xmrig | 23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409

Analysis

max time kernel
148s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
Size

1.3MB
MD5

db538c66cfec86dccbfb365f8376adcd
SHA1

24baf9edd267242203115cd15830bdbeaf7c3ed5
SHA256

23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409
SHA512

b8b45872529887165d193770a9b7c75689b9cd26d30469ff4782ee1f139f3bfe03593034f97e8c3f6fa07a1629cc5d7a3de9feab6a8982df19546153ac3d1951
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4BK4+3ZRjN/jcLv7:GezaTF8FcNkNdfE0pZ9ozttwIRakGKNe

Score

10^/10

xmrig discovery miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000a00000001225f-2.dat	xmrig
behavioral1/files/0x0008000000019329-9.dat	xmrig
behavioral1/files/0x0007000000019345-13.dat	xmrig
behavioral1/files/0x000600000001937b-24.dat	xmrig
behavioral1/files/0x0006000000019382-29.dat	xmrig
behavioral1/files/0x000500000001a452-64.dat	xmrig
behavioral1/files/0x000500000001a472-89.dat	xmrig
behavioral1/files/0x000500000001a47c-100.dat	xmrig
behavioral1/files/0x000500000001a48f-144.dat	xmrig
behavioral1/files/0x000500000001a493-154.dat	xmrig
behavioral1/files/0x000500000001a495-160.dat	xmrig
behavioral1/files/0x000500000001a491-150.dat	xmrig
behavioral1/files/0x000500000001a48d-140.dat	xmrig
behavioral1/files/0x000500000001a489-130.dat	xmrig
behavioral1/files/0x000500000001a48b-134.dat	xmrig
behavioral1/files/0x000500000001a485-120.dat	xmrig
behavioral1/files/0x000500000001a481-110.dat	xmrig
behavioral1/files/0x000500000001a487-124.dat	xmrig
behavioral1/files/0x000500000001a483-114.dat	xmrig
behavioral1/files/0x000500000001a47f-104.dat	xmrig
behavioral1/files/0x000500000001a478-94.dat	xmrig
behavioral1/files/0x000500000001a470-85.dat	xmrig
behavioral1/files/0x000500000001a46d-79.dat	xmrig
behavioral1/files/0x000500000001a463-74.dat	xmrig
behavioral1/files/0x000500000001a454-69.dat	xmrig
behavioral1/files/0x000500000001a447-59.dat	xmrig
behavioral1/files/0x000500000001a445-55.dat	xmrig
behavioral1/files/0x00070000000195d0-49.dat	xmrig
behavioral1/files/0x00080000000193d1-45.dat	xmrig
behavioral1/files/0x00080000000193a8-40.dat	xmrig
behavioral1/files/0x000600000001938e-35.dat	xmrig
behavioral1/files/0x0007000000019369-19.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
696	ZBxRdbu.exe
2176	xwzGktX.exe
952	OBbSYTP.exe
2828	KoIgJLn.exe
1424	LUDXqCx.exe
2760	DtCneQa.exe
2872	OtJehqF.exe
3020	xuFZnRL.exe
2820	AntcOlJ.exe
2844	bxIJsLn.exe
2928	qqiscZn.exe
2812	LquEiQs.exe
2668	TMflIxn.exe
2624	DcySeSn.exe
2688	NitdNtJ.exe
2664	BVExyWw.exe
2052	EfPHeCX.exe
548	EyUtuCN.exe
1456	MJtVWFi.exe
1100	AjqmIpC.exe
2516	hpCtbCy.exe
2196	lmDZUYY.exe
628	QpdLhWm.exe
1448	JTYxFom.exe
1868	boiTppR.exe
2976	EXufQyP.exe
2924	IhrCoXh.exe
2292	JigiFxi.exe
1904	GfxBbGX.exe
2180	IeAmrFX.exe
1752	mRIsisz.exe
448	iyhMKwx.exe
2428	RRzmklt.exe
3016	HjgLaxn.exe
1216	BXvqqlf.exe
276	IVNiECt.exe
1792	whXoZDH.exe
2672	VCZYwzH.exe
1464	uzOuQss.exe
1708	hjFTXwm.exe
844	aQZzbXj.exe
1980	fgBiXSO.exe
1272	jAzfSDw.exe
936	epWZWOD.exe
540	YCGdNOg.exe
1632	yUnunrw.exe
2380	ZApsBlp.exe
1288	QQBKLqz.exe
684	zQaDMdB.exe
2532	taJrBfU.exe
1944	bpWSyaG.exe
896	mXhYbDx.exe
1940	iRAlqhL.exe
884	RsXwyAm.exe
2412	PeCnINV.exe
2360	NabkqcA.exe
1536	mXluMMm.exe
592	GQZCizb.exe
580	OROaBTD.exe
2468	gGnTzSH.exe
2300	CyvqRpn.exe
2768	yqSTnVg.exe
2492	goRGCvj.exe
2064	UTBcrgE.exe

Loads dropped DLL 64 IoCs

pid	Process
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dzHmydl.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\XwaLuvo.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\rqAYlox.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\UCvCTvP.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\vDtqgPO.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\BTlkxSk.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\HaalKaF.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\XPhCWmr.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\dPOPHfE.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\TKITsVw.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\uNNAcfw.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\WlXQACm.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\vhkBjqb.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\oeTdukl.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\FBMrBEL.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\VcCbPFc.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\klPmiyy.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\GKBUdSK.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\FJRhyDg.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\xMUwBmR.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\VBsJlXO.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\QrPwUSn.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\fNeoBaB.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\uqEvghO.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\DTCCKYO.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\WTuDcSl.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\xZiJHXj.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\tAmOGfS.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\NIpUmui.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\ZvMAsHn.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\xdwUPeC.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\elCaiiv.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\TgsJPmW.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\Ojfwzih.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\lGsuFOE.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\aIkSPeY.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\CcoxDaw.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\lyCAImG.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\hCOTTSj.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\QCkLGvV.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\tehiyTv.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\yzNPtoH.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\BZPMXto.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\gShIdKY.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\NDvAxzP.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\mDvPNOC.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\JLrQufl.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\nJHSYSS.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\LrLmORq.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\GisBaBG.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\Xmedozo.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\igHnYjF.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\bMcHjcq.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\JigiFxi.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\kNSryNV.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\KxRTyuG.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\FdxGPIy.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\ECxwloI.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\RsWMPNO.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\EAzuhQJ.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\WTRTTym.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\DNuDESW.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\gJTHtRz.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
File created	C:\Windows\System\oHWXGDf.exe	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
8972	pingrbw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 696	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	31
PID 2384 wrote to memory of 696	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	31
PID 2384 wrote to memory of 696	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	31
PID 2384 wrote to memory of 2176	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	32
PID 2384 wrote to memory of 2176	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	32
PID 2384 wrote to memory of 2176	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	32
PID 2384 wrote to memory of 952	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	33
PID 2384 wrote to memory of 952	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	33
PID 2384 wrote to memory of 952	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	33
PID 2384 wrote to memory of 2828	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	34
PID 2384 wrote to memory of 2828	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	34
PID 2384 wrote to memory of 2828	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	34
PID 2384 wrote to memory of 1424	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	35
PID 2384 wrote to memory of 1424	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	35
PID 2384 wrote to memory of 1424	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	35
PID 2384 wrote to memory of 2760	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	36
PID 2384 wrote to memory of 2760	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	36
PID 2384 wrote to memory of 2760	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	36
PID 2384 wrote to memory of 2872	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	37
PID 2384 wrote to memory of 2872	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	37
PID 2384 wrote to memory of 2872	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	37
PID 2384 wrote to memory of 3020	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	38
PID 2384 wrote to memory of 3020	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	38
PID 2384 wrote to memory of 3020	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	38
PID 2384 wrote to memory of 2820	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	39
PID 2384 wrote to memory of 2820	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	39
PID 2384 wrote to memory of 2820	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	39
PID 2384 wrote to memory of 2844	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	40
PID 2384 wrote to memory of 2844	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	40
PID 2384 wrote to memory of 2844	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	40
PID 2384 wrote to memory of 2928	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	41
PID 2384 wrote to memory of 2928	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	41
PID 2384 wrote to memory of 2928	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	41
PID 2384 wrote to memory of 2812	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	42
PID 2384 wrote to memory of 2812	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	42
PID 2384 wrote to memory of 2812	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	42
PID 2384 wrote to memory of 2668	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	43
PID 2384 wrote to memory of 2668	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	43
PID 2384 wrote to memory of 2668	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	43
PID 2384 wrote to memory of 2624	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	44
PID 2384 wrote to memory of 2624	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	44
PID 2384 wrote to memory of 2624	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	44
PID 2384 wrote to memory of 2688	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	45
PID 2384 wrote to memory of 2688	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	45
PID 2384 wrote to memory of 2688	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	45
PID 2384 wrote to memory of 2664	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	46
PID 2384 wrote to memory of 2664	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	46
PID 2384 wrote to memory of 2664	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	46
PID 2384 wrote to memory of 2052	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	47
PID 2384 wrote to memory of 2052	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	47
PID 2384 wrote to memory of 2052	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	47
PID 2384 wrote to memory of 548	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	48
PID 2384 wrote to memory of 548	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	48
PID 2384 wrote to memory of 548	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	48
PID 2384 wrote to memory of 1456	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	49
PID 2384 wrote to memory of 1456	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	49
PID 2384 wrote to memory of 1456	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	49
PID 2384 wrote to memory of 1100	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	50
PID 2384 wrote to memory of 1100	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	50
PID 2384 wrote to memory of 1100	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	50
PID 2384 wrote to memory of 2516	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	51
PID 2384 wrote to memory of 2516	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	51
PID 2384 wrote to memory of 2516	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	51
PID 2384 wrote to memory of 2196	2384	23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe	52

C:\Users\Admin\AppData\Local\Temp\23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe
"C:\Users\Admin\AppData\Local\Temp\23c229ca5be21e4b7c7c876104cbe6b9dbbed05f70dcbb80ddfefb32abf3b409.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\System\ZBxRdbu.exe
  C:\Windows\System\ZBxRdbu.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\xwzGktX.exe
  C:\Windows\System\xwzGktX.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\OBbSYTP.exe
  C:\Windows\System\OBbSYTP.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\KoIgJLn.exe
  C:\Windows\System\KoIgJLn.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\LUDXqCx.exe
  C:\Windows\System\LUDXqCx.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\DtCneQa.exe
  C:\Windows\System\DtCneQa.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\OtJehqF.exe
  C:\Windows\System\OtJehqF.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\xuFZnRL.exe
  C:\Windows\System\xuFZnRL.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\AntcOlJ.exe
  C:\Windows\System\AntcOlJ.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\bxIJsLn.exe
  C:\Windows\System\bxIJsLn.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\qqiscZn.exe
  C:\Windows\System\qqiscZn.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\LquEiQs.exe
  C:\Windows\System\LquEiQs.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\TMflIxn.exe
  C:\Windows\System\TMflIxn.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\DcySeSn.exe
  C:\Windows\System\DcySeSn.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\NitdNtJ.exe
  C:\Windows\System\NitdNtJ.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\BVExyWw.exe
  C:\Windows\System\BVExyWw.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\EfPHeCX.exe
  C:\Windows\System\EfPHeCX.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\EyUtuCN.exe
  C:\Windows\System\EyUtuCN.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\MJtVWFi.exe
  C:\Windows\System\MJtVWFi.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\AjqmIpC.exe
  C:\Windows\System\AjqmIpC.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\hpCtbCy.exe
  C:\Windows\System\hpCtbCy.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\lmDZUYY.exe
  C:\Windows\System\lmDZUYY.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\QpdLhWm.exe
  C:\Windows\System\QpdLhWm.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\JTYxFom.exe
  C:\Windows\System\JTYxFom.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\boiTppR.exe
  C:\Windows\System\boiTppR.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\EXufQyP.exe
  C:\Windows\System\EXufQyP.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\IhrCoXh.exe
  C:\Windows\System\IhrCoXh.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\JigiFxi.exe
  C:\Windows\System\JigiFxi.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\GfxBbGX.exe
  C:\Windows\System\GfxBbGX.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\IeAmrFX.exe
  C:\Windows\System\IeAmrFX.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\mRIsisz.exe
  C:\Windows\System\mRIsisz.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\iyhMKwx.exe
  C:\Windows\System\iyhMKwx.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\RRzmklt.exe
  C:\Windows\System\RRzmklt.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\HjgLaxn.exe
  C:\Windows\System\HjgLaxn.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\BXvqqlf.exe
  C:\Windows\System\BXvqqlf.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\IVNiECt.exe
  C:\Windows\System\IVNiECt.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\whXoZDH.exe
  C:\Windows\System\whXoZDH.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\VCZYwzH.exe
  C:\Windows\System\VCZYwzH.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\uzOuQss.exe
  C:\Windows\System\uzOuQss.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\hjFTXwm.exe
  C:\Windows\System\hjFTXwm.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\aQZzbXj.exe
  C:\Windows\System\aQZzbXj.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\fgBiXSO.exe
  C:\Windows\System\fgBiXSO.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\jAzfSDw.exe
  C:\Windows\System\jAzfSDw.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\epWZWOD.exe
  C:\Windows\System\epWZWOD.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\YCGdNOg.exe
  C:\Windows\System\YCGdNOg.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\yUnunrw.exe
  C:\Windows\System\yUnunrw.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\ZApsBlp.exe
  C:\Windows\System\ZApsBlp.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\QQBKLqz.exe
  C:\Windows\System\QQBKLqz.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\zQaDMdB.exe
  C:\Windows\System\zQaDMdB.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\taJrBfU.exe
  C:\Windows\System\taJrBfU.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\bpWSyaG.exe
  C:\Windows\System\bpWSyaG.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\mXhYbDx.exe
  C:\Windows\System\mXhYbDx.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\iRAlqhL.exe
  C:\Windows\System\iRAlqhL.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\RsXwyAm.exe
  C:\Windows\System\RsXwyAm.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\PeCnINV.exe
  C:\Windows\System\PeCnINV.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\NabkqcA.exe
  C:\Windows\System\NabkqcA.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\mXluMMm.exe
  C:\Windows\System\mXluMMm.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\GQZCizb.exe
  C:\Windows\System\GQZCizb.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\OROaBTD.exe
  C:\Windows\System\OROaBTD.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\gGnTzSH.exe
  C:\Windows\System\gGnTzSH.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\CyvqRpn.exe
  C:\Windows\System\CyvqRpn.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\yqSTnVg.exe
  C:\Windows\System\yqSTnVg.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\goRGCvj.exe
  C:\Windows\System\goRGCvj.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\UTBcrgE.exe
  C:\Windows\System\UTBcrgE.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\ULfSKfQ.exe
  C:\Windows\System\ULfSKfQ.exe
  2⤵
  PID:2780
- C:\Windows\System\NOdXvRV.exe
  C:\Windows\System\NOdXvRV.exe
  2⤵
  PID:2656
- C:\Windows\System\dFUkuzm.exe
  C:\Windows\System\dFUkuzm.exe
  2⤵
  PID:1180
- C:\Windows\System\EhYDXpo.exe
  C:\Windows\System\EhYDXpo.exe
  2⤵
  PID:636
- C:\Windows\System\kWJIdTP.exe
  C:\Windows\System\kWJIdTP.exe
  2⤵
  PID:1880
- C:\Windows\System\vmOHSlp.exe
  C:\Windows\System\vmOHSlp.exe
  2⤵
  PID:800
- C:\Windows\System\bjzGKau.exe
  C:\Windows\System\bjzGKau.exe
  2⤵
  PID:2968
- C:\Windows\System\zaXaDFN.exe
  C:\Windows\System\zaXaDFN.exe
  2⤵
  PID:1668
- C:\Windows\System\XaQmJaH.exe
  C:\Windows\System\XaQmJaH.exe
  2⤵
  PID:1872
- C:\Windows\System\FQmoyrA.exe
  C:\Windows\System\FQmoyrA.exe
  2⤵
  PID:2228
- C:\Windows\System\qNzLhIy.exe
  C:\Windows\System\qNzLhIy.exe
  2⤵
  PID:2100
- C:\Windows\System\dCGFZcF.exe
  C:\Windows\System\dCGFZcF.exe
  2⤵
  PID:2272
- C:\Windows\System\RoUBdUT.exe
  C:\Windows\System\RoUBdUT.exe
  2⤵
  PID:408
- C:\Windows\System\HpTpcwy.exe
  C:\Windows\System\HpTpcwy.exe
  2⤵
  PID:1204
- C:\Windows\System\tnyTaYQ.exe
  C:\Windows\System\tnyTaYQ.exe
  2⤵
  PID:688
- C:\Windows\System\zjXoQcn.exe
  C:\Windows\System\zjXoQcn.exe
  2⤵
  PID:1968
- C:\Windows\System\VKAzsTR.exe
  C:\Windows\System\VKAzsTR.exe
  2⤵
  PID:2416
- C:\Windows\System\wRvJwTr.exe
  C:\Windows\System\wRvJwTr.exe
  2⤵
  PID:1720
- C:\Windows\System\dMGdSVD.exe
  C:\Windows\System\dMGdSVD.exe
  2⤵
  PID:2280
- C:\Windows\System\mDvPNOC.exe
  C:\Windows\System\mDvPNOC.exe
  2⤵
  PID:748
- C:\Windows\System\XboZFbj.exe
  C:\Windows\System\XboZFbj.exe
  2⤵
  PID:2424
- C:\Windows\System\UbCptqN.exe
  C:\Windows\System\UbCptqN.exe
  2⤵
  PID:3000
- C:\Windows\System\VYfngMp.exe
  C:\Windows\System\VYfngMp.exe
  2⤵
  PID:2224
- C:\Windows\System\NIaadSA.exe
  C:\Windows\System\NIaadSA.exe
  2⤵
  PID:1596
- C:\Windows\System\SdRWGza.exe
  C:\Windows\System\SdRWGza.exe
  2⤵
  PID:1088
- C:\Windows\System\EgSPitd.exe
  C:\Windows\System\EgSPitd.exe
  2⤵
  PID:2096
- C:\Windows\System\yVCChYs.exe
  C:\Windows\System\yVCChYs.exe
  2⤵
  PID:2356
- C:\Windows\System\iPoImUO.exe
  C:\Windows\System\iPoImUO.exe
  2⤵
  PID:2404
- C:\Windows\System\ZcLhMyz.exe
  C:\Windows\System\ZcLhMyz.exe
  2⤵
  PID:1540
- C:\Windows\System\MEoWawg.exe
  C:\Windows\System\MEoWawg.exe
  2⤵
  PID:2852
- C:\Windows\System\xycnBof.exe
  C:\Windows\System\xycnBof.exe
  2⤵
  PID:2160
- C:\Windows\System\FDYKiKs.exe
  C:\Windows\System\FDYKiKs.exe
  2⤵
  PID:2804
- C:\Windows\System\vuFhNAL.exe
  C:\Windows\System\vuFhNAL.exe
  2⤵
  PID:2660
- C:\Windows\System\jRWCJhq.exe
  C:\Windows\System\jRWCJhq.exe
  2⤵
  PID:2208
- C:\Windows\System\AjtCFio.exe
  C:\Windows\System\AjtCFio.exe
  2⤵
  PID:2836
- C:\Windows\System\FBMrBEL.exe
  C:\Windows\System\FBMrBEL.exe
  2⤵
  PID:876
- C:\Windows\System\kFTNXCF.exe
  C:\Windows\System\kFTNXCF.exe
  2⤵
  PID:1496
- C:\Windows\System\MxJZUIn.exe
  C:\Windows\System\MxJZUIn.exe
  2⤵
  PID:1648
- C:\Windows\System\xOaFbKz.exe
  C:\Windows\System\xOaFbKz.exe
  2⤵
  PID:2444
- C:\Windows\System\gXzDMBe.exe
  C:\Windows\System\gXzDMBe.exe
  2⤵
  PID:2436
- C:\Windows\System\zIdAEiD.exe
  C:\Windows\System\zIdAEiD.exe
  2⤵
  PID:2504
- C:\Windows\System\ntRekmT.exe
  C:\Windows\System\ntRekmT.exe
  2⤵
  PID:856
- C:\Windows\System\dYnJuZy.exe
  C:\Windows\System\dYnJuZy.exe
  2⤵
  PID:1784
- C:\Windows\System\tWvuPZj.exe
  C:\Windows\System\tWvuPZj.exe
  2⤵
  PID:1468
- C:\Windows\System\iyfbkOq.exe
  C:\Windows\System\iyfbkOq.exe
  2⤵
  PID:2248
- C:\Windows\System\PSFtGSx.exe
  C:\Windows\System\PSFtGSx.exe
  2⤵
  PID:2540
- C:\Windows\System\NMyAqIx.exe
  C:\Windows\System\NMyAqIx.exe
  2⤵
  PID:2552
- C:\Windows\System\ojnmESW.exe
  C:\Windows\System\ojnmESW.exe
  2⤵
  PID:2560
- C:\Windows\System\TtGpmyc.exe
  C:\Windows\System\TtGpmyc.exe
  2⤵
  PID:3068
- C:\Windows\System\ypolANT.exe
  C:\Windows\System\ypolANT.exe
  2⤵
  PID:2704
- C:\Windows\System\JcDFOPp.exe
  C:\Windows\System\JcDFOPp.exe
  2⤵
  PID:1504
- C:\Windows\System\bVQvcLu.exe
  C:\Windows\System\bVQvcLu.exe
  2⤵
  PID:3008
- C:\Windows\System\VxFJPtM.exe
  C:\Windows\System\VxFJPtM.exe
  2⤵
  PID:3076
- C:\Windows\System\ioxRLSn.exe
  C:\Windows\System\ioxRLSn.exe
  2⤵
  PID:3096
- C:\Windows\System\FDqzdUy.exe
  C:\Windows\System\FDqzdUy.exe
  2⤵
  PID:3116
- C:\Windows\System\dPOPHfE.exe
  C:\Windows\System\dPOPHfE.exe
  2⤵
  PID:3132
- C:\Windows\System\TMFvLlR.exe
  C:\Windows\System\TMFvLlR.exe
  2⤵
  PID:3152
- C:\Windows\System\AvDLndJ.exe
  C:\Windows\System\AvDLndJ.exe
  2⤵
  PID:3168
- C:\Windows\System\vfsGanV.exe
  C:\Windows\System\vfsGanV.exe
  2⤵
  PID:3192
- C:\Windows\System\nAUpiuF.exe
  C:\Windows\System\nAUpiuF.exe
  2⤵
  PID:3208
- C:\Windows\System\mvaofuB.exe
  C:\Windows\System\mvaofuB.exe
  2⤵
  PID:3228
- C:\Windows\System\PlQexKL.exe
  C:\Windows\System\PlQexKL.exe
  2⤵
  PID:3248
- C:\Windows\System\fIhykSP.exe
  C:\Windows\System\fIhykSP.exe
  2⤵
  PID:3276
- C:\Windows\System\QuLjicF.exe
  C:\Windows\System\QuLjicF.exe
  2⤵
  PID:3296
- C:\Windows\System\IvMezWu.exe
  C:\Windows\System\IvMezWu.exe
  2⤵
  PID:3316
- C:\Windows\System\VvLoLBi.exe
  C:\Windows\System\VvLoLBi.exe
  2⤵
  PID:3336
- C:\Windows\System\fgPbWFx.exe
  C:\Windows\System\fgPbWFx.exe
  2⤵
  PID:3352
- C:\Windows\System\fYaxgyj.exe
  C:\Windows\System\fYaxgyj.exe
  2⤵
  PID:3372
- C:\Windows\System\iEtRzBN.exe
  C:\Windows\System\iEtRzBN.exe
  2⤵
  PID:3392
- C:\Windows\System\qYKCaau.exe
  C:\Windows\System\qYKCaau.exe
  2⤵
  PID:3412
- C:\Windows\System\nvNxHVM.exe
  C:\Windows\System\nvNxHVM.exe
  2⤵
  PID:3432
- C:\Windows\System\vvFgKzL.exe
  C:\Windows\System\vvFgKzL.exe
  2⤵
  PID:3452
- C:\Windows\System\hDeaQPK.exe
  C:\Windows\System\hDeaQPK.exe
  2⤵
  PID:3472
- C:\Windows\System\jXhMdiV.exe
  C:\Windows\System\jXhMdiV.exe
  2⤵
  PID:3492
- C:\Windows\System\mXGSQlH.exe
  C:\Windows\System\mXGSQlH.exe
  2⤵
  PID:3512
- C:\Windows\System\RYZJMNo.exe
  C:\Windows\System\RYZJMNo.exe
  2⤵
  PID:3536
- C:\Windows\System\vYyBhwr.exe
  C:\Windows\System\vYyBhwr.exe
  2⤵
  PID:3552
- C:\Windows\System\RzGHpNy.exe
  C:\Windows\System\RzGHpNy.exe
  2⤵
  PID:3568
- C:\Windows\System\MaGQETw.exe
  C:\Windows\System\MaGQETw.exe
  2⤵
  PID:3592
- C:\Windows\System\CIrkfbK.exe
  C:\Windows\System\CIrkfbK.exe
  2⤵
  PID:3612
- C:\Windows\System\QCkLGvV.exe
  C:\Windows\System\QCkLGvV.exe
  2⤵
  PID:3632
- C:\Windows\System\ZLTvsdM.exe
  C:\Windows\System\ZLTvsdM.exe
  2⤵
  PID:3648
- C:\Windows\System\qiXaUjH.exe
  C:\Windows\System\qiXaUjH.exe
  2⤵
  PID:3676
- C:\Windows\System\qpKbRmk.exe
  C:\Windows\System\qpKbRmk.exe
  2⤵
  PID:3692
- C:\Windows\System\xpAtxRk.exe
  C:\Windows\System\xpAtxRk.exe
  2⤵
  PID:3712
- C:\Windows\System\UalbvcT.exe
  C:\Windows\System\UalbvcT.exe
  2⤵
  PID:3728
- C:\Windows\System\YGUODZl.exe
  C:\Windows\System\YGUODZl.exe
  2⤵
  PID:3744
- C:\Windows\System\ZeOYrpm.exe
  C:\Windows\System\ZeOYrpm.exe
  2⤵
  PID:3768
- C:\Windows\System\YLjHfKb.exe
  C:\Windows\System\YLjHfKb.exe
  2⤵
  PID:3792
- C:\Windows\System\cUAAOJf.exe
  C:\Windows\System\cUAAOJf.exe
  2⤵
  PID:3812
- C:\Windows\System\ohniZcm.exe
  C:\Windows\System\ohniZcm.exe
  2⤵
  PID:3832
- C:\Windows\System\uirRvaa.exe
  C:\Windows\System\uirRvaa.exe
  2⤵
  PID:3848
- C:\Windows\System\sszdHAP.exe
  C:\Windows\System\sszdHAP.exe
  2⤵
  PID:3868
- C:\Windows\System\SQAkqzW.exe
  C:\Windows\System\SQAkqzW.exe
  2⤵
  PID:3888
- C:\Windows\System\utEbnYo.exe
  C:\Windows\System\utEbnYo.exe
  2⤵
  PID:3908
- C:\Windows\System\nghFQNt.exe
  C:\Windows\System\nghFQNt.exe
  2⤵
  PID:3924
- C:\Windows\System\ncVGqPa.exe
  C:\Windows\System\ncVGqPa.exe
  2⤵
  PID:3952
- C:\Windows\System\viNZLKd.exe
  C:\Windows\System\viNZLKd.exe
  2⤵
  PID:3968
- C:\Windows\System\GKBHexo.exe
  C:\Windows\System\GKBHexo.exe
  2⤵
  PID:3984
- C:\Windows\System\jLCOHxj.exe
  C:\Windows\System\jLCOHxj.exe
  2⤵
  PID:4000
- C:\Windows\System\TdRCEDi.exe
  C:\Windows\System\TdRCEDi.exe
  2⤵
  PID:4028
- C:\Windows\System\pXIRERM.exe
  C:\Windows\System\pXIRERM.exe
  2⤵
  PID:4044
- C:\Windows\System\VOJTyYA.exe
  C:\Windows\System\VOJTyYA.exe
  2⤵
  PID:4060
- C:\Windows\System\bIevcMh.exe
  C:\Windows\System\bIevcMh.exe
  2⤵
  PID:4076
- C:\Windows\System\qilglYR.exe
  C:\Windows\System\qilglYR.exe
  2⤵
  PID:4092
- C:\Windows\System\UCvCTvP.exe
  C:\Windows\System\UCvCTvP.exe
  2⤵
  PID:2268
- C:\Windows\System\nQUtINr.exe
  C:\Windows\System\nQUtINr.exe
  2⤵
  PID:1900
- C:\Windows\System\eAQasTU.exe
  C:\Windows\System\eAQasTU.exe
  2⤵
  PID:2152
- C:\Windows\System\IRmWAnn.exe
  C:\Windows\System\IRmWAnn.exe
  2⤵
  PID:792
- C:\Windows\System\CxSehNb.exe
  C:\Windows\System\CxSehNb.exe
  2⤵
  PID:2992
- C:\Windows\System\GhWaTrC.exe
  C:\Windows\System\GhWaTrC.exe
  2⤵
  PID:860
- C:\Windows\System\JiOmqct.exe
  C:\Windows\System\JiOmqct.exe
  2⤵
  PID:2140
- C:\Windows\System\FohyoeZ.exe
  C:\Windows\System\FohyoeZ.exe
  2⤵
  PID:1928
- C:\Windows\System\LXBBcgR.exe
  C:\Windows\System\LXBBcgR.exe
  2⤵
  PID:2864
- C:\Windows\System\uymcllO.exe
  C:\Windows\System\uymcllO.exe
  2⤵
  PID:2616
- C:\Windows\System\GZzcQYt.exe
  C:\Windows\System\GZzcQYt.exe
  2⤵
  PID:2840
- C:\Windows\System\BtjFCLb.exe
  C:\Windows\System\BtjFCLb.exe
  2⤵
  PID:3104
- C:\Windows\System\ySTNQMJ.exe
  C:\Windows\System\ySTNQMJ.exe
  2⤵
  PID:3144
- C:\Windows\System\JdtlWDV.exe
  C:\Windows\System\JdtlWDV.exe
  2⤵
  PID:3140
- C:\Windows\System\NwfwmnO.exe
  C:\Windows\System\NwfwmnO.exe
  2⤵
  PID:3224
- C:\Windows\System\NUBsHVo.exe
  C:\Windows\System\NUBsHVo.exe
  2⤵
  PID:3264
- C:\Windows\System\rlDwfNy.exe
  C:\Windows\System\rlDwfNy.exe
  2⤵
  PID:3288
- C:\Windows\System\ncjLgKH.exe
  C:\Windows\System\ncjLgKH.exe
  2⤵
  PID:3308
- C:\Windows\System\fcgdpSh.exe
  C:\Windows\System\fcgdpSh.exe
  2⤵
  PID:3364
- C:\Windows\System\VvmzLQu.exe
  C:\Windows\System\VvmzLQu.exe
  2⤵
  PID:3408
- C:\Windows\System\WGNkCTo.exe
  C:\Windows\System\WGNkCTo.exe
  2⤵
  PID:3348
- C:\Windows\System\naokWup.exe
  C:\Windows\System\naokWup.exe
  2⤵
  PID:3448
- C:\Windows\System\txeyfWK.exe
  C:\Windows\System\txeyfWK.exe
  2⤵
  PID:3488
- C:\Windows\System\fNsIBxy.exe
  C:\Windows\System\fNsIBxy.exe
  2⤵
  PID:3420
- C:\Windows\System\ZtzxZIi.exe
  C:\Windows\System\ZtzxZIi.exe
  2⤵
  PID:3524
- C:\Windows\System\VbbbQhm.exe
  C:\Windows\System\VbbbQhm.exe
  2⤵
  PID:3500
- C:\Windows\System\ZNAyNkr.exe
  C:\Windows\System\ZNAyNkr.exe
  2⤵
  PID:3576
- C:\Windows\System\QtRmeda.exe
  C:\Windows\System\QtRmeda.exe
  2⤵
  PID:3608
- C:\Windows\System\eRtPmrr.exe
  C:\Windows\System\eRtPmrr.exe
  2⤵
  PID:3620
- C:\Windows\System\BUtaIFD.exe
  C:\Windows\System\BUtaIFD.exe
  2⤵
  PID:3800
- C:\Windows\System\uWhyznI.exe
  C:\Windows\System\uWhyznI.exe
  2⤵
  PID:3844
- C:\Windows\System\lmLhQHC.exe
  C:\Windows\System\lmLhQHC.exe
  2⤵
  PID:3916
- C:\Windows\System\KBqpDGR.exe
  C:\Windows\System\KBqpDGR.exe
  2⤵
  PID:3992
- C:\Windows\System\XclSRMM.exe
  C:\Windows\System\XclSRMM.exe
  2⤵
  PID:2256
- C:\Windows\System\zrsgrpY.exe
  C:\Windows\System\zrsgrpY.exe
  2⤵
  PID:3668
- C:\Windows\System\SvuOKCC.exe
  C:\Windows\System\SvuOKCC.exe
  2⤵
  PID:3704
- C:\Windows\System\qjpYHyH.exe
  C:\Windows\System\qjpYHyH.exe
  2⤵
  PID:2796
- C:\Windows\System\gGyQVNx.exe
  C:\Windows\System\gGyQVNx.exe
  2⤵
  PID:3784
- C:\Windows\System\FYlFhjP.exe
  C:\Windows\System\FYlFhjP.exe
  2⤵
  PID:3860
- C:\Windows\System\qQylonG.exe
  C:\Windows\System\qQylonG.exe
  2⤵
  PID:3904
- C:\Windows\System\PRllatc.exe
  C:\Windows\System\PRllatc.exe
  2⤵
  PID:3936
- C:\Windows\System\oUeMTyy.exe
  C:\Windows\System\oUeMTyy.exe
  2⤵
  PID:4012
- C:\Windows\System\NMUFhfM.exe
  C:\Windows\System\NMUFhfM.exe
  2⤵
  PID:3052
- C:\Windows\System\yyomzOv.exe
  C:\Windows\System\yyomzOv.exe
  2⤵
  PID:2548
- C:\Windows\System\HLWjYiG.exe
  C:\Windows\System\HLWjYiG.exe
  2⤵
  PID:2856
- C:\Windows\System\pkYkmCm.exe
  C:\Windows\System\pkYkmCm.exe
  2⤵
  PID:1588
- C:\Windows\System\aKbObOC.exe
  C:\Windows\System\aKbObOC.exe
  2⤵
  PID:3976
- C:\Windows\System\PLLWJYF.exe
  C:\Windows\System\PLLWJYF.exe
  2⤵
  PID:4016
- C:\Windows\System\IxqGdgT.exe
  C:\Windows\System\IxqGdgT.exe
  2⤵
  PID:2876
- C:\Windows\System\uptrTlA.exe
  C:\Windows\System\uptrTlA.exe
  2⤵
  PID:2756
- C:\Windows\System\ECxwloI.exe
  C:\Windows\System\ECxwloI.exe
  2⤵
  PID:3244
- C:\Windows\System\AsrqIXB.exe
  C:\Windows\System\AsrqIXB.exe
  2⤵
  PID:3148
- C:\Windows\System\SOHGuCN.exe
  C:\Windows\System\SOHGuCN.exe
  2⤵
  PID:2020
- C:\Windows\System\NqiPlPb.exe
  C:\Windows\System\NqiPlPb.exe
  2⤵
  PID:3360
- C:\Windows\System\uUHxQGt.exe
  C:\Windows\System\uUHxQGt.exe
  2⤵
  PID:3304
- C:\Windows\System\RBByvee.exe
  C:\Windows\System\RBByvee.exe
  2⤵
  PID:1656
- C:\Windows\System\HHWVCKy.exe
  C:\Windows\System\HHWVCKy.exe
  2⤵
  PID:3428
- C:\Windows\System\BxxhZJr.exe
  C:\Windows\System\BxxhZJr.exe
  2⤵
  PID:3460
- C:\Windows\System\QrPwUSn.exe
  C:\Windows\System\QrPwUSn.exe
  2⤵
  PID:3584
- C:\Windows\System\PwkcWiL.exe
  C:\Windows\System\PwkcWiL.exe
  2⤵
  PID:3724
- C:\Windows\System\hOLnkpr.exe
  C:\Windows\System\hOLnkpr.exe
  2⤵
  PID:3624
- C:\Windows\System\ckbzlxl.exe
  C:\Windows\System\ckbzlxl.exe
  2⤵
  PID:3580
- C:\Windows\System\Orivykf.exe
  C:\Windows\System\Orivykf.exe
  2⤵
  PID:2720
- C:\Windows\System\zBPynyE.exe
  C:\Windows\System\zBPynyE.exe
  2⤵
  PID:2260
- C:\Windows\System\MCKzoiW.exe
  C:\Windows\System\MCKzoiW.exe
  2⤵
  PID:4036
- C:\Windows\System\dLypQmv.exe
  C:\Windows\System\dLypQmv.exe
  2⤵
  PID:1624
- C:\Windows\System\poogVtf.exe
  C:\Windows\System\poogVtf.exe
  2⤵
  PID:2324
- C:\Windows\System\DEeRHVz.exe
  C:\Windows\System\DEeRHVz.exe
  2⤵
  PID:3660
- C:\Windows\System\QmjaFUX.exe
  C:\Windows\System\QmjaFUX.exe
  2⤵
  PID:2724
- C:\Windows\System\qoBDNNr.exe
  C:\Windows\System\qoBDNNr.exe
  2⤵
  PID:3736
- C:\Windows\System\aEKLvkO.exe
  C:\Windows\System\aEKLvkO.exe
  2⤵
  PID:3856
- C:\Windows\System\OJTlaxO.exe
  C:\Windows\System\OJTlaxO.exe
  2⤵
  PID:2776
- C:\Windows\System\MZnxrAv.exe
  C:\Windows\System\MZnxrAv.exe
  2⤵
  PID:2708
- C:\Windows\System\kvRsyFT.exe
  C:\Windows\System\kvRsyFT.exe
  2⤵
  PID:4056
- C:\Windows\System\TnpIVLN.exe
  C:\Windows\System\TnpIVLN.exe
  2⤵
  PID:2848
- C:\Windows\System\xIyyzuu.exe
  C:\Windows\System\xIyyzuu.exe
  2⤵
  PID:4084
- C:\Windows\System\gJZrCJp.exe
  C:\Windows\System\gJZrCJp.exe
  2⤵
  PID:2972
- C:\Windows\System\DEKeLCd.exe
  C:\Windows\System\DEKeLCd.exe
  2⤵
  PID:2764
- C:\Windows\System\yBsAPVg.exe
  C:\Windows\System\yBsAPVg.exe
  2⤵
  PID:840
- C:\Windows\System\iorvOZB.exe
  C:\Windows\System\iorvOZB.exe
  2⤵
  PID:1032
- C:\Windows\System\xPBioiS.exe
  C:\Windows\System\xPBioiS.exe
  2⤵
  PID:2612
- C:\Windows\System\PKsYllc.exe
  C:\Windows\System\PKsYllc.exe
  2⤵
  PID:3508
- C:\Windows\System\CxYEZCd.exe
  C:\Windows\System\CxYEZCd.exe
  2⤵
  PID:3504
- C:\Windows\System\VfXzBta.exe
  C:\Windows\System\VfXzBta.exe
  2⤵
  PID:1916
- C:\Windows\System\HUpZooC.exe
  C:\Windows\System\HUpZooC.exe
  2⤵
  PID:3720
- C:\Windows\System\RhCcVlh.exe
  C:\Windows\System\RhCcVlh.exe
  2⤵
  PID:3808
- C:\Windows\System\KjnajOK.exe
  C:\Windows\System\KjnajOK.exe
  2⤵
  PID:3960
- C:\Windows\System\NQPpyDT.exe
  C:\Windows\System\NQPpyDT.exe
  2⤵
  PID:1984
- C:\Windows\System\KtEIKIF.exe
  C:\Windows\System\KtEIKIF.exe
  2⤵
  PID:3760
- C:\Windows\System\IKXLxyL.exe
  C:\Windows\System\IKXLxyL.exe
  2⤵
  PID:3756
- C:\Windows\System\hrRpPMw.exe
  C:\Windows\System\hrRpPMw.exe
  2⤵
  PID:3672
- C:\Windows\System\JyGlwaF.exe
  C:\Windows\System\JyGlwaF.exe
  2⤵
  PID:2136
- C:\Windows\System\xqzWSHC.exe
  C:\Windows\System\xqzWSHC.exe
  2⤵
  PID:2752
- C:\Windows\System\ITdylTn.exe
  C:\Windows\System\ITdylTn.exe
  2⤵
  PID:3480
- C:\Windows\System\dCuNxwD.exe
  C:\Windows\System\dCuNxwD.exe
  2⤵
  PID:3260
- C:\Windows\System\HCPXzHj.exe
  C:\Windows\System\HCPXzHj.exe
  2⤵
  PID:2204
- C:\Windows\System\crLOrXv.exe
  C:\Windows\System\crLOrXv.exe
  2⤵
  PID:236
- C:\Windows\System\bhuOVcc.exe
  C:\Windows\System\bhuOVcc.exe
  2⤵
  PID:3528
- C:\Windows\System\vIBtWYx.exe
  C:\Windows\System\vIBtWYx.exe
  2⤵
  PID:2128
- C:\Windows\System\UZWUGRA.exe
  C:\Windows\System\UZWUGRA.exe
  2⤵
  PID:3328
- C:\Windows\System\wFTvAGB.exe
  C:\Windows\System\wFTvAGB.exe
  2⤵
  PID:3644
- C:\Windows\System\vMJKizI.exe
  C:\Windows\System\vMJKizI.exe
  2⤵
  PID:1120
- C:\Windows\System\UVQWlho.exe
  C:\Windows\System\UVQWlho.exe
  2⤵
  PID:1884
- C:\Windows\System\asMeWKx.exe
  C:\Windows\System\asMeWKx.exe
  2⤵
  PID:3588
- C:\Windows\System\APLreyv.exe
  C:\Windows\System\APLreyv.exe
  2⤵
  PID:4068
- C:\Windows\System\qBvuROt.exe
  C:\Windows\System\qBvuROt.exe
  2⤵
  PID:2440
- C:\Windows\System\FQmeyKU.exe
  C:\Windows\System\FQmeyKU.exe
  2⤵
  PID:1604
- C:\Windows\System\YbiHPAa.exe
  C:\Windows\System\YbiHPAa.exe
  2⤵
  PID:3900
- C:\Windows\System\dtvTxje.exe
  C:\Windows\System\dtvTxje.exe
  2⤵
  PID:3604
- C:\Windows\System\kVrJxXF.exe
  C:\Windows\System\kVrJxXF.exe
  2⤵
  PID:1852
- C:\Windows\System\ezhhGFd.exe
  C:\Windows\System\ezhhGFd.exe
  2⤵
  PID:3164
- C:\Windows\System\VwcVGhx.exe
  C:\Windows\System\VwcVGhx.exe
  2⤵
  PID:2276
- C:\Windows\System\ZtaIZUH.exe
  C:\Windows\System\ZtaIZUH.exe
  2⤵
  PID:2236
- C:\Windows\System\VokZjTs.exe
  C:\Windows\System\VokZjTs.exe
  2⤵
  PID:3384
- C:\Windows\System\bRWbGBc.exe
  C:\Windows\System\bRWbGBc.exe
  2⤵
  PID:3272
- C:\Windows\System\UYZIvAz.exe
  C:\Windows\System\UYZIvAz.exe
  2⤵
  PID:3024
- C:\Windows\System\wpgadAy.exe
  C:\Windows\System\wpgadAy.exe
  2⤵
  PID:1972
- C:\Windows\System\HArVcaX.exe
  C:\Windows\System\HArVcaX.exe
  2⤵
  PID:2240
- C:\Windows\System\ehCGTFN.exe
  C:\Windows\System\ehCGTFN.exe
  2⤵
  PID:3284
- C:\Windows\System\VTjUlUY.exe
  C:\Windows\System\VTjUlUY.exe
  2⤵
  PID:3708
- C:\Windows\System\QATaAXX.exe
  C:\Windows\System\QATaAXX.exe
  2⤵
  PID:4024
- C:\Windows\System\TLqLbHt.exe
  C:\Windows\System\TLqLbHt.exe
  2⤵
  PID:2200
- C:\Windows\System\PEIlCDt.exe
  C:\Windows\System\PEIlCDt.exe
  2⤵
  PID:3128
- C:\Windows\System\fXEbLqu.exe
  C:\Windows\System\fXEbLqu.exe
  2⤵
  PID:4072
- C:\Windows\System\GmwQhlK.exe
  C:\Windows\System\GmwQhlK.exe
  2⤵
  PID:4116
- C:\Windows\System\NEEaUdE.exe
  C:\Windows\System\NEEaUdE.exe
  2⤵
  PID:4132
- C:\Windows\System\yDwQxCw.exe
  C:\Windows\System\yDwQxCw.exe
  2⤵
  PID:4152
- C:\Windows\System\uONPdoM.exe
  C:\Windows\System\uONPdoM.exe
  2⤵
  PID:4172
- C:\Windows\System\tKSdriJ.exe
  C:\Windows\System\tKSdriJ.exe
  2⤵
  PID:4188
- C:\Windows\System\QiVZrNe.exe
  C:\Windows\System\QiVZrNe.exe
  2⤵
  PID:4204
- C:\Windows\System\KqrJTyy.exe
  C:\Windows\System\KqrJTyy.exe
  2⤵
  PID:4224
- C:\Windows\System\xfytbqz.exe
  C:\Windows\System\xfytbqz.exe
  2⤵
  PID:4248
- C:\Windows\System\ExDkhWI.exe
  C:\Windows\System\ExDkhWI.exe
  2⤵
  PID:4268
- C:\Windows\System\AxUrKPe.exe
  C:\Windows\System\AxUrKPe.exe
  2⤵
  PID:4284
- C:\Windows\System\fGDdidK.exe
  C:\Windows\System\fGDdidK.exe
  2⤵
  PID:4328
- C:\Windows\System\JHBLtZN.exe
  C:\Windows\System\JHBLtZN.exe
  2⤵
  PID:4344
- C:\Windows\System\yreekzn.exe
  C:\Windows\System\yreekzn.exe
  2⤵
  PID:4360
- C:\Windows\System\BJutRGv.exe
  C:\Windows\System\BJutRGv.exe
  2⤵
  PID:4376
- C:\Windows\System\ezSalDh.exe
  C:\Windows\System\ezSalDh.exe
  2⤵
  PID:4392
- C:\Windows\System\JLrQufl.exe
  C:\Windows\System\JLrQufl.exe
  2⤵
  PID:4408
- C:\Windows\System\EXJfTmp.exe
  C:\Windows\System\EXJfTmp.exe
  2⤵
  PID:4424
- C:\Windows\System\UhrywpS.exe
  C:\Windows\System\UhrywpS.exe
  2⤵
  PID:4440
- C:\Windows\System\qxXyKph.exe
  C:\Windows\System\qxXyKph.exe
  2⤵
  PID:4460
- C:\Windows\System\ceVgSps.exe
  C:\Windows\System\ceVgSps.exe
  2⤵
  PID:4480
- C:\Windows\System\MpPlwBJ.exe
  C:\Windows\System\MpPlwBJ.exe
  2⤵
  PID:4496
- C:\Windows\System\wzJmcTY.exe
  C:\Windows\System\wzJmcTY.exe
  2⤵
  PID:4516
- C:\Windows\System\TsTtoZP.exe
  C:\Windows\System\TsTtoZP.exe
  2⤵
  PID:4536
- C:\Windows\System\ImtblWx.exe
  C:\Windows\System\ImtblWx.exe
  2⤵
  PID:4556
- C:\Windows\System\WclYqEx.exe
  C:\Windows\System\WclYqEx.exe
  2⤵
  PID:4576
- C:\Windows\System\Oencfol.exe
  C:\Windows\System\Oencfol.exe
  2⤵
  PID:4592
- C:\Windows\System\IxFzsTe.exe
  C:\Windows\System\IxFzsTe.exe
  2⤵
  PID:4612
- C:\Windows\System\cJlNXpx.exe
  C:\Windows\System\cJlNXpx.exe
  2⤵
  PID:4632
- C:\Windows\System\qyPnEeM.exe
  C:\Windows\System\qyPnEeM.exe
  2⤵
  PID:4648
- C:\Windows\System\PwBzHta.exe
  C:\Windows\System\PwBzHta.exe
  2⤵
  PID:4668
- C:\Windows\System\nrkXoBK.exe
  C:\Windows\System\nrkXoBK.exe
  2⤵
  PID:4688
- C:\Windows\System\TbZnMCY.exe
  C:\Windows\System\TbZnMCY.exe
  2⤵
  PID:4708
- C:\Windows\System\xakJbXi.exe
  C:\Windows\System\xakJbXi.exe
  2⤵
  PID:4724
- C:\Windows\System\ucsgPiI.exe
  C:\Windows\System\ucsgPiI.exe
  2⤵
  PID:4744
- C:\Windows\System\AdMFavC.exe
  C:\Windows\System\AdMFavC.exe
  2⤵
  PID:4760
- C:\Windows\System\wvePzOp.exe
  C:\Windows\System\wvePzOp.exe
  2⤵
  PID:4780
- C:\Windows\System\fNeoBaB.exe
  C:\Windows\System\fNeoBaB.exe
  2⤵
  PID:4800
- C:\Windows\System\geofCWn.exe
  C:\Windows\System\geofCWn.exe
  2⤵
  PID:4816
- C:\Windows\System\OydRaPT.exe
  C:\Windows\System\OydRaPT.exe
  2⤵
  PID:4836
- C:\Windows\System\HozSEnp.exe
  C:\Windows\System\HozSEnp.exe
  2⤵
  PID:4856
- C:\Windows\System\xZZpOTg.exe
  C:\Windows\System\xZZpOTg.exe
  2⤵
  PID:4876
- C:\Windows\System\AwPvkFD.exe
  C:\Windows\System\AwPvkFD.exe
  2⤵
  PID:4896
- C:\Windows\System\cRYUzhM.exe
  C:\Windows\System\cRYUzhM.exe
  2⤵
  PID:4912
- C:\Windows\System\LVxJhdA.exe
  C:\Windows\System\LVxJhdA.exe
  2⤵
  PID:4932
- C:\Windows\System\xYPKkyt.exe
  C:\Windows\System\xYPKkyt.exe
  2⤵
  PID:4952
- C:\Windows\System\XaQJdNi.exe
  C:\Windows\System\XaQJdNi.exe
  2⤵
  PID:4968
- C:\Windows\System\TLeeDmx.exe
  C:\Windows\System\TLeeDmx.exe
  2⤵
  PID:4988
- C:\Windows\System\qfNdRvT.exe
  C:\Windows\System\qfNdRvT.exe
  2⤵
  PID:5004
- C:\Windows\System\oBPFPAP.exe
  C:\Windows\System\oBPFPAP.exe
  2⤵
  PID:5024
- C:\Windows\System\OvyQFwo.exe
  C:\Windows\System\OvyQFwo.exe
  2⤵
  PID:5044
- C:\Windows\System\CzhFCBI.exe
  C:\Windows\System\CzhFCBI.exe
  2⤵
  PID:5060
- C:\Windows\System\VHPCwPu.exe
  C:\Windows\System\VHPCwPu.exe
  2⤵
  PID:5080
- C:\Windows\System\aArboJS.exe
  C:\Windows\System\aArboJS.exe
  2⤵
  PID:5096
- C:\Windows\System\jvMLNAg.exe
  C:\Windows\System\jvMLNAg.exe
  2⤵
  PID:5112
- C:\Windows\System\lAWfLaE.exe
  C:\Windows\System\lAWfLaE.exe
  2⤵
  PID:4124
- C:\Windows\System\zvUDIzs.exe
  C:\Windows\System\zvUDIzs.exe
  2⤵
  PID:4160
- C:\Windows\System\cOdwxST.exe
  C:\Windows\System\cOdwxST.exe
  2⤵
  PID:4108
- C:\Windows\System\yoQhqtf.exe
  C:\Windows\System\yoQhqtf.exe
  2⤵
  PID:2448
- C:\Windows\System\VcCbPFc.exe
  C:\Windows\System\VcCbPFc.exe
  2⤵
  PID:4112
- C:\Windows\System\AuRFGKq.exe
  C:\Windows\System\AuRFGKq.exe
  2⤵
  PID:4220
- C:\Windows\System\gkKXXBL.exe
  C:\Windows\System\gkKXXBL.exe
  2⤵
  PID:4276
- C:\Windows\System\mZZyizu.exe
  C:\Windows\System\mZZyizu.exe
  2⤵
  PID:4296
- C:\Windows\System\ceDsvTL.exe
  C:\Windows\System\ceDsvTL.exe
  2⤵
  PID:4320
- C:\Windows\System\fhdeico.exe
  C:\Windows\System\fhdeico.exe
  2⤵
  PID:4372
- C:\Windows\System\mBVQZxK.exe
  C:\Windows\System\mBVQZxK.exe
  2⤵
  PID:4436
- C:\Windows\System\sasYARj.exe
  C:\Windows\System\sasYARj.exe
  2⤵
  PID:4772
- C:\Windows\System\JiiWzCJ.exe
  C:\Windows\System\JiiWzCJ.exe
  2⤵
  PID:4844
- C:\Windows\System\kNSryNV.exe
  C:\Windows\System\kNSryNV.exe
  2⤵
  PID:4888
- C:\Windows\System\pNPDYMq.exe
  C:\Windows\System\pNPDYMq.exe
  2⤵
  PID:4928
- C:\Windows\System\DtmrvKt.exe
  C:\Windows\System\DtmrvKt.exe
  2⤵
  PID:5000
- C:\Windows\System\WxJckbm.exe
  C:\Windows\System\WxJckbm.exe
  2⤵
  PID:5068
- C:\Windows\System\wlceGUp.exe
  C:\Windows\System\wlceGUp.exe
  2⤵
  PID:5108
- C:\Windows\System\BhNapwB.exe
  C:\Windows\System\BhNapwB.exe
  2⤵
  PID:4568
- C:\Windows\System\YcVRcYr.exe
  C:\Windows\System\YcVRcYr.exe
  2⤵
  PID:4680
- C:\Windows\System\ZMivTra.exe
  C:\Windows\System\ZMivTra.exe
  2⤵
  PID:4788
- C:\Windows\System\CfOUbgl.exe
  C:\Windows\System\CfOUbgl.exe
  2⤵
  PID:4828
- C:\Windows\System\DgyXwjH.exe
  C:\Windows\System\DgyXwjH.exe
  2⤵
  PID:4416
- C:\Windows\System\rGoeWiW.exe
  C:\Windows\System\rGoeWiW.exe
  2⤵
  PID:4940
- C:\Windows\System\IsaXyCr.exe
  C:\Windows\System\IsaXyCr.exe
  2⤵
  PID:4984
- C:\Windows\System\JdYTcBO.exe
  C:\Windows\System\JdYTcBO.exe
  2⤵
  PID:4196
- C:\Windows\System\LdkftfD.exe
  C:\Windows\System\LdkftfD.exe
  2⤵
  PID:3036
- C:\Windows\System\OwjJafk.exe
  C:\Windows\System\OwjJafk.exe
  2⤵
  PID:4948
- C:\Windows\System\HpfcAKK.exe
  C:\Windows\System\HpfcAKK.exe
  2⤵
  PID:4148
- C:\Windows\System\dSqBScb.exe
  C:\Windows\System\dSqBScb.exe
  2⤵
  PID:4292
- C:\Windows\System\zWaMdhA.exe
  C:\Windows\System\zWaMdhA.exe
  2⤵
  PID:4368
- C:\Windows\System\sPMstCY.exe
  C:\Windows\System\sPMstCY.exe
  2⤵
  PID:4548
- C:\Windows\System\qFJZYQC.exe
  C:\Windows\System\qFJZYQC.exe
  2⤵
  PID:4528
- C:\Windows\System\susnsGb.exe
  C:\Windows\System\susnsGb.exe
  2⤵
  PID:4644
- C:\Windows\System\jGTGwAV.exe
  C:\Windows\System\jGTGwAV.exe
  2⤵
  PID:4472
- C:\Windows\System\klPmiyy.exe
  C:\Windows\System\klPmiyy.exe
  2⤵
  PID:4624
- C:\Windows\System\Vjfwkzc.exe
  C:\Windows\System\Vjfwkzc.exe
  2⤵
  PID:4660
- C:\Windows\System\lbbzBjM.exe
  C:\Windows\System\lbbzBjM.exe
  2⤵
  PID:5020
- C:\Windows\System\imueVJp.exe
  C:\Windows\System\imueVJp.exe
  2⤵
  PID:4240
- C:\Windows\System\mycNMeh.exe
  C:\Windows\System\mycNMeh.exe
  2⤵
  PID:4740
- C:\Windows\System\fdLkaxl.exe
  C:\Windows\System\fdLkaxl.exe
  2⤵
  PID:4100
- C:\Windows\System\yfwrmmK.exe
  C:\Windows\System\yfwrmmK.exe
  2⤵
  PID:4316
- C:\Windows\System\gPQWYXj.exe
  C:\Windows\System\gPQWYXj.exe
  2⤵
  PID:4996
- C:\Windows\System\yyBBMAy.exe
  C:\Windows\System\yyBBMAy.exe
  2⤵
  PID:4676
- C:\Windows\System\ssbptzo.exe
  C:\Windows\System\ssbptzo.exe
  2⤵
  PID:5012
- C:\Windows\System\KzBmrxp.exe
  C:\Windows\System\KzBmrxp.exe
  2⤵
  PID:4184
- C:\Windows\System\tehiyTv.exe
  C:\Windows\System\tehiyTv.exe
  2⤵
  PID:4508
- C:\Windows\System\Yzbxedx.exe
  C:\Windows\System\Yzbxedx.exe
  2⤵
  PID:4732
- C:\Windows\System\GKBUdSK.exe
  C:\Windows\System\GKBUdSK.exe
  2⤵
  PID:4404
- C:\Windows\System\KemtfpF.exe
  C:\Windows\System\KemtfpF.exe
  2⤵
  PID:5104
- C:\Windows\System\AClGIyU.exe
  C:\Windows\System\AClGIyU.exe
  2⤵
  PID:5136
- C:\Windows\System\TZQPyiU.exe
  C:\Windows\System\TZQPyiU.exe
  2⤵
  PID:5156
- C:\Windows\System\fENavLT.exe
  C:\Windows\System\fENavLT.exe
  2⤵
  PID:5172
- C:\Windows\System\PfujMwY.exe
  C:\Windows\System\PfujMwY.exe
  2⤵
  PID:5188
- C:\Windows\System\nJHSYSS.exe
  C:\Windows\System\nJHSYSS.exe
  2⤵
  PID:5296
- C:\Windows\System\tjiosVX.exe
  C:\Windows\System\tjiosVX.exe
  2⤵
  PID:5312
- C:\Windows\System\knucMJc.exe
  C:\Windows\System\knucMJc.exe
  2⤵
  PID:5336
- C:\Windows\System\EYhcCJE.exe
  C:\Windows\System\EYhcCJE.exe
  2⤵
  PID:5352
- C:\Windows\System\ZvCZhIN.exe
  C:\Windows\System\ZvCZhIN.exe
  2⤵
  PID:5368
- C:\Windows\System\OCYFEsx.exe
  C:\Windows\System\OCYFEsx.exe
  2⤵
  PID:5388
- C:\Windows\System\vDtqgPO.exe
  C:\Windows\System\vDtqgPO.exe
  2⤵
  PID:5412
- C:\Windows\System\SAdZmAP.exe
  C:\Windows\System\SAdZmAP.exe
  2⤵
  PID:5428
- C:\Windows\System\yzNPtoH.exe
  C:\Windows\System\yzNPtoH.exe
  2⤵
  PID:5444
- C:\Windows\System\OxNiVyf.exe
  C:\Windows\System\OxNiVyf.exe
  2⤵
  PID:5464
- C:\Windows\System\peqKtjF.exe
  C:\Windows\System\peqKtjF.exe
  2⤵
  PID:5480
- C:\Windows\System\HevaUrE.exe
  C:\Windows\System\HevaUrE.exe
  2⤵
  PID:5512
- C:\Windows\System\jdSNZkO.exe
  C:\Windows\System\jdSNZkO.exe
  2⤵
  PID:5532
- C:\Windows\System\YuUVNXN.exe
  C:\Windows\System\YuUVNXN.exe
  2⤵
  PID:5548
- C:\Windows\System\QAgIivq.exe
  C:\Windows\System\QAgIivq.exe
  2⤵
  PID:5568
- C:\Windows\System\cPeFQQS.exe
  C:\Windows\System\cPeFQQS.exe
  2⤵
  PID:5588
- C:\Windows\System\xAypRFO.exe
  C:\Windows\System\xAypRFO.exe
  2⤵
  PID:5604
- C:\Windows\System\NncGUQH.exe
  C:\Windows\System\NncGUQH.exe
  2⤵
  PID:5620
- C:\Windows\System\TTmCxrv.exe
  C:\Windows\System\TTmCxrv.exe
  2⤵
  PID:5644
- C:\Windows\System\PbPyjwu.exe
  C:\Windows\System\PbPyjwu.exe
  2⤵
  PID:5660
- C:\Windows\System\gVZGWYY.exe
  C:\Windows\System\gVZGWYY.exe
  2⤵
  PID:5700
- C:\Windows\System\BZPMXto.exe
  C:\Windows\System\BZPMXto.exe
  2⤵
  PID:5716
- C:\Windows\System\VgONLDQ.exe
  C:\Windows\System\VgONLDQ.exe
  2⤵
  PID:5732
- C:\Windows\System\PBaNEyv.exe
  C:\Windows\System\PBaNEyv.exe
  2⤵
  PID:5748
- C:\Windows\System\KwxpbEL.exe
  C:\Windows\System\KwxpbEL.exe
  2⤵
  PID:5768
- C:\Windows\System\BzXRiUu.exe
  C:\Windows\System\BzXRiUu.exe
  2⤵
  PID:5784
- C:\Windows\System\HtCWaIQ.exe
  C:\Windows\System\HtCWaIQ.exe
  2⤵
  PID:5804
- C:\Windows\System\XfzrLnv.exe
  C:\Windows\System\XfzrLnv.exe
  2⤵
  PID:5828
- C:\Windows\System\NvLGJdg.exe
  C:\Windows\System\NvLGJdg.exe
  2⤵
  PID:5844
- C:\Windows\System\CDSWitc.exe
  C:\Windows\System\CDSWitc.exe
  2⤵
  PID:5868
- C:\Windows\System\iRteCwV.exe
  C:\Windows\System\iRteCwV.exe
  2⤵
  PID:5888
- C:\Windows\System\clxHOai.exe
  C:\Windows\System\clxHOai.exe
  2⤵
  PID:5908
- C:\Windows\System\xZXSVIy.exe
  C:\Windows\System\xZXSVIy.exe
  2⤵
  PID:5924
- C:\Windows\System\BCnUJut.exe
  C:\Windows\System\BCnUJut.exe
  2⤵
  PID:5948
- C:\Windows\System\bDWaXpW.exe
  C:\Windows\System\bDWaXpW.exe
  2⤵
  PID:5968
- C:\Windows\System\ZLeWbZq.exe
  C:\Windows\System\ZLeWbZq.exe
  2⤵
  PID:5996
- C:\Windows\System\befBfrO.exe
  C:\Windows\System\befBfrO.exe
  2⤵
  PID:6012
- C:\Windows\System\rhbOrpz.exe
  C:\Windows\System\rhbOrpz.exe
  2⤵
  PID:6028
- C:\Windows\System\ncMKowZ.exe
  C:\Windows\System\ncMKowZ.exe
  2⤵
  PID:6048
- C:\Windows\System\kIVMiSj.exe
  C:\Windows\System\kIVMiSj.exe
  2⤵
  PID:6068
- C:\Windows\System\pLjkNnV.exe
  C:\Windows\System\pLjkNnV.exe
  2⤵
  PID:6084
- C:\Windows\System\NwoDNfq.exe
  C:\Windows\System\NwoDNfq.exe
  2⤵
  PID:6104
- C:\Windows\System\rTmcPGC.exe
  C:\Windows\System\rTmcPGC.exe
  2⤵
  PID:6124
- C:\Windows\System\gkRFEvt.exe
  C:\Windows\System\gkRFEvt.exe
  2⤵
  PID:4704
- C:\Windows\System\yhBbGfe.exe
  C:\Windows\System\yhBbGfe.exe
  2⤵
  PID:4584
- C:\Windows\System\tmmqJMN.exe
  C:\Windows\System\tmmqJMN.exe
  2⤵
  PID:4608
- C:\Windows\System\qgbOlHN.exe
  C:\Windows\System\qgbOlHN.exe
  2⤵
  PID:5152
- C:\Windows\System\xLjcHRE.exe
  C:\Windows\System\xLjcHRE.exe
  2⤵
  PID:4448
- C:\Windows\System\jWGLkCi.exe
  C:\Windows\System\jWGLkCi.exe
  2⤵
  PID:4552
- C:\Windows\System\lfVDbUj.exe
  C:\Windows\System\lfVDbUj.exe
  2⤵
  PID:5132
- C:\Windows\System\NsyPUZd.exe
  C:\Windows\System\NsyPUZd.exe
  2⤵
  PID:4180
- C:\Windows\System\sHxLSNj.exe
  C:\Windows\System\sHxLSNj.exe
  2⤵
  PID:5252
- C:\Windows\System\heXJwGl.exe
  C:\Windows\System\heXJwGl.exe
  2⤵
  PID:4924
- C:\Windows\System\tCehiiG.exe
  C:\Windows\System\tCehiiG.exe
  2⤵
  PID:5256
- C:\Windows\System\cabuOiB.exe
  C:\Windows\System\cabuOiB.exe
  2⤵
  PID:4852
- C:\Windows\System\rwTYzEK.exe
  C:\Windows\System\rwTYzEK.exe
  2⤵
  PID:4796
- C:\Windows\System\kDuBUBr.exe
  C:\Windows\System\kDuBUBr.exe
  2⤵
  PID:5284
- C:\Windows\System\FTLDIOe.exe
  C:\Windows\System\FTLDIOe.exe
  2⤵
  PID:4168
- C:\Windows\System\RrwtNUW.exe
  C:\Windows\System\RrwtNUW.exe
  2⤵
  PID:4384
- C:\Windows\System\BTlkxSk.exe
  C:\Windows\System\BTlkxSk.exe
  2⤵
  PID:4492
- C:\Windows\System\pcYByeG.exe
  C:\Windows\System\pcYByeG.exe
  2⤵
  PID:5236
- C:\Windows\System\BkApoTO.exe
  C:\Windows\System\BkApoTO.exe
  2⤵
  PID:5308
- C:\Windows\System\CbbNJCq.exe
  C:\Windows\System\CbbNJCq.exe
  2⤵
  PID:5344
- C:\Windows\System\NIpUmui.exe
  C:\Windows\System\NIpUmui.exe
  2⤵
  PID:5384
- C:\Windows\System\IqxuOpb.exe
  C:\Windows\System\IqxuOpb.exe
  2⤵
  PID:5452
- C:\Windows\System\LfaccSj.exe
  C:\Windows\System\LfaccSj.exe
  2⤵
  PID:5456
- C:\Windows\System\ustdMXv.exe
  C:\Windows\System\ustdMXv.exe
  2⤵
  PID:5408
- C:\Windows\System\uzWXkLc.exe
  C:\Windows\System\uzWXkLc.exe
  2⤵
  PID:5476
- C:\Windows\System\hOwxicR.exe
  C:\Windows\System\hOwxicR.exe
  2⤵
  PID:5496
- C:\Windows\System\HcktUPu.exe
  C:\Windows\System\HcktUPu.exe
  2⤵
  PID:5584
- C:\Windows\System\QuTuBOX.exe
  C:\Windows\System\QuTuBOX.exe
  2⤵
  PID:5640
- C:\Windows\System\PSfvsMe.exe
  C:\Windows\System\PSfvsMe.exe
  2⤵
  PID:5524
- C:\Windows\System\TKITsVw.exe
  C:\Windows\System\TKITsVw.exe
  2⤵
  PID:5632
- C:\Windows\System\JvcNodl.exe
  C:\Windows\System\JvcNodl.exe
  2⤵
  PID:5680
- C:\Windows\System\TRUEbbo.exe
  C:\Windows\System\TRUEbbo.exe
  2⤵
  PID:5740
- C:\Windows\System\rQclBRv.exe
  C:\Windows\System\rQclBRv.exe
  2⤵
  PID:5688
- C:\Windows\System\btpNBRO.exe
  C:\Windows\System\btpNBRO.exe
  2⤵
  PID:5756
- C:\Windows\System\rxbygtM.exe
  C:\Windows\System\rxbygtM.exe
  2⤵
  PID:5812
- C:\Windows\System\oHWXGDf.exe
  C:\Windows\System\oHWXGDf.exe
  2⤵
  PID:5852
- C:\Windows\System\DyCrtVX.exe
  C:\Windows\System\DyCrtVX.exe
  2⤵
  PID:5900
- C:\Windows\System\FvrDhHY.exe
  C:\Windows\System\FvrDhHY.exe
  2⤵
  PID:5936
- C:\Windows\System\UQRuYHr.exe
  C:\Windows\System\UQRuYHr.exe
  2⤵
  PID:5836
- C:\Windows\System\UhfebaA.exe
  C:\Windows\System\UhfebaA.exe
  2⤵
  PID:5944
- C:\Windows\System\TVSDKtH.exe
  C:\Windows\System\TVSDKtH.exe
  2⤵
  PID:5992
- C:\Windows\System\survrHn.exe
  C:\Windows\System\survrHn.exe
  2⤵
  PID:6008
- C:\Windows\System\VxCLbtK.exe
  C:\Windows\System\VxCLbtK.exe
  2⤵
  PID:6044
- C:\Windows\System\NmLIyin.exe
  C:\Windows\System\NmLIyin.exe
  2⤵
  PID:6096
- C:\Windows\System\dDSeeSK.exe
  C:\Windows\System\dDSeeSK.exe
  2⤵
  PID:6140
- C:\Windows\System\bHBhkRf.exe
  C:\Windows\System\bHBhkRf.exe
  2⤵
  PID:5184
- C:\Windows\System\oNSTnoX.exe
  C:\Windows\System\oNSTnoX.exe
  2⤵
  PID:5240
- C:\Windows\System\TcqigIf.exe
  C:\Windows\System\TcqigIf.exe
  2⤵
  PID:5268
- C:\Windows\System\qkoFykU.exe
  C:\Windows\System\qkoFykU.exe
  2⤵
  PID:6116
- C:\Windows\System\DiIENfo.exe
  C:\Windows\System\DiIENfo.exe
  2⤵
  PID:4904
- C:\Windows\System\fFBRYmu.exe
  C:\Windows\System\fFBRYmu.exe
  2⤵
  PID:5144
- C:\Windows\System\saSprxe.exe
  C:\Windows\System\saSprxe.exe
  2⤵
  PID:5196
- C:\Windows\System\qsQBhMM.exe
  C:\Windows\System\qsQBhMM.exe
  2⤵
  PID:4512
- C:\Windows\System\uNNAcfw.exe
  C:\Windows\System\uNNAcfw.exe
  2⤵
  PID:5248
- C:\Windows\System\fizGzlK.exe
  C:\Windows\System\fizGzlK.exe
  2⤵
  PID:4720
- C:\Windows\System\ZvMAsHn.exe
  C:\Windows\System\ZvMAsHn.exe
  2⤵
  PID:5200
- C:\Windows\System\VpGhJnK.exe
  C:\Windows\System\VpGhJnK.exe
  2⤵
  PID:5396
- C:\Windows\System\SPsdkjC.exe
  C:\Windows\System\SPsdkjC.exe
  2⤵
  PID:5544
- C:\Windows\System\OPlNhKn.exe
  C:\Windows\System\OPlNhKn.exe
  2⤵
  PID:5520
- C:\Windows\System\ATeSdZL.exe
  C:\Windows\System\ATeSdZL.exe
  2⤵
  PID:5328
- C:\Windows\System\NzQtGpp.exe
  C:\Windows\System\NzQtGpp.exe
  2⤵
  PID:5220
- C:\Windows\System\wEthzDW.exe
  C:\Windows\System\wEthzDW.exe
  2⤵
  PID:5764
- C:\Windows\System\OnxvSpk.exe
  C:\Windows\System\OnxvSpk.exe
  2⤵
  PID:5884
- C:\Windows\System\SHCZvRb.exe
  C:\Windows\System\SHCZvRb.exe
  2⤵
  PID:5988
- C:\Windows\System\YTyXTpG.exe
  C:\Windows\System\YTyXTpG.exe
  2⤵
  PID:6136
- C:\Windows\System\YSyGMeJ.exe
  C:\Windows\System\YSyGMeJ.exe
  2⤵
  PID:2352
- C:\Windows\System\kIFtASE.exe
  C:\Windows\System\kIFtASE.exe
  2⤵
  PID:4256
- C:\Windows\System\wJcBhey.exe
  C:\Windows\System\wJcBhey.exe
  2⤵
  PID:4340
- C:\Windows\System\WlXQACm.exe
  C:\Windows\System\WlXQACm.exe
  2⤵
  PID:6120
- C:\Windows\System\oZMjpZC.exe
  C:\Windows\System\oZMjpZC.exe
  2⤵
  PID:5420
- C:\Windows\System\EoyRMcM.exe
  C:\Windows\System\EoyRMcM.exe
  2⤵
  PID:5204
- C:\Windows\System\RZzpmQr.exe
  C:\Windows\System\RZzpmQr.exe
  2⤵
  PID:5656
- C:\Windows\System\yqDgAxM.exe
  C:\Windows\System\yqDgAxM.exe
  2⤵
  PID:5564
- C:\Windows\System\wySnFQk.exe
  C:\Windows\System\wySnFQk.exe
  2⤵
  PID:5800
- C:\Windows\System\NTebjrC.exe
  C:\Windows\System\NTebjrC.exe
  2⤵
  PID:5856
- C:\Windows\System\UIpXyRR.exe
  C:\Windows\System\UIpXyRR.exe
  2⤵
  PID:6024
- C:\Windows\System\hiDobqT.exe
  C:\Windows\System\hiDobqT.exe
  2⤵
  PID:6060
- C:\Windows\System\zAAhMxy.exe
  C:\Windows\System\zAAhMxy.exe
  2⤵
  PID:4308
- C:\Windows\System\ubIOANi.exe
  C:\Windows\System\ubIOANi.exe
  2⤵
  PID:5052
- C:\Windows\System\qfSxpOL.exe
  C:\Windows\System\qfSxpOL.exe
  2⤵
  PID:5264
- C:\Windows\System\wpyIiUr.exe
  C:\Windows\System\wpyIiUr.exe
  2⤵
  PID:5208
- C:\Windows\System\UpzLsZs.exe
  C:\Windows\System\UpzLsZs.exe
  2⤵
  PID:5364
- C:\Windows\System\skzqyPB.exe
  C:\Windows\System\skzqyPB.exe
  2⤵
  PID:5324
- C:\Windows\System\aOexxeX.exe
  C:\Windows\System\aOexxeX.exe
  2⤵
  PID:5976
- C:\Windows\System\VWzntYF.exe
  C:\Windows\System\VWzntYF.exe
  2⤵
  PID:5440
- C:\Windows\System\WSUvTpS.exe
  C:\Windows\System\WSUvTpS.exe
  2⤵
  PID:5760
- C:\Windows\System\WzetKiS.exe
  C:\Windows\System\WzetKiS.exe
  2⤵
  PID:5124
- C:\Windows\System\XjHAOSE.exe
  C:\Windows\System\XjHAOSE.exe
  2⤵
  PID:4604
- C:\Windows\System\ZvkvpIz.exe
  C:\Windows\System\ZvkvpIz.exe
  2⤵
  PID:5556
- C:\Windows\System\iLBCAwF.exe
  C:\Windows\System\iLBCAwF.exe
  2⤵
  PID:6056
- C:\Windows\System\zewAUat.exe
  C:\Windows\System\zewAUat.exe
  2⤵
  PID:5652
- C:\Windows\System\FFBgMAr.exe
  C:\Windows\System\FFBgMAr.exe
  2⤵
  PID:4908
- C:\Windows\System\dyPUicG.exe
  C:\Windows\System\dyPUicG.exe
  2⤵
  PID:5436
- C:\Windows\System\MpgApsR.exe
  C:\Windows\System\MpgApsR.exe
  2⤵
  PID:5508
- C:\Windows\System\AVvRECm.exe
  C:\Windows\System\AVvRECm.exe
  2⤵
  PID:5920
- C:\Windows\System\kZCltXv.exe
  C:\Windows\System\kZCltXv.exe
  2⤵
  PID:5148
- C:\Windows\System\vfCJFsh.exe
  C:\Windows\System\vfCJFsh.exe
  2⤵
  PID:5164
- C:\Windows\System\KevQFmn.exe
  C:\Windows\System\KevQFmn.exe
  2⤵
  PID:4212
- C:\Windows\System\dGhfjuV.exe
  C:\Windows\System\dGhfjuV.exe
  2⤵
  PID:5712
- C:\Windows\System\bVpNxUT.exe
  C:\Windows\System\bVpNxUT.exe
  2⤵
  PID:4620
- C:\Windows\System\jSKwryp.exe
  C:\Windows\System\jSKwryp.exe
  2⤵
  PID:6152
- C:\Windows\System\WTRTTym.exe
  C:\Windows\System\WTRTTym.exe
  2⤵
  PID:6168
- C:\Windows\System\MlrLqwp.exe
  C:\Windows\System\MlrLqwp.exe
  2⤵
  PID:6184
- C:\Windows\System\XIEyVuO.exe
  C:\Windows\System\XIEyVuO.exe
  2⤵
  PID:6200
- C:\Windows\System\sCXsXgL.exe
  C:\Windows\System\sCXsXgL.exe
  2⤵
  PID:6216
- C:\Windows\System\KRpuYSG.exe
  C:\Windows\System\KRpuYSG.exe
  2⤵
  PID:6232
- C:\Windows\System\esQRTgp.exe
  C:\Windows\System\esQRTgp.exe
  2⤵
  PID:6248
- C:\Windows\System\BwNgCjZ.exe
  C:\Windows\System\BwNgCjZ.exe
  2⤵
  PID:6264
- C:\Windows\System\MCQVUOm.exe
  C:\Windows\System\MCQVUOm.exe
  2⤵
  PID:6280
- C:\Windows\System\cNBdYEW.exe
  C:\Windows\System\cNBdYEW.exe
  2⤵
  PID:6296
- C:\Windows\System\XTeSKaP.exe
  C:\Windows\System\XTeSKaP.exe
  2⤵
  PID:6312
- C:\Windows\System\hwuuxUr.exe
  C:\Windows\System\hwuuxUr.exe
  2⤵
  PID:6328
- C:\Windows\System\pxNLznE.exe
  C:\Windows\System\pxNLznE.exe
  2⤵
  PID:6344
- C:\Windows\System\PcEhVDG.exe
  C:\Windows\System\PcEhVDG.exe
  2⤵
  PID:6360
- C:\Windows\System\lAQvWWi.exe
  C:\Windows\System\lAQvWWi.exe
  2⤵
  PID:6376
- C:\Windows\System\NnsRWNH.exe
  C:\Windows\System\NnsRWNH.exe
  2⤵
  PID:6392
- C:\Windows\System\RFCtEuz.exe
  C:\Windows\System\RFCtEuz.exe
  2⤵
  PID:6408
- C:\Windows\System\UFccCod.exe
  C:\Windows\System\UFccCod.exe
  2⤵
  PID:6424
- C:\Windows\System\GisBaBG.exe
  C:\Windows\System\GisBaBG.exe
  2⤵
  PID:6440
- C:\Windows\System\JdadJKM.exe
  C:\Windows\System\JdadJKM.exe
  2⤵
  PID:6456
- C:\Windows\System\ZCXxFmY.exe
  C:\Windows\System\ZCXxFmY.exe
  2⤵
  PID:6472
- C:\Windows\System\yvFIuKz.exe
  C:\Windows\System\yvFIuKz.exe
  2⤵
  PID:6488
- C:\Windows\System\neyDPzY.exe
  C:\Windows\System\neyDPzY.exe
  2⤵
  PID:6504
- C:\Windows\System\VuFKZLJ.exe
  C:\Windows\System\VuFKZLJ.exe
  2⤵
  PID:6520
- C:\Windows\System\hsfJqTr.exe
  C:\Windows\System\hsfJqTr.exe
  2⤵
  PID:6536
- C:\Windows\System\fkzSLYV.exe
  C:\Windows\System\fkzSLYV.exe
  2⤵
  PID:6552
- C:\Windows\System\TzffZJQ.exe
  C:\Windows\System\TzffZJQ.exe
  2⤵
  PID:6568
- C:\Windows\System\ccpVvyN.exe
  C:\Windows\System\ccpVvyN.exe
  2⤵
  PID:6584
- C:\Windows\System\MRNNEGd.exe
  C:\Windows\System\MRNNEGd.exe
  2⤵
  PID:6600
- C:\Windows\System\khRbCBo.exe
  C:\Windows\System\khRbCBo.exe
  2⤵
  PID:6616
- C:\Windows\System\hvKPDfF.exe
  C:\Windows\System\hvKPDfF.exe
  2⤵
  PID:6632
- C:\Windows\System\yJmkjFa.exe
  C:\Windows\System\yJmkjFa.exe
  2⤵
  PID:6648
- C:\Windows\System\ugCWqSc.exe
  C:\Windows\System\ugCWqSc.exe
  2⤵
  PID:6664
- C:\Windows\System\xYCdIlA.exe
  C:\Windows\System\xYCdIlA.exe
  2⤵
  PID:6680
- C:\Windows\System\jJMAXBB.exe
  C:\Windows\System\jJMAXBB.exe
  2⤵
  PID:6696
- C:\Windows\System\vLndQTF.exe
  C:\Windows\System\vLndQTF.exe
  2⤵
  PID:6712
- C:\Windows\System\wRmFgbD.exe
  C:\Windows\System\wRmFgbD.exe
  2⤵
  PID:6728
- C:\Windows\System\FkTsaHJ.exe
  C:\Windows\System\FkTsaHJ.exe
  2⤵
  PID:6744
- C:\Windows\System\vKGAJYI.exe
  C:\Windows\System\vKGAJYI.exe
  2⤵
  PID:6760
- C:\Windows\System\suvhjfR.exe
  C:\Windows\System\suvhjfR.exe
  2⤵
  PID:6776
- C:\Windows\System\KGfOfsO.exe
  C:\Windows\System\KGfOfsO.exe
  2⤵
  PID:6792
- C:\Windows\System\SIvdDjV.exe
  C:\Windows\System\SIvdDjV.exe
  2⤵
  PID:6808
- C:\Windows\System\HaalKaF.exe
  C:\Windows\System\HaalKaF.exe
  2⤵
  PID:6824
- C:\Windows\System\EUbMZUe.exe
  C:\Windows\System\EUbMZUe.exe
  2⤵
  PID:6840
- C:\Windows\System\btEpgbw.exe
  C:\Windows\System\btEpgbw.exe
  2⤵
  PID:6856
- C:\Windows\System\FjVjvjA.exe
  C:\Windows\System\FjVjvjA.exe
  2⤵
  PID:6872
- C:\Windows\System\iyZpQLt.exe
  C:\Windows\System\iyZpQLt.exe
  2⤵
  PID:6888
- C:\Windows\System\OEPiDJn.exe
  C:\Windows\System\OEPiDJn.exe
  2⤵
  PID:6904
- C:\Windows\System\kmpBcKw.exe
  C:\Windows\System\kmpBcKw.exe
  2⤵
  PID:6920
- C:\Windows\System\cukttSp.exe
  C:\Windows\System\cukttSp.exe
  2⤵
  PID:6936
- C:\Windows\System\cPUyTOc.exe
  C:\Windows\System\cPUyTOc.exe
  2⤵
  PID:6952
- C:\Windows\System\mUgffbq.exe
  C:\Windows\System\mUgffbq.exe
  2⤵
  PID:6968
- C:\Windows\System\HSXggut.exe
  C:\Windows\System\HSXggut.exe
  2⤵
  PID:6984
- C:\Windows\System\GhRnWjr.exe
  C:\Windows\System\GhRnWjr.exe
  2⤵
  PID:7000
- C:\Windows\System\tvPGHFx.exe
  C:\Windows\System\tvPGHFx.exe
  2⤵
  PID:7016
- C:\Windows\System\qPduNma.exe
  C:\Windows\System\qPduNma.exe
  2⤵
  PID:7032
- C:\Windows\System\lYvAwsA.exe
  C:\Windows\System\lYvAwsA.exe
  2⤵
  PID:7048
- C:\Windows\System\yPGxEIQ.exe
  C:\Windows\System\yPGxEIQ.exe
  2⤵
  PID:7064
- C:\Windows\System\bGgKvFq.exe
  C:\Windows\System\bGgKvFq.exe
  2⤵
  PID:7080
- C:\Windows\System\SrPQTLk.exe
  C:\Windows\System\SrPQTLk.exe
  2⤵
  PID:7096
- C:\Windows\System\LImuDxa.exe
  C:\Windows\System\LImuDxa.exe
  2⤵
  PID:7112
- C:\Windows\System\yqZtCnV.exe
  C:\Windows\System\yqZtCnV.exe
  2⤵
  PID:7128
- C:\Windows\System\hkOGOza.exe
  C:\Windows\System\hkOGOza.exe
  2⤵
  PID:7144
- C:\Windows\System\fwyxaDq.exe
  C:\Windows\System\fwyxaDq.exe
  2⤵
  PID:7160
- C:\Windows\System\yRAfZXI.exe
  C:\Windows\System\yRAfZXI.exe
  2⤵
  PID:5820
- C:\Windows\System\ztUKHLa.exe
  C:\Windows\System\ztUKHLa.exe
  2⤵
  PID:6208
- C:\Windows\System\bFqtGKv.exe
  C:\Windows\System\bFqtGKv.exe
  2⤵
  PID:5824
- C:\Windows\System\RFIDAYZ.exe
  C:\Windows\System\RFIDAYZ.exe
  2⤵
  PID:5244
- C:\Windows\System\MTZRuJe.exe
  C:\Windows\System\MTZRuJe.exe
  2⤵
  PID:6272
- C:\Windows\System\qePxZgP.exe
  C:\Windows\System\qePxZgP.exe
  2⤵
  PID:5224
- C:\Windows\System\NEQFDzC.exe
  C:\Windows\System\NEQFDzC.exe
  2⤵
  PID:6196
- C:\Windows\System\BekwQlO.exe
  C:\Windows\System\BekwQlO.exe
  2⤵
  PID:6260
- C:\Windows\System\ubtTvyM.exe
  C:\Windows\System\ubtTvyM.exe
  2⤵
  PID:6340
- C:\Windows\System\hnnNOQs.exe
  C:\Windows\System\hnnNOQs.exe
  2⤵
  PID:6404
- C:\Windows\System\SMzaftO.exe
  C:\Windows\System\SMzaftO.exe
  2⤵
  PID:6468
- C:\Windows\System\puQrvvY.exe
  C:\Windows\System\puQrvvY.exe
  2⤵
  PID:6532
- C:\Windows\System\NegmzYn.exe
  C:\Windows\System\NegmzYn.exe
  2⤵
  PID:6512
- C:\Windows\System\uGsBlME.exe
  C:\Windows\System\uGsBlME.exe
  2⤵
  PID:6628
- C:\Windows\System\uBqwwuC.exe
  C:\Windows\System\uBqwwuC.exe
  2⤵
  PID:6688
- C:\Windows\System\fnbKkeP.exe
  C:\Windows\System\fnbKkeP.exe
  2⤵
  PID:6576
- C:\Windows\System\mXLArHw.exe
  C:\Windows\System\mXLArHw.exe
  2⤵
  PID:6352
- C:\Windows\System\KlRTuTZ.exe
  C:\Windows\System\KlRTuTZ.exe
  2⤵
  PID:6388
- C:\Windows\System\AOWZwaW.exe
  C:\Windows\System\AOWZwaW.exe
  2⤵
  PID:6452
- C:\Windows\System\TdCxijK.exe
  C:\Windows\System\TdCxijK.exe
  2⤵
  PID:6612
- C:\Windows\System\OvByGra.exe
  C:\Windows\System\OvByGra.exe
  2⤵
  PID:6608
- C:\Windows\System\pEFSFiR.exe
  C:\Windows\System\pEFSFiR.exe
  2⤵
  PID:6676
- C:\Windows\System\aYPUlAP.exe
  C:\Windows\System\aYPUlAP.exe
  2⤵
  PID:6784
- C:\Windows\System\qtBCHSC.exe
  C:\Windows\System\qtBCHSC.exe
  2⤵
  PID:6852
- C:\Windows\System\WasUecz.exe
  C:\Windows\System\WasUecz.exe
  2⤵
  PID:6912
- C:\Windows\System\jkLLezQ.exe
  C:\Windows\System\jkLLezQ.exe
  2⤵
  PID:6948
- C:\Windows\System\oqSUHvY.exe
  C:\Windows\System\oqSUHvY.exe
  2⤵
  PID:7040
- C:\Windows\System\rHLbXcI.exe
  C:\Windows\System\rHLbXcI.exe
  2⤵
  PID:6992
- C:\Windows\System\ZKtxPnw.exe
  C:\Windows\System\ZKtxPnw.exe
  2⤵
  PID:7140
- C:\Windows\System\dVowszB.exe
  C:\Windows\System\dVowszB.exe
  2⤵
  PID:5376
- C:\Windows\System\Edrcyon.exe
  C:\Windows\System\Edrcyon.exe
  2⤵
  PID:6932
- C:\Windows\System\XppcnTp.exe
  C:\Windows\System\XppcnTp.exe
  2⤵
  PID:7088
- C:\Windows\System\UJAvgLo.exe
  C:\Windows\System\UJAvgLo.exe
  2⤵
  PID:7124
- C:\Windows\System\uDefNXW.exe
  C:\Windows\System\uDefNXW.exe
  2⤵
  PID:6240
- C:\Windows\System\HtMAAwU.exe
  C:\Windows\System\HtMAAwU.exe
  2⤵
  PID:6080
- C:\Windows\System\AXLoHGJ.exe
  C:\Windows\System\AXLoHGJ.exe
  2⤵
  PID:6304
- C:\Windows\System\TImHiqC.exe
  C:\Windows\System\TImHiqC.exe
  2⤵
  PID:6308
- C:\Windows\System\tEkooVa.exe
  C:\Windows\System\tEkooVa.exe
  2⤵
  PID:6464
- C:\Windows\System\gPArLJz.exe
  C:\Windows\System\gPArLJz.exe
  2⤵
  PID:6320
- C:\Windows\System\EbfYSqD.exe
  C:\Windows\System\EbfYSqD.exe
  2⤵
  PID:6484
- C:\Windows\System\RsWMPNO.exe
  C:\Windows\System\RsWMPNO.exe
  2⤵
  PID:6720
- C:\Windows\System\acEOsym.exe
  C:\Windows\System\acEOsym.exe
  2⤵
  PID:6580
- C:\Windows\System\gpaVOUc.exe
  C:\Windows\System\gpaVOUc.exe
  2⤵
  PID:6624
- C:\Windows\System\pabhVZJ.exe
  C:\Windows\System\pabhVZJ.exe
  2⤵
  PID:6672
- C:\Windows\System\qCnaElV.exe
  C:\Windows\System\qCnaElV.exe
  2⤵
  PID:6980
- C:\Windows\System\waBalRl.exe
  C:\Windows\System\waBalRl.exe
  2⤵
  PID:7012
- C:\Windows\System\ViDAGTm.exe
  C:\Windows\System\ViDAGTm.exe
  2⤵
  PID:7108
- C:\Windows\System\hKwHEtj.exe
  C:\Windows\System\hKwHEtj.exe
  2⤵
  PID:6928
- C:\Windows\System\ULSVfrd.exe
  C:\Windows\System\ULSVfrd.exe
  2⤵
  PID:7024
- C:\Windows\System\KxRTyuG.exe
  C:\Windows\System\KxRTyuG.exe
  2⤵
  PID:6336
- C:\Windows\System\OCHUqRt.exe
  C:\Windows\System\OCHUqRt.exe
  2⤵
  PID:6256
- C:\Windows\System\DmoXwVp.exe
  C:\Windows\System\DmoXwVp.exe
  2⤵
  PID:6660
- C:\Windows\System\ihgpJyf.exe
  C:\Windows\System\ihgpJyf.exe
  2⤵
  PID:6400
- C:\Windows\System\EBVSReV.exe
  C:\Windows\System\EBVSReV.exe
  2⤵
  PID:5896
- C:\Windows\System\FdxGPIy.exe
  C:\Windows\System\FdxGPIy.exe
  2⤵
  PID:6180
- C:\Windows\System\Xmedozo.exe
  C:\Windows\System\Xmedozo.exe
  2⤵
  PID:6884
- C:\Windows\System\bLueXXO.exe
  C:\Windows\System\bLueXXO.exe
  2⤵
  PID:7156
- C:\Windows\System\jcYkthm.exe
  C:\Windows\System\jcYkthm.exe
  2⤵
  PID:6756
- C:\Windows\System\qTWznhR.exe
  C:\Windows\System\qTWznhR.exe
  2⤵
  PID:5728
- C:\Windows\System\njjmNqi.exe
  C:\Windows\System\njjmNqi.exe
  2⤵
  PID:6544
- C:\Windows\System\giaMfoT.exe
  C:\Windows\System\giaMfoT.exe
  2⤵
  PID:7180
- C:\Windows\System\Vnxgqbw.exe
  C:\Windows\System\Vnxgqbw.exe
  2⤵
  PID:7196
- C:\Windows\System\XsyoSYI.exe
  C:\Windows\System\XsyoSYI.exe
  2⤵
  PID:7212
- C:\Windows\System\XmMBBrp.exe
  C:\Windows\System\XmMBBrp.exe
  2⤵
  PID:7228
- C:\Windows\System\LExVTbE.exe
  C:\Windows\System\LExVTbE.exe
  2⤵
  PID:7244
- C:\Windows\System\kMRLtyi.exe
  C:\Windows\System\kMRLtyi.exe
  2⤵
  PID:7260
- C:\Windows\System\OBmfMOw.exe
  C:\Windows\System\OBmfMOw.exe
  2⤵
  PID:7276
- C:\Windows\System\MsTsejV.exe
  C:\Windows\System\MsTsejV.exe
  2⤵
  PID:7292
- C:\Windows\System\FEzoAjo.exe
  C:\Windows\System\FEzoAjo.exe
  2⤵
  PID:7308
- C:\Windows\System\NRDpWSp.exe
  C:\Windows\System\NRDpWSp.exe
  2⤵
  PID:7324
- C:\Windows\System\bNMsjZj.exe
  C:\Windows\System\bNMsjZj.exe
  2⤵
  PID:7340
- C:\Windows\System\FLIRpVq.exe
  C:\Windows\System\FLIRpVq.exe
  2⤵
  PID:7356
- C:\Windows\System\yiKcdRy.exe
  C:\Windows\System\yiKcdRy.exe
  2⤵
  PID:7372
- C:\Windows\System\DtCfRGF.exe
  C:\Windows\System\DtCfRGF.exe
  2⤵
  PID:7388
- C:\Windows\System\VVZnmug.exe
  C:\Windows\System\VVZnmug.exe
  2⤵
  PID:7404
- C:\Windows\System\LZmYWCe.exe
  C:\Windows\System\LZmYWCe.exe
  2⤵
  PID:7420
- C:\Windows\System\gGDGMGV.exe
  C:\Windows\System\gGDGMGV.exe
  2⤵
  PID:7436
- C:\Windows\System\eDKHaIv.exe
  C:\Windows\System\eDKHaIv.exe
  2⤵
  PID:7452
- C:\Windows\System\owzESmI.exe
  C:\Windows\System\owzESmI.exe
  2⤵
  PID:7468
- C:\Windows\System\pzPnHRj.exe
  C:\Windows\System\pzPnHRj.exe
  2⤵
  PID:7484
- C:\Windows\System\egwCCsV.exe
  C:\Windows\System\egwCCsV.exe
  2⤵
  PID:7500
- C:\Windows\System\cUbAbHJ.exe
  C:\Windows\System\cUbAbHJ.exe
  2⤵
  PID:7516
- C:\Windows\System\CZClcid.exe
  C:\Windows\System\CZClcid.exe
  2⤵
  PID:7532
- C:\Windows\System\viOrQZi.exe
  C:\Windows\System\viOrQZi.exe
  2⤵
  PID:7548
- C:\Windows\System\PTUAWuD.exe
  C:\Windows\System\PTUAWuD.exe
  2⤵
  PID:7564
- C:\Windows\System\eLounYY.exe
  C:\Windows\System\eLounYY.exe
  2⤵
  PID:7580
- C:\Windows\System\nPGAnoH.exe
  C:\Windows\System\nPGAnoH.exe
  2⤵
  PID:7596
- C:\Windows\System\nrLffoN.exe
  C:\Windows\System\nrLffoN.exe
  2⤵
  PID:7612
- C:\Windows\System\lWIRnhM.exe
  C:\Windows\System\lWIRnhM.exe
  2⤵
  PID:7628
- C:\Windows\System\WgoOGvG.exe
  C:\Windows\System\WgoOGvG.exe
  2⤵
  PID:7648
- C:\Windows\System\lFiSDaH.exe
  C:\Windows\System\lFiSDaH.exe
  2⤵
  PID:7664
- C:\Windows\System\VsBszlt.exe
  C:\Windows\System\VsBszlt.exe
  2⤵
  PID:7680
- C:\Windows\System\tbykwzi.exe
  C:\Windows\System\tbykwzi.exe
  2⤵
  PID:7696
- C:\Windows\System\dnbDTNO.exe
  C:\Windows\System\dnbDTNO.exe
  2⤵
  PID:7712
- C:\Windows\System\FznzlAy.exe
  C:\Windows\System\FznzlAy.exe
  2⤵
  PID:7728
- C:\Windows\System\ZJCcVyj.exe
  C:\Windows\System\ZJCcVyj.exe
  2⤵
  PID:7744
- C:\Windows\System\QfFiHvR.exe
  C:\Windows\System\QfFiHvR.exe
  2⤵
  PID:7760
- C:\Windows\System\DZfKQek.exe
  C:\Windows\System\DZfKQek.exe
  2⤵
  PID:7776
- C:\Windows\System\CNtoDhz.exe
  C:\Windows\System\CNtoDhz.exe
  2⤵
  PID:7792
- C:\Windows\System\ilpuxUi.exe
  C:\Windows\System\ilpuxUi.exe
  2⤵
  PID:7808
- C:\Windows\System\mncevPT.exe
  C:\Windows\System\mncevPT.exe
  2⤵
  PID:7824
- C:\Windows\System\OBImZSJ.exe
  C:\Windows\System\OBImZSJ.exe
  2⤵
  PID:7840
- C:\Windows\System\nFNCFlb.exe
  C:\Windows\System\nFNCFlb.exe
  2⤵
  PID:7856
- C:\Windows\System\wgkzgyB.exe
  C:\Windows\System\wgkzgyB.exe
  2⤵
  PID:7872
- C:\Windows\System\yMlcgKA.exe
  C:\Windows\System\yMlcgKA.exe
  2⤵
  PID:7888
- C:\Windows\System\xnRknnP.exe
  C:\Windows\System\xnRknnP.exe
  2⤵
  PID:7904
- C:\Windows\System\OYniUfy.exe
  C:\Windows\System\OYniUfy.exe
  2⤵
  PID:7920
- C:\Windows\System\ZqylVme.exe
  C:\Windows\System\ZqylVme.exe
  2⤵
  PID:7936
- C:\Windows\System\yGfwjQV.exe
  C:\Windows\System\yGfwjQV.exe
  2⤵
  PID:7952
- C:\Windows\System\GvZAgXH.exe
  C:\Windows\System\GvZAgXH.exe
  2⤵
  PID:7968
- C:\Windows\System\LfzcUbY.exe
  C:\Windows\System\LfzcUbY.exe
  2⤵
  PID:7984
- C:\Windows\System\hIvsjKS.exe
  C:\Windows\System\hIvsjKS.exe
  2⤵
  PID:8000
- C:\Windows\System\HGpwiUj.exe
  C:\Windows\System\HGpwiUj.exe
  2⤵
  PID:8016
- C:\Windows\System\AgHCNab.exe
  C:\Windows\System\AgHCNab.exe
  2⤵
  PID:8032
- C:\Windows\System\JdDvqFR.exe
  C:\Windows\System\JdDvqFR.exe
  2⤵
  PID:8048
- C:\Windows\System\iSMTumR.exe
  C:\Windows\System\iSMTumR.exe
  2⤵
  PID:8064
- C:\Windows\System\RTtTgbz.exe
  C:\Windows\System\RTtTgbz.exe
  2⤵
  PID:8080
- C:\Windows\System\QHronVt.exe
  C:\Windows\System\QHronVt.exe
  2⤵
  PID:8096
- C:\Windows\System\MhaRcGw.exe
  C:\Windows\System\MhaRcGw.exe
  2⤵
  PID:8112
- C:\Windows\System\MngIZxd.exe
  C:\Windows\System\MngIZxd.exe
  2⤵
  PID:8128
- C:\Windows\System\sgQiZul.exe
  C:\Windows\System\sgQiZul.exe
  2⤵
  PID:8144
- C:\Windows\System\kaoqYNM.exe
  C:\Windows\System\kaoqYNM.exe
  2⤵
  PID:8160
- C:\Windows\System\ecAdyjE.exe
  C:\Windows\System\ecAdyjE.exe
  2⤵
  PID:8176
- C:\Windows\System\lVWijhZ.exe
  C:\Windows\System\lVWijhZ.exe
  2⤵
  PID:6416
- C:\Windows\System\QvvqlYH.exe
  C:\Windows\System\QvvqlYH.exe
  2⤵
  PID:7220
- C:\Windows\System\eBBPHuw.exe
  C:\Windows\System\eBBPHuw.exe
  2⤵
  PID:7256
- C:\Windows\System\gemEhoo.exe
  C:\Windows\System\gemEhoo.exe
  2⤵
  PID:6964
- C:\Windows\System\LrLmORq.exe
  C:\Windows\System\LrLmORq.exe
  2⤵
  PID:7348
- C:\Windows\System\SWuKyGa.exe
  C:\Windows\System\SWuKyGa.exe
  2⤵
  PID:6528
- C:\Windows\System\NiqgaqE.exe
  C:\Windows\System\NiqgaqE.exe
  2⤵
  PID:7448
- C:\Windows\System\SRXtZMY.exe
  C:\Windows\System\SRXtZMY.exe
  2⤵
  PID:7512
- C:\Windows\System\qRFHMpL.exe
  C:\Windows\System\qRFHMpL.exe
  2⤵
  PID:7576
- C:\Windows\System\qkXPjeF.exe
  C:\Windows\System\qkXPjeF.exe
  2⤵
  PID:7640
- C:\Windows\System\FpiRMvN.exe
  C:\Windows\System\FpiRMvN.exe
  2⤵
  PID:7708
- C:\Windows\System\jILpDzx.exe
  C:\Windows\System\jILpDzx.exe
  2⤵
  PID:6500
- C:\Windows\System\dIhnkqB.exe
  C:\Windows\System\dIhnkqB.exe
  2⤵
  PID:7104
- C:\Windows\System\seenoMq.exe
  C:\Windows\System\seenoMq.exe
  2⤵
  PID:7556
- C:\Windows\System\omlxvup.exe
  C:\Windows\System\omlxvup.exe
  2⤵
  PID:7272
- C:\Windows\System\dhUIkcp.exe
  C:\Windows\System\dhUIkcp.exe
  2⤵
  PID:7364
- C:\Windows\System\XCLfcZh.exe
  C:\Windows\System\XCLfcZh.exe
  2⤵
  PID:7432
- C:\Windows\System\oeYiYKL.exe
  C:\Windows\System\oeYiYKL.exe
  2⤵
  PID:7528
- C:\Windows\System\wpgUXfs.exe
  C:\Windows\System\wpgUXfs.exe
  2⤵
  PID:7592
- C:\Windows\System\JELqBtH.exe
  C:\Windows\System\JELqBtH.exe
  2⤵
  PID:7660
- C:\Windows\System\DScFRtp.exe
  C:\Windows\System\DScFRtp.exe
  2⤵
  PID:7332
- C:\Windows\System\zhTnxZI.exe
  C:\Windows\System\zhTnxZI.exe
  2⤵
  PID:7724
- C:\Windows\System\ODtBvYj.exe
  C:\Windows\System\ODtBvYj.exe
  2⤵
  PID:7800
- C:\Windows\System\JvKiWyD.exe
  C:\Windows\System\JvKiWyD.exe
  2⤵
  PID:7788
- C:\Windows\System\VJtfBxX.exe
  C:\Windows\System\VJtfBxX.exe
  2⤵
  PID:7900
- C:\Windows\System\vzcyJub.exe
  C:\Windows\System\vzcyJub.exe
  2⤵
  PID:7960
- C:\Windows\System\RAqudnV.exe
  C:\Windows\System\RAqudnV.exe
  2⤵
  PID:8024
- C:\Windows\System\qHVOFIT.exe
  C:\Windows\System\qHVOFIT.exe
  2⤵
  PID:8060
- C:\Windows\System\YItFJuE.exe
  C:\Windows\System\YItFJuE.exe
  2⤵
  PID:8120
- C:\Windows\System\TgsJPmW.exe
  C:\Windows\System\TgsJPmW.exe
  2⤵
  PID:8188
- C:\Windows\System\Bvedkxj.exe
  C:\Windows\System\Bvedkxj.exe
  2⤵
  PID:7252
- C:\Windows\System\vXUMpHB.exe
  C:\Windows\System\vXUMpHB.exe
  2⤵
  PID:7416
- C:\Windows\System\ViVMUdz.exe
  C:\Windows\System\ViVMUdz.exe
  2⤵
  PID:7572
- C:\Windows\System\ysgtnQH.exe
  C:\Windows\System\ysgtnQH.exe
  2⤵
  PID:7240
- C:\Windows\System\TWwgivx.exe
  C:\Windows\System\TWwgivx.exe
  2⤵
  PID:8104
- C:\Windows\System\AAKEVYe.exe
  C:\Windows\System\AAKEVYe.exe
  2⤵
  PID:7304
- C:\Windows\System\zcHeNHg.exe
  C:\Windows\System\zcHeNHg.exe
  2⤵
  PID:7912
- C:\Windows\System\WDdoNGX.exe
  C:\Windows\System\WDdoNGX.exe
  2⤵
  PID:7980
- C:\Windows\System\Endpuzs.exe
  C:\Windows\System\Endpuzs.exe
  2⤵
  PID:8040
- C:\Windows\System\apmxxLw.exe
  C:\Windows\System\apmxxLw.exe
  2⤵
  PID:8140
- C:\Windows\System\nIjiIes.exe
  C:\Windows\System\nIjiIes.exe
  2⤵
  PID:7288
- C:\Windows\System\RRuZilY.exe
  C:\Windows\System\RRuZilY.exe
  2⤵
  PID:7508
- C:\Windows\System\ysiCuwR.exe
  C:\Windows\System\ysiCuwR.exe
  2⤵
  PID:7428
- C:\Windows\System\sVSKklE.exe
  C:\Windows\System\sVSKklE.exe
  2⤵
  PID:7336
- C:\Windows\System\UplbwNG.exe
  C:\Windows\System\UplbwNG.exe
  2⤵
  PID:7704
- C:\Windows\System\ptWSAjS.exe
  C:\Windows\System\ptWSAjS.exe
  2⤵
  PID:7492
- C:\Windows\System\AanyMiH.exe
  C:\Windows\System\AanyMiH.exe
  2⤵
  PID:7624
- C:\Windows\System\PSUHtUu.exe
  C:\Windows\System\PSUHtUu.exe
  2⤵
  PID:7816
- C:\Windows\System\OMwzWbg.exe
  C:\Windows\System\OMwzWbg.exe
  2⤵
  PID:8088
- C:\Windows\System\pWBXXks.exe
  C:\Windows\System\pWBXXks.exe
  2⤵
  PID:8012
- C:\Windows\System\xKloidu.exe
  C:\Windows\System\xKloidu.exe
  2⤵
  PID:7916
- C:\Windows\System\HiPMDGw.exe
  C:\Windows\System\HiPMDGw.exe
  2⤵
  PID:7172
- C:\Windows\System\epCKDmM.exe
  C:\Windows\System\epCKDmM.exe
  2⤵
  PID:7672
- C:\Windows\System\vKAeGcj.exe
  C:\Windows\System\vKAeGcj.exe
  2⤵
  PID:7320
- C:\Windows\System\mPSCqBv.exe
  C:\Windows\System\mPSCqBv.exe
  2⤵
  PID:7976
- C:\Windows\System\rDYehTZ.exe
  C:\Windows\System\rDYehTZ.exe
  2⤵
  PID:7676
- C:\Windows\System\cMWpjTG.exe
  C:\Windows\System\cMWpjTG.exe
  2⤵
  PID:7996
- C:\Windows\System\XhARpuP.exe
  C:\Windows\System\XhARpuP.exe
  2⤵
  PID:6804
- C:\Windows\System\aONsZvC.exe
  C:\Windows\System\aONsZvC.exe
  2⤵
  PID:7480
- C:\Windows\System\QKDawYI.exe
  C:\Windows\System\QKDawYI.exe
  2⤵
  PID:7720
- C:\Windows\System\dNzZoAW.exe
  C:\Windows\System\dNzZoAW.exe
  2⤵
  PID:7384
- C:\Windows\System\HyRCIdO.exe
  C:\Windows\System\HyRCIdO.exe
  2⤵
  PID:7768
- C:\Windows\System\iHYyayE.exe
  C:\Windows\System\iHYyayE.exe
  2⤵
  PID:8156
- C:\Windows\System\hoEnjbB.exe
  C:\Windows\System\hoEnjbB.exe
  2⤵
  PID:8152
- C:\Windows\System\aEwVtfl.exe
  C:\Windows\System\aEwVtfl.exe
  2⤵
  PID:7832
- C:\Windows\System\lXmpFyZ.exe
  C:\Windows\System\lXmpFyZ.exe
  2⤵
  PID:7192
- C:\Windows\System\xdwUPeC.exe
  C:\Windows\System\xdwUPeC.exe
  2⤵
  PID:8204
- C:\Windows\System\ydArIot.exe
  C:\Windows\System\ydArIot.exe
  2⤵
  PID:8220
- C:\Windows\System\fwLDJFn.exe
  C:\Windows\System\fwLDJFn.exe
  2⤵
  PID:8236
- C:\Windows\System\bIqNQeA.exe
  C:\Windows\System\bIqNQeA.exe
  2⤵
  PID:8252
- C:\Windows\System\TXxBskm.exe
  C:\Windows\System\TXxBskm.exe
  2⤵
  PID:8268
- C:\Windows\System\KoKJXTv.exe
  C:\Windows\System\KoKJXTv.exe
  2⤵
  PID:8284
- C:\Windows\System\Ojfwzih.exe
  C:\Windows\System\Ojfwzih.exe
  2⤵
  PID:8300
- C:\Windows\System\fkMCxsx.exe
  C:\Windows\System\fkMCxsx.exe
  2⤵
  PID:8316
- C:\Windows\System\ciFrRMN.exe
  C:\Windows\System\ciFrRMN.exe
  2⤵
  PID:8332
- C:\Windows\System\tFtNvtF.exe
  C:\Windows\System\tFtNvtF.exe
  2⤵
  PID:8348
- C:\Windows\System\xsYJsZP.exe
  C:\Windows\System\xsYJsZP.exe
  2⤵
  PID:8364
- C:\Windows\System\kkBtiDP.exe
  C:\Windows\System\kkBtiDP.exe
  2⤵
  PID:8384
- C:\Windows\System\WfejrjN.exe
  C:\Windows\System\WfejrjN.exe
  2⤵
  PID:8400
- C:\Windows\System\YKMZzcF.exe
  C:\Windows\System\YKMZzcF.exe
  2⤵
  PID:8416
- C:\Windows\System\NMTxegG.exe
  C:\Windows\System\NMTxegG.exe
  2⤵
  PID:8432
- C:\Windows\System\beuXKPr.exe
  C:\Windows\System\beuXKPr.exe
  2⤵
  PID:8448
- C:\Windows\System\ZQownLu.exe
  C:\Windows\System\ZQownLu.exe
  2⤵
  PID:8464
- C:\Windows\System\kyDiXoH.exe
  C:\Windows\System\kyDiXoH.exe
  2⤵
  PID:8480
- C:\Windows\System\RpSUZDq.exe
  C:\Windows\System\RpSUZDq.exe
  2⤵
  PID:8496
- C:\Windows\System\TtJqMhU.exe
  C:\Windows\System\TtJqMhU.exe
  2⤵
  PID:8512
- C:\Windows\System\NBNXNsN.exe
  C:\Windows\System\NBNXNsN.exe
  2⤵
  PID:8528
- C:\Windows\System\EVALqhI.exe
  C:\Windows\System\EVALqhI.exe
  2⤵
  PID:8544
- C:\Windows\System\GRvXjmc.exe
  C:\Windows\System\GRvXjmc.exe
  2⤵
  PID:8560
- C:\Windows\System\ULlpBYS.exe
  C:\Windows\System\ULlpBYS.exe
  2⤵
  PID:8576
- C:\Windows\System\uqEvghO.exe
  C:\Windows\System\uqEvghO.exe
  2⤵
  PID:8592
- C:\Windows\System\MyLbbUd.exe
  C:\Windows\System\MyLbbUd.exe
  2⤵
  PID:8608
- C:\Windows\System\aKlHaDy.exe
  C:\Windows\System\aKlHaDy.exe
  2⤵
  PID:8624
- C:\Windows\System\fzaUMnF.exe
  C:\Windows\System\fzaUMnF.exe
  2⤵
  PID:8640
- C:\Windows\System\tpqotNf.exe
  C:\Windows\System\tpqotNf.exe
  2⤵
  PID:8656
- C:\Windows\System\YlOzltu.exe
  C:\Windows\System\YlOzltu.exe
  2⤵
  PID:8672
- C:\Windows\System\iWZOEux.exe
  C:\Windows\System\iWZOEux.exe
  2⤵
  PID:8688
- C:\Windows\System\yBHOUfM.exe
  C:\Windows\System\yBHOUfM.exe
  2⤵
  PID:8704
- C:\Windows\System\ETsxIUB.exe
  C:\Windows\System\ETsxIUB.exe
  2⤵
  PID:8720
- C:\Windows\System\iispoYz.exe
  C:\Windows\System\iispoYz.exe
  2⤵
  PID:8736
- C:\Windows\System\KrObTNA.exe
  C:\Windows\System\KrObTNA.exe
  2⤵
  PID:8752
- C:\Windows\System\GVIpbxe.exe
  C:\Windows\System\GVIpbxe.exe
  2⤵
  PID:8768
- C:\Windows\System\BQIZZOD.exe
  C:\Windows\System\BQIZZOD.exe
  2⤵
  PID:8784
- C:\Windows\System\SIlrUvZ.exe
  C:\Windows\System\SIlrUvZ.exe
  2⤵
  PID:8800
- C:\Windows\System\uFYRarD.exe
  C:\Windows\System\uFYRarD.exe
  2⤵
  PID:8816
- C:\Windows\System\QGhhKKM.exe
  C:\Windows\System\QGhhKKM.exe
  2⤵
  PID:8832
- C:\Windows\System\fsJaEZB.exe
  C:\Windows\System\fsJaEZB.exe
  2⤵
  PID:8848
- C:\Windows\System\DTCCKYO.exe
  C:\Windows\System\DTCCKYO.exe
  2⤵
  PID:8864
- C:\Windows\System\ZRcwudR.exe
  C:\Windows\System\ZRcwudR.exe
  2⤵
  PID:8880
- C:\Windows\System\mnmcRXF.exe
  C:\Windows\System\mnmcRXF.exe
  2⤵
  PID:8896
- C:\Windows\System\AFHlbOK.exe
  C:\Windows\System\AFHlbOK.exe
  2⤵
  PID:8912
- C:\Windows\System\VUjlPXi.exe
  C:\Windows\System\VUjlPXi.exe
  2⤵
  PID:8928
- C:\Windows\System\VTmoGvT.exe
  C:\Windows\System\VTmoGvT.exe
  2⤵
  PID:8944
- C:\Windows\System\JVPWCKe.exe
  C:\Windows\System\JVPWCKe.exe
  2⤵
  PID:8960
- C:\Windows\System\XbLbxaC.exe
  C:\Windows\System\XbLbxaC.exe
  2⤵
  PID:8976
- C:\Windows\System\trmudok.exe
  C:\Windows\System\trmudok.exe
  2⤵
  PID:8996
- C:\Windows\System\GenxieR.exe
  C:\Windows\System\GenxieR.exe
  2⤵
  PID:9012
- C:\Windows\System\SQqGNMn.exe
  C:\Windows\System\SQqGNMn.exe
  2⤵
  PID:9028
- C:\Windows\System\hWXiBNm.exe
  C:\Windows\System\hWXiBNm.exe
  2⤵
  PID:9044
- C:\Windows\System\elCaiiv.exe
  C:\Windows\System\elCaiiv.exe
  2⤵
  PID:9060
- C:\Windows\System\fXUVRrJ.exe
  C:\Windows\System\fXUVRrJ.exe
  2⤵
  PID:9076
- C:\Windows\System\SGUwcrJ.exe
  C:\Windows\System\SGUwcrJ.exe
  2⤵
  PID:9092
- C:\Windows\System\ufmTwUV.exe
  C:\Windows\System\ufmTwUV.exe
  2⤵
  PID:9108
- C:\Windows\System\iJyaEhc.exe
  C:\Windows\System\iJyaEhc.exe
  2⤵
  PID:9124
- C:\Windows\System\riLhSuG.exe
  C:\Windows\System\riLhSuG.exe
  2⤵
  PID:9140
- C:\Windows\System\XPdIHnU.exe
  C:\Windows\System\XPdIHnU.exe
  2⤵
  PID:9156
- C:\Windows\System\fDeWKcA.exe
  C:\Windows\System\fDeWKcA.exe
  2⤵
  PID:9172
- C:\Windows\System\JPOWykC.exe
  C:\Windows\System\JPOWykC.exe
  2⤵
  PID:9188
- C:\Windows\System\xBFnktn.exe
  C:\Windows\System\xBFnktn.exe
  2⤵
  PID:9204
- C:\Windows\System\SYacXSD.exe
  C:\Windows\System\SYacXSD.exe
  2⤵
  PID:8200
- C:\Windows\System\KzGfoVY.exe
  C:\Windows\System\KzGfoVY.exe
  2⤵
  PID:8228
- C:\Windows\System\TamlIoX.exe
  C:\Windows\System\TamlIoX.exe
  2⤵
  PID:6564
- C:\Windows\System\vhkBjqb.exe
  C:\Windows\System\vhkBjqb.exe
  2⤵
  PID:8216
- C:\Windows\System\bBcLfdk.exe
  C:\Windows\System\bBcLfdk.exe
  2⤵
  PID:8292
- C:\Windows\System\QtIMxoH.exe
  C:\Windows\System\QtIMxoH.exe
  2⤵
  PID:8324
- C:\Windows\System\NbVxEfa.exe
  C:\Windows\System\NbVxEfa.exe
  2⤵
  PID:8392
- C:\Windows\System\oeTdukl.exe
  C:\Windows\System\oeTdukl.exe
  2⤵
  PID:8456
- C:\Windows\System\ccqGFzJ.exe
  C:\Windows\System\ccqGFzJ.exe
  2⤵
  PID:8520
- C:\Windows\System\UCSzHVe.exe
  C:\Windows\System\UCSzHVe.exe
  2⤵
  PID:8588
- C:\Windows\System\JbHQAaW.exe
  C:\Windows\System\JbHQAaW.exe
  2⤵
  PID:8312
- C:\Windows\System\GwPIbWx.exe
  C:\Windows\System\GwPIbWx.exe
  2⤵
  PID:8372
- C:\Windows\System\nfTKRlF.exe
  C:\Windows\System\nfTKRlF.exe
  2⤵
  PID:8600
- C:\Windows\System\XPhCWmr.exe
  C:\Windows\System\XPhCWmr.exe
  2⤵
  PID:8380
- C:\Windows\System\IZVUpCp.exe
  C:\Windows\System\IZVUpCp.exe
  2⤵
  PID:8440
- C:\Windows\System\aQypxuP.exe
  C:\Windows\System\aQypxuP.exe
  2⤵
  PID:8652
- C:\Windows\System\ndlVNyn.exe
  C:\Windows\System\ndlVNyn.exe
  2⤵
  PID:8668
- C:\Windows\System\kFwqoeJ.exe
  C:\Windows\System\kFwqoeJ.exe
  2⤵
  PID:8744
- C:\Windows\System\tRJiSDY.exe
  C:\Windows\System\tRJiSDY.exe
  2⤵
  PID:8808
- C:\Windows\System\TsqzHTz.exe
  C:\Windows\System\TsqzHTz.exe
  2⤵
  PID:8872
- C:\Windows\System\tGPnsdQ.exe
  C:\Windows\System\tGPnsdQ.exe
  2⤵
  PID:8696
- C:\Windows\System\nEuVGZt.exe
  C:\Windows\System\nEuVGZt.exe
  2⤵
  PID:8888
- C:\Windows\System\XPnJMBI.exe
  C:\Windows\System\XPnJMBI.exe
  2⤵
  PID:8936
- C:\Windows\System\gbgpdGb.exe
  C:\Windows\System\gbgpdGb.exe
  2⤵
  PID:8860
- C:\Windows\System\pingrbw.exe
  C:\Windows\System\pingrbw.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:8972
- C:\Windows\System\BlAviCl.exe
  C:\Windows\System\BlAviCl.exe
  2⤵
  PID:9036
- C:\Windows\System\LZMOCzk.exe
  C:\Windows\System\LZMOCzk.exe
  2⤵
  PID:8952
- C:\Windows\System\DKaOsRs.exe
  C:\Windows\System\DKaOsRs.exe
  2⤵
  PID:8924
- C:\Windows\System\FQgtFjF.exe
  C:\Windows\System\FQgtFjF.exe
  2⤵
  PID:9020
- C:\Windows\System\tYOBwLT.exe
  C:\Windows\System\tYOBwLT.exe
  2⤵
  PID:9084
- C:\Windows\System\KLyKzdu.exe
  C:\Windows\System\KLyKzdu.exe
  2⤵
  PID:9132
- C:\Windows\System\SEQvRSF.exe
  C:\Windows\System\SEQvRSF.exe
  2⤵
  PID:9164
- C:\Windows\System\HRXAfHP.exe
  C:\Windows\System\HRXAfHP.exe
  2⤵
  PID:7496
- C:\Windows\System\yuYbnZi.exe
  C:\Windows\System\yuYbnZi.exe
  2⤵
  PID:8276
- C:\Windows\System\FWlEscS.exe
  C:\Windows\System\FWlEscS.exe
  2⤵
  PID:9212
- C:\Windows\System\cuqCMRP.exe
  C:\Windows\System\cuqCMRP.exe
  2⤵
  PID:8260
- C:\Windows\System\dcjMmsi.exe
  C:\Windows\System\dcjMmsi.exe
  2⤵
  PID:8424
- C:\Windows\System\XtpePiu.exe
  C:\Windows\System\XtpePiu.exe
  2⤵
  PID:8552
- C:\Windows\System\VLBlqQd.exe
  C:\Windows\System\VLBlqQd.exe
  2⤵
  PID:8620
- C:\Windows\System\fXIPFYn.exe
  C:\Windows\System\fXIPFYn.exe
  2⤵
  PID:8572
- C:\Windows\System\rAOmlED.exe
  C:\Windows\System\rAOmlED.exe
  2⤵
  PID:8444
- C:\Windows\System\fKCMZpT.exe
  C:\Windows\System\fKCMZpT.exe
  2⤵
  PID:8632
- C:\Windows\System\kWUAMXJ.exe
  C:\Windows\System\kWUAMXJ.exe
  2⤵
  PID:8840
- C:\Windows\System\VZNdqqY.exe
  C:\Windows\System\VZNdqqY.exe
  2⤵
  PID:8664
- C:\Windows\System\KYKsCHu.exe
  C:\Windows\System\KYKsCHu.exe
  2⤵
  PID:8760
- C:\Windows\System\ALIwkEg.exe
  C:\Windows\System\ALIwkEg.exe
  2⤵
  PID:8828
- C:\Windows\System\mVbwEMd.exe
  C:\Windows\System\mVbwEMd.exe
  2⤵
  PID:9072
- C:\Windows\System\vwPMPvT.exe
  C:\Windows\System\vwPMPvT.exe
  2⤵
  PID:8984
- C:\Windows\System\pIjSnGb.exe
  C:\Windows\System\pIjSnGb.exe
  2⤵
  PID:9152
- C:\Windows\System\HtsAYqs.exe
  C:\Windows\System\HtsAYqs.exe
  2⤵
  PID:9116
- C:\Windows\System\NZcOwzO.exe
  C:\Windows\System\NZcOwzO.exe
  2⤵
  PID:9196
- C:\Windows\System\GHtVjNF.exe
  C:\Windows\System\GHtVjNF.exe
  2⤵
  PID:8488
- C:\Windows\System\rIEJZYI.exe
  C:\Windows\System\rIEJZYI.exe
  2⤵
  PID:8648
- C:\Windows\System\LTcumzR.exe
  C:\Windows\System\LTcumzR.exe
  2⤵
  PID:8356
- C:\Windows\System\hflGenp.exe
  C:\Windows\System\hflGenp.exe
  2⤵
  PID:8716
- C:\Windows\System\doVgLnA.exe
  C:\Windows\System\doVgLnA.exe
  2⤵
  PID:8540
- C:\Windows\System\ukhEONn.exe
  C:\Windows\System\ukhEONn.exe
  2⤵
  PID:8732
- C:\Windows\System\EdqlfSs.exe
  C:\Windows\System\EdqlfSs.exe
  2⤵
  PID:8764
- C:\Windows\System\zKxFtGK.exe
  C:\Windows\System\zKxFtGK.exe
  2⤵
  PID:8824
- C:\Windows\System\EPJbVlQ.exe
  C:\Windows\System\EPJbVlQ.exe
  2⤵
  PID:8212
- C:\Windows\System\eoQMKJr.exe
  C:\Windows\System\eoQMKJr.exe
  2⤵
  PID:9228
- C:\Windows\System\NrJCfkn.exe
  C:\Windows\System\NrJCfkn.exe
  2⤵
  PID:9244
- C:\Windows\System\MrkGDrm.exe
  C:\Windows\System\MrkGDrm.exe
  2⤵
  PID:9264
- C:\Windows\System\ynJnmzp.exe
  C:\Windows\System\ynJnmzp.exe
  2⤵
  PID:9280
- C:\Windows\System\PkaAQHM.exe
  C:\Windows\System\PkaAQHM.exe
  2⤵
  PID:9296
- C:\Windows\System\eDftxfY.exe
  C:\Windows\System\eDftxfY.exe
  2⤵
  PID:9312
- C:\Windows\System\FVyBUXh.exe
  C:\Windows\System\FVyBUXh.exe
  2⤵
  PID:9328
- C:\Windows\System\UlSkShx.exe
  C:\Windows\System\UlSkShx.exe
  2⤵
  PID:9344
- C:\Windows\System\AfiAlXA.exe
  C:\Windows\System\AfiAlXA.exe
  2⤵
  PID:9360
- C:\Windows\System\tBRjEpr.exe
  C:\Windows\System\tBRjEpr.exe
  2⤵
  PID:9376
- C:\Windows\System\xKORmqr.exe
  C:\Windows\System\xKORmqr.exe
  2⤵
  PID:9392
- C:\Windows\System\MsSnhZe.exe
  C:\Windows\System\MsSnhZe.exe
  2⤵
  PID:9408
- C:\Windows\System\lPxXPUz.exe
  C:\Windows\System\lPxXPUz.exe
  2⤵
  PID:9424
- C:\Windows\System\fPvHsJF.exe
  C:\Windows\System\fPvHsJF.exe
  2⤵
  PID:9440
- C:\Windows\System\DYTpgHo.exe
  C:\Windows\System\DYTpgHo.exe
  2⤵
  PID:9460
- C:\Windows\System\eoYnwgR.exe
  C:\Windows\System\eoYnwgR.exe
  2⤵
  PID:9476
- C:\Windows\System\zYQRgTw.exe
  C:\Windows\System\zYQRgTw.exe
  2⤵
  PID:9492
- C:\Windows\System\xXkWybR.exe
  C:\Windows\System\xXkWybR.exe
  2⤵
  PID:9508
- C:\Windows\System\gZUXFxY.exe
  C:\Windows\System\gZUXFxY.exe
  2⤵
  PID:9524
- C:\Windows\System\YmIwPPi.exe
  C:\Windows\System\YmIwPPi.exe
  2⤵
  PID:9540
- C:\Windows\System\rvtzLeu.exe
  C:\Windows\System\rvtzLeu.exe
  2⤵
  PID:9556
- C:\Windows\System\lsLbRQI.exe
  C:\Windows\System\lsLbRQI.exe
  2⤵
  PID:9572
- C:\Windows\System\EyKHlJS.exe
  C:\Windows\System\EyKHlJS.exe
  2⤵
  PID:9588
- C:\Windows\System\qaSzDUz.exe
  C:\Windows\System\qaSzDUz.exe
  2⤵
  PID:9604
- C:\Windows\System\NYQgYZK.exe
  C:\Windows\System\NYQgYZK.exe
  2⤵
  PID:9620
- C:\Windows\System\etcNQTV.exe
  C:\Windows\System\etcNQTV.exe
  2⤵
  PID:9636
- C:\Windows\System\OFPQcHv.exe
  C:\Windows\System\OFPQcHv.exe
  2⤵
  PID:9652
- C:\Windows\System\BnFdbaL.exe
  C:\Windows\System\BnFdbaL.exe
  2⤵
  PID:9668
- C:\Windows\System\DdfssQO.exe
  C:\Windows\System\DdfssQO.exe
  2⤵
  PID:9684
- C:\Windows\System\DzwCNzp.exe
  C:\Windows\System\DzwCNzp.exe
  2⤵
  PID:9700
- C:\Windows\System\FTYUgCw.exe
  C:\Windows\System\FTYUgCw.exe
  2⤵
  PID:9716
- C:\Windows\System\xHoCdFk.exe
  C:\Windows\System\xHoCdFk.exe
  2⤵
  PID:9732
- C:\Windows\System\hPRBCKj.exe
  C:\Windows\System\hPRBCKj.exe
  2⤵
  PID:9748
- C:\Windows\System\lqgagyZ.exe
  C:\Windows\System\lqgagyZ.exe
  2⤵
  PID:9764
- C:\Windows\System\cYPSvzm.exe
  C:\Windows\System\cYPSvzm.exe
  2⤵
  PID:9780
- C:\Windows\System\kvyTdJe.exe
  C:\Windows\System\kvyTdJe.exe
  2⤵
  PID:9796
- C:\Windows\System\kkMallK.exe
  C:\Windows\System\kkMallK.exe
  2⤵
  PID:9812
- C:\Windows\System\CeTdaZp.exe
  C:\Windows\System\CeTdaZp.exe
  2⤵
  PID:9828
- C:\Windows\System\jnxtArV.exe
  C:\Windows\System\jnxtArV.exe
  2⤵
  PID:9844
- C:\Windows\System\ycehfbm.exe
  C:\Windows\System\ycehfbm.exe
  2⤵
  PID:9860
- C:\Windows\System\FNcWFiH.exe
  C:\Windows\System\FNcWFiH.exe
  2⤵
  PID:9876
- C:\Windows\System\ICejDgT.exe
  C:\Windows\System\ICejDgT.exe
  2⤵
  PID:9892
- C:\Windows\System\lRPwekI.exe
  C:\Windows\System\lRPwekI.exe
  2⤵
  PID:9908
- C:\Windows\System\azvjUlh.exe
  C:\Windows\System\azvjUlh.exe
  2⤵
  PID:9924
- C:\Windows\System\mFoPSLV.exe
  C:\Windows\System\mFoPSLV.exe
  2⤵
  PID:9940
- C:\Windows\System\dKykzhu.exe
  C:\Windows\System\dKykzhu.exe
  2⤵
  PID:9956
- C:\Windows\System\jfGQjqZ.exe
  C:\Windows\System\jfGQjqZ.exe
  2⤵
  PID:9972
- C:\Windows\System\KgaDsdL.exe
  C:\Windows\System\KgaDsdL.exe
  2⤵
  PID:9988
- C:\Windows\System\feoubns.exe
  C:\Windows\System\feoubns.exe
  2⤵
  PID:10004
- C:\Windows\System\MlRofbx.exe
  C:\Windows\System\MlRofbx.exe
  2⤵
  PID:10020
- C:\Windows\System\ovEPXWz.exe
  C:\Windows\System\ovEPXWz.exe
  2⤵
  PID:10036
- C:\Windows\System\yzeWzKs.exe
  C:\Windows\System\yzeWzKs.exe
  2⤵
  PID:10052
- C:\Windows\System\JnHDSLD.exe
  C:\Windows\System\JnHDSLD.exe
  2⤵
  PID:10068
- C:\Windows\System\ZMghnnG.exe
  C:\Windows\System\ZMghnnG.exe
  2⤵
  PID:10084
- C:\Windows\System\nRFFLBt.exe
  C:\Windows\System\nRFFLBt.exe
  2⤵
  PID:10100
- C:\Windows\System\HjAVKZw.exe
  C:\Windows\System\HjAVKZw.exe
  2⤵
  PID:10116
- C:\Windows\System\qSIPxLr.exe
  C:\Windows\System\qSIPxLr.exe
  2⤵
  PID:10132
- C:\Windows\System\SZDwyem.exe
  C:\Windows\System\SZDwyem.exe
  2⤵
  PID:10148
- C:\Windows\System\UNOLjRa.exe
  C:\Windows\System\UNOLjRa.exe
  2⤵
  PID:10164
- C:\Windows\System\QDRWJXB.exe
  C:\Windows\System\QDRWJXB.exe
  2⤵
  PID:10180
- C:\Windows\System\tYrwpdM.exe
  C:\Windows\System\tYrwpdM.exe
  2⤵
  PID:10196
- C:\Windows\System\FJRhyDg.exe
  C:\Windows\System\FJRhyDg.exe
  2⤵
  PID:10212
- C:\Windows\System\isHqZng.exe
  C:\Windows\System\isHqZng.exe
  2⤵
  PID:10228
- C:\Windows\System\OTDlvFS.exe
  C:\Windows\System\OTDlvFS.exe
  2⤵
  PID:9236
- C:\Windows\System\HwnbtLm.exe
  C:\Windows\System\HwnbtLm.exe
  2⤵
  PID:9008
- C:\Windows\System\PvJPDux.exe
  C:\Windows\System\PvJPDux.exe
  2⤵
  PID:8792
- C:\Windows\System\YevDbsd.exe
  C:\Windows\System\YevDbsd.exe
  2⤵
  PID:8492
- C:\Windows\System\xTpqBAE.exe
  C:\Windows\System\xTpqBAE.exe
  2⤵
  PID:7868
- C:\Windows\System\QnAJuKY.exe
  C:\Windows\System\QnAJuKY.exe
  2⤵
  PID:9256
- C:\Windows\System\bwXummB.exe
  C:\Windows\System\bwXummB.exe
  2⤵
  PID:9320
- C:\Windows\System\qJOAsae.exe
  C:\Windows\System\qJOAsae.exe
  2⤵
  PID:9292
- C:\Windows\System\AOibklc.exe
  C:\Windows\System\AOibklc.exe
  2⤵
  PID:9324
- C:\Windows\System\oDkHcde.exe
  C:\Windows\System\oDkHcde.exe
  2⤵
  PID:9388
- C:\Windows\System\zubqBoW.exe
  C:\Windows\System\zubqBoW.exe
  2⤵
  PID:9468
- C:\Windows\System\aIkSPeY.exe
  C:\Windows\System\aIkSPeY.exe
  2⤵
  PID:9448
- C:\Windows\System\aDRhsBM.exe
  C:\Windows\System\aDRhsBM.exe
  2⤵
  PID:9488
- C:\Windows\System\KJylbSF.exe
  C:\Windows\System\KJylbSF.exe
  2⤵
  PID:9536
- C:\Windows\System\IJzJqZI.exe
  C:\Windows\System\IJzJqZI.exe
  2⤵
  PID:9520
- C:\Windows\System\jJPRZrC.exe
  C:\Windows\System\jJPRZrC.exe
  2⤵
  PID:9628
- C:\Windows\System\DvKPQsZ.exe
  C:\Windows\System\DvKPQsZ.exe
  2⤵
  PID:9664
- C:\Windows\System\CjcTfUs.exe
  C:\Windows\System\CjcTfUs.exe
  2⤵
  PID:9648
- C:\Windows\System\XvsecNu.exe
  C:\Windows\System\XvsecNu.exe
  2⤵
  PID:9644
- C:\Windows\System\nYkGqOd.exe
  C:\Windows\System\nYkGqOd.exe
  2⤵
  PID:9760
- C:\Windows\System\daVOuwC.exe
  C:\Windows\System\daVOuwC.exe
  2⤵
  PID:9820
- C:\Windows\System\fueNAJT.exe
  C:\Windows\System\fueNAJT.exe
  2⤵
  PID:9852
- C:\Windows\System\odxaqmG.exe
  C:\Windows\System\odxaqmG.exe
  2⤵
  PID:9712
- C:\Windows\System\pJfIsyt.exe
  C:\Windows\System\pJfIsyt.exe
  2⤵
  PID:9776
- C:\Windows\System\cwMrZDB.exe
  C:\Windows\System\cwMrZDB.exe
  2⤵
  PID:9840
- C:\Windows\System\bMcHjcq.exe
  C:\Windows\System\bMcHjcq.exe
  2⤵
  PID:9904
- C:\Windows\System\oLMYQfg.exe
  C:\Windows\System\oLMYQfg.exe
  2⤵
  PID:9980
- C:\Windows\System\ZGsLKuh.exe
  C:\Windows\System\ZGsLKuh.exe
  2⤵
  PID:10000
- C:\Windows\System\fkMAtht.exe
  C:\Windows\System\fkMAtht.exe
  2⤵
  PID:10012
- C:\Windows\System\MAEVmjm.exe
  C:\Windows\System\MAEVmjm.exe
  2⤵
  PID:10048
- C:\Windows\System\iaKMEom.exe
  C:\Windows\System\iaKMEom.exe
  2⤵
  PID:10060
- C:\Windows\System\lSMEvgS.exe
  C:\Windows\System\lSMEvgS.exe
  2⤵
  PID:10096
- C:\Windows\System\TDzCXCX.exe
  C:\Windows\System\TDzCXCX.exe
  2⤵
  PID:10112
- C:\Windows\System\nPpTzGR.exe
  C:\Windows\System\nPpTzGR.exe
  2⤵
  PID:10204
- C:\Windows\System\ljWPvOT.exe
  C:\Windows\System\ljWPvOT.exe
  2⤵
  PID:8988
- C:\Windows\System\uhRvWyQ.exe
  C:\Windows\System\uhRvWyQ.exe
  2⤵
  PID:10160
- C:\Windows\System\loDRmIc.exe
  C:\Windows\System\loDRmIc.exe
  2⤵
  PID:9308
- C:\Windows\System\VMPhsdb.exe
  C:\Windows\System\VMPhsdb.exe
  2⤵
  PID:9004
- C:\Windows\System\dwYVBtQ.exe
  C:\Windows\System\dwYVBtQ.exe
  2⤵
  PID:9252
- C:\Windows\System\TOhBsBy.exe
  C:\Windows\System\TOhBsBy.exe
  2⤵
  PID:9432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AjqmIpC.exe

Filesize
1.3MB

MD5
0b7c316233b4cd027b169fca06e429fb

SHA1
35624f48cbad906bd778fe60189e36c46b1e05e7

SHA256
45a0b45475542e021e5b97f7a884143b7a865a4924689cd66381532c915bd96a

SHA512
28970a772ae9414edd8cb5459b2ccf3cd2e38b7e986b0f1aa9a4bf8540ad14c362b448656a7b9a328f59501bf10677cfe6243af36f05f4e5683c9fe4d9539895

Download Submit
C:\Windows\system\AntcOlJ.exe

Filesize
1.3MB

MD5
89e35a10f06151d71bb8bac62e7a4680

SHA1
b1af60008c09e562611f26dda83af26fb8d77281

SHA256
79090661039a0a6b0b1fb0c738d41df3ad471450cb2b5ba1448f07d6bd2bddf8

SHA512
dcf8143f2093356209fa4a5c63bb7d78e9842791eda1f3b70b5647b26f34747580dd3ee222f7a636e347557041dfd99fe37e558ccda42d2291a2d267d27c431c

Download Submit
C:\Windows\system\BVExyWw.exe

Filesize
1.3MB

MD5
c0dfc828dd64410222575ac67794b39d

SHA1
c3bfda393669438dba1bc12c124f04e61295b7dd

SHA256
722fa6671a42d114f9d5d815136f56540484092974b6e90f610bc1e5b5fc4383

SHA512
3747db00d5de3dad437bc851be5c0c659bde25cdcc6d16d980bb5869d76979a193553e48f488fe6631abf1191471a0f73d060027c9e77e9593f1a1742d8f60de

Download Submit
C:\Windows\system\DcySeSn.exe

Filesize
1.3MB

MD5
e18d8df386007957abb13cb6fe73cabb

SHA1
928828dbf8bc18e0e0f953ae54d71946cf5de914

SHA256
9d1b7b39356455df3214def2597241745e203d9142b7bab479930df77cb648fc

SHA512
b8c8fcc6455f3e3a8a1bc1fdc5533f667b4ad7560bda95c7a706aaaa124b2ac50c452631b52cb495f6c0e3616b3630cb9b92ad027fff37901f9be6bd7fd52624

Download Submit
C:\Windows\system\DtCneQa.exe

Filesize
1.3MB

MD5
5661d364bb42b575dbedb57be6e6b9c8

SHA1
9f114dcd8a951f466e865692a7975379bf473933

SHA256
52790485f3c62524cb67dbaadecb8b5bc75ef8d83f11c4328717aeb1e5cde166

SHA512
73a724e52297855b105b027bbf4ecdfbf58d219474a14b75e747ae0de9b72bb52064117c7ff7d1e9259c91e20bc41c9d59da9557677e1817e1815f1337383e8c

Download Submit
C:\Windows\system\EXufQyP.exe

Filesize
1.3MB

MD5
0adaea6d012928702dc597db70553396

SHA1
e1724098ee8a215e84cc20b3719d9fd54e19afab

SHA256
cb84aab22e06ba3d22fdf8a8305fe14e2f4fb94828e3a34caa4939a802dd7ba2

SHA512
bf5394b712556c829df01c791c64fda31d3a466077a62c3ef203acb2e66217186afa3648d7c536d8db562be995288f0d51e165b98dd1f7c4c9cbc797ec3f3e29

Download Submit
C:\Windows\system\EfPHeCX.exe

Filesize
1.3MB

MD5
624a1064fc0445ffb4295ba4fdaac804

SHA1
2722498bc842c33a4b219de23e293cf039716549

SHA256
1be92b3293f17feadd5dcd671ff1d836f04487d5d6e53584adf913cd097c7df8

SHA512
380cd1a2cabc66941df31b884f26b6758dd8e7e870b5b45c884401102db53773115df2d5d1b1799d9ab4e90bf30ab730e2a84c75e265937d60316dceb410fa03

Download Submit
C:\Windows\system\EyUtuCN.exe

Filesize
1.3MB

MD5
d7a8a7df12d5e15ed27757560f57d751

SHA1
4ec516aa6a07a1c9d086e6312433e0ec0dfef8cc

SHA256
2805df144ebd7de52c43d1b27d82544fa1b586fb507584c4b3d8993534a56e4a

SHA512
cb97bebae1a1c34a7be65d2621217f5ac5612e089852ef73e689ee0762df532ae9a478fede0446962aadc9be3e686c43c511f30fe6aff1fa38a257d356b6a69b

Download Submit
C:\Windows\system\GfxBbGX.exe

Filesize
1.3MB

MD5
8558703d4f6bdfa65dbe7d63c532c762

SHA1
d94e83bab0f424c8726a377da72b35ed71b3b198

SHA256
8d05c33d7deb0c1c97835aee00bf8d50d848064415bc498b5c752f81ec80623d

SHA512
ec9d8677330a8ce4f8f6533c7e54f23ce016f8eb369e226851ad15be27be139951c0403e7a5763815c1d63ac87f89b9fd683ac3f155c41fd4932b7c4666c85ec

Download Submit
C:\Windows\system\IeAmrFX.exe

Filesize
1.3MB

MD5
5b8bebf71120d9aafe61261ade01a8b2

SHA1
c05966798a806882778b8fe0b11b51fccddb7523

SHA256
dca7c44648430c155807f7c1dc0e292e67071aefdd239e1d8bf64150611ae0d9

SHA512
0b055b490a8dfceb7faac6aaf628000e8548cc74b621df90a2de664a45b446c32e3dac1b1dc56ed352ecfe39fa120632e49e8172e0cec1c5e806b19b87f46155

Download Submit
C:\Windows\system\IhrCoXh.exe

Filesize
1.3MB

MD5
f68b02e781a9754c2717569db3fdc305

SHA1
e0a86c7f70a75af2d57dd3e2f541e3a909d2f3ee

SHA256
628e1c192b366d37d16c3ba998dd7f6de72742d0232220c4141ba9edd4805dd7

SHA512
fc856d5750451f5cf02f18ede101d882989902fa748f7fb3792a39e71327d5a353aa1c36a3e571d1b124f08de63ab34e97fd3f8aa8f0350c4336a2d57a67a7ec

Download Submit
C:\Windows\system\JTYxFom.exe

Filesize
1.3MB

MD5
4a44e23ca886cfd67e807f6553dbbbfd

SHA1
35b6db9390d2050d44eb530aec88640e91040ca6

SHA256
791446c1a4423718963a24aed524ac475456085f93b6f629ff7e06b0778b77e0

SHA512
ebbf5463a058d54a33f1807972fd2aad9d1dd8ab97bca769646474d8ed15bdb695584e5a273266cd754daa69b43d3e01f38ddf3c5672547bdcc46bb3d6c4b42f

Download Submit
C:\Windows\system\JigiFxi.exe

Filesize
1.3MB

MD5
e2629b80c229aa54032a99768ee36e2a

SHA1
c96aa66a4e53cf38ed0b3dc67ba0f4a14f2d1bf0

SHA256
609ad676d99cc80abff70fafd2598dbcf48935f2c711eab0f59037ecd4f0b9bb

SHA512
ca5f2d9e480ae8bbc92358cea9dd4030e99e8a608aacef01d4661513f4ccf037301e75a6e0295f3722a0a0b0552f7eb07caf5525c412e8d1b0c58a68be4f7b84

Download Submit
C:\Windows\system\KoIgJLn.exe

Filesize
1.3MB

MD5
e09f678cc4fa0f2439454bd834abd4b5

SHA1
3f8b27bca1c31ae29f23094695f092017d45e0c2

SHA256
0ac8f93395d9636609349165e3d4b320fa58b793e96e6d12c1e703e1ae93ddb6

SHA512
1b711ba43d29d5f1ab6efd9fa18918c3203dd9117044de92580482d1d3cea99e89a71b777adba496ca4c9747f56c5d764d5d99af57ae7721ddc3a0be63d232a3

Download Submit
C:\Windows\system\LUDXqCx.exe

Filesize
1.3MB

MD5
76440ffd9c626b676a3e41c212b7e586

SHA1
e4b7958e5bff431361652ebf6a1ab96515c54f8d

SHA256
b8dc48ddc24d5dcb66281c340c9f008c6c5db32f445929baff92f82faf20caf4

SHA512
8915a7ca62b48e8ae605ea74d26d793a09a015bd1d4bf5ee61c49c1d0f0407b6cd58b9fceb8692280fb76721fef00710aa1c4c21c8aa4fe8fae4e0e2259f6d45

Download Submit
C:\Windows\system\LquEiQs.exe

Filesize
1.3MB

MD5
3e12e335a87a1290f5050d09b87f62c7

SHA1
1e8cf8a2741cf2dc56964f65caecc77fdfef005c

SHA256
3b9d114806a1dd5b1e60dd02fc7aaf47f2ddff8988428c605999d1821ce6346c

SHA512
fbd0e93af2faf88546f8f77e7b2210462732333041695fc5cfc051882f09d17de8f3a52c1840e88aedc5312e5cb06992e8ddfde62692df7195e4cafd628d4468

Download Submit
C:\Windows\system\MJtVWFi.exe

Filesize
1.3MB

MD5
470bede16aaedcfc7a764f50ec08be03

SHA1
8a011f5a5132fa6c0c42bb2fc2d5fee52205aab1

SHA256
3b2067bd11c53154f9628e4be4c0076d266ffd1394ca39b600d09597a00ef970

SHA512
24210c4911dbbd83d3a401af9afddf65010de5db47f740118ad538dfeb470564e59dbdc1e25210b59e2c4f218c619c731d0e2dffafb794fda5feeaafe038780a

Download Submit
C:\Windows\system\NitdNtJ.exe

Filesize
1.3MB

MD5
eeaff808d71eb4caffcc8d0c9b2f5133

SHA1
5160f4fa65ad796913646f7d06e0bebe07d52e00

SHA256
24615142cb0e6b09f5e96cf1a7fccff388f920b078f2a9042a011ef37187c6d5

SHA512
d5abd82e1477c317260cb7e53f034e80bdb0e9cfb616f69168badb0286d14787a3439497b93753ee0c862376bd83fd341dc40531edf33fb1ba2c167fe84e4a90

Download Submit
C:\Windows\system\OBbSYTP.exe

Filesize
1.3MB

MD5
c9c7338f167fec58667f8d9c32cb9fd6

SHA1
30e98d321e2420ea9465d802142300b9a5f0bf16

SHA256
362cb34939e6ce6b87d31b29477d429b5b9ca67c4df0217d33ba1f16f2283935

SHA512
7a682cedb96c0918d7751e86bdbb791a56e6a5d66f6a75904efd93c2d24692cfe779889f96131e9a23053e91bbf12db6fbc2b6c9489b3cd04d1f1be41c680d67

Download Submit
C:\Windows\system\OtJehqF.exe

Filesize
1.3MB

MD5
a98aa37069113cd545b3ffaee6879293

SHA1
a6bd42f8f0fba76fec542d8404139b9da6e334e1

SHA256
074ea9178bbea8bcff3ce02c9fc58832c2a9f9d2c42f4107f2dcbe8fb61b1083

SHA512
7e243a916cdf44d276a9239b3015019748086206a2291498cba8d388828aca144777aad0094aeb080f751bd595ba44c7df7396470ed726e107c6d206b3b5ffa2

Download Submit
C:\Windows\system\QpdLhWm.exe

Filesize
1.3MB

MD5
0585cd59cebf886488c48bf67bd47ecc

SHA1
66397c46be9384b31b57c79c2cfa3582db919089

SHA256
4fc368fe98422cb9c75bc5fa347fbc0efdf9e29baa62204756a437174948821b

SHA512
8c003c04e14416251711639813c7c08c4ab9734cf546c0eae6e2e0a88311efff348dc32e89f0d79c679e6e84cb14ecc8ffe1bcb3af4e101438c216352ac756b9

Download Submit
C:\Windows\system\TMflIxn.exe

Filesize
1.3MB

MD5
7ab122bc5af1447b0c9d6d7ff9f31a38

SHA1
629933ac81c4413e23614b503047b84499bbb5eb

SHA256
f370a67e53fb3d47279fdd1fd15704af2993b01dd6106cd7d77eccce832db5c2

SHA512
b7ec05e765d8991581418458e7f179cd06a9f3a3ea8786a36fc5bc8b3f81004a90a3c7bbd589c522ee2581ab975f43eb912ec9f3e807cd1ed45f36bd62db5d13

Download Submit
C:\Windows\system\boiTppR.exe

Filesize
1.3MB

MD5
0edcc1f9222e63158cf7cbd017a3c929

SHA1
8d051b419899b185b8bb295f33bbc783eb4fece4

SHA256
9c0a9b53db57e4eb1fd52b8cdd7367ce750e14f45f4aae798f5e9f457809e3d9

SHA512
b2825d75960c2056de69c93e1ec780f53b75a529dfa66c6cec7b0e2520f4689485391b6220534d186ec798968581d57a14a6b52447b62409cfc97b50eb44df4f

Download Submit
C:\Windows\system\bxIJsLn.exe

Filesize
1.3MB

MD5
da92587871055880964fea64dd0e8e17

SHA1
51c1a6fae51bfe2a3fc1da0761dd7954a04b4eb2

SHA256
c0ba68cb2a5cd68ed65804952b443f1e6363b871147d0b7362940f3d87484410

SHA512
9efa686459cb0395601533c0b89f3a1c4c090970ff20eb7f29ed6c281f73a7e1a6bbc658e5bf43add813e6f307e47c5873f85b548ef94d079950e47b10213f23

Download Submit
C:\Windows\system\hpCtbCy.exe

Filesize
1.3MB

MD5
9e8ef53090dde6d9637821716bbeb304

SHA1
635900b2cceca4f54b90247d4b16119c7fa5b916

SHA256
383b5a43f9a940e40f0a1d51f266fb2d707fdce3230af8754c890209c6199737

SHA512
43ce8fd14bb3c1584d905ee4a06d3225ce54c76abf3d4043118ee7597eb39b798dfe9229c44477ba9a69002da9d8bfa8743058ed30c94d71f0c958f52174e634

Download Submit
C:\Windows\system\iyhMKwx.exe

Filesize
1.3MB

MD5
9db9d2edb8f327c1f2ef8efdd31dc939

SHA1
43561a6cd5846d0a3ecf81b0c05fef6cefcf1552

SHA256
2469e3d8e5780a940aef7bcd4d209e7985470e3a78a1fa79568e4bb00d2a74f2

SHA512
f9565fd132c76ae6def206a5fe17c1b476b9e9a264378ed0926d6880acca6099da929f069c64aa1cd3ef0ff0a68d47fa36120c00ead5c40a3ed84d1fabc0ae9d

Download Submit
C:\Windows\system\lmDZUYY.exe

Filesize
1.3MB

MD5
390dc246c588da4bdc46ea2842585922

SHA1
c6a2a17d19a632aff360be8d2b1552b9c19ba3e0

SHA256
c8c3b55844b6b4a2f6232483d3f6321202c117997d8a0c0226d9ec8c1f7427ef

SHA512
a94fdad190a97172856e1ccd39c3b3041d5a8bc8b017bc4f96e73aebe5ac430efbfc99623fd4cfe6cb366511d1f07f9123d0924932bec985d0bc007fc0c9d950

Download Submit
C:\Windows\system\mRIsisz.exe

Filesize
1.3MB

MD5
42d2757eb77d5be5bae81edbcc9c3e5a

SHA1
295d319113d73dd4adbc1cb9064e90dc5631e322

SHA256
64b64ad572be72b7e76da66f490003f87107147cc374fd44c318e69f5bc44738

SHA512
8d9f14f75a626f06df4ab594044a7ea4b6bc30cca351f563837844d33280f5d422713b1206864aa33fac36f6ce1b955389e619cfb6bb51152d18089bd82809dd

Download Submit
C:\Windows\system\qqiscZn.exe

Filesize
1.3MB

MD5
67780a1495645b27aae338600b8f9812

SHA1
f4ee16b83551b20ffa29cd005c1af4a5ca7145fe

SHA256
f1f26c8992ae3a38f77b006a2f6f951e9a29753aaf1ceb9971caa8ea222664a5

SHA512
51ff955a4efd8972f26bfe591e6fb51577956bb6f61f53155c4a381015a23b36dc22e57fa4e4f137142c4f05f9ffb57873a964e900cdca5bf64323a8bccc6ab8

Download Submit
C:\Windows\system\xuFZnRL.exe

Filesize
1.3MB

MD5
cb89c57735c5385985566f37593cdcc8

SHA1
b45afea6713afb3a7c3d5c8332bd66a0455c9fa1

SHA256
8df340e9660229b29c0159301aa552ad000c23ac77daadbc861cfdd87b0beb61

SHA512
40763e9fa8202545efc7a93e7a5cb5cc4fc30b3df5458ae3ed8c91d4dab7216ece116c9294eba78e5b26952d843b61f2d61bcd5220e4de86ed1a95eaa10d7143

Download Submit
C:\Windows\system\xwzGktX.exe

Filesize
1.3MB

MD5
49083cd4f43b423fbeeac575aea2b3d4

SHA1
c8f83cea42f81544f5a9507762c964244fa45d84

SHA256
9204fc49a40e2582ea36c7e24b1baeb79ccd4496e63fbf8a9af1a7969001696c

SHA512
47094ac71562b03dd5fa4ecd69a710e44d68aea85c071f388716ffdf9fe00116f7d84d93c6d509e5029a436356b924a5571c346ac0e711944b506384b6d62214

Download Submit
\Windows\system\ZBxRdbu.exe

Filesize
1.3MB

MD5
c01d7581b680b99c0080132df98c3c85

SHA1
259efe75cd0d0360212efedab316cf771078453f

SHA256
049ad784c7bfe28b5f32c1474dd4de961ee2a5d23a2c91157ed9895348d64ff0

SHA512
463d9fda06aae7b7532b27bf201a879d4698f7045ec2213e6c50fe7ebb47606297235f7f1a0d8ac0b3a928deabfb70d81d785b9fe2b3d34a2173b0b91c81c2bc

Download Submit
memory/2384-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download