xmrig | ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
Size

1.2MB
MD5

91480f9afc6706d2fab4a8dd2a98a3ee
SHA1

964def7ea7ed1931854931ce71714e0ac510f5d3
SHA256

ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2
SHA512

c607a4a7090373ed57b08e9a9d4ddb9c4b4df7c4ca88cae8b1a16a3f4d55f32f72c357d068e45cc2a371f74b89fa4f96b5ee38987b0955c2ec0c9741e8df08db
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrYn6MYfaGn1/wpq7:GezaTF8FcNkNdfE0pZ9ozttwIRQxMYPZ

Score

10^/10

xmrig discovery miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x00070000000120fe-5.dat	xmrig
behavioral1/files/0x00070000000186d9-9.dat	xmrig
behavioral1/files/0x0006000000018710-14.dat	xmrig
behavioral1/files/0x0006000000018718-18.dat	xmrig
behavioral1/files/0x0006000000018766-22.dat	xmrig
behavioral1/files/0x0008000000018780-25.dat	xmrig
behavioral1/files/0x0009000000018b62-30.dat	xmrig
behavioral1/files/0x000500000001960c-41.dat	xmrig
behavioral1/files/0x000500000001961e-49.dat	xmrig
behavioral1/files/0x0005000000019cca-85.dat	xmrig
behavioral1/files/0x000500000001a41b-125.dat	xmrig
behavioral1/files/0x000500000001a41d-130.dat	xmrig
behavioral1/files/0x000500000001a359-121.dat	xmrig
behavioral1/files/0x000500000001a307-117.dat	xmrig
behavioral1/files/0x000500000001a09e-113.dat	xmrig
behavioral1/files/0x000500000001a075-106.dat	xmrig
behavioral1/files/0x000500000001a07e-109.dat	xmrig
behavioral1/files/0x0005000000019f8a-97.dat	xmrig
behavioral1/files/0x0005000000019d8e-89.dat	xmrig
behavioral1/files/0x0005000000019f94-101.dat	xmrig
behavioral1/files/0x0005000000019dbf-93.dat	xmrig
behavioral1/files/0x0005000000019cba-81.dat	xmrig
behavioral1/files/0x0005000000019c57-77.dat	xmrig
behavioral1/files/0x0005000000019c3e-73.dat	xmrig
behavioral1/files/0x0005000000019c3c-70.dat	xmrig
behavioral1/files/0x0005000000019c34-65.dat	xmrig
behavioral1/files/0x0005000000019926-61.dat	xmrig
behavioral1/files/0x00050000000196a1-57.dat	xmrig
behavioral1/files/0x0005000000019667-53.dat	xmrig
behavioral1/files/0x000500000001961c-46.dat	xmrig
behavioral1/files/0x000500000001960a-37.dat	xmrig
behavioral1/files/0x000600000001932d-34.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2736	NTCUIrE.exe
2840	SeHcpXn.exe
2884	ztKioyu.exe
2824	TFNVlCJ.exe
2012	FoVXiSU.exe
2752	hbCmWsy.exe
2968	gsBESvK.exe
1752	GmpITCW.exe
2620	GKgydon.exe
2568	GEUsQEH.exe
2640	RuiocUz.exe
2240	ESihWRF.exe
1796	TKUlPzd.exe
612	CDpeUsF.exe
2612	UHeanSz.exe
1808	BMJUIAb.exe
3028	kdUpjVd.exe
852	mkoQoTt.exe
2108	euAVyQB.exe
2132	giOCWry.exe
2288	iABGxZV.exe
2560	AFmdctN.exe
552	inFChCC.exe
2804	GhqZsyQ.exe
2812	rtdVoEQ.exe
536	elpYCdf.exe
468	TcGvVnc.exe
1020	rKHvdFF.exe
2440	KpzCySh.exe
2192	CQxfRmx.exe
2352	HsCIFIj.exe
2388	XRMxxys.exe
3052	FcXiaHI.exe
2252	inWtzep.exe
2016	yriskvt.exe
1324	HKUBGFw.exe
1960	uIqHseK.exe
956	wWOqliY.exe
1432	xPXAata.exe
1212	EVtexhX.exe
1616	YGrLhOC.exe
896	IDXDntI.exe
1136	xFxGHfW.exe
560	YLLqgWs.exe
1284	PPgBfdB.exe
1688	anmyUuu.exe
2104	wjXDvMs.exe
2080	qxlvPSs.exe
1472	pGFUvBs.exe
2540	gBixpGp.exe
1148	dJgQeyX.exe
1664	joyhmoJ.exe
2032	EKIvGKd.exe
1756	QMJyQMS.exe
2316	MpzqorQ.exe
1248	LokLeeH.exe
2532	wWPYJLJ.exe
2444	lcdDXGl.exe
2312	oJTmCLY.exe
1528	bPyyYax.exe
792	dXlzZkH.exe
2292	ofyrEnh.exe
2520	MgTTwGO.exe
2504	aoGCgDb.exe

Loads dropped DLL 64 IoCs

pid	Process
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gupPbqj.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\dJgQeyX.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\gNMrevZ.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\DeUPsPZ.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\FVUnQPK.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\ygXIFpz.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\tEteeYs.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\ootXBhO.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\kJVCzUD.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\YlWPrFe.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\GOumpkz.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\GhqZsyQ.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\ZEnnLkw.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\pfKEocC.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\VfofYFW.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\CtWwpOl.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\qRowTyl.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\mowwgJO.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\iYHZbez.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\kBZHTIN.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\kXCxmIo.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\ZXypPIx.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\qJWeHVl.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\lHFIExC.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\bUmdagz.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\FaDPcmy.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\cbNGUda.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\XbojRob.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\QVmCgqY.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\SRSzXcT.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\lQalWkE.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\IuKbqOt.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\lztbVgX.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\hCjwmIj.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\ilUgnXS.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\tcTUAYT.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\FvZsAOD.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\RcHaYPF.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\clZiKvF.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\WbfxnQR.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\mrvZndL.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\UrExkna.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\LokLeeH.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\NdvhJUY.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\mLPYRIh.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\CppkPWW.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\BzansQZ.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\kyZKBya.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\OpuCkUC.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\SjBaHJs.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\bAEvvFh.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\kHrZhPH.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\uKBicGp.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\KiwZkCi.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\YuGOWyO.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\DGGKtkC.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\rqoGwSn.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\ZaIXJhu.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\hpRorWN.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\iVjzFpH.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\xuOtPCU.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\kGGbseq.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\fhGAmOF.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
File created	C:\Windows\System\ZhSstGI.exe	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4456	LpInGRa.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2736	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	31
PID 2412 wrote to memory of 2736	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	31
PID 2412 wrote to memory of 2736	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	31
PID 2412 wrote to memory of 2840	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	32
PID 2412 wrote to memory of 2840	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	32
PID 2412 wrote to memory of 2840	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	32
PID 2412 wrote to memory of 2884	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	33
PID 2412 wrote to memory of 2884	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	33
PID 2412 wrote to memory of 2884	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	33
PID 2412 wrote to memory of 2824	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	34
PID 2412 wrote to memory of 2824	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	34
PID 2412 wrote to memory of 2824	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	34
PID 2412 wrote to memory of 2012	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	35
PID 2412 wrote to memory of 2012	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	35
PID 2412 wrote to memory of 2012	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	35
PID 2412 wrote to memory of 2752	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	36
PID 2412 wrote to memory of 2752	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	36
PID 2412 wrote to memory of 2752	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	36
PID 2412 wrote to memory of 2968	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	37
PID 2412 wrote to memory of 2968	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	37
PID 2412 wrote to memory of 2968	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	37
PID 2412 wrote to memory of 1752	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	38
PID 2412 wrote to memory of 1752	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	38
PID 2412 wrote to memory of 1752	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	38
PID 2412 wrote to memory of 2620	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	39
PID 2412 wrote to memory of 2620	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	39
PID 2412 wrote to memory of 2620	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	39
PID 2412 wrote to memory of 2568	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	40
PID 2412 wrote to memory of 2568	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	40
PID 2412 wrote to memory of 2568	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	40
PID 2412 wrote to memory of 2640	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	41
PID 2412 wrote to memory of 2640	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	41
PID 2412 wrote to memory of 2640	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	41
PID 2412 wrote to memory of 2240	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	42
PID 2412 wrote to memory of 2240	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	42
PID 2412 wrote to memory of 2240	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	42
PID 2412 wrote to memory of 1796	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	43
PID 2412 wrote to memory of 1796	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	43
PID 2412 wrote to memory of 1796	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	43
PID 2412 wrote to memory of 612	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	44
PID 2412 wrote to memory of 612	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	44
PID 2412 wrote to memory of 612	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	44
PID 2412 wrote to memory of 2612	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	45
PID 2412 wrote to memory of 2612	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	45
PID 2412 wrote to memory of 2612	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	45
PID 2412 wrote to memory of 1808	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	46
PID 2412 wrote to memory of 1808	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	46
PID 2412 wrote to memory of 1808	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	46
PID 2412 wrote to memory of 3028	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	47
PID 2412 wrote to memory of 3028	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	47
PID 2412 wrote to memory of 3028	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	47
PID 2412 wrote to memory of 852	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	48
PID 2412 wrote to memory of 852	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	48
PID 2412 wrote to memory of 852	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	48
PID 2412 wrote to memory of 2108	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	49
PID 2412 wrote to memory of 2108	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	49
PID 2412 wrote to memory of 2108	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	49
PID 2412 wrote to memory of 2132	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	50
PID 2412 wrote to memory of 2132	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	50
PID 2412 wrote to memory of 2132	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	50
PID 2412 wrote to memory of 2288	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	51
PID 2412 wrote to memory of 2288	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	51
PID 2412 wrote to memory of 2288	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	51
PID 2412 wrote to memory of 2560	2412	ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe	52

C:\Users\Admin\AppData\Local\Temp\ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe
"C:\Users\Admin\AppData\Local\Temp\ca947e8de40098ad56c66e446da2ea296b82da8f0c16fcd9c86ba6136c8dd9b2.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\System\NTCUIrE.exe
  C:\Windows\System\NTCUIrE.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\SeHcpXn.exe
  C:\Windows\System\SeHcpXn.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\ztKioyu.exe
  C:\Windows\System\ztKioyu.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\TFNVlCJ.exe
  C:\Windows\System\TFNVlCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\FoVXiSU.exe
  C:\Windows\System\FoVXiSU.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\hbCmWsy.exe
  C:\Windows\System\hbCmWsy.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\gsBESvK.exe
  C:\Windows\System\gsBESvK.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\GmpITCW.exe
  C:\Windows\System\GmpITCW.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\GKgydon.exe
  C:\Windows\System\GKgydon.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\GEUsQEH.exe
  C:\Windows\System\GEUsQEH.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\RuiocUz.exe
  C:\Windows\System\RuiocUz.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\ESihWRF.exe
  C:\Windows\System\ESihWRF.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\TKUlPzd.exe
  C:\Windows\System\TKUlPzd.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\CDpeUsF.exe
  C:\Windows\System\CDpeUsF.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\UHeanSz.exe
  C:\Windows\System\UHeanSz.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\BMJUIAb.exe
  C:\Windows\System\BMJUIAb.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\kdUpjVd.exe
  C:\Windows\System\kdUpjVd.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\mkoQoTt.exe
  C:\Windows\System\mkoQoTt.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\euAVyQB.exe
  C:\Windows\System\euAVyQB.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\giOCWry.exe
  C:\Windows\System\giOCWry.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\iABGxZV.exe
  C:\Windows\System\iABGxZV.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\AFmdctN.exe
  C:\Windows\System\AFmdctN.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\inFChCC.exe
  C:\Windows\System\inFChCC.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\GhqZsyQ.exe
  C:\Windows\System\GhqZsyQ.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\rtdVoEQ.exe
  C:\Windows\System\rtdVoEQ.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\elpYCdf.exe
  C:\Windows\System\elpYCdf.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\TcGvVnc.exe
  C:\Windows\System\TcGvVnc.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\rKHvdFF.exe
  C:\Windows\System\rKHvdFF.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\KpzCySh.exe
  C:\Windows\System\KpzCySh.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\CQxfRmx.exe
  C:\Windows\System\CQxfRmx.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\HsCIFIj.exe
  C:\Windows\System\HsCIFIj.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\XRMxxys.exe
  C:\Windows\System\XRMxxys.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\FcXiaHI.exe
  C:\Windows\System\FcXiaHI.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\inWtzep.exe
  C:\Windows\System\inWtzep.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\yriskvt.exe
  C:\Windows\System\yriskvt.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\HKUBGFw.exe
  C:\Windows\System\HKUBGFw.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\uIqHseK.exe
  C:\Windows\System\uIqHseK.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\wWOqliY.exe
  C:\Windows\System\wWOqliY.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\xPXAata.exe
  C:\Windows\System\xPXAata.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\EVtexhX.exe
  C:\Windows\System\EVtexhX.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\YGrLhOC.exe
  C:\Windows\System\YGrLhOC.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\IDXDntI.exe
  C:\Windows\System\IDXDntI.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\xFxGHfW.exe
  C:\Windows\System\xFxGHfW.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\YLLqgWs.exe
  C:\Windows\System\YLLqgWs.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\PPgBfdB.exe
  C:\Windows\System\PPgBfdB.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\anmyUuu.exe
  C:\Windows\System\anmyUuu.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\wjXDvMs.exe
  C:\Windows\System\wjXDvMs.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\qxlvPSs.exe
  C:\Windows\System\qxlvPSs.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\pGFUvBs.exe
  C:\Windows\System\pGFUvBs.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\gBixpGp.exe
  C:\Windows\System\gBixpGp.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\dJgQeyX.exe
  C:\Windows\System\dJgQeyX.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\joyhmoJ.exe
  C:\Windows\System\joyhmoJ.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\EKIvGKd.exe
  C:\Windows\System\EKIvGKd.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\QMJyQMS.exe
  C:\Windows\System\QMJyQMS.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\MpzqorQ.exe
  C:\Windows\System\MpzqorQ.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\LokLeeH.exe
  C:\Windows\System\LokLeeH.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\wWPYJLJ.exe
  C:\Windows\System\wWPYJLJ.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\lcdDXGl.exe
  C:\Windows\System\lcdDXGl.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\oJTmCLY.exe
  C:\Windows\System\oJTmCLY.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\bPyyYax.exe
  C:\Windows\System\bPyyYax.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\dXlzZkH.exe
  C:\Windows\System\dXlzZkH.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\ofyrEnh.exe
  C:\Windows\System\ofyrEnh.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\MgTTwGO.exe
  C:\Windows\System\MgTTwGO.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\aoGCgDb.exe
  C:\Windows\System\aoGCgDb.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\gOhEGJa.exe
  C:\Windows\System\gOhEGJa.exe
  2⤵
  PID:1692
- C:\Windows\System\gNMrevZ.exe
  C:\Windows\System\gNMrevZ.exe
  2⤵
  PID:2128
- C:\Windows\System\THNWQzB.exe
  C:\Windows\System\THNWQzB.exe
  2⤵
  PID:1968
- C:\Windows\System\rRLamxB.exe
  C:\Windows\System\rRLamxB.exe
  2⤵
  PID:1240
- C:\Windows\System\XxJLVDI.exe
  C:\Windows\System\XxJLVDI.exe
  2⤵
  PID:2432
- C:\Windows\System\fjiZNrk.exe
  C:\Windows\System\fjiZNrk.exe
  2⤵
  PID:2708
- C:\Windows\System\TqnsHkX.exe
  C:\Windows\System\TqnsHkX.exe
  2⤵
  PID:2724
- C:\Windows\System\DXYIOhS.exe
  C:\Windows\System\DXYIOhS.exe
  2⤵
  PID:2996
- C:\Windows\System\qQAFceV.exe
  C:\Windows\System\qQAFceV.exe
  2⤵
  PID:3024
- C:\Windows\System\JQNAXAI.exe
  C:\Windows\System\JQNAXAI.exe
  2⤵
  PID:2580
- C:\Windows\System\GZjgGup.exe
  C:\Windows\System\GZjgGup.exe
  2⤵
  PID:2608
- C:\Windows\System\vQHDvvQ.exe
  C:\Windows\System\vQHDvvQ.exe
  2⤵
  PID:2716
- C:\Windows\System\pPxPfUV.exe
  C:\Windows\System\pPxPfUV.exe
  2⤵
  PID:2592
- C:\Windows\System\GansHKm.exe
  C:\Windows\System\GansHKm.exe
  2⤵
  PID:2852
- C:\Windows\System\lzabgiN.exe
  C:\Windows\System\lzabgiN.exe
  2⤵
  PID:2100
- C:\Windows\System\BZNlwwU.exe
  C:\Windows\System\BZNlwwU.exe
  2⤵
  PID:1552
- C:\Windows\System\ATkOfOT.exe
  C:\Windows\System\ATkOfOT.exe
  2⤵
  PID:2552
- C:\Windows\System\riNJiOc.exe
  C:\Windows\System\riNJiOc.exe
  2⤵
  PID:1508
- C:\Windows\System\HpkeRyI.exe
  C:\Windows\System\HpkeRyI.exe
  2⤵
  PID:1416
- C:\Windows\System\vjDvPkU.exe
  C:\Windows\System\vjDvPkU.exe
  2⤵
  PID:868
- C:\Windows\System\eyXXRPF.exe
  C:\Windows\System\eyXXRPF.exe
  2⤵
  PID:584
- C:\Windows\System\ePKBRfX.exe
  C:\Windows\System\ePKBRfX.exe
  2⤵
  PID:1780
- C:\Windows\System\zlFYuTC.exe
  C:\Windows\System\zlFYuTC.exe
  2⤵
  PID:780
- C:\Windows\System\SdgzhVy.exe
  C:\Windows\System\SdgzhVy.exe
  2⤵
  PID:2248
- C:\Windows\System\EjzvzWf.exe
  C:\Windows\System\EjzvzWf.exe
  2⤵
  PID:2368
- C:\Windows\System\NAOXEtK.exe
  C:\Windows\System\NAOXEtK.exe
  2⤵
  PID:2688
- C:\Windows\System\EInOdWR.exe
  C:\Windows\System\EInOdWR.exe
  2⤵
  PID:2364
- C:\Windows\System\wHqTOCR.exe
  C:\Windows\System\wHqTOCR.exe
  2⤵
  PID:2236
- C:\Windows\System\DtbLwrz.exe
  C:\Windows\System\DtbLwrz.exe
  2⤵
  PID:1280
- C:\Windows\System\ALpvzwT.exe
  C:\Windows\System\ALpvzwT.exe
  2⤵
  PID:2152
- C:\Windows\System\UmbXtvA.exe
  C:\Windows\System\UmbXtvA.exe
  2⤵
  PID:832
- C:\Windows\System\tgGPZgx.exe
  C:\Windows\System\tgGPZgx.exe
  2⤵
  PID:2780
- C:\Windows\System\oaLbchv.exe
  C:\Windows\System\oaLbchv.exe
  2⤵
  PID:864
- C:\Windows\System\ciQGZip.exe
  C:\Windows\System\ciQGZip.exe
  2⤵
  PID:1288
- C:\Windows\System\OppqglK.exe
  C:\Windows\System\OppqglK.exe
  2⤵
  PID:1880
- C:\Windows\System\nyZInMU.exe
  C:\Windows\System\nyZInMU.exe
  2⤵
  PID:3060
- C:\Windows\System\myskWZp.exe
  C:\Windows\System\myskWZp.exe
  2⤵
  PID:1264
- C:\Windows\System\VFpuHFD.exe
  C:\Windows\System\VFpuHFD.exe
  2⤵
  PID:2320
- C:\Windows\System\kdvHWAJ.exe
  C:\Windows\System\kdvHWAJ.exe
  2⤵
  PID:604
- C:\Windows\System\umoBpyl.exe
  C:\Windows\System\umoBpyl.exe
  2⤵
  PID:2328
- C:\Windows\System\xWxpCGP.exe
  C:\Windows\System\xWxpCGP.exe
  2⤵
  PID:1952
- C:\Windows\System\VsuLxbs.exe
  C:\Windows\System\VsuLxbs.exe
  2⤵
  PID:1448
- C:\Windows\System\obVWoYT.exe
  C:\Windows\System\obVWoYT.exe
  2⤵
  PID:1884
- C:\Windows\System\hSOgQZG.exe
  C:\Windows\System\hSOgQZG.exe
  2⤵
  PID:1868
- C:\Windows\System\RshCorH.exe
  C:\Windows\System\RshCorH.exe
  2⤵
  PID:2888
- C:\Windows\System\wLmngSi.exe
  C:\Windows\System\wLmngSi.exe
  2⤵
  PID:1520
- C:\Windows\System\TubOgcq.exe
  C:\Windows\System\TubOgcq.exe
  2⤵
  PID:2868
- C:\Windows\System\QsUpCRd.exe
  C:\Windows\System\QsUpCRd.exe
  2⤵
  PID:2696
- C:\Windows\System\AOtvgGj.exe
  C:\Windows\System\AOtvgGj.exe
  2⤵
  PID:1372
- C:\Windows\System\BDLMlSK.exe
  C:\Windows\System\BDLMlSK.exe
  2⤵
  PID:2200
- C:\Windows\System\mwkTyxo.exe
  C:\Windows\System\mwkTyxo.exe
  2⤵
  PID:1512
- C:\Windows\System\NgZXgYL.exe
  C:\Windows\System\NgZXgYL.exe
  2⤵
  PID:1608
- C:\Windows\System\CKIppko.exe
  C:\Windows\System\CKIppko.exe
  2⤵
  PID:2756
- C:\Windows\System\hONENCI.exe
  C:\Windows\System\hONENCI.exe
  2⤵
  PID:2920
- C:\Windows\System\uPUAcqL.exe
  C:\Windows\System\uPUAcqL.exe
  2⤵
  PID:848
- C:\Windows\System\vEDwoGT.exe
  C:\Windows\System\vEDwoGT.exe
  2⤵
  PID:2468
- C:\Windows\System\DxSGmXK.exe
  C:\Windows\System\DxSGmXK.exe
  2⤵
  PID:2692
- C:\Windows\System\GGovsxX.exe
  C:\Windows\System\GGovsxX.exe
  2⤵
  PID:2260
- C:\Windows\System\LeXVJRY.exe
  C:\Windows\System\LeXVJRY.exe
  2⤵
  PID:2460
- C:\Windows\System\aKOaHFD.exe
  C:\Windows\System\aKOaHFD.exe
  2⤵
  PID:2604
- C:\Windows\System\yTKmoaz.exe
  C:\Windows\System\yTKmoaz.exe
  2⤵
  PID:1556
- C:\Windows\System\DeUPsPZ.exe
  C:\Windows\System\DeUPsPZ.exe
  2⤵
  PID:1668
- C:\Windows\System\kWDDUZA.exe
  C:\Windows\System\kWDDUZA.exe
  2⤵
  PID:1656
- C:\Windows\System\eNjtuok.exe
  C:\Windows\System\eNjtuok.exe
  2⤵
  PID:2764
- C:\Windows\System\uHoywzS.exe
  C:\Windows\System\uHoywzS.exe
  2⤵
  PID:2616
- C:\Windows\System\qkKylnh.exe
  C:\Windows\System\qkKylnh.exe
  2⤵
  PID:1272
- C:\Windows\System\jJILVZs.exe
  C:\Windows\System\jJILVZs.exe
  2⤵
  PID:1696
- C:\Windows\System\mkTWGRm.exe
  C:\Windows\System\mkTWGRm.exe
  2⤵
  PID:2500
- C:\Windows\System\NdNEnJG.exe
  C:\Windows\System\NdNEnJG.exe
  2⤵
  PID:2556
- C:\Windows\System\GxYrDRU.exe
  C:\Windows\System\GxYrDRU.exe
  2⤵
  PID:2384
- C:\Windows\System\IBJCdhw.exe
  C:\Windows\System\IBJCdhw.exe
  2⤵
  PID:2112
- C:\Windows\System\gcRMTie.exe
  C:\Windows\System\gcRMTie.exe
  2⤵
  PID:2740
- C:\Windows\System\sBjjHkM.exe
  C:\Windows\System\sBjjHkM.exe
  2⤵
  PID:2172
- C:\Windows\System\JPCoMpT.exe
  C:\Windows\System\JPCoMpT.exe
  2⤵
  PID:752
- C:\Windows\System\DxJwFmN.exe
  C:\Windows\System\DxJwFmN.exe
  2⤵
  PID:1724
- C:\Windows\System\ZsbMNcJ.exe
  C:\Windows\System\ZsbMNcJ.exe
  2⤵
  PID:1124
- C:\Windows\System\XXsPOnp.exe
  C:\Windows\System\XXsPOnp.exe
  2⤵
  PID:2820
- C:\Windows\System\BONkhUV.exe
  C:\Windows\System\BONkhUV.exe
  2⤵
  PID:2160
- C:\Windows\System\ohCHxVQ.exe
  C:\Windows\System\ohCHxVQ.exe
  2⤵
  PID:2664
- C:\Windows\System\eWWHtFH.exe
  C:\Windows\System\eWWHtFH.exe
  2⤵
  PID:2244
- C:\Windows\System\GCAWYyb.exe
  C:\Windows\System\GCAWYyb.exe
  2⤵
  PID:1140
- C:\Windows\System\kkiiymf.exe
  C:\Windows\System\kkiiymf.exe
  2⤵
  PID:2140
- C:\Windows\System\VokzWRG.exe
  C:\Windows\System\VokzWRG.exe
  2⤵
  PID:2836
- C:\Windows\System\cliaNYy.exe
  C:\Windows\System\cliaNYy.exe
  2⤵
  PID:1544
- C:\Windows\System\aoNtTwJ.exe
  C:\Windows\System\aoNtTwJ.exe
  2⤵
  PID:2588
- C:\Windows\System\uzBRyEe.exe
  C:\Windows\System\uzBRyEe.exe
  2⤵
  PID:2712
- C:\Windows\System\BQoFMwA.exe
  C:\Windows\System\BQoFMwA.exe
  2⤵
  PID:1592
- C:\Windows\System\fhgWEqo.exe
  C:\Windows\System\fhgWEqo.exe
  2⤵
  PID:2648
- C:\Windows\System\gHsoWkf.exe
  C:\Windows\System\gHsoWkf.exe
  2⤵
  PID:904
- C:\Windows\System\NIcnLHM.exe
  C:\Windows\System\NIcnLHM.exe
  2⤵
  PID:2856
- C:\Windows\System\tsKKTqo.exe
  C:\Windows\System\tsKKTqo.exe
  2⤵
  PID:1632
- C:\Windows\System\EzIPMnV.exe
  C:\Windows\System\EzIPMnV.exe
  2⤵
  PID:2796
- C:\Windows\System\cNVYMZd.exe
  C:\Windows\System\cNVYMZd.exe
  2⤵
  PID:2144
- C:\Windows\System\hHpaGiZ.exe
  C:\Windows\System\hHpaGiZ.exe
  2⤵
  PID:1984
- C:\Windows\System\gavpxdS.exe
  C:\Windows\System\gavpxdS.exe
  2⤵
  PID:2300
- C:\Windows\System\cPJTDYq.exe
  C:\Windows\System\cPJTDYq.exe
  2⤵
  PID:284
- C:\Windows\System\hVFiyeA.exe
  C:\Windows\System\hVFiyeA.exe
  2⤵
  PID:2376
- C:\Windows\System\DRXfhYj.exe
  C:\Windows\System\DRXfhYj.exe
  2⤵
  PID:1748
- C:\Windows\System\CmJGPXC.exe
  C:\Windows\System\CmJGPXC.exe
  2⤵
  PID:1488
- C:\Windows\System\snRFAPi.exe
  C:\Windows\System\snRFAPi.exe
  2⤵
  PID:1676
- C:\Windows\System\iYHZbez.exe
  C:\Windows\System\iYHZbez.exe
  2⤵
  PID:2212
- C:\Windows\System\QmvhlPM.exe
  C:\Windows\System\QmvhlPM.exe
  2⤵
  PID:2184
- C:\Windows\System\GKKNKjI.exe
  C:\Windows\System\GKKNKjI.exe
  2⤵
  PID:1684
- C:\Windows\System\znFYwUa.exe
  C:\Windows\System\znFYwUa.exe
  2⤵
  PID:2228
- C:\Windows\System\YPNyLFF.exe
  C:\Windows\System\YPNyLFF.exe
  2⤵
  PID:3088
- C:\Windows\System\TRyUFzI.exe
  C:\Windows\System\TRyUFzI.exe
  2⤵
  PID:3104
- C:\Windows\System\nMenGCv.exe
  C:\Windows\System\nMenGCv.exe
  2⤵
  PID:3120
- C:\Windows\System\cXTwDkt.exe
  C:\Windows\System\cXTwDkt.exe
  2⤵
  PID:3136
- C:\Windows\System\vNEYobs.exe
  C:\Windows\System\vNEYobs.exe
  2⤵
  PID:3152
- C:\Windows\System\wIBXJZL.exe
  C:\Windows\System\wIBXJZL.exe
  2⤵
  PID:3168
- C:\Windows\System\uTuTFbx.exe
  C:\Windows\System\uTuTFbx.exe
  2⤵
  PID:3184
- C:\Windows\System\yTLvWRo.exe
  C:\Windows\System\yTLvWRo.exe
  2⤵
  PID:3200
- C:\Windows\System\iAIMAmX.exe
  C:\Windows\System\iAIMAmX.exe
  2⤵
  PID:3216
- C:\Windows\System\XdhreXe.exe
  C:\Windows\System\XdhreXe.exe
  2⤵
  PID:3232
- C:\Windows\System\HTFuElX.exe
  C:\Windows\System\HTFuElX.exe
  2⤵
  PID:3248
- C:\Windows\System\xyAgWom.exe
  C:\Windows\System\xyAgWom.exe
  2⤵
  PID:3264
- C:\Windows\System\pJqkGnH.exe
  C:\Windows\System\pJqkGnH.exe
  2⤵
  PID:3280
- C:\Windows\System\dAoYbHo.exe
  C:\Windows\System\dAoYbHo.exe
  2⤵
  PID:3296
- C:\Windows\System\VLVIklg.exe
  C:\Windows\System\VLVIklg.exe
  2⤵
  PID:3312
- C:\Windows\System\EYvdcYy.exe
  C:\Windows\System\EYvdcYy.exe
  2⤵
  PID:3328
- C:\Windows\System\DiotbqE.exe
  C:\Windows\System\DiotbqE.exe
  2⤵
  PID:3344
- C:\Windows\System\cPtvrax.exe
  C:\Windows\System\cPtvrax.exe
  2⤵
  PID:3360
- C:\Windows\System\iUghWsr.exe
  C:\Windows\System\iUghWsr.exe
  2⤵
  PID:3376
- C:\Windows\System\GSOBHwC.exe
  C:\Windows\System\GSOBHwC.exe
  2⤵
  PID:3392
- C:\Windows\System\TbISBFx.exe
  C:\Windows\System\TbISBFx.exe
  2⤵
  PID:3408
- C:\Windows\System\ZXpBtyX.exe
  C:\Windows\System\ZXpBtyX.exe
  2⤵
  PID:3424
- C:\Windows\System\XpvKgHT.exe
  C:\Windows\System\XpvKgHT.exe
  2⤵
  PID:3440
- C:\Windows\System\OJpYveQ.exe
  C:\Windows\System\OJpYveQ.exe
  2⤵
  PID:3456
- C:\Windows\System\bBCnBcU.exe
  C:\Windows\System\bBCnBcU.exe
  2⤵
  PID:3472
- C:\Windows\System\tPqhCOJ.exe
  C:\Windows\System\tPqhCOJ.exe
  2⤵
  PID:3488
- C:\Windows\System\LiQdRsd.exe
  C:\Windows\System\LiQdRsd.exe
  2⤵
  PID:3508
- C:\Windows\System\SwjkncF.exe
  C:\Windows\System\SwjkncF.exe
  2⤵
  PID:3524
- C:\Windows\System\MAjWiED.exe
  C:\Windows\System\MAjWiED.exe
  2⤵
  PID:3540
- C:\Windows\System\dsyzxDR.exe
  C:\Windows\System\dsyzxDR.exe
  2⤵
  PID:3556
- C:\Windows\System\bXRLDie.exe
  C:\Windows\System\bXRLDie.exe
  2⤵
  PID:3572
- C:\Windows\System\qJWeHVl.exe
  C:\Windows\System\qJWeHVl.exe
  2⤵
  PID:3588
- C:\Windows\System\sXVLWhZ.exe
  C:\Windows\System\sXVLWhZ.exe
  2⤵
  PID:3604
- C:\Windows\System\YCNikMe.exe
  C:\Windows\System\YCNikMe.exe
  2⤵
  PID:3620
- C:\Windows\System\UEINHcZ.exe
  C:\Windows\System\UEINHcZ.exe
  2⤵
  PID:3636
- C:\Windows\System\xNOjeJe.exe
  C:\Windows\System\xNOjeJe.exe
  2⤵
  PID:3652
- C:\Windows\System\ZEnnLkw.exe
  C:\Windows\System\ZEnnLkw.exe
  2⤵
  PID:3668
- C:\Windows\System\ylOXwxQ.exe
  C:\Windows\System\ylOXwxQ.exe
  2⤵
  PID:3684
- C:\Windows\System\BoQGuoT.exe
  C:\Windows\System\BoQGuoT.exe
  2⤵
  PID:3700
- C:\Windows\System\uyoyJQq.exe
  C:\Windows\System\uyoyJQq.exe
  2⤵
  PID:3716
- C:\Windows\System\fyiRpqv.exe
  C:\Windows\System\fyiRpqv.exe
  2⤵
  PID:3732
- C:\Windows\System\NeVzFEl.exe
  C:\Windows\System\NeVzFEl.exe
  2⤵
  PID:3748
- C:\Windows\System\mqGoNeE.exe
  C:\Windows\System\mqGoNeE.exe
  2⤵
  PID:3764
- C:\Windows\System\HetUHoS.exe
  C:\Windows\System\HetUHoS.exe
  2⤵
  PID:3780
- C:\Windows\System\qyJszqv.exe
  C:\Windows\System\qyJszqv.exe
  2⤵
  PID:3796
- C:\Windows\System\ZFsLodS.exe
  C:\Windows\System\ZFsLodS.exe
  2⤵
  PID:3812
- C:\Windows\System\KNjRaZj.exe
  C:\Windows\System\KNjRaZj.exe
  2⤵
  PID:3828
- C:\Windows\System\DdMddcU.exe
  C:\Windows\System\DdMddcU.exe
  2⤵
  PID:3844
- C:\Windows\System\iVjzFpH.exe
  C:\Windows\System\iVjzFpH.exe
  2⤵
  PID:3860
- C:\Windows\System\kWXrKaO.exe
  C:\Windows\System\kWXrKaO.exe
  2⤵
  PID:3876
- C:\Windows\System\mnFSPUn.exe
  C:\Windows\System\mnFSPUn.exe
  2⤵
  PID:3892
- C:\Windows\System\lHVZBkH.exe
  C:\Windows\System\lHVZBkH.exe
  2⤵
  PID:3908
- C:\Windows\System\ZsUTCBR.exe
  C:\Windows\System\ZsUTCBR.exe
  2⤵
  PID:3924
- C:\Windows\System\HkTINnl.exe
  C:\Windows\System\HkTINnl.exe
  2⤵
  PID:3940
- C:\Windows\System\ZULBtrZ.exe
  C:\Windows\System\ZULBtrZ.exe
  2⤵
  PID:3956
- C:\Windows\System\adaqTpZ.exe
  C:\Windows\System\adaqTpZ.exe
  2⤵
  PID:3972
- C:\Windows\System\cCqszDC.exe
  C:\Windows\System\cCqszDC.exe
  2⤵
  PID:3988
- C:\Windows\System\RXnZPPN.exe
  C:\Windows\System\RXnZPPN.exe
  2⤵
  PID:4004
- C:\Windows\System\LcGGLwt.exe
  C:\Windows\System\LcGGLwt.exe
  2⤵
  PID:4020
- C:\Windows\System\QSFQZmh.exe
  C:\Windows\System\QSFQZmh.exe
  2⤵
  PID:4036
- C:\Windows\System\OWQLpoc.exe
  C:\Windows\System\OWQLpoc.exe
  2⤵
  PID:4052
- C:\Windows\System\RgIPodV.exe
  C:\Windows\System\RgIPodV.exe
  2⤵
  PID:4068
- C:\Windows\System\bwUhyma.exe
  C:\Windows\System\bwUhyma.exe
  2⤵
  PID:4084
- C:\Windows\System\xLHTAnS.exe
  C:\Windows\System\xLHTAnS.exe
  2⤵
  PID:924
- C:\Windows\System\FideEYE.exe
  C:\Windows\System\FideEYE.exe
  2⤵
  PID:1204
- C:\Windows\System\MCzOQBO.exe
  C:\Windows\System\MCzOQBO.exe
  2⤵
  PID:592
- C:\Windows\System\fpHAPXD.exe
  C:\Windows\System\fpHAPXD.exe
  2⤵
  PID:3096
- C:\Windows\System\RtAGfiF.exe
  C:\Windows\System\RtAGfiF.exe
  2⤵
  PID:3160
- C:\Windows\System\ttACCwk.exe
  C:\Windows\System\ttACCwk.exe
  2⤵
  PID:3256
- C:\Windows\System\ifwtmoZ.exe
  C:\Windows\System\ifwtmoZ.exe
  2⤵
  PID:3320
- C:\Windows\System\WdwPDBG.exe
  C:\Windows\System\WdwPDBG.exe
  2⤵
  PID:3384
- C:\Windows\System\FRYSFGm.exe
  C:\Windows\System\FRYSFGm.exe
  2⤵
  PID:3448
- C:\Windows\System\SsWkhiE.exe
  C:\Windows\System\SsWkhiE.exe
  2⤵
  PID:3484
- C:\Windows\System\AeEPOxu.exe
  C:\Windows\System\AeEPOxu.exe
  2⤵
  PID:3340
- C:\Windows\System\FdbmMjq.exe
  C:\Windows\System\FdbmMjq.exe
  2⤵
  PID:3272
- C:\Windows\System\DxTXYoK.exe
  C:\Windows\System\DxTXYoK.exe
  2⤵
  PID:3208
- C:\Windows\System\DRcrBAJ.exe
  C:\Windows\System\DRcrBAJ.exe
  2⤵
  PID:3240
- C:\Windows\System\XhOwsMB.exe
  C:\Windows\System\XhOwsMB.exe
  2⤵
  PID:3404
- C:\Windows\System\jFdTwUh.exe
  C:\Windows\System\jFdTwUh.exe
  2⤵
  PID:3084
- C:\Windows\System\NwMfaTE.exe
  C:\Windows\System\NwMfaTE.exe
  2⤵
  PID:3080
- C:\Windows\System\SIZUoZQ.exe
  C:\Windows\System\SIZUoZQ.exe
  2⤵
  PID:3516
- C:\Windows\System\pfKEocC.exe
  C:\Windows\System\pfKEocC.exe
  2⤵
  PID:3584
- C:\Windows\System\VEyZSlh.exe
  C:\Windows\System\VEyZSlh.exe
  2⤵
  PID:3648
- C:\Windows\System\RbBSPqv.exe
  C:\Windows\System\RbBSPqv.exe
  2⤵
  PID:3680
- C:\Windows\System\YGwmZeb.exe
  C:\Windows\System\YGwmZeb.exe
  2⤵
  PID:3964
- C:\Windows\System\AihSaNF.exe
  C:\Windows\System\AihSaNF.exe
  2⤵
  PID:4028
- C:\Windows\System\rJyMwYu.exe
  C:\Windows\System\rJyMwYu.exe
  2⤵
  PID:4060
- C:\Windows\System\PKAJrOr.exe
  C:\Windows\System\PKAJrOr.exe
  2⤵
  PID:3564
- C:\Windows\System\lNTfzlS.exe
  C:\Windows\System\lNTfzlS.exe
  2⤵
  PID:2484
- C:\Windows\System\PluJVyl.exe
  C:\Windows\System\PluJVyl.exe
  2⤵
  PID:3664
- C:\Windows\System\Yvprvma.exe
  C:\Windows\System\Yvprvma.exe
  2⤵
  PID:3728
- C:\Windows\System\phCtcqA.exe
  C:\Windows\System\phCtcqA.exe
  2⤵
  PID:3792
- C:\Windows\System\usiscCQ.exe
  C:\Windows\System\usiscCQ.exe
  2⤵
  PID:3128
- C:\Windows\System\NJvSkJQ.exe
  C:\Windows\System\NJvSkJQ.exe
  2⤵
  PID:3888
- C:\Windows\System\kyZKBya.exe
  C:\Windows\System\kyZKBya.exe
  2⤵
  PID:3952
- C:\Windows\System\YxoIRaD.exe
  C:\Windows\System\YxoIRaD.exe
  2⤵
  PID:3132
- C:\Windows\System\KnGeJSz.exe
  C:\Windows\System\KnGeJSz.exe
  2⤵
  PID:4016
- C:\Windows\System\wBlMGdw.exe
  C:\Windows\System\wBlMGdw.exe
  2⤵
  PID:4080
- C:\Windows\System\qrInrPc.exe
  C:\Windows\System\qrInrPc.exe
  2⤵
  PID:3064
- C:\Windows\System\fkVpIFh.exe
  C:\Windows\System\fkVpIFh.exe
  2⤵
  PID:3336
- C:\Windows\System\DAQjRex.exe
  C:\Windows\System\DAQjRex.exe
  2⤵
  PID:3356
- C:\Windows\System\mQyhTGg.exe
  C:\Windows\System\mQyhTGg.exe
  2⤵
  PID:3180
- C:\Windows\System\kZajvnY.exe
  C:\Windows\System\kZajvnY.exe
  2⤵
  PID:2924
- C:\Windows\System\eifRWYA.exe
  C:\Windows\System\eifRWYA.exe
  2⤵
  PID:3744
- C:\Windows\System\uNUKeih.exe
  C:\Windows\System\uNUKeih.exe
  2⤵
  PID:3612
- C:\Windows\System\LHUulLa.exe
  C:\Windows\System\LHUulLa.exe
  2⤵
  PID:3244
- C:\Windows\System\sIsjWRs.exe
  C:\Windows\System\sIsjWRs.exe
  2⤵
  PID:3712
- C:\Windows\System\MwWMtQj.exe
  C:\Windows\System\MwWMtQj.exe
  2⤵
  PID:3532
- C:\Windows\System\vTOwVCU.exe
  C:\Windows\System\vTOwVCU.exe
  2⤵
  PID:3932
- C:\Windows\System\WAWvNew.exe
  C:\Windows\System\WAWvNew.exe
  2⤵
  PID:3596
- C:\Windows\System\VfofYFW.exe
  C:\Windows\System\VfofYFW.exe
  2⤵
  PID:3856
- C:\Windows\System\AoelgQo.exe
  C:\Windows\System\AoelgQo.exe
  2⤵
  PID:3224
- C:\Windows\System\JIWIYuh.exe
  C:\Windows\System\JIWIYuh.exe
  2⤵
  PID:3288
- C:\Windows\System\ohLYevC.exe
  C:\Windows\System\ohLYevC.exe
  2⤵
  PID:3420
- C:\Windows\System\zNymysw.exe
  C:\Windows\System\zNymysw.exe
  2⤵
  PID:4104
- C:\Windows\System\FitNvkW.exe
  C:\Windows\System\FitNvkW.exe
  2⤵
  PID:4120
- C:\Windows\System\ODQRCDN.exe
  C:\Windows\System\ODQRCDN.exe
  2⤵
  PID:4136
- C:\Windows\System\AMRkIQC.exe
  C:\Windows\System\AMRkIQC.exe
  2⤵
  PID:4152
- C:\Windows\System\xfebOEG.exe
  C:\Windows\System\xfebOEG.exe
  2⤵
  PID:4168
- C:\Windows\System\VjgPVMA.exe
  C:\Windows\System\VjgPVMA.exe
  2⤵
  PID:4184
- C:\Windows\System\NdvhJUY.exe
  C:\Windows\System\NdvhJUY.exe
  2⤵
  PID:4200
- C:\Windows\System\HKQXnUp.exe
  C:\Windows\System\HKQXnUp.exe
  2⤵
  PID:4216
- C:\Windows\System\vMQCWWA.exe
  C:\Windows\System\vMQCWWA.exe
  2⤵
  PID:4232
- C:\Windows\System\tuPeWFy.exe
  C:\Windows\System\tuPeWFy.exe
  2⤵
  PID:4248
- C:\Windows\System\nXllqxk.exe
  C:\Windows\System\nXllqxk.exe
  2⤵
  PID:4264
- C:\Windows\System\svlzaHc.exe
  C:\Windows\System\svlzaHc.exe
  2⤵
  PID:4280
- C:\Windows\System\lklIqIg.exe
  C:\Windows\System\lklIqIg.exe
  2⤵
  PID:4296
- C:\Windows\System\nDmPHpe.exe
  C:\Windows\System\nDmPHpe.exe
  2⤵
  PID:4312
- C:\Windows\System\cGXghrc.exe
  C:\Windows\System\cGXghrc.exe
  2⤵
  PID:4328
- C:\Windows\System\SGKcpYr.exe
  C:\Windows\System\SGKcpYr.exe
  2⤵
  PID:4344
- C:\Windows\System\GZuqepB.exe
  C:\Windows\System\GZuqepB.exe
  2⤵
  PID:4360
- C:\Windows\System\MVAoaVS.exe
  C:\Windows\System\MVAoaVS.exe
  2⤵
  PID:4376
- C:\Windows\System\TtOpFDf.exe
  C:\Windows\System\TtOpFDf.exe
  2⤵
  PID:4392
- C:\Windows\System\iMlOjrE.exe
  C:\Windows\System\iMlOjrE.exe
  2⤵
  PID:4408
- C:\Windows\System\EoeloMX.exe
  C:\Windows\System\EoeloMX.exe
  2⤵
  PID:4424
- C:\Windows\System\bLCmBOo.exe
  C:\Windows\System\bLCmBOo.exe
  2⤵
  PID:4440
- C:\Windows\System\LpInGRa.exe
  C:\Windows\System\LpInGRa.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4456
- C:\Windows\System\SXNsIak.exe
  C:\Windows\System\SXNsIak.exe
  2⤵
  PID:4472
- C:\Windows\System\anifvPE.exe
  C:\Windows\System\anifvPE.exe
  2⤵
  PID:4488
- C:\Windows\System\LyEBqvg.exe
  C:\Windows\System\LyEBqvg.exe
  2⤵
  PID:4504
- C:\Windows\System\JAgamrq.exe
  C:\Windows\System\JAgamrq.exe
  2⤵
  PID:4520
- C:\Windows\System\mHvWmEL.exe
  C:\Windows\System\mHvWmEL.exe
  2⤵
  PID:4536
- C:\Windows\System\bIsQkyv.exe
  C:\Windows\System\bIsQkyv.exe
  2⤵
  PID:4556
- C:\Windows\System\hnatrYF.exe
  C:\Windows\System\hnatrYF.exe
  2⤵
  PID:4572
- C:\Windows\System\jEmFpYY.exe
  C:\Windows\System\jEmFpYY.exe
  2⤵
  PID:4588
- C:\Windows\System\jUlZDYW.exe
  C:\Windows\System\jUlZDYW.exe
  2⤵
  PID:4604
- C:\Windows\System\pRFevvu.exe
  C:\Windows\System\pRFevvu.exe
  2⤵
  PID:4620
- C:\Windows\System\qLiyaIY.exe
  C:\Windows\System\qLiyaIY.exe
  2⤵
  PID:4636
- C:\Windows\System\ZsUjmgE.exe
  C:\Windows\System\ZsUjmgE.exe
  2⤵
  PID:4652
- C:\Windows\System\eSsSDgk.exe
  C:\Windows\System\eSsSDgk.exe
  2⤵
  PID:4668
- C:\Windows\System\ifgstCH.exe
  C:\Windows\System\ifgstCH.exe
  2⤵
  PID:4684
- C:\Windows\System\XlIJIYh.exe
  C:\Windows\System\XlIJIYh.exe
  2⤵
  PID:4700
- C:\Windows\System\ZqvFplV.exe
  C:\Windows\System\ZqvFplV.exe
  2⤵
  PID:4716
- C:\Windows\System\qDIWOov.exe
  C:\Windows\System\qDIWOov.exe
  2⤵
  PID:4732
- C:\Windows\System\RQgGegS.exe
  C:\Windows\System\RQgGegS.exe
  2⤵
  PID:4748
- C:\Windows\System\BUowhZF.exe
  C:\Windows\System\BUowhZF.exe
  2⤵
  PID:4764
- C:\Windows\System\JLBrolI.exe
  C:\Windows\System\JLBrolI.exe
  2⤵
  PID:4780
- C:\Windows\System\fHTsXLD.exe
  C:\Windows\System\fHTsXLD.exe
  2⤵
  PID:4796
- C:\Windows\System\sSQErKT.exe
  C:\Windows\System\sSQErKT.exe
  2⤵
  PID:4812
- C:\Windows\System\yFQKEQM.exe
  C:\Windows\System\yFQKEQM.exe
  2⤵
  PID:4828
- C:\Windows\System\LkOEQHp.exe
  C:\Windows\System\LkOEQHp.exe
  2⤵
  PID:4844
- C:\Windows\System\cDSGxvg.exe
  C:\Windows\System\cDSGxvg.exe
  2⤵
  PID:4860
- C:\Windows\System\fBqpVQG.exe
  C:\Windows\System\fBqpVQG.exe
  2⤵
  PID:4876
- C:\Windows\System\YVvWGRw.exe
  C:\Windows\System\YVvWGRw.exe
  2⤵
  PID:4892
- C:\Windows\System\KbuMWGG.exe
  C:\Windows\System\KbuMWGG.exe
  2⤵
  PID:4908
- C:\Windows\System\POhlKHK.exe
  C:\Windows\System\POhlKHK.exe
  2⤵
  PID:4924
- C:\Windows\System\JzDyFRn.exe
  C:\Windows\System\JzDyFRn.exe
  2⤵
  PID:4940
- C:\Windows\System\fCUZaGF.exe
  C:\Windows\System\fCUZaGF.exe
  2⤵
  PID:4956
- C:\Windows\System\DsduvNn.exe
  C:\Windows\System\DsduvNn.exe
  2⤵
  PID:4972
- C:\Windows\System\EkhlsJW.exe
  C:\Windows\System\EkhlsJW.exe
  2⤵
  PID:4988
- C:\Windows\System\dhwqeFc.exe
  C:\Windows\System\dhwqeFc.exe
  2⤵
  PID:5004
- C:\Windows\System\sjzLjXx.exe
  C:\Windows\System\sjzLjXx.exe
  2⤵
  PID:5020
- C:\Windows\System\HkxQVrh.exe
  C:\Windows\System\HkxQVrh.exe
  2⤵
  PID:5036
- C:\Windows\System\BRqDLCu.exe
  C:\Windows\System\BRqDLCu.exe
  2⤵
  PID:5052
- C:\Windows\System\xvNImdz.exe
  C:\Windows\System\xvNImdz.exe
  2⤵
  PID:5068
- C:\Windows\System\hnxOiWH.exe
  C:\Windows\System\hnxOiWH.exe
  2⤵
  PID:5084
- C:\Windows\System\PRQxvbI.exe
  C:\Windows\System\PRQxvbI.exe
  2⤵
  PID:5100
- C:\Windows\System\MnIyASK.exe
  C:\Windows\System\MnIyASK.exe
  2⤵
  PID:5116
- C:\Windows\System\VvDouZV.exe
  C:\Windows\System\VvDouZV.exe
  2⤵
  PID:3112
- C:\Windows\System\jWJMZUC.exe
  C:\Windows\System\jWJMZUC.exe
  2⤵
  PID:3724
- C:\Windows\System\YuhlESz.exe
  C:\Windows\System\YuhlESz.exe
  2⤵
  PID:3372
- C:\Windows\System\LIufHlY.exe
  C:\Windows\System\LIufHlY.exe
  2⤵
  PID:4160
- C:\Windows\System\PMvJelv.exe
  C:\Windows\System\PMvJelv.exe
  2⤵
  PID:4224
- C:\Windows\System\zhWwmty.exe
  C:\Windows\System\zhWwmty.exe
  2⤵
  PID:4288
- C:\Windows\System\BZntPkw.exe
  C:\Windows\System\BZntPkw.exe
  2⤵
  PID:4032
- C:\Windows\System\yLyaiCl.exe
  C:\Windows\System\yLyaiCl.exe
  2⤵
  PID:2336
- C:\Windows\System\AVbXTeh.exe
  C:\Windows\System\AVbXTeh.exe
  2⤵
  PID:4048
- C:\Windows\System\xgZXXnL.exe
  C:\Windows\System\xgZXXnL.exe
  2⤵
  PID:4240
- C:\Windows\System\kvzppun.exe
  C:\Windows\System\kvzppun.exe
  2⤵
  PID:4308
- C:\Windows\System\qZkqtAc.exe
  C:\Windows\System\qZkqtAc.exe
  2⤵
  PID:3580
- C:\Windows\System\hFJFqiP.exe
  C:\Windows\System\hFJFqiP.exe
  2⤵
  PID:4144
- C:\Windows\System\hDuskoU.exe
  C:\Windows\System\hDuskoU.exe
  2⤵
  PID:4208
- C:\Windows\System\eddWTCq.exe
  C:\Windows\System\eddWTCq.exe
  2⤵
  PID:4324
- C:\Windows\System\sSpPUpI.exe
  C:\Windows\System\sSpPUpI.exe
  2⤵
  PID:4352
- C:\Windows\System\ZWmgzRn.exe
  C:\Windows\System\ZWmgzRn.exe
  2⤵
  PID:4388
- C:\Windows\System\GuMPSWg.exe
  C:\Windows\System\GuMPSWg.exe
  2⤵
  PID:4404
- C:\Windows\System\GkwNrQa.exe
  C:\Windows\System\GkwNrQa.exe
  2⤵
  PID:4468
- C:\Windows\System\VCCJgiU.exe
  C:\Windows\System\VCCJgiU.exe
  2⤵
  PID:4452
- C:\Windows\System\YuGOWyO.exe
  C:\Windows\System\YuGOWyO.exe
  2⤵
  PID:4480
- C:\Windows\System\iEBCcPZ.exe
  C:\Windows\System\iEBCcPZ.exe
  2⤵
  PID:4532
- C:\Windows\System\nHwQrQh.exe
  C:\Windows\System\nHwQrQh.exe
  2⤵
  PID:4632
- C:\Windows\System\jEuljQm.exe
  C:\Windows\System\jEuljQm.exe
  2⤵
  PID:4664
- C:\Windows\System\YcPQHQK.exe
  C:\Windows\System\YcPQHQK.exe
  2⤵
  PID:4584
- C:\Windows\System\OwAlgaG.exe
  C:\Windows\System\OwAlgaG.exe
  2⤵
  PID:4616
- C:\Windows\System\IGBPCXG.exe
  C:\Windows\System\IGBPCXG.exe
  2⤵
  PID:4680
- C:\Windows\System\gbrmsFW.exe
  C:\Windows\System\gbrmsFW.exe
  2⤵
  PID:4744
- C:\Windows\System\thuYIrD.exe
  C:\Windows\System\thuYIrD.exe
  2⤵
  PID:4808
- C:\Windows\System\CtWwpOl.exe
  C:\Windows\System\CtWwpOl.exe
  2⤵
  PID:4868
- C:\Windows\System\OydFLGW.exe
  C:\Windows\System\OydFLGW.exe
  2⤵
  PID:4932
- C:\Windows\System\xHVrclK.exe
  C:\Windows\System\xHVrclK.exe
  2⤵
  PID:4996
- C:\Windows\System\kZlMnTO.exe
  C:\Windows\System\kZlMnTO.exe
  2⤵
  PID:4756
- C:\Windows\System\QbrgSmf.exe
  C:\Windows\System\QbrgSmf.exe
  2⤵
  PID:4760
- C:\Windows\System\GXuldEZ.exe
  C:\Windows\System\GXuldEZ.exe
  2⤵
  PID:4884
- C:\Windows\System\yzjQkKZ.exe
  C:\Windows\System\yzjQkKZ.exe
  2⤵
  PID:4948
- C:\Windows\System\fTCSJSN.exe
  C:\Windows\System\fTCSJSN.exe
  2⤵
  PID:4980
- C:\Windows\System\gtaXXbD.exe
  C:\Windows\System\gtaXXbD.exe
  2⤵
  PID:2916
- C:\Windows\System\opGJAtC.exe
  C:\Windows\System\opGJAtC.exe
  2⤵
  PID:5108
- C:\Windows\System\MBuveLI.exe
  C:\Windows\System\MBuveLI.exe
  2⤵
  PID:5112
- C:\Windows\System\BkgyclR.exe
  C:\Windows\System\BkgyclR.exe
  2⤵
  PID:3984
- C:\Windows\System\IlhbaTr.exe
  C:\Windows\System\IlhbaTr.exe
  2⤵
  PID:3632
- C:\Windows\System\nNenmNn.exe
  C:\Windows\System\nNenmNn.exe
  2⤵
  PID:4256
- C:\Windows\System\oUusecz.exe
  C:\Windows\System\oUusecz.exe
  2⤵
  PID:4260
- C:\Windows\System\xVqdqGt.exe
  C:\Windows\System\xVqdqGt.exe
  2⤵
  PID:4272
- C:\Windows\System\ItlSeow.exe
  C:\Windows\System\ItlSeow.exe
  2⤵
  PID:4244
- C:\Windows\System\xDJJITJ.exe
  C:\Windows\System\xDJJITJ.exe
  2⤵
  PID:4436
- C:\Windows\System\nZwZPbg.exe
  C:\Windows\System\nZwZPbg.exe
  2⤵
  PID:4596
- C:\Windows\System\FHUwNen.exe
  C:\Windows\System\FHUwNen.exe
  2⤵
  PID:4648
- C:\Windows\System\iHnJMpN.exe
  C:\Windows\System\iHnJMpN.exe
  2⤵
  PID:4900
- C:\Windows\System\cyoSVYy.exe
  C:\Windows\System\cyoSVYy.exe
  2⤵
  PID:5028
- C:\Windows\System\DFjwVbh.exe
  C:\Windows\System\DFjwVbh.exe
  2⤵
  PID:5012
- C:\Windows\System\ZDLFSTy.exe
  C:\Windows\System\ZDLFSTy.exe
  2⤵
  PID:3660
- C:\Windows\System\kFOtkOu.exe
  C:\Windows\System\kFOtkOu.exe
  2⤵
  PID:4420
- C:\Windows\System\eSdMgMv.exe
  C:\Windows\System\eSdMgMv.exe
  2⤵
  PID:3292
- C:\Windows\System\SEzUprt.exe
  C:\Windows\System\SEzUprt.exe
  2⤵
  PID:4696
- C:\Windows\System\TKlOvjm.exe
  C:\Windows\System\TKlOvjm.exe
  2⤵
  PID:3552
- C:\Windows\System\JYHpJxY.exe
  C:\Windows\System\JYHpJxY.exe
  2⤵
  PID:4852
- C:\Windows\System\gswIoCV.exe
  C:\Windows\System\gswIoCV.exe
  2⤵
  PID:5132
- C:\Windows\System\qImkFCK.exe
  C:\Windows\System\qImkFCK.exe
  2⤵
  PID:5148
- C:\Windows\System\MFlrJgS.exe
  C:\Windows\System\MFlrJgS.exe
  2⤵
  PID:5164
- C:\Windows\System\ueVYVJF.exe
  C:\Windows\System\ueVYVJF.exe
  2⤵
  PID:5180
- C:\Windows\System\zLFkDfw.exe
  C:\Windows\System\zLFkDfw.exe
  2⤵
  PID:5196
- C:\Windows\System\QVPgUWp.exe
  C:\Windows\System\QVPgUWp.exe
  2⤵
  PID:5212
- C:\Windows\System\upqyRUR.exe
  C:\Windows\System\upqyRUR.exe
  2⤵
  PID:5228
- C:\Windows\System\TLXCjjf.exe
  C:\Windows\System\TLXCjjf.exe
  2⤵
  PID:5244
- C:\Windows\System\FILtlrR.exe
  C:\Windows\System\FILtlrR.exe
  2⤵
  PID:5260
- C:\Windows\System\ATOUuBn.exe
  C:\Windows\System\ATOUuBn.exe
  2⤵
  PID:5276
- C:\Windows\System\DLIdLyK.exe
  C:\Windows\System\DLIdLyK.exe
  2⤵
  PID:5292
- C:\Windows\System\KWKGkDD.exe
  C:\Windows\System\KWKGkDD.exe
  2⤵
  PID:5308
- C:\Windows\System\WvlbCEd.exe
  C:\Windows\System\WvlbCEd.exe
  2⤵
  PID:5324
- C:\Windows\System\ZdNKuCE.exe
  C:\Windows\System\ZdNKuCE.exe
  2⤵
  PID:5340
- C:\Windows\System\xhLxaLu.exe
  C:\Windows\System\xhLxaLu.exe
  2⤵
  PID:5356
- C:\Windows\System\zgRHYAt.exe
  C:\Windows\System\zgRHYAt.exe
  2⤵
  PID:5372
- C:\Windows\System\oELcGyi.exe
  C:\Windows\System\oELcGyi.exe
  2⤵
  PID:5388
- C:\Windows\System\tsvnsdF.exe
  C:\Windows\System\tsvnsdF.exe
  2⤵
  PID:5404
- C:\Windows\System\wwFlqnf.exe
  C:\Windows\System\wwFlqnf.exe
  2⤵
  PID:5420
- C:\Windows\System\XLIivIG.exe
  C:\Windows\System\XLIivIG.exe
  2⤵
  PID:5436
- C:\Windows\System\tJKtwQs.exe
  C:\Windows\System\tJKtwQs.exe
  2⤵
  PID:5452
- C:\Windows\System\aCiKUkX.exe
  C:\Windows\System\aCiKUkX.exe
  2⤵
  PID:5468
- C:\Windows\System\ZlLLWub.exe
  C:\Windows\System\ZlLLWub.exe
  2⤵
  PID:5484
- C:\Windows\System\BlqKWkX.exe
  C:\Windows\System\BlqKWkX.exe
  2⤵
  PID:5500
- C:\Windows\System\ErbBnWH.exe
  C:\Windows\System\ErbBnWH.exe
  2⤵
  PID:5516
- C:\Windows\System\ReGbVUN.exe
  C:\Windows\System\ReGbVUN.exe
  2⤵
  PID:5532
- C:\Windows\System\nBOiTvS.exe
  C:\Windows\System\nBOiTvS.exe
  2⤵
  PID:5548
- C:\Windows\System\RJdThJJ.exe
  C:\Windows\System\RJdThJJ.exe
  2⤵
  PID:5564
- C:\Windows\System\ZsoYNrN.exe
  C:\Windows\System\ZsoYNrN.exe
  2⤵
  PID:5580
- C:\Windows\System\FZRPZrb.exe
  C:\Windows\System\FZRPZrb.exe
  2⤵
  PID:5596
- C:\Windows\System\iJUWKuO.exe
  C:\Windows\System\iJUWKuO.exe
  2⤵
  PID:5612
- C:\Windows\System\qsMMahu.exe
  C:\Windows\System\qsMMahu.exe
  2⤵
  PID:5628
- C:\Windows\System\PliUbtd.exe
  C:\Windows\System\PliUbtd.exe
  2⤵
  PID:5644
- C:\Windows\System\YIHdqIW.exe
  C:\Windows\System\YIHdqIW.exe
  2⤵
  PID:5660
- C:\Windows\System\tfQjslY.exe
  C:\Windows\System\tfQjslY.exe
  2⤵
  PID:5676
- C:\Windows\System\jceEeiB.exe
  C:\Windows\System\jceEeiB.exe
  2⤵
  PID:5696
- C:\Windows\System\nlwnsEY.exe
  C:\Windows\System\nlwnsEY.exe
  2⤵
  PID:5716
- C:\Windows\System\rnGSUcY.exe
  C:\Windows\System\rnGSUcY.exe
  2⤵
  PID:5732
- C:\Windows\System\UtLuQhu.exe
  C:\Windows\System\UtLuQhu.exe
  2⤵
  PID:5748
- C:\Windows\System\dWkWmra.exe
  C:\Windows\System\dWkWmra.exe
  2⤵
  PID:5764
- C:\Windows\System\YZYvfOE.exe
  C:\Windows\System\YZYvfOE.exe
  2⤵
  PID:5784
- C:\Windows\System\InElZsO.exe
  C:\Windows\System\InElZsO.exe
  2⤵
  PID:5800
- C:\Windows\System\SIKAKLk.exe
  C:\Windows\System\SIKAKLk.exe
  2⤵
  PID:5816
- C:\Windows\System\BkIFNIr.exe
  C:\Windows\System\BkIFNIr.exe
  2⤵
  PID:5832
- C:\Windows\System\MqINORT.exe
  C:\Windows\System\MqINORT.exe
  2⤵
  PID:5848
- C:\Windows\System\TCeZbox.exe
  C:\Windows\System\TCeZbox.exe
  2⤵
  PID:5864
- C:\Windows\System\OIcyJTv.exe
  C:\Windows\System\OIcyJTv.exe
  2⤵
  PID:5880
- C:\Windows\System\BoFLsky.exe
  C:\Windows\System\BoFLsky.exe
  2⤵
  PID:5896
- C:\Windows\System\WvJjaHN.exe
  C:\Windows\System\WvJjaHN.exe
  2⤵
  PID:5912
- C:\Windows\System\ehQrIkp.exe
  C:\Windows\System\ehQrIkp.exe
  2⤵
  PID:5928
- C:\Windows\System\NUfdgJo.exe
  C:\Windows\System\NUfdgJo.exe
  2⤵
  PID:5948
- C:\Windows\System\GEvVyJv.exe
  C:\Windows\System\GEvVyJv.exe
  2⤵
  PID:6084
- C:\Windows\System\ekYDnHC.exe
  C:\Windows\System\ekYDnHC.exe
  2⤵
  PID:6100
- C:\Windows\System\jiPpTEo.exe
  C:\Windows\System\jiPpTEo.exe
  2⤵
  PID:6116
- C:\Windows\System\CdQbTHb.exe
  C:\Windows\System\CdQbTHb.exe
  2⤵
  PID:6132
- C:\Windows\System\XDjjawL.exe
  C:\Windows\System\XDjjawL.exe
  2⤵
  PID:5128
- C:\Windows\System\jVFhWnV.exe
  C:\Windows\System\jVFhWnV.exe
  2⤵
  PID:4548
- C:\Windows\System\watVsvl.exe
  C:\Windows\System\watVsvl.exe
  2⤵
  PID:4340
- C:\Windows\System\OpuCkUC.exe
  C:\Windows\System\OpuCkUC.exe
  2⤵
  PID:4132
- C:\Windows\System\JQkrswN.exe
  C:\Windows\System\JQkrswN.exe
  2⤵
  PID:5192
- C:\Windows\System\LpglROs.exe
  C:\Windows\System\LpglROs.exe
  2⤵
  PID:5252
- C:\Windows\System\QZKQYgn.exe
  C:\Windows\System\QZKQYgn.exe
  2⤵
  PID:5288
- C:\Windows\System\BbPuHGQ.exe
  C:\Windows\System\BbPuHGQ.exe
  2⤵
  PID:5352
- C:\Windows\System\VHKuosE.exe
  C:\Windows\System\VHKuosE.exe
  2⤵
  PID:4712
- C:\Windows\System\dgYaNbb.exe
  C:\Windows\System\dgYaNbb.exe
  2⤵
  PID:4836
- C:\Windows\System\JwRBnaL.exe
  C:\Windows\System\JwRBnaL.exe
  2⤵
  PID:5412
- C:\Windows\System\hMTljYp.exe
  C:\Windows\System\hMTljYp.exe
  2⤵
  PID:5448
- C:\Windows\System\rgiWPqu.exe
  C:\Windows\System\rgiWPqu.exe
  2⤵
  PID:5512
- C:\Windows\System\ljmyrWu.exe
  C:\Windows\System\ljmyrWu.exe
  2⤵
  PID:4196
- C:\Windows\System\UyynPIT.exe
  C:\Windows\System\UyynPIT.exe
  2⤵
  PID:4516
- C:\Windows\System\AfGkdtM.exe
  C:\Windows\System\AfGkdtM.exe
  2⤵
  PID:4728
- C:\Windows\System\ZnJTpOl.exe
  C:\Windows\System\ZnJTpOl.exe
  2⤵
  PID:3304
- C:\Windows\System\XpSdYJS.exe
  C:\Windows\System\XpSdYJS.exe
  2⤵
  PID:5176
- C:\Windows\System\HPpNRRr.exe
  C:\Windows\System\HPpNRRr.exe
  2⤵
  PID:5240
- C:\Windows\System\ZXkjLCV.exe
  C:\Windows\System\ZXkjLCV.exe
  2⤵
  PID:5332
- C:\Windows\System\BjTotrv.exe
  C:\Windows\System\BjTotrv.exe
  2⤵
  PID:5396
- C:\Windows\System\eznMsHU.exe
  C:\Windows\System\eznMsHU.exe
  2⤵
  PID:5460
- C:\Windows\System\DGGKtkC.exe
  C:\Windows\System\DGGKtkC.exe
  2⤵
  PID:5528
- C:\Windows\System\qRowTyl.exe
  C:\Windows\System\qRowTyl.exe
  2⤵
  PID:5592
- C:\Windows\System\DBFpZmd.exe
  C:\Windows\System\DBFpZmd.exe
  2⤵
  PID:5604
- C:\Windows\System\ZMctBnT.exe
  C:\Windows\System\ZMctBnT.exe
  2⤵
  PID:5640
- C:\Windows\System\vAVoHCD.exe
  C:\Windows\System\vAVoHCD.exe
  2⤵
  PID:5684
- C:\Windows\System\UhDIbIN.exe
  C:\Windows\System\UhDIbIN.exe
  2⤵
  PID:5668
- C:\Windows\System\VSSMcLb.exe
  C:\Windows\System\VSSMcLb.exe
  2⤵
  PID:5712
- C:\Windows\System\nOqLiVk.exe
  C:\Windows\System\nOqLiVk.exe
  2⤵
  PID:5724
- C:\Windows\System\MhgCQYq.exe
  C:\Windows\System\MhgCQYq.exe
  2⤵
  PID:5776
- C:\Windows\System\BRefzVX.exe
  C:\Windows\System\BRefzVX.exe
  2⤵
  PID:5840
- C:\Windows\System\jiPLPBU.exe
  C:\Windows\System\jiPLPBU.exe
  2⤵
  PID:5904
- C:\Windows\System\rqsOOWg.exe
  C:\Windows\System\rqsOOWg.exe
  2⤵
  PID:5824
- C:\Windows\System\cUQcOBs.exe
  C:\Windows\System\cUQcOBs.exe
  2⤵
  PID:5860
- C:\Windows\System\PtpIdgD.exe
  C:\Windows\System\PtpIdgD.exe
  2⤵
  PID:5936
- C:\Windows\System\wKDoAdP.exe
  C:\Windows\System\wKDoAdP.exe
  2⤵
  PID:5960
- C:\Windows\System\KqymWaz.exe
  C:\Windows\System\KqymWaz.exe
  2⤵
  PID:5976
- C:\Windows\System\fUUZaBa.exe
  C:\Windows\System\fUUZaBa.exe
  2⤵
  PID:5992
- C:\Windows\System\wijJCjt.exe
  C:\Windows\System\wijJCjt.exe
  2⤵
  PID:6008
- C:\Windows\System\NWOWZLX.exe
  C:\Windows\System\NWOWZLX.exe
  2⤵
  PID:6020
- C:\Windows\System\WeVVjUT.exe
  C:\Windows\System\WeVVjUT.exe
  2⤵
  PID:6040
- C:\Windows\System\LvlTcEE.exe
  C:\Windows\System\LvlTcEE.exe
  2⤵
  PID:6056
- C:\Windows\System\TrgEdFh.exe
  C:\Windows\System\TrgEdFh.exe
  2⤵
  PID:6072
- C:\Windows\System\RGEYAYb.exe
  C:\Windows\System\RGEYAYb.exe
  2⤵
  PID:6128
- C:\Windows\System\KyOwaKY.exe
  C:\Windows\System\KyOwaKY.exe
  2⤵
  PID:6076
- C:\Windows\System\JOgxaxx.exe
  C:\Windows\System\JOgxaxx.exe
  2⤵
  PID:6108
- C:\Windows\System\bctJsQs.exe
  C:\Windows\System\bctJsQs.exe
  2⤵
  PID:5320
- C:\Windows\System\BiblvsD.exe
  C:\Windows\System\BiblvsD.exe
  2⤵
  PID:4176
- C:\Windows\System\WWcuPxf.exe
  C:\Windows\System\WWcuPxf.exe
  2⤵
  PID:5188
- C:\Windows\System\UQpkSuV.exe
  C:\Windows\System\UQpkSuV.exe
  2⤵
  PID:4916
- C:\Windows\System\LruoXzw.exe
  C:\Windows\System\LruoXzw.exe
  2⤵
  PID:4804
- C:\Windows\System\SSgjoTP.exe
  C:\Windows\System\SSgjoTP.exe
  2⤵
  PID:5480
- C:\Windows\System\jtSzcQW.exe
  C:\Windows\System\jtSzcQW.exe
  2⤵
  PID:4384
- C:\Windows\System\qznUTjM.exe
  C:\Windows\System\qznUTjM.exe
  2⤵
  PID:5304
- C:\Windows\System\LrCLTPM.exe
  C:\Windows\System\LrCLTPM.exe
  2⤵
  PID:5208
- C:\Windows\System\VcJPNxS.exe
  C:\Windows\System\VcJPNxS.exe
  2⤵
  PID:5364
- C:\Windows\System\FVUnQPK.exe
  C:\Windows\System\FVUnQPK.exe
  2⤵
  PID:5524
- C:\Windows\System\HlptMNf.exe
  C:\Windows\System\HlptMNf.exe
  2⤵
  PID:4512
- C:\Windows\System\uyHfjsM.exe
  C:\Windows\System\uyHfjsM.exe
  2⤵
  PID:5756
- C:\Windows\System\cvOyEUd.exe
  C:\Windows\System\cvOyEUd.exe
  2⤵
  PID:5792
- C:\Windows\System\AiGBrmY.exe
  C:\Windows\System\AiGBrmY.exe
  2⤵
  PID:5576
- C:\Windows\System\cvsutju.exe
  C:\Windows\System\cvsutju.exe
  2⤵
  PID:5624
- C:\Windows\System\kuhznQP.exe
  C:\Windows\System\kuhznQP.exe
  2⤵
  PID:5972
- C:\Windows\System\FVKrcfG.exe
  C:\Windows\System\FVKrcfG.exe
  2⤵
  PID:6004
- C:\Windows\System\dMyoGwI.exe
  C:\Windows\System\dMyoGwI.exe
  2⤵
  PID:6068
- C:\Windows\System\MkRFPTq.exe
  C:\Windows\System\MkRFPTq.exe
  2⤵
  PID:5224
- C:\Windows\System\yxNdaxc.exe
  C:\Windows\System\yxNdaxc.exe
  2⤵
  PID:5876
- C:\Windows\System\SfMcirs.exe
  C:\Windows\System\SfMcirs.exe
  2⤵
  PID:4964
- C:\Windows\System\ySiNnZK.exe
  C:\Windows\System\ySiNnZK.exe
  2⤵
  PID:5856
- C:\Windows\System\uEvFpOd.exe
  C:\Windows\System\uEvFpOd.exe
  2⤵
  PID:5956
- C:\Windows\System\nUiDpwZ.exe
  C:\Windows\System\nUiDpwZ.exe
  2⤵
  PID:5496
- C:\Windows\System\WEQlWSS.exe
  C:\Windows\System\WEQlWSS.exe
  2⤵
  PID:5572
- C:\Windows\System\mECLHBp.exe
  C:\Windows\System\mECLHBp.exe
  2⤵
  PID:6028
- C:\Windows\System\eOfwFJZ.exe
  C:\Windows\System\eOfwFJZ.exe
  2⤵
  PID:6036
- C:\Windows\System\RNRiuyV.exe
  C:\Windows\System\RNRiuyV.exe
  2⤵
  PID:5380
- C:\Windows\System\wdosKMi.exe
  C:\Windows\System\wdosKMi.exe
  2⤵
  PID:5444
- C:\Windows\System\appmauM.exe
  C:\Windows\System\appmauM.exe
  2⤵
  PID:6096
- C:\Windows\System\QLjTcrw.exe
  C:\Windows\System\QLjTcrw.exe
  2⤵
  PID:5796
- C:\Windows\System\ewXEora.exe
  C:\Windows\System\ewXEora.exe
  2⤵
  PID:5428
- C:\Windows\System\pUSmXFc.exe
  C:\Windows\System\pUSmXFc.exe
  2⤵
  PID:5432
- C:\Windows\System\cPHHkOq.exe
  C:\Windows\System\cPHHkOq.exe
  2⤵
  PID:5300
- C:\Windows\System\QZPjocM.exe
  C:\Windows\System\QZPjocM.exe
  2⤵
  PID:5692
- C:\Windows\System\tlTkoCq.exe
  C:\Windows\System\tlTkoCq.exe
  2⤵
  PID:5156
- C:\Windows\System\MHSTYIv.exe
  C:\Windows\System\MHSTYIv.exe
  2⤵
  PID:5076
- C:\Windows\System\gMMvzCb.exe
  C:\Windows\System\gMMvzCb.exe
  2⤵
  PID:6052
- C:\Windows\System\uCTnVQP.exe
  C:\Windows\System\uCTnVQP.exe
  2⤵
  PID:4628
- C:\Windows\System\jgnzLCs.exe
  C:\Windows\System\jgnzLCs.exe
  2⤵
  PID:6016
- C:\Windows\System\hUAtfXO.exe
  C:\Windows\System\hUAtfXO.exe
  2⤵
  PID:6160
- C:\Windows\System\SjBaHJs.exe
  C:\Windows\System\SjBaHJs.exe
  2⤵
  PID:6264
- C:\Windows\System\SLeSiye.exe
  C:\Windows\System\SLeSiye.exe
  2⤵
  PID:6368
- C:\Windows\System\HTBhsww.exe
  C:\Windows\System\HTBhsww.exe
  2⤵
  PID:6384
- C:\Windows\System\nomjryn.exe
  C:\Windows\System\nomjryn.exe
  2⤵
  PID:6404
- C:\Windows\System\nBVAETI.exe
  C:\Windows\System\nBVAETI.exe
  2⤵
  PID:6420
- C:\Windows\System\mInLtaM.exe
  C:\Windows\System\mInLtaM.exe
  2⤵
  PID:6436
- C:\Windows\System\gwdDudm.exe
  C:\Windows\System\gwdDudm.exe
  2⤵
  PID:6452
- C:\Windows\System\bAEvvFh.exe
  C:\Windows\System\bAEvvFh.exe
  2⤵
  PID:6468
- C:\Windows\System\mkOruAE.exe
  C:\Windows\System\mkOruAE.exe
  2⤵
  PID:6484
- C:\Windows\System\MrjAPPP.exe
  C:\Windows\System\MrjAPPP.exe
  2⤵
  PID:6500
- C:\Windows\System\uHnBHhp.exe
  C:\Windows\System\uHnBHhp.exe
  2⤵
  PID:6516
- C:\Windows\System\ryJOavm.exe
  C:\Windows\System\ryJOavm.exe
  2⤵
  PID:6532
- C:\Windows\System\wlUXcsF.exe
  C:\Windows\System\wlUXcsF.exe
  2⤵
  PID:6548
- C:\Windows\System\BclEwrl.exe
  C:\Windows\System\BclEwrl.exe
  2⤵
  PID:6564
- C:\Windows\System\eKvEdZw.exe
  C:\Windows\System\eKvEdZw.exe
  2⤵
  PID:6580
- C:\Windows\System\BdMCzNh.exe
  C:\Windows\System\BdMCzNh.exe
  2⤵
  PID:6596
- C:\Windows\System\dMJEFpV.exe
  C:\Windows\System\dMJEFpV.exe
  2⤵
  PID:6612
- C:\Windows\System\rQHcOXu.exe
  C:\Windows\System\rQHcOXu.exe
  2⤵
  PID:6628
- C:\Windows\System\PVDweOg.exe
  C:\Windows\System\PVDweOg.exe
  2⤵
  PID:6644
- C:\Windows\System\WnLZFHJ.exe
  C:\Windows\System\WnLZFHJ.exe
  2⤵
  PID:6660
- C:\Windows\System\gNbfkzV.exe
  C:\Windows\System\gNbfkzV.exe
  2⤵
  PID:6676
- C:\Windows\System\zlTlhzm.exe
  C:\Windows\System\zlTlhzm.exe
  2⤵
  PID:6692
- C:\Windows\System\HbloCpC.exe
  C:\Windows\System\HbloCpC.exe
  2⤵
  PID:6708
- C:\Windows\System\mMRkXlR.exe
  C:\Windows\System\mMRkXlR.exe
  2⤵
  PID:6724
- C:\Windows\System\DjJipKw.exe
  C:\Windows\System\DjJipKw.exe
  2⤵
  PID:6740
- C:\Windows\System\PqduHjJ.exe
  C:\Windows\System\PqduHjJ.exe
  2⤵
  PID:6756
- C:\Windows\System\jwAuIfa.exe
  C:\Windows\System\jwAuIfa.exe
  2⤵
  PID:6772
- C:\Windows\System\jdlHWPK.exe
  C:\Windows\System\jdlHWPK.exe
  2⤵
  PID:6788
- C:\Windows\System\oQTcrfS.exe
  C:\Windows\System\oQTcrfS.exe
  2⤵
  PID:6804
- C:\Windows\System\psBHVTX.exe
  C:\Windows\System\psBHVTX.exe
  2⤵
  PID:6820
- C:\Windows\System\ILhYHcN.exe
  C:\Windows\System\ILhYHcN.exe
  2⤵
  PID:6836
- C:\Windows\System\idPNrOf.exe
  C:\Windows\System\idPNrOf.exe
  2⤵
  PID:6852
- C:\Windows\System\sGYtppu.exe
  C:\Windows\System\sGYtppu.exe
  2⤵
  PID:6868
- C:\Windows\System\CmONXxv.exe
  C:\Windows\System\CmONXxv.exe
  2⤵
  PID:6884
- C:\Windows\System\KNyPVWp.exe
  C:\Windows\System\KNyPVWp.exe
  2⤵
  PID:6900
- C:\Windows\System\KpOfhBL.exe
  C:\Windows\System\KpOfhBL.exe
  2⤵
  PID:6916
- C:\Windows\System\xuOtPCU.exe
  C:\Windows\System\xuOtPCU.exe
  2⤵
  PID:6932
- C:\Windows\System\kQRvGkn.exe
  C:\Windows\System\kQRvGkn.exe
  2⤵
  PID:6948
- C:\Windows\System\uLaMRQt.exe
  C:\Windows\System\uLaMRQt.exe
  2⤵
  PID:6964
- C:\Windows\System\uMAaLJO.exe
  C:\Windows\System\uMAaLJO.exe
  2⤵
  PID:6980
- C:\Windows\System\IGQInKZ.exe
  C:\Windows\System\IGQInKZ.exe
  2⤵
  PID:6996
- C:\Windows\System\KMpsTqg.exe
  C:\Windows\System\KMpsTqg.exe
  2⤵
  PID:7012
- C:\Windows\System\kGGbseq.exe
  C:\Windows\System\kGGbseq.exe
  2⤵
  PID:7028
- C:\Windows\System\rJZrzvV.exe
  C:\Windows\System\rJZrzvV.exe
  2⤵
  PID:7044
- C:\Windows\System\XsovQeF.exe
  C:\Windows\System\XsovQeF.exe
  2⤵
  PID:7060
- C:\Windows\System\gEYyZRp.exe
  C:\Windows\System\gEYyZRp.exe
  2⤵
  PID:7076
- C:\Windows\System\xsbkYGl.exe
  C:\Windows\System\xsbkYGl.exe
  2⤵
  PID:7092
- C:\Windows\System\GuhGdUE.exe
  C:\Windows\System\GuhGdUE.exe
  2⤵
  PID:7108
- C:\Windows\System\vvcOwJW.exe
  C:\Windows\System\vvcOwJW.exe
  2⤵
  PID:7124
- C:\Windows\System\dhZOXsQ.exe
  C:\Windows\System\dhZOXsQ.exe
  2⤵
  PID:7140
- C:\Windows\System\yneVpBP.exe
  C:\Windows\System\yneVpBP.exe
  2⤵
  PID:7156
- C:\Windows\System\GfAzgQZ.exe
  C:\Windows\System\GfAzgQZ.exe
  2⤵
  PID:5920
- C:\Windows\System\gAwRuBQ.exe
  C:\Windows\System\gAwRuBQ.exe
  2⤵
  PID:5160
- C:\Windows\System\MMdPOsI.exe
  C:\Windows\System\MMdPOsI.exe
  2⤵
  PID:5236
- C:\Windows\System\gBCPlHI.exe
  C:\Windows\System\gBCPlHI.exe
  2⤵
  PID:6156
- C:\Windows\System\zuxziLl.exe
  C:\Windows\System\zuxziLl.exe
  2⤵
  PID:6180
- C:\Windows\System\SQkErLp.exe
  C:\Windows\System\SQkErLp.exe
  2⤵
  PID:6196
- C:\Windows\System\UoldEXT.exe
  C:\Windows\System\UoldEXT.exe
  2⤵
  PID:6212
- C:\Windows\System\EYZYtlg.exe
  C:\Windows\System\EYZYtlg.exe
  2⤵
  PID:6228
- C:\Windows\System\zTxGkrR.exe
  C:\Windows\System\zTxGkrR.exe
  2⤵
  PID:6244
- C:\Windows\System\XnphlBr.exe
  C:\Windows\System\XnphlBr.exe
  2⤵
  PID:6260
- C:\Windows\System\NzCNktw.exe
  C:\Windows\System\NzCNktw.exe
  2⤵
  PID:6284
- C:\Windows\System\EDGuINK.exe
  C:\Windows\System\EDGuINK.exe
  2⤵
  PID:6300
- C:\Windows\System\aoyBZXH.exe
  C:\Windows\System\aoyBZXH.exe
  2⤵
  PID:6316
- C:\Windows\System\Lucwaxo.exe
  C:\Windows\System\Lucwaxo.exe
  2⤵
  PID:6332
- C:\Windows\System\kyGAlFe.exe
  C:\Windows\System\kyGAlFe.exe
  2⤵
  PID:6348
- C:\Windows\System\wXKBohw.exe
  C:\Windows\System\wXKBohw.exe
  2⤵
  PID:6416
- C:\Windows\System\WPyOFYO.exe
  C:\Windows\System\WPyOFYO.exe
  2⤵
  PID:6476
- C:\Windows\System\AqAEJbO.exe
  C:\Windows\System\AqAEJbO.exe
  2⤵
  PID:6428
- C:\Windows\System\dnDRYiN.exe
  C:\Windows\System\dnDRYiN.exe
  2⤵
  PID:6572
- C:\Windows\System\sPJhIzc.exe
  C:\Windows\System\sPJhIzc.exe
  2⤵
  PID:6604
- C:\Windows\System\MIshLCY.exe
  C:\Windows\System\MIshLCY.exe
  2⤵
  PID:6668
- C:\Windows\System\RiMRkfH.exe
  C:\Windows\System\RiMRkfH.exe
  2⤵
  PID:6732
- C:\Windows\System\XAIxJIc.exe
  C:\Windows\System\XAIxJIc.exe
  2⤵
  PID:6768
- C:\Windows\System\bbEchSc.exe
  C:\Windows\System\bbEchSc.exe
  2⤵
  PID:6360
- C:\Windows\System\GytFpnf.exe
  C:\Windows\System\GytFpnf.exe
  2⤵
  PID:6464
- C:\Windows\System\AOBeRNF.exe
  C:\Windows\System\AOBeRNF.exe
  2⤵
  PID:6832
- C:\Windows\System\zLLAgMc.exe
  C:\Windows\System\zLLAgMc.exe
  2⤵
  PID:6896
- C:\Windows\System\UiTMKom.exe
  C:\Windows\System\UiTMKom.exe
  2⤵
  PID:6960
- C:\Windows\System\UeJtmGI.exe
  C:\Windows\System\UeJtmGI.exe
  2⤵
  PID:6592
- C:\Windows\System\UVTeNst.exe
  C:\Windows\System\UVTeNst.exe
  2⤵
  PID:6656
- C:\Windows\System\BecbcBS.exe
  C:\Windows\System\BecbcBS.exe
  2⤵
  PID:7024
- C:\Windows\System\NoybWWt.exe
  C:\Windows\System\NoybWWt.exe
  2⤵
  PID:7088
- C:\Windows\System\ngDvUoC.exe
  C:\Windows\System\ngDvUoC.exe
  2⤵
  PID:6684
- C:\Windows\System\vFrWmEj.exe
  C:\Windows\System\vFrWmEj.exe
  2⤵
  PID:6748
- C:\Windows\System\ejveTbO.exe
  C:\Windows\System\ejveTbO.exe
  2⤵
  PID:6812
- C:\Windows\System\blOJmUb.exe
  C:\Windows\System\blOJmUb.exe
  2⤵
  PID:6908
- C:\Windows\System\RbzZPdc.exe
  C:\Windows\System\RbzZPdc.exe
  2⤵
  PID:7136
- C:\Windows\System\ZgvOVVp.exe
  C:\Windows\System\ZgvOVVp.exe
  2⤵
  PID:6848
- C:\Windows\System\PqAbdUa.exe
  C:\Windows\System\PqAbdUa.exe
  2⤵
  PID:6944
- C:\Windows\System\EOyDhqg.exe
  C:\Windows\System\EOyDhqg.exe
  2⤵
  PID:7068
- C:\Windows\System\UuuuOBE.exe
  C:\Windows\System\UuuuOBE.exe
  2⤵
  PID:5124
- C:\Windows\System\jySLdRj.exe
  C:\Windows\System\jySLdRj.exe
  2⤵
  PID:5772
- C:\Windows\System\AItzhpR.exe
  C:\Windows\System\AItzhpR.exe
  2⤵
  PID:3436
- C:\Windows\System\uxeSSzs.exe
  C:\Windows\System\uxeSSzs.exe
  2⤵
  PID:6224
- C:\Windows\System\NJJFAme.exe
  C:\Windows\System\NJJFAme.exe
  2⤵
  PID:6204
- C:\Windows\System\HDmvzYV.exe
  C:\Windows\System\HDmvzYV.exe
  2⤵
  PID:6324
- C:\Windows\System\zQRvuAg.exe
  C:\Windows\System\zQRvuAg.exe
  2⤵
  PID:6412
- C:\Windows\System\MORmkMr.exe
  C:\Windows\System\MORmkMr.exe
  2⤵
  PID:6364
- C:\Windows\System\ZsPRfHD.exe
  C:\Windows\System\ZsPRfHD.exe
  2⤵
  PID:6240
- C:\Windows\System\AEygjMM.exe
  C:\Windows\System\AEygjMM.exe
  2⤵
  PID:6800
- C:\Windows\System\YsYcUDk.exe
  C:\Windows\System\YsYcUDk.exe
  2⤵
  PID:6528
- C:\Windows\System\QrqZCBD.exe
  C:\Windows\System\QrqZCBD.exe
  2⤵
  PID:6460
- C:\Windows\System\RlSMhHz.exe
  C:\Windows\System\RlSMhHz.exe
  2⤵
  PID:6624
- C:\Windows\System\HErMSGG.exe
  C:\Windows\System\HErMSGG.exe
  2⤵
  PID:6636
- C:\Windows\System\uSjVukz.exe
  C:\Windows\System\uSjVukz.exe
  2⤵
  PID:6864
- C:\Windows\System\YoHUuSS.exe
  C:\Windows\System\YoHUuSS.exe
  2⤵
  PID:6720
- C:\Windows\System\YXcqRdy.exe
  C:\Windows\System\YXcqRdy.exe
  2⤵
  PID:6844
- C:\Windows\System\jMkEeQB.exe
  C:\Windows\System\jMkEeQB.exe
  2⤵
  PID:6780
- C:\Windows\System\uLOMSzl.exe
  C:\Windows\System\uLOMSzl.exe
  2⤵
  PID:7132
- C:\Windows\System\XjoKqnJ.exe
  C:\Windows\System\XjoKqnJ.exe
  2⤵
  PID:7100
- C:\Windows\System\wNKqjFs.exe
  C:\Windows\System\wNKqjFs.exe
  2⤵
  PID:7164
- C:\Windows\System\AGQJvSu.exe
  C:\Windows\System\AGQJvSu.exe
  2⤵
  PID:5744
- C:\Windows\System\raBqxis.exe
  C:\Windows\System\raBqxis.exe
  2⤵
  PID:6256
- C:\Windows\System\pTPTfnp.exe
  C:\Windows\System\pTPTfnp.exe
  2⤵
  PID:6496
- C:\Windows\System\bIMzYuU.exe
  C:\Windows\System\bIMzYuU.exe
  2⤵
  PID:6544
- C:\Windows\System\ZJVSGzI.exe
  C:\Windows\System\ZJVSGzI.exe
  2⤵
  PID:6956
- C:\Windows\System\xYAczjX.exe
  C:\Windows\System\xYAczjX.exe
  2⤵
  PID:6716
- C:\Windows\System\mZNQQcQ.exe
  C:\Windows\System\mZNQQcQ.exe
  2⤵
  PID:6940
- C:\Windows\System\sOtwIJC.exe
  C:\Windows\System\sOtwIJC.exe
  2⤵
  PID:6784
- C:\Windows\System\gUPTgrP.exe
  C:\Windows\System\gUPTgrP.exe
  2⤵
  PID:7040
- C:\Windows\System\pBpxPai.exe
  C:\Windows\System\pBpxPai.exe
  2⤵
  PID:6220
- C:\Windows\System\IRbHWlT.exe
  C:\Windows\System\IRbHWlT.exe
  2⤵
  PID:6236
- C:\Windows\System\ODdXTgP.exe
  C:\Windows\System\ODdXTgP.exe
  2⤵
  PID:6380
- C:\Windows\System\GHIFIrB.exe
  C:\Windows\System\GHIFIrB.exe
  2⤵
  PID:7020
- C:\Windows\System\FnmvtrT.exe
  C:\Windows\System\FnmvtrT.exe
  2⤵
  PID:7056
- C:\Windows\System\JavHEYL.exe
  C:\Windows\System\JavHEYL.exe
  2⤵
  PID:6912
- C:\Windows\System\YaDWuvS.exe
  C:\Windows\System\YaDWuvS.exe
  2⤵
  PID:6152
- C:\Windows\System\wNkywnf.exe
  C:\Windows\System\wNkywnf.exe
  2⤵
  PID:6892
- C:\Windows\System\YkRUtlA.exe
  C:\Windows\System\YkRUtlA.exe
  2⤵
  PID:7184
- C:\Windows\System\fsevJJA.exe
  C:\Windows\System\fsevJJA.exe
  2⤵
  PID:7200
- C:\Windows\System\YosuUjE.exe
  C:\Windows\System\YosuUjE.exe
  2⤵
  PID:7216
- C:\Windows\System\hMVuLsN.exe
  C:\Windows\System\hMVuLsN.exe
  2⤵
  PID:7232
- C:\Windows\System\zNkHyPF.exe
  C:\Windows\System\zNkHyPF.exe
  2⤵
  PID:7248
- C:\Windows\System\IxjOnvd.exe
  C:\Windows\System\IxjOnvd.exe
  2⤵
  PID:7264
- C:\Windows\System\ACzeMpE.exe
  C:\Windows\System\ACzeMpE.exe
  2⤵
  PID:7280
- C:\Windows\System\krsMxsx.exe
  C:\Windows\System\krsMxsx.exe
  2⤵
  PID:7296
- C:\Windows\System\AOcmnAy.exe
  C:\Windows\System\AOcmnAy.exe
  2⤵
  PID:7312
- C:\Windows\System\uVgbryg.exe
  C:\Windows\System\uVgbryg.exe
  2⤵
  PID:7328
- C:\Windows\System\tqyZOQn.exe
  C:\Windows\System\tqyZOQn.exe
  2⤵
  PID:7344
- C:\Windows\System\bxlFjSO.exe
  C:\Windows\System\bxlFjSO.exe
  2⤵
  PID:7360
- C:\Windows\System\VGOkfCl.exe
  C:\Windows\System\VGOkfCl.exe
  2⤵
  PID:7376
- C:\Windows\System\fppcBGr.exe
  C:\Windows\System\fppcBGr.exe
  2⤵
  PID:7392
- C:\Windows\System\RIJztvM.exe
  C:\Windows\System\RIJztvM.exe
  2⤵
  PID:7408
- C:\Windows\System\XaVWzEZ.exe
  C:\Windows\System\XaVWzEZ.exe
  2⤵
  PID:7424
- C:\Windows\System\eywUjIu.exe
  C:\Windows\System\eywUjIu.exe
  2⤵
  PID:7440
- C:\Windows\System\ydQoDqy.exe
  C:\Windows\System\ydQoDqy.exe
  2⤵
  PID:7456
- C:\Windows\System\pRgtlWu.exe
  C:\Windows\System\pRgtlWu.exe
  2⤵
  PID:7472
- C:\Windows\System\FryWAoP.exe
  C:\Windows\System\FryWAoP.exe
  2⤵
  PID:7488
- C:\Windows\System\kBZHTIN.exe
  C:\Windows\System\kBZHTIN.exe
  2⤵
  PID:7504
- C:\Windows\System\XsztEIn.exe
  C:\Windows\System\XsztEIn.exe
  2⤵
  PID:7520
- C:\Windows\System\fIPcwNo.exe
  C:\Windows\System\fIPcwNo.exe
  2⤵
  PID:7536
- C:\Windows\System\zFDbHVZ.exe
  C:\Windows\System\zFDbHVZ.exe
  2⤵
  PID:7552
- C:\Windows\System\asaKDMw.exe
  C:\Windows\System\asaKDMw.exe
  2⤵
  PID:7568
- C:\Windows\System\UGXDeNY.exe
  C:\Windows\System\UGXDeNY.exe
  2⤵
  PID:7584
- C:\Windows\System\eQtbEYl.exe
  C:\Windows\System\eQtbEYl.exe
  2⤵
  PID:7600
- C:\Windows\System\wplxQfV.exe
  C:\Windows\System\wplxQfV.exe
  2⤵
  PID:7616
- C:\Windows\System\PvpAzou.exe
  C:\Windows\System\PvpAzou.exe
  2⤵
  PID:7632
- C:\Windows\System\fcPReMv.exe
  C:\Windows\System\fcPReMv.exe
  2⤵
  PID:7648
- C:\Windows\System\fhGAmOF.exe
  C:\Windows\System\fhGAmOF.exe
  2⤵
  PID:7664
- C:\Windows\System\nUUZcIo.exe
  C:\Windows\System\nUUZcIo.exe
  2⤵
  PID:7680
- C:\Windows\System\aZktmbq.exe
  C:\Windows\System\aZktmbq.exe
  2⤵
  PID:7696
- C:\Windows\System\gYSMDGv.exe
  C:\Windows\System\gYSMDGv.exe
  2⤵
  PID:7712
- C:\Windows\System\zFSzUrH.exe
  C:\Windows\System\zFSzUrH.exe
  2⤵
  PID:7728
- C:\Windows\System\tvBmfba.exe
  C:\Windows\System\tvBmfba.exe
  2⤵
  PID:7744
- C:\Windows\System\BYvjhGT.exe
  C:\Windows\System\BYvjhGT.exe
  2⤵
  PID:7760
- C:\Windows\System\OTWTxfQ.exe
  C:\Windows\System\OTWTxfQ.exe
  2⤵
  PID:7776
- C:\Windows\System\iTeQMhy.exe
  C:\Windows\System\iTeQMhy.exe
  2⤵
  PID:7792
- C:\Windows\System\edQBEUJ.exe
  C:\Windows\System\edQBEUJ.exe
  2⤵
  PID:7808
- C:\Windows\System\gpFRqjU.exe
  C:\Windows\System\gpFRqjU.exe
  2⤵
  PID:7824
- C:\Windows\System\SNCsQqX.exe
  C:\Windows\System\SNCsQqX.exe
  2⤵
  PID:7840
- C:\Windows\System\dcbByRO.exe
  C:\Windows\System\dcbByRO.exe
  2⤵
  PID:7856
- C:\Windows\System\pGEwctz.exe
  C:\Windows\System\pGEwctz.exe
  2⤵
  PID:7872
- C:\Windows\System\AZqrmOg.exe
  C:\Windows\System\AZqrmOg.exe
  2⤵
  PID:7888
- C:\Windows\System\mrvZndL.exe
  C:\Windows\System\mrvZndL.exe
  2⤵
  PID:7904
- C:\Windows\System\UvxVCCB.exe
  C:\Windows\System\UvxVCCB.exe
  2⤵
  PID:7920
- C:\Windows\System\JAxRMxW.exe
  C:\Windows\System\JAxRMxW.exe
  2⤵
  PID:7936
- C:\Windows\System\iloNcVB.exe
  C:\Windows\System\iloNcVB.exe
  2⤵
  PID:7952
- C:\Windows\System\XlmzygF.exe
  C:\Windows\System\XlmzygF.exe
  2⤵
  PID:7968
- C:\Windows\System\xIesKlF.exe
  C:\Windows\System\xIesKlF.exe
  2⤵
  PID:7984
- C:\Windows\System\LkmKiyy.exe
  C:\Windows\System\LkmKiyy.exe
  2⤵
  PID:8000
- C:\Windows\System\JkgauTO.exe
  C:\Windows\System\JkgauTO.exe
  2⤵
  PID:8020
- C:\Windows\System\sVVBNfv.exe
  C:\Windows\System\sVVBNfv.exe
  2⤵
  PID:8036
- C:\Windows\System\mwnPTbl.exe
  C:\Windows\System\mwnPTbl.exe
  2⤵
  PID:8052
- C:\Windows\System\ydfOYAV.exe
  C:\Windows\System\ydfOYAV.exe
  2⤵
  PID:8068
- C:\Windows\System\tgNbDQX.exe
  C:\Windows\System\tgNbDQX.exe
  2⤵
  PID:8084
- C:\Windows\System\ngToovb.exe
  C:\Windows\System\ngToovb.exe
  2⤵
  PID:8100
- C:\Windows\System\GunPkun.exe
  C:\Windows\System\GunPkun.exe
  2⤵
  PID:8116
- C:\Windows\System\KxOZHpo.exe
  C:\Windows\System\KxOZHpo.exe
  2⤵
  PID:8132
- C:\Windows\System\QyuiIYK.exe
  C:\Windows\System\QyuiIYK.exe
  2⤵
  PID:8148
- C:\Windows\System\HAJQBuX.exe
  C:\Windows\System\HAJQBuX.exe
  2⤵
  PID:8164
- C:\Windows\System\ZOMbMDe.exe
  C:\Windows\System\ZOMbMDe.exe
  2⤵
  PID:8180
- C:\Windows\System\mASlrvB.exe
  C:\Windows\System\mASlrvB.exe
  2⤵
  PID:6308
- C:\Windows\System\fHriIcC.exe
  C:\Windows\System\fHriIcC.exe
  2⤵
  PID:6432
- C:\Windows\System\coJJyoz.exe
  C:\Windows\System\coJJyoz.exe
  2⤵
  PID:6396
- C:\Windows\System\zyDnuMR.exe
  C:\Windows\System\zyDnuMR.exe
  2⤵
  PID:7260
- C:\Windows\System\XQiDCQp.exe
  C:\Windows\System\XQiDCQp.exe
  2⤵
  PID:7208
- C:\Windows\System\iaedByw.exe
  C:\Windows\System\iaedByw.exe
  2⤵
  PID:7272
- C:\Windows\System\BTisRxm.exe
  C:\Windows\System\BTisRxm.exe
  2⤵
  PID:7324
- C:\Windows\System\SpVKlVV.exe
  C:\Windows\System\SpVKlVV.exe
  2⤵
  PID:7388
- C:\Windows\System\LAVLUGG.exe
  C:\Windows\System\LAVLUGG.exe
  2⤵
  PID:7416
- C:\Windows\System\senVYcp.exe
  C:\Windows\System\senVYcp.exe
  2⤵
  PID:7372
- C:\Windows\System\nATDJdq.exe
  C:\Windows\System\nATDJdq.exe
  2⤵
  PID:7400
- C:\Windows\System\RtvMKmD.exe
  C:\Windows\System\RtvMKmD.exe
  2⤵
  PID:7436
- C:\Windows\System\YCtCRzY.exe
  C:\Windows\System\YCtCRzY.exe
  2⤵
  PID:7544
- C:\Windows\System\bMOpPmd.exe
  C:\Windows\System\bMOpPmd.exe
  2⤵
  PID:7576
- C:\Windows\System\NQFNOgf.exe
  C:\Windows\System\NQFNOgf.exe
  2⤵
  PID:7608
- C:\Windows\System\wVkvwYW.exe
  C:\Windows\System\wVkvwYW.exe
  2⤵
  PID:7564
- C:\Windows\System\GusufKs.exe
  C:\Windows\System\GusufKs.exe
  2⤵
  PID:7628
- C:\Windows\System\xrDBhNo.exe
  C:\Windows\System\xrDBhNo.exe
  2⤵
  PID:7656
- C:\Windows\System\hLtcwJI.exe
  C:\Windows\System\hLtcwJI.exe
  2⤵
  PID:7708
- C:\Windows\System\rFioQih.exe
  C:\Windows\System\rFioQih.exe
  2⤵
  PID:7768
- C:\Windows\System\gOpeagX.exe
  C:\Windows\System\gOpeagX.exe
  2⤵
  PID:7784
- C:\Windows\System\fDbQhgv.exe
  C:\Windows\System\fDbQhgv.exe
  2⤵
  PID:7752
- C:\Windows\System\AqCvsVe.exe
  C:\Windows\System\AqCvsVe.exe
  2⤵
  PID:7868
- C:\Windows\System\iPzzFcx.exe
  C:\Windows\System\iPzzFcx.exe
  2⤵
  PID:7900
- C:\Windows\System\ZNzUrTs.exe
  C:\Windows\System\ZNzUrTs.exe
  2⤵
  PID:7884
- C:\Windows\System\ygXIFpz.exe
  C:\Windows\System\ygXIFpz.exe
  2⤵
  PID:7852
- C:\Windows\System\ljndDcB.exe
  C:\Windows\System\ljndDcB.exe
  2⤵
  PID:7996
- C:\Windows\System\rBqwgRh.exe
  C:\Windows\System\rBqwgRh.exe
  2⤵
  PID:7916
- C:\Windows\System\jKPpbZo.exe
  C:\Windows\System\jKPpbZo.exe
  2⤵
  PID:8092
- C:\Windows\System\HDuxLWi.exe
  C:\Windows\System\HDuxLWi.exe
  2⤵
  PID:8128
- C:\Windows\System\sahshqo.exe
  C:\Windows\System\sahshqo.exe
  2⤵
  PID:8156
- C:\Windows\System\yMauAmK.exe
  C:\Windows\System\yMauAmK.exe
  2⤵
  PID:8048
- C:\Windows\System\ykgRmTC.exe
  C:\Windows\System\ykgRmTC.exe
  2⤵
  PID:7180
- C:\Windows\System\vTudxGB.exe
  C:\Windows\System\vTudxGB.exe
  2⤵
  PID:7292
- C:\Windows\System\aUTBGLf.exe
  C:\Windows\System\aUTBGLf.exe
  2⤵
  PID:7340
- C:\Windows\System\aPZCaFS.exe
  C:\Windows\System\aPZCaFS.exe
  2⤵
  PID:8144
- C:\Windows\System\lAzOPsw.exe
  C:\Windows\System\lAzOPsw.exe
  2⤵
  PID:7512
- C:\Windows\System\NkgiDEe.exe
  C:\Windows\System\NkgiDEe.exe
  2⤵
  PID:7624
- C:\Windows\System\kzjqJbI.exe
  C:\Windows\System\kzjqJbI.exe
  2⤵
  PID:7724
- C:\Windows\System\NzqTOmZ.exe
  C:\Windows\System\NzqTOmZ.exe
  2⤵
  PID:7932
- C:\Windows\System\VSNKgfg.exe
  C:\Windows\System\VSNKgfg.exe
  2⤵
  PID:8016
- C:\Windows\System\MqyLuJl.exe
  C:\Windows\System\MqyLuJl.exe
  2⤵
  PID:6764
- C:\Windows\System\yyxuvdB.exe
  C:\Windows\System\yyxuvdB.exe
  2⤵
  PID:7228
- C:\Windows\System\jpbWUjJ.exe
  C:\Windows\System\jpbWUjJ.exe
  2⤵
  PID:7960
- C:\Windows\System\QBjmWJN.exe
  C:\Windows\System\QBjmWJN.exe
  2⤵
  PID:7448
- C:\Windows\System\PkfuTaS.exe
  C:\Windows\System\PkfuTaS.exe
  2⤵
  PID:7528
- C:\Windows\System\MePZpUZ.exe
  C:\Windows\System\MePZpUZ.exe
  2⤵
  PID:7676
- C:\Windows\System\OeYbBGj.exe
  C:\Windows\System\OeYbBGj.exe
  2⤵
  PID:7788
- C:\Windows\System\LbPZwyQ.exe
  C:\Windows\System\LbPZwyQ.exe
  2⤵
  PID:8032
- C:\Windows\System\EVPvqKw.exe
  C:\Windows\System\EVPvqKw.exe
  2⤵
  PID:7304
- C:\Windows\System\fwAqtBK.exe
  C:\Windows\System\fwAqtBK.exe
  2⤵
  PID:7980
- C:\Windows\System\TtZpOGK.exe
  C:\Windows\System\TtZpOGK.exe
  2⤵
  PID:7688
- C:\Windows\System\MsCxKAR.exe
  C:\Windows\System\MsCxKAR.exe
  2⤵
  PID:6400
- C:\Windows\System\aLlAEFP.exe
  C:\Windows\System\aLlAEFP.exe
  2⤵
  PID:7836
- C:\Windows\System\SpDDMne.exe
  C:\Windows\System\SpDDMne.exe
  2⤵
  PID:7384
- C:\Windows\System\PnQAlsd.exe
  C:\Windows\System\PnQAlsd.exe
  2⤵
  PID:7612
- C:\Windows\System\tEUixGF.exe
  C:\Windows\System\tEUixGF.exe
  2⤵
  PID:7964
- C:\Windows\System\HEYEDKZ.exe
  C:\Windows\System\HEYEDKZ.exe
  2⤵
  PID:7432
- C:\Windows\System\rgXUtqE.exe
  C:\Windows\System\rgXUtqE.exe
  2⤵
  PID:7720
- C:\Windows\System\RhOlISr.exe
  C:\Windows\System\RhOlISr.exe
  2⤵
  PID:6588
- C:\Windows\System\UVYCezf.exe
  C:\Windows\System\UVYCezf.exe
  2⤵
  PID:7580
- C:\Windows\System\XtMVhSv.exe
  C:\Windows\System\XtMVhSv.exe
  2⤵
  PID:7896
- C:\Windows\System\sOkdpVH.exe
  C:\Windows\System\sOkdpVH.exe
  2⤵
  PID:8200
- C:\Windows\System\MHLyGzc.exe
  C:\Windows\System\MHLyGzc.exe
  2⤵
  PID:8216
- C:\Windows\System\HGgptkS.exe
  C:\Windows\System\HGgptkS.exe
  2⤵
  PID:8232
- C:\Windows\System\TkdEEKm.exe
  C:\Windows\System\TkdEEKm.exe
  2⤵
  PID:8248
- C:\Windows\System\bAXMXva.exe
  C:\Windows\System\bAXMXva.exe
  2⤵
  PID:8264
- C:\Windows\System\OTDYBum.exe
  C:\Windows\System\OTDYBum.exe
  2⤵
  PID:8280
- C:\Windows\System\bmGaUgO.exe
  C:\Windows\System\bmGaUgO.exe
  2⤵
  PID:8296
- C:\Windows\System\YEKwPme.exe
  C:\Windows\System\YEKwPme.exe
  2⤵
  PID:8312
- C:\Windows\System\JgWDpIR.exe
  C:\Windows\System\JgWDpIR.exe
  2⤵
  PID:8328
- C:\Windows\System\HOSEZgL.exe
  C:\Windows\System\HOSEZgL.exe
  2⤵
  PID:8344
- C:\Windows\System\aFkTxaT.exe
  C:\Windows\System\aFkTxaT.exe
  2⤵
  PID:8360
- C:\Windows\System\FkSjysR.exe
  C:\Windows\System\FkSjysR.exe
  2⤵
  PID:8376
- C:\Windows\System\XdhrUFA.exe
  C:\Windows\System\XdhrUFA.exe
  2⤵
  PID:8392
- C:\Windows\System\wcWFELt.exe
  C:\Windows\System\wcWFELt.exe
  2⤵
  PID:8408
- C:\Windows\System\WwHxjcz.exe
  C:\Windows\System\WwHxjcz.exe
  2⤵
  PID:8424
- C:\Windows\System\uzknizR.exe
  C:\Windows\System\uzknizR.exe
  2⤵
  PID:8440
- C:\Windows\System\cjlrSlK.exe
  C:\Windows\System\cjlrSlK.exe
  2⤵
  PID:8456
- C:\Windows\System\ueqqvoo.exe
  C:\Windows\System\ueqqvoo.exe
  2⤵
  PID:8472
- C:\Windows\System\GWlDGZi.exe
  C:\Windows\System\GWlDGZi.exe
  2⤵
  PID:8488
- C:\Windows\System\hqBgkbD.exe
  C:\Windows\System\hqBgkbD.exe
  2⤵
  PID:8504
- C:\Windows\System\tEteeYs.exe
  C:\Windows\System\tEteeYs.exe
  2⤵
  PID:8520
- C:\Windows\System\sSublYX.exe
  C:\Windows\System\sSublYX.exe
  2⤵
  PID:8536
- C:\Windows\System\KzmsYMU.exe
  C:\Windows\System\KzmsYMU.exe
  2⤵
  PID:8552
- C:\Windows\System\yQvPpYs.exe
  C:\Windows\System\yQvPpYs.exe
  2⤵
  PID:8568
- C:\Windows\System\cjzxypU.exe
  C:\Windows\System\cjzxypU.exe
  2⤵
  PID:8584
- C:\Windows\System\QXWQpLz.exe
  C:\Windows\System\QXWQpLz.exe
  2⤵
  PID:8600
- C:\Windows\System\IksOhmm.exe
  C:\Windows\System\IksOhmm.exe
  2⤵
  PID:8616
- C:\Windows\System\tRzcKUk.exe
  C:\Windows\System\tRzcKUk.exe
  2⤵
  PID:8632
- C:\Windows\System\hLSCtOK.exe
  C:\Windows\System\hLSCtOK.exe
  2⤵
  PID:8648
- C:\Windows\System\NmnuyQB.exe
  C:\Windows\System\NmnuyQB.exe
  2⤵
  PID:8664
- C:\Windows\System\sFgYWGh.exe
  C:\Windows\System\sFgYWGh.exe
  2⤵
  PID:8680
- C:\Windows\System\GWZCBUV.exe
  C:\Windows\System\GWZCBUV.exe
  2⤵
  PID:8696
- C:\Windows\System\aztMeKd.exe
  C:\Windows\System\aztMeKd.exe
  2⤵
  PID:8712
- C:\Windows\System\QkJbuhU.exe
  C:\Windows\System\QkJbuhU.exe
  2⤵
  PID:8728
- C:\Windows\System\OMRhTqu.exe
  C:\Windows\System\OMRhTqu.exe
  2⤵
  PID:8748
- C:\Windows\System\aGDzRcV.exe
  C:\Windows\System\aGDzRcV.exe
  2⤵
  PID:8764
- C:\Windows\System\PtrEuEF.exe
  C:\Windows\System\PtrEuEF.exe
  2⤵
  PID:8780
- C:\Windows\System\xTmxDgk.exe
  C:\Windows\System\xTmxDgk.exe
  2⤵
  PID:8796
- C:\Windows\System\KalRDac.exe
  C:\Windows\System\KalRDac.exe
  2⤵
  PID:8812
- C:\Windows\System\OPWRMHw.exe
  C:\Windows\System\OPWRMHw.exe
  2⤵
  PID:8828
- C:\Windows\System\jWdNghr.exe
  C:\Windows\System\jWdNghr.exe
  2⤵
  PID:8844
- C:\Windows\System\nJERtbG.exe
  C:\Windows\System\nJERtbG.exe
  2⤵
  PID:8860
- C:\Windows\System\liIFGEm.exe
  C:\Windows\System\liIFGEm.exe
  2⤵
  PID:8876
- C:\Windows\System\iAqZqSw.exe
  C:\Windows\System\iAqZqSw.exe
  2⤵
  PID:8892
- C:\Windows\System\YGjCFsY.exe
  C:\Windows\System\YGjCFsY.exe
  2⤵
  PID:8908
- C:\Windows\System\oidPdmH.exe
  C:\Windows\System\oidPdmH.exe
  2⤵
  PID:8924
- C:\Windows\System\eShzMGl.exe
  C:\Windows\System\eShzMGl.exe
  2⤵
  PID:8940
- C:\Windows\System\ZJRuvYz.exe
  C:\Windows\System\ZJRuvYz.exe
  2⤵
  PID:8956
- C:\Windows\System\vkPhZuF.exe
  C:\Windows\System\vkPhZuF.exe
  2⤵
  PID:8972
- C:\Windows\System\TGWbUaS.exe
  C:\Windows\System\TGWbUaS.exe
  2⤵
  PID:8988
- C:\Windows\System\EcGipsS.exe
  C:\Windows\System\EcGipsS.exe
  2⤵
  PID:9004
- C:\Windows\System\gnJHxMT.exe
  C:\Windows\System\gnJHxMT.exe
  2⤵
  PID:9020
- C:\Windows\System\ZhSstGI.exe
  C:\Windows\System\ZhSstGI.exe
  2⤵
  PID:9036
- C:\Windows\System\ootXBhO.exe
  C:\Windows\System\ootXBhO.exe
  2⤵
  PID:9052
- C:\Windows\System\TyRmLld.exe
  C:\Windows\System\TyRmLld.exe
  2⤵
  PID:9068
- C:\Windows\System\XarWLho.exe
  C:\Windows\System\XarWLho.exe
  2⤵
  PID:9084
- C:\Windows\System\xkeBeeQ.exe
  C:\Windows\System\xkeBeeQ.exe
  2⤵
  PID:9100
- C:\Windows\System\mowwgJO.exe
  C:\Windows\System\mowwgJO.exe
  2⤵
  PID:9116
- C:\Windows\System\nwaeAvt.exe
  C:\Windows\System\nwaeAvt.exe
  2⤵
  PID:9132
- C:\Windows\System\SaCQjXI.exe
  C:\Windows\System\SaCQjXI.exe
  2⤵
  PID:9148
- C:\Windows\System\iKWKycP.exe
  C:\Windows\System\iKWKycP.exe
  2⤵
  PID:9164
- C:\Windows\System\poxnhIK.exe
  C:\Windows\System\poxnhIK.exe
  2⤵
  PID:9180
- C:\Windows\System\QGRfJgo.exe
  C:\Windows\System\QGRfJgo.exe
  2⤵
  PID:9196
- C:\Windows\System\jokFBNk.exe
  C:\Windows\System\jokFBNk.exe
  2⤵
  PID:9212
- C:\Windows\System\OvILnud.exe
  C:\Windows\System\OvILnud.exe
  2⤵
  PID:8196
- C:\Windows\System\seSUgaC.exe
  C:\Windows\System\seSUgaC.exe
  2⤵
  PID:7864
- C:\Windows\System\dfTtRDi.exe
  C:\Windows\System\dfTtRDi.exe
  2⤵
  PID:8224
- C:\Windows\System\RGloYhL.exe
  C:\Windows\System\RGloYhL.exe
  2⤵
  PID:8260
- C:\Windows\System\dzJjZqO.exe
  C:\Windows\System\dzJjZqO.exe
  2⤵
  PID:8292
- C:\Windows\System\MgEmHmV.exe
  C:\Windows\System\MgEmHmV.exe
  2⤵
  PID:8272
- C:\Windows\System\dxYoyjx.exe
  C:\Windows\System\dxYoyjx.exe
  2⤵
  PID:8308
- C:\Windows\System\jpasbAA.exe
  C:\Windows\System\jpasbAA.exe
  2⤵
  PID:8388
- C:\Windows\System\tJbPbcU.exe
  C:\Windows\System\tJbPbcU.exe
  2⤵
  PID:8448
- C:\Windows\System\VUmhmDW.exe
  C:\Windows\System\VUmhmDW.exe
  2⤵
  PID:8432
- C:\Windows\System\pSbrTIq.exe
  C:\Windows\System\pSbrTIq.exe
  2⤵
  PID:8404
- C:\Windows\System\wTsgYQu.exe
  C:\Windows\System\wTsgYQu.exe
  2⤵
  PID:8496
- C:\Windows\System\gPbZSYg.exe
  C:\Windows\System\gPbZSYg.exe
  2⤵
  PID:8544
- C:\Windows\System\giaGkZD.exe
  C:\Windows\System\giaGkZD.exe
  2⤵
  PID:8528
- C:\Windows\System\XbojRob.exe
  C:\Windows\System\XbojRob.exe
  2⤵
  PID:8532
- C:\Windows\System\YQSlnyv.exe
  C:\Windows\System\YQSlnyv.exe
  2⤵
  PID:8624
- C:\Windows\System\WVaJLTg.exe
  C:\Windows\System\WVaJLTg.exe
  2⤵
  PID:8672
- C:\Windows\System\Fmrzmgc.exe
  C:\Windows\System\Fmrzmgc.exe
  2⤵
  PID:8660
- C:\Windows\System\SeLsCWL.exe
  C:\Windows\System\SeLsCWL.exe
  2⤵
  PID:8736
- C:\Windows\System\ozCtXwn.exe
  C:\Windows\System\ozCtXwn.exe
  2⤵
  PID:8804
- C:\Windows\System\UNkfTPs.exe
  C:\Windows\System\UNkfTPs.exe
  2⤵
  PID:8868
- C:\Windows\System\KluftIV.exe
  C:\Windows\System\KluftIV.exe
  2⤵
  PID:8820
- C:\Windows\System\OWbxmLb.exe
  C:\Windows\System\OWbxmLb.exe
  2⤵
  PID:8824
- C:\Windows\System\Zxkiozw.exe
  C:\Windows\System\Zxkiozw.exe
  2⤵
  PID:8888
- C:\Windows\System\MMUMrOh.exe
  C:\Windows\System\MMUMrOh.exe
  2⤵
  PID:8936
- C:\Windows\System\MVQDiib.exe
  C:\Windows\System\MVQDiib.exe
  2⤵
  PID:8996
- C:\Windows\System\ecvxqnb.exe
  C:\Windows\System\ecvxqnb.exe
  2⤵
  PID:8916
- C:\Windows\System\mLPYRIh.exe
  C:\Windows\System\mLPYRIh.exe
  2⤵
  PID:9060
- C:\Windows\System\LnBuiYF.exe
  C:\Windows\System\LnBuiYF.exe
  2⤵
  PID:9016
- C:\Windows\System\WGtwXsL.exe
  C:\Windows\System\WGtwXsL.exe
  2⤵
  PID:9076
- C:\Windows\System\QppqJLu.exe
  C:\Windows\System\QppqJLu.exe
  2⤵
  PID:9156
- C:\Windows\System\KENpFJg.exe
  C:\Windows\System\KENpFJg.exe
  2⤵
  PID:9080
- C:\Windows\System\sFlgNYx.exe
  C:\Windows\System\sFlgNYx.exe
  2⤵
  PID:9112
- C:\Windows\System\gSjWxwK.exe
  C:\Windows\System\gSjWxwK.exe
  2⤵
  PID:8212
- C:\Windows\System\hMLBeYy.exe
  C:\Windows\System\hMLBeYy.exe
  2⤵
  PID:8420
- C:\Windows\System\kHrZhPH.exe
  C:\Windows\System\kHrZhPH.exe
  2⤵
  PID:8436
- C:\Windows\System\lhxKtlo.exe
  C:\Windows\System\lhxKtlo.exe
  2⤵
  PID:9204
- C:\Windows\System\oAAGeJh.exe
  C:\Windows\System\oAAGeJh.exe
  2⤵
  PID:8256
- C:\Windows\System\JyVmALh.exe
  C:\Windows\System\JyVmALh.exe
  2⤵
  PID:8244
- C:\Windows\System\XiBizgN.exe
  C:\Windows\System\XiBizgN.exe
  2⤵
  PID:8340
- C:\Windows\System\VFJZtVh.exe
  C:\Windows\System\VFJZtVh.exe
  2⤵
  PID:8356
- C:\Windows\System\aYCdAsc.exe
  C:\Windows\System\aYCdAsc.exe
  2⤵
  PID:8644
- C:\Windows\System\UDEzyCP.exe
  C:\Windows\System\UDEzyCP.exe
  2⤵
  PID:8688
- C:\Windows\System\LIaMycc.exe
  C:\Windows\System\LIaMycc.exe
  2⤵
  PID:8776
- C:\Windows\System\pTECoHI.exe
  C:\Windows\System\pTECoHI.exe
  2⤵
  PID:8792
- C:\Windows\System\WSTQsfc.exe
  C:\Windows\System\WSTQsfc.exe
  2⤵
  PID:8932
- C:\Windows\System\iceumCu.exe
  C:\Windows\System\iceumCu.exe
  2⤵
  PID:8964
- C:\Windows\System\snIHJAX.exe
  C:\Windows\System\snIHJAX.exe
  2⤵
  PID:9032
- C:\Windows\System\WKVtYdp.exe
  C:\Windows\System\WKVtYdp.exe
  2⤵
  PID:8124
- C:\Windows\System\NVTqcCi.exe
  C:\Windows\System\NVTqcCi.exe
  2⤵
  PID:9188
- C:\Windows\System\GizMlEa.exe
  C:\Windows\System\GizMlEa.exe
  2⤵
  PID:8208
- C:\Windows\System\mPmOIYE.exe
  C:\Windows\System\mPmOIYE.exe
  2⤵
  PID:8468
- C:\Windows\System\tkXIkPf.exe
  C:\Windows\System\tkXIkPf.exe
  2⤵
  PID:8500
- C:\Windows\System\iECZVZt.exe
  C:\Windows\System\iECZVZt.exe
  2⤵
  PID:8480
- C:\Windows\System\UFXmDyi.exe
  C:\Windows\System\UFXmDyi.exe
  2⤵
  PID:8708
- C:\Windows\System\QVmCgqY.exe
  C:\Windows\System\QVmCgqY.exe
  2⤵
  PID:8952
- C:\Windows\System\fzNctKR.exe
  C:\Windows\System\fzNctKR.exe
  2⤵
  PID:9128
- C:\Windows\System\DbAvLKc.exe
  C:\Windows\System\DbAvLKc.exe
  2⤵
  PID:8304
- C:\Windows\System\xPNTGhU.exe
  C:\Windows\System\xPNTGhU.exe
  2⤵
  PID:8368
- C:\Windows\System\sNzbbVI.exe
  C:\Windows\System\sNzbbVI.exe
  2⤵
  PID:9176
- C:\Windows\System\ziPvklS.exe
  C:\Windows\System\ziPvklS.exe
  2⤵
  PID:9096
- C:\Windows\System\JqGuYnY.exe
  C:\Windows\System\JqGuYnY.exe
  2⤵
  PID:8724
- C:\Windows\System\DpAKcti.exe
  C:\Windows\System\DpAKcti.exe
  2⤵
  PID:8836
- C:\Windows\System\zCsSGak.exe
  C:\Windows\System\zCsSGak.exe
  2⤵
  PID:8904
- C:\Windows\System\EoxWfMn.exe
  C:\Windows\System\EoxWfMn.exe
  2⤵
  PID:9064
- C:\Windows\System\LfLEDIZ.exe
  C:\Windows\System\LfLEDIZ.exe
  2⤵
  PID:8592
- C:\Windows\System\nNYKbbG.exe
  C:\Windows\System\nNYKbbG.exe
  2⤵
  PID:8580
- C:\Windows\System\uKBicGp.exe
  C:\Windows\System\uKBicGp.exe
  2⤵
  PID:9232
- C:\Windows\System\IblYOgP.exe
  C:\Windows\System\IblYOgP.exe
  2⤵
  PID:9248
- C:\Windows\System\DAfwTog.exe
  C:\Windows\System\DAfwTog.exe
  2⤵
  PID:9264
- C:\Windows\System\CeGtdik.exe
  C:\Windows\System\CeGtdik.exe
  2⤵
  PID:9280
- C:\Windows\System\GlYRxcg.exe
  C:\Windows\System\GlYRxcg.exe
  2⤵
  PID:9296
- C:\Windows\System\yydLLKp.exe
  C:\Windows\System\yydLLKp.exe
  2⤵
  PID:9312
- C:\Windows\System\KYRMzdS.exe
  C:\Windows\System\KYRMzdS.exe
  2⤵
  PID:9328
- C:\Windows\System\derpRLB.exe
  C:\Windows\System\derpRLB.exe
  2⤵
  PID:9344
- C:\Windows\System\GUMnLzx.exe
  C:\Windows\System\GUMnLzx.exe
  2⤵
  PID:9360
- C:\Windows\System\LzvZlOp.exe
  C:\Windows\System\LzvZlOp.exe
  2⤵
  PID:9376
- C:\Windows\System\slcYWYk.exe
  C:\Windows\System\slcYWYk.exe
  2⤵
  PID:9392
- C:\Windows\System\yBJUbrh.exe
  C:\Windows\System\yBJUbrh.exe
  2⤵
  PID:9408
- C:\Windows\System\nCisGDp.exe
  C:\Windows\System\nCisGDp.exe
  2⤵
  PID:9428
- C:\Windows\System\djdgTTx.exe
  C:\Windows\System\djdgTTx.exe
  2⤵
  PID:9444
- C:\Windows\System\HvUDVQg.exe
  C:\Windows\System\HvUDVQg.exe
  2⤵
  PID:9460
- C:\Windows\System\BxKGdpv.exe
  C:\Windows\System\BxKGdpv.exe
  2⤵
  PID:9476
- C:\Windows\System\pFHVuht.exe
  C:\Windows\System\pFHVuht.exe
  2⤵
  PID:9492
- C:\Windows\System\tpKDYVa.exe
  C:\Windows\System\tpKDYVa.exe
  2⤵
  PID:9508
- C:\Windows\System\clMUOZZ.exe
  C:\Windows\System\clMUOZZ.exe
  2⤵
  PID:9524
- C:\Windows\System\MmHgxyv.exe
  C:\Windows\System\MmHgxyv.exe
  2⤵
  PID:9540
- C:\Windows\System\YKiWoPb.exe
  C:\Windows\System\YKiWoPb.exe
  2⤵
  PID:9556
- C:\Windows\System\NdmfWZS.exe
  C:\Windows\System\NdmfWZS.exe
  2⤵
  PID:9572
- C:\Windows\System\uYldTEI.exe
  C:\Windows\System\uYldTEI.exe
  2⤵
  PID:9588
- C:\Windows\System\xyzcQiM.exe
  C:\Windows\System\xyzcQiM.exe
  2⤵
  PID:9604
- C:\Windows\System\hUFdfPQ.exe
  C:\Windows\System\hUFdfPQ.exe
  2⤵
  PID:9624
- C:\Windows\System\vOyMsdq.exe
  C:\Windows\System\vOyMsdq.exe
  2⤵
  PID:9640
- C:\Windows\System\siNPZON.exe
  C:\Windows\System\siNPZON.exe
  2⤵
  PID:9676
- C:\Windows\System\FiIPlUx.exe
  C:\Windows\System\FiIPlUx.exe
  2⤵
  PID:9716
- C:\Windows\System\KPdwgPZ.exe
  C:\Windows\System\KPdwgPZ.exe
  2⤵
  PID:9736
- C:\Windows\System\iqvtSvw.exe
  C:\Windows\System\iqvtSvw.exe
  2⤵
  PID:9752
- C:\Windows\System\ilUgnXS.exe
  C:\Windows\System\ilUgnXS.exe
  2⤵
  PID:9768
- C:\Windows\System\VbKSTrp.exe
  C:\Windows\System\VbKSTrp.exe
  2⤵
  PID:9784
- C:\Windows\System\DeyUloF.exe
  C:\Windows\System\DeyUloF.exe
  2⤵
  PID:9800
- C:\Windows\System\yJIukRc.exe
  C:\Windows\System\yJIukRc.exe
  2⤵
  PID:9816
- C:\Windows\System\PgimrLK.exe
  C:\Windows\System\PgimrLK.exe
  2⤵
  PID:9832
- C:\Windows\System\nIYKMkT.exe
  C:\Windows\System\nIYKMkT.exe
  2⤵
  PID:9848
- C:\Windows\System\oMZGEGZ.exe
  C:\Windows\System\oMZGEGZ.exe
  2⤵
  PID:9864
- C:\Windows\System\wgyhkKe.exe
  C:\Windows\System\wgyhkKe.exe
  2⤵
  PID:9880
- C:\Windows\System\IFnoPMW.exe
  C:\Windows\System\IFnoPMW.exe
  2⤵
  PID:9896
- C:\Windows\System\waZXkCz.exe
  C:\Windows\System\waZXkCz.exe
  2⤵
  PID:9912
- C:\Windows\System\tugfylV.exe
  C:\Windows\System\tugfylV.exe
  2⤵
  PID:9928
- C:\Windows\System\HugMqZW.exe
  C:\Windows\System\HugMqZW.exe
  2⤵
  PID:9944
- C:\Windows\System\IWbWtJt.exe
  C:\Windows\System\IWbWtJt.exe
  2⤵
  PID:9960
- C:\Windows\System\kgakplo.exe
  C:\Windows\System\kgakplo.exe
  2⤵
  PID:9976
- C:\Windows\System\vYUYltO.exe
  C:\Windows\System\vYUYltO.exe
  2⤵
  PID:9992
- C:\Windows\System\JsQbstI.exe
  C:\Windows\System\JsQbstI.exe
  2⤵
  PID:10008
- C:\Windows\System\uAjDnir.exe
  C:\Windows\System\uAjDnir.exe
  2⤵
  PID:10024
- C:\Windows\System\YrIyKCW.exe
  C:\Windows\System\YrIyKCW.exe
  2⤵
  PID:10040
- C:\Windows\System\mkCMvpS.exe
  C:\Windows\System\mkCMvpS.exe
  2⤵
  PID:10056
- C:\Windows\System\nEHvcLU.exe
  C:\Windows\System\nEHvcLU.exe
  2⤵
  PID:10072
- C:\Windows\System\VvoYgrP.exe
  C:\Windows\System\VvoYgrP.exe
  2⤵
  PID:10088
- C:\Windows\System\PDVVEPp.exe
  C:\Windows\System\PDVVEPp.exe
  2⤵
  PID:10104
- C:\Windows\System\VjvuYNT.exe
  C:\Windows\System\VjvuYNT.exe
  2⤵
  PID:10120
- C:\Windows\System\qNOovjN.exe
  C:\Windows\System\qNOovjN.exe
  2⤵
  PID:10136
- C:\Windows\System\SDvNWin.exe
  C:\Windows\System\SDvNWin.exe
  2⤵
  PID:10152
- C:\Windows\System\oeBtBoO.exe
  C:\Windows\System\oeBtBoO.exe
  2⤵
  PID:10168
- C:\Windows\System\RPjEXlJ.exe
  C:\Windows\System\RPjEXlJ.exe
  2⤵
  PID:10188
- C:\Windows\System\ijcymDb.exe
  C:\Windows\System\ijcymDb.exe
  2⤵
  PID:10204
- C:\Windows\System\lAQxGnJ.exe
  C:\Windows\System\lAQxGnJ.exe
  2⤵
  PID:10220
- C:\Windows\System\ExjUDVa.exe
  C:\Windows\System\ExjUDVa.exe
  2⤵
  PID:10236
- C:\Windows\System\PldfWtH.exe
  C:\Windows\System\PldfWtH.exe
  2⤵
  PID:9372
- C:\Windows\System\qBsKhsn.exe
  C:\Windows\System\qBsKhsn.exe
  2⤵
  PID:9352
- C:\Windows\System\IFIPZvO.exe
  C:\Windows\System\IFIPZvO.exe
  2⤵
  PID:9416
- C:\Windows\System\EyGbPhg.exe
  C:\Windows\System\EyGbPhg.exe
  2⤵
  PID:9504
- C:\Windows\System\QbgXgAc.exe
  C:\Windows\System\QbgXgAc.exe
  2⤵
  PID:9484
- C:\Windows\System\GIhIIOK.exe
  C:\Windows\System\GIhIIOK.exe
  2⤵
  PID:9456
- C:\Windows\System\bYasljC.exe
  C:\Windows\System\bYasljC.exe
  2⤵
  PID:9516
- C:\Windows\System\hsPgTVx.exe
  C:\Windows\System\hsPgTVx.exe
  2⤵
  PID:9580
- C:\Windows\System\pWGixVQ.exe
  C:\Windows\System\pWGixVQ.exe
  2⤵
  PID:9612
- C:\Windows\System\PrsEtyK.exe
  C:\Windows\System\PrsEtyK.exe
  2⤵
  PID:9636
- C:\Windows\System\ESEukDo.exe
  C:\Windows\System\ESEukDo.exe
  2⤵
  PID:9656
- C:\Windows\System\cFJOEIO.exe
  C:\Windows\System\cFJOEIO.exe
  2⤵
  PID:9672
- C:\Windows\System\NKQdRpc.exe
  C:\Windows\System\NKQdRpc.exe
  2⤵
  PID:9696
- C:\Windows\System\tcTUAYT.exe
  C:\Windows\System\tcTUAYT.exe
  2⤵
  PID:9712
- C:\Windows\System\LyiHmdI.exe
  C:\Windows\System\LyiHmdI.exe
  2⤵
  PID:9732
- C:\Windows\System\UMVjOHH.exe
  C:\Windows\System\UMVjOHH.exe
  2⤵
  PID:9760
- C:\Windows\System\SGSHDNS.exe
  C:\Windows\System\SGSHDNS.exe
  2⤵
  PID:9796
- C:\Windows\System\sdYodsq.exe
  C:\Windows\System\sdYodsq.exe
  2⤵
  PID:9828
- C:\Windows\System\Wlgylbi.exe
  C:\Windows\System\Wlgylbi.exe
  2⤵
  PID:9860
- C:\Windows\System\Ngedlyv.exe
  C:\Windows\System\Ngedlyv.exe
  2⤵
  PID:9936
- C:\Windows\System\chOgVRr.exe
  C:\Windows\System\chOgVRr.exe
  2⤵
  PID:9968
- C:\Windows\System\hqcRCPV.exe
  C:\Windows\System\hqcRCPV.exe
  2⤵
  PID:9972
- C:\Windows\System\vXDxWjJ.exe
  C:\Windows\System\vXDxWjJ.exe
  2⤵
  PID:10032
- C:\Windows\System\EQVSEdY.exe
  C:\Windows\System\EQVSEdY.exe
  2⤵
  PID:10020
- C:\Windows\System\juZCbZG.exe
  C:\Windows\System\juZCbZG.exe
  2⤵
  PID:10096
- C:\Windows\System\CxWzexm.exe
  C:\Windows\System\CxWzexm.exe
  2⤵
  PID:10128
- C:\Windows\System\yJtGVOR.exe
  C:\Windows\System\yJtGVOR.exe
  2⤵
  PID:10116
- C:\Windows\System\TlsgNyv.exe
  C:\Windows\System\TlsgNyv.exe
  2⤵
  PID:10196
- C:\Windows\System\umbytdE.exe
  C:\Windows\System\umbytdE.exe
  2⤵
  PID:10212
- C:\Windows\System\NauRCmP.exe
  C:\Windows\System\NauRCmP.exe
  2⤵
  PID:10232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AFmdctN.exe

Filesize
1.2MB

MD5
00a6e237fe67064af8b6a55151bf3a84

SHA1
0ef9f79020c9588b39ce866dda38ec30f7330c93

SHA256
f99a91f1df7a07be9f0f93a2f9b8d8438b5e85efc41752bd4388fb9ad743ce7f

SHA512
62c7eab7ec45ebd0ea18b5599e2f57d136688cf3fc0a62f5808521fe55d6c9aba49eb37fd983d17b68b64f22915a6c980ceda252e428ea18cc71f04a79b4cfa0

Download Submit
C:\Windows\system\BMJUIAb.exe

Filesize
1.2MB

MD5
adb6a435ff623f208ecfa93c317e5407

SHA1
04bfaf902c8ef97964d94e86e4a261db5b411557

SHA256
c7d5997d8d5956c88386dbe85fbca267633529f9b4bc585f5053e68a0df25bdf

SHA512
a81cabd915d354f46e7787fea5e9c763509fd48ddeba1366648a1e5b84196ac736c73c52975623f63bc3f16803319c5e3bbadfbbe70e97e1c61c620ffbc31f4e

Download Submit
C:\Windows\system\CDpeUsF.exe

Filesize
1.2MB

MD5
54d75411340e0ab2dc050e9ec0fd7c10

SHA1
f47c8e21f9054288d9af57dfcd727c241b36b8ef

SHA256
2e21f0eec44f3c976c4462fb3dd578e21ba9f58477fd0b3ea5bdcc6b26667415

SHA512
80e127a099646d2b0e2ed89b8f05b8706240c366d13e4d8d0d872ac95b8ded671d5deef90db29c71d45fdd74123c805d886159b7a9e36e5dec95f0932ac9a9c6

Download Submit
C:\Windows\system\CQxfRmx.exe

Filesize
1.2MB

MD5
84f7300fe60fc551f283f5cb0b731ef7

SHA1
5bd51dd3112d614e44ef8156d6541a228bd8aef2

SHA256
3daa16883060d0d9d7dc59cb4a33347e57fb25a6cb6b5263cf5755ef4de09306

SHA512
9c30a59d9bb34819b3f5bc7ad5e55cfb41807e4a228438daab0ed574c02bd2bdf8ed55b27112cb331028a156ee7e64e764033a07d07a23244b9c12b21f9e19fb

Download Submit
C:\Windows\system\ESihWRF.exe

Filesize
1.2MB

MD5
9c8010ad1b5d71c278d8243a563c1d9b

SHA1
038ef848d7ebac95ccc30574d91e5f40443e06ee

SHA256
f351d57f4c74c5c472bdea40c5d3b0a24dcef188ea8f1c7f64431d62ccd6433c

SHA512
a0259f8d95dd15cb0dfc76a2a471c5c86399805aaea37dfa7be68d4db12ae18015f49e684d57667f2ad6d0c2dc99a245fd4f506140f78ebeb92ad2e97019cb0b

Download Submit
C:\Windows\system\FoVXiSU.exe

Filesize
1.2MB

MD5
76ca8b4433fab5587773da1d46b1ed0b

SHA1
09b7be81dff4b21751b4ee2762d0dc8a79f26e8b

SHA256
1e1a6d9da1034714d58b678e4a7954d3ce88846bd5fb94c2e0037051e3ad6d9f

SHA512
f66b26978b856ef35efabe4ba046f276356ad5cdaeebb18d98dd2cfd9bd100fd141f0b7a36d0e0356ce08adc1e9ec9b5463423e7e66f8804abfccafff1f4fd36

Download Submit
C:\Windows\system\GEUsQEH.exe

Filesize
1.2MB

MD5
a45ac01cdc0242e6edf7ef5ff2ebdca3

SHA1
af86f898740e714519ededff75009706c9963427

SHA256
70ff41ca1c4734ed98bf841404f16c58273ac7bec859d31ef6f4cd2a85fdb66d

SHA512
498727258e0690c0195ee61507b18777ac2ccaf33ef783b7db17cd90ea71fe34e0f07f5f5575cc633f937d0e290f39e514b6b5dc378445ace9a27b30cc3f2641

Download Submit
C:\Windows\system\GKgydon.exe

Filesize
1.2MB

MD5
6ffdcc19a950987fb63758847f52cf12

SHA1
43f72d2da1390e380b06efd540037efba53a6d97

SHA256
b8dcf727f8dc7032d8ad73c0404f5fff09df7bcc625ee0d24f14f9afed608603

SHA512
cad697973f77ffba65061fe0e95934c1c4aee3dc936af4d1b1f450ab6c1a749c5da14a60a76d43c9d43a00a39375ee18f8931fd61a423964d8e5f567010223c8

Download Submit
C:\Windows\system\GhqZsyQ.exe

Filesize
1.2MB

MD5
542ccc6c2d7eb87d4fa613714955c54e

SHA1
1c9bb6d54b23758e43e3daf54f0bcbfa2b67ff8f

SHA256
d97e3cfa7430aa831125887c2c0f4db96a1d8bfa148b548b6ce5e7f5b618bc4f

SHA512
cb2a28846d305bd1ca149215723af89a440899eef0ddb05e531736afae6b63daa96434a0794956b56664b187f958b0bc936cd520d66e1b5cd64eed2fc1bf347c

Download Submit
C:\Windows\system\GmpITCW.exe

Filesize
1.2MB

MD5
596948945cab85e162cfa783ee398fb5

SHA1
bffe16f6522dccd546fdb95578e423533e009e84

SHA256
a8030643b82a53ede9af728d9309fc5ef286c944d932691235e7f6a90d912082

SHA512
a2a1740c54ec2cccfd67f3aba3d744f176548a5f6c184a1bcfe7f3212415fc5998ea078f5c4f7785a4a25c82888ea7016be621fc26a59051932c157d5e470b6f

Download Submit
C:\Windows\system\HsCIFIj.exe

Filesize
1.2MB

MD5
9b00f0d617950589b2ff8a5e9fec0d7d

SHA1
686ad9d14dd7917b95411614267f6618551e9853

SHA256
2075f98dd1851fe6d081f55a65097ca887d96d11f2a35155dcab3a667778e409

SHA512
3101effddde7e286559450e323ba8c9c01ac3097310d705f59c2b8640077b8e95796d3be94f35126289f553362141501970bfc9d316f885ee40d770a348ed3ac

Download Submit
C:\Windows\system\KpzCySh.exe

Filesize
1.2MB

MD5
f8ca5bcd6ec5540c6c7d1aa58ed2377f

SHA1
b30ac2494bd17152d4f077322a2252a3eced543d

SHA256
443b6b2a9495c0f4476b441d7b2f60ba348cab25165cd441569b124d70887bcc

SHA512
6e533c2ec1d87d44772604aabf854f157ceeb591731bf99e277fc8666f9d0f50c50be00622f9d3eac01fcea2465dd2c4ecd32ed8969e3e4fba40af9d1d0f0be9

Download Submit
C:\Windows\system\NTCUIrE.exe

Filesize
1.2MB

MD5
3321747683743e0ce5528b79ffb9ac52

SHA1
109715179f37ac2e784089c5b6510380c6f1c604

SHA256
4af36baa34c72cd35abed13f2788f50759ddc5088d4c14930338675ee376039f

SHA512
b56c5316edc6fc9f480c1fe2a6171963af334e04be5077afd52ee2bc7b4e0f4d211c18e6647f15e0e98269c4462702418cc43efbc8889c72943911355dd9b74d

Download Submit
C:\Windows\system\RuiocUz.exe

Filesize
1.2MB

MD5
e8618c08440adddb3b16cfd060982ecf

SHA1
26b4236d1ba29abb92f9bf3889715a948d34f339

SHA256
75310594dea5212bf0c75809922609664c2a601d37b209e34a7c1ab251cc4510

SHA512
cb420cd7cfc74f2916d22b207b686c52861e7e5fa9c7aea7e4071a9052c8e436605981dd8433b1c17dda7898f76ba663c13b52554e2c42655146f381e08137f2

Download Submit
C:\Windows\system\SeHcpXn.exe

Filesize
1.2MB

MD5
596dfb85be3927af3061492bc85f85a3

SHA1
f55d2f7538e5e131d2fea65910795142de996f8c

SHA256
4c24eb01f92eca33da2983634f8dbd20d8ccbdfb9704775822d0338b746ca98c

SHA512
0994d4f16b8812e1484f1fe32bbb223a098e0e63df14417d6b3e35417e8dbdef0f3c17351e100203390a969b9bbe4b586aa4737a83992cbd0d390cb5847fffae

Download Submit
C:\Windows\system\TFNVlCJ.exe

Filesize
1.2MB

MD5
d009b972d4ce00f76b8d7b9d4e365561

SHA1
b83bc3cb148bf5c5001e81e3f31f80f482c8087a

SHA256
06dc921ba7a10683cc9bb6234762c6c0d5455fe7abf23940afc6e05f8db8cadc

SHA512
12ae82a8575cc0c136d06047cbcf1f779b0e666e19671716027ead2cb60db485d57b8cf74eeaa264c5b6a49fe1953ca3c07ed790f67df06dd18c0d90effb9d2c

Download Submit
C:\Windows\system\TKUlPzd.exe

Filesize
1.2MB

MD5
552a60f8b8bc9945c613c29a890d9e5d

SHA1
bc1da5acd998c0092616b6f72f31c80db19383ac

SHA256
8743b532b36a3828d3c7f7074cf46924b447715ef6421e9046116161d4b8d8f3

SHA512
c06aa627ea9f0b301ec9fe49d4654eccfaf784959bad7e2a654c4950563e7c418006b75c18ecd101464024ff6c021e8f8215a7d631f21a2097ee636591c0fe38

Download Submit
C:\Windows\system\TcGvVnc.exe

Filesize
1.2MB

MD5
c829966d389e07f02a3da76ab897ae41

SHA1
e9d7603a1a441fb1aa7d2babd2c7d6a6e4ace10c

SHA256
210e3598f277dd0c820012c58d372eed289b7d1a36de2a9372b85a8d07add85f

SHA512
78842f089eb67363514cbcd67dc5436f593f5c33f4a28aa05e794af616376d4c5a028db1e8f5e926200c8806e43aeaa01acd44dccb7eb7fc430740d5077a2f6a

Download Submit
C:\Windows\system\UHeanSz.exe

Filesize
1.2MB

MD5
1391d9d957cdd563ced7ba190c83d222

SHA1
1fa3b5edb45292dcb6e4e6a70da5ceff19de986d

SHA256
fb322531b1d2b5db515e5e96105c10ca2bb56ebdd750be5091b090238b1fcd69

SHA512
3300e9182095170e656cdca689ff46dee34053a598108cf7c0ec99ebcb4711a27a1cec634928e8fd470fb308897dd80bba336e2b350f5d52265cc665622f157c

Download Submit
C:\Windows\system\XRMxxys.exe

Filesize
1.2MB

MD5
7406a4c2b4f962a4c5c6301877078a9a

SHA1
32ce33aafa4b8548cb04b48fae222e6b600fb43b

SHA256
95116ef465b8d6288ad2bb8a9f88f83402acb5fb23ef598bac8a60e184482b70

SHA512
de7b20421b35ee7232ab2aca4de58952a76bbc54672a9b997f3e8784090f939b97799ea1b82802fc14b0f59356c2fb05db9b86b355a2568f1eca373c4526fa96

Download Submit
C:\Windows\system\elpYCdf.exe

Filesize
1.2MB

MD5
82e91ae3ad233ea3ec599923d9ac2fee

SHA1
b38493e074f53daf4fb72bf423d1b5a667203d20

SHA256
5f049d9e66fced425880977fea335b97a37011eb4e6101de7b47d0d4abe97434

SHA512
270d7b030387d8750c8869b3dab82233a59736e8c8047ff71c63219056fac32d9ad1e35d14ade467a73354ee4b3c88edf9c0507458f458f8de7f71c875dfc6fd

Download Submit
C:\Windows\system\euAVyQB.exe

Filesize
1.2MB

MD5
188d2e6669e8813c39ed6632757580ec

SHA1
d0b47be2f43a344d0d6bb25c8babf68a1ccfdce4

SHA256
67ce5f8db3d8b455e86d99969154a42f01bd8a5bc3b2d374143b4d19df6c02a3

SHA512
430f5093cc378244bdf5db7f8af8627b083e5e8c4008f4945113a733ec52170d3989e5dee550a37f4b865652d1d655867b5ee470fd0a5d81906bd5d6c86a2fea

Download Submit
C:\Windows\system\giOCWry.exe

Filesize
1.2MB

MD5
b1f590bcf1c3925b5c76a4ef14813de1

SHA1
3e9921893232fadd80210c190c20340a36a7fc8d

SHA256
c67c1bf45ba2cd372a24b1afa1e9f92aaa71c0e7e92c9fe9e9056e1063c3b439

SHA512
5cffc1633cad562c72b26929faa39cf53211f71dd51417893c1875c2512469c4f7fac570428aad5a21656c6efa71fb8c93db011b9e5ed2b3c5f295a928c709e6

Download Submit
C:\Windows\system\gsBESvK.exe

Filesize
1.2MB

MD5
94408901b8a1d9dcfc447b408fcf46ed

SHA1
b7273c72de74d8db3e578fe4996f3b29926f2c95

SHA256
e0576b381e6417fb7347363cdb256388da518bf45ad4ebb5dd7eccc5d9dc6876

SHA512
2b35e4a8aef9439e162ccc24ed12f6acb0bf61521032f8b2d33ec8fbed6a34b3916f34144ca1d563b8781b2dd6fbf8e2c3c9d8df1b67894429e8e68ae3df8668

Download Submit
C:\Windows\system\hbCmWsy.exe

Filesize
1.2MB

MD5
5c6b848e2ba2cb410254327003c7000f

SHA1
78ce6a68d4592898ffcd6f335bd597c62d2f04a3

SHA256
24142321ff735c908cc2fa8c5fcb7ee03ca0feede743a829a608b7d36b124755

SHA512
4283e534798a1bb0cad8ffdb887984d7770472dcc52d66432a47c51187be39645ad7fce55fc615a373811d066e8ef1526358964e842ebec48a9316e58d389162

Download Submit
C:\Windows\system\iABGxZV.exe

Filesize
1.2MB

MD5
431b3d628449e55fa40f1551a95f4fd2

SHA1
373c13f508854fac78fa01f4876604f7ca2fbd01

SHA256
ce181ca232607bfed96de7327cada530f3ec413e365f37f873b9d613096804f5

SHA512
aa2659e6a83bc6f13ce5a4ec531a20270185a1cd1da7ceb88ed9f507062e649a68d410ae83dff26438ac6303bdf0b5a64f728f4f03aa9dd387119afa5f88456d

Download Submit
C:\Windows\system\inFChCC.exe

Filesize
1.2MB

MD5
370f8c07e6dc354ccdc314564a1a3935

SHA1
e78e46b8127282449170899930f35d6acb401f4f

SHA256
ce8301a7c57d90178685d05e67996b609fc3350b6977fb4207ca76ef83e2151c

SHA512
21e2f7c7e9251c034c34606b177c78440b7c0c5e6ccaa798ddf99560b858efe1e53e8ef8d19c123301f9c54704989118086a303ce236b17b36519c6ac4f7cff4

Download Submit
C:\Windows\system\kdUpjVd.exe

Filesize
1.2MB

MD5
6d96a4564afc3876e61af1f8477ee903

SHA1
3907d65aa663661c3e2123a8db1f2b903acbc40e

SHA256
7c0426c0e67535db918fc800f24b12c707cb4ac85d0cecbe2d3b8057e6c363e3

SHA512
f802d22e7cdc319f80e391d0631b3a8e7d5c1b6245fef0232109e5fb150b72d59bf3db2697fb8f7bb445929ff2844090031030d65eca591d41a3ca930f67f5aa

Download Submit
C:\Windows\system\mkoQoTt.exe

Filesize
1.2MB

MD5
782fa0e831fc8a2c52edef5a1877a604

SHA1
ff3e14fb5102f1b5ed5bd728d5dc9aeed105c660

SHA256
7421e5931bdc86000d6130e52bce86b8c68b2e08c79bb180712a84eb0e6b5e1f

SHA512
863627541f6dc0d0b4c229a9021405fe11a48d092f6a07f92465a5c2ab9def616305d29ee40cd2be14bb66960ee69c2e7937a7788960f7ed82e3cc42a4355855

Download Submit
C:\Windows\system\rKHvdFF.exe

Filesize
1.2MB

MD5
1c67fce8e378983cdeba4c024cf65346

SHA1
113924d9764cbea2fb91df22996812de5f5b0a5d

SHA256
33f4b1491468b8edcdfe89a8c44e0faf37859a59c4636042f687df2ddc74eb76

SHA512
2780f16002787f0269f7d7651b2b2871d3ad72fd91ddbb1bb8167c93be7e4ca04ed779451a696a98825777b07bbd62ebbe14ed4e4472ecf6c13a5ec2853b6600

Download Submit
C:\Windows\system\rtdVoEQ.exe

Filesize
1.2MB

MD5
d6fca0e5a816ab7bda1bf20b9cac985b

SHA1
b26ef019fa3f95830ed2802ba26fbc29b883a382

SHA256
0ec39297a4da878e5de805381a5fc51bab87dfecd42830deb68aa846234af584

SHA512
b9a6031215562ed212ea45b2190802fdeab861384f764acfcb1b0be6be675fdc2df11df9f50000f07a115ee77a9f65d1568fb022159dfcbeb07364d13cfd0fbb

Download Submit
C:\Windows\system\ztKioyu.exe

Filesize
1.2MB

MD5
5dba223b2334a296f5422767a6122df8

SHA1
5a203c1ce5fcc33eaef5cec0fbae94f7ae4a8095

SHA256
f0dd5b7003d3b78a7c5c46bf76e93c9cda98c54c29bf60684f8e2ba43be26f1c

SHA512
68561224f9087c85c76c25c6002639214d5d79bca3fb5e412e8a597c0809d700b46c2c5c70c96ae7a5d3007c905c679356e6ff9292d8b49321916ea4fc515306

Download Submit
memory/2412-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download