xmrig | 3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b

Analysis

max time kernel
68s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
Size

1.5MB
MD5

b0fe1a7116de5f2f1439236bde3fe7ce
SHA1

99c014fc99b23d1bfb3314cb0927e89f674ef6cc
SHA256

3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b
SHA512

bd659bcf729f3301330c220e4939ee9ce3b29a8e02bf4bb8deb12e125a48db7e32c327c6c2b1b2f3b032611e167c292e40885aef959df9482bcfae82ef6bb50c
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcL:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5t

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x00080000000120fd-2.dat	xmrig
behavioral1/files/0x00070000000186ca-6.dat	xmrig
behavioral1/files/0x00070000000186d9-13.dat	xmrig
behavioral1/files/0x0007000000018710-17.dat	xmrig
behavioral1/files/0x0006000000018766-21.dat	xmrig
behavioral1/files/0x0006000000018780-24.dat	xmrig
behavioral1/files/0x0007000000018b62-29.dat	xmrig
behavioral1/files/0x000700000001933b-36.dat	xmrig
behavioral1/files/0x000500000001960c-40.dat	xmrig
behavioral1/files/0x0005000000019667-52.dat	xmrig
behavioral1/files/0x0005000000019c3c-69.dat	xmrig
behavioral1/files/0x0005000000019c57-76.dat	xmrig
behavioral1/files/0x0005000000019cba-80.dat	xmrig
behavioral1/files/0x000500000001a41d-129.dat	xmrig
behavioral1/files/0x000500000001a41b-124.dat	xmrig
behavioral1/files/0x000500000001a359-120.dat	xmrig
behavioral1/files/0x000500000001a09e-109.dat	xmrig
behavioral1/files/0x000500000001a075-102.dat	xmrig
behavioral1/files/0x000500000001a307-114.dat	xmrig
behavioral1/files/0x000500000001a07e-107.dat	xmrig
behavioral1/files/0x0005000000019f8a-96.dat	xmrig
behavioral1/files/0x0005000000019d8e-88.dat	xmrig
behavioral1/files/0x0005000000019f94-100.dat	xmrig
behavioral1/files/0x0005000000019dbf-92.dat	xmrig
behavioral1/files/0x0005000000019cca-84.dat	xmrig
behavioral1/files/0x0005000000019c3e-72.dat	xmrig
behavioral1/files/0x0005000000019c34-64.dat	xmrig
behavioral1/files/0x0005000000019926-60.dat	xmrig
behavioral1/files/0x00050000000196a1-56.dat	xmrig
behavioral1/files/0x000500000001961e-48.dat	xmrig
behavioral1/files/0x000500000001961c-45.dat	xmrig
behavioral1/files/0x0009000000018bf3-33.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
672	NXTyGZD.exe
3004	VUHxkjW.exe
2952	sYfRkjg.exe
2352	GnpaGtn.exe
2836	PvdMxiM.exe
2900	rYnkpbb.exe
2796	UqdNdlP.exe
3024	ulvsEFq.exe
2932	ytACCmc.exe
2676	LuMZSYA.exe
2668	OOajSjQ.exe
2776	hNKtfkg.exe
2412	drDdBHN.exe
2644	RhbYnZL.exe
2692	XnHapWb.exe
1712	RYjOlCI.exe
568	tXFiyLr.exe
600	agobZXA.exe
2864	DIARlCw.exe
2424	VnDdhHJ.exe
2496	eDTGWYO.exe
2480	cjdtGXS.exe
1056	oAjExFC.exe
2968	zzbbUMJ.exe
1732	fGfHxcg.exe
2960	Iuvmbsp.exe
640	BwPHMoX.exe
2104	GzwdgiI.exe
1504	QYNoVKe.exe
2016	ChZzjwA.exe
964	CNaCYhF.exe
1692	EFXrYKB.exe
940	gYBpAID.exe
2400	krtQnVy.exe
2264	vWgoPhL.exe
2188	wluquDT.exe
2124	YYINKCA.exe
2060	XzILXwA.exe
2820	VhBZDNA.exe
904	iZzfMdd.exe
1156	WKABETf.exe
3032	hDVgFNl.exe
592	TpVzIVQ.exe
1060	mkiHkzV.exe
2528	zsNNoPW.exe
1936	yMoXuXl.exe
1628	eIkQMKB.exe
2320	CRaSVYM.exe
2452	nIqiPkq.exe
1228	CJxpMpv.exe
2276	yRIKGrn.exe
2600	MbjrEYZ.exe
1896	peDrRHq.exe
1672	jrJZqmm.exe
1980	iUMNPaM.exe
1008	RoCihzH.exe
1584	yNKJalO.exe
1428	bUdmMAl.exe
1892	AxewmsZ.exe
948	dqHBhJn.exe
1912	NXFbjrL.exe
3016	WsfzGsz.exe
1080	suKlyqy.exe
2780	SwrDePS.exe

Loads dropped DLL 64 IoCs

pid	Process
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KPSwhCm.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\xTIHQlP.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\CFHfOgf.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\YohIGiZ.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\MiaMdCQ.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\YhgJmED.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\DngNXzu.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\VdGMWri.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\fFTboSe.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\KzjGmfg.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\kCGWooC.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\ULCCSmr.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\CsMFoUD.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\UzlJdJx.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\DFWPpYE.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\iKpYEvb.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\WyiSYps.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\dqHBhJn.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\EpaRwVY.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\HDbOhMB.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\fOCUFYJ.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\XDhheKQ.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\KzuPvPb.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\sDUYPZA.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\xaNfXeF.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\SzfNlzw.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\EJElsuA.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\dmBtuzI.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\cWrdSoS.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\XpzsKYt.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\ZHRmbWb.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\ZkbDmwI.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\VfTbLSs.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\GHPxCfB.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\DitUOPL.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\QJQVkUg.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\VkuHjBo.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\hWJymsp.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\oNcLuqA.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\lvUYRQp.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\RhbYnZL.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\AbCPHjd.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\xsQSDiY.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\HSpagNB.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\LOaSCZn.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\SiTvnDY.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\amlOike.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\dtnwhKL.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\kxexptO.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\YVodqtW.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\wmlOUOo.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\BEIlePE.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\zBdqiou.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\bJCccss.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\LqJQYeK.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\eexWyhD.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\oLjNthr.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\LuMZSYA.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\oVsdmdQ.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\qBUfZrV.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\bGTYMnc.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\qWRQHlY.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\jrjxopQ.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
File created	C:\Windows\System\tCtIUdq.exe	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 672	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	30
PID 2380 wrote to memory of 672	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	30
PID 2380 wrote to memory of 672	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	30
PID 2380 wrote to memory of 3004	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	31
PID 2380 wrote to memory of 3004	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	31
PID 2380 wrote to memory of 3004	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	31
PID 2380 wrote to memory of 2952	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	32
PID 2380 wrote to memory of 2952	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	32
PID 2380 wrote to memory of 2952	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	32
PID 2380 wrote to memory of 2352	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	33
PID 2380 wrote to memory of 2352	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	33
PID 2380 wrote to memory of 2352	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	33
PID 2380 wrote to memory of 2836	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	34
PID 2380 wrote to memory of 2836	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	34
PID 2380 wrote to memory of 2836	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	34
PID 2380 wrote to memory of 2900	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	35
PID 2380 wrote to memory of 2900	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	35
PID 2380 wrote to memory of 2900	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	35
PID 2380 wrote to memory of 2796	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	36
PID 2380 wrote to memory of 2796	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	36
PID 2380 wrote to memory of 2796	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	36
PID 2380 wrote to memory of 3024	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	37
PID 2380 wrote to memory of 3024	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	37
PID 2380 wrote to memory of 3024	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	37
PID 2380 wrote to memory of 2932	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	38
PID 2380 wrote to memory of 2932	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	38
PID 2380 wrote to memory of 2932	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	38
PID 2380 wrote to memory of 2676	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	39
PID 2380 wrote to memory of 2676	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	39
PID 2380 wrote to memory of 2676	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	39
PID 2380 wrote to memory of 2668	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	40
PID 2380 wrote to memory of 2668	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	40
PID 2380 wrote to memory of 2668	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	40
PID 2380 wrote to memory of 2776	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	41
PID 2380 wrote to memory of 2776	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	41
PID 2380 wrote to memory of 2776	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	41
PID 2380 wrote to memory of 2412	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	42
PID 2380 wrote to memory of 2412	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	42
PID 2380 wrote to memory of 2412	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	42
PID 2380 wrote to memory of 2644	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	43
PID 2380 wrote to memory of 2644	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	43
PID 2380 wrote to memory of 2644	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	43
PID 2380 wrote to memory of 2692	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	44
PID 2380 wrote to memory of 2692	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	44
PID 2380 wrote to memory of 2692	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	44
PID 2380 wrote to memory of 1712	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	45
PID 2380 wrote to memory of 1712	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	45
PID 2380 wrote to memory of 1712	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	45
PID 2380 wrote to memory of 568	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	46
PID 2380 wrote to memory of 568	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	46
PID 2380 wrote to memory of 568	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	46
PID 2380 wrote to memory of 600	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	47
PID 2380 wrote to memory of 600	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	47
PID 2380 wrote to memory of 600	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	47
PID 2380 wrote to memory of 2864	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	48
PID 2380 wrote to memory of 2864	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	48
PID 2380 wrote to memory of 2864	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	48
PID 2380 wrote to memory of 2424	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	49
PID 2380 wrote to memory of 2424	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	49
PID 2380 wrote to memory of 2424	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	49
PID 2380 wrote to memory of 2496	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	50
PID 2380 wrote to memory of 2496	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	50
PID 2380 wrote to memory of 2496	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	50
PID 2380 wrote to memory of 2480	2380	3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe	51

C:\Users\Admin\AppData\Local\Temp\3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe
"C:\Users\Admin\AppData\Local\Temp\3c3ecd71cfc2e13174032a7ebc9aa797d4999c02e91363735c1ef3e50ca62a4b.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System\NXTyGZD.exe
  C:\Windows\System\NXTyGZD.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\VUHxkjW.exe
  C:\Windows\System\VUHxkjW.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\sYfRkjg.exe
  C:\Windows\System\sYfRkjg.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\GnpaGtn.exe
  C:\Windows\System\GnpaGtn.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\PvdMxiM.exe
  C:\Windows\System\PvdMxiM.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\rYnkpbb.exe
  C:\Windows\System\rYnkpbb.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\UqdNdlP.exe
  C:\Windows\System\UqdNdlP.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\ulvsEFq.exe
  C:\Windows\System\ulvsEFq.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\ytACCmc.exe
  C:\Windows\System\ytACCmc.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\LuMZSYA.exe
  C:\Windows\System\LuMZSYA.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\OOajSjQ.exe
  C:\Windows\System\OOajSjQ.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\hNKtfkg.exe
  C:\Windows\System\hNKtfkg.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\drDdBHN.exe
  C:\Windows\System\drDdBHN.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\RhbYnZL.exe
  C:\Windows\System\RhbYnZL.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\XnHapWb.exe
  C:\Windows\System\XnHapWb.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\RYjOlCI.exe
  C:\Windows\System\RYjOlCI.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\tXFiyLr.exe
  C:\Windows\System\tXFiyLr.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\agobZXA.exe
  C:\Windows\System\agobZXA.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\DIARlCw.exe
  C:\Windows\System\DIARlCw.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\VnDdhHJ.exe
  C:\Windows\System\VnDdhHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\eDTGWYO.exe
  C:\Windows\System\eDTGWYO.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\cjdtGXS.exe
  C:\Windows\System\cjdtGXS.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\oAjExFC.exe
  C:\Windows\System\oAjExFC.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\zzbbUMJ.exe
  C:\Windows\System\zzbbUMJ.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\fGfHxcg.exe
  C:\Windows\System\fGfHxcg.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\GzwdgiI.exe
  C:\Windows\System\GzwdgiI.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\Iuvmbsp.exe
  C:\Windows\System\Iuvmbsp.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\QYNoVKe.exe
  C:\Windows\System\QYNoVKe.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\BwPHMoX.exe
  C:\Windows\System\BwPHMoX.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\ChZzjwA.exe
  C:\Windows\System\ChZzjwA.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\CNaCYhF.exe
  C:\Windows\System\CNaCYhF.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\EFXrYKB.exe
  C:\Windows\System\EFXrYKB.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\gYBpAID.exe
  C:\Windows\System\gYBpAID.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\krtQnVy.exe
  C:\Windows\System\krtQnVy.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\vWgoPhL.exe
  C:\Windows\System\vWgoPhL.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\wluquDT.exe
  C:\Windows\System\wluquDT.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\YYINKCA.exe
  C:\Windows\System\YYINKCA.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\XzILXwA.exe
  C:\Windows\System\XzILXwA.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\VhBZDNA.exe
  C:\Windows\System\VhBZDNA.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\iZzfMdd.exe
  C:\Windows\System\iZzfMdd.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\WKABETf.exe
  C:\Windows\System\WKABETf.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\hDVgFNl.exe
  C:\Windows\System\hDVgFNl.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\TpVzIVQ.exe
  C:\Windows\System\TpVzIVQ.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\mkiHkzV.exe
  C:\Windows\System\mkiHkzV.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\zsNNoPW.exe
  C:\Windows\System\zsNNoPW.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\yMoXuXl.exe
  C:\Windows\System\yMoXuXl.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\eIkQMKB.exe
  C:\Windows\System\eIkQMKB.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\CRaSVYM.exe
  C:\Windows\System\CRaSVYM.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\nIqiPkq.exe
  C:\Windows\System\nIqiPkq.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\CJxpMpv.exe
  C:\Windows\System\CJxpMpv.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\yRIKGrn.exe
  C:\Windows\System\yRIKGrn.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\MbjrEYZ.exe
  C:\Windows\System\MbjrEYZ.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\peDrRHq.exe
  C:\Windows\System\peDrRHq.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\jrJZqmm.exe
  C:\Windows\System\jrJZqmm.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\iUMNPaM.exe
  C:\Windows\System\iUMNPaM.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\RoCihzH.exe
  C:\Windows\System\RoCihzH.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\yNKJalO.exe
  C:\Windows\System\yNKJalO.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\bUdmMAl.exe
  C:\Windows\System\bUdmMAl.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\AxewmsZ.exe
  C:\Windows\System\AxewmsZ.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\dqHBhJn.exe
  C:\Windows\System\dqHBhJn.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\NXFbjrL.exe
  C:\Windows\System\NXFbjrL.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\WsfzGsz.exe
  C:\Windows\System\WsfzGsz.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\suKlyqy.exe
  C:\Windows\System\suKlyqy.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\SwrDePS.exe
  C:\Windows\System\SwrDePS.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\IQdyELy.exe
  C:\Windows\System\IQdyELy.exe
  2⤵
  PID:2888
- C:\Windows\System\AbCPHjd.exe
  C:\Windows\System\AbCPHjd.exe
  2⤵
  PID:2672
- C:\Windows\System\ksbEBhO.exe
  C:\Windows\System\ksbEBhO.exe
  2⤵
  PID:2312
- C:\Windows\System\fNVJaCI.exe
  C:\Windows\System\fNVJaCI.exe
  2⤵
  PID:2096
- C:\Windows\System\IyumHhh.exe
  C:\Windows\System\IyumHhh.exe
  2⤵
  PID:2336
- C:\Windows\System\slvkLSk.exe
  C:\Windows\System\slvkLSk.exe
  2⤵
  PID:1332
- C:\Windows\System\YKDOAgW.exe
  C:\Windows\System\YKDOAgW.exe
  2⤵
  PID:1172
- C:\Windows\System\MPopFOl.exe
  C:\Windows\System\MPopFOl.exe
  2⤵
  PID:588
- C:\Windows\System\HloMwtF.exe
  C:\Windows\System\HloMwtF.exe
  2⤵
  PID:2272
- C:\Windows\System\KeCADfO.exe
  C:\Windows\System\KeCADfO.exe
  2⤵
  PID:2436
- C:\Windows\System\wDCqLaK.exe
  C:\Windows\System\wDCqLaK.exe
  2⤵
  PID:1740
- C:\Windows\System\aFWBRBN.exe
  C:\Windows\System\aFWBRBN.exe
  2⤵
  PID:2448
- C:\Windows\System\WeCSNzm.exe
  C:\Windows\System\WeCSNzm.exe
  2⤵
  PID:400
- C:\Windows\System\KtkJIHe.exe
  C:\Windows\System\KtkJIHe.exe
  2⤵
  PID:2028
- C:\Windows\System\HliOaPD.exe
  C:\Windows\System\HliOaPD.exe
  2⤵
  PID:2164
- C:\Windows\System\unyAoaJ.exe
  C:\Windows\System\unyAoaJ.exe
  2⤵
  PID:2220
- C:\Windows\System\FOSaOLV.exe
  C:\Windows\System\FOSaOLV.exe
  2⤵
  PID:544
- C:\Windows\System\OdauHYf.exe
  C:\Windows\System\OdauHYf.exe
  2⤵
  PID:3028
- C:\Windows\System\PQGsbhI.exe
  C:\Windows\System\PQGsbhI.exe
  2⤵
  PID:780
- C:\Windows\System\Xqkiiog.exe
  C:\Windows\System\Xqkiiog.exe
  2⤵
  PID:2456
- C:\Windows\System\LHmhKCW.exe
  C:\Windows\System\LHmhKCW.exe
  2⤵
  PID:1600
- C:\Windows\System\ScwoJzv.exe
  C:\Windows\System\ScwoJzv.exe
  2⤵
  PID:992
- C:\Windows\System\nkRajSu.exe
  C:\Windows\System\nkRajSu.exe
  2⤵
  PID:1348
- C:\Windows\System\ASshfds.exe
  C:\Windows\System\ASshfds.exe
  2⤵
  PID:796
- C:\Windows\System\qiztKid.exe
  C:\Windows\System\qiztKid.exe
  2⤵
  PID:2556
- C:\Windows\System\otGqVhI.exe
  C:\Windows\System\otGqVhI.exe
  2⤵
  PID:2224
- C:\Windows\System\RVMUzXY.exe
  C:\Windows\System\RVMUzXY.exe
  2⤵
  PID:3068
- C:\Windows\System\fMEEjqU.exe
  C:\Windows\System\fMEEjqU.exe
  2⤵
  PID:584
- C:\Windows\System\sALBrAf.exe
  C:\Windows\System\sALBrAf.exe
  2⤵
  PID:3056
- C:\Windows\System\ChyQuhv.exe
  C:\Windows\System\ChyQuhv.exe
  2⤵
  PID:3012
- C:\Windows\System\PJIGInw.exe
  C:\Windows\System\PJIGInw.exe
  2⤵
  PID:2160
- C:\Windows\System\PtZydGB.exe
  C:\Windows\System\PtZydGB.exe
  2⤵
  PID:1796
- C:\Windows\System\oVOdYUa.exe
  C:\Windows\System\oVOdYUa.exe
  2⤵
  PID:2792
- C:\Windows\System\VwxLyUI.exe
  C:\Windows\System\VwxLyUI.exe
  2⤵
  PID:2212
- C:\Windows\System\FIddYAf.exe
  C:\Windows\System\FIddYAf.exe
  2⤵
  PID:2912
- C:\Windows\System\nWGeVWx.exe
  C:\Windows\System\nWGeVWx.exe
  2⤵
  PID:2132
- C:\Windows\System\EDsiNVZ.exe
  C:\Windows\System\EDsiNVZ.exe
  2⤵
  PID:924
- C:\Windows\System\RxYMHwz.exe
  C:\Windows\System\RxYMHwz.exe
  2⤵
  PID:2268
- C:\Windows\System\QYSNyay.exe
  C:\Windows\System\QYSNyay.exe
  2⤵
  PID:2084
- C:\Windows\System\qvFNsoC.exe
  C:\Windows\System\qvFNsoC.exe
  2⤵
  PID:1944
- C:\Windows\System\NzeiSpT.exe
  C:\Windows\System\NzeiSpT.exe
  2⤵
  PID:1984
- C:\Windows\System\omJqMcD.exe
  C:\Windows\System\omJqMcD.exe
  2⤵
  PID:1016
- C:\Windows\System\tsgKKEa.exe
  C:\Windows\System\tsgKKEa.exe
  2⤵
  PID:2260
- C:\Windows\System\GHPxCfB.exe
  C:\Windows\System\GHPxCfB.exe
  2⤵
  PID:2256
- C:\Windows\System\KvObkdI.exe
  C:\Windows\System\KvObkdI.exe
  2⤵
  PID:352
- C:\Windows\System\zuvqfgf.exe
  C:\Windows\System\zuvqfgf.exe
  2⤵
  PID:2484
- C:\Windows\System\jhjxjUZ.exe
  C:\Windows\System\jhjxjUZ.exe
  2⤵
  PID:1684
- C:\Windows\System\InYQVgd.exe
  C:\Windows\System\InYQVgd.exe
  2⤵
  PID:1752
- C:\Windows\System\xsuqtBA.exe
  C:\Windows\System\xsuqtBA.exe
  2⤵
  PID:2348
- C:\Windows\System\ijgmmUR.exe
  C:\Windows\System\ijgmmUR.exe
  2⤵
  PID:1532
- C:\Windows\System\oWTyPNx.exe
  C:\Windows\System\oWTyPNx.exe
  2⤵
  PID:1088
- C:\Windows\System\PBoEbSg.exe
  C:\Windows\System\PBoEbSg.exe
  2⤵
  PID:1704
- C:\Windows\System\fphxmtm.exe
  C:\Windows\System\fphxmtm.exe
  2⤵
  PID:2560
- C:\Windows\System\PUjAIzo.exe
  C:\Windows\System\PUjAIzo.exe
  2⤵
  PID:2648
- C:\Windows\System\MGpFOuH.exe
  C:\Windows\System\MGpFOuH.exe
  2⤵
  PID:1624
- C:\Windows\System\rIktICQ.exe
  C:\Windows\System\rIktICQ.exe
  2⤵
  PID:2664
- C:\Windows\System\BPMuXSi.exe
  C:\Windows\System\BPMuXSi.exe
  2⤵
  PID:2828
- C:\Windows\System\FaFzXYY.exe
  C:\Windows\System\FaFzXYY.exe
  2⤵
  PID:2928
- C:\Windows\System\oXtCnPj.exe
  C:\Windows\System\oXtCnPj.exe
  2⤵
  PID:604
- C:\Windows\System\YhVPGUj.exe
  C:\Windows\System\YhVPGUj.exe
  2⤵
  PID:2896
- C:\Windows\System\yHRzmFp.exe
  C:\Windows\System\yHRzmFp.exe
  2⤵
  PID:2696
- C:\Windows\System\hHimOkx.exe
  C:\Windows\System\hHimOkx.exe
  2⤵
  PID:2252
- C:\Windows\System\HDTRXqp.exe
  C:\Windows\System\HDTRXqp.exe
  2⤵
  PID:548
- C:\Windows\System\MPAqECa.exe
  C:\Windows\System\MPAqECa.exe
  2⤵
  PID:1496
- C:\Windows\System\JUaTigW.exe
  C:\Windows\System\JUaTigW.exe
  2⤵
  PID:376
- C:\Windows\System\XpzsKYt.exe
  C:\Windows\System\XpzsKYt.exe
  2⤵
  PID:2416
- C:\Windows\System\ADtLMvP.exe
  C:\Windows\System\ADtLMvP.exe
  2⤵
  PID:1176
- C:\Windows\System\oGxtMiT.exe
  C:\Windows\System\oGxtMiT.exe
  2⤵
  PID:2444
- C:\Windows\System\dPEOkYW.exe
  C:\Windows\System\dPEOkYW.exe
  2⤵
  PID:2392
- C:\Windows\System\PPHZlvY.exe
  C:\Windows\System\PPHZlvY.exe
  2⤵
  PID:836
- C:\Windows\System\jStRosH.exe
  C:\Windows\System\jStRosH.exe
  2⤵
  PID:2812
- C:\Windows\System\bGTYMnc.exe
  C:\Windows\System\bGTYMnc.exe
  2⤵
  PID:852
- C:\Windows\System\qBvWiWw.exe
  C:\Windows\System\qBvWiWw.exe
  2⤵
  PID:2680
- C:\Windows\System\hQFxUNM.exe
  C:\Windows\System\hQFxUNM.exe
  2⤵
  PID:2576
- C:\Windows\System\SyMRKJP.exe
  C:\Windows\System\SyMRKJP.exe
  2⤵
  PID:2516
- C:\Windows\System\uCqighn.exe
  C:\Windows\System\uCqighn.exe
  2⤵
  PID:2176
- C:\Windows\System\AGsKguK.exe
  C:\Windows\System\AGsKguK.exe
  2⤵
  PID:2228
- C:\Windows\System\BOVmZXb.exe
  C:\Windows\System\BOVmZXb.exe
  2⤵
  PID:1568
- C:\Windows\System\aWQsovE.exe
  C:\Windows\System\aWQsovE.exe
  2⤵
  PID:2500
- C:\Windows\System\MpiNVem.exe
  C:\Windows\System\MpiNVem.exe
  2⤵
  PID:1368
- C:\Windows\System\kiuaHio.exe
  C:\Windows\System\kiuaHio.exe
  2⤵
  PID:2472
- C:\Windows\System\EcbhAtL.exe
  C:\Windows\System\EcbhAtL.exe
  2⤵
  PID:1660
- C:\Windows\System\EzZWPRv.exe
  C:\Windows\System\EzZWPRv.exe
  2⤵
  PID:1308
- C:\Windows\System\TdFHYfA.exe
  C:\Windows\System\TdFHYfA.exe
  2⤵
  PID:1932
- C:\Windows\System\uovWIAe.exe
  C:\Windows\System\uovWIAe.exe
  2⤵
  PID:1632
- C:\Windows\System\rNONuqW.exe
  C:\Windows\System\rNONuqW.exe
  2⤵
  PID:884
- C:\Windows\System\gArAyRr.exe
  C:\Windows\System\gArAyRr.exe
  2⤵
  PID:2052
- C:\Windows\System\ULCCSmr.exe
  C:\Windows\System\ULCCSmr.exe
  2⤵
  PID:2004
- C:\Windows\System\XleIUqQ.exe
  C:\Windows\System\XleIUqQ.exe
  2⤵
  PID:2152
- C:\Windows\System\aSyTFsX.exe
  C:\Windows\System\aSyTFsX.exe
  2⤵
  PID:2624
- C:\Windows\System\WvOqKTf.exe
  C:\Windows\System\WvOqKTf.exe
  2⤵
  PID:2536
- C:\Windows\System\GRUNoUn.exe
  C:\Windows\System\GRUNoUn.exe
  2⤵
  PID:3044
- C:\Windows\System\fyEPgDP.exe
  C:\Windows\System\fyEPgDP.exe
  2⤵
  PID:1376
- C:\Windows\System\klKZXTA.exe
  C:\Windows\System\klKZXTA.exe
  2⤵
  PID:2976
- C:\Windows\System\DaVXoAN.exe
  C:\Windows\System\DaVXoAN.exe
  2⤵
  PID:3088
- C:\Windows\System\CrAVTVV.exe
  C:\Windows\System\CrAVTVV.exe
  2⤵
  PID:3108
- C:\Windows\System\zlLDlVz.exe
  C:\Windows\System\zlLDlVz.exe
  2⤵
  PID:3124
- C:\Windows\System\LuXarzV.exe
  C:\Windows\System\LuXarzV.exe
  2⤵
  PID:3140
- C:\Windows\System\MLgtike.exe
  C:\Windows\System\MLgtike.exe
  2⤵
  PID:3156
- C:\Windows\System\NYWCUis.exe
  C:\Windows\System\NYWCUis.exe
  2⤵
  PID:3172
- C:\Windows\System\ajSmTdp.exe
  C:\Windows\System\ajSmTdp.exe
  2⤵
  PID:3188
- C:\Windows\System\qbjdsez.exe
  C:\Windows\System\qbjdsez.exe
  2⤵
  PID:3204
- C:\Windows\System\GayOnSl.exe
  C:\Windows\System\GayOnSl.exe
  2⤵
  PID:3220
- C:\Windows\System\rgFCfXS.exe
  C:\Windows\System\rgFCfXS.exe
  2⤵
  PID:3236
- C:\Windows\System\kxDPltg.exe
  C:\Windows\System\kxDPltg.exe
  2⤵
  PID:3252
- C:\Windows\System\jrAzWCx.exe
  C:\Windows\System\jrAzWCx.exe
  2⤵
  PID:3268
- C:\Windows\System\DitUOPL.exe
  C:\Windows\System\DitUOPL.exe
  2⤵
  PID:3284
- C:\Windows\System\laRpdOP.exe
  C:\Windows\System\laRpdOP.exe
  2⤵
  PID:3300
- C:\Windows\System\eJopCSa.exe
  C:\Windows\System\eJopCSa.exe
  2⤵
  PID:3316
- C:\Windows\System\uQyisTC.exe
  C:\Windows\System\uQyisTC.exe
  2⤵
  PID:3368
- C:\Windows\System\LjdHzcD.exe
  C:\Windows\System\LjdHzcD.exe
  2⤵
  PID:3384
- C:\Windows\System\isQZzYO.exe
  C:\Windows\System\isQZzYO.exe
  2⤵
  PID:3404
- C:\Windows\System\Zrlzwgl.exe
  C:\Windows\System\Zrlzwgl.exe
  2⤵
  PID:3476
- C:\Windows\System\pMpvOPe.exe
  C:\Windows\System\pMpvOPe.exe
  2⤵
  PID:3496
- C:\Windows\System\TdzyPPG.exe
  C:\Windows\System\TdzyPPG.exe
  2⤵
  PID:3524
- C:\Windows\System\BQdaLPJ.exe
  C:\Windows\System\BQdaLPJ.exe
  2⤵
  PID:3540
- C:\Windows\System\emFChoW.exe
  C:\Windows\System\emFChoW.exe
  2⤵
  PID:3556
- C:\Windows\System\NyRtnyI.exe
  C:\Windows\System\NyRtnyI.exe
  2⤵
  PID:3572
- C:\Windows\System\ZtoCZRC.exe
  C:\Windows\System\ZtoCZRC.exe
  2⤵
  PID:3588
- C:\Windows\System\HSioxtl.exe
  C:\Windows\System\HSioxtl.exe
  2⤵
  PID:3604
- C:\Windows\System\JNdntdz.exe
  C:\Windows\System\JNdntdz.exe
  2⤵
  PID:3624
- C:\Windows\System\rJwHwPX.exe
  C:\Windows\System\rJwHwPX.exe
  2⤵
  PID:3640
- C:\Windows\System\uIWXsDu.exe
  C:\Windows\System\uIWXsDu.exe
  2⤵
  PID:3660
- C:\Windows\System\JQeHsiJ.exe
  C:\Windows\System\JQeHsiJ.exe
  2⤵
  PID:3676
- C:\Windows\System\kOjenGq.exe
  C:\Windows\System\kOjenGq.exe
  2⤵
  PID:3692
- C:\Windows\System\rJIujeh.exe
  C:\Windows\System\rJIujeh.exe
  2⤵
  PID:3708
- C:\Windows\System\ELMLhzj.exe
  C:\Windows\System\ELMLhzj.exe
  2⤵
  PID:3724
- C:\Windows\System\MsegoFK.exe
  C:\Windows\System\MsegoFK.exe
  2⤵
  PID:3740
- C:\Windows\System\BFTWVfb.exe
  C:\Windows\System\BFTWVfb.exe
  2⤵
  PID:3756
- C:\Windows\System\XoBQPhY.exe
  C:\Windows\System\XoBQPhY.exe
  2⤵
  PID:3772
- C:\Windows\System\hkpsWEI.exe
  C:\Windows\System\hkpsWEI.exe
  2⤵
  PID:3816
- C:\Windows\System\zgkuijY.exe
  C:\Windows\System\zgkuijY.exe
  2⤵
  PID:3832
- C:\Windows\System\bPIqHDT.exe
  C:\Windows\System\bPIqHDT.exe
  2⤵
  PID:3848
- C:\Windows\System\dGSEomk.exe
  C:\Windows\System\dGSEomk.exe
  2⤵
  PID:3864
- C:\Windows\System\RCPgxzB.exe
  C:\Windows\System\RCPgxzB.exe
  2⤵
  PID:3884
- C:\Windows\System\OsvGKsG.exe
  C:\Windows\System\OsvGKsG.exe
  2⤵
  PID:3900
- C:\Windows\System\DxqyZCI.exe
  C:\Windows\System\DxqyZCI.exe
  2⤵
  PID:3916
- C:\Windows\System\skumHEC.exe
  C:\Windows\System\skumHEC.exe
  2⤵
  PID:3936
- C:\Windows\System\sbAyYwx.exe
  C:\Windows\System\sbAyYwx.exe
  2⤵
  PID:3952
- C:\Windows\System\QXVETXQ.exe
  C:\Windows\System\QXVETXQ.exe
  2⤵
  PID:3968
- C:\Windows\System\iEjBKOx.exe
  C:\Windows\System\iEjBKOx.exe
  2⤵
  PID:3984
- C:\Windows\System\UGpVCdF.exe
  C:\Windows\System\UGpVCdF.exe
  2⤵
  PID:4004
- C:\Windows\System\DsSDCoL.exe
  C:\Windows\System\DsSDCoL.exe
  2⤵
  PID:4020
- C:\Windows\System\TJpCYmP.exe
  C:\Windows\System\TJpCYmP.exe
  2⤵
  PID:4040
- C:\Windows\System\WNlcsmy.exe
  C:\Windows\System\WNlcsmy.exe
  2⤵
  PID:4060
- C:\Windows\System\OVpTISm.exe
  C:\Windows\System\OVpTISm.exe
  2⤵
  PID:4076
- C:\Windows\System\lLygGta.exe
  C:\Windows\System\lLygGta.exe
  2⤵
  PID:1956
- C:\Windows\System\KoRlOsC.exe
  C:\Windows\System\KoRlOsC.exe
  2⤵
  PID:2652
- C:\Windows\System\YoOThTt.exe
  C:\Windows\System\YoOThTt.exe
  2⤵
  PID:3060
- C:\Windows\System\SiEafeu.exe
  C:\Windows\System\SiEafeu.exe
  2⤵
  PID:2852
- C:\Windows\System\YohIGiZ.exe
  C:\Windows\System\YohIGiZ.exe
  2⤵
  PID:912
- C:\Windows\System\CemumbJ.exe
  C:\Windows\System\CemumbJ.exe
  2⤵
  PID:848
- C:\Windows\System\vxRYmgQ.exe
  C:\Windows\System\vxRYmgQ.exe
  2⤵
  PID:3132
- C:\Windows\System\pBPaYYd.exe
  C:\Windows\System\pBPaYYd.exe
  2⤵
  PID:2732
- C:\Windows\System\guiasMt.exe
  C:\Windows\System\guiasMt.exe
  2⤵
  PID:3084
- C:\Windows\System\jmvgrFv.exe
  C:\Windows\System\jmvgrFv.exe
  2⤵
  PID:3100
- C:\Windows\System\gKiQUbL.exe
  C:\Windows\System\gKiQUbL.exe
  2⤵
  PID:3196
- C:\Windows\System\dOKwPkL.exe
  C:\Windows\System\dOKwPkL.exe
  2⤵
  PID:3260
- C:\Windows\System\uuSFgTf.exe
  C:\Windows\System\uuSFgTf.exe
  2⤵
  PID:3332
- C:\Windows\System\qAlapok.exe
  C:\Windows\System\qAlapok.exe
  2⤵
  PID:3348
- C:\Windows\System\IOgSnle.exe
  C:\Windows\System\IOgSnle.exe
  2⤵
  PID:3276
- C:\Windows\System\xLCcgSK.exe
  C:\Windows\System\xLCcgSK.exe
  2⤵
  PID:2996
- C:\Windows\System\ItQUMUx.exe
  C:\Windows\System\ItQUMUx.exe
  2⤵
  PID:3312
- C:\Windows\System\CbNUUJB.exe
  C:\Windows\System\CbNUUJB.exe
  2⤵
  PID:3184
- C:\Windows\System\omhiXQW.exe
  C:\Windows\System\omhiXQW.exe
  2⤵
  PID:3400
- C:\Windows\System\tWmExOc.exe
  C:\Windows\System\tWmExOc.exe
  2⤵
  PID:3492
- C:\Windows\System\rExzXoK.exe
  C:\Windows\System\rExzXoK.exe
  2⤵
  PID:3568
- C:\Windows\System\FXCqdWr.exe
  C:\Windows\System\FXCqdWr.exe
  2⤵
  PID:3700
- C:\Windows\System\FvcJgkH.exe
  C:\Windows\System\FvcJgkH.exe
  2⤵
  PID:3764
- C:\Windows\System\ETPXadv.exe
  C:\Windows\System\ETPXadv.exe
  2⤵
  PID:3768
- C:\Windows\System\CycNtOQ.exe
  C:\Windows\System\CycNtOQ.exe
  2⤵
  PID:3412
- C:\Windows\System\DsidlDO.exe
  C:\Windows\System\DsidlDO.exe
  2⤵
  PID:3428
- C:\Windows\System\KosdjQL.exe
  C:\Windows\System\KosdjQL.exe
  2⤵
  PID:3444
- C:\Windows\System\fTIXehP.exe
  C:\Windows\System\fTIXehP.exe
  2⤵
  PID:3460
- C:\Windows\System\JoXCYSH.exe
  C:\Windows\System\JoXCYSH.exe
  2⤵
  PID:3508
- C:\Windows\System\JvBVkcv.exe
  C:\Windows\System\JvBVkcv.exe
  2⤵
  PID:3548
- C:\Windows\System\UfpJwGf.exe
  C:\Windows\System\UfpJwGf.exe
  2⤵
  PID:3612
- C:\Windows\System\uycOJdn.exe
  C:\Windows\System\uycOJdn.exe
  2⤵
  PID:3652
- C:\Windows\System\fzVcNoL.exe
  C:\Windows\System\fzVcNoL.exe
  2⤵
  PID:3716
- C:\Windows\System\BEVpbVD.exe
  C:\Windows\System\BEVpbVD.exe
  2⤵
  PID:3752
- C:\Windows\System\dtyafuN.exe
  C:\Windows\System\dtyafuN.exe
  2⤵
  PID:3792
- C:\Windows\System\yHXfiMZ.exe
  C:\Windows\System\yHXfiMZ.exe
  2⤵
  PID:4104
- C:\Windows\System\dHQMllI.exe
  C:\Windows\System\dHQMllI.exe
  2⤵
  PID:4120
- C:\Windows\System\KzzypoV.exe
  C:\Windows\System\KzzypoV.exe
  2⤵
  PID:4136
- C:\Windows\System\ZHRmbWb.exe
  C:\Windows\System\ZHRmbWb.exe
  2⤵
  PID:4152
- C:\Windows\System\zHgywbm.exe
  C:\Windows\System\zHgywbm.exe
  2⤵
  PID:4168
- C:\Windows\System\capPqoQ.exe
  C:\Windows\System\capPqoQ.exe
  2⤵
  PID:4184
- C:\Windows\System\lLzEzdx.exe
  C:\Windows\System\lLzEzdx.exe
  2⤵
  PID:4200
- C:\Windows\System\efGIyIc.exe
  C:\Windows\System\efGIyIc.exe
  2⤵
  PID:4216
- C:\Windows\System\TESgEaj.exe
  C:\Windows\System\TESgEaj.exe
  2⤵
  PID:4236
- C:\Windows\System\cstBwLJ.exe
  C:\Windows\System\cstBwLJ.exe
  2⤵
  PID:4256
- C:\Windows\System\knNUaNt.exe
  C:\Windows\System\knNUaNt.exe
  2⤵
  PID:4280
- C:\Windows\System\kdjhZQn.exe
  C:\Windows\System\kdjhZQn.exe
  2⤵
  PID:4296
- C:\Windows\System\kyVUuWH.exe
  C:\Windows\System\kyVUuWH.exe
  2⤵
  PID:4320
- C:\Windows\System\PrudbyN.exe
  C:\Windows\System\PrudbyN.exe
  2⤵
  PID:4336
- C:\Windows\System\VnvMgXC.exe
  C:\Windows\System\VnvMgXC.exe
  2⤵
  PID:4352
- C:\Windows\System\lYylsbz.exe
  C:\Windows\System\lYylsbz.exe
  2⤵
  PID:4368
- C:\Windows\System\NgAfzLT.exe
  C:\Windows\System\NgAfzLT.exe
  2⤵
  PID:4388
- C:\Windows\System\FPQcCEt.exe
  C:\Windows\System\FPQcCEt.exe
  2⤵
  PID:4408
- C:\Windows\System\uUdwjxM.exe
  C:\Windows\System\uUdwjxM.exe
  2⤵
  PID:4424
- C:\Windows\System\nloPxTe.exe
  C:\Windows\System\nloPxTe.exe
  2⤵
  PID:4444
- C:\Windows\System\RjQGAyE.exe
  C:\Windows\System\RjQGAyE.exe
  2⤵
  PID:4460
- C:\Windows\System\PCZnIPZ.exe
  C:\Windows\System\PCZnIPZ.exe
  2⤵
  PID:4480
- C:\Windows\System\RvAPHae.exe
  C:\Windows\System\RvAPHae.exe
  2⤵
  PID:4496
- C:\Windows\System\wNszOBM.exe
  C:\Windows\System\wNszOBM.exe
  2⤵
  PID:4516
- C:\Windows\System\dTJVlSV.exe
  C:\Windows\System\dTJVlSV.exe
  2⤵
  PID:4532
- C:\Windows\System\WFIuJPv.exe
  C:\Windows\System\WFIuJPv.exe
  2⤵
  PID:4552
- C:\Windows\System\CahOLfH.exe
  C:\Windows\System\CahOLfH.exe
  2⤵
  PID:4572
- C:\Windows\System\SBUfmpo.exe
  C:\Windows\System\SBUfmpo.exe
  2⤵
  PID:4588
- C:\Windows\System\xpwYyCU.exe
  C:\Windows\System\xpwYyCU.exe
  2⤵
  PID:4612
- C:\Windows\System\DmpIUJA.exe
  C:\Windows\System\DmpIUJA.exe
  2⤵
  PID:4628
- C:\Windows\System\fXNxIwR.exe
  C:\Windows\System\fXNxIwR.exe
  2⤵
  PID:4652
- C:\Windows\System\YCSakxg.exe
  C:\Windows\System\YCSakxg.exe
  2⤵
  PID:4668
- C:\Windows\System\wzKtRsA.exe
  C:\Windows\System\wzKtRsA.exe
  2⤵
  PID:4688
- C:\Windows\System\jNuIiKu.exe
  C:\Windows\System\jNuIiKu.exe
  2⤵
  PID:4704
- C:\Windows\System\YArqewb.exe
  C:\Windows\System\YArqewb.exe
  2⤵
  PID:4724
- C:\Windows\System\yVvpZQn.exe
  C:\Windows\System\yVvpZQn.exe
  2⤵
  PID:4752
- C:\Windows\System\wpuxBwA.exe
  C:\Windows\System\wpuxBwA.exe
  2⤵
  PID:4768
- C:\Windows\System\CsMFoUD.exe
  C:\Windows\System\CsMFoUD.exe
  2⤵
  PID:4784
- C:\Windows\System\CvKHSXK.exe
  C:\Windows\System\CvKHSXK.exe
  2⤵
  PID:4800
- C:\Windows\System\MkKAPne.exe
  C:\Windows\System\MkKAPne.exe
  2⤵
  PID:4816
- C:\Windows\System\NmGslfA.exe
  C:\Windows\System\NmGslfA.exe
  2⤵
  PID:4832
- C:\Windows\System\DXuESUa.exe
  C:\Windows\System\DXuESUa.exe
  2⤵
  PID:4848
- C:\Windows\System\uSfXRXg.exe
  C:\Windows\System\uSfXRXg.exe
  2⤵
  PID:4864
- C:\Windows\System\cToylkG.exe
  C:\Windows\System\cToylkG.exe
  2⤵
  PID:4880
- C:\Windows\System\YyHNqhu.exe
  C:\Windows\System\YyHNqhu.exe
  2⤵
  PID:4896
- C:\Windows\System\MCjiAEr.exe
  C:\Windows\System\MCjiAEr.exe
  2⤵
  PID:4916
- C:\Windows\System\RZgXdqg.exe
  C:\Windows\System\RZgXdqg.exe
  2⤵
  PID:4932
- C:\Windows\System\uWBgWUh.exe
  C:\Windows\System\uWBgWUh.exe
  2⤵
  PID:4948
- C:\Windows\System\PAxkDoc.exe
  C:\Windows\System\PAxkDoc.exe
  2⤵
  PID:4964
- C:\Windows\System\KuUuNot.exe
  C:\Windows\System\KuUuNot.exe
  2⤵
  PID:4980
- C:\Windows\System\TDtJVdu.exe
  C:\Windows\System\TDtJVdu.exe
  2⤵
  PID:4996
- C:\Windows\System\QJQVkUg.exe
  C:\Windows\System\QJQVkUg.exe
  2⤵
  PID:5012
- C:\Windows\System\sQZPBQk.exe
  C:\Windows\System\sQZPBQk.exe
  2⤵
  PID:5028
- C:\Windows\System\lsMxzml.exe
  C:\Windows\System\lsMxzml.exe
  2⤵
  PID:5044
- C:\Windows\System\HDWbxqH.exe
  C:\Windows\System\HDWbxqH.exe
  2⤵
  PID:5060
- C:\Windows\System\PqeBTik.exe
  C:\Windows\System\PqeBTik.exe
  2⤵
  PID:5076
- C:\Windows\System\kxexptO.exe
  C:\Windows\System\kxexptO.exe
  2⤵
  PID:5092
- C:\Windows\System\qukzJXU.exe
  C:\Windows\System\qukzJXU.exe
  2⤵
  PID:5108
- C:\Windows\System\dkUMYxH.exe
  C:\Windows\System\dkUMYxH.exe
  2⤵
  PID:3804
- C:\Windows\System\qLMFoCa.exe
  C:\Windows\System\qLMFoCa.exe
  2⤵
  PID:3844
- C:\Windows\System\HSQFehz.exe
  C:\Windows\System\HSQFehz.exe
  2⤵
  PID:3912
- C:\Windows\System\vrNiCuX.exe
  C:\Windows\System\vrNiCuX.exe
  2⤵
  PID:3980
- C:\Windows\System\cnFZAxE.exe
  C:\Windows\System\cnFZAxE.exe
  2⤵
  PID:4052
- C:\Windows\System\hGFZslX.exe
  C:\Windows\System\hGFZslX.exe
  2⤵
  PID:4092
- C:\Windows\System\ZElTWAb.exe
  C:\Windows\System\ZElTWAb.exe
  2⤵
  PID:1152
- C:\Windows\System\LJfoqAf.exe
  C:\Windows\System\LJfoqAf.exe
  2⤵
  PID:3076
- C:\Windows\System\zppbMLR.exe
  C:\Windows\System\zppbMLR.exe
  2⤵
  PID:3168
- C:\Windows\System\TlOCmhA.exe
  C:\Windows\System\TlOCmhA.exe
  2⤵
  PID:3212
- C:\Windows\System\nrWwbDs.exe
  C:\Windows\System\nrWwbDs.exe
  2⤵
  PID:3120
- C:\Windows\System\aLGGEwp.exe
  C:\Windows\System\aLGGEwp.exe
  2⤵
  PID:3564
- C:\Windows\System\kSzCPyu.exe
  C:\Windows\System\kSzCPyu.exe
  2⤵
  PID:3380
- C:\Windows\System\VOzygep.exe
  C:\Windows\System\VOzygep.exe
  2⤵
  PID:3472
- C:\Windows\System\qyYiCMa.exe
  C:\Windows\System\qyYiCMa.exe
  2⤵
  PID:3684
- C:\Windows\System\PgdZoli.exe
  C:\Windows\System\PgdZoli.exe
  2⤵
  PID:4112
- C:\Windows\System\NBCdcgQ.exe
  C:\Windows\System\NBCdcgQ.exe
  2⤵
  PID:3928
- C:\Windows\System\ZuTySLw.exe
  C:\Windows\System\ZuTySLw.exe
  2⤵
  PID:4208
- C:\Windows\System\BuvKIDl.exe
  C:\Windows\System\BuvKIDl.exe
  2⤵
  PID:4252
- C:\Windows\System\asBUfwJ.exe
  C:\Windows\System\asBUfwJ.exe
  2⤵
  PID:3828
- C:\Windows\System\JBCwPRx.exe
  C:\Windows\System\JBCwPRx.exe
  2⤵
  PID:3672
- C:\Windows\System\MoOnBXi.exe
  C:\Windows\System\MoOnBXi.exe
  2⤵
  PID:3932
- C:\Windows\System\oyfzTav.exe
  C:\Windows\System\oyfzTav.exe
  2⤵
  PID:4344
- C:\Windows\System\rPFycfP.exe
  C:\Windows\System\rPFycfP.exe
  2⤵
  PID:4524
- C:\Windows\System\rKhFGDi.exe
  C:\Windows\System\rKhFGDi.exe
  2⤵
  PID:1512
- C:\Windows\System\mJyFdvF.exe
  C:\Windows\System\mJyFdvF.exe
  2⤵
  PID:4276
- C:\Windows\System\KfMVkJR.exe
  C:\Windows\System\KfMVkJR.exe
  2⤵
  PID:4316
- C:\Windows\System\bbgnXGW.exe
  C:\Windows\System\bbgnXGW.exe
  2⤵
  PID:4384
- C:\Windows\System\UkegvYJ.exe
  C:\Windows\System\UkegvYJ.exe
  2⤵
  PID:4492
- C:\Windows\System\zwqcdxX.exe
  C:\Windows\System\zwqcdxX.exe
  2⤵
  PID:4568
- C:\Windows\System\gvdlYlj.exe
  C:\Windows\System\gvdlYlj.exe
  2⤵
  PID:4332
- C:\Windows\System\QnxHhpp.exe
  C:\Windows\System\QnxHhpp.exe
  2⤵
  PID:4636
- C:\Windows\System\CGqpMXb.exe
  C:\Windows\System\CGqpMXb.exe
  2⤵
  PID:4680
- C:\Windows\System\lpTDBdZ.exe
  C:\Windows\System\lpTDBdZ.exe
  2⤵
  PID:4716
- C:\Windows\System\IOpAjYH.exe
  C:\Windows\System\IOpAjYH.exe
  2⤵
  PID:4404
- C:\Windows\System\WiprcZf.exe
  C:\Windows\System\WiprcZf.exe
  2⤵
  PID:4580
- C:\Windows\System\DaVCQlK.exe
  C:\Windows\System\DaVCQlK.exe
  2⤵
  PID:4732
- C:\Windows\System\UDYdWgn.exe
  C:\Windows\System\UDYdWgn.exe
  2⤵
  PID:4468
- C:\Windows\System\pBfhXdP.exe
  C:\Windows\System\pBfhXdP.exe
  2⤵
  PID:4544
- C:\Windows\System\cJfCfPz.exe
  C:\Windows\System\cJfCfPz.exe
  2⤵
  PID:4624
- C:\Windows\System\XzCwoVl.exe
  C:\Windows\System\XzCwoVl.exe
  2⤵
  PID:4776
- C:\Windows\System\odlIwuz.exe
  C:\Windows\System\odlIwuz.exe
  2⤵
  PID:4760
- C:\Windows\System\xMXXdIy.exe
  C:\Windows\System\xMXXdIy.exe
  2⤵
  PID:4824
- C:\Windows\System\dwnEKMc.exe
  C:\Windows\System\dwnEKMc.exe
  2⤵
  PID:4888
- C:\Windows\System\kUwshPO.exe
  C:\Windows\System\kUwshPO.exe
  2⤵
  PID:4876
- C:\Windows\System\OkMntGU.exe
  C:\Windows\System\OkMntGU.exe
  2⤵
  PID:4940
- C:\Windows\System\HPOdrMq.exe
  C:\Windows\System\HPOdrMq.exe
  2⤵
  PID:5004
- C:\Windows\System\bYSUfHU.exe
  C:\Windows\System\bYSUfHU.exe
  2⤵
  PID:4928
- C:\Windows\System\TDrODrO.exe
  C:\Windows\System\TDrODrO.exe
  2⤵
  PID:4988
- C:\Windows\System\bcUkMQQ.exe
  C:\Windows\System\bcUkMQQ.exe
  2⤵
  PID:5072
- C:\Windows\System\HjdxUQr.exe
  C:\Windows\System\HjdxUQr.exe
  2⤵
  PID:3840
- C:\Windows\System\BkmXrUl.exe
  C:\Windows\System\BkmXrUl.exe
  2⤵
  PID:4088
- C:\Windows\System\bfuTLJJ.exe
  C:\Windows\System\bfuTLJJ.exe
  2⤵
  PID:3328
- C:\Windows\System\utISYfN.exe
  C:\Windows\System\utISYfN.exe
  2⤵
  PID:5024
- C:\Windows\System\LeftNEh.exe
  C:\Windows\System\LeftNEh.exe
  2⤵
  PID:5056
- C:\Windows\System\EBLDDeZ.exe
  C:\Windows\System\EBLDDeZ.exe
  2⤵
  PID:3800
- C:\Windows\System\yuFjsVy.exe
  C:\Windows\System\yuFjsVy.exe
  2⤵
  PID:4016
- C:\Windows\System\SPEJtnO.exe
  C:\Windows\System\SPEJtnO.exe
  2⤵
  PID:3324
- C:\Windows\System\eYIeSrl.exe
  C:\Windows\System\eYIeSrl.exe
  2⤵
  PID:3580
- C:\Windows\System\ttRpgpN.exe
  C:\Windows\System\ttRpgpN.exe
  2⤵
  PID:4244
- C:\Windows\System\WnSmaXV.exe
  C:\Windows\System\WnSmaXV.exe
  2⤵
  PID:3960
- C:\Windows\System\lGhcdIZ.exe
  C:\Windows\System\lGhcdIZ.exe
  2⤵
  PID:4180
- C:\Windows\System\vMzFMeL.exe
  C:\Windows\System\vMzFMeL.exe
  2⤵
  PID:4416
- C:\Windows\System\iIVUzxC.exe
  C:\Windows\System\iIVUzxC.exe
  2⤵
  PID:4452
- C:\Windows\System\tbAbWRP.exe
  C:\Windows\System\tbAbWRP.exe
  2⤵
  PID:1052
- C:\Windows\System\SzfNlzw.exe
  C:\Windows\System\SzfNlzw.exe
  2⤵
  PID:956
- C:\Windows\System\QhKzaAT.exe
  C:\Windows\System\QhKzaAT.exe
  2⤵
  PID:3232
- C:\Windows\System\sMuzhFf.exe
  C:\Windows\System\sMuzhFf.exe
  2⤵
  PID:3344
- C:\Windows\System\VWwjiwu.exe
  C:\Windows\System\VWwjiwu.exe
  2⤵
  PID:3484
- C:\Windows\System\FxqTrPa.exe
  C:\Windows\System\FxqTrPa.exe
  2⤵
  PID:3704
- C:\Windows\System\DCOnTto.exe
  C:\Windows\System\DCOnTto.exe
  2⤵
  PID:3456
- C:\Windows\System\XIWcTsM.exe
  C:\Windows\System\XIWcTsM.exe
  2⤵
  PID:3856
- C:\Windows\System\EGVvxDQ.exe
  C:\Windows\System\EGVvxDQ.exe
  2⤵
  PID:4132
- C:\Windows\System\gbVnCrf.exe
  C:\Windows\System\gbVnCrf.exe
  2⤵
  PID:4196
- C:\Windows\System\TtRWgzl.exe
  C:\Windows\System\TtRWgzl.exe
  2⤵
  PID:4268
- C:\Windows\System\dqQkQEf.exe
  C:\Windows\System\dqQkQEf.exe
  2⤵
  PID:4380
- C:\Windows\System\KhrpHKh.exe
  C:\Windows\System\KhrpHKh.exe
  2⤵
  PID:4608
- C:\Windows\System\xMuylwl.exe
  C:\Windows\System\xMuylwl.exe
  2⤵
  PID:4456
- C:\Windows\System\MtNWAkf.exe
  C:\Windows\System\MtNWAkf.exe
  2⤵
  PID:4644
- C:\Windows\System\AhFuExc.exe
  C:\Windows\System\AhFuExc.exe
  2⤵
  PID:4504
- C:\Windows\System\CQdkQcD.exe
  C:\Windows\System\CQdkQcD.exe
  2⤵
  PID:4548
- C:\Windows\System\tvuofBy.exe
  C:\Windows\System\tvuofBy.exe
  2⤵
  PID:4664
- C:\Windows\System\jwmwFUz.exe
  C:\Windows\System\jwmwFUz.exe
  2⤵
  PID:4812
- C:\Windows\System\hgarVbl.exe
  C:\Windows\System\hgarVbl.exe
  2⤵
  PID:4796
- C:\Windows\System\wzUYPhH.exe
  C:\Windows\System\wzUYPhH.exe
  2⤵
  PID:4956
- C:\Windows\System\DOjIYeu.exe
  C:\Windows\System\DOjIYeu.exe
  2⤵
  PID:4856
- C:\Windows\System\WxVRkXx.exe
  C:\Windows\System\WxVRkXx.exe
  2⤵
  PID:4912
- C:\Windows\System\FkiBqUm.exe
  C:\Windows\System\FkiBqUm.exe
  2⤵
  PID:3976
- C:\Windows\System\gmuQAsX.exe
  C:\Windows\System\gmuQAsX.exe
  2⤵
  PID:5088
- C:\Windows\System\YVodqtW.exe
  C:\Windows\System\YVodqtW.exe
  2⤵
  PID:3136
- C:\Windows\System\XKmIXcd.exe
  C:\Windows\System\XKmIXcd.exe
  2⤵
  PID:3788
- C:\Windows\System\TuECBmq.exe
  C:\Windows\System\TuECBmq.exe
  2⤵
  PID:3336
- C:\Windows\System\yGcdBVe.exe
  C:\Windows\System\yGcdBVe.exe
  2⤵
  PID:2204
- C:\Windows\System\rsLcyxW.exe
  C:\Windows\System\rsLcyxW.exe
  2⤵
  PID:3736
- C:\Windows\System\Xgojjxa.exe
  C:\Windows\System\Xgojjxa.exe
  2⤵
  PID:2684
- C:\Windows\System\lBaVpMA.exe
  C:\Windows\System\lBaVpMA.exe
  2⤵
  PID:4068
- C:\Windows\System\SYdbTQq.exe
  C:\Windows\System\SYdbTQq.exe
  2⤵
  PID:1484
- C:\Windows\System\SJGoMEb.exe
  C:\Windows\System\SJGoMEb.exe
  2⤵
  PID:4100
- C:\Windows\System\AOAIKZJ.exe
  C:\Windows\System\AOAIKZJ.exe
  2⤵
  PID:3620
- C:\Windows\System\RRfKjZs.exe
  C:\Windows\System\RRfKjZs.exe
  2⤵
  PID:4308
- C:\Windows\System\SiAUsZB.exe
  C:\Windows\System\SiAUsZB.exe
  2⤵
  PID:4328
- C:\Windows\System\hdvHqvR.exe
  C:\Windows\System\hdvHqvR.exe
  2⤵
  PID:4972
- C:\Windows\System\wmsFakY.exe
  C:\Windows\System\wmsFakY.exe
  2⤵
  PID:4396
- C:\Windows\System\gWnNRfz.exe
  C:\Windows\System\gWnNRfz.exe
  2⤵
  PID:4748
- C:\Windows\System\OxveRzO.exe
  C:\Windows\System\OxveRzO.exe
  2⤵
  PID:4872
- C:\Windows\System\UaTbEew.exe
  C:\Windows\System\UaTbEew.exe
  2⤵
  PID:3908
- C:\Windows\System\FKlYPUX.exe
  C:\Windows\System\FKlYPUX.exe
  2⤵
  PID:4844
- C:\Windows\System\kJYikZh.exe
  C:\Windows\System\kJYikZh.exe
  2⤵
  PID:3784
- C:\Windows\System\JpmmeeT.exe
  C:\Windows\System\JpmmeeT.exe
  2⤵
  PID:3468
- C:\Windows\System\AmgBJuP.exe
  C:\Windows\System\AmgBJuP.exe
  2⤵
  PID:1444
- C:\Windows\System\MQJUmkx.exe
  C:\Windows\System\MQJUmkx.exe
  2⤵
  PID:3924
- C:\Windows\System\lFSRKgX.exe
  C:\Windows\System\lFSRKgX.exe
  2⤵
  PID:4564
- C:\Windows\System\BZJtRHJ.exe
  C:\Windows\System\BZJtRHJ.exe
  2⤵
  PID:4312
- C:\Windows\System\EVTuTif.exe
  C:\Windows\System\EVTuTif.exe
  2⤵
  PID:5124
- C:\Windows\System\TmxQcXC.exe
  C:\Windows\System\TmxQcXC.exe
  2⤵
  PID:5140
- C:\Windows\System\uckocwP.exe
  C:\Windows\System\uckocwP.exe
  2⤵
  PID:5156
- C:\Windows\System\XascFWf.exe
  C:\Windows\System\XascFWf.exe
  2⤵
  PID:5172
- C:\Windows\System\RGDnwbo.exe
  C:\Windows\System\RGDnwbo.exe
  2⤵
  PID:5188
- C:\Windows\System\yBQPsuD.exe
  C:\Windows\System\yBQPsuD.exe
  2⤵
  PID:5204
- C:\Windows\System\pgaseiL.exe
  C:\Windows\System\pgaseiL.exe
  2⤵
  PID:5220
- C:\Windows\System\NQfphgN.exe
  C:\Windows\System\NQfphgN.exe
  2⤵
  PID:5236
- C:\Windows\System\HmnHagC.exe
  C:\Windows\System\HmnHagC.exe
  2⤵
  PID:5252
- C:\Windows\System\sVcXLqW.exe
  C:\Windows\System\sVcXLqW.exe
  2⤵
  PID:5268
- C:\Windows\System\GHBHfxV.exe
  C:\Windows\System\GHBHfxV.exe
  2⤵
  PID:5284
- C:\Windows\System\ruaqviJ.exe
  C:\Windows\System\ruaqviJ.exe
  2⤵
  PID:5304
- C:\Windows\System\HwCyOWN.exe
  C:\Windows\System\HwCyOWN.exe
  2⤵
  PID:5320
- C:\Windows\System\YDgNYCd.exe
  C:\Windows\System\YDgNYCd.exe
  2⤵
  PID:5336
- C:\Windows\System\oeabiuj.exe
  C:\Windows\System\oeabiuj.exe
  2⤵
  PID:5352
- C:\Windows\System\CcWEHiq.exe
  C:\Windows\System\CcWEHiq.exe
  2⤵
  PID:5368
- C:\Windows\System\xzpTGvO.exe
  C:\Windows\System\xzpTGvO.exe
  2⤵
  PID:5384
- C:\Windows\System\jlKENrX.exe
  C:\Windows\System\jlKENrX.exe
  2⤵
  PID:5400
- C:\Windows\System\dkJMfPv.exe
  C:\Windows\System\dkJMfPv.exe
  2⤵
  PID:5416
- C:\Windows\System\ROXloMl.exe
  C:\Windows\System\ROXloMl.exe
  2⤵
  PID:5432
- C:\Windows\System\yqsJFqU.exe
  C:\Windows\System\yqsJFqU.exe
  2⤵
  PID:5448
- C:\Windows\System\QnicIVq.exe
  C:\Windows\System\QnicIVq.exe
  2⤵
  PID:5464
- C:\Windows\System\CvsyxrK.exe
  C:\Windows\System\CvsyxrK.exe
  2⤵
  PID:5480
- C:\Windows\System\RMKKNeL.exe
  C:\Windows\System\RMKKNeL.exe
  2⤵
  PID:5496
- C:\Windows\System\PRxZiSj.exe
  C:\Windows\System\PRxZiSj.exe
  2⤵
  PID:5512
- C:\Windows\System\oBOqIrv.exe
  C:\Windows\System\oBOqIrv.exe
  2⤵
  PID:5528
- C:\Windows\System\ZHcJeVL.exe
  C:\Windows\System\ZHcJeVL.exe
  2⤵
  PID:5544
- C:\Windows\System\eMrVnwl.exe
  C:\Windows\System\eMrVnwl.exe
  2⤵
  PID:5560
- C:\Windows\System\uXCyxOp.exe
  C:\Windows\System\uXCyxOp.exe
  2⤵
  PID:5576
- C:\Windows\System\IUaPLfN.exe
  C:\Windows\System\IUaPLfN.exe
  2⤵
  PID:5592
- C:\Windows\System\IiFstwA.exe
  C:\Windows\System\IiFstwA.exe
  2⤵
  PID:5608
- C:\Windows\System\gSlCyIh.exe
  C:\Windows\System\gSlCyIh.exe
  2⤵
  PID:5624
- C:\Windows\System\MUirYIb.exe
  C:\Windows\System\MUirYIb.exe
  2⤵
  PID:5640
- C:\Windows\System\JwDwsVZ.exe
  C:\Windows\System\JwDwsVZ.exe
  2⤵
  PID:5656
- C:\Windows\System\oVsdmdQ.exe
  C:\Windows\System\oVsdmdQ.exe
  2⤵
  PID:5672
- C:\Windows\System\uuSukXZ.exe
  C:\Windows\System\uuSukXZ.exe
  2⤵
  PID:5688
- C:\Windows\System\EBeNVOo.exe
  C:\Windows\System\EBeNVOo.exe
  2⤵
  PID:5704
- C:\Windows\System\GfesZWo.exe
  C:\Windows\System\GfesZWo.exe
  2⤵
  PID:5720
- C:\Windows\System\VhiQBri.exe
  C:\Windows\System\VhiQBri.exe
  2⤵
  PID:5736
- C:\Windows\System\yQFjdWQ.exe
  C:\Windows\System\yQFjdWQ.exe
  2⤵
  PID:5752
- C:\Windows\System\cxqRIdF.exe
  C:\Windows\System\cxqRIdF.exe
  2⤵
  PID:5768
- C:\Windows\System\OeRxpDi.exe
  C:\Windows\System\OeRxpDi.exe
  2⤵
  PID:5784
- C:\Windows\System\cUaQttq.exe
  C:\Windows\System\cUaQttq.exe
  2⤵
  PID:5800
- C:\Windows\System\zLSQmfZ.exe
  C:\Windows\System\zLSQmfZ.exe
  2⤵
  PID:5816
- C:\Windows\System\sDUYPZA.exe
  C:\Windows\System\sDUYPZA.exe
  2⤵
  PID:5832
- C:\Windows\System\DBbuToz.exe
  C:\Windows\System\DBbuToz.exe
  2⤵
  PID:5848
- C:\Windows\System\JvKFqut.exe
  C:\Windows\System\JvKFqut.exe
  2⤵
  PID:5864
- C:\Windows\System\vdWkuhl.exe
  C:\Windows\System\vdWkuhl.exe
  2⤵
  PID:5880
- C:\Windows\System\edsqoxm.exe
  C:\Windows\System\edsqoxm.exe
  2⤵
  PID:5896
- C:\Windows\System\FsoegSq.exe
  C:\Windows\System\FsoegSq.exe
  2⤵
  PID:5912
- C:\Windows\System\paDIMSy.exe
  C:\Windows\System\paDIMSy.exe
  2⤵
  PID:5928
- C:\Windows\System\jRDDEjB.exe
  C:\Windows\System\jRDDEjB.exe
  2⤵
  PID:5944
- C:\Windows\System\ilYgOKD.exe
  C:\Windows\System\ilYgOKD.exe
  2⤵
  PID:5960
- C:\Windows\System\Osxjdpn.exe
  C:\Windows\System\Osxjdpn.exe
  2⤵
  PID:5976
- C:\Windows\System\DbwNjFc.exe
  C:\Windows\System\DbwNjFc.exe
  2⤵
  PID:5992
- C:\Windows\System\aMdfQgT.exe
  C:\Windows\System\aMdfQgT.exe
  2⤵
  PID:6008
- C:\Windows\System\KCAgtdf.exe
  C:\Windows\System\KCAgtdf.exe
  2⤵
  PID:6024
- C:\Windows\System\PppskQk.exe
  C:\Windows\System\PppskQk.exe
  2⤵
  PID:6040
- C:\Windows\System\AdznYdu.exe
  C:\Windows\System\AdznYdu.exe
  2⤵
  PID:6056
- C:\Windows\System\kSfYLPj.exe
  C:\Windows\System\kSfYLPj.exe
  2⤵
  PID:6072
- C:\Windows\System\qvZmUPl.exe
  C:\Windows\System\qvZmUPl.exe
  2⤵
  PID:6088
- C:\Windows\System\nVkDxlm.exe
  C:\Windows\System\nVkDxlm.exe
  2⤵
  PID:6104
- C:\Windows\System\PGRARbD.exe
  C:\Windows\System\PGRARbD.exe
  2⤵
  PID:6120
- C:\Windows\System\HikzZXL.exe
  C:\Windows\System\HikzZXL.exe
  2⤵
  PID:6136
- C:\Windows\System\UmCSTng.exe
  C:\Windows\System\UmCSTng.exe
  2⤵
  PID:4164
- C:\Windows\System\kfPWvOm.exe
  C:\Windows\System\kfPWvOm.exe
  2⤵
  PID:3296
- C:\Windows\System\EDPzkxJ.exe
  C:\Windows\System\EDPzkxJ.exe
  2⤵
  PID:5068
- C:\Windows\System\WUiqYlL.exe
  C:\Windows\System\WUiqYlL.exe
  2⤵
  PID:4232
- C:\Windows\System\upJjnbn.exe
  C:\Windows\System\upJjnbn.exe
  2⤵
  PID:4860
- C:\Windows\System\TAqSozL.exe
  C:\Windows\System\TAqSozL.exe
  2⤵
  PID:5184
- C:\Windows\System\sbAGlkT.exe
  C:\Windows\System\sbAGlkT.exe
  2⤵
  PID:5248
- C:\Windows\System\JrjdxYY.exe
  C:\Windows\System\JrjdxYY.exe
  2⤵
  PID:5316
- C:\Windows\System\OczCgnf.exe
  C:\Windows\System\OczCgnf.exe
  2⤵
  PID:4360
- C:\Windows\System\udqgZlC.exe
  C:\Windows\System\udqgZlC.exe
  2⤵
  PID:5168
- C:\Windows\System\LsShYwk.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes