xmrig | 9363fa4c2aa5c3cf2cd391aa33725e82e1ddee2413a2101da720e471da2d889b

Analysis

max time kernel
148s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
Size 1.6MB
Sample240529-e4a6wsbd23
SHA256 9363fa4c2aa5c3cf2cd391aa33725e82e1ddee2413a2101da720e471da2d889b
MD5 3e85360a653cb2f6ee6f6118b49bad60
SHA1 f4db6f737c405008bb6be9c59402c7ca9e973d4f
SHA512 9c4a1206c56d6d2ce6f264f02aeefb805356a151b31239056e7f9fc18394af80e576867936747f270bd3d89936ac04a873005534f2f56e1ad6fb2ce16376696d
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fi:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 31 IoCs

miner

resource	yara_rule
behavioral1/memory/1456-18-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/2648-22-0x000000013FBF0000-0x000000013FF41000-memory.dmp	xmrig
behavioral1/memory/2004-37-0x000000013F180000-0x000000013F4D1000-memory.dmp	xmrig
behavioral1/memory/1456-58-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/1936-66-0x000000013FE70000-0x00000001401C1000-memory.dmp	xmrig
behavioral1/memory/2560-891-0x000000013F1E0000-0x000000013F531000-memory.dmp	xmrig
behavioral1/memory/2832-123-0x000000013F510000-0x000000013F861000-memory.dmp	xmrig
behavioral1/memory/1936-122-0x0000000001F20000-0x0000000002271000-memory.dmp	xmrig
behavioral1/memory/2268-121-0x000000013F350000-0x000000013F6A1000-memory.dmp	xmrig
behavioral1/memory/1936-97-0x000000013FA40000-0x000000013FD91000-memory.dmp	xmrig
behavioral1/memory/1936-96-0x0000000001F20000-0x0000000002271000-memory.dmp	xmrig
behavioral1/memory/1392-92-0x000000013FB50000-0x000000013FEA1000-memory.dmp	xmrig
behavioral1/memory/2684-80-0x000000013F4A0000-0x000000013F7F1000-memory.dmp	xmrig
behavioral1/memory/1936-57-0x000000013F530000-0x000000013F881000-memory.dmp	xmrig
behavioral1/memory/2572-65-0x000000013FCC0000-0x0000000140011000-memory.dmp	xmrig
behavioral1/memory/1936-55-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/2428-54-0x000000013F4D0000-0x000000013F821000-memory.dmp	xmrig
behavioral1/memory/2428-3854-0x000000013F4D0000-0x000000013F821000-memory.dmp	xmrig
behavioral1/memory/1020-4326-0x000000013FA40000-0x000000013FD91000-memory.dmp	xmrig
behavioral1/memory/2560-4342-0x000000013F1E0000-0x000000013F531000-memory.dmp	xmrig
behavioral1/memory/2496-4344-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/580-4354-0x000000013F110000-0x000000013F461000-memory.dmp	xmrig
behavioral1/memory/2684-4380-0x000000013F4A0000-0x000000013F7F1000-memory.dmp	xmrig
behavioral1/memory/2004-4388-0x000000013F180000-0x000000013F4D1000-memory.dmp	xmrig
behavioral1/memory/1456-4387-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/2932-4386-0x000000013FE70000-0x00000001401C1000-memory.dmp	xmrig
behavioral1/memory/2832-4424-0x000000013F510000-0x000000013F861000-memory.dmp	xmrig
behavioral1/memory/2572-4659-0x000000013FCC0000-0x0000000140011000-memory.dmp	xmrig
behavioral1/memory/2648-4672-0x000000013FBF0000-0x000000013FF41000-memory.dmp	xmrig
behavioral1/memory/2268-4673-0x000000013F350000-0x000000013F6A1000-memory.dmp	xmrig
behavioral1/memory/1392-4773-0x000000013FB50000-0x000000013FEA1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1456	MbJdSZJ.exe
2572	FNeASFk.exe
2648	GtzVfEO.exe
2684	mANShAJ.exe
2004	ofGoFCa.exe
2560	bXMOqxy.exe
2428	HyZywms.exe
2496	tMDJAjw.exe
2932	McnLCvK.exe
580	wpAKvRP.exe
1392	cvXGEYS.exe
1020	meuRIBC.exe
2268	vVwCnTj.exe
2832	rKhsGin.exe
2800	GtopvVr.exe
2252	ippQnQj.exe
956	GHYogEM.exe
1376	yACgWBW.exe
952	FOgehVe.exe
2492	LcicoCX.exe
2272	ElSMwFZ.exe
1040	KsGYitI.exe
1656	MkDlhCs.exe
2700	jTERxNf.exe
1516	xMKBKpG.exe
596	NbFqVso.exe
468	NTzukWq.exe
2316	oWwawyP.exe
2336	EgASbOv.exe
2364	ngNENCX.exe
2240	ASbddWM.exe
3048	NuPgtHJ.exe
400	aqHeOwg.exe
1444	IEhrpcA.exe
1696	QLTPLJI.exe
960	nzfwlsu.exe
1984	IPyBUGo.exe
1384	YACXUBO.exe
1836	GEqzZlw.exe
1140	KuIOnUP.exe
2176	zdQcKVY.exe
1884	JQpOLUq.exe
560	tQDEVvB.exe
2200	JkFqeCT.exe
1088	ljxlZFe.exe
2892	uLyeRol.exe
844	JnWMAzK.exe
1612	OcHTuuN.exe
2204	JrcjIhN.exe
900	oiXjeHH.exe
2196	KPaUQOI.exe
2916	SqiUNwg.exe
1708	SHkbMiQ.exe
2632	mvMYNjh.exe
2964	lfkTbSZ.exe
2904	mdUsXfM.exe
2888	HsXJanB.exe
1560	kFimYcO.exe
2568	aXwhwqX.exe
2516	VqfkOHe.exe
2264	Gsujsih.exe
2440	QXasJkm.exe
2280	IHpDaCG.exe
2532	iIJwxKz.exe

Loads dropped DLL 64 IoCs

pid	Process
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1936-0-0x000000013F530000-0x000000013F881000-memory.dmp	upx
behavioral1/files/0x002e000000015364-3.dat	upx
behavioral1/files/0x002c0000000155d4-9.dat	upx
behavioral1/files/0x0008000000015a2d-11.dat	upx
behavioral1/memory/1456-18-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/memory/2648-22-0x000000013FBF0000-0x000000013FF41000-memory.dmp	upx
behavioral1/files/0x0007000000015a98-24.dat	upx
behavioral1/memory/2572-19-0x000000013FCC0000-0x0000000140011000-memory.dmp	upx
behavioral1/memory/2684-29-0x000000013F4A0000-0x000000013F7F1000-memory.dmp	upx
behavioral1/files/0x00120000000155d9-31.dat	upx
behavioral1/memory/2004-37-0x000000013F180000-0x000000013F4D1000-memory.dmp	upx
behavioral1/files/0x0007000000015c23-47.dat	upx
behavioral1/files/0x0007000000015c0d-42.dat	upx
behavioral1/files/0x0009000000015c2f-49.dat	upx
behavioral1/memory/1456-58-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/memory/2932-67-0x000000013FE70000-0x00000001401C1000-memory.dmp	upx
behavioral1/files/0x0006000000016d89-84.dat	upx
behavioral1/files/0x000600000001704f-110.dat	upx
behavioral1/files/0x00050000000186a0-134.dat	upx
behavioral1/files/0x0006000000018d06-184.dat	upx
behavioral1/memory/2560-891-0x000000013F1E0000-0x000000013F531000-memory.dmp	upx
behavioral1/files/0x00050000000192f4-196.dat	upx
behavioral1/files/0x0006000000018b96-183.dat	upx
behavioral1/files/0x00050000000192c9-190.dat	upx
behavioral1/files/0x0006000000018ba2-178.dat	upx
behavioral1/files/0x0006000000018b73-170.dat	upx
behavioral1/files/0x0006000000018b6a-164.dat	upx
behavioral1/files/0x0006000000018b42-149.dat	upx
behavioral1/files/0x0006000000018ae8-143.dat	upx
behavioral1/files/0x0006000000018b33-141.dat	upx
behavioral1/files/0x0006000000018b4a-155.dat	upx
behavioral1/files/0x000500000001868c-124.dat	upx
behavioral1/memory/2832-123-0x000000013F510000-0x000000013F861000-memory.dmp	upx
behavioral1/files/0x0006000000018b37-147.dat	upx
behavioral1/memory/2268-121-0x000000013F350000-0x000000013F6A1000-memory.dmp	upx
behavioral1/files/0x0006000000018b15-138.dat	upx
behavioral1/memory/1020-98-0x000000013FA40000-0x000000013FD91000-memory.dmp	upx
behavioral1/files/0x0006000000018ae2-128.dat	upx
behavioral1/files/0x0005000000018698-115.dat	upx
behavioral1/files/0x0006000000017090-104.dat	upx
behavioral1/files/0x0006000000016d55-69.dat	upx
behavioral1/memory/1392-92-0x000000013FB50000-0x000000013FEA1000-memory.dmp	upx
behavioral1/files/0x0006000000016e56-91.dat	upx
behavioral1/memory/2684-80-0x000000013F4A0000-0x000000013F7F1000-memory.dmp	upx
behavioral1/memory/580-79-0x000000013F110000-0x000000013F461000-memory.dmp	upx
behavioral1/files/0x0006000000016d84-76.dat	upx
behavioral1/memory/2496-59-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/memory/1936-57-0x000000013F530000-0x000000013F881000-memory.dmp	upx
behavioral1/memory/2572-65-0x000000013FCC0000-0x0000000140011000-memory.dmp	upx
behavioral1/files/0x0009000000015c3c-62.dat	upx
behavioral1/memory/2428-54-0x000000013F4D0000-0x000000013F821000-memory.dmp	upx
behavioral1/memory/2560-43-0x000000013F1E0000-0x000000013F531000-memory.dmp	upx
behavioral1/memory/2428-3854-0x000000013F4D0000-0x000000013F821000-memory.dmp	upx
behavioral1/memory/1020-4326-0x000000013FA40000-0x000000013FD91000-memory.dmp	upx
behavioral1/memory/2560-4342-0x000000013F1E0000-0x000000013F531000-memory.dmp	upx
behavioral1/memory/2496-4344-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/memory/580-4354-0x000000013F110000-0x000000013F461000-memory.dmp	upx
behavioral1/memory/2684-4380-0x000000013F4A0000-0x000000013F7F1000-memory.dmp	upx
behavioral1/memory/2004-4388-0x000000013F180000-0x000000013F4D1000-memory.dmp	upx
behavioral1/memory/1456-4387-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/memory/2932-4386-0x000000013FE70000-0x00000001401C1000-memory.dmp	upx
behavioral1/memory/2832-4424-0x000000013F510000-0x000000013F861000-memory.dmp	upx
behavioral1/memory/2572-4659-0x000000013FCC0000-0x0000000140011000-memory.dmp	upx
behavioral1/memory/2648-4672-0x000000013FBF0000-0x000000013FF41000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HyZywms.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\qzOTNPW.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\IckVvfo.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\ECJukWY.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\sFamdcV.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\QsaGvBb.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\hdDxCJC.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\vLdIsQF.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\wyfvAfS.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\rGRGhAl.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\MeqbImO.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\VjbpxOM.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\SrMeDJK.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\gHBLSBI.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\asfDIaO.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\aRWCHFS.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\HfbgwuZ.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\esApIbf.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\fKkVbQi.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\qvZMDTm.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\FKpwIZe.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\syraDpD.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\tUwKsWL.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\IAIrlfD.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\KshBZeO.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\yACgWBW.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\RBARroX.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\LGUxAkF.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\gWiKGjX.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\fYcqwKA.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\kjomnVt.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\lRWuKax.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\eYvUrLQ.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\YQyYqeH.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\SoWgYmX.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\StBmRiD.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\qCDbkJb.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\OZOZpoR.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\fLkUkYI.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\uSqLzSZ.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\EjOMpep.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\hqOjuvw.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\ZoXUopf.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\PdPuYMY.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\EMLDwFW.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\sYtLcBV.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\GyClIJE.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\ptLsTrQ.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\bJJtEdQ.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\gOeucuq.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\MlTVvHw.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\qzRMBZT.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\uFpsUrx.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\KuIOnUP.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\TCIaWsR.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\ycxZOAa.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\rcYeYJk.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\oULGrrV.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\JrFKipi.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\lfkTbSZ.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\JrcjIhN.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\eFTuPhr.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\Cjzlmni.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
File created	C:\Windows\System\HCaGdth.exe	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1456	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	29
PID 1936 wrote to memory of 1456	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	29
PID 1936 wrote to memory of 1456	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	29
PID 1936 wrote to memory of 2572	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	30
PID 1936 wrote to memory of 2572	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	30
PID 1936 wrote to memory of 2572	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	30
PID 1936 wrote to memory of 2648	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	31
PID 1936 wrote to memory of 2648	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	31
PID 1936 wrote to memory of 2648	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	31
PID 1936 wrote to memory of 2684	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	32
PID 1936 wrote to memory of 2684	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	32
PID 1936 wrote to memory of 2684	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	32
PID 1936 wrote to memory of 2004	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	33
PID 1936 wrote to memory of 2004	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	33
PID 1936 wrote to memory of 2004	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	33
PID 1936 wrote to memory of 2560	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	34
PID 1936 wrote to memory of 2560	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	34
PID 1936 wrote to memory of 2560	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	34
PID 1936 wrote to memory of 2428	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	35
PID 1936 wrote to memory of 2428	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	35
PID 1936 wrote to memory of 2428	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	35
PID 1936 wrote to memory of 2496	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	36
PID 1936 wrote to memory of 2496	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	36
PID 1936 wrote to memory of 2496	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	36
PID 1936 wrote to memory of 2932	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	37
PID 1936 wrote to memory of 2932	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	37
PID 1936 wrote to memory of 2932	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	37
PID 1936 wrote to memory of 1392	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	38
PID 1936 wrote to memory of 1392	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	38
PID 1936 wrote to memory of 1392	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	38
PID 1936 wrote to memory of 580	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	39
PID 1936 wrote to memory of 580	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	39
PID 1936 wrote to memory of 580	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	39
PID 1936 wrote to memory of 2268	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	40
PID 1936 wrote to memory of 2268	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	40
PID 1936 wrote to memory of 2268	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	40
PID 1936 wrote to memory of 1020	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	41
PID 1936 wrote to memory of 1020	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	41
PID 1936 wrote to memory of 1020	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	41
PID 1936 wrote to memory of 2800	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	42
PID 1936 wrote to memory of 2800	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	42
PID 1936 wrote to memory of 2800	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	42
PID 1936 wrote to memory of 2832	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	43
PID 1936 wrote to memory of 2832	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	43
PID 1936 wrote to memory of 2832	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	43
PID 1936 wrote to memory of 956	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	44
PID 1936 wrote to memory of 956	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	44
PID 1936 wrote to memory of 956	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	44
PID 1936 wrote to memory of 2252	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	45
PID 1936 wrote to memory of 2252	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	45
PID 1936 wrote to memory of 2252	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	45
PID 1936 wrote to memory of 952	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	46
PID 1936 wrote to memory of 952	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	46
PID 1936 wrote to memory of 952	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	46
PID 1936 wrote to memory of 1376	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	47
PID 1936 wrote to memory of 1376	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	47
PID 1936 wrote to memory of 1376	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	47
PID 1936 wrote to memory of 2272	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	48
PID 1936 wrote to memory of 2272	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	48
PID 1936 wrote to memory of 2272	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	48
PID 1936 wrote to memory of 2492	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	49
PID 1936 wrote to memory of 2492	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	49
PID 1936 wrote to memory of 2492	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	49
PID 1936 wrote to memory of 2700	1936	3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3e85360a653cb2f6ee6f6118b49bad60_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\System\MbJdSZJ.exe
  C:\Windows\System\MbJdSZJ.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\FNeASFk.exe
  C:\Windows\System\FNeASFk.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\GtzVfEO.exe
  C:\Windows\System\GtzVfEO.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\mANShAJ.exe
  C:\Windows\System\mANShAJ.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\ofGoFCa.exe
  C:\Windows\System\ofGoFCa.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\bXMOqxy.exe
  C:\Windows\System\bXMOqxy.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\HyZywms.exe
  C:\Windows\System\HyZywms.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\tMDJAjw.exe
  C:\Windows\System\tMDJAjw.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\McnLCvK.exe
  C:\Windows\System\McnLCvK.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\cvXGEYS.exe
  C:\Windows\System\cvXGEYS.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\wpAKvRP.exe
  C:\Windows\System\wpAKvRP.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\vVwCnTj.exe
  C:\Windows\System\vVwCnTj.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\meuRIBC.exe
  C:\Windows\System\meuRIBC.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\GtopvVr.exe
  C:\Windows\System\GtopvVr.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\rKhsGin.exe
  C:\Windows\System\rKhsGin.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\GHYogEM.exe
  C:\Windows\System\GHYogEM.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\ippQnQj.exe
  C:\Windows\System\ippQnQj.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\FOgehVe.exe
  C:\Windows\System\FOgehVe.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\yACgWBW.exe
  C:\Windows\System\yACgWBW.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\ElSMwFZ.exe
  C:\Windows\System\ElSMwFZ.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\LcicoCX.exe
  C:\Windows\System\LcicoCX.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\jTERxNf.exe
  C:\Windows\System\jTERxNf.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\KsGYitI.exe
  C:\Windows\System\KsGYitI.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\xMKBKpG.exe
  C:\Windows\System\xMKBKpG.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\MkDlhCs.exe
  C:\Windows\System\MkDlhCs.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\NbFqVso.exe
  C:\Windows\System\NbFqVso.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\NTzukWq.exe
  C:\Windows\System\NTzukWq.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\EgASbOv.exe
  C:\Windows\System\EgASbOv.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\oWwawyP.exe
  C:\Windows\System\oWwawyP.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\ngNENCX.exe
  C:\Windows\System\ngNENCX.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\ASbddWM.exe
  C:\Windows\System\ASbddWM.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\NuPgtHJ.exe
  C:\Windows\System\NuPgtHJ.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\aqHeOwg.exe
  C:\Windows\System\aqHeOwg.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\nzfwlsu.exe
  C:\Windows\System\nzfwlsu.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\IEhrpcA.exe
  C:\Windows\System\IEhrpcA.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\IPyBUGo.exe
  C:\Windows\System\IPyBUGo.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\QLTPLJI.exe
  C:\Windows\System\QLTPLJI.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\YACXUBO.exe
  C:\Windows\System\YACXUBO.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\GEqzZlw.exe
  C:\Windows\System\GEqzZlw.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\KuIOnUP.exe
  C:\Windows\System\KuIOnUP.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\zdQcKVY.exe
  C:\Windows\System\zdQcKVY.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\JkFqeCT.exe
  C:\Windows\System\JkFqeCT.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\JQpOLUq.exe
  C:\Windows\System\JQpOLUq.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\ljxlZFe.exe
  C:\Windows\System\ljxlZFe.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\tQDEVvB.exe
  C:\Windows\System\tQDEVvB.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\uLyeRol.exe
  C:\Windows\System\uLyeRol.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\JnWMAzK.exe
  C:\Windows\System\JnWMAzK.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\KPaUQOI.exe
  C:\Windows\System\KPaUQOI.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\OcHTuuN.exe
  C:\Windows\System\OcHTuuN.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\lfkTbSZ.exe
  C:\Windows\System\lfkTbSZ.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\JrcjIhN.exe
  C:\Windows\System\JrcjIhN.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\mdUsXfM.exe
  C:\Windows\System\mdUsXfM.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\oiXjeHH.exe
  C:\Windows\System\oiXjeHH.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\HsXJanB.exe
  C:\Windows\System\HsXJanB.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\SqiUNwg.exe
  C:\Windows\System\SqiUNwg.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\kFimYcO.exe
  C:\Windows\System\kFimYcO.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\SHkbMiQ.exe
  C:\Windows\System\SHkbMiQ.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\VqfkOHe.exe
  C:\Windows\System\VqfkOHe.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\mvMYNjh.exe
  C:\Windows\System\mvMYNjh.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\Gsujsih.exe
  C:\Windows\System\Gsujsih.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\aXwhwqX.exe
  C:\Windows\System\aXwhwqX.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\QXasJkm.exe
  C:\Windows\System\QXasJkm.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\IHpDaCG.exe
  C:\Windows\System\IHpDaCG.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\iIJwxKz.exe
  C:\Windows\System\iIJwxKz.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\GaLVmaO.exe
  C:\Windows\System\GaLVmaO.exe
  2⤵
  PID:1600
- C:\Windows\System\nFinmpn.exe
  C:\Windows\System\nFinmpn.exe
  2⤵
  PID:2768
- C:\Windows\System\aZpWuWU.exe
  C:\Windows\System\aZpWuWU.exe
  2⤵
  PID:3028
- C:\Windows\System\YSwkKbm.exe
  C:\Windows\System\YSwkKbm.exe
  2⤵
  PID:948
- C:\Windows\System\SkSODZj.exe
  C:\Windows\System\SkSODZj.exe
  2⤵
  PID:276
- C:\Windows\System\AyCDxIf.exe
  C:\Windows\System\AyCDxIf.exe
  2⤵
  PID:1332
- C:\Windows\System\ixsqETR.exe
  C:\Windows\System\ixsqETR.exe
  2⤵
  PID:2520
- C:\Windows\System\bWqigEi.exe
  C:\Windows\System\bWqigEi.exe
  2⤵
  PID:840
- C:\Windows\System\tQbIRgQ.exe
  C:\Windows\System\tQbIRgQ.exe
  2⤵
  PID:944
- C:\Windows\System\dOzUbPD.exe
  C:\Windows\System\dOzUbPD.exe
  2⤵
  PID:1776
- C:\Windows\System\QJomHlV.exe
  C:\Windows\System\QJomHlV.exe
  2⤵
  PID:1520
- C:\Windows\System\soveJRa.exe
  C:\Windows\System\soveJRa.exe
  2⤵
  PID:2080
- C:\Windows\System\DZXkSau.exe
  C:\Windows\System\DZXkSau.exe
  2⤵
  PID:2104
- C:\Windows\System\pMfrYLb.exe
  C:\Windows\System\pMfrYLb.exe
  2⤵
  PID:2392
- C:\Windows\System\jPEQHFO.exe
  C:\Windows\System\jPEQHFO.exe
  2⤵
  PID:1304
- C:\Windows\System\yDHKvSw.exe
  C:\Windows\System\yDHKvSw.exe
  2⤵
  PID:856
- C:\Windows\System\PKpLDBf.exe
  C:\Windows\System\PKpLDBf.exe
  2⤵
  PID:1680
- C:\Windows\System\qZjACzw.exe
  C:\Windows\System\qZjACzw.exe
  2⤵
  PID:2036
- C:\Windows\System\QGSyAgG.exe
  C:\Windows\System\QGSyAgG.exe
  2⤵
  PID:1344
- C:\Windows\System\wfyxTGI.exe
  C:\Windows\System\wfyxTGI.exe
  2⤵
  PID:1756
- C:\Windows\System\IAIrlfD.exe
  C:\Windows\System\IAIrlfD.exe
  2⤵
  PID:828
- C:\Windows\System\YFliHYT.exe
  C:\Windows\System\YFliHYT.exe
  2⤵
  PID:1824
- C:\Windows\System\xqRdzbE.exe
  C:\Windows\System\xqRdzbE.exe
  2⤵
  PID:2900
- C:\Windows\System\PCUZDZQ.exe
  C:\Windows\System\PCUZDZQ.exe
  2⤵
  PID:2884
- C:\Windows\System\tHaTIEB.exe
  C:\Windows\System\tHaTIEB.exe
  2⤵
  PID:2220
- C:\Windows\System\qzOTNPW.exe
  C:\Windows\System\qzOTNPW.exe
  2⤵
  PID:2032
- C:\Windows\System\WUvtuWU.exe
  C:\Windows\System\WUvtuWU.exe
  2⤵
  PID:2140
- C:\Windows\System\ClajRtC.exe
  C:\Windows\System\ClajRtC.exe
  2⤵
  PID:1764
- C:\Windows\System\ZZUQmNb.exe
  C:\Windows\System\ZZUQmNb.exe
  2⤵
  PID:2976
- C:\Windows\System\GmoySpn.exe
  C:\Windows\System\GmoySpn.exe
  2⤵
  PID:1628
- C:\Windows\System\zFBcWxW.exe
  C:\Windows\System\zFBcWxW.exe
  2⤵
  PID:2720
- C:\Windows\System\QtgAnaD.exe
  C:\Windows\System\QtgAnaD.exe
  2⤵
  PID:1572
- C:\Windows\System\MGAfwrS.exe
  C:\Windows\System\MGAfwrS.exe
  2⤵
  PID:2640
- C:\Windows\System\ixHnHXP.exe
  C:\Windows\System\ixHnHXP.exe
  2⤵
  PID:2388
- C:\Windows\System\yawPTRn.exe
  C:\Windows\System\yawPTRn.exe
  2⤵
  PID:2488
- C:\Windows\System\SCQKHrq.exe
  C:\Windows\System\SCQKHrq.exe
  2⤵
  PID:2480
- C:\Windows\System\aYlexOR.exe
  C:\Windows\System\aYlexOR.exe
  2⤵
  PID:1992
- C:\Windows\System\Gecqxqf.exe
  C:\Windows\System\Gecqxqf.exe
  2⤵
  PID:1880
- C:\Windows\System\YSzqpuP.exe
  C:\Windows\System\YSzqpuP.exe
  2⤵
  PID:2396
- C:\Windows\System\SrMeDJK.exe
  C:\Windows\System\SrMeDJK.exe
  2⤵
  PID:2352
- C:\Windows\System\qkhNwGj.exe
  C:\Windows\System\qkhNwGj.exe
  2⤵
  PID:2452
- C:\Windows\System\ZogZpjY.exe
  C:\Windows\System\ZogZpjY.exe
  2⤵
  PID:1112
- C:\Windows\System\tUwKsWL.exe
  C:\Windows\System\tUwKsWL.exe
  2⤵
  PID:1796
- C:\Windows\System\hcFBbbf.exe
  C:\Windows\System\hcFBbbf.exe
  2⤵
  PID:2860
- C:\Windows\System\YKECFPW.exe
  C:\Windows\System\YKECFPW.exe
  2⤵
  PID:2040
- C:\Windows\System\zOnESyc.exe
  C:\Windows\System\zOnESyc.exe
  2⤵
  PID:2876
- C:\Windows\System\hGFFmAF.exe
  C:\Windows\System\hGFFmAF.exe
  2⤵
  PID:2776
- C:\Windows\System\ZXzPQlE.exe
  C:\Windows\System\ZXzPQlE.exe
  2⤵
  PID:2984
- C:\Windows\System\UbbRUxt.exe
  C:\Windows\System\UbbRUxt.exe
  2⤵
  PID:1268
- C:\Windows\System\clLEmUY.exe
  C:\Windows\System\clLEmUY.exe
  2⤵
  PID:1832
- C:\Windows\System\RMgkdae.exe
  C:\Windows\System\RMgkdae.exe
  2⤵
  PID:2068
- C:\Windows\System\qIvHgSP.exe
  C:\Windows\System\qIvHgSP.exe
  2⤵
  PID:2324
- C:\Windows\System\NXrLwdK.exe
  C:\Windows\System\NXrLwdK.exe
  2⤵
  PID:1844
- C:\Windows\System\lUHkGhN.exe
  C:\Windows\System\lUHkGhN.exe
  2⤵
  PID:1180
- C:\Windows\System\ofSRiyn.exe
  C:\Windows\System\ofSRiyn.exe
  2⤵
  PID:2340
- C:\Windows\System\MeVdsAx.exe
  C:\Windows\System\MeVdsAx.exe
  2⤵
  PID:2432
- C:\Windows\System\mllRTYo.exe
  C:\Windows\System\mllRTYo.exe
  2⤵
  PID:2216
- C:\Windows\System\SvSzvLr.exe
  C:\Windows\System\SvSzvLr.exe
  2⤵
  PID:2528
- C:\Windows\System\DwqUXUP.exe
  C:\Windows\System\DwqUXUP.exe
  2⤵
  PID:1980
- C:\Windows\System\fplYLWj.exe
  C:\Windows\System\fplYLWj.exe
  2⤵
  PID:2784
- C:\Windows\System\RVYSRJg.exe
  C:\Windows\System\RVYSRJg.exe
  2⤵
  PID:964
- C:\Windows\System\aBCnWkR.exe
  C:\Windows\System\aBCnWkR.exe
  2⤵
  PID:3004
- C:\Windows\System\oMmQUXE.exe
  C:\Windows\System\oMmQUXE.exe
  2⤵
  PID:3016
- C:\Windows\System\NbBYQbh.exe
  C:\Windows\System\NbBYQbh.exe
  2⤵
  PID:1948
- C:\Windows\System\xADQpbA.exe
  C:\Windows\System\xADQpbA.exe
  2⤵
  PID:1828
- C:\Windows\System\wRfwkvd.exe
  C:\Windows\System\wRfwkvd.exe
  2⤵
  PID:3012
- C:\Windows\System\tuAlTPB.exe
  C:\Windows\System\tuAlTPB.exe
  2⤵
  PID:2940
- C:\Windows\System\PXdzQeU.exe
  C:\Windows\System\PXdzQeU.exe
  2⤵
  PID:976
- C:\Windows\System\gWiKGjX.exe
  C:\Windows\System\gWiKGjX.exe
  2⤵
  PID:1664
- C:\Windows\System\fRzEwoB.exe
  C:\Windows\System\fRzEwoB.exe
  2⤵
  PID:2592
- C:\Windows\System\nLWVQES.exe
  C:\Windows\System\nLWVQES.exe
  2⤵
  PID:2356
- C:\Windows\System\xlaKDtL.exe
  C:\Windows\System\xlaKDtL.exe
  2⤵
  PID:1952
- C:\Windows\System\ffVSrRm.exe
  C:\Windows\System\ffVSrRm.exe
  2⤵
  PID:528
- C:\Windows\System\MScVsZX.exe
  C:\Windows\System\MScVsZX.exe
  2⤵
  PID:1688
- C:\Windows\System\MxRHUoK.exe
  C:\Windows\System\MxRHUoK.exe
  2⤵
  PID:1748
- C:\Windows\System\AJkKeAC.exe
  C:\Windows\System\AJkKeAC.exe
  2⤵
  PID:2728
- C:\Windows\System\VSIiwKF.exe
  C:\Windows\System\VSIiwKF.exe
  2⤵
  PID:2624
- C:\Windows\System\JPpdwuA.exe
  C:\Windows\System\JPpdwuA.exe
  2⤵
  PID:2380
- C:\Windows\System\QnJjLAV.exe
  C:\Windows\System\QnJjLAV.exe
  2⤵
  PID:2696
- C:\Windows\System\dTXmAXz.exe
  C:\Windows\System\dTXmAXz.exe
  2⤵
  PID:2584
- C:\Windows\System\KywXWes.exe
  C:\Windows\System\KywXWes.exe
  2⤵
  PID:940
- C:\Windows\System\fKfcsVl.exe
  C:\Windows\System\fKfcsVl.exe
  2⤵
  PID:1032
- C:\Windows\System\GyClIJE.exe
  C:\Windows\System\GyClIJE.exe
  2⤵
  PID:1596
- C:\Windows\System\QIsWWwP.exe
  C:\Windows\System\QIsWWwP.exe
  2⤵
  PID:3060
- C:\Windows\System\dmiBEjh.exe
  C:\Windows\System\dmiBEjh.exe
  2⤵
  PID:2540
- C:\Windows\System\uVVrmQw.exe
  C:\Windows\System\uVVrmQw.exe
  2⤵
  PID:1052
- C:\Windows\System\vqyVUSS.exe
  C:\Windows\System\vqyVUSS.exe
  2⤵
  PID:2168
- C:\Windows\System\ItvPFkQ.exe
  C:\Windows\System\ItvPFkQ.exe
  2⤵
  PID:1816
- C:\Windows\System\fYcqwKA.exe
  C:\Windows\System\fYcqwKA.exe
  2⤵
  PID:1848
- C:\Windows\System\PBLLjke.exe
  C:\Windows\System\PBLLjke.exe
  2⤵
  PID:700
- C:\Windows\System\fqZONFx.exe
  C:\Windows\System\fqZONFx.exe
  2⤵
  PID:2664
- C:\Windows\System\GGDMkWK.exe
  C:\Windows\System\GGDMkWK.exe
  2⤵
  PID:608
- C:\Windows\System\OysUBAG.exe
  C:\Windows\System\OysUBAG.exe
  2⤵
  PID:3076
- C:\Windows\System\LDxNkxo.exe
  C:\Windows\System\LDxNkxo.exe
  2⤵
  PID:3092
- C:\Windows\System\gHBLSBI.exe
  C:\Windows\System\gHBLSBI.exe
  2⤵
  PID:3112
- C:\Windows\System\HJGJsRZ.exe
  C:\Windows\System\HJGJsRZ.exe
  2⤵
  PID:3176
- C:\Windows\System\hKYpRjE.exe
  C:\Windows\System\hKYpRjE.exe
  2⤵
  PID:3192
- C:\Windows\System\VwEHAtJ.exe
  C:\Windows\System\VwEHAtJ.exe
  2⤵
  PID:3212
- C:\Windows\System\YOzxzat.exe
  C:\Windows\System\YOzxzat.exe
  2⤵
  PID:3228
- C:\Windows\System\zltTvFx.exe
  C:\Windows\System\zltTvFx.exe
  2⤵
  PID:3248
- C:\Windows\System\YTQGKeE.exe
  C:\Windows\System\YTQGKeE.exe
  2⤵
  PID:3264
- C:\Windows\System\KSYlJIB.exe
  C:\Windows\System\KSYlJIB.exe
  2⤵
  PID:3284
- C:\Windows\System\fPyalNm.exe
  C:\Windows\System\fPyalNm.exe
  2⤵
  PID:3300
- C:\Windows\System\RZAtokc.exe
  C:\Windows\System\RZAtokc.exe
  2⤵
  PID:3320
- C:\Windows\System\LncmOMU.exe
  C:\Windows\System\LncmOMU.exe
  2⤵
  PID:3336
- C:\Windows\System\UskjLWr.exe
  C:\Windows\System\UskjLWr.exe
  2⤵
  PID:3352
- C:\Windows\System\JNPdHHb.exe
  C:\Windows\System\JNPdHHb.exe
  2⤵
  PID:3368
- C:\Windows\System\HRrtEri.exe
  C:\Windows\System\HRrtEri.exe
  2⤵
  PID:3384
- C:\Windows\System\QBRHrWj.exe
  C:\Windows\System\QBRHrWj.exe
  2⤵
  PID:3400
- C:\Windows\System\GtWuGNv.exe
  C:\Windows\System\GtWuGNv.exe
  2⤵
  PID:3416
- C:\Windows\System\LsqyxqJ.exe
  C:\Windows\System\LsqyxqJ.exe
  2⤵
  PID:3456
- C:\Windows\System\NQWYVYS.exe
  C:\Windows\System\NQWYVYS.exe
  2⤵
  PID:3484
- C:\Windows\System\IkFGNJb.exe
  C:\Windows\System\IkFGNJb.exe
  2⤵
  PID:3500
- C:\Windows\System\TQAHvdH.exe
  C:\Windows\System\TQAHvdH.exe
  2⤵
  PID:3516
- C:\Windows\System\AehWUvy.exe
  C:\Windows\System\AehWUvy.exe
  2⤵
  PID:3536
- C:\Windows\System\bHxqZLr.exe
  C:\Windows\System\bHxqZLr.exe
  2⤵
  PID:3552
- C:\Windows\System\OhIFoHM.exe
  C:\Windows\System\OhIFoHM.exe
  2⤵
  PID:3568
- C:\Windows\System\QyGvSEy.exe
  C:\Windows\System\QyGvSEy.exe
  2⤵
  PID:3588
- C:\Windows\System\BzYmGef.exe
  C:\Windows\System\BzYmGef.exe
  2⤵
  PID:3620
- C:\Windows\System\fYMCmne.exe
  C:\Windows\System\fYMCmne.exe
  2⤵
  PID:3636
- C:\Windows\System\nGMsKvR.exe
  C:\Windows\System\nGMsKvR.exe
  2⤵
  PID:3652
- C:\Windows\System\SBNIGSH.exe
  C:\Windows\System\SBNIGSH.exe
  2⤵
  PID:3668
- C:\Windows\System\sjSOHpL.exe
  C:\Windows\System\sjSOHpL.exe
  2⤵
  PID:3684
- C:\Windows\System\FErtNXJ.exe
  C:\Windows\System\FErtNXJ.exe
  2⤵
  PID:3700
- C:\Windows\System\IckVvfo.exe
  C:\Windows\System\IckVvfo.exe
  2⤵
  PID:3716
- C:\Windows\System\xxBFnRV.exe
  C:\Windows\System\xxBFnRV.exe
  2⤵
  PID:3732
- C:\Windows\System\ObSCeir.exe
  C:\Windows\System\ObSCeir.exe
  2⤵
  PID:3748
- C:\Windows\System\HcpvtUy.exe
  C:\Windows\System\HcpvtUy.exe
  2⤵
  PID:3764
- C:\Windows\System\yNewFeG.exe
  C:\Windows\System\yNewFeG.exe
  2⤵
  PID:3780
- C:\Windows\System\NWYPXJB.exe
  C:\Windows\System\NWYPXJB.exe
  2⤵
  PID:3796
- C:\Windows\System\xNMGeyU.exe
  C:\Windows\System\xNMGeyU.exe
  2⤵
  PID:3840
- C:\Windows\System\cYeKEvP.exe
  C:\Windows\System\cYeKEvP.exe
  2⤵
  PID:3856
- C:\Windows\System\ySrPXta.exe
  C:\Windows\System\ySrPXta.exe
  2⤵
  PID:3872
- C:\Windows\System\kLjhGdj.exe
  C:\Windows\System\kLjhGdj.exe
  2⤵
  PID:3888
- C:\Windows\System\lHOVbfL.exe
  C:\Windows\System\lHOVbfL.exe
  2⤵
  PID:3908
- C:\Windows\System\GRWsLAG.exe
  C:\Windows\System\GRWsLAG.exe
  2⤵
  PID:3924
- C:\Windows\System\mASjdcR.exe
  C:\Windows\System\mASjdcR.exe
  2⤵
  PID:3940
- C:\Windows\System\UPKfiyK.exe
  C:\Windows\System\UPKfiyK.exe
  2⤵
  PID:3956
- C:\Windows\System\cjGDsTJ.exe
  C:\Windows\System\cjGDsTJ.exe
  2⤵
  PID:3972
- C:\Windows\System\lewOvIj.exe
  C:\Windows\System\lewOvIj.exe
  2⤵
  PID:3988
- C:\Windows\System\yvJlhZH.exe
  C:\Windows\System\yvJlhZH.exe
  2⤵
  PID:4004
- C:\Windows\System\zoufghG.exe
  C:\Windows\System\zoufghG.exe
  2⤵
  PID:4020
- C:\Windows\System\vHqnbNJ.exe
  C:\Windows\System\vHqnbNJ.exe
  2⤵
  PID:4036
- C:\Windows\System\ptLsTrQ.exe
  C:\Windows\System\ptLsTrQ.exe
  2⤵
  PID:4052
- C:\Windows\System\WZBXxld.exe
  C:\Windows\System\WZBXxld.exe
  2⤵
  PID:4068
- C:\Windows\System\kjomnVt.exe
  C:\Windows\System\kjomnVt.exe
  2⤵
  PID:4084
- C:\Windows\System\DOHnZqI.exe
  C:\Windows\System\DOHnZqI.exe
  2⤵
  PID:2060
- C:\Windows\System\TQRXVLH.exe
  C:\Windows\System\TQRXVLH.exe
  2⤵
  PID:2312
- C:\Windows\System\KIFQgay.exe
  C:\Windows\System\KIFQgay.exe
  2⤵
  PID:2232
- C:\Windows\System\ONjIMJV.exe
  C:\Windows\System\ONjIMJV.exe
  2⤵
  PID:2072
- C:\Windows\System\uCiOgWj.exe
  C:\Windows\System\uCiOgWj.exe
  2⤵
  PID:2476
- C:\Windows\System\dOPjOPX.exe
  C:\Windows\System\dOPjOPX.exe
  2⤵
  PID:3020
- C:\Windows\System\bJpgbqr.exe
  C:\Windows\System\bJpgbqr.exe
  2⤵
  PID:3052
- C:\Windows\System\rXxdvdO.exe
  C:\Windows\System\rXxdvdO.exe
  2⤵
  PID:884
- C:\Windows\System\YEuhmQp.exe
  C:\Windows\System\YEuhmQp.exe
  2⤵
  PID:3144
- C:\Windows\System\opGyOoj.exe
  C:\Windows\System\opGyOoj.exe
  2⤵
  PID:3160
- C:\Windows\System\rwJGKyf.exe
  C:\Windows\System\rwJGKyf.exe
  2⤵
  PID:764
- C:\Windows\System\FwBQIiW.exe
  C:\Windows\System\FwBQIiW.exe
  2⤵
  PID:1148
- C:\Windows\System\qoQTaWg.exe
  C:\Windows\System\qoQTaWg.exe
  2⤵
  PID:2044
- C:\Windows\System\ZaRNtbd.exe
  C:\Windows\System\ZaRNtbd.exe
  2⤵
  PID:3204
- C:\Windows\System\upWbHwn.exe
  C:\Windows\System\upWbHwn.exe
  2⤵
  PID:3272
- C:\Windows\System\vkaZubz.exe
  C:\Windows\System\vkaZubz.exe
  2⤵
  PID:3308
- C:\Windows\System\FrPFVtR.exe
  C:\Windows\System\FrPFVtR.exe
  2⤵
  PID:3344
- C:\Windows\System\QDUkVtY.exe
  C:\Windows\System\QDUkVtY.exe
  2⤵
  PID:3220
- C:\Windows\System\aDHdbdS.exe
  C:\Windows\System\aDHdbdS.exe
  2⤵
  PID:3412
- C:\Windows\System\PefUlIM.exe
  C:\Windows\System\PefUlIM.exe
  2⤵
  PID:3292
- C:\Windows\System\lfLSrsC.exe
  C:\Windows\System\lfLSrsC.exe
  2⤵
  PID:3364
- C:\Windows\System\kgRynXZ.exe
  C:\Windows\System\kgRynXZ.exe
  2⤵
  PID:3328
- C:\Windows\System\NoHokfh.exe
  C:\Windows\System\NoHokfh.exe
  2⤵
  PID:1172
- C:\Windows\System\TCIaWsR.exe
  C:\Windows\System\TCIaWsR.exe
  2⤵
  PID:1676
- C:\Windows\System\ZXXCDzV.exe
  C:\Windows\System\ZXXCDzV.exe
  2⤵
  PID:3444
- C:\Windows\System\jOFKxkh.exe
  C:\Windows\System\jOFKxkh.exe
  2⤵
  PID:1264
- C:\Windows\System\OxjpKBy.exe
  C:\Windows\System\OxjpKBy.exe
  2⤵
  PID:3660
- C:\Windows\System\HmEAJGP.exe
  C:\Windows\System\HmEAJGP.exe
  2⤵
  PID:3724
- C:\Windows\System\zVtUumx.exe
  C:\Windows\System\zVtUumx.exe
  2⤵
  PID:3524
- C:\Windows\System\MGEbNBW.exe
  C:\Windows\System\MGEbNBW.exe
  2⤵
  PID:2296
- C:\Windows\System\dVqkKfY.exe
  C:\Windows\System\dVqkKfY.exe
  2⤵
  PID:3616
- C:\Windows\System\uQUExxA.exe
  C:\Windows\System\uQUExxA.exe
  2⤵
  PID:2872
- C:\Windows\System\bFmDoII.exe
  C:\Windows\System\bFmDoII.exe
  2⤵
  PID:3676
- C:\Windows\System\bhRFisv.exe
  C:\Windows\System\bhRFisv.exe
  2⤵
  PID:3740
- C:\Windows\System\aAplRLs.exe
  C:\Windows\System\aAplRLs.exe
  2⤵
  PID:3776
- C:\Windows\System\JDnmmos.exe
  C:\Windows\System\JDnmmos.exe
  2⤵
  PID:2404
- C:\Windows\System\eeeSKnb.exe
  C:\Windows\System\eeeSKnb.exe
  2⤵
  PID:3884
- C:\Windows\System\WbcKpEe.exe
  C:\Windows\System\WbcKpEe.exe
  2⤵
  PID:3864
- C:\Windows\System\xjuvJYy.exe
  C:\Windows\System\xjuvJYy.exe
  2⤵
  PID:3916
- C:\Windows\System\qANXexa.exe
  C:\Windows\System\qANXexa.exe
  2⤵
  PID:3964
- C:\Windows\System\syODVxO.exe
  C:\Windows\System\syODVxO.exe
  2⤵
  PID:3996
- C:\Windows\System\VLkaaZs.exe
  C:\Windows\System\VLkaaZs.exe
  2⤵
  PID:3968
- C:\Windows\System\rtWynov.exe
  C:\Windows\System\rtWynov.exe
  2⤵
  PID:4044
- C:\Windows\System\mtusAGJ.exe
  C:\Windows\System\mtusAGJ.exe
  2⤵
  PID:4064
- C:\Windows\System\pmkPElm.exe
  C:\Windows\System\pmkPElm.exe
  2⤵
  PID:1620
- C:\Windows\System\ZtiIkDp.exe
  C:\Windows\System\ZtiIkDp.exe
  2⤵
  PID:3632
- C:\Windows\System\NpvwrWB.exe
  C:\Windows\System\NpvwrWB.exe
  2⤵
  PID:3648
- C:\Windows\System\FxSFIqf.exe
  C:\Windows\System\FxSFIqf.exe
  2⤵
  PID:576
- C:\Windows\System\ogwVTJN.exe
  C:\Windows\System\ogwVTJN.exe
  2⤵
  PID:3128
- C:\Windows\System\brZNNNu.exe
  C:\Windows\System\brZNNNu.exe
  2⤵
  PID:2820
- C:\Windows\System\UmpDihn.exe
  C:\Windows\System\UmpDihn.exe
  2⤵
  PID:3136
- C:\Windows\System\SphOQPS.exe
  C:\Windows\System\SphOQPS.exe
  2⤵
  PID:2472
- C:\Windows\System\mrFNOTC.exe
  C:\Windows\System\mrFNOTC.exe
  2⤵
  PID:2680
- C:\Windows\System\eHQksfQ.exe
  C:\Windows\System\eHQksfQ.exe
  2⤵
  PID:3188
- C:\Windows\System\zpmRjHM.exe
  C:\Windows\System\zpmRjHM.exe
  2⤵
  PID:3424
- C:\Windows\System\jmQECub.exe
  C:\Windows\System\jmQECub.exe
  2⤵
  PID:3240
- C:\Windows\System\HmhdFQD.exe
  C:\Windows\System\HmhdFQD.exe
  2⤵
  PID:3428
- C:\Windows\System\LBifgWM.exe
  C:\Windows\System\LBifgWM.exe
  2⤵
  PID:3256
- C:\Windows\System\OmEOXLb.exe
  C:\Windows\System\OmEOXLb.exe
  2⤵
  PID:3332
- C:\Windows\System\nhpxrLw.exe
  C:\Windows\System\nhpxrLw.exe
  2⤵
  PID:3476
- C:\Windows\System\QxdaePK.exe
  C:\Windows\System\QxdaePK.exe
  2⤵
  PID:3512
- C:\Windows\System\nMkBLew.exe
  C:\Windows\System\nMkBLew.exe
  2⤵
  PID:1296
- C:\Windows\System\ArGPgWs.exe
  C:\Windows\System\ArGPgWs.exe
  2⤵
  PID:3496
- C:\Windows\System\EalWVxr.exe
  C:\Windows\System\EalWVxr.exe
  2⤵
  PID:3564
- C:\Windows\System\oEhLEJU.exe
  C:\Windows\System\oEhLEJU.exe
  2⤵
  PID:1164
- C:\Windows\System\LYJUcTf.exe
  C:\Windows\System\LYJUcTf.exe
  2⤵
  PID:1760
- C:\Windows\System\ycxZOAa.exe
  C:\Windows\System\ycxZOAa.exe
  2⤵
  PID:3760
- C:\Windows\System\wsUuCYL.exe
  C:\Windows\System\wsUuCYL.exe
  2⤵
  PID:1200
- C:\Windows\System\ekIfbIW.exe
  C:\Windows\System\ekIfbIW.exe
  2⤵
  PID:3772
- C:\Windows\System\FUfWoAM.exe
  C:\Windows\System\FUfWoAM.exe
  2⤵
  PID:4092
- C:\Windows\System\FsQvVfW.exe
  C:\Windows\System\FsQvVfW.exe
  2⤵
  PID:3712
- C:\Windows\System\TzndoRQ.exe
  C:\Windows\System\TzndoRQ.exe
  2⤵
  PID:3904
- C:\Windows\System\kYdPcdn.exe
  C:\Windows\System\kYdPcdn.exe
  2⤵
  PID:3708
- C:\Windows\System\HbQbbml.exe
  C:\Windows\System\HbQbbml.exe
  2⤵
  PID:3952
- C:\Windows\System\QvymNzX.exe
  C:\Windows\System\QvymNzX.exe
  2⤵
  PID:3932
- C:\Windows\System\tLszBBF.exe
  C:\Windows\System\tLszBBF.exe
  2⤵
  PID:2084
- C:\Windows\System\iNGrRET.exe
  C:\Windows\System\iNGrRET.exe
  2⤵
  PID:3236
- C:\Windows\System\fAgztYj.exe
  C:\Windows\System\fAgztYj.exe
  2⤵
  PID:1644
- C:\Windows\System\iuHhznC.exe
  C:\Windows\System\iuHhznC.exe
  2⤵
  PID:1396
- C:\Windows\System\CtICiXb.exe
  C:\Windows\System\CtICiXb.exe
  2⤵
  PID:4104
- C:\Windows\System\WlIjIrA.exe
  C:\Windows\System\WlIjIrA.exe
  2⤵
  PID:4120
- C:\Windows\System\wYadIRP.exe
  C:\Windows\System\wYadIRP.exe
  2⤵
  PID:4136
- C:\Windows\System\rXPSXTK.exe
  C:\Windows\System\rXPSXTK.exe
  2⤵
  PID:4152
- C:\Windows\System\OYEHxtT.exe
  C:\Windows\System\OYEHxtT.exe
  2⤵
  PID:4172
- C:\Windows\System\wbHSSFv.exe
  C:\Windows\System\wbHSSFv.exe
  2⤵
  PID:4188
- C:\Windows\System\mgeBHGk.exe
  C:\Windows\System\mgeBHGk.exe
  2⤵
  PID:4204
- C:\Windows\System\NMEmegi.exe
  C:\Windows\System\NMEmegi.exe
  2⤵
  PID:4220
- C:\Windows\System\SxIkOmJ.exe
  C:\Windows\System\SxIkOmJ.exe
  2⤵
  PID:4240
- C:\Windows\System\MmYMROW.exe
  C:\Windows\System\MmYMROW.exe
  2⤵
  PID:4260
- C:\Windows\System\xFEyNqI.exe
  C:\Windows\System\xFEyNqI.exe
  2⤵
  PID:4276
- C:\Windows\System\dmiRfaf.exe
  C:\Windows\System\dmiRfaf.exe
  2⤵
  PID:4296
- C:\Windows\System\WOsORgE.exe
  C:\Windows\System\WOsORgE.exe
  2⤵
  PID:4416
- C:\Windows\System\tlMGASO.exe
  C:\Windows\System\tlMGASO.exe
  2⤵
  PID:4432
- C:\Windows\System\zuIhCSa.exe
  C:\Windows\System\zuIhCSa.exe
  2⤵
  PID:4448
- C:\Windows\System\EwJmjmz.exe
  C:\Windows\System\EwJmjmz.exe
  2⤵
  PID:4464
- C:\Windows\System\sCaLBlo.exe
  C:\Windows\System\sCaLBlo.exe
  2⤵
  PID:4484
- C:\Windows\System\ylYuBLw.exe
  C:\Windows\System\ylYuBLw.exe
  2⤵
  PID:4500
- C:\Windows\System\npoAOrw.exe
  C:\Windows\System\npoAOrw.exe
  2⤵
  PID:4516
- C:\Windows\System\GErcArD.exe
  C:\Windows\System\GErcArD.exe
  2⤵
  PID:4536
- C:\Windows\System\jsHaidi.exe
  C:\Windows\System\jsHaidi.exe
  2⤵
  PID:4552
- C:\Windows\System\KwVbpNs.exe
  C:\Windows\System\KwVbpNs.exe
  2⤵
  PID:4576
- C:\Windows\System\IoFziNV.exe
  C:\Windows\System\IoFziNV.exe
  2⤵
  PID:4596
- C:\Windows\System\mqnNzdA.exe
  C:\Windows\System\mqnNzdA.exe
  2⤵
  PID:4612
- C:\Windows\System\SoWgYmX.exe
  C:\Windows\System\SoWgYmX.exe
  2⤵
  PID:4628
- C:\Windows\System\YDfFEcY.exe
  C:\Windows\System\YDfFEcY.exe
  2⤵
  PID:4644
- C:\Windows\System\PZTQIAk.exe
  C:\Windows\System\PZTQIAk.exe
  2⤵
  PID:4660
- C:\Windows\System\ZubREdU.exe
  C:\Windows\System\ZubREdU.exe
  2⤵
  PID:4676
- C:\Windows\System\FdDsYNi.exe
  C:\Windows\System\FdDsYNi.exe
  2⤵
  PID:4712
- C:\Windows\System\KshBZeO.exe
  C:\Windows\System\KshBZeO.exe
  2⤵
  PID:4780
- C:\Windows\System\fYfroKT.exe
  C:\Windows\System\fYfroKT.exe
  2⤵
  PID:4796
- C:\Windows\System\FlkgynV.exe
  C:\Windows\System\FlkgynV.exe
  2⤵
  PID:4812
- C:\Windows\System\xwttKWZ.exe
  C:\Windows\System\xwttKWZ.exe
  2⤵
  PID:4828
- C:\Windows\System\LQNjxzW.exe
  C:\Windows\System\LQNjxzW.exe
  2⤵
  PID:4844
- C:\Windows\System\PGeklle.exe
  C:\Windows\System\PGeklle.exe
  2⤵
  PID:4872
- C:\Windows\System\tPLpapT.exe
  C:\Windows\System\tPLpapT.exe
  2⤵
  PID:4892
- C:\Windows\System\FpJLVie.exe
  C:\Windows\System\FpJLVie.exe
  2⤵
  PID:4908
- C:\Windows\System\DGqhgBF.exe
  C:\Windows\System\DGqhgBF.exe
  2⤵
  PID:4924
- C:\Windows\System\rJtaUgE.exe
  C:\Windows\System\rJtaUgE.exe
  2⤵
  PID:4944
- C:\Windows\System\edMSMQw.exe
  C:\Windows\System\edMSMQw.exe
  2⤵
  PID:4960
- C:\Windows\System\eFTuPhr.exe
  C:\Windows\System\eFTuPhr.exe
  2⤵
  PID:4980
- C:\Windows\System\CdAJrND.exe
  C:\Windows\System\CdAJrND.exe
  2⤵
  PID:5000
- C:\Windows\System\rInTkUu.exe
  C:\Windows\System\rInTkUu.exe
  2⤵
  PID:5016
- C:\Windows\System\KqvebYi.exe
  C:\Windows\System\KqvebYi.exe
  2⤵
  PID:5032
- C:\Windows\System\IVDzWlz.exe
  C:\Windows\System\IVDzWlz.exe
  2⤵
  PID:5068
- C:\Windows\System\aTGSeCr.exe
  C:\Windows\System\aTGSeCr.exe
  2⤵
  PID:5084
- C:\Windows\System\GoSThBr.exe
  C:\Windows\System\GoSThBr.exe
  2⤵
  PID:5100
- C:\Windows\System\oMwXrDm.exe
  C:\Windows\System\oMwXrDm.exe
  2⤵
  PID:3088
- C:\Windows\System\Ierorco.exe
  C:\Windows\System\Ierorco.exe
  2⤵
  PID:2536
- C:\Windows\System\hnTBUsO.exe
  C:\Windows\System\hnTBUsO.exe
  2⤵
  PID:3548
- C:\Windows\System\cKndmFU.exe
  C:\Windows\System\cKndmFU.exe
  2⤵
  PID:4112
- C:\Windows\System\qAthudE.exe
  C:\Windows\System\qAthudE.exe
  2⤵
  PID:4212
- C:\Windows\System\junLjPK.exe
  C:\Windows\System\junLjPK.exe
  2⤵
  PID:4252
- C:\Windows\System\lKpUPKJ.exe
  C:\Windows\System\lKpUPKJ.exe
  2⤵
  PID:3896
- C:\Windows\System\mXIWsUN.exe
  C:\Windows\System\mXIWsUN.exe
  2⤵
  PID:4148
- C:\Windows\System\YbKyrFq.exe
  C:\Windows\System\YbKyrFq.exe
  2⤵
  PID:4288
- C:\Windows\System\PwSjTEU.exe
  C:\Windows\System\PwSjTEU.exe
  2⤵
  PID:3448
- C:\Windows\System\cKcqQRl.exe
  C:\Windows\System\cKcqQRl.exe
  2⤵
  PID:3576
- C:\Windows\System\PhBUguS.exe
  C:\Windows\System\PhBUguS.exe
  2⤵
  PID:4268
- C:\Windows\System\Ibdgxrp.exe
  C:\Windows\System\Ibdgxrp.exe
  2⤵
  PID:676
- C:\Windows\System\fmKOJoU.exe
  C:\Windows\System\fmKOJoU.exe
  2⤵
  PID:4012
- C:\Windows\System\UYeyAUY.exe
  C:\Windows\System\UYeyAUY.exe
  2⤵
  PID:2308
- C:\Windows\System\AvIHKgE.exe
  C:\Windows\System\AvIHKgE.exe
  2⤵
  PID:2636
- C:\Windows\System\nbOLYWa.exe
  C:\Windows\System\nbOLYWa.exe
  2⤵
  PID:4100
- C:\Windows\System\bHzZnrl.exe
  C:\Windows\System\bHzZnrl.exe
  2⤵
  PID:4168
- C:\Windows\System\WgtodRW.exe
  C:\Windows\System\WgtodRW.exe
  2⤵
  PID:4460
- C:\Windows\System\tdvypPk.exe
  C:\Windows\System\tdvypPk.exe
  2⤵
  PID:4312
- C:\Windows\System\sNcpQYZ.exe
  C:\Windows\System\sNcpQYZ.exe
  2⤵
  PID:4332
- C:\Windows\System\XucjQzr.exe
  C:\Windows\System\XucjQzr.exe
  2⤵
  PID:4352
- C:\Windows\System\VBmuEzg.exe
  C:\Windows\System\VBmuEzg.exe
  2⤵
  PID:4368
- C:\Windows\System\oxVedrN.exe
  C:\Windows\System\oxVedrN.exe
  2⤵
  PID:4384
- C:\Windows\System\DMvDjxB.exe
  C:\Windows\System\DMvDjxB.exe
  2⤵
  PID:4400
- C:\Windows\System\RtVAVbZ.exe
  C:\Windows\System\RtVAVbZ.exe
  2⤵
  PID:4440
- C:\Windows\System\iflZoka.exe
  C:\Windows\System\iflZoka.exe
  2⤵
  PID:4480
- C:\Windows\System\AnrGddw.exe
  C:\Windows\System\AnrGddw.exe
  2⤵
  PID:4524
- C:\Windows\System\zVdwOPf.exe
  C:\Windows\System\zVdwOPf.exe
  2⤵
  PID:4652
- C:\Windows\System\aCsYYqd.exe
  C:\Windows\System\aCsYYqd.exe
  2⤵
  PID:4528
- C:\Windows\System\oQtINoM.exe
  C:\Windows\System\oQtINoM.exe
  2⤵
  PID:4564
- C:\Windows\System\JSkxIqf.exe
  C:\Windows\System\JSkxIqf.exe
  2⤵
  PID:4604
- C:\Windows\System\hPvszFW.exe
  C:\Windows\System\hPvszFW.exe
  2⤵
  PID:4692
- C:\Windows\System\hssknLS.exe
  C:\Windows\System\hssknLS.exe
  2⤵
  PID:4700
- C:\Windows\System\IOqrRBE.exe
  C:\Windows\System\IOqrRBE.exe
  2⤵
  PID:4732
- C:\Windows\System\qRBHuTl.exe
  C:\Windows\System\qRBHuTl.exe
  2⤵
  PID:4744
- C:\Windows\System\ehChJeN.exe
  C:\Windows\System\ehChJeN.exe
  2⤵
  PID:4768
- C:\Windows\System\nTSdZXh.exe
  C:\Windows\System\nTSdZXh.exe
  2⤵
  PID:4792
- C:\Windows\System\LGUxAkF.exe
  C:\Windows\System\LGUxAkF.exe
  2⤵
  PID:4776
- C:\Windows\System\KhuHhNv.exe
  C:\Windows\System\KhuHhNv.exe
  2⤵
  PID:4880
- C:\Windows\System\kUSgtsK.exe
  C:\Windows\System\kUSgtsK.exe
  2⤵
  PID:4864
- C:\Windows\System\uqjbQvr.exe
  C:\Windows\System\uqjbQvr.exe
  2⤵
  PID:4936
- C:\Windows\System\PdoyVOR.exe
  C:\Windows\System\PdoyVOR.exe
  2⤵
  PID:4996
- C:\Windows\System\XCFdBgQ.exe
  C:\Windows\System\XCFdBgQ.exe
  2⤵
  PID:5092
- C:\Windows\System\vRuiXYk.exe
  C:\Windows\System\vRuiXYk.exe
  2⤵
  PID:4976
- C:\Windows\System\hLpXkBn.exe
  C:\Windows\System\hLpXkBn.exe
  2⤵
  PID:5040
- C:\Windows\System\ZRpvqwT.exe
  C:\Windows\System\ZRpvqwT.exe
  2⤵
  PID:5108
- C:\Windows\System\MAdkyfX.exe
  C:\Windows\System\MAdkyfX.exe
  2⤵
  PID:3312
- C:\Windows\System\DvacIlx.exe
  C:\Windows\System\DvacIlx.exe
  2⤵
  PID:3380
- C:\Windows\System\ltouXlN.exe
  C:\Windows\System\ltouXlN.exe
  2⤵
  PID:3100
- C:\Windows\System\BajOttR.exe
  C:\Windows\System\BajOttR.exe
  2⤵
  PID:1484
- C:\Windows\System\pQSzxJX.exe
  C:\Windows\System\pQSzxJX.exe
  2⤵
  PID:2744
- C:\Windows\System\JCJicnR.exe
  C:\Windows\System\JCJicnR.exe
  2⤵
  PID:4032
- C:\Windows\System\fsNpCLW.exe
  C:\Windows\System\fsNpCLW.exe
  2⤵
  PID:3184
- C:\Windows\System\XIyRaPI.exe
  C:\Windows\System\XIyRaPI.exe
  2⤵
  PID:3172
- C:\Windows\System\nRwChlH.exe
  C:\Windows\System\nRwChlH.exe
  2⤵
  PID:2180
- C:\Windows\System\jFtgliR.exe
  C:\Windows\System\jFtgliR.exe
  2⤵
  PID:2944
- C:\Windows\System\gGXDSXC.exe
  C:\Windows\System\gGXDSXC.exe
  2⤵
  PID:3604
- C:\Windows\System\taDfAhe.exe
  C:\Windows\System\taDfAhe.exe
  2⤵
  PID:4160
- C:\Windows\System\NunwEkU.exe
  C:\Windows\System\NunwEkU.exe
  2⤵
  PID:4236
- C:\Windows\System\urqkgEr.exe
  C:\Windows\System\urqkgEr.exe
  2⤵
  PID:4344
- C:\Windows\System\XEzRNYK.exe
  C:\Windows\System\XEzRNYK.exe
  2⤵
  PID:4456
- C:\Windows\System\iQrKkft.exe
  C:\Windows\System\iQrKkft.exe
  2⤵
  PID:3612
- C:\Windows\System\YBIEICo.exe
  C:\Windows\System\YBIEICo.exe
  2⤵
  PID:4396
- C:\Windows\System\ipWrZRy.exe
  C:\Windows\System\ipWrZRy.exe
  2⤵
  PID:4380
- C:\Windows\System\fTtMceA.exe
  C:\Windows\System\fTtMceA.exe
  2⤵
  PID:4544
- C:\Windows\System\VDCpTea.exe
  C:\Windows\System\VDCpTea.exe
  2⤵
  PID:4684
- C:\Windows\System\YgfSPfa.exe
  C:\Windows\System\YgfSPfa.exe
  2⤵
  PID:3432
- C:\Windows\System\uSqLzSZ.exe
  C:\Windows\System\uSqLzSZ.exe
  2⤵
  PID:4724
- C:\Windows\System\rTpJUIF.exe
  C:\Windows\System\rTpJUIF.exe
  2⤵
  PID:4808
- C:\Windows\System\YvZBumZ.exe
  C:\Windows\System\YvZBumZ.exe
  2⤵
  PID:4708
- C:\Windows\System\qnqZREf.exe
  C:\Windows\System\qnqZREf.exe
  2⤵
  PID:4756
- C:\Windows\System\tZHtldj.exe
  C:\Windows\System\tZHtldj.exe
  2⤵
  PID:4856
- C:\Windows\System\ieWcDmL.exe
  C:\Windows\System\ieWcDmL.exe
  2⤵
  PID:4920
- C:\Windows\System\zUDAOpQ.exe
  C:\Windows\System\zUDAOpQ.exe
  2⤵
  PID:4900
- C:\Windows\System\lGYWVXR.exe
  C:\Windows\System\lGYWVXR.exe
  2⤵
  PID:5008
- C:\Windows\System\IQnkmuv.exe
  C:\Windows\System\IQnkmuv.exe
  2⤵
  PID:5060
- C:\Windows\System\CQmFUxj.exe
  C:\Windows\System\CQmFUxj.exe
  2⤵
  PID:5044
- C:\Windows\System\XGxOjIR.exe
  C:\Windows\System\XGxOjIR.exe
  2⤵
  PID:4532
- C:\Windows\System\tLwKhvw.exe
  C:\Windows\System\tLwKhvw.exe
  2⤵
  PID:3084
- C:\Windows\System\esApIbf.exe
  C:\Windows\System\esApIbf.exe
  2⤵
  PID:2300
- C:\Windows\System\FeXOeRH.exe
  C:\Windows\System\FeXOeRH.exe
  2⤵
  PID:3544
- C:\Windows\System\asfDIaO.exe
  C:\Windows\System\asfDIaO.exe
  2⤵
  PID:1036
- C:\Windows\System\gEzrPiJ.exe
  C:\Windows\System\gEzrPiJ.exe
  2⤵
  PID:4184
- C:\Windows\System\UVdDbUf.exe
  C:\Windows\System\UVdDbUf.exe
  2⤵
  PID:4132
- C:\Windows\System\prjunSf.exe
  C:\Windows\System\prjunSf.exe
  2⤵
  PID:4472
- C:\Windows\System\rPceCae.exe
  C:\Windows\System\rPceCae.exe
  2⤵
  PID:4376
- C:\Windows\System\uzDZpzS.exe
  C:\Windows\System\uzDZpzS.exe
  2⤵
  PID:4364
- C:\Windows\System\mDFBPkI.exe
  C:\Windows\System\mDFBPkI.exe
  2⤵
  PID:4740
- C:\Windows\System\LKnCInP.exe
  C:\Windows\System\LKnCInP.exe
  2⤵
  PID:4640
- C:\Windows\System\xcytZKI.exe
  C:\Windows\System\xcytZKI.exe
  2⤵
  PID:4940
- C:\Windows\System\QdILZph.exe
  C:\Windows\System\QdILZph.exe
  2⤵
  PID:4840
- C:\Windows\System\sUdVabu.exe
  C:\Windows\System\sUdVabu.exe
  2⤵
  PID:4428
- C:\Windows\System\fQtKaej.exe
  C:\Windows\System\fQtKaej.exe
  2⤵
  PID:5028
- C:\Windows\System\ZukCBLq.exe
  C:\Windows\System\ZukCBLq.exe
  2⤵
  PID:4284
- C:\Windows\System\rcYeYJk.exe
  C:\Windows\System\rcYeYJk.exe
  2⤵
  PID:3584
- C:\Windows\System\HZQejOi.exe
  C:\Windows\System\HZQejOi.exe
  2⤵
  PID:4888
- C:\Windows\System\nATQylH.exe
  C:\Windows\System\nATQylH.exe
  2⤵
  PID:4788
- C:\Windows\System\KZRGqDt.exe
  C:\Windows\System\KZRGqDt.exe
  2⤵
  PID:4736
- C:\Windows\System\GxlaVBX.exe
  C:\Windows\System\GxlaVBX.exe
  2⤵
  PID:4704
- C:\Windows\System\pwpfHYJ.exe
  C:\Windows\System\pwpfHYJ.exe
  2⤵
  PID:1672
- C:\Windows\System\QmrBYCN.exe
  C:\Windows\System\QmrBYCN.exe
  2⤵
  PID:1508
- C:\Windows\System\ROpinYz.exe
  C:\Windows\System\ROpinYz.exe
  2⤵
  PID:4328
- C:\Windows\System\wkYRxIH.exe
  C:\Windows\System\wkYRxIH.exe
  2⤵
  PID:5124
- C:\Windows\System\smcPfgx.exe
  C:\Windows\System\smcPfgx.exe
  2⤵
  PID:5144
- C:\Windows\System\dgRtFyK.exe
  C:\Windows\System\dgRtFyK.exe
  2⤵
  PID:5160
- C:\Windows\System\nfawvns.exe
  C:\Windows\System\nfawvns.exe
  2⤵
  PID:5176
- C:\Windows\System\cLeDaqZ.exe
  C:\Windows\System\cLeDaqZ.exe
  2⤵
  PID:5192
- C:\Windows\System\BFtxrDy.exe
  C:\Windows\System\BFtxrDy.exe
  2⤵
  PID:5208
- C:\Windows\System\YcvOrLZ.exe
  C:\Windows\System\YcvOrLZ.exe
  2⤵
  PID:5224
- C:\Windows\System\RFbRvvQ.exe
  C:\Windows\System\RFbRvvQ.exe
  2⤵
  PID:5240
- C:\Windows\System\ZhIUuEn.exe
  C:\Windows\System\ZhIUuEn.exe
  2⤵
  PID:5256
- C:\Windows\System\LZwsGIG.exe
  C:\Windows\System\LZwsGIG.exe
  2⤵
  PID:5276
- C:\Windows\System\sfcKwMn.exe
  C:\Windows\System\sfcKwMn.exe
  2⤵
  PID:5292
- C:\Windows\System\XdBEKpe.exe
  C:\Windows\System\XdBEKpe.exe
  2⤵
  PID:5308
- C:\Windows\System\BNdjoWQ.exe
  C:\Windows\System\BNdjoWQ.exe
  2⤵
  PID:5324
- C:\Windows\System\FKpwIZe.exe
  C:\Windows\System\FKpwIZe.exe
  2⤵
  PID:5340
- C:\Windows\System\mbPjHMH.exe
  C:\Windows\System\mbPjHMH.exe
  2⤵
  PID:5356
- C:\Windows\System\kORpsuE.exe
  C:\Windows\System\kORpsuE.exe
  2⤵
  PID:5376
- C:\Windows\System\OazEfdd.exe
  C:\Windows\System\OazEfdd.exe
  2⤵
  PID:5396
- C:\Windows\System\NjEeFZq.exe
  C:\Windows\System\NjEeFZq.exe
  2⤵
  PID:5412
- C:\Windows\System\GzHODhT.exe
  C:\Windows\System\GzHODhT.exe
  2⤵
  PID:5428
- C:\Windows\System\HZzHhsU.exe
  C:\Windows\System\HZzHhsU.exe
  2⤵
  PID:5444
- C:\Windows\System\lrNYUhb.exe
  C:\Windows\System\lrNYUhb.exe
  2⤵
  PID:5464
- C:\Windows\System\GZbUzkL.exe
  C:\Windows\System\GZbUzkL.exe
  2⤵
  PID:5480
- C:\Windows\System\rqyPzVy.exe
  C:\Windows\System\rqyPzVy.exe
  2⤵
  PID:5496
- C:\Windows\System\AMBCjgT.exe
  C:\Windows\System\AMBCjgT.exe
  2⤵
  PID:5512
- C:\Windows\System\KzjzFjM.exe
  C:\Windows\System\KzjzFjM.exe
  2⤵
  PID:5528
- C:\Windows\System\xMyPeRS.exe
  C:\Windows\System\xMyPeRS.exe
  2⤵
  PID:5544
- C:\Windows\System\LNEDmrq.exe
  C:\Windows\System\LNEDmrq.exe
  2⤵
  PID:5564
- C:\Windows\System\BABvyjR.exe
  C:\Windows\System\BABvyjR.exe
  2⤵
  PID:5584
- C:\Windows\System\VIfwpPN.exe
  C:\Windows\System\VIfwpPN.exe
  2⤵
  PID:5604
- C:\Windows\System\tVUrKlR.exe
  C:\Windows\System\tVUrKlR.exe
  2⤵
  PID:5620
- C:\Windows\System\OoyWwap.exe
  C:\Windows\System\OoyWwap.exe
  2⤵
  PID:5636
- C:\Windows\System\OPgGICF.exe
  C:\Windows\System\OPgGICF.exe
  2⤵
  PID:5652
- C:\Windows\System\BwgCcHh.exe
  C:\Windows\System\BwgCcHh.exe
  2⤵
  PID:5668
- C:\Windows\System\neOYSJY.exe
  C:\Windows\System\neOYSJY.exe
  2⤵
  PID:5684
- C:\Windows\System\tRqSpfJ.exe
  C:\Windows\System\tRqSpfJ.exe
  2⤵
  PID:5700
- C:\Windows\System\inoEdgG.exe
  C:\Windows\System\inoEdgG.exe
  2⤵
  PID:5716
- C:\Windows\System\dyqfaxo.exe
  C:\Windows\System\dyqfaxo.exe
  2⤵
  PID:5732
- C:\Windows\System\jXTCCgS.exe
  C:\Windows\System\jXTCCgS.exe
  2⤵
  PID:5748
- C:\Windows\System\zRoxYDI.exe
  C:\Windows\System\zRoxYDI.exe
  2⤵
  PID:5764
- C:\Windows\System\gcDnJWi.exe
  C:\Windows\System\gcDnJWi.exe
  2⤵
  PID:5784
- C:\Windows\System\StBmRiD.exe
  C:\Windows\System\StBmRiD.exe
  2⤵
  PID:5800
- C:\Windows\System\ujpHDBg.exe
  C:\Windows\System\ujpHDBg.exe
  2⤵
  PID:5824
- C:\Windows\System\Cjzlmni.exe
  C:\Windows\System\Cjzlmni.exe
  2⤵
  PID:5840
- C:\Windows\System\SVSToex.exe
  C:\Windows\System\SVSToex.exe
  2⤵
  PID:5856
- C:\Windows\System\AztJMKm.exe
  C:\Windows\System\AztJMKm.exe
  2⤵
  PID:5872
- C:\Windows\System\QVmGvXX.exe
  C:\Windows\System\QVmGvXX.exe
  2⤵
  PID:5888
- C:\Windows\System\BvwmlWg.exe
  C:\Windows\System\BvwmlWg.exe
  2⤵
  PID:5904
- C:\Windows\System\LUEfEOM.exe
  C:\Windows\System\LUEfEOM.exe
  2⤵
  PID:5920
- C:\Windows\System\XuHXTXx.exe
  C:\Windows\System\XuHXTXx.exe
  2⤵
  PID:5936
- C:\Windows\System\nROfADL.exe
  C:\Windows\System\nROfADL.exe
  2⤵
  PID:5952
- C:\Windows\System\ldmSmSb.exe
  C:\Windows\System\ldmSmSb.exe
  2⤵
  PID:5968
- C:\Windows\System\zjRmYuR.exe
  C:\Windows\System\zjRmYuR.exe
  2⤵
  PID:6020
- C:\Windows\System\nNjAZPO.exe
  C:\Windows\System\nNjAZPO.exe
  2⤵
  PID:6036
- C:\Windows\System\WNCwIeT.exe
  C:\Windows\System\WNCwIeT.exe
  2⤵
  PID:6056
- C:\Windows\System\yOeREnV.exe
  C:\Windows\System\yOeREnV.exe
  2⤵
  PID:6072
- C:\Windows\System\nQOclaZ.exe
  C:\Windows\System\nQOclaZ.exe
  2⤵
  PID:6088
- C:\Windows\System\NvReOTf.exe
  C:\Windows\System\NvReOTf.exe
  2⤵
  PID:6104
- C:\Windows\System\fKkVbQi.exe
  C:\Windows\System\fKkVbQi.exe
  2⤵
  PID:6120
- C:\Windows\System\EgqNPRC.exe
  C:\Windows\System\EgqNPRC.exe
  2⤵
  PID:6136
- C:\Windows\System\oEVAsQy.exe
  C:\Windows\System\oEVAsQy.exe
  2⤵
  PID:4956
- C:\Windows\System\APwOJbm.exe
  C:\Windows\System\APwOJbm.exe
  2⤵
  PID:4820
- C:\Windows\System\ATZwSFA.exe
  C:\Windows\System\ATZwSFA.exe
  2⤵
  PID:5172
- C:\Windows\System\IYzJKPd.exe
  C:\Windows\System\IYzJKPd.exe
  2⤵
  PID:5168
- C:\Windows\System\aelHqVu.exe
  C:\Windows\System\aelHqVu.exe
  2⤵
  PID:4348
- C:\Windows\System\RLWNybt.exe
  C:\Windows\System\RLWNybt.exe
  2⤵
  PID:5264
- C:\Windows\System\VrYiAlp.exe
  C:\Windows\System\VrYiAlp.exe
  2⤵
  PID:5272
- C:\Windows\System\XoQMwln.exe
  C:\Windows\System\XoQMwln.exe
  2⤵
  PID:5220
- C:\Windows\System\qXoRDPF.exe
  C:\Windows\System\qXoRDPF.exe
  2⤵
  PID:5248
- C:\Windows\System\uixgClX.exe
  C:\Windows\System\uixgClX.exe
  2⤵
  PID:5348
- C:\Windows\System\aKxLmdf.exe
  C:\Windows\System\aKxLmdf.exe
  2⤵
  PID:5424
- C:\Windows\System\zljqOlH.exe
  C:\Windows\System\zljqOlH.exe
  2⤵
  PID:5560
- C:\Windows\System\PMgDvju.exe
  C:\Windows\System\PMgDvju.exe
  2⤵
  PID:5576
- C:\Windows\System\JDDBHAE.exe
  C:\Windows\System\JDDBHAE.exe
  2⤵
  PID:5492
- C:\Windows\System\AKYZHws.exe
  C:\Windows\System\AKYZHws.exe
  2⤵
  PID:5648
- C:\Windows\System\zSokUVI.exe
  C:\Windows\System\zSokUVI.exe
  2⤵
  PID:5632
- C:\Windows\System\UxYwJki.exe
  C:\Windows\System\UxYwJki.exe
  2⤵
  PID:5696
- C:\Windows\System\aRWCHFS.exe
  C:\Windows\System\aRWCHFS.exe
  2⤵
  PID:5740
- C:\Windows\System\Bmdghim.exe
  C:\Windows\System\Bmdghim.exe
  2⤵
  PID:5796
- C:\Windows\System\eYvUrLQ.exe
  C:\Windows\System\eYvUrLQ.exe
  2⤵
  PID:5808
- C:\Windows\System\raHuNbZ.exe
  C:\Windows\System\raHuNbZ.exe
  2⤵
  PID:5836
- C:\Windows\System\pMPxvgp.exe
  C:\Windows\System\pMPxvgp.exe
  2⤵
  PID:5880
- C:\Windows\System\cwjwiaw.exe
  C:\Windows\System\cwjwiaw.exe
  2⤵
  PID:5896
- C:\Windows\System\HKwHJlf.exe
  C:\Windows\System\HKwHJlf.exe
  2⤵
  PID:5960
- C:\Windows\System\IcgFNGk.exe
  C:\Windows\System\IcgFNGk.exe
  2⤵
  PID:5916
- C:\Windows\System\iHmBfbb.exe
  C:\Windows\System\iHmBfbb.exe
  2⤵
  PID:5992
- C:\Windows\System\pADuAyu.exe
  C:\Windows\System\pADuAyu.exe
  2⤵
  PID:6008
- C:\Windows\System\lDIyJmn.exe
  C:\Windows\System\lDIyJmn.exe
  2⤵
  PID:6052
- C:\Windows\System\Tjfelya.exe
  C:\Windows\System\Tjfelya.exe
  2⤵
  PID:6032
- C:\Windows\System\rvLMoSm.exe
  C:\Windows\System\rvLMoSm.exe
  2⤵
  PID:6128
- C:\Windows\System\hTNgIdL.exe
  C:\Windows\System\hTNgIdL.exe
  2⤵
  PID:6112
- C:\Windows\System\hRcPGzv.exe
  C:\Windows\System\hRcPGzv.exe
  2⤵
  PID:4512
- C:\Windows\System\oWtUskX.exe
  C:\Windows\System\oWtUskX.exe
  2⤵
  PID:3792
- C:\Windows\System\TgJRFwU.exe
  C:\Windows\System\TgJRFwU.exe
  2⤵
  PID:5216
- C:\Windows\System\cFexzkP.exe
  C:\Windows\System\cFexzkP.exe
  2⤵
  PID:5332
- C:\Windows\System\ajNMdlC.exe
  C:\Windows\System\ajNMdlC.exe
  2⤵
  PID:5140
- C:\Windows\System\RaFAzUO.exe
  C:\Windows\System\RaFAzUO.exe
  2⤵
  PID:5816
- C:\Windows\System\MyLlwIN.exe
  C:\Windows\System\MyLlwIN.exe
  2⤵
  PID:5388
- C:\Windows\System\YjvTXDy.exe
  C:\Windows\System\YjvTXDy.exe
  2⤵
  PID:5392
- C:\Windows\System\DxnbFEa.exe
  C:\Windows\System\DxnbFEa.exe
  2⤵
  PID:5456
- C:\Windows\System\FcklWWj.exe
  C:\Windows\System\FcklWWj.exe
  2⤵
  PID:5540
- C:\Windows\System\LRDZKYA.exe
  C:\Windows\System\LRDZKYA.exe
  2⤵
  PID:108
- C:\Windows\System\GOrPbVh.exe
  C:\Windows\System\GOrPbVh.exe
  2⤵
  PID:5600
- C:\Windows\System\BNCgqls.exe
  C:\Windows\System\BNCgqls.exe
  2⤵
  PID:5728
- C:\Windows\System\blzvTEx.exe
  C:\Windows\System\blzvTEx.exe
  2⤵
  PID:5756
- C:\Windows\System\SrDxjnU.exe
  C:\Windows\System\SrDxjnU.exe
  2⤵
  PID:5852
- C:\Windows\System\kdUqmna.exe
  C:\Windows\System\kdUqmna.exe
  2⤵
  PID:5948
- C:\Windows\System\CcEmQcF.exe
  C:\Windows\System\CcEmQcF.exe
  2⤵
  PID:5864
- C:\Windows\System\JrFKipi.exe
  C:\Windows\System\JrFKipi.exe
  2⤵
  PID:5980
- C:\Windows\System\ycBmZLs.exe
  C:\Windows\System\ycBmZLs.exe
  2⤵
  PID:6080
- C:\Windows\System\cWlzpKC.exe
  C:\Windows\System\cWlzpKC.exe
  2⤵
  PID:6100
- C:\Windows\System\qusejru.exe
  C:\Windows\System\qusejru.exe
  2⤵
  PID:5136
- C:\Windows\System\EwWPtTj.exe
  C:\Windows\System\EwWPtTj.exe
  2⤵
  PID:5320
- C:\Windows\System\kfLixNH.exe
  C:\Windows\System\kfLixNH.exe
  2⤵
  PID:4196
- C:\Windows\System\FSSCjIH.exe
  C:\Windows\System\FSSCjIH.exe
  2⤵
  PID:5420
- C:\Windows\System\WMlIhwG.exe
  C:\Windows\System\WMlIhwG.exe
  2⤵
  PID:5372
- C:\Windows\System\gXMxQap.exe
  C:\Windows\System\gXMxQap.exe
  2⤵
  PID:5712
- C:\Windows\System\bJJtEdQ.exe
  C:\Windows\System\bJJtEdQ.exe
  2⤵
  PID:5772
- C:\Windows\System\XffJPQn.exe
  C:\Windows\System\XffJPQn.exe
  2⤵
  PID:5820
- C:\Windows\System\jzpnipk.exe
  C:\Windows\System\jzpnipk.exe
  2⤵
  PID:4636
- C:\Windows\System\vQTGlrE.exe
  C:\Windows\System\vQTGlrE.exe
  2⤵
  PID:5988
- C:\Windows\System\aHzgJkt.exe
  C:\Windows\System\aHzgJkt.exe
  2⤵
  PID:5384
- C:\Windows\System\MOOLyXv.exe
  C:\Windows\System\MOOLyXv.exe
  2⤵
  PID:5488
- C:\Windows\System\weWFypJ.exe
  C:\Windows\System\weWFypJ.exe
  2⤵
  PID:6068
- C:\Windows\System\RNdfxzZ.exe
  C:\Windows\System\RNdfxzZ.exe
  2⤵
  PID:5900
- C:\Windows\System\rEJOzOR.exe
  C:\Windows\System\rEJOzOR.exe
  2⤵
  PID:5460
- C:\Windows\System\vwWnouO.exe
  C:\Windows\System\vwWnouO.exe
  2⤵
  PID:5644
- C:\Windows\System\AlikEcm.exe
  C:\Windows\System\AlikEcm.exe
  2⤵
  PID:6160
- C:\Windows\System\woXxocR.exe
  C:\Windows\System\woXxocR.exe
  2⤵
  PID:6176
- C:\Windows\System\OgNHWEz.exe
  C:\Windows\System\OgNHWEz.exe
  2⤵
  PID:6192
- C:\Windows\System\QKntRPd.exe
  C:\Windows\System\QKntRPd.exe
  2⤵
  PID:6208
- C:\Windows\System\NVvGgPu.exe
  C:\Windows\System\NVvGgPu.exe
  2⤵
  PID:6224
- C:\Windows\System\kBQwlPp.exe
  C:\Windows\System\kBQwlPp.exe
  2⤵
  PID:6240
- C:\Windows\System\jVbuiYt.exe
  C:\Windows\System\jVbuiYt.exe
  2⤵
  PID:6256
- C:\Windows\System\vEdyuab.exe
  C:\Windows\System\vEdyuab.exe
  2⤵
  PID:6272
- C:\Windows\System\sslNVMn.exe
  C:\Windows\System\sslNVMn.exe
  2⤵
  PID:6292
- C:\Windows\System\uXHFatN.exe
  C:\Windows\System\uXHFatN.exe
  2⤵
  PID:6308
- C:\Windows\System\BWrFGzp.exe
  C:\Windows\System\BWrFGzp.exe
  2⤵
  PID:6324
- C:\Windows\System\HiPdsmC.exe
  C:\Windows\System\HiPdsmC.exe
  2⤵
  PID:6340
- C:\Windows\System\xmhhVeQ.exe
  C:\Windows\System\xmhhVeQ.exe
  2⤵
  PID:6356
- C:\Windows\System\iqkeebd.exe
  C:\Windows\System\iqkeebd.exe
  2⤵
  PID:6372
- C:\Windows\System\BMiSiZJ.exe
  C:\Windows\System\BMiSiZJ.exe
  2⤵
  PID:6388
- C:\Windows\System\pYKPQCY.exe
  C:\Windows\System\pYKPQCY.exe
  2⤵
  PID:6404
- C:\Windows\System\hdHGnDC.exe
  C:\Windows\System\hdHGnDC.exe
  2⤵
  PID:6420
- C:\Windows\System\DGriaJL.exe
  C:\Windows\System\DGriaJL.exe
  2⤵
  PID:6436
- C:\Windows\System\QrPDRWk.exe
  C:\Windows\System\QrPDRWk.exe
  2⤵
  PID:6452
- C:\Windows\System\CBrHxHq.exe
  C:\Windows\System\CBrHxHq.exe
  2⤵
  PID:6468
- C:\Windows\System\keNOdxZ.exe
  C:\Windows\System\keNOdxZ.exe
  2⤵
  PID:6484
- C:\Windows\System\KkRmCnP.exe
  C:\Windows\System\KkRmCnP.exe
  2⤵
  PID:6500
- C:\Windows\System\FXNaGKL.exe
  C:\Windows\System\FXNaGKL.exe
  2⤵
  PID:6516
- C:\Windows\System\PNxiiMf.exe
  C:\Windows\System\PNxiiMf.exe
  2⤵
  PID:6536
- C:\Windows\System\tEgdbBg.exe
  C:\Windows\System\tEgdbBg.exe
  2⤵
  PID:6552
- C:\Windows\System\HJvnKGS.exe
  C:\Windows\System\HJvnKGS.exe
  2⤵
  PID:6568
- C:\Windows\System\knLLoxj.exe
  C:\Windows\System\knLLoxj.exe
  2⤵
  PID:6584
- C:\Windows\System\bweoprY.exe
  C:\Windows\System\bweoprY.exe
  2⤵
  PID:6600
- C:\Windows\System\UBkynfP.exe
  C:\Windows\System\UBkynfP.exe
  2⤵
  PID:6616
- C:\Windows\System\nFqCzTo.exe
  C:\Windows\System\nFqCzTo.exe
  2⤵
  PID:6632
- C:\Windows\System\PPxHemH.exe
  C:\Windows\System\PPxHemH.exe
  2⤵
  PID:6648
- C:\Windows\System\SrRBVCo.exe
  C:\Windows\System\SrRBVCo.exe
  2⤵
  PID:6664
- C:\Windows\System\MZzeARD.exe
  C:\Windows\System\MZzeARD.exe
  2⤵
  PID:6680
- C:\Windows\System\mgYtkbX.exe
  C:\Windows\System\mgYtkbX.exe
  2⤵
  PID:6696
- C:\Windows\System\DhOqfxb.exe
  C:\Windows\System\DhOqfxb.exe
  2⤵
  PID:6712
- C:\Windows\System\JeseENV.exe
  C:\Windows\System\JeseENV.exe
  2⤵
  PID:6728
- C:\Windows\System\puhKyDd.exe
  C:\Windows\System\puhKyDd.exe
  2⤵
  PID:6744
- C:\Windows\System\DCSxdjD.exe
  C:\Windows\System\DCSxdjD.exe
  2⤵
  PID:6760
- C:\Windows\System\OnyvKNp.exe
  C:\Windows\System\OnyvKNp.exe
  2⤵
  PID:6776
- C:\Windows\System\hjzJuOy.exe
  C:\Windows\System\hjzJuOy.exe
  2⤵
  PID:6792
- C:\Windows\System\hkiMFVy.exe
  C:\Windows\System\hkiMFVy.exe
  2⤵
  PID:6808
- C:\Windows\System\XVVTxgM.exe
  C:\Windows\System\XVVTxgM.exe
  2⤵
  PID:6824
- C:\Windows\System\qftxvET.exe
  C:\Windows\System\qftxvET.exe
  2⤵
  PID:6840
- C:\Windows\System\kTCMxHg.exe
  C:\Windows\System\kTCMxHg.exe
  2⤵
  PID:6860
- C:\Windows\System\HHttYUi.exe
  C:\Windows\System\HHttYUi.exe
  2⤵
  PID:6876
- C:\Windows\System\cnVHZPi.exe
  C:\Windows\System\cnVHZPi.exe
  2⤵
  PID:6892
- C:\Windows\System\NFFwFRr.exe
  C:\Windows\System\NFFwFRr.exe
  2⤵
  PID:6908
- C:\Windows\System\bJoTpYw.exe
  C:\Windows\System\bJoTpYw.exe
  2⤵
  PID:6924
- C:\Windows\System\tJXypiB.exe
  C:\Windows\System\tJXypiB.exe
  2⤵
  PID:6940
- C:\Windows\System\zXQYyJv.exe
  C:\Windows\System\zXQYyJv.exe
  2⤵
  PID:6956
- C:\Windows\System\FMfcWPL.exe
  C:\Windows\System\FMfcWPL.exe
  2⤵
  PID:6972
- C:\Windows\System\BOkIzuI.exe
  C:\Windows\System\BOkIzuI.exe
  2⤵
  PID:6988
- C:\Windows\System\vxFomJc.exe
  C:\Windows\System\vxFomJc.exe
  2⤵
  PID:7004
- C:\Windows\System\ZcgbmNP.exe
  C:\Windows\System\ZcgbmNP.exe
  2⤵
  PID:7020
- C:\Windows\System\EguFSdz.exe
  C:\Windows\System\EguFSdz.exe
  2⤵
  PID:7036
- C:\Windows\System\faVscqW.exe
  C:\Windows\System\faVscqW.exe
  2⤵
  PID:7052
- C:\Windows\System\iTiOkZE.exe
  C:\Windows\System\iTiOkZE.exe
  2⤵
  PID:7072
- C:\Windows\System\UkaIFaE.exe
  C:\Windows\System\UkaIFaE.exe
  2⤵
  PID:7088
- C:\Windows\System\rcCUGVN.exe
  C:\Windows\System\rcCUGVN.exe
  2⤵
  PID:7104
- C:\Windows\System\HFySkwZ.exe
  C:\Windows\System\HFySkwZ.exe
  2⤵
  PID:7120
- C:\Windows\System\MxajOIF.exe
  C:\Windows\System\MxajOIF.exe
  2⤵
  PID:7136
- C:\Windows\System\WbuNzen.exe
  C:\Windows\System\WbuNzen.exe
  2⤵
  PID:7152
- C:\Windows\System\kVZhaDh.exe
  C:\Windows\System\kVZhaDh.exe
  2⤵
  PID:5556
- C:\Windows\System\RmvlPFu.exe
  C:\Windows\System\RmvlPFu.exe
  2⤵
  PID:5928
- C:\Windows\System\ThDsebc.exe
  C:\Windows\System\ThDsebc.exe
  2⤵
  PID:5628
- C:\Windows\System\jioWVHF.exe
  C:\Windows\System\jioWVHF.exe
  2⤵
  PID:6400
- C:\Windows\System\rCRLXVr.exe
  C:\Windows\System\rCRLXVr.exe
  2⤵
  PID:6448
- C:\Windows\System\clRRRSm.exe
  C:\Windows\System\clRRRSm.exe
  2⤵
  PID:6512
- C:\Windows\System\naPmPct.exe
  C:\Windows\System\naPmPct.exe
  2⤵
  PID:6532
- C:\Windows\System\OHXNspA.exe
  C:\Windows\System\OHXNspA.exe
  2⤵
  PID:6564
- C:\Windows\System\VOMcdNg.exe
  C:\Windows\System\VOMcdNg.exe
  2⤵
  PID:6612
- C:\Windows\System\THywTal.exe
  C:\Windows\System\THywTal.exe
  2⤵
  PID:6660
- C:\Windows\System\bvvdvhO.exe
  C:\Windows\System\bvvdvhO.exe
  2⤵
  PID:6736
- C:\Windows\System\TUNsOrs.exe
  C:\Windows\System\TUNsOrs.exe
  2⤵
  PID:6772
- C:\Windows\System\JyoeKFY.exe
  C:\Windows\System\JyoeKFY.exe
  2⤵
  PID:6756
- C:\Windows\System\rRUuRwN.exe
  C:\Windows\System\rRUuRwN.exe
  2⤵
  PID:6832
- C:\Windows\System\jXHLbpv.exe
  C:\Windows\System\jXHLbpv.exe
  2⤵
  PID:6852
- C:\Windows\System\ycUqgxf.exe
  C:\Windows\System\ycUqgxf.exe
  2⤵
  PID:6916
- C:\Windows\System\lCNWIJk.exe
  C:\Windows\System\lCNWIJk.exe
  2⤵
  PID:7044
- C:\Windows\System\MTPEwSB.exe
  C:\Windows\System\MTPEwSB.exe
  2⤵
  PID:6932
- C:\Windows\System\RdksCAh.exe
  C:\Windows\System\RdksCAh.exe
  2⤵
  PID:7000
- C:\Windows\System\FYRfDYV.exe
  C:\Windows\System\FYRfDYV.exe
  2⤵
  PID:7080
- C:\Windows\System\rrIoMIa.exe
  C:\Windows\System\rrIoMIa.exe
  2⤵
  PID:7068
- C:\Windows\System\kFHdRFp.exe
  C:\Windows\System\kFHdRFp.exe
  2⤵
  PID:7160
- C:\Windows\System\tUPwTga.exe
  C:\Windows\System\tUPwTga.exe
  2⤵
  PID:7132
- C:\Windows\System\rSHEBfo.exe
  C:\Windows\System\rSHEBfo.exe
  2⤵
  PID:6168
- C:\Windows\System\NtMfUyo.exe
  C:\Windows\System\NtMfUyo.exe
  2⤵
  PID:6348
- C:\Windows\System\aqrQytT.exe
  C:\Windows\System\aqrQytT.exe
  2⤵
  PID:6236
- C:\Windows\System\KvLDMFC.exe
  C:\Windows\System\KvLDMFC.exe
  2⤵
  PID:6396
- C:\Windows\System\muirEbD.exe
  C:\Windows\System\muirEbD.exe
  2⤵
  PID:6216
- C:\Windows\System\xREoivb.exe
  C:\Windows\System\xREoivb.exe
  2⤵
  PID:5984
- C:\Windows\System\LNGxxSu.exe
  C:\Windows\System\LNGxxSu.exe
  2⤵
  PID:6304
- C:\Windows\System\yTJnSdp.exe
  C:\Windows\System\yTJnSdp.exe
  2⤵
  PID:6380
- C:\Windows\System\qCDbkJb.exe
  C:\Windows\System\qCDbkJb.exe
  2⤵
  PID:6508
- C:\Windows\System\pRBdCRo.exe
  C:\Windows\System\pRBdCRo.exe
  2⤵
  PID:6628
- C:\Windows\System\cJULtnE.exe
  C:\Windows\System\cJULtnE.exe
  2⤵
  PID:6768
- C:\Windows\System\HfbgwuZ.exe
  C:\Windows\System\HfbgwuZ.exe
  2⤵
  PID:6596
- C:\Windows\System\MeCruXm.exe
  C:\Windows\System\MeCruXm.exe
  2⤵
  PID:6460
- C:\Windows\System\NSSZupI.exe
  C:\Windows\System\NSSZupI.exe
  2⤵
  PID:6884
- C:\Windows\System\tsPWUVA.exe
  C:\Windows\System\tsPWUVA.exe
  2⤵
  PID:6692
- C:\Windows\System\LVzKxuW.exe
  C:\Windows\System\LVzKxuW.exe
  2⤵
  PID:6724
- C:\Windows\System\pEQMlnp.exe
  C:\Windows\System\pEQMlnp.exe
  2⤵
  PID:6948
- C:\Windows\System\DEYFdCK.exe
  C:\Windows\System\DEYFdCK.exe
  2⤵
  PID:7012
- C:\Windows\System\btFSWeN.exe
  C:\Windows\System\btFSWeN.exe
  2⤵
  PID:7028
- C:\Windows\System\HWscXLM.exe
  C:\Windows\System\HWscXLM.exe
  2⤵
  PID:7128
- C:\Windows\System\lArXWdj.exe
  C:\Windows\System\lArXWdj.exe
  2⤵
  PID:6204
- C:\Windows\System\OAsMkLK.exe
  C:\Windows\System\OAsMkLK.exe
  2⤵
  PID:7096
- C:\Windows\System\ZXPbklb.exe
  C:\Windows\System\ZXPbklb.exe
  2⤵
  PID:6316
- C:\Windows\System\SDbiyUi.exe
  C:\Windows\System\SDbiyUi.exe
  2⤵
  PID:6280
- C:\Windows\System\DYFOSot.exe
  C:\Windows\System\DYFOSot.exe
  2⤵
  PID:6412
- C:\Windows\System\nNWKdtK.exe
  C:\Windows\System\nNWKdtK.exe
  2⤵
  PID:6752
- C:\Windows\System\yYPxigI.exe
  C:\Windows\System\yYPxigI.exe
  2⤵
  PID:6608
- C:\Windows\System\eGwSadk.exe
  C:\Windows\System\eGwSadk.exe
  2⤵
  PID:6560
- C:\Windows\System\QxPUmEj.exe
  C:\Windows\System\QxPUmEj.exe
  2⤵
  PID:6804
- C:\Windows\System\xXsQMQa.exe
  C:\Windows\System\xXsQMQa.exe
  2⤵
  PID:6984
- C:\Windows\System\HNIeWJy.exe
  C:\Windows\System\HNIeWJy.exe
  2⤵
  PID:6900
- C:\Windows\System\XPNKwKk.exe
  C:\Windows\System\XPNKwKk.exe
  2⤵
  PID:6220
- C:\Windows\System\eKwuSfo.exe
  C:\Windows\System\eKwuSfo.exe
  2⤵
  PID:6672
- C:\Windows\System\feSzYJK.exe
  C:\Windows\System\feSzYJK.exe
  2⤵
  PID:6904
- C:\Windows\System\DWzRnWH.exe
  C:\Windows\System\DWzRnWH.exe
  2⤵
  PID:7144
- C:\Windows\System\qyudhtQ.exe
  C:\Windows\System\qyudhtQ.exe
  2⤵
  PID:6364
- C:\Windows\System\cbkvEdt.exe
  C:\Windows\System\cbkvEdt.exe
  2⤵
  PID:6528
- C:\Windows\System\XahXRQE.exe
  C:\Windows\System\XahXRQE.exe
  2⤵
  PID:6336
- C:\Windows\System\YMxtbZX.exe
  C:\Windows\System\YMxtbZX.exe
  2⤵
  PID:6820
- C:\Windows\System\sBAGguh.exe
  C:\Windows\System\sBAGguh.exe
  2⤵
  PID:6184
- C:\Windows\System\TGgcGMX.exe
  C:\Windows\System\TGgcGMX.exe
  2⤵
  PID:6968
- C:\Windows\System\fgAZXga.exe
  C:\Windows\System\fgAZXga.exe
  2⤵
  PID:7172
- C:\Windows\System\fktooIt.exe
  C:\Windows\System\fktooIt.exe
  2⤵
  PID:7188
- C:\Windows\System\jIvoPLG.exe
  C:\Windows\System\jIvoPLG.exe
  2⤵
  PID:7208
- C:\Windows\System\cvcEnIB.exe
  C:\Windows\System\cvcEnIB.exe
  2⤵
  PID:7224
- C:\Windows\System\ndelhER.exe
  C:\Windows\System\ndelhER.exe
  2⤵
  PID:7240
- C:\Windows\System\avlkJmo.exe
  C:\Windows\System\avlkJmo.exe
  2⤵
  PID:7256
- C:\Windows\System\ZhwQOMe.exe
  C:\Windows\System\ZhwQOMe.exe
  2⤵
  PID:7272
- C:\Windows\System\YiEctzG.exe
  C:\Windows\System\YiEctzG.exe
  2⤵
  PID:7288
- C:\Windows\System\kjHCcfz.exe
  C:\Windows\System\kjHCcfz.exe
  2⤵
  PID:7304
- C:\Windows\System\bzDYeFu.exe
  C:\Windows\System\bzDYeFu.exe
  2⤵
  PID:7320
- C:\Windows\System\IxiBtvX.exe
  C:\Windows\System\IxiBtvX.exe
  2⤵
  PID:7336
- C:\Windows\System\GlKSlzM.exe
  C:\Windows\System\GlKSlzM.exe
  2⤵
  PID:7352
- C:\Windows\System\kUJicjR.exe
  C:\Windows\System\kUJicjR.exe
  2⤵
  PID:7368
- C:\Windows\System\ejAzhoQ.exe
  C:\Windows\System\ejAzhoQ.exe
  2⤵
  PID:7384
- C:\Windows\System\VCdXMAo.exe
  C:\Windows\System\VCdXMAo.exe
  2⤵
  PID:7400
- C:\Windows\System\zDNsYRn.exe
  C:\Windows\System\zDNsYRn.exe
  2⤵
  PID:7416
- C:\Windows\System\XIaJuTr.exe
  C:\Windows\System\XIaJuTr.exe
  2⤵
  PID:7432
- C:\Windows\System\HoBKuAI.exe
  C:\Windows\System\HoBKuAI.exe
  2⤵
  PID:7448
- C:\Windows\System\OwBGluI.exe
  C:\Windows\System\OwBGluI.exe
  2⤵
  PID:7464
- C:\Windows\System\RuycLXX.exe
  C:\Windows\System\RuycLXX.exe
  2⤵
  PID:7480
- C:\Windows\System\NUFDBAi.exe
  C:\Windows\System\NUFDBAi.exe
  2⤵
  PID:7496
- C:\Windows\System\xIdMsxh.exe
  C:\Windows\System\xIdMsxh.exe
  2⤵
  PID:7512
- C:\Windows\System\KKSnOmW.exe
  C:\Windows\System\KKSnOmW.exe
  2⤵
  PID:7528
- C:\Windows\System\bUGBNfx.exe
  C:\Windows\System\bUGBNfx.exe
  2⤵
  PID:7544
- C:\Windows\System\fPYweTS.exe
  C:\Windows\System\fPYweTS.exe
  2⤵
  PID:7560
- C:\Windows\System\UVyQcBW.exe
  C:\Windows\System\UVyQcBW.exe
  2⤵
  PID:7576
- C:\Windows\System\ZetKVWp.exe
  C:\Windows\System\ZetKVWp.exe
  2⤵
  PID:7592
- C:\Windows\System\KzfUVMM.exe
  C:\Windows\System\KzfUVMM.exe
  2⤵
  PID:7608
- C:\Windows\System\RXdQhgx.exe
  C:\Windows\System\RXdQhgx.exe
  2⤵
  PID:7624
- C:\Windows\System\lpxpRuA.exe
  C:\Windows\System\lpxpRuA.exe
  2⤵
  PID:7640
- C:\Windows\System\bFmWjnp.exe
  C:\Windows\System\bFmWjnp.exe
  2⤵
  PID:7656
- C:\Windows\System\kTldirZ.exe
  C:\Windows\System\kTldirZ.exe
  2⤵
  PID:7672
- C:\Windows\System\tKmrepU.exe
  C:\Windows\System\tKmrepU.exe
  2⤵
  PID:7688
- C:\Windows\System\yUgTCXa.exe
  C:\Windows\System\yUgTCXa.exe
  2⤵
  PID:7704
- C:\Windows\System\QsaGvBb.exe
  C:\Windows\System\QsaGvBb.exe
  2⤵
  PID:7720
- C:\Windows\System\wKDtnBE.exe
  C:\Windows\System\wKDtnBE.exe
  2⤵
  PID:7736
- C:\Windows\System\vjnvcRc.exe
  C:\Windows\System\vjnvcRc.exe
  2⤵
  PID:7752
- C:\Windows\System\iCpVMWw.exe
  C:\Windows\System\iCpVMWw.exe
  2⤵
  PID:7772
- C:\Windows\System\EkmZuTD.exe
  C:\Windows\System\EkmZuTD.exe
  2⤵
  PID:7788
- C:\Windows\System\fwDQuma.exe
  C:\Windows\System\fwDQuma.exe
  2⤵
  PID:7860
- C:\Windows\System\pkwvYpD.exe
  C:\Windows\System\pkwvYpD.exe
  2⤵
  PID:7880
- C:\Windows\System\dcWFEss.exe
  C:\Windows\System\dcWFEss.exe
  2⤵
  PID:7896
- C:\Windows\System\qzRMBZT.exe
  C:\Windows\System\qzRMBZT.exe
  2⤵
  PID:7912
- C:\Windows\System\YuvkTXb.exe
  C:\Windows\System\YuvkTXb.exe
  2⤵
  PID:7928
- C:\Windows\System\lKgRTCf.exe
  C:\Windows\System\lKgRTCf.exe
  2⤵
  PID:7944
- C:\Windows\System\UDGGqjb.exe
  C:\Windows\System\UDGGqjb.exe
  2⤵
  PID:7960
- C:\Windows\System\CgCOxGs.exe
  C:\Windows\System\CgCOxGs.exe
  2⤵
  PID:7976
- C:\Windows\System\NKmApIb.exe
  C:\Windows\System\NKmApIb.exe
  2⤵
  PID:7996
- C:\Windows\System\isfMBxC.exe
  C:\Windows\System\isfMBxC.exe
  2⤵
  PID:8012
- C:\Windows\System\NdvNFMD.exe
  C:\Windows\System\NdvNFMD.exe
  2⤵
  PID:8028
- C:\Windows\System\QDQmbGL.exe
  C:\Windows\System\QDQmbGL.exe
  2⤵
  PID:8044
- C:\Windows\System\PWyZeVA.exe
  C:\Windows\System\PWyZeVA.exe
  2⤵
  PID:8060
- C:\Windows\System\lvKuQkn.exe
  C:\Windows\System\lvKuQkn.exe
  2⤵
  PID:8076
- C:\Windows\System\WQoBFZU.exe
  C:\Windows\System\WQoBFZU.exe
  2⤵
  PID:8092
- C:\Windows\System\QlybMVf.exe
  C:\Windows\System\QlybMVf.exe
  2⤵
  PID:8108
- C:\Windows\System\DBRATUb.exe
  C:\Windows\System\DBRATUb.exe
  2⤵
  PID:8124
- C:\Windows\System\ILkgOLi.exe
  C:\Windows\System\ILkgOLi.exe
  2⤵
  PID:8152
- C:\Windows\System\rHGJXOD.exe
  C:\Windows\System\rHGJXOD.exe
  2⤵
  PID:8168
- C:\Windows\System\owhARbp.exe
  C:\Windows\System\owhARbp.exe
  2⤵
  PID:8184
- C:\Windows\System\ZZZRONe.exe
  C:\Windows\System\ZZZRONe.exe
  2⤵
  PID:7064
- C:\Windows\System\bBIHpDm.exe
  C:\Windows\System\bBIHpDm.exe
  2⤵
  PID:7312
- C:\Windows\System\mBnXBwa.exe
  C:\Windows\System\mBnXBwa.exe
  2⤵
  PID:7348
- C:\Windows\System\byBUrjL.exe
  C:\Windows\System\byBUrjL.exe
  2⤵
  PID:7408
- C:\Windows\System\TCaWzRm.exe
  C:\Windows\System\TCaWzRm.exe
  2⤵
  PID:7476
- C:\Windows\System\TrRFVff.exe
  C:\Windows\System\TrRFVff.exe
  2⤵
  PID:7536
- C:\Windows\System\hdDxCJC.exe
  C:\Windows\System\hdDxCJC.exe
  2⤵
  PID:7460
- C:\Windows\System\NDpZAEp.exe
  C:\Windows\System\NDpZAEp.exe
  2⤵
  PID:7264
- C:\Windows\System\PDamLaO.exe
  C:\Windows\System\PDamLaO.exe
  2⤵
  PID:7424
- C:\Windows\System\WtfmqDS.exe
  C:\Windows\System\WtfmqDS.exe
  2⤵
  PID:7728
- C:\Windows\System\GJYENsm.exe
  C:\Windows\System\GJYENsm.exe
  2⤵
  PID:7892
- C:\Windows\System\uFpsUrx.exe
  C:\Windows\System\uFpsUrx.exe
  2⤵
  PID:8072
- C:\Windows\System\xLNywcm.exe
  C:\Windows\System\xLNywcm.exe
  2⤵
  PID:8100
- C:\Windows\System\tPwZnjv.exe
  C:\Windows\System\tPwZnjv.exe
  2⤵
  PID:8132
- C:\Windows\System\PluOjfy.exe
  C:\Windows\System\PluOjfy.exe
  2⤵
  PID:6352
- C:\Windows\System\CidJbxE.exe
  C:\Windows\System\CidJbxE.exe
  2⤵
  PID:7216
- C:\Windows\System\SsphLzI.exe
  C:\Windows\System\SsphLzI.exe
  2⤵
  PID:7284
- C:\Windows\System\LuHAQXS.exe
  C:\Windows\System\LuHAQXS.exe
  2⤵
  PID:7316
- C:\Windows\System\JIuoFpc.exe
  C:\Windows\System\JIuoFpc.exe
  2⤵
  PID:7332
- C:\Windows\System\mFoalSP.exe
  C:\Windows\System\mFoalSP.exe
  2⤵
  PID:7200
- C:\Windows\System\jbaVKhl.exe
  C:\Windows\System\jbaVKhl.exe
  2⤵
  PID:7568
- C:\Windows\System\zgKZfCg.exe
  C:\Windows\System\zgKZfCg.exe
  2⤵
  PID:7524
- C:\Windows\System\FRvTWNu.exe
  C:\Windows\System\FRvTWNu.exe
  2⤵
  PID:7572
- C:\Windows\System\ZCcVwdQ.exe
  C:\Windows\System\ZCcVwdQ.exe
  2⤵
  PID:7652
- C:\Windows\System\iTStPFi.exe
  C:\Windows\System\iTStPFi.exe
  2⤵
  PID:7636
- C:\Windows\System\KfgEAsJ.exe
  C:\Windows\System\KfgEAsJ.exe
  2⤵
  PID:7700
- C:\Windows\System\bJNSeaV.exe
  C:\Windows\System\bJNSeaV.exe
  2⤵
  PID:7680
- C:\Windows\System\mBVhXbU.exe
  C:\Windows\System\mBVhXbU.exe
  2⤵
  PID:7780
- C:\Windows\System\oIpUfZL.exe
  C:\Windows\System\oIpUfZL.exe
  2⤵
  PID:7804
- C:\Windows\System\PrIJEWs.exe
  C:\Windows\System\PrIJEWs.exe
  2⤵
  PID:7824
- C:\Windows\System\dQFzfwj.exe
  C:\Windows\System\dQFzfwj.exe
  2⤵
  PID:6232
- C:\Windows\System\SEFtVgk.exe
  C:\Windows\System\SEFtVgk.exe
  2⤵
  PID:7872
- C:\Windows\System\oaXYxzV.exe
  C:\Windows\System\oaXYxzV.exe
  2⤵
  PID:7876
- C:\Windows\System\xXrRmUK.exe
  C:\Windows\System\xXrRmUK.exe
  2⤵
  PID:7924
- C:\Windows\System\EsOiBDs.exe
  C:\Windows\System\EsOiBDs.exe
  2⤵
  PID:8052
- C:\Windows\System\RBlnxrt.exe
  C:\Windows\System\RBlnxrt.exe
  2⤵
  PID:7992
- C:\Windows\System\GmcWCMl.exe
  C:\Windows\System\GmcWCMl.exe
  2⤵
  PID:8160
- C:\Windows\System\mvPlhOC.exe
  C:\Windows\System\mvPlhOC.exe
  2⤵
  PID:8140
- C:\Windows\System\PpdqGiz.exe
  C:\Windows\System\PpdqGiz.exe
  2⤵
  PID:7508
- C:\Windows\System\GkkAdAK.exe
  C:\Windows\System\GkkAdAK.exe
  2⤵
  PID:7232
- C:\Windows\System\GKbrkbY.exe
  C:\Windows\System\GKbrkbY.exe
  2⤵
  PID:7620
- C:\Windows\System\lCoCTLn.exe
  C:\Windows\System\lCoCTLn.exe
  2⤵
  PID:7768
- C:\Windows\System\EbBlsoR.exe
  C:\Windows\System\EbBlsoR.exe
  2⤵
  PID:7180
- C:\Windows\System\dFpHAQK.exe
  C:\Windows\System\dFpHAQK.exe
  2⤵
  PID:7360
- C:\Windows\System\kBmWWwd.exe
  C:\Windows\System\kBmWWwd.exe
  2⤵
  PID:7392
- C:\Windows\System\dQLyuNy.exe
  C:\Windows\System\dQLyuNy.exe
  2⤵
  PID:7696
- C:\Windows\System\iQBmvCM.exe
  C:\Windows\System\iQBmvCM.exe
  2⤵
  PID:7820
- C:\Windows\System\joZsGEG.exe
  C:\Windows\System\joZsGEG.exe
  2⤵
  PID:7456
- C:\Windows\System\uvxlHXY.exe
  C:\Windows\System\uvxlHXY.exe
  2⤵
  PID:7952
- C:\Windows\System\IdIMLsa.exe
  C:\Windows\System\IdIMLsa.exe
  2⤵
  PID:7940
- C:\Windows\System\peshLOn.exe
  C:\Windows\System\peshLOn.exe
  2⤵
  PID:7648
- C:\Windows\System\hCFrtQl.exe
  C:\Windows\System\hCFrtQl.exe
  2⤵
  PID:7540
- C:\Windows\System\fscHNED.exe
  C:\Windows\System\fscHNED.exe
  2⤵
  PID:7868
- C:\Windows\System\eCOukfb.exe
  C:\Windows\System\eCOukfb.exe
  2⤵
  PID:8204
- C:\Windows\System\TXErhTA.exe
  C:\Windows\System\TXErhTA.exe
  2⤵
  PID:8224
- C:\Windows\System\QyiaAfH.exe
  C:\Windows\System\QyiaAfH.exe
  2⤵
  PID:8240
- C:\Windows\System\HbfymfK.exe
  C:\Windows\System\HbfymfK.exe
  2⤵
  PID:8256
- C:\Windows\System\xMpSmDD.exe
  C:\Windows\System\xMpSmDD.exe
  2⤵
  PID:8272
- C:\Windows\System\PFGEfXm.exe
  C:\Windows\System\PFGEfXm.exe
  2⤵
  PID:8288
- C:\Windows\System\YxYhOAt.exe
  C:\Windows\System\YxYhOAt.exe
  2⤵
  PID:8304
- C:\Windows\System\PlOEOcB.exe
  C:\Windows\System\PlOEOcB.exe
  2⤵
  PID:8320
- C:\Windows\System\iTFpsWT.exe
  C:\Windows\System\iTFpsWT.exe
  2⤵
  PID:8336
- C:\Windows\System\rhOepUe.exe
  C:\Windows\System\rhOepUe.exe
  2⤵
  PID:8352
- C:\Windows\System\zNzLxVr.exe
  C:\Windows\System\zNzLxVr.exe
  2⤵
  PID:8368
- C:\Windows\System\DesYhPQ.exe
  C:\Windows\System\DesYhPQ.exe
  2⤵
  PID:8388
- C:\Windows\System\bStmThO.exe
  C:\Windows\System\bStmThO.exe
  2⤵
  PID:8404
- C:\Windows\System\meIuurp.exe
  C:\Windows\System\meIuurp.exe
  2⤵
  PID:8420
- C:\Windows\System\rlENAvX.exe
  C:\Windows\System\rlENAvX.exe
  2⤵
  PID:8436
- C:\Windows\System\fHpWmaQ.exe
  C:\Windows\System\fHpWmaQ.exe
  2⤵
  PID:8452
- C:\Windows\System\xFdVefl.exe
  C:\Windows\System\xFdVefl.exe
  2⤵
  PID:8468
- C:\Windows\System\aCiNWyT.exe
  C:\Windows\System\aCiNWyT.exe
  2⤵
  PID:8484
- C:\Windows\System\MIeBAuc.exe
  C:\Windows\System\MIeBAuc.exe
  2⤵
  PID:8500
- C:\Windows\System\UXLoIJc.exe
  C:\Windows\System\UXLoIJc.exe
  2⤵
  PID:8524
- C:\Windows\System\eugIQxe.exe
  C:\Windows\System\eugIQxe.exe
  2⤵
  PID:8552
- C:\Windows\System\ktesQKR.exe
  C:\Windows\System\ktesQKR.exe
  2⤵
  PID:8572
- C:\Windows\System\LvfarKo.exe
  C:\Windows\System\LvfarKo.exe
  2⤵
  PID:8588
- C:\Windows\System\SMLpwcw.exe
  C:\Windows\System\SMLpwcw.exe
  2⤵
  PID:8604
- C:\Windows\System\YKZPejI.exe
  C:\Windows\System\YKZPejI.exe
  2⤵
  PID:8624
- C:\Windows\System\CnMOhNM.exe
  C:\Windows\System\CnMOhNM.exe
  2⤵
  PID:8640
- C:\Windows\System\KeuxodW.exe
  C:\Windows\System\KeuxodW.exe
  2⤵
  PID:8660
- C:\Windows\System\kDrUKJm.exe
  C:\Windows\System\kDrUKJm.exe
  2⤵
  PID:8676
- C:\Windows\System\WCdoNmp.exe
  C:\Windows\System\WCdoNmp.exe
  2⤵
  PID:8692
- C:\Windows\System\DhnRFDV.exe
  C:\Windows\System\DhnRFDV.exe
  2⤵
  PID:8708
- C:\Windows\System\vqgHJTu.exe
  C:\Windows\System\vqgHJTu.exe
  2⤵
  PID:8724
- C:\Windows\System\GZsfxkL.exe
  C:\Windows\System\GZsfxkL.exe
  2⤵
  PID:8740
- C:\Windows\System\gMUOITB.exe
  C:\Windows\System\gMUOITB.exe
  2⤵
  PID:8760
- C:\Windows\System\TTuqjOP.exe
  C:\Windows\System\TTuqjOP.exe
  2⤵
  PID:8776
- C:\Windows\System\GXijbRJ.exe
  C:\Windows\System\GXijbRJ.exe
  2⤵
  PID:8792
- C:\Windows\System\ZzhKWLG.exe
  C:\Windows\System\ZzhKWLG.exe
  2⤵
  PID:8808
- C:\Windows\System\MeqbImO.exe
  C:\Windows\System\MeqbImO.exe
  2⤵
  PID:8824
- C:\Windows\System\PvJpcQq.exe
  C:\Windows\System\PvJpcQq.exe
  2⤵
  PID:8844
- C:\Windows\System\lGRlxPl.exe
  C:\Windows\System\lGRlxPl.exe
  2⤵
  PID:8860
- C:\Windows\System\ABNxbzp.exe
  C:\Windows\System\ABNxbzp.exe
  2⤵
  PID:8876
- C:\Windows\System\sLmjhZj.exe
  C:\Windows\System\sLmjhZj.exe
  2⤵
  PID:8892
- C:\Windows\System\rNpfLWP.exe
  C:\Windows\System\rNpfLWP.exe
  2⤵
  PID:8908
- C:\Windows\System\UtkcBns.exe
  C:\Windows\System\UtkcBns.exe
  2⤵
  PID:8924
- C:\Windows\System\LdhlhQb.exe
  C:\Windows\System\LdhlhQb.exe
  2⤵
  PID:8960
- C:\Windows\System\ZIepNIK.exe
  C:\Windows\System\ZIepNIK.exe
  2⤵
  PID:8976
- C:\Windows\System\FeiXhhT.exe
  C:\Windows\System\FeiXhhT.exe
  2⤵
  PID:8996
- C:\Windows\System\ZGLqhfb.exe
  C:\Windows\System\ZGLqhfb.exe
  2⤵
  PID:9012
- C:\Windows\System\cefpvss.exe
  C:\Windows\System\cefpvss.exe
  2⤵
  PID:9028
- C:\Windows\System\QGaXwdY.exe
  C:\Windows\System\QGaXwdY.exe
  2⤵
  PID:9044
- C:\Windows\System\kXqCqtW.exe
  C:\Windows\System\kXqCqtW.exe
  2⤵
  PID:9060
- C:\Windows\System\inUrMNe.exe
  C:\Windows\System\inUrMNe.exe
  2⤵
  PID:9080
- C:\Windows\System\lJpZouk.exe
  C:\Windows\System\lJpZouk.exe
  2⤵
  PID:9096
- C:\Windows\System\iWaoIVw.exe
  C:\Windows\System\iWaoIVw.exe
  2⤵
  PID:9112
- C:\Windows\System\wTYdjvi.exe
  C:\Windows\System\wTYdjvi.exe
  2⤵
  PID:9128
- C:\Windows\System\GPFKIYf.exe
  C:\Windows\System\GPFKIYf.exe
  2⤵
  PID:9144
- C:\Windows\System\wbarjCX.exe
  C:\Windows\System\wbarjCX.exe
  2⤵
  PID:9164
- C:\Windows\System\TqRoxlR.exe
  C:\Windows\System\TqRoxlR.exe
  2⤵
  PID:9180
- C:\Windows\System\btMlAzU.exe
  C:\Windows\System\btMlAzU.exe
  2⤵
  PID:9204
- C:\Windows\System\uMksXJm.exe
  C:\Windows\System\uMksXJm.exe
  2⤵
  PID:7520
- C:\Windows\System\oULGrrV.exe
  C:\Windows\System\oULGrrV.exe
  2⤵
  PID:7968
- C:\Windows\System\SVIpSto.exe
  C:\Windows\System\SVIpSto.exe
  2⤵
  PID:7236
- C:\Windows\System\DwFMFfI.exe
  C:\Windows\System\DwFMFfI.exe
  2⤵
  PID:8116
- C:\Windows\System\QFlXYQd.exe
  C:\Windows\System\QFlXYQd.exe
  2⤵
  PID:8232
- C:\Windows\System\JxuAPvV.exe
  C:\Windows\System\JxuAPvV.exe
  2⤵
  PID:7832
- C:\Windows\System\kjEcLqg.exe
  C:\Windows\System\kjEcLqg.exe
  2⤵
  PID:8280
- C:\Windows\System\xmCvXVM.exe
  C:\Windows\System\xmCvXVM.exe
  2⤵
  PID:8316
- C:\Windows\System\iFTXoqY.exe
  C:\Windows\System\iFTXoqY.exe
  2⤵
  PID:8348
- C:\Windows\System\wGPrFVw.exe
  C:\Windows\System\wGPrFVw.exe
  2⤵
  PID:8508
- C:\Windows\System\AiQgJhG.exe
  C:\Windows\System\AiQgJhG.exe
  2⤵
  PID:8564
- C:\Windows\System\iSyqphy.exe
  C:\Windows\System\iSyqphy.exe
  2⤵
  PID:8668
- C:\Windows\System\HCaGdth.exe
  C:\Windows\System\HCaGdth.exe
  2⤵
  PID:8736
- C:\Windows\System\eroqGre.exe
  C:\Windows\System\eroqGre.exe
  2⤵
  PID:8496
- C:\Windows\System\GnQjpGo.exe
  C:\Windows\System\GnQjpGo.exe
  2⤵
  PID:8804
- C:\Windows\System\ykqqVeX.exe
  C:\Windows\System\ykqqVeX.exe
  2⤵
  PID:8900
- C:\Windows\System\EunSZdh.exe
  C:\Windows\System\EunSZdh.exe
  2⤵
  PID:8540
- C:\Windows\System\POmbvRL.exe
  C:\Windows\System\POmbvRL.exe
  2⤵
  PID:8872
- C:\Windows\System\uHmerZt.exe
  C:\Windows\System\uHmerZt.exe
  2⤵
  PID:8656
- C:\Windows\System\wGntUsh.exe
  C:\Windows\System\wGntUsh.exe
  2⤵
  PID:8720
- C:\Windows\System\BAPTzLb.exe
  C:\Windows\System\BAPTzLb.exe
  2⤵
  PID:8784
- C:\Windows\System\yhxUits.exe
  C:\Windows\System\yhxUits.exe
  2⤵
  PID:8852
- C:\Windows\System\gKLxfwX.exe
  C:\Windows\System\gKLxfwX.exe
  2⤵
  PID:8916
- C:\Windows\System\mcuKjiN.exe
  C:\Windows\System\mcuKjiN.exe
  2⤵
  PID:8936
- C:\Windows\System\pJeJYtU.exe
  C:\Windows\System\pJeJYtU.exe
  2⤵
  PID:8988
- C:\Windows\System\eZGqUdj.exe
  C:\Windows\System\eZGqUdj.exe
  2⤵
  PID:8992
- C:\Windows\System\ZRLprag.exe
  C:\Windows\System\ZRLprag.exe
  2⤵
  PID:9008
- C:\Windows\System\nEqvbSE.exe
  C:\Windows\System\nEqvbSE.exe
  2⤵
  PID:9036
- C:\Windows\System\nlZmvLo.exe
  C:\Windows\System\nlZmvLo.exe
  2⤵
  PID:9108
- C:\Windows\System\vPJjuXi.exe
  C:\Windows\System\vPJjuXi.exe
  2⤵
  PID:9156
- C:\Windows\System\NwENogd.exe
  C:\Windows\System\NwENogd.exe
  2⤵
  PID:9152
- C:\Windows\System\JnEsNJN.exe
  C:\Windows\System\JnEsNJN.exe
  2⤵
  PID:8068
- C:\Windows\System\XJuFVGQ.exe
  C:\Windows\System\XJuFVGQ.exe
  2⤵
  PID:8268
- C:\Windows\System\LdATbQL.exe
  C:\Windows\System\LdATbQL.exe
  2⤵
  PID:8296
- C:\Windows\System\AfZKYBS.exe
  C:\Windows\System\AfZKYBS.exe
  2⤵
  PID:6284
- C:\Windows\System\yUXWsaq.exe
  C:\Windows\System\yUXWsaq.exe
  2⤵
  PID:7908
- C:\Windows\System\McgNiHn.exe
  C:\Windows\System\McgNiHn.exe
  2⤵
  PID:7328
- C:\Windows\System\mjLgZDL.exe
  C:\Windows\System\mjLgZDL.exe
  2⤵
  PID:8264
- C:\Windows\System\LDZexIK.exe
  C:\Windows\System\LDZexIK.exe
  2⤵
  PID:7972
- C:\Windows\System\hHGwyOH.exe
  C:\Windows\System\hHGwyOH.exe
  2⤵
  PID:8248
- C:\Windows\System\YIaZJPO.exe
  C:\Windows\System\YIaZJPO.exe
  2⤵
  PID:8284
- C:\Windows\System\daGTZqj.exe
  C:\Windows\System\daGTZqj.exe
  2⤵
  PID:8400
- C:\Windows\System\BzOUeUv.exe
  C:\Windows\System\BzOUeUv.exe
  2⤵
  PID:8448
- C:\Windows\System\ozCQWfk.exe
  C:\Windows\System\ozCQWfk.exe
  2⤵
  PID:8364
- C:\Windows\System\hbyepSc.exe
  C:\Windows\System\hbyepSc.exe
  2⤵
  PID:8596
- C:\Windows\System\vLdIsQF.exe
  C:\Windows\System\vLdIsQF.exe
  2⤵
  PID:8840
- C:\Windows\System\vOPoeOK.exe
  C:\Windows\System\vOPoeOK.exe
  2⤵
  PID:8584
- C:\Windows\System\bLmSOQp.exe
  C:\Windows\System\bLmSOQp.exe
  2⤵
  PID:8820
- C:\Windows\System\wttoJbh.exe
  C:\Windows\System\wttoJbh.exe
  2⤵
  PID:8632
- C:\Windows\System\Yinixhi.exe
  C:\Windows\System\Yinixhi.exe
  2⤵
  PID:8464
- C:\Windows\System\oelCxCg.exe
  C:\Windows\System\oelCxCg.exe
  2⤵
  PID:8532
- C:\Windows\System\fsEZsxU.exe
  C:\Windows\System\fsEZsxU.exe
  2⤵
  PID:8652
- C:\Windows\System\iYXXHar.exe
  C:\Windows\System\iYXXHar.exe
  2⤵
  PID:8888
- C:\Windows\System\huSafiR.exe
  C:\Windows\System\huSafiR.exe
  2⤵
  PID:8952
- C:\Windows\System\RBARroX.exe
  C:\Windows\System\RBARroX.exe
  2⤵
  PID:9092
- C:\Windows\System\NKcxhWA.exe
  C:\Windows\System\NKcxhWA.exe
  2⤵
  PID:8024
- C:\Windows\System\sxTxuia.exe
  C:\Windows\System\sxTxuia.exe
  2⤵
  PID:7584
- C:\Windows\System\unWHovV.exe
  C:\Windows\System\unWHovV.exe
  2⤵
  PID:8460
- C:\Windows\System\nDBfiFQ.exe
  C:\Windows\System\nDBfiFQ.exe
  2⤵
  PID:8396
- C:\Windows\System\qylwlHI.exe
  C:\Windows\System\qylwlHI.exe
  2⤵
  PID:9024
- C:\Windows\System\mKejpTv.exe
  C:\Windows\System\mKejpTv.exe
  2⤵
  PID:9072
- C:\Windows\System\VjbpxOM.exe
  C:\Windows\System\VjbpxOM.exe
  2⤵
  PID:9104
- C:\Windows\System\CgtHLzw.exe
  C:\Windows\System\CgtHLzw.exe
  2⤵
  PID:9172
- C:\Windows\System\sbUmbzu.exe
  C:\Windows\System\sbUmbzu.exe
  2⤵
  PID:8332
- C:\Windows\System\yblcASz.exe
  C:\Windows\System\yblcASz.exe
  2⤵
  PID:8344
- C:\Windows\System\tniGTdv.exe
  C:\Windows\System\tniGTdv.exe
  2⤵
  PID:8688
- C:\Windows\System\EjOMpep.exe
  C:\Windows\System\EjOMpep.exe
  2⤵
  PID:8752
- C:\Windows\System\LJEjGcy.exe
  C:\Windows\System\LJEjGcy.exe
  2⤵
  PID:8620
- C:\Windows\System\SxNJAYj.exe
  C:\Windows\System\SxNJAYj.exe
  2⤵
  PID:8616
- C:\Windows\System\OqlEvIu.exe
  C:\Windows\System\OqlEvIu.exe
  2⤵
  PID:7920
- C:\Windows\System\MfQDmNq.exe
  C:\Windows\System\MfQDmNq.exe
  2⤵
  PID:9236
- C:\Windows\System\eOIdzHL.exe
  C:\Windows\System\eOIdzHL.exe
  2⤵
  PID:9252
- C:\Windows\System\NDTjUae.exe
  C:\Windows\System\NDTjUae.exe
  2⤵
  PID:9268
- C:\Windows\System\XRRwgNj.exe
  C:\Windows\System\XRRwgNj.exe
  2⤵
  PID:9284
- C:\Windows\System\npAIZnY.exe
  C:\Windows\System\npAIZnY.exe
  2⤵
  PID:9300
- C:\Windows\System\SmdtnEx.exe
  C:\Windows\System\SmdtnEx.exe
  2⤵
  PID:9316
- C:\Windows\System\uRtheyw.exe
  C:\Windows\System\uRtheyw.exe
  2⤵
  PID:9332
- C:\Windows\System\CyrKoOR.exe
  C:\Windows\System\CyrKoOR.exe
  2⤵
  PID:9352
- C:\Windows\System\wJWcywZ.exe
  C:\Windows\System\wJWcywZ.exe
  2⤵
  PID:9368
- C:\Windows\System\oBrgKvz.exe
  C:\Windows\System\oBrgKvz.exe
  2⤵
  PID:9384
- C:\Windows\System\TlChhuM.exe
  C:\Windows\System\TlChhuM.exe
  2⤵
  PID:9400
- C:\Windows\System\tCzicBC.exe
  C:\Windows\System\tCzicBC.exe
  2⤵
  PID:9416
- C:\Windows\System\lSXpoBK.exe
  C:\Windows\System\lSXpoBK.exe
  2⤵
  PID:9432
- C:\Windows\System\zVptoOi.exe
  C:\Windows\System\zVptoOi.exe
  2⤵
  PID:9448
- C:\Windows\System\rtrHLNd.exe
  C:\Windows\System\rtrHLNd.exe
  2⤵
  PID:9464
- C:\Windows\System\RllQYAn.exe
  C:\Windows\System\RllQYAn.exe
  2⤵
  PID:9480
- C:\Windows\System\NCsqYCu.exe
  C:\Windows\System\NCsqYCu.exe
  2⤵
  PID:9496
- C:\Windows\System\DbiiutX.exe
  C:\Windows\System\DbiiutX.exe
  2⤵
  PID:9512
- C:\Windows\System\oEQqcdt.exe
  C:\Windows\System\oEQqcdt.exe
  2⤵
  PID:9528
- C:\Windows\System\JyYsoWC.exe
  C:\Windows\System\JyYsoWC.exe
  2⤵
  PID:9544
- C:\Windows\System\YYaMUeq.exe
  C:\Windows\System\YYaMUeq.exe
  2⤵
  PID:9560
- C:\Windows\System\TvhjmjQ.exe
  C:\Windows\System\TvhjmjQ.exe
  2⤵
  PID:9576
- C:\Windows\System\fJshucQ.exe
  C:\Windows\System\fJshucQ.exe
  2⤵
  PID:9592
- C:\Windows\System\LPwqNxK.exe
  C:\Windows\System\LPwqNxK.exe
  2⤵
  PID:9608
- C:\Windows\System\rWachXj.exe
  C:\Windows\System\rWachXj.exe
  2⤵
  PID:9624
- C:\Windows\System\AscofRE.exe
  C:\Windows\System\AscofRE.exe
  2⤵
  PID:9640
- C:\Windows\System\iMktZRj.exe
  C:\Windows\System\iMktZRj.exe
  2⤵
  PID:9656
- C:\Windows\System\kSvKZAe.exe
  C:\Windows\System\kSvKZAe.exe
  2⤵
  PID:9680
- C:\Windows\System\GxUzZHG.exe
  C:\Windows\System\GxUzZHG.exe
  2⤵
  PID:9696
- C:\Windows\System\ePOrjuY.exe
  C:\Windows\System\ePOrjuY.exe
  2⤵
  PID:9712
- C:\Windows\System\oDROBiG.exe
  C:\Windows\System\oDROBiG.exe
  2⤵
  PID:9728
- C:\Windows\System\NnqKcYp.exe
  C:\Windows\System\NnqKcYp.exe
  2⤵
  PID:9744
- C:\Windows\System\rlhKtGF.exe
  C:\Windows\System\rlhKtGF.exe
  2⤵
  PID:9760
- C:\Windows\System\moHnnMl.exe
  C:\Windows\System\moHnnMl.exe
  2⤵
  PID:9776
- C:\Windows\System\MPRgWRw.exe
  C:\Windows\System\MPRgWRw.exe
  2⤵
  PID:9796
- C:\Windows\System\zoioYTE.exe
  C:\Windows\System\zoioYTE.exe
  2⤵
  PID:9812
- C:\Windows\System\dpeDKVt.exe
  C:\Windows\System\dpeDKVt.exe
  2⤵
  PID:9832
- C:\Windows\System\wyfvAfS.exe
  C:\Windows\System\wyfvAfS.exe
  2⤵
  PID:9848
- C:\Windows\System\syraDpD.exe
  C:\Windows\System\syraDpD.exe
  2⤵
  PID:9876
- C:\Windows\System\OuqVvUH.exe
  C:\Windows\System\OuqVvUH.exe
  2⤵
  PID:10016
- C:\Windows\System\XcmSXAO.exe
  C:\Windows\System\XcmSXAO.exe
  2⤵
  PID:10032
- C:\Windows\System\MWLvmUz.exe
  C:\Windows\System\MWLvmUz.exe
  2⤵
  PID:10052
- C:\Windows\System\FIxfZRi.exe
  C:\Windows\System\FIxfZRi.exe
  2⤵
  PID:10068
- C:\Windows\System\GjCjQPW.exe
  C:\Windows\System\GjCjQPW.exe
  2⤵
  PID:10084
- C:\Windows\System\yFdCnAA.exe
  C:\Windows\System\yFdCnAA.exe
  2⤵
  PID:10100
- C:\Windows\System\PgtiuVh.exe
  C:\Windows\System\PgtiuVh.exe
  2⤵
  PID:10208
- C:\Windows\System\ijbTewn.exe
  C:\Windows\System\ijbTewn.exe
  2⤵
  PID:10228
- C:\Windows\System\OoPKrhq.exe
  C:\Windows\System\OoPKrhq.exe
  2⤵
  PID:9160
- C:\Windows\System\fzAfxNi.exe
  C:\Windows\System\fzAfxNi.exe
  2⤵
  PID:8220
- C:\Windows\System\lGHCNbp.exe
  C:\Windows\System\lGHCNbp.exe
  2⤵
  PID:9176
- C:\Windows\System\oiZIjNv.exe
  C:\Windows\System\oiZIjNv.exe
  2⤵
  PID:8492
- C:\Windows\System\EsRhoVG.exe
  C:\Windows\System\EsRhoVG.exe
  2⤵
  PID:9224
- C:\Windows\System\DpQVyhG.exe
  C:\Windows\System\DpQVyhG.exe
  2⤵
  PID:8800
- C:\Windows\System\yEtowxC.exe
  C:\Windows\System\yEtowxC.exe
  2⤵
  PID:9296
- C:\Windows\System\mWbfoOe.exe
  C:\Windows\System\mWbfoOe.exe
  2⤵
  PID:9324
- C:\Windows\System\hDgSiGD.exe
  C:\Windows\System\hDgSiGD.exe
  2⤵
  PID:9424
- C:\Windows\System\bpgNUCd.exe
  C:\Windows\System\bpgNUCd.exe
  2⤵
  PID:9428
- C:\Windows\System\xqwGgfH.exe
  C:\Windows\System\xqwGgfH.exe
  2⤵
  PID:9492
- C:\Windows\System\wkEJQdg.exe
  C:\Windows\System\wkEJQdg.exe
  2⤵
  PID:9556
- C:\Windows\System\yOdQybe.exe
  C:\Windows\System\yOdQybe.exe
  2⤵
  PID:9408
- C:\Windows\System\uRgWXBB.exe
  C:\Windows\System\uRgWXBB.exe
  2⤵
  PID:9440
- C:\Windows\System\ENJaSvc.exe
  C:\Windows\System\ENJaSvc.exe
  2⤵
  PID:9584
- C:\Windows\System\QzXdJDw.exe
  C:\Windows\System\QzXdJDw.exe
  2⤵
  PID:9572
- C:\Windows\System\qcVWgJG.exe
  C:\Windows\System\qcVWgJG.exe
  2⤵
  PID:9312
- C:\Windows\System\NbTRgqZ.exe
  C:\Windows\System\NbTRgqZ.exe
  2⤵
  PID:9380
- C:\Windows\System\cbOtJnY.exe
  C:\Windows\System\cbOtJnY.exe
  2⤵
  PID:9648
- C:\Windows\System\ukJgbDI.exe
  C:\Windows\System\ukJgbDI.exe
  2⤵
  PID:9664
- C:\Windows\System\YHaKKSi.exe
  C:\Windows\System\YHaKKSi.exe
  2⤵
  PID:9676
- C:\Windows\System\ZmIeAXk.exe
  C:\Windows\System\ZmIeAXk.exe
  2⤵
  PID:9792
- C:\Windows\System\MonIMFG.exe
  C:\Windows\System\MonIMFG.exe
  2⤵
  PID:9688
- C:\Windows\System\poAakOl.exe
  C:\Windows\System\poAakOl.exe
  2⤵
  PID:9864
- C:\Windows\System\pxXVQDP.exe
  C:\Windows\System\pxXVQDP.exe
  2⤵
  PID:9788
- C:\Windows\System\zvGWWyw.exe
  C:\Windows\System\zvGWWyw.exe
  2⤵
  PID:9756
- C:\Windows\System\HLpLNjl.exe
  C:\Windows\System\HLpLNjl.exe
  2⤵
  PID:9884
- C:\Windows\System\rQbtEIj.exe
  C:\Windows\System\rQbtEIj.exe
  2⤵
  PID:9804
- C:\Windows\System\gEKtBOa.exe
  C:\Windows\System\gEKtBOa.exe
  2⤵
  PID:9348
- C:\Windows\System\kZFyXda.exe
  C:\Windows\System\kZFyXda.exe
  2⤵
  PID:9896
- C:\Windows\System\ATpMVlM.exe
  C:\Windows\System\ATpMVlM.exe
  2⤵
  PID:9952
- C:\Windows\System\FbjudXd.exe
  C:\Windows\System\FbjudXd.exe
  2⤵
  PID:10184
- C:\Windows\System\YZVzQpd.exe
  C:\Windows\System\YZVzQpd.exe
  2⤵
  PID:9668
- C:\Windows\System\wygKEpu.exe
  C:\Windows\System\wygKEpu.exe
  2⤵
  PID:9820
- C:\Windows\System\nUHAXPz.exe
  C:\Windows\System\nUHAXPz.exe
  2⤵
  PID:9904
- C:\Windows\System\srpPTzG.exe
  C:\Windows\System\srpPTzG.exe
  2⤵
  PID:9912
- C:\Windows\System\TPdXHMh.exe
  C:\Windows\System\TPdXHMh.exe
  2⤵
  PID:8704
- C:\Windows\System\WtRxHNx.exe
  C:\Windows\System\WtRxHNx.exe
  2⤵
  PID:9360
- C:\Windows\System\uNmYkFh.exe
  C:\Windows\System\uNmYkFh.exe
  2⤵
  PID:8716
- C:\Windows\System\nVUdmAy.exe
  C:\Windows\System\nVUdmAy.exe
  2⤵
  PID:9412
- C:\Windows\System\bsbguOI.exe
  C:\Windows\System\bsbguOI.exe
  2⤵
  PID:2276
- C:\Windows\System\eminfix.exe
  C:\Windows\System\eminfix.exe
  2⤵
  PID:2724
- C:\Windows\System\qiZzmkS.exe
  C:\Windows\System\qiZzmkS.exe
  2⤵
  PID:9828
- C:\Windows\System\bZFqRYD.exe
  C:\Windows\System\bZFqRYD.exe
  2⤵
  PID:9720
- C:\Windows\System\ffpNixF.exe
  C:\Windows\System\ffpNixF.exe
  2⤵
  PID:9920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ASbddWM.exe

Path C:\Windows\system\ASbddWM.exe
Size 1.6MB
SHA256 0752c09c22ed26415a99e6ca650ae19d6f054744bf6cdbdda7196c9c47071580
MD5 fada5c63980a4be3109971519f73f430
SHA1 3336def6043011c0161de65e4f44956d81ea263b
SHA512 3c23a6f874b24031a886f75b23a02f3d6c175560561ee3359235aa62bd8502df046d63379e559fee2c0d3434c44019dc2cf7445d43bcfde979dd48474a4ca3fc
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f2:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAW
MD5 SHA1 SHA512 SSDEEP

Submit Download

EgASbOv.exe

Path C:\Windows\system\EgASbOv.exe
Size 1.6MB
SHA256 f49841e9e024b2b852c3b10443195d29b9f1db3fb8f007d112dac66314550cea
MD5 5004172464ddce1912a52047e2350e90
SHA1 1a3f823ef68ec479e635407e6eae37b19432ba3b
SHA512 d427b8ea7cb038d64365963de739f511a8dc04f8f41483855c2af6437ea088f09e4f32ba06fc348276b2963749b9512c03d0b1518bce6b7404f84f1fe2232c4f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fn:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ElSMwFZ.exe

Path C:\Windows\system\ElSMwFZ.exe
Size 1.6MB
SHA256 5a6c698ea6f67ffa1847f07232eaa631c5fadf74ddb4ef0fe2d965ff5057c165
MD5 739f81121f4543bc2c79697bcd024e4a
SHA1 9c032f3120a1ae771db6483a98b1de2f6fde1226
SHA512 c180b01b747baa434b8449d4ec5ee38488169fe93ad24b119cd37c3b48ff659278c0c2b49da85ad8c0503e279f15f3443a69d757a25bb6f97747de3a378b9c7b
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fh:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAB
MD5 SHA1 SHA512 SSDEEP

Submit Download

FOgehVe.exe

Path C:\Windows\system\FOgehVe.exe
Size 1.6MB
SHA256 e35c20ddb43ffcf1ec942e43dfc1df343f11b311f4dcad9d491ae2cd47153dac
MD5 62d07b26c07a8d04173b233a4737af03
SHA1 8092b7277a4880b9a4f4b0fe554545b18f969804
SHA512 145be92a5605df3f2a3b8453c329791c0848645407e1b57c69c120938fa878eb4fae0d8a29228c40b2084e019392d3a8fe15f7c691d8c89a9f0711fb7f5db59a
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f0:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAU
MD5 SHA1 SHA512 SSDEEP

Submit Download

GHYogEM.exe

Path C:\Windows\system\GHYogEM.exe
Size 1.6MB
SHA256 cd067ef6eab2ec804afb18698762319444ed5ba1c14e4110b38798710ed7bb01
MD5 cda1217b0394a5ba4dd3bdfabdd9a8ad
SHA1 c5c1ba51b55987f090ca8958445f50150f6dcec1
SHA512 98ac9fdbee4d802fe1e6d069ef5b241544af3aa49e65827caead564da847fe82de897ff08c8a0bf9984829b305783ffe2ff0966682ccb48344175408759cb903
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fv:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAP
MD5 SHA1 SHA512 SSDEEP

Submit Download

GtopvVr.exe

Path C:\Windows\system\GtopvVr.exe
Size 1.6MB
SHA256 f4de8c88de548288e3b96b060a6f52f6316a2000ce51718b44fbadca027adda3
MD5 2f4e52d6443107bf12ac02d6d6d2f4e9
SHA1 34869cb8ec66ba912685b961883732e881605411
SHA512 1bc9a5f2bb5b41c17d3de2dc2fb379ea6e16fca5c64024dd001febee9ce4e257d04dae3f0571e8d710592f995727b2f6cf544f06f021bb2e0fa5ddffa2583298
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fV:ROdWCCi7/rahwNUMuikLCiJCF+QT1HA1
MD5 SHA1 SHA512 SSDEEP

Submit Download

GtzVfEO.exe

Path C:\Windows\system\GtzVfEO.exe
Size 1.6MB
SHA256 af7c42ece883fc9c119fb75f912d20021778f1aa3a88db32869073b0d38f11a5
MD5 0a39d5f6de16a4020a9162d15d6ff717
SHA1 89a269a3610b2718c755f6b9eca28fe85155f93f
SHA512 a7b47858b5416d2670f414c91df7b387ec35c5f9d0bf3b93020f0c527a680061fade4692b4d8aeb74ce4e7d76a6844c753773e80b9777728ee2b643e61480188
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fJ:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAp
MD5 SHA1 SHA512 SSDEEP

Submit Download

HyZywms.exe

Path C:\Windows\system\HyZywms.exe
Size 1.6MB
SHA256 8743cc6ea86d8cdacac6c23c6c9c2a4d101d31e9bd63613d86ea28ac82026247
MD5 ee9e9d220035d9272e82144adddfee02
SHA1 c13961b903618be854c43fd98f5163af964736cc
SHA512 6f67fa3bb6210a9171fd9b34f1e505b544e95c92a8521fde3807cecd360dcc2c80e872c11b348c04ab5ec42a9c8906d8a14e4ec5a8aa2f1d0ab8dd0d0594c8d1
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fY:ROdWCCi7/rahwNUMuikLCiJCF+QT1HA4
MD5 SHA1 SHA512 SSDEEP

Submit Download

KsGYitI.exe

Path C:\Windows\system\KsGYitI.exe
Size 1.6MB
SHA256 eb74b637c9d5ffbf89f0c8034083f31ad2cc20424e347f1b5960009dbc34fad9
MD5 81a010c32a7c3f9eae9cc8ed1ea71773
SHA1 4edb19cdbd6c091276ae06070bfe70b56fb6b4c1
SHA512 e321034015a60839654c94dbd88493405bd5b44256cd48c695f88a173b5bfc9e172e4850a26a6e7b4b1427692e2d958e38f28af323b01a04e7ef7ffa692ffff7
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f8:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAc
MD5 SHA1 SHA512 SSDEEP

Submit Download

LcicoCX.exe

Path C:\Windows\system\LcicoCX.exe
Size 1.6MB
SHA256 dc352b23e5d6b155735b020fe7894b52eacdd124db94df23c360f79e5d9aa467
MD5 f8df51b1415b6eb830a0dbb7549440c1
SHA1 2098b03591fbaf6d82d66c7ecefffe473d4a359a
SHA512 96e169b5ee30c506fd4b670219bf3ac81923932472160b6fc542ea9100821fd7bf80edb4feb8a7410a42d48da01347bfc607795d78129b7a879f219549a05838
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f1:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAV
MD5 SHA1 SHA512 SSDEEP

Submit Download

McnLCvK.exe

Path C:\Windows\system\McnLCvK.exe
Size 1.6MB
SHA256 e73b3d1e205e02691250c2da35fa0236e235c771816ffe65cefa9e905234398a
MD5 1e53a89c984e174f2352672caa501b12
SHA1 072f47973461d13ff208c17518401cc73acf0061
SHA512 b977c91294aac75f544ce7f1a95768b9b3603169cc4e3b876b2bbd656e92ae03bdc220c5a03b24c71570cf45a828fbe1157eb78da4204c15b4a2169d5b481515
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fr:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAL
MD5 SHA1 SHA512 SSDEEP

Submit Download

MkDlhCs.exe

Path C:\Windows\system\MkDlhCs.exe
Size 1.6MB
SHA256 7f129c07fbf3c1b330cfbf3a835ebb75c93e8e9f3c0bfd76298808f95cf92986
MD5 449a3b609d7f81ae7cebdc99bc98be88
SHA1 933bdf5366d68aac0a7790ba491e3d146818c8fa
SHA512 1d0fe0ae3dd1904268aabba658fbd82a8b09fc6c3dd9bc09fb19a85121b3fc07aa076391d2334d7a0761c61fb8b61b2c98709a9d32952053bfb71ec2c1762d4b
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fH:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

NTzukWq.exe

Path C:\Windows\system\NTzukWq.exe
Size 1.6MB
SHA256 5985ba0e2ae4e86a39185442e80950fd8acb082bd78cdc9f1dd6a784eaa13848
MD5 26721ddf3111d16b89462f62fcb32266
SHA1 234b8ba1cf0efe9ea4c7f0873e8234ee4a8033d4
SHA512 56e3b0f2181add6aa4fcaf8c28a6767b1953248f789095b0ebfb7ef6ab322f02038d1c97a8795725c80c5b3901a245d764197cd27703dfae7177dec0ec563158
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fK:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAq
MD5 SHA1 SHA512 SSDEEP

Submit Download

NbFqVso.exe

Path C:\Windows\system\NbFqVso.exe
Size 1.6MB
SHA256 8e199cba92049c833da041ab967af28f5a0ce6b4e9a6074aff4aaa95ce529896
MD5 2bcf04dd5ee8e81d62df6b135b0adc30
SHA1 80853effdbf5e7891a6662df4c3cd4c1b403d1ec
SHA512 c9daf1032783abe57052b83b2c8b3b8adc4692ad6711edb815a71ac30c63a22ad6fdff1964917997b17186e5c35a61e0d9c1a329c8013c6da45768d1ed3bf863
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f9:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAd
MD5 SHA1 SHA512 SSDEEP

Submit Download

NuPgtHJ.exe

Path C:\Windows\system\NuPgtHJ.exe
Size 1.6MB
SHA256 5446ae43b01d78733597e88505af82e09bccd6f9b0d7476ed9742978292887b7
MD5 812791c6fd5e36459a032a5d578ef701
SHA1 58429ecff0e64be9ecad52d156a9684ed991b302
SHA512 db30e2f6958a428133f495ceff6f0dfa0d4a9dd64314901d8d036f6942cf99a437d389f303b7eb53756253e1276d2d2efde77f9cba280b4b65d3ed176da43694
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f+:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAe
MD5 SHA1 SHA512 SSDEEP

Submit Download

bXMOqxy.exe

Path C:\Windows\system\bXMOqxy.exe
Size 1.6MB
SHA256 613d76f488932e3ed8e8d0cc0810c1372886d01b0de0e17565b1fbbccb72b7f1
MD5 3c4f0f4f6f6ed6918de9c56aba17cc12
SHA1 857ae99f932f8bddbdd97902bb36388615be5fe1
SHA512 77cad3ffb8857d397ffb2e2b26966e8fffd5ec9ce0f228ef097f8a59409946e56674aea2d3e3fbda634a01d4d15cb0e772a99e45593ec63b7e505060a98c31b7
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fG:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ippQnQj.exe

Path C:\Windows\system\ippQnQj.exe
Size 1.6MB
SHA256 711f10c9a44b3572cc793a46d412c60fed32cb378611601b0dd6644489846f42
MD5 3ca28c3a9ed99d5b4fcd7636c88a7996
SHA1 d23f300936c43050fea2383189437f540a7e6d34
SHA512 cd05da09cffc5984c0aa1fab1291317f8df717147215d722b617da2a91e6d41cf79faa306b80d9b86524a0bc35f1d03525f09383eaed770eb117c8e9b352ad1b
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fJ:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAp
MD5 SHA1 SHA512 SSDEEP

Submit Download

meuRIBC.exe

Path C:\Windows\system\meuRIBC.exe
Size 1.6MB
SHA256 3189bc5f0e397f5e24de43af9569f58a6aa67d91759bac6a3657d41b68ecb88a
MD5 112eb927317f72e6b108281444af8a36
SHA1 3cbd40266d8e3df76414522032c51b4262e87188
SHA512 a37bb335f797cd47e12cae8c88d5353ab4f6eeb036c65f95a9b2318c0389dc2e15fc85d502da756a1644ce27c2c4595c96d115a8e043b5a6a08268291c16db2d
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fF:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ngNENCX.exe

Path C:\Windows\system\ngNENCX.exe
Size 1.6MB
SHA256 1438480fe94e41531a60e81a736e47fbcf8ecbf3fde5fca17cc3c20b8fdc738c
MD5 8d4a8d58e578475b6b29738ffa6033b6
SHA1 10bfb6cdfcab8a0fc8ccce55ce2fc474184215d2
SHA512 4783100b0763fa7208b20eddff20284cacc22246f3f83c04aa9ddabdd57174f4721ffabad4ab23cef9f72bce158611c4cac103df969942875755b7dc8821e7e0
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fE:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAk
MD5 SHA1 SHA512 SSDEEP

Submit Download

oWwawyP.exe

Path C:\Windows\system\oWwawyP.exe
Size 1.6MB
SHA256 e7c35e98939d6d05e3802437608c27b97f25afba72954ea736b990946c06da0f
MD5 5b1c42ab577995e2b230fa73734cc159
SHA1 bb3862937c12fdf819b3cd5054766d16308cb9ce
SHA512 b4e7d757b9c7579d4ca98f35d9f09db59bc7ddd67240d7a28aa051cdd7ca994638199a1407f132ad8524c633b70063046d7c8bca3061543b1c5f2f775b6c4f29
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++f7:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAb
MD5 SHA1 SHA512 SSDEEP

Submit Download

rKhsGin.exe

Path C:\Windows\system\rKhsGin.exe
Size 1.6MB
SHA256 4d07e1d429e14ab11300b16ea8fe0321d46317744dbacfbedf5403e835ec9112
MD5 8c8111d04768289edb2723bd731016b6
SHA1 cf58cb48364d56c0ecfed5c1bcb7477da678eb3b
SHA512 610357542d596ac877fa4d2619840b6d72821171e61b91535bc05c0f6b3b3276f373d41ac24ffa380ae5c15b060151ed448e6587db126281cc96f081b0e7a589
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fd:ROdWCCi7/rahwNUMuikLCiJCF+QT1HA9
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpAKvRP.exe

Path C:\Windows\system\wpAKvRP.exe
Size 1.6MB
SHA256 c9d0ec3a836f5e38a4db282424b3b42bc2a975339ab88c5699d1c1eba1e5771b
MD5 8593a2a22e3a20f5954646140e3225dc
SHA1 2ad0bc87acb3b184a8a553222bb8a492cfd0a020
SHA512 78959e8ba935dd275057fc8cdb69f61411ab787aae61dd57a8bac43ad0d46771b0da5de11173ff76dc349f601c97f6855dff665ab4b859b8c0226c2b25f93c37
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fQ:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAw
MD5 SHA1 SHA512 SSDEEP

Submit Download

yACgWBW.exe

Path C:\Windows\system\yACgWBW.exe
Size 1.6MB
SHA256 1486087ec733d2da6d5e2c4ac861a71c5f2e2a52e478abd1db9626cdf0580fe6
MD5 dc09f9d888762b7db30547df1a5e7906
SHA1 55420670d0e0e4e080d1f542911fcc37d48eb931
SHA512 1d6711ebfcfa6267188a9fc5d6404e52045a93cf93d865bfaf36b355cd4ffb4c9bce6218a20c9ef5f5f86537255752fb06eef9472d4698a910ec8df61082ffa1
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fC:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAi
MD5 SHA1 SHA512 SSDEEP

Submit Download

FNeASFk.exe

Path \Windows\system\FNeASFk.exe
Size 1.6MB
SHA256 cfaa9b87c088163cc313690cd8ba7765f1161a19692424910b2da74706af1a28
MD5 ab5d21d1ff1558d1d2d16b6416da7242
SHA1 a357bf41534a9511b4507b726779fd082b064846
SHA512 094c46e52ebf0ceac26f2a0795235521384203dd8184728b399dafd3a11cda17ab17ad366b35a91b91115f41f1239038b8f37208b618a5bce62fdcf883b01d72
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fk:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAE
MD5 SHA1 SHA512 SSDEEP

Submit Download

MbJdSZJ.exe

Path \Windows\system\MbJdSZJ.exe
Size 1.6MB
SHA256 9f79adb92d2632b640413e512b802a09038474f3f6c1e32efbe3f6057e83a2d3
MD5 5a2d82bffa335ef13c3ff599eeca7efd
SHA1 aad98a24c521ec44e850dec21cd09afaac49de98
SHA512 64ea97b23295d7fae7a7fc0f82f2e8d8a188b1ce9f5f1cf02eee171834c179e076d06fc3564ccdcc6a977543ac33bf0b624073a591772193de4f311472923861
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fx:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAR
MD5 SHA1 SHA512 SSDEEP

Submit Download

cvXGEYS.exe

Path \Windows\system\cvXGEYS.exe
Size 1.6MB
SHA256 8454534681c275cb5c8029b7e63a577a731fd57ec47588856ace6cb25271e2d0
MD5 c0cc8a3e093f8b2b2533dd9322b8b4d3
SHA1 e2bfdbe27feb1f9d3a6a096ca7aeaa9903105696
SHA512 fc7a5d8314cdf11ba1ea0909ffa310eb9208865aaf31006e6a127dc695f650d934062eb40733f934bd3d24922ee905b8bdc595c922ae04ace48bfe078fa439cd
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fz:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jTERxNf.exe

Path \Windows\system\jTERxNf.exe
Size 1.6MB
SHA256 6880e38fc545c181dfa810c2ac7ec6d635b2ddea885701d44868726a0336b7d9
MD5 a3e318e589eb6fc5360b2cccb3b6427f
SHA1 fceb4d5fa8b1bf5beb5c99d24f8898f99f9f2d53
SHA512 cc4c7e406df70bfd65b8de8522a8f4d9417cfa5e56b1cd8e4d8793074c5ca400936413da936df01124917fa551733d67612bc5cecabf2872598f92175bf84173
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fW:ROdWCCi7/rahwNUMuikLCiJCF+QT1HA2
MD5 SHA1 SHA512 SSDEEP

Submit Download

mANShAJ.exe

Path \Windows\system\mANShAJ.exe
Size 1.6MB
SHA256 82e9838e360d1365edf4218fd5f313dd27359202a0bf94b3d93aea0e83770d2d
MD5 7844f1f822d68a0cfe874221d40fbd36
SHA1 0f5ad6aefce74467894f646281fb94c778012c89
SHA512 c69917a44ada3658d4d09bdbc645cb7abcbd3e40c53f7139cb7a3f0ae8ae4aeb0ea1dbd98397625c9a12322d0903f5756a144a87a7b82ae6ba8960f52e06eb46
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++ft:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofGoFCa.exe

Path \Windows\system\ofGoFCa.exe
Size 1.6MB
SHA256 7aa35b925e4420ffb9365259202991d13caea671f92b5d768395a912bcd7315e
MD5 ae18ec6dfecf77cecc04cecfb6f3540c
SHA1 eee571309bd4adaca015a92e94b61428e0eedd30
SHA512 37b02ca1d511a8efe891508c1353fce65cd20f313c0bace73a4258f1e70fb57c881b854e6282fa777cc74b79608affb4cf916b6cd1858b5298ae75de79ac1cb8
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fw:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tMDJAjw.exe

Path \Windows\system\tMDJAjw.exe
Size 1.6MB
SHA256 5eaa1489a46ca89b7a3ade8743d1f0c88d14d3f2b66d2b9bbc6999784ec43d67
MD5 f6287513dd8b7dcc95caf8114410bd41
SHA1 ab2e04d88c7602a1bba76d48a145684aa7332715
SHA512 97a56297fca13c96cfc5b48f59caa69ab3c040dd7aa07e23a8ff741bde56c37b883fe9c37f036b5f4fe4469a5914e01e833dc5547be60d58a82e959849d760a8
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fh:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAB
MD5 SHA1 SHA512 SSDEEP

Submit Download

vVwCnTj.exe

Path \Windows\system\vVwCnTj.exe
Size 1.6MB
SHA256 d9431db4899dbcc74a8140c41212e0232eb4a2a2fc163681e2f2bb203f13c0e5
MD5 189aa7c8ad8c9270452c40356ca8cce7
SHA1 ab41a2c145788950708404fe0c6d83207dd0fc06
SHA512 a321744de925bcb7fd0b7e034433e7493e111bc1e1c62e5782e9e14f53d050add201f96de3ef4c0590d4b614388312c20e50b7d35d4f6b1ad005962e86cc4281
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fA:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

xMKBKpG.exe

Path \Windows\system\xMKBKpG.exe
Size 1.6MB
SHA256 0e8fcdf3ed81b5d4e091564c9d39ed39f189375adc0a53f7435b4e09ac448de4
MD5 909bebd4c1b58f7820bd8b2f7ea5d1db
SHA1 c80239e041bd99e9eac3bf407331330c2e6b7a56
SHA512 7dc4f5eb4c47a677c3dd008a31650215fdcf1d4c6b9cd39338386859ad21a643211b72f5fe728e444edaeeaa150a5723248b941d6a08f16c7f2a5ff55e1a7ebc
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1u471mNtcgiTiBLCXAj++fl:ROdWCCi7/rahwNUMuikLCiJCF+QT1HAF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/580-4354-0x000000013F110000-0x000000013F461000-memory.dmp

Download

memory/580-79-0x000000013F110000-0x000000013F461000-memory.dmp

Download

memory/1020-4326-0x000000013FA40000-0x000000013FD91000-memory.dmp

Download

memory/1020-98-0x000000013FA40000-0x000000013FD91000-memory.dmp

Download

memory/1392-92-0x000000013FB50000-0x000000013FEA1000-memory.dmp

Download

memory/1392-4773-0x000000013FB50000-0x000000013FEA1000-memory.dmp

Download

memory/1456-4387-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/1456-18-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/1456-58-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/1936-122-0x0000000001F20000-0x0000000002271000-memory.dmp

Download

memory/1936-66-0x000000013FE70000-0x00000001401C1000-memory.dmp

Download

memory/1936-53-0x0000000001F20000-0x0000000002271000-memory.dmp

Download

memory/1936-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Download

memory/1936-99-0x000000013FD50000-0x00000001400A1000-memory.dmp

Download

memory/1936-55-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/1936-97-0x000000013FA40000-0x000000013FD91000-memory.dmp

Download

memory/1936-96-0x0000000001F20000-0x0000000002271000-memory.dmp

Download

memory/1936-78-0x000000013F110000-0x000000013F461000-memory.dmp

Download

memory/1936-57-0x000000013F530000-0x000000013F881000-memory.dmp

Download

memory/1936-7-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/1936-25-0x0000000001F20000-0x0000000002271000-memory.dmp

Download

memory/1936-36-0x000000013F180000-0x000000013F4D1000-memory.dmp

Download

memory/1936-41-0x0000000001F20000-0x0000000002271000-memory.dmp

Download

memory/1936-90-0x000000013F180000-0x000000013F4D1000-memory.dmp

Download

memory/1936-64-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/1936-0-0x000000013F530000-0x000000013F881000-memory.dmp

Download

memory/1936-21-0x000000013FBF0000-0x000000013FF41000-memory.dmp

Download

memory/1936-75-0x000000013FB50000-0x000000013FEA1000-memory.dmp

Download

memory/1936-23-0x000000013FCC0000-0x0000000140011000-memory.dmp

Download

memory/2004-4388-0x000000013F180000-0x000000013F4D1000-memory.dmp

Download

memory/2004-37-0x000000013F180000-0x000000013F4D1000-memory.dmp

Download

memory/2268-4673-0x000000013F350000-0x000000013F6A1000-memory.dmp

Download

memory/2268-121-0x000000013F350000-0x000000013F6A1000-memory.dmp

Download

memory/2428-54-0x000000013F4D0000-0x000000013F821000-memory.dmp

Download

memory/2428-3854-0x000000013F4D0000-0x000000013F821000-memory.dmp

Download

memory/2496-59-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/2496-4344-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/2560-4342-0x000000013F1E0000-0x000000013F531000-memory.dmp

Download

memory/2560-891-0x000000013F1E0000-0x000000013F531000-memory.dmp

Download

memory/2560-43-0x000000013F1E0000-0x000000013F531000-memory.dmp

Download

memory/2572-4659-0x000000013FCC0000-0x0000000140011000-memory.dmp

Download

memory/2572-65-0x000000013FCC0000-0x0000000140011000-memory.dmp

Download

memory/2572-19-0x000000013FCC0000-0x0000000140011000-memory.dmp

Download

memory/2648-22-0x000000013FBF0000-0x000000013FF41000-memory.dmp

Download

memory/2648-4672-0x000000013FBF0000-0x000000013FF41000-memory.dmp

Download

memory/2684-29-0x000000013F4A0000-0x000000013F7F1000-memory.dmp

Download

memory/2684-4380-0x000000013F4A0000-0x000000013F7F1000-memory.dmp

Download

memory/2684-80-0x000000013F4A0000-0x000000013F7F1000-memory.dmp

Download

memory/2832-4424-0x000000013F510000-0x000000013F861000-memory.dmp

Download

memory/2832-123-0x000000013F510000-0x000000013F861000-memory.dmp

Download

memory/2932-4386-0x000000013FE70000-0x00000001401C1000-memory.dmp

Download

memory/2932-67-0x000000013FE70000-0x00000001401C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads