785-0x00007FF68ACD0000-0x00007FF68B0C2000-memory.dmp

Filesize
3.9MB

Download
memory/2776-228-0x00007FF68ACD0000-0x00007FF68B0C2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-2808-0x00007FF6C0040000-0x00007FF6C0432000-memory.dmp

Filesize
3.9MB

Download
memory/2988-554-0x00007FF6C0040000-0x00007FF6C0432000-memory.dmp

Filesize
3.9MB

Download
memory/3036-2807-0x00007FF7D02E0000-0x00007FF7D06D2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-552-0x00007FF7D02E0000-0x00007FF7D06D2000-memory.dmp

Filesize
3.9MB

Download
memory/3312-579-0x00007FF7DBD70000-0x00007FF7DC162000-memory.dmp

Filesize
3.9MB

Download
memory/3312-2835-0x00007FF7DBD70000-0x00007FF7DC162000-memory.dmp

Filesize
3.9MB

Download
memory/3436-1179-0x00007FF6E78D0000-0x00007FF6E7CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3436-2840-0x00007FF6E78D0000-0x00007FF6E7CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3636-2792-0x00007FF6305E0000-0x00007FF6309D2000-memory.dmp

Filesize
3.9MB

Download
memory/3636-297-0x00007FF6305E0000-0x00007FF6309D2000-memory.dmp

Filesize
3.9MB

Download
memory/4104-2799-0x00007FF629330000-0x00007FF629722000-memory.dmp

Filesize
3.9MB

Download
memory/4104-726-0x00007FF629330000-0x00007FF629722000-memory.dmp

Filesize
3.9MB

Download
memory/4732-2810-0x00007FF73E910000-0x00007FF73ED02000-memory.dmp

Filesize
3.9MB

Download
memory/4732-553-0x00007FF73E910000-0x00007FF73ED02000-memory.dmp

Filesize
3.9MB

Download
memory/4804-2797-0x00007FF7DE100000-0x00007FF7DE4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4804-551-0x00007FF7DE100000-0x00007FF7DE4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-2801-0x00007FF6495B0000-0x00007FF6499A2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-548-0x00007FF6495B0000-0x00007FF6499A2000-memory.dmp

Filesize
3.9MB

Download
memory/4896-2818-0x00007FF60CB60000-0x00007FF60CF52000-memory.dmp

Filesize
3.9MB

Download
memory/4896-1844-0x00007FF60CB60000-0x00007FF60CF52000-memory.dmp

Filesize
3.9MB

Download
memory/4952-181-0x00007FFBFE3A0000-0x00007FFBFEE61000-memory.dmp

Filesize
10.8MB

Download
memory/4952-640-0x000001A6746A0000-0x000001A6746C2000-memory.dmp

Filesize
136KB

Download
memory/4952-41-0x00007FFBFE3A3000-0x00007FFBFE3A5000-memory.dmp

Filesize
8KB

Download