xmrig | 3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
Size

1.4MB
MD5

b03160437d054baaca22340acd9e2aea
SHA1

8f0b4b8fd36378dbd09e21049863c44ca287e746
SHA256

3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38
SHA512

4802176e4393b4d6575d6c90cc2a983d76aee6057ad63c85840a45814765318a7f1aacdbe5ce97db10603608ec18f82cdc8edc6ea4cae49828d1e3a18531222f
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbc1:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c53

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000d000000012261-4.dat	xmrig
behavioral1/files/0x0008000000016bfc-6.dat	xmrig
behavioral1/files/0x0008000000016c81-9.dat	xmrig
behavioral1/files/0x0007000000016cf8-15.dat	xmrig
behavioral1/files/0x0007000000016d33-25.dat	xmrig
behavioral1/files/0x0007000000016d11-23.dat	xmrig
behavioral1/files/0x0009000000016d46-31.dat	xmrig
behavioral1/files/0x0008000000016d4a-36.dat	xmrig
behavioral1/files/0x00050000000193f8-42.dat	xmrig
behavioral1/files/0x00050000000193fa-46.dat	xmrig
behavioral1/files/0x0005000000019408-52.dat	xmrig
behavioral1/files/0x00050000000194a7-60.dat	xmrig
behavioral1/files/0x00050000000194b4-64.dat	xmrig
behavioral1/files/0x0009000000016652-84.dat	xmrig
behavioral1/files/0x0005000000019501-110.dat	xmrig
behavioral1/files/0x0005000000019503-112.dat	xmrig
behavioral1/files/0x000500000001953a-124.dat	xmrig
behavioral1/files/0x0005000000019624-147.dat	xmrig
behavioral1/files/0x00050000000197c1-159.dat	xmrig
behavioral1/files/0x0005000000019625-154.dat	xmrig
behavioral1/files/0x000500000001961f-144.dat	xmrig
behavioral1/files/0x0005000000019589-134.dat	xmrig
behavioral1/files/0x000500000001961b-139.dat	xmrig
behavioral1/files/0x000500000001957c-129.dat	xmrig
behavioral1/files/0x0005000000019515-119.dat	xmrig
behavioral1/files/0x00050000000194f6-104.dat	xmrig
behavioral1/files/0x00050000000194f2-99.dat	xmrig
behavioral1/files/0x00050000000194ea-94.dat	xmrig
behavioral1/files/0x00050000000194e2-88.dat	xmrig
behavioral1/files/0x00050000000194da-80.dat	xmrig
behavioral1/files/0x00050000000194d4-75.dat	xmrig
behavioral1/files/0x0005000000019494-56.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2100	thctWEj.exe
2016	PUieiit.exe
1864	TRBMzru.exe
2300	hmgQvCa.exe
2548	vMvJgkd.exe
2912	JpFwTjE.exe
1792	hqxHmjh.exe
2736	TNlIKSG.exe
2824	bXQvCWx.exe
2732	yFZZJGF.exe
1540	GFChMrT.exe
2836	ZPxCPOS.exe
2768	VyvMFhg.exe
2628	LFCcSYd.exe
2156	dswHfRd.exe
3028	ULLxqMr.exe
1712	PcnIhOj.exe
676	aVjRUCy.exe
1568	gtOKurz.exe
3036	DfjDdwn.exe
1716	AEtssUK.exe
2328	FjSIqVP.exe
1976	rdtoDVQ.exe
2884	lDVGdln.exe
2764	nOaLiwk.exe
1344	qSpbJsF.exe
316	WWjCKfm.exe
1320	iNfTXUU.exe
1812	mHPnEqz.exe
2204	scoJCVs.exe
320	KJzUPTW.exe
1292	bZKHYcX.exe
2556	yJYsrwK.exe
2052	EIrBnIC.exe
1064	srZwqvK.exe
1104	OGbRtJz.exe
1148	ayydNUm.exe
300	KNfbvQD.exe
2188	XDRqsgd.exe
1532	GGzbVIL.exe
1352	HrKFnDS.exe
1928	EXQasRG.exe
468	zJYLuNC.exe
1584	cRGmoqZ.exe
1548	vHApuRW.exe
600	iDzmAGH.exe
1760	bTAVIKA.exe
112	qJfIhIt.exe
1052	bNoNnQH.exe
3068	ozFdvDF.exe
2552	YjrjpTJ.exe
2504	Hlhexnr.exe
2184	xQbftLK.exe
2320	TfFpSEr.exe
1536	CIdIgdn.exe
3044	NiLZuKi.exe
888	lBCsRGf.exe
2336	ZJFzTuN.exe
2024	HeOQgDk.exe
1616	NapTFZN.exe
1720	QuNIchm.exe
2012	IEgxDGn.exe
2672	CkcgFSL.exe
1884	AFRewnI.exe

Loads dropped DLL 64 IoCs

pid	Process
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HrKFnDS.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\UtGDHoB.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\kXsAowk.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\jcuqAtT.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\vfhDzWs.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\fJaSouq.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\tAwvfTv.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\tftuBng.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\JoIVajE.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\eLqDdiN.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\ZcHZKiq.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\cFuYnCY.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\sPSnpAr.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\dNOrQbj.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\ccOxxhw.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\BepWMvk.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\WehHYhv.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\vXkhwEj.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\bZgZGpA.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\mIVQILR.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\UNevBEA.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\qUiVBab.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\rqeJtqM.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\UijmsIq.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\hOrRmhP.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\bfJObwv.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\GpNSRBa.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\mDIdYcc.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\GoDybbU.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\eorxnQs.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\AHLwbah.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\QSGQRwR.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\VXijggG.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\OsSfWqA.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\cZeNRPN.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\ROGtcMt.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\VoAuLWb.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\vaRqIZa.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\mIkBrgh.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\DcvOJhA.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\yfsukdr.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\dPGUdIj.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\VfZikQR.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\iSSCuvH.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\tXBtZIr.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\brMUVbz.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\YuixIpZ.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\QpTcTUk.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\hmgQvCa.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\RDUqvMr.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\FYPvAuO.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\glZSkWT.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\vOKJVYu.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\rKHujAE.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\wBgmmNT.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\BoRtGfz.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\rUJXYZS.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\HMjQDZA.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\viAPOOG.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\IEEPWuH.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\kgERDcb.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\bBxwmcs.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\SbQPKAe.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\JhlYaWJ.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2100	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	31
PID 2508 wrote to memory of 2100	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	31
PID 2508 wrote to memory of 2100	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	31
PID 2508 wrote to memory of 2016	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	32
PID 2508 wrote to memory of 2016	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	32
PID 2508 wrote to memory of 2016	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	32
PID 2508 wrote to memory of 1864	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	33
PID 2508 wrote to memory of 1864	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	33
PID 2508 wrote to memory of 1864	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	33
PID 2508 wrote to memory of 2300	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	34
PID 2508 wrote to memory of 2300	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	34
PID 2508 wrote to memory of 2300	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	34
PID 2508 wrote to memory of 2548	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	35
PID 2508 wrote to memory of 2548	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	35
PID 2508 wrote to memory of 2548	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	35
PID 2508 wrote to memory of 2912	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	36
PID 2508 wrote to memory of 2912	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	36
PID 2508 wrote to memory of 2912	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	36
PID 2508 wrote to memory of 1792	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	37
PID 2508 wrote to memory of 1792	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	37
PID 2508 wrote to memory of 1792	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	37
PID 2508 wrote to memory of 2736	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	38
PID 2508 wrote to memory of 2736	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	38
PID 2508 wrote to memory of 2736	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	38
PID 2508 wrote to memory of 2824	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	39
PID 2508 wrote to memory of 2824	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	39
PID 2508 wrote to memory of 2824	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	39
PID 2508 wrote to memory of 2732	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	40
PID 2508 wrote to memory of 2732	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	40
PID 2508 wrote to memory of 2732	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	40
PID 2508 wrote to memory of 1540	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	41
PID 2508 wrote to memory of 1540	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	41
PID 2508 wrote to memory of 1540	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	41
PID 2508 wrote to memory of 2836	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	42
PID 2508 wrote to memory of 2836	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	42
PID 2508 wrote to memory of 2836	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	42
PID 2508 wrote to memory of 2768	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	43
PID 2508 wrote to memory of 2768	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	43
PID 2508 wrote to memory of 2768	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	43
PID 2508 wrote to memory of 2628	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	44
PID 2508 wrote to memory of 2628	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	44
PID 2508 wrote to memory of 2628	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	44
PID 2508 wrote to memory of 2156	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	45
PID 2508 wrote to memory of 2156	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	45
PID 2508 wrote to memory of 2156	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	45
PID 2508 wrote to memory of 3028	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	46
PID 2508 wrote to memory of 3028	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	46
PID 2508 wrote to memory of 3028	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	46
PID 2508 wrote to memory of 1712	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	47
PID 2508 wrote to memory of 1712	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	47
PID 2508 wrote to memory of 1712	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	47
PID 2508 wrote to memory of 676	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	48
PID 2508 wrote to memory of 676	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	48
PID 2508 wrote to memory of 676	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	48
PID 2508 wrote to memory of 1568	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	49
PID 2508 wrote to memory of 1568	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	49
PID 2508 wrote to memory of 1568	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	49
PID 2508 wrote to memory of 3036	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	50
PID 2508 wrote to memory of 3036	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	50
PID 2508 wrote to memory of 3036	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	50
PID 2508 wrote to memory of 1716	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	51
PID 2508 wrote to memory of 1716	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	51
PID 2508 wrote to memory of 1716	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	51
PID 2508 wrote to memory of 2328	2508	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	52

C:\Users\Admin\AppData\Local\Temp\3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
"C:\Users\Admin\AppData\Local\Temp\3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\System\thctWEj.exe
  C:\Windows\System\thctWEj.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\PUieiit.exe
  C:\Windows\System\PUieiit.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\TRBMzru.exe
  C:\Windows\System\TRBMzru.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\hmgQvCa.exe
  C:\Windows\System\hmgQvCa.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\vMvJgkd.exe
  C:\Windows\System\vMvJgkd.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\JpFwTjE.exe
  C:\Windows\System\JpFwTjE.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\hqxHmjh.exe
  C:\Windows\System\hqxHmjh.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\TNlIKSG.exe
  C:\Windows\System\TNlIKSG.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\bXQvCWx.exe
  C:\Windows\System\bXQvCWx.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\yFZZJGF.exe
  C:\Windows\System\yFZZJGF.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\GFChMrT.exe
  C:\Windows\System\GFChMrT.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\ZPxCPOS.exe
  C:\Windows\System\ZPxCPOS.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\VyvMFhg.exe
  C:\Windows\System\VyvMFhg.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\LFCcSYd.exe
  C:\Windows\System\LFCcSYd.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\dswHfRd.exe
  C:\Windows\System\dswHfRd.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\ULLxqMr.exe
  C:\Windows\System\ULLxqMr.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\PcnIhOj.exe
  C:\Windows\System\PcnIhOj.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\aVjRUCy.exe
  C:\Windows\System\aVjRUCy.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\gtOKurz.exe
  C:\Windows\System\gtOKurz.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\DfjDdwn.exe
  C:\Windows\System\DfjDdwn.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\AEtssUK.exe
  C:\Windows\System\AEtssUK.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\FjSIqVP.exe
  C:\Windows\System\FjSIqVP.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\rdtoDVQ.exe
  C:\Windows\System\rdtoDVQ.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\lDVGdln.exe
  C:\Windows\System\lDVGdln.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\nOaLiwk.exe
  C:\Windows\System\nOaLiwk.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\qSpbJsF.exe
  C:\Windows\System\qSpbJsF.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\WWjCKfm.exe
  C:\Windows\System\WWjCKfm.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\iNfTXUU.exe
  C:\Windows\System\iNfTXUU.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\mHPnEqz.exe
  C:\Windows\System\mHPnEqz.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\scoJCVs.exe
  C:\Windows\System\scoJCVs.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\KJzUPTW.exe
  C:\Windows\System\KJzUPTW.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\bZKHYcX.exe
  C:\Windows\System\bZKHYcX.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\yJYsrwK.exe
  C:\Windows\System\yJYsrwK.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\EIrBnIC.exe
  C:\Windows\System\EIrBnIC.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\srZwqvK.exe
  C:\Windows\System\srZwqvK.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\OGbRtJz.exe
  C:\Windows\System\OGbRtJz.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\ayydNUm.exe
  C:\Windows\System\ayydNUm.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\KNfbvQD.exe
  C:\Windows\System\KNfbvQD.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\XDRqsgd.exe
  C:\Windows\System\XDRqsgd.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\GGzbVIL.exe
  C:\Windows\System\GGzbVIL.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\HrKFnDS.exe
  C:\Windows\System\HrKFnDS.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\EXQasRG.exe
  C:\Windows\System\EXQasRG.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\zJYLuNC.exe
  C:\Windows\System\zJYLuNC.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\cRGmoqZ.exe
  C:\Windows\System\cRGmoqZ.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\vHApuRW.exe
  C:\Windows\System\vHApuRW.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\iDzmAGH.exe
  C:\Windows\System\iDzmAGH.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\bTAVIKA.exe
  C:\Windows\System\bTAVIKA.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\qJfIhIt.exe
  C:\Windows\System\qJfIhIt.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\bNoNnQH.exe
  C:\Windows\System\bNoNnQH.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\ozFdvDF.exe
  C:\Windows\System\ozFdvDF.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\YjrjpTJ.exe
  C:\Windows\System\YjrjpTJ.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\Hlhexnr.exe
  C:\Windows\System\Hlhexnr.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\xQbftLK.exe
  C:\Windows\System\xQbftLK.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\TfFpSEr.exe
  C:\Windows\System\TfFpSEr.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\CIdIgdn.exe
  C:\Windows\System\CIdIgdn.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\NiLZuKi.exe
  C:\Windows\System\NiLZuKi.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\lBCsRGf.exe
  C:\Windows\System\lBCsRGf.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\ZJFzTuN.exe
  C:\Windows\System\ZJFzTuN.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\HeOQgDk.exe
  C:\Windows\System\HeOQgDk.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\NapTFZN.exe
  C:\Windows\System\NapTFZN.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\QuNIchm.exe
  C:\Windows\System\QuNIchm.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\IEgxDGn.exe
  C:\Windows\System\IEgxDGn.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\CkcgFSL.exe
  C:\Windows\System\CkcgFSL.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\AFRewnI.exe
  C:\Windows\System\AFRewnI.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\mwTvOER.exe
  C:\Windows\System\mwTvOER.exe
  2⤵
  PID:1804
- C:\Windows\System\HqnLzpT.exe
  C:\Windows\System\HqnLzpT.exe
  2⤵
  PID:2216
- C:\Windows\System\FrIdkbO.exe
  C:\Windows\System\FrIdkbO.exe
  2⤵
  PID:2096
- C:\Windows\System\gMGRBqo.exe
  C:\Windows\System\gMGRBqo.exe
  2⤵
  PID:2696
- C:\Windows\System\Sknxvbu.exe
  C:\Windows\System\Sknxvbu.exe
  2⤵
  PID:2820
- C:\Windows\System\LwseVKu.exe
  C:\Windows\System\LwseVKu.exe
  2⤵
  PID:2460
- C:\Windows\System\KnXuECr.exe
  C:\Windows\System\KnXuECr.exe
  2⤵
  PID:2616
- C:\Windows\System\RSaewzL.exe
  C:\Windows\System\RSaewzL.exe
  2⤵
  PID:2612
- C:\Windows\System\JDIvAfs.exe
  C:\Windows\System\JDIvAfs.exe
  2⤵
  PID:3020
- C:\Windows\System\pknTWig.exe
  C:\Windows\System\pknTWig.exe
  2⤵
  PID:1796
- C:\Windows\System\YVDbydp.exe
  C:\Windows\System\YVDbydp.exe
  2⤵
  PID:1664
- C:\Windows\System\RNlBWSv.exe
  C:\Windows\System\RNlBWSv.exe
  2⤵
  PID:2688
- C:\Windows\System\bWAjOdw.exe
  C:\Windows\System\bWAjOdw.exe
  2⤵
  PID:1992
- C:\Windows\System\DCsYVLG.exe
  C:\Windows\System\DCsYVLG.exe
  2⤵
  PID:2496
- C:\Windows\System\MaJpFbJ.exe
  C:\Windows\System\MaJpFbJ.exe
  2⤵
  PID:2864
- C:\Windows\System\YBYegGl.exe
  C:\Windows\System\YBYegGl.exe
  2⤵
  PID:1436
- C:\Windows\System\jvXDwNB.exe
  C:\Windows\System\jvXDwNB.exe
  2⤵
  PID:1820
- C:\Windows\System\ClkgMGt.exe
  C:\Windows\System\ClkgMGt.exe
  2⤵
  PID:2372
- C:\Windows\System\cQXncuF.exe
  C:\Windows\System\cQXncuF.exe
  2⤵
  PID:712
- C:\Windows\System\XcoGtdE.exe
  C:\Windows\System\XcoGtdE.exe
  2⤵
  PID:820
- C:\Windows\System\tKtVeDr.exe
  C:\Windows\System\tKtVeDr.exe
  2⤵
  PID:2196
- C:\Windows\System\BptDTep.exe
  C:\Windows\System\BptDTep.exe
  2⤵
  PID:760
- C:\Windows\System\IaIFJMP.exe
  C:\Windows\System\IaIFJMP.exe
  2⤵
  PID:844
- C:\Windows\System\TqFnSoB.exe
  C:\Windows\System\TqFnSoB.exe
  2⤵
  PID:1660
- C:\Windows\System\cmwglpU.exe
  C:\Windows\System\cmwglpU.exe
  2⤵
  PID:1372
- C:\Windows\System\xoUMmXX.exe
  C:\Windows\System\xoUMmXX.exe
  2⤵
  PID:1632
- C:\Windows\System\wgNklDu.exe
  C:\Windows\System\wgNklDu.exe
  2⤵
  PID:1212
- C:\Windows\System\WkUXFEi.exe
  C:\Windows\System\WkUXFEi.exe
  2⤵
  PID:1600
- C:\Windows\System\eZRJEHT.exe
  C:\Windows\System\eZRJEHT.exe
  2⤵
  PID:1360
- C:\Windows\System\tiXCFLP.exe
  C:\Windows\System\tiXCFLP.exe
  2⤵
  PID:1012
- C:\Windows\System\kzQnlDT.exe
  C:\Windows\System\kzQnlDT.exe
  2⤵
  PID:568
- C:\Windows\System\ixvypxx.exe
  C:\Windows\System\ixvypxx.exe
  2⤵
  PID:2924
- C:\Windows\System\PPBVPzj.exe
  C:\Windows\System\PPBVPzj.exe
  2⤵
  PID:2408
- C:\Windows\System\NduplKh.exe
  C:\Windows\System\NduplKh.exe
  2⤵
  PID:2404
- C:\Windows\System\jVKUYfp.exe
  C:\Windows\System\jVKUYfp.exe
  2⤵
  PID:988
- C:\Windows\System\MizdMkw.exe
  C:\Windows\System\MizdMkw.exe
  2⤵
  PID:2992
- C:\Windows\System\nfnaTFa.exe
  C:\Windows\System\nfnaTFa.exe
  2⤵
  PID:1168
- C:\Windows\System\HVcxZeo.exe
  C:\Windows\System\HVcxZeo.exe
  2⤵
  PID:1516
- C:\Windows\System\qIjlUcb.exe
  C:\Windows\System\qIjlUcb.exe
  2⤵
  PID:2004
- C:\Windows\System\xNCZAJw.exe
  C:\Windows\System\xNCZAJw.exe
  2⤵
  PID:2140
- C:\Windows\System\yjemQlO.exe
  C:\Windows\System\yjemQlO.exe
  2⤵
  PID:2284
- C:\Windows\System\tLLVEUv.exe
  C:\Windows\System\tLLVEUv.exe
  2⤵
  PID:2312
- C:\Windows\System\vxNSUIC.exe
  C:\Windows\System\vxNSUIC.exe
  2⤵
  PID:2692
- C:\Windows\System\CPvhtTr.exe
  C:\Windows\System\CPvhtTr.exe
  2⤵
  PID:2800
- C:\Windows\System\IOQsApB.exe
  C:\Windows\System\IOQsApB.exe
  2⤵
  PID:2664
- C:\Windows\System\kcGGxWS.exe
  C:\Windows\System\kcGGxWS.exe
  2⤵
  PID:1240
- C:\Windows\System\dvXHzXA.exe
  C:\Windows\System\dvXHzXA.exe
  2⤵
  PID:2476
- C:\Windows\System\BltznYF.exe
  C:\Windows\System\BltznYF.exe
  2⤵
  PID:1484
- C:\Windows\System\azSKyiw.exe
  C:\Windows\System\azSKyiw.exe
  2⤵
  PID:700
- C:\Windows\System\AydvdWs.exe
  C:\Windows\System\AydvdWs.exe
  2⤵
  PID:2916
- C:\Windows\System\vxzMwqv.exe
  C:\Windows\System\vxzMwqv.exe
  2⤵
  PID:1336
- C:\Windows\System\aPjsdmS.exe
  C:\Windows\System\aPjsdmS.exe
  2⤵
  PID:2412
- C:\Windows\System\ULPubox.exe
  C:\Windows\System\ULPubox.exe
  2⤵
  PID:2524
- C:\Windows\System\njuGTkU.exe
  C:\Windows\System\njuGTkU.exe
  2⤵
  PID:616
- C:\Windows\System\sVbxhNf.exe
  C:\Windows\System\sVbxhNf.exe
  2⤵
  PID:2740
- C:\Windows\System\DcvOJhA.exe
  C:\Windows\System\DcvOJhA.exe
  2⤵
  PID:1036
- C:\Windows\System\AxnueQj.exe
  C:\Windows\System\AxnueQj.exe
  2⤵
  PID:1740
- C:\Windows\System\eYKKPrc.exe
  C:\Windows\System\eYKKPrc.exe
  2⤵
  PID:1488
- C:\Windows\System\zWViiUl.exe
  C:\Windows\System\zWViiUl.exe
  2⤵
  PID:2428
- C:\Windows\System\zRLHxWj.exe
  C:\Windows\System\zRLHxWj.exe
  2⤵
  PID:2804
- C:\Windows\System\ZsmGlue.exe
  C:\Windows\System\ZsmGlue.exe
  2⤵
  PID:2080
- C:\Windows\System\eakqphC.exe
  C:\Windows\System\eakqphC.exe
  2⤵
  PID:1752
- C:\Windows\System\AMWuneu.exe
  C:\Windows\System\AMWuneu.exe
  2⤵
  PID:1580
- C:\Windows\System\EyemgGU.exe
  C:\Windows\System\EyemgGU.exe
  2⤵
  PID:2400
- C:\Windows\System\iUOqrDk.exe
  C:\Windows\System\iUOqrDk.exe
  2⤵
  PID:2368
- C:\Windows\System\hdhOqfC.exe
  C:\Windows\System\hdhOqfC.exe
  2⤵
  PID:2560
- C:\Windows\System\TwkFSzE.exe
  C:\Windows\System\TwkFSzE.exe
  2⤵
  PID:1672
- C:\Windows\System\SPMglsL.exe
  C:\Windows\System\SPMglsL.exe
  2⤵
  PID:2748
- C:\Windows\System\VfNoBSQ.exe
  C:\Windows\System\VfNoBSQ.exe
  2⤵
  PID:732
- C:\Windows\System\QWviHfl.exe
  C:\Windows\System\QWviHfl.exe
  2⤵
  PID:2776
- C:\Windows\System\OzUCiPW.exe
  C:\Windows\System\OzUCiPW.exe
  2⤵
  PID:1932
- C:\Windows\System\oQQoFxc.exe
  C:\Windows\System\oQQoFxc.exe
  2⤵
  PID:2656
- C:\Windows\System\xqgxfmA.exe
  C:\Windows\System\xqgxfmA.exe
  2⤵
  PID:2128
- C:\Windows\System\sMXvSjI.exe
  C:\Windows\System\sMXvSjI.exe
  2⤵
  PID:2684
- C:\Windows\System\WeiTnLm.exe
  C:\Windows\System\WeiTnLm.exe
  2⤵
  PID:1272
- C:\Windows\System\UCFoBYh.exe
  C:\Windows\System\UCFoBYh.exe
  2⤵
  PID:2072
- C:\Windows\System\NIIuMRz.exe
  C:\Windows\System\NIIuMRz.exe
  2⤵
  PID:916
- C:\Windows\System\TvrcpHF.exe
  C:\Windows\System\TvrcpHF.exe
  2⤵
  PID:2176
- C:\Windows\System\SIBNorH.exe
  C:\Windows\System\SIBNorH.exe
  2⤵
  PID:1496
- C:\Windows\System\dnGOpPy.exe
  C:\Windows\System\dnGOpPy.exe
  2⤵
  PID:2180
- C:\Windows\System\CHOeAKJ.exe
  C:\Windows\System\CHOeAKJ.exe
  2⤵
  PID:2892
- C:\Windows\System\efrOuhg.exe
  C:\Windows\System\efrOuhg.exe
  2⤵
  PID:2964
- C:\Windows\System\ThJUEdj.exe
  C:\Windows\System\ThJUEdj.exe
  2⤵
  PID:2860
- C:\Windows\System\Bobbpza.exe
  C:\Windows\System\Bobbpza.exe
  2⤵
  PID:2088
- C:\Windows\System\SeKqbuM.exe
  C:\Windows\System\SeKqbuM.exe
  2⤵
  PID:2844
- C:\Windows\System\BfXvQVw.exe
  C:\Windows\System\BfXvQVw.exe
  2⤵
  PID:2220
- C:\Windows\System\QwaWAsn.exe
  C:\Windows\System\QwaWAsn.exe
  2⤵
  PID:2716
- C:\Windows\System\pvcrPyv.exe
  C:\Windows\System\pvcrPyv.exe
  2⤵
  PID:2724
- C:\Windows\System\IHoasgR.exe
  C:\Windows\System\IHoasgR.exe
  2⤵
  PID:1772
- C:\Windows\System\FMtdueM.exe
  C:\Windows\System\FMtdueM.exe
  2⤵
  PID:288
- C:\Windows\System\mxFQjvh.exe
  C:\Windows\System\mxFQjvh.exe
  2⤵
  PID:1312
- C:\Windows\System\lKpgdyt.exe
  C:\Windows\System\lKpgdyt.exe
  2⤵
  PID:2256
- C:\Windows\System\YqtCbPT.exe
  C:\Windows\System\YqtCbPT.exe
  2⤵
  PID:2132
- C:\Windows\System\QlyMlfk.exe
  C:\Windows\System\QlyMlfk.exe
  2⤵
  PID:1748
- C:\Windows\System\dJsPLep.exe
  C:\Windows\System\dJsPLep.exe
  2⤵
  PID:2572
- C:\Windows\System\dotYZTm.exe
  C:\Windows\System\dotYZTm.exe
  2⤵
  PID:2272
- C:\Windows\System\nYyrBQV.exe
  C:\Windows\System\nYyrBQV.exe
  2⤵
  PID:1116
- C:\Windows\System\ffAIxAi.exe
  C:\Windows\System\ffAIxAi.exe
  2⤵
  PID:1520
- C:\Windows\System\GxFAgTo.exe
  C:\Windows\System\GxFAgTo.exe
  2⤵
  PID:3060
- C:\Windows\System\JHXGzlm.exe
  C:\Windows\System\JHXGzlm.exe
  2⤵
  PID:528
- C:\Windows\System\cjWDwSx.exe
  C:\Windows\System\cjWDwSx.exe
  2⤵
  PID:2876
- C:\Windows\System\CmAPbSW.exe
  C:\Windows\System\CmAPbSW.exe
  2⤵
  PID:1652
- C:\Windows\System\ncsGBOH.exe
  C:\Windows\System\ncsGBOH.exe
  2⤵
  PID:2472
- C:\Windows\System\YzPeGjx.exe
  C:\Windows\System\YzPeGjx.exe
  2⤵
  PID:2852
- C:\Windows\System\gyegueb.exe
  C:\Windows\System\gyegueb.exe
  2⤵
  PID:792
- C:\Windows\System\bYrYrPh.exe
  C:\Windows\System\bYrYrPh.exe
  2⤵
  PID:1056
- C:\Windows\System\jTpxEIN.exe
  C:\Windows\System\jTpxEIN.exe
  2⤵
  PID:2424
- C:\Windows\System\PoqFaLt.exe
  C:\Windows\System\PoqFaLt.exe
  2⤵
  PID:1656
- C:\Windows\System\rImKMlE.exe
  C:\Windows\System\rImKMlE.exe
  2⤵
  PID:816
- C:\Windows\System\NasLjQu.exe
  C:\Windows\System\NasLjQu.exe
  2⤵
  PID:3088
- C:\Windows\System\jjhBuHh.exe
  C:\Windows\System\jjhBuHh.exe
  2⤵
  PID:3104
- C:\Windows\System\wXIonzI.exe
  C:\Windows\System\wXIonzI.exe
  2⤵
  PID:3120
- C:\Windows\System\thWsqqr.exe
  C:\Windows\System\thWsqqr.exe
  2⤵
  PID:3136
- C:\Windows\System\hPnBNaT.exe
  C:\Windows\System\hPnBNaT.exe
  2⤵
  PID:3152
- C:\Windows\System\rdpYexg.exe
  C:\Windows\System\rdpYexg.exe
  2⤵
  PID:3168
- C:\Windows\System\YyUHpMj.exe
  C:\Windows\System\YyUHpMj.exe
  2⤵
  PID:3184
- C:\Windows\System\jIJIydY.exe
  C:\Windows\System\jIJIydY.exe
  2⤵
  PID:3216
- C:\Windows\System\eYaVNyW.exe
  C:\Windows\System\eYaVNyW.exe
  2⤵
  PID:3248
- C:\Windows\System\hupruXw.exe
  C:\Windows\System\hupruXw.exe
  2⤵
  PID:3276
- C:\Windows\System\lkkGTkO.exe
  C:\Windows\System\lkkGTkO.exe
  2⤵
  PID:3300
- C:\Windows\System\pSLhHcG.exe
  C:\Windows\System\pSLhHcG.exe
  2⤵
  PID:3316
- C:\Windows\System\JZzoXLz.exe
  C:\Windows\System\JZzoXLz.exe
  2⤵
  PID:3332
- C:\Windows\System\UXiYDyb.exe
  C:\Windows\System\UXiYDyb.exe
  2⤵
  PID:3348
- C:\Windows\System\LYLhjJL.exe
  C:\Windows\System\LYLhjJL.exe
  2⤵
  PID:3364
- C:\Windows\System\WgRfRnq.exe
  C:\Windows\System\WgRfRnq.exe
  2⤵
  PID:3388
- C:\Windows\System\mRvkbec.exe
  C:\Windows\System\mRvkbec.exe
  2⤵
  PID:3404
- C:\Windows\System\sYwYFrk.exe
  C:\Windows\System\sYwYFrk.exe
  2⤵
  PID:3424
- C:\Windows\System\GydOTyn.exe
  C:\Windows\System\GydOTyn.exe
  2⤵
  PID:3448
- C:\Windows\System\xAVOQfx.exe
  C:\Windows\System\xAVOQfx.exe
  2⤵
  PID:3488
- C:\Windows\System\zzStLaz.exe
  C:\Windows\System\zzStLaz.exe
  2⤵
  PID:3508
- C:\Windows\System\SjeogTH.exe
  C:\Windows\System\SjeogTH.exe
  2⤵
  PID:3532
- C:\Windows\System\uixHwYA.exe
  C:\Windows\System\uixHwYA.exe
  2⤵
  PID:3548
- C:\Windows\System\lkhittp.exe
  C:\Windows\System\lkhittp.exe
  2⤵
  PID:3564
- C:\Windows\System\PwdLGCG.exe
  C:\Windows\System\PwdLGCG.exe
  2⤵
  PID:3580
- C:\Windows\System\dXiHduP.exe
  C:\Windows\System\dXiHduP.exe
  2⤵
  PID:3600
- C:\Windows\System\oFjdQfQ.exe
  C:\Windows\System\oFjdQfQ.exe
  2⤵
  PID:3620
- C:\Windows\System\wSXHrsm.exe
  C:\Windows\System\wSXHrsm.exe
  2⤵
  PID:3640
- C:\Windows\System\tPYPooK.exe
  C:\Windows\System\tPYPooK.exe
  2⤵
  PID:3660
- C:\Windows\System\KliPyQL.exe
  C:\Windows\System\KliPyQL.exe
  2⤵
  PID:3676
- C:\Windows\System\yAtRIVI.exe
  C:\Windows\System\yAtRIVI.exe
  2⤵
  PID:3696
- C:\Windows\System\zlFLutt.exe
  C:\Windows\System\zlFLutt.exe
  2⤵
  PID:3716
- C:\Windows\System\RwBidWC.exe
  C:\Windows\System\RwBidWC.exe
  2⤵
  PID:3736
- C:\Windows\System\beNaLmj.exe
  C:\Windows\System\beNaLmj.exe
  2⤵
  PID:3752
- C:\Windows\System\WimuAsD.exe
  C:\Windows\System\WimuAsD.exe
  2⤵
  PID:3768
- C:\Windows\System\LfIrhFe.exe
  C:\Windows\System\LfIrhFe.exe
  2⤵
  PID:3784
- C:\Windows\System\zrMEQtD.exe
  C:\Windows\System\zrMEQtD.exe
  2⤵
  PID:3840
- C:\Windows\System\AJxQMYM.exe
  C:\Windows\System\AJxQMYM.exe
  2⤵
  PID:3856
- C:\Windows\System\WVrkGMV.exe
  C:\Windows\System\WVrkGMV.exe
  2⤵
  PID:3876
- C:\Windows\System\YhdKiNh.exe
  C:\Windows\System\YhdKiNh.exe
  2⤵
  PID:3904
- C:\Windows\System\SWlwKXl.exe
  C:\Windows\System\SWlwKXl.exe
  2⤵
  PID:3920
- C:\Windows\System\ClskLLm.exe
  C:\Windows\System\ClskLLm.exe
  2⤵
  PID:3936
- C:\Windows\System\AzEndxs.exe
  C:\Windows\System\AzEndxs.exe
  2⤵
  PID:3952
- C:\Windows\System\LrtqQtV.exe
  C:\Windows\System\LrtqQtV.exe
  2⤵
  PID:3968
- C:\Windows\System\tbQQpYR.exe
  C:\Windows\System\tbQQpYR.exe
  2⤵
  PID:3992
- C:\Windows\System\xQbTnPR.exe
  C:\Windows\System\xQbTnPR.exe
  2⤵
  PID:4008
- C:\Windows\System\jptaoyi.exe
  C:\Windows\System\jptaoyi.exe
  2⤵
  PID:4024
- C:\Windows\System\FZqfAgn.exe
  C:\Windows\System\FZqfAgn.exe
  2⤵
  PID:4044
- C:\Windows\System\SDhTume.exe
  C:\Windows\System\SDhTume.exe
  2⤵
  PID:4064
- C:\Windows\System\ALbJlPq.exe
  C:\Windows\System\ALbJlPq.exe
  2⤵
  PID:4088
- C:\Windows\System\kMMxnAX.exe
  C:\Windows\System\kMMxnAX.exe
  2⤵
  PID:1988
- C:\Windows\System\NuTSSMN.exe
  C:\Windows\System\NuTSSMN.exe
  2⤵
  PID:3192
- C:\Windows\System\ZQLvYno.exe
  C:\Windows\System\ZQLvYno.exe
  2⤵
  PID:552
- C:\Windows\System\Zzairzu.exe
  C:\Windows\System\Zzairzu.exe
  2⤵
  PID:2084
- C:\Windows\System\VXijggG.exe
  C:\Windows\System\VXijggG.exe
  2⤵
  PID:3148
- C:\Windows\System\OpSWcfz.exe
  C:\Windows\System\OpSWcfz.exe
  2⤵
  PID:2240
- C:\Windows\System\FGIayQZ.exe
  C:\Windows\System\FGIayQZ.exe
  2⤵
  PID:3076
- C:\Windows\System\blhvWjN.exe
  C:\Windows\System\blhvWjN.exe
  2⤵
  PID:1408
- C:\Windows\System\QPtzrkZ.exe
  C:\Windows\System\QPtzrkZ.exe
  2⤵
  PID:3256
- C:\Windows\System\ImZqUMB.exe
  C:\Windows\System\ImZqUMB.exe
  2⤵
  PID:3272
- C:\Windows\System\RQNVpiZ.exe
  C:\Windows\System\RQNVpiZ.exe
  2⤵
  PID:3308
- C:\Windows\System\dEaaLUE.exe
  C:\Windows\System\dEaaLUE.exe
  2⤵
  PID:3376
- C:\Windows\System\KqCnQES.exe
  C:\Windows\System\KqCnQES.exe
  2⤵
  PID:3416
- C:\Windows\System\GcOznta.exe
  C:\Windows\System\GcOznta.exe
  2⤵
  PID:3484
- C:\Windows\System\EjJqukz.exe
  C:\Windows\System\EjJqukz.exe
  2⤵
  PID:3356
- C:\Windows\System\nnmNlMv.exe
  C:\Windows\System\nnmNlMv.exe
  2⤵
  PID:3528
- C:\Windows\System\oLJFdfv.exe
  C:\Windows\System\oLJFdfv.exe
  2⤵
  PID:3596
- C:\Windows\System\ZTXPTsz.exe
  C:\Windows\System\ZTXPTsz.exe
  2⤵
  PID:3668
- C:\Windows\System\aDCCzCZ.exe
  C:\Windows\System\aDCCzCZ.exe
  2⤵
  PID:3296
- C:\Windows\System\wYgfSoS.exe
  C:\Windows\System\wYgfSoS.exe
  2⤵
  PID:3744
- C:\Windows\System\UtGDHoB.exe
  C:\Windows\System\UtGDHoB.exe
  2⤵
  PID:3396
- C:\Windows\System\wcZyxmL.exe
  C:\Windows\System\wcZyxmL.exe
  2⤵
  PID:3812
- C:\Windows\System\vIuZvrW.exe
  C:\Windows\System\vIuZvrW.exe
  2⤵
  PID:3544
- C:\Windows\System\lwTyzin.exe
  C:\Windows\System\lwTyzin.exe
  2⤵
  PID:3576
- C:\Windows\System\UGTBXav.exe
  C:\Windows\System\UGTBXav.exe
  2⤵
  PID:3884
- C:\Windows\System\JzUxZuy.exe
  C:\Windows\System\JzUxZuy.exe
  2⤵
  PID:3612
- C:\Windows\System\vMbZpoi.exe
  C:\Windows\System\vMbZpoi.exe
  2⤵
  PID:3656
- C:\Windows\System\SbNFbkD.exe
  C:\Windows\System\SbNFbkD.exe
  2⤵
  PID:3692
- C:\Windows\System\GjwLpmF.exe
  C:\Windows\System\GjwLpmF.exe
  2⤵
  PID:3760
- C:\Windows\System\pyRrncJ.exe
  C:\Windows\System\pyRrncJ.exe
  2⤵
  PID:3892
- C:\Windows\System\JHpIluK.exe
  C:\Windows\System\JHpIluK.exe
  2⤵
  PID:3868
- C:\Windows\System\OpOkQjf.exe
  C:\Windows\System\OpOkQjf.exe
  2⤵
  PID:3932
- C:\Windows\System\ITdJEVO.exe
  C:\Windows\System\ITdJEVO.exe
  2⤵
  PID:4004
- C:\Windows\System\vkPcGOY.exe
  C:\Windows\System\vkPcGOY.exe
  2⤵
  PID:4080
- C:\Windows\System\VbQesJt.exe
  C:\Windows\System\VbQesJt.exe
  2⤵
  PID:3128
- C:\Windows\System\aYxKMbh.exe
  C:\Windows\System\aYxKMbh.exe
  2⤵
  PID:3948
- C:\Windows\System\pkqfRGj.exe
  C:\Windows\System\pkqfRGj.exe
  2⤵
  PID:448
- C:\Windows\System\hnuvoIt.exe
  C:\Windows\System\hnuvoIt.exe
  2⤵
  PID:3344
- C:\Windows\System\oPzZJnQ.exe
  C:\Windows\System\oPzZJnQ.exe
  2⤵
  PID:3472
- C:\Windows\System\yAaahQp.exe
  C:\Windows\System\yAaahQp.exe
  2⤵
  PID:3460
- C:\Windows\System\oYIkycg.exe
  C:\Windows\System\oYIkycg.exe
  2⤵
  PID:4060
- C:\Windows\System\quiSPbl.exe
  C:\Windows\System\quiSPbl.exe
  2⤵
  PID:3712
- C:\Windows\System\lQDCFJd.exe
  C:\Windows\System\lQDCFJd.exe
  2⤵
  PID:3572
- C:\Windows\System\lzUVliI.exe
  C:\Windows\System\lzUVliI.exe
  2⤵
  PID:3340
- C:\Windows\System\zbAvdEy.exe
  C:\Windows\System\zbAvdEy.exe
  2⤵
  PID:3704
- C:\Windows\System\joDIOFr.exe
  C:\Windows\System\joDIOFr.exe
  2⤵
  PID:3984
- C:\Windows\System\aGyRCfQ.exe
  C:\Windows\System\aGyRCfQ.exe
  2⤵
  PID:3916
- C:\Windows\System\qJRckmd.exe
  C:\Windows\System\qJRckmd.exe
  2⤵
  PID:3900
- C:\Windows\System\gnkYKmE.exe
  C:\Windows\System\gnkYKmE.exe
  2⤵
  PID:3412
- C:\Windows\System\zDOtCep.exe
  C:\Windows\System\zDOtCep.exe
  2⤵
  PID:3864
- C:\Windows\System\paKcLgZ.exe
  C:\Windows\System\paKcLgZ.exe
  2⤵
  PID:4052
- C:\Windows\System\FyjXZzx.exe
  C:\Windows\System\FyjXZzx.exe
  2⤵
  PID:3468
- C:\Windows\System\qmKzgLe.exe
  C:\Windows\System\qmKzgLe.exe
  2⤵
  PID:3808
- C:\Windows\System\DeVJbka.exe
  C:\Windows\System\DeVJbka.exe
  2⤵
  PID:3324
- C:\Windows\System\XMfGJeM.exe
  C:\Windows\System\XMfGJeM.exe
  2⤵
  PID:3728
- C:\Windows\System\TLOsfAK.exe
  C:\Windows\System\TLOsfAK.exe
  2⤵
  PID:3652
- C:\Windows\System\HwlNjIp.exe
  C:\Windows\System\HwlNjIp.exe
  2⤵
  PID:3776
- C:\Windows\System\EowPYEG.exe
  C:\Windows\System\EowPYEG.exe
  2⤵
  PID:3244
- C:\Windows\System\WzILPrZ.exe
  C:\Windows\System\WzILPrZ.exe
  2⤵
  PID:3228
- C:\Windows\System\ZZmKiWH.exe
  C:\Windows\System\ZZmKiWH.exe
  2⤵
  PID:3096
- C:\Windows\System\fhWddNJ.exe
  C:\Windows\System\fhWddNJ.exe
  2⤵
  PID:4076
- C:\Windows\System\cSliMey.exe
  C:\Windows\System\cSliMey.exe
  2⤵
  PID:2212
- C:\Windows\System\CJoTjrG.exe
  C:\Windows\System\CJoTjrG.exe
  2⤵
  PID:3980
- C:\Windows\System\ShXPods.exe
  C:\Windows\System\ShXPods.exe
  2⤵
  PID:3780
- C:\Windows\System\oHBZvqA.exe
  C:\Windows\System\oHBZvqA.exe
  2⤵
  PID:3836
- C:\Windows\System\SNTasaG.exe
  C:\Windows\System\SNTasaG.exe
  2⤵
  PID:3084
- C:\Windows\System\sXUIiaR.exe
  C:\Windows\System\sXUIiaR.exe
  2⤵
  PID:4000
- C:\Windows\System\FngUwHQ.exe
  C:\Windows\System\FngUwHQ.exe
  2⤵
  PID:3976
- C:\Windows\System\joZWcmY.exe
  C:\Windows\System\joZWcmY.exe
  2⤵
  PID:3444
- C:\Windows\System\FmcpuJm.exe
  C:\Windows\System\FmcpuJm.exe
  2⤵
  PID:3912
- C:\Windows\System\SbQPKAe.exe
  C:\Windows\System\SbQPKAe.exe
  2⤵
  PID:3224
- C:\Windows\System\GJGCoJM.exe
  C:\Windows\System\GJGCoJM.exe
  2⤵
  PID:4036
- C:\Windows\System\okJCWCp.exe
  C:\Windows\System\okJCWCp.exe
  2⤵
  PID:3380
- C:\Windows\System\fmAGahy.exe
  C:\Windows\System\fmAGahy.exe
  2⤵
  PID:3852
- C:\Windows\System\ZyRVhJa.exe
  C:\Windows\System\ZyRVhJa.exe
  2⤵
  PID:2676
- C:\Windows\System\XGByIgz.exe
  C:\Windows\System\XGByIgz.exe
  2⤵
  PID:4020
- C:\Windows\System\kBdBDss.exe
  C:\Windows\System\kBdBDss.exe
  2⤵
  PID:3208
- C:\Windows\System\ZtMbcRc.exe
  C:\Windows\System\ZtMbcRc.exe
  2⤵
  PID:3796
- C:\Windows\System\OEnFBuu.exe
  C:\Windows\System\OEnFBuu.exe
  2⤵
  PID:1432
- C:\Windows\System\igkFmHr.exe
  C:\Windows\System\igkFmHr.exe
  2⤵
  PID:3456
- C:\Windows\System\IZYdPOK.exe
  C:\Windows\System\IZYdPOK.exe
  2⤵
  PID:4112
- C:\Windows\System\NFXQlEZ.exe
  C:\Windows\System\NFXQlEZ.exe
  2⤵
  PID:4128
- C:\Windows\System\sIfaIpX.exe
  C:\Windows\System\sIfaIpX.exe
  2⤵
  PID:4144
- C:\Windows\System\lswylgi.exe
  C:\Windows\System\lswylgi.exe
  2⤵
  PID:4168
- C:\Windows\System\PQqgxiB.exe
  C:\Windows\System\PQqgxiB.exe
  2⤵
  PID:4184
- C:\Windows\System\NGaWqoB.exe
  C:\Windows\System\NGaWqoB.exe
  2⤵
  PID:4200
- C:\Windows\System\mFZJuBj.exe
  C:\Windows\System\mFZJuBj.exe
  2⤵
  PID:4216
- C:\Windows\System\PpFSlMM.exe
  C:\Windows\System\PpFSlMM.exe
  2⤵
  PID:4232
- C:\Windows\System\YTrDilH.exe
  C:\Windows\System\YTrDilH.exe
  2⤵
  PID:4248
- C:\Windows\System\cITiUbM.exe
  C:\Windows\System\cITiUbM.exe
  2⤵
  PID:4264
- C:\Windows\System\fCESSRs.exe
  C:\Windows\System\fCESSRs.exe
  2⤵
  PID:4280
- C:\Windows\System\AilhlqA.exe
  C:\Windows\System\AilhlqA.exe
  2⤵
  PID:4296
- C:\Windows\System\fGYfQOE.exe
  C:\Windows\System\fGYfQOE.exe
  2⤵
  PID:4312
- C:\Windows\System\bKLmQdQ.exe
  C:\Windows\System\bKLmQdQ.exe
  2⤵
  PID:4328
- C:\Windows\System\bNgZhUf.exe
  C:\Windows\System\bNgZhUf.exe
  2⤵
  PID:4344
- C:\Windows\System\wRbhfdY.exe
  C:\Windows\System\wRbhfdY.exe
  2⤵
  PID:4360
- C:\Windows\System\aznmQJF.exe
  C:\Windows\System\aznmQJF.exe
  2⤵
  PID:4380
- C:\Windows\System\HslPFbk.exe
  C:\Windows\System\HslPFbk.exe
  2⤵
  PID:4396
- C:\Windows\System\sxvrOnh.exe
  C:\Windows\System\sxvrOnh.exe
  2⤵
  PID:4412
- C:\Windows\System\jzWwTLT.exe
  C:\Windows\System\jzWwTLT.exe
  2⤵
  PID:4428
- C:\Windows\System\vLXBSiI.exe
  C:\Windows\System\vLXBSiI.exe
  2⤵
  PID:4444
- C:\Windows\System\eVBDGgR.exe
  C:\Windows\System\eVBDGgR.exe
  2⤵
  PID:4460
- C:\Windows\System\hCYAVGA.exe
  C:\Windows\System\hCYAVGA.exe
  2⤵
  PID:4476
- C:\Windows\System\uBjNpvR.exe
  C:\Windows\System\uBjNpvR.exe
  2⤵
  PID:4492
- C:\Windows\System\pBDnGmI.exe
  C:\Windows\System\pBDnGmI.exe
  2⤵
  PID:4508
- C:\Windows\System\WehHYhv.exe
  C:\Windows\System\WehHYhv.exe
  2⤵
  PID:4524
- C:\Windows\System\znswtWf.exe
  C:\Windows\System\znswtWf.exe
  2⤵
  PID:4540
- C:\Windows\System\BSUXJck.exe
  C:\Windows\System\BSUXJck.exe
  2⤵
  PID:4556
- C:\Windows\System\ydDBCxE.exe
  C:\Windows\System\ydDBCxE.exe
  2⤵
  PID:4572
- C:\Windows\System\WsfoVFN.exe
  C:\Windows\System\WsfoVFN.exe
  2⤵
  PID:4588
- C:\Windows\System\FzvRHvI.exe
  C:\Windows\System\FzvRHvI.exe
  2⤵
  PID:4608
- C:\Windows\System\kXsAowk.exe
  C:\Windows\System\kXsAowk.exe
  2⤵
  PID:4624
- C:\Windows\System\rKHujAE.exe
  C:\Windows\System\rKHujAE.exe
  2⤵
  PID:4640
- C:\Windows\System\yngYYaC.exe
  C:\Windows\System\yngYYaC.exe
  2⤵
  PID:4656
- C:\Windows\System\bymwWEn.exe
  C:\Windows\System\bymwWEn.exe
  2⤵
  PID:4672
- C:\Windows\System\KeTpWiC.exe
  C:\Windows\System\KeTpWiC.exe
  2⤵
  PID:4688
- C:\Windows\System\czwjqEZ.exe
  C:\Windows\System\czwjqEZ.exe
  2⤵
  PID:4704
- C:\Windows\System\uYjfMIO.exe
  C:\Windows\System\uYjfMIO.exe
  2⤵
  PID:4720
- C:\Windows\System\lzVqgAA.exe
  C:\Windows\System\lzVqgAA.exe
  2⤵
  PID:4740
- C:\Windows\System\CUbUbvH.exe
  C:\Windows\System\CUbUbvH.exe
  2⤵
  PID:4756
- C:\Windows\System\PLpXXfy.exe
  C:\Windows\System\PLpXXfy.exe
  2⤵
  PID:4776
- C:\Windows\System\ABUsRmU.exe
  C:\Windows\System\ABUsRmU.exe
  2⤵
  PID:4816
- C:\Windows\System\wJSVjrV.exe
  C:\Windows\System\wJSVjrV.exe
  2⤵
  PID:4832
- C:\Windows\System\WcLIDfN.exe
  C:\Windows\System\WcLIDfN.exe
  2⤵
  PID:4856
- C:\Windows\System\WEFFGdR.exe
  C:\Windows\System\WEFFGdR.exe
  2⤵
  PID:4872
- C:\Windows\System\PaGJWfM.exe
  C:\Windows\System\PaGJWfM.exe
  2⤵
  PID:4888
- C:\Windows\System\dwiFYpj.exe
  C:\Windows\System\dwiFYpj.exe
  2⤵
  PID:4904
- C:\Windows\System\bUqnseH.exe
  C:\Windows\System\bUqnseH.exe
  2⤵
  PID:4920
- C:\Windows\System\JoIVajE.exe
  C:\Windows\System\JoIVajE.exe
  2⤵
  PID:4936
- C:\Windows\System\RLLjjFZ.exe
  C:\Windows\System\RLLjjFZ.exe
  2⤵
  PID:4952
- C:\Windows\System\vMeIShS.exe
  C:\Windows\System\vMeIShS.exe
  2⤵
  PID:4976
- C:\Windows\System\iVwtIUh.exe
  C:\Windows\System\iVwtIUh.exe
  2⤵
  PID:4996
- C:\Windows\System\wBgmmNT.exe
  C:\Windows\System\wBgmmNT.exe
  2⤵
  PID:5016
- C:\Windows\System\AwXnLCk.exe
  C:\Windows\System\AwXnLCk.exe
  2⤵
  PID:5032
- C:\Windows\System\FwPZrel.exe
  C:\Windows\System\FwPZrel.exe
  2⤵
  PID:5048
- C:\Windows\System\fKCSXOZ.exe
  C:\Windows\System\fKCSXOZ.exe
  2⤵
  PID:5068
- C:\Windows\System\OoPhoYl.exe
  C:\Windows\System\OoPhoYl.exe
  2⤵
  PID:5088
- C:\Windows\System\oiSHNMI.exe
  C:\Windows\System\oiSHNMI.exe
  2⤵
  PID:5104
- C:\Windows\System\EGGtgMe.exe
  C:\Windows\System\EGGtgMe.exe
  2⤵
  PID:2252
- C:\Windows\System\VfZikQR.exe
  C:\Windows\System\VfZikQR.exe
  2⤵
  PID:4136
- C:\Windows\System\QvowiOj.exe
  C:\Windows\System\QvowiOj.exe
  2⤵
  PID:4104
- C:\Windows\System\qhjzUlK.exe
  C:\Windows\System\qhjzUlK.exe
  2⤵
  PID:4160
- C:\Windows\System\PicioWz.exe
  C:\Windows\System\PicioWz.exe
  2⤵
  PID:4180
- C:\Windows\System\HEpLPhx.exe
  C:\Windows\System\HEpLPhx.exe
  2⤵
  PID:4208
- C:\Windows\System\FqYdnCo.exe
  C:\Windows\System\FqYdnCo.exe
  2⤵
  PID:4224
- C:\Windows\System\HjvpbfM.exe
  C:\Windows\System\HjvpbfM.exe
  2⤵
  PID:4304
- C:\Windows\System\bgSJYRF.exe
  C:\Windows\System\bgSJYRF.exe
  2⤵
  PID:4352
- C:\Windows\System\fPXbPTz.exe
  C:\Windows\System\fPXbPTz.exe
  2⤵
  PID:4388
- C:\Windows\System\QznPfOj.exe
  C:\Windows\System\QznPfOj.exe
  2⤵
  PID:4452
- C:\Windows\System\aOZiBhH.exe
  C:\Windows\System\aOZiBhH.exe
  2⤵
  PID:4404
- C:\Windows\System\cyFPGOb.exe
  C:\Windows\System\cyFPGOb.exe
  2⤵
  PID:4520
- C:\Windows\System\kfivUgm.exe
  C:\Windows\System\kfivUgm.exe
  2⤵
  PID:4548
- C:\Windows\System\sFhpfQM.exe
  C:\Windows\System\sFhpfQM.exe
  2⤵
  PID:4616
- C:\Windows\System\VRXRftP.exe
  C:\Windows\System\VRXRftP.exe
  2⤵
  PID:4652
- C:\Windows\System\XqjVFDy.exe
  C:\Windows\System\XqjVFDy.exe
  2⤵
  PID:4636
- C:\Windows\System\CWaFCck.exe
  C:\Windows\System\CWaFCck.exe
  2⤵
  PID:4716
- C:\Windows\System\XdLbTHu.exe
  C:\Windows\System\XdLbTHu.exe
  2⤵
  PID:4596
- C:\Windows\System\fxuMIGv.exe
  C:\Windows\System\fxuMIGv.exe
  2⤵
  PID:4700
- C:\Windows\System\HMOXNfd.exe
  C:\Windows\System\HMOXNfd.exe
  2⤵
  PID:4752
- C:\Windows\System\QqYrrpq.exe
  C:\Windows\System\QqYrrpq.exe
  2⤵
  PID:4772
- C:\Windows\System\JFLrvFz.exe
  C:\Windows\System\JFLrvFz.exe
  2⤵
  PID:4796
- C:\Windows\System\uMHeceq.exe
  C:\Windows\System\uMHeceq.exe
  2⤵
  PID:4840
- C:\Windows\System\MZQHQey.exe
  C:\Windows\System\MZQHQey.exe
  2⤵
  PID:4880
- C:\Windows\System\AcVYgME.exe
  C:\Windows\System\AcVYgME.exe
  2⤵
  PID:4916
- C:\Windows\System\TOzvMle.exe
  C:\Windows\System\TOzvMle.exe
  2⤵
  PID:4928
- C:\Windows\System\AMhfGPp.exe
  C:\Windows\System\AMhfGPp.exe
  2⤵
  PID:4900
- C:\Windows\System\IYtwyzG.exe
  C:\Windows\System\IYtwyzG.exe
  2⤵
  PID:5024
- C:\Windows\System\hOrRmhP.exe
  C:\Windows\System\hOrRmhP.exe
  2⤵
  PID:4960
- C:\Windows\System\eMAZWov.exe
  C:\Windows\System\eMAZWov.exe
  2⤵
  PID:5096
- C:\Windows\System\NazYmZd.exe
  C:\Windows\System\NazYmZd.exe
  2⤵
  PID:4124
- C:\Windows\System\NUuFfLp.exe
  C:\Windows\System\NUuFfLp.exe
  2⤵
  PID:5044
- C:\Windows\System\yQNYRTI.exe
  C:\Windows\System\yQNYRTI.exe
  2⤵
  PID:4944
- C:\Windows\System\XLGpDwh.exe
  C:\Windows\System\XLGpDwh.exe
  2⤵
  PID:3284
- C:\Windows\System\rDtLWRP.exe
  C:\Windows\System\rDtLWRP.exe
  2⤵
  PID:4156
- C:\Windows\System\jpoGtQa.exe
  C:\Windows\System\jpoGtQa.exe
  2⤵
  PID:4196
- C:\Windows\System\VmOoVxc.exe
  C:\Windows\System\VmOoVxc.exe
  2⤵
  PID:4272
- C:\Windows\System\iccuGWE.exe
  C:\Windows\System\iccuGWE.exe
  2⤵
  PID:4228
- C:\Windows\System\bIyMuHg.exe
  C:\Windows\System\bIyMuHg.exe
  2⤵
  PID:4392
- C:\Windows\System\eFIbDss.exe
  C:\Windows\System\eFIbDss.exe
  2⤵
  PID:4372
- C:\Windows\System\lcoKVaK.exe
  C:\Windows\System\lcoKVaK.exe
  2⤵
  PID:4472
- C:\Windows\System\dICwVXq.exe
  C:\Windows\System\dICwVXq.exe
  2⤵
  PID:4408
- C:\Windows\System\WNXwvkd.exe
  C:\Windows\System\WNXwvkd.exe
  2⤵
  PID:4584
- C:\Windows\System\POCekMG.exe
  C:\Windows\System\POCekMG.exe
  2⤵
  PID:4748
- C:\Windows\System\pCUSgUO.exe
  C:\Windows\System\pCUSgUO.exe
  2⤵
  PID:5112
- C:\Windows\System\oRdgGeu.exe
  C:\Windows\System\oRdgGeu.exe
  2⤵
  PID:4532
- C:\Windows\System\GCXrLBd.exe
  C:\Windows\System\GCXrLBd.exe
  2⤵
  PID:4712
- C:\Windows\System\KGCSaul.exe
  C:\Windows\System\KGCSaul.exe
  2⤵
  PID:4684
- C:\Windows\System\TSmIUPX.exe
  C:\Windows\System\TSmIUPX.exe
  2⤵
  PID:4664
- C:\Windows\System\bfJObwv.exe
  C:\Windows\System\bfJObwv.exe
  2⤵
  PID:4792
- C:\Windows\System\XfAHTUP.exe
  C:\Windows\System\XfAHTUP.exe
  2⤵
  PID:4844
- C:\Windows\System\rqPvCqy.exe
  C:\Windows\System\rqPvCqy.exe
  2⤵
  PID:4848
- C:\Windows\System\KCMLhKs.exe
  C:\Windows\System\KCMLhKs.exe
  2⤵
  PID:4152
- C:\Windows\System\LfUXwVM.exe
  C:\Windows\System\LfUXwVM.exe
  2⤵
  PID:4968
- C:\Windows\System\DJOFHrK.exe
  C:\Windows\System\DJOFHrK.exe
  2⤵
  PID:4324
- C:\Windows\System\HvSAxku.exe
  C:\Windows\System\HvSAxku.exe
  2⤵
  PID:4320
- C:\Windows\System\PNBtnkm.exe
  C:\Windows\System\PNBtnkm.exe
  2⤵
  PID:4580
- C:\Windows\System\beqPcvk.exe
  C:\Windows\System\beqPcvk.exe
  2⤵
  PID:4884
- C:\Windows\System\EAtQfcB.exe
  C:\Windows\System\EAtQfcB.exe
  2⤵
  PID:4988
- C:\Windows\System\zUODMSK.exe
  C:\Windows\System\zUODMSK.exe
  2⤵
  PID:4788
- C:\Windows\System\rDKjeYE.exe
  C:\Windows\System\rDKjeYE.exe
  2⤵
  PID:2364
- C:\Windows\System\bCmyoec.exe
  C:\Windows\System\bCmyoec.exe
  2⤵
  PID:4340
- C:\Windows\System\YysiFhb.exe
  C:\Windows\System\YysiFhb.exe
  2⤵
  PID:5080
- C:\Windows\System\JoRsFHV.exe
  C:\Windows\System\JoRsFHV.exe
  2⤵
  PID:5056
- C:\Windows\System\xibMnIP.exe
  C:\Windows\System\xibMnIP.exe
  2⤵
  PID:5128
- C:\Windows\System\nFGFqWN.exe
  C:\Windows\System\nFGFqWN.exe
  2⤵
  PID:5144
- C:\Windows\System\WzbZDiP.exe
  C:\Windows\System\WzbZDiP.exe
  2⤵
  PID:5160
- C:\Windows\System\KPkHZMJ.exe
  C:\Windows\System\KPkHZMJ.exe
  2⤵
  PID:5176
- C:\Windows\System\ndJqQtx.exe
  C:\Windows\System\ndJqQtx.exe
  2⤵
  PID:5196
- C:\Windows\System\zApvRWW.exe
  C:\Windows\System\zApvRWW.exe
  2⤵
  PID:5216
- C:\Windows\System\gtaUpLN.exe
  C:\Windows\System\gtaUpLN.exe
  2⤵
  PID:5236
- C:\Windows\System\mVWEPRS.exe
  C:\Windows\System\mVWEPRS.exe
  2⤵
  PID:5256
- C:\Windows\System\OgzkDOv.exe
  C:\Windows\System\OgzkDOv.exe
  2⤵
  PID:5276
- C:\Windows\System\pajuOEC.exe
  C:\Windows\System\pajuOEC.exe
  2⤵
  PID:5296
- C:\Windows\System\YoipoTt.exe
  C:\Windows\System\YoipoTt.exe
  2⤵
  PID:5312
- C:\Windows\System\BPrPyxv.exe
  C:\Windows\System\BPrPyxv.exe
  2⤵
  PID:5328
- C:\Windows\System\IVCegDW.exe
  C:\Windows\System\IVCegDW.exe
  2⤵
  PID:5344
- C:\Windows\System\leZFHXQ.exe
  C:\Windows\System\leZFHXQ.exe
  2⤵
  PID:5364
- C:\Windows\System\FiSYzpU.exe
  C:\Windows\System\FiSYzpU.exe
  2⤵
  PID:5420
- C:\Windows\System\TnXnosj.exe
  C:\Windows\System\TnXnosj.exe
  2⤵
  PID:5436
- C:\Windows\System\KgSrtCY.exe
  C:\Windows\System\KgSrtCY.exe
  2⤵
  PID:5452
- C:\Windows\System\SlWlXjI.exe
  C:\Windows\System\SlWlXjI.exe
  2⤵
  PID:5476
- C:\Windows\System\fRXxbMh.exe
  C:\Windows\System\fRXxbMh.exe
  2⤵
  PID:5500
- C:\Windows\System\iPzyxZR.exe
  C:\Windows\System\iPzyxZR.exe
  2⤵
  PID:5520
- C:\Windows\System\WWkrovS.exe
  C:\Windows\System\WWkrovS.exe
  2⤵
  PID:5540
- C:\Windows\System\VBAoYBk.exe
  C:\Windows\System\VBAoYBk.exe
  2⤵
  PID:5556
- C:\Windows\System\jVEbEfZ.exe
  C:\Windows\System\jVEbEfZ.exe
  2⤵
  PID:5572
- C:\Windows\System\YznqEVK.exe
  C:\Windows\System\YznqEVK.exe
  2⤵
  PID:5588
- C:\Windows\System\JgZPIwV.exe
  C:\Windows\System\JgZPIwV.exe
  2⤵
  PID:5604
- C:\Windows\System\qCzjiqp.exe
  C:\Windows\System\qCzjiqp.exe
  2⤵
  PID:5620
- C:\Windows\System\mNrlxHY.exe
  C:\Windows\System\mNrlxHY.exe
  2⤵
  PID:5640
- C:\Windows\System\dvKeXDl.exe
  C:\Windows\System\dvKeXDl.exe
  2⤵
  PID:5660
- C:\Windows\System\muqjEge.exe
  C:\Windows\System\muqjEge.exe
  2⤵
  PID:5680
- C:\Windows\System\FdWzjHK.exe
  C:\Windows\System\FdWzjHK.exe
  2⤵
  PID:5704
- C:\Windows\System\miJXYnm.exe
  C:\Windows\System\miJXYnm.exe
  2⤵
  PID:5720
- C:\Windows\System\ofZNTBS.exe
  C:\Windows\System\ofZNTBS.exe
  2⤵
  PID:5736
- C:\Windows\System\EwohvZc.exe
  C:\Windows\System\EwohvZc.exe
  2⤵
  PID:5756
- C:\Windows\System\QaYXFtf.exe
  C:\Windows\System\QaYXFtf.exe
  2⤵
  PID:5772
- C:\Windows\System\owBNOWw.exe
  C:\Windows\System\owBNOWw.exe
  2⤵
  PID:5788
- C:\Windows\System\caohAbV.exe
  C:\Windows\System\caohAbV.exe
  2⤵
  PID:5804
- C:\Windows\System\oJhWngn.exe
  C:\Windows\System\oJhWngn.exe
  2⤵
  PID:5824
- C:\Windows\System\GwrKwXE.exe
  C:\Windows\System\GwrKwXE.exe
  2⤵
  PID:5844
- C:\Windows\System\TQvxRLU.exe
  C:\Windows\System\TQvxRLU.exe
  2⤵
  PID:5860
- C:\Windows\System\SKrZflJ.exe
  C:\Windows\System\SKrZflJ.exe
  2⤵
  PID:5884
- C:\Windows\System\zAfWSxS.exe
  C:\Windows\System\zAfWSxS.exe
  2⤵
  PID:5904
- C:\Windows\System\sBweUAQ.exe
  C:\Windows\System\sBweUAQ.exe
  2⤵
  PID:5928
- C:\Windows\System\SsFkMLx.exe
  C:\Windows\System\SsFkMLx.exe
  2⤵
  PID:5944
- C:\Windows\System\zxSUQSq.exe
  C:\Windows\System\zxSUQSq.exe
  2⤵
  PID:5972
- C:\Windows\System\BoRtGfz.exe
  C:\Windows\System\BoRtGfz.exe
  2⤵
  PID:5992
- C:\Windows\System\dkIIfFe.exe
  C:\Windows\System\dkIIfFe.exe
  2⤵
  PID:6052
- C:\Windows\System\gwmrlGz.exe
  C:\Windows\System\gwmrlGz.exe
  2⤵
  PID:6068
- C:\Windows\System\NNzWnpw.exe
  C:\Windows\System\NNzWnpw.exe
  2⤵
  PID:6084
- C:\Windows\System\wtOUyjd.exe
  C:\Windows\System\wtOUyjd.exe
  2⤵
  PID:6104
- C:\Windows\System\XPMFqoK.exe
  C:\Windows\System\XPMFqoK.exe
  2⤵
  PID:6120
- C:\Windows\System\PfAIDex.exe
  C:\Windows\System\PfAIDex.exe
  2⤵
  PID:6140
- C:\Windows\System\bRdHFVS.exe
  C:\Windows\System\bRdHFVS.exe
  2⤵
  PID:4504
- C:\Windows\System\YRbdGfn.exe
  C:\Windows\System\YRbdGfn.exe
  2⤵
  PID:5188
- C:\Windows\System\BwOpZfo.exe
  C:\Windows\System\BwOpZfo.exe
  2⤵
  PID:5228
- C:\Windows\System\gsdlHLI.exe
  C:\Windows\System\gsdlHLI.exe
  2⤵
  PID:5272
- C:\Windows\System\oRQriby.exe
  C:\Windows\System\oRQriby.exe
  2⤵
  PID:4192
- C:\Windows\System\loMkEtD.exe
  C:\Windows\System\loMkEtD.exe
  2⤵
  PID:5336
- C:\Windows\System\aUDSiCq.exe
  C:\Windows\System\aUDSiCq.exe
  2⤵
  PID:5384
- C:\Windows\System\xzrEdKC.exe
  C:\Windows\System\xzrEdKC.exe
  2⤵
  PID:4488
- C:\Windows\System\ktFjddI.exe
  C:\Windows\System\ktFjddI.exe
  2⤵
  PID:5204
- C:\Windows\System\WgBROlM.exe
  C:\Windows\System\WgBROlM.exe
  2⤵
  PID:5140
- C:\Windows\System\unrnLlu.exe
  C:\Windows\System\unrnLlu.exe
  2⤵
  PID:5492
- C:\Windows\System\XuSpiAl.exe
  C:\Windows\System\XuSpiAl.exe
  2⤵
  PID:5536
- C:\Windows\System\WlOiRLw.exe
  C:\Windows\System\WlOiRLw.exe
  2⤵
  PID:5600
- C:\Windows\System\ozzqUlw.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes