xmrig | 40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4

Analysis

max time kernel
93s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
Size

1.2MB
MD5

3b1ad597d62f309c1caf08930a079e66
SHA1

d128aeba911f706c1aca263fa1197b29ea68ee25
SHA256

40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4
SHA512

3bfc68ab9c6c25c86ac896019fe93b89b2d6d5ccac3828e1ca66a57ba70ad5ebc3ff369599fc8d8c1c9aa717188fde18205956a66e74f5c6038a3b3a8d8b69a7
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrP5+pNo6aepH8J:GezaTF8FcNkNdfE0pZ9ozttwIRQlXaH0

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023bca-7.dat	xmrig
behavioral2/files/0x0007000000023ca7-6.dat	xmrig
behavioral2/files/0x0008000000023ca3-13.dat	xmrig
behavioral2/files/0x0007000000023ca8-19.dat	xmrig
behavioral2/files/0x0007000000023cab-38.dat	xmrig
behavioral2/files/0x0007000000023cb0-62.dat	xmrig
behavioral2/files/0x0007000000023cb4-77.dat	xmrig
behavioral2/files/0x0007000000023cb6-87.dat	xmrig
behavioral2/files/0x0007000000023cb9-102.dat	xmrig
behavioral2/files/0x0007000000023cc5-162.dat	xmrig
behavioral2/files/0x0007000000023cc3-160.dat	xmrig
behavioral2/files/0x0007000000023cc4-157.dat	xmrig
behavioral2/files/0x0007000000023cc2-155.dat	xmrig
behavioral2/files/0x0007000000023cc1-150.dat	xmrig
behavioral2/files/0x0007000000023cc0-145.dat	xmrig
behavioral2/files/0x0007000000023cbf-140.dat	xmrig
behavioral2/files/0x0007000000023cbe-135.dat	xmrig
behavioral2/files/0x0007000000023cbd-130.dat	xmrig
behavioral2/files/0x0007000000023cbc-125.dat	xmrig
behavioral2/files/0x0007000000023cbb-120.dat	xmrig
behavioral2/files/0x0007000000023cba-115.dat	xmrig
behavioral2/files/0x0007000000023cb8-105.dat	xmrig
behavioral2/files/0x0007000000023cb7-100.dat	xmrig
behavioral2/files/0x0007000000023cb5-90.dat	xmrig
behavioral2/files/0x0007000000023cb3-78.dat	xmrig
behavioral2/files/0x0007000000023cb2-72.dat	xmrig
behavioral2/files/0x0007000000023cb1-68.dat	xmrig
behavioral2/files/0x0007000000023caf-58.dat	xmrig
behavioral2/files/0x0007000000023cae-52.dat	xmrig
behavioral2/files/0x0007000000023cad-48.dat	xmrig
behavioral2/files/0x0007000000023cac-42.dat	xmrig
behavioral2/files/0x0007000000023caa-32.dat	xmrig
behavioral2/files/0x0007000000023ca9-28.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2440	vyfxryB.exe
4212	UkaKeEc.exe
2096	LbhdNpZ.exe
3816	EgsuwnV.exe
3684	jeFtrOt.exe
1112	aPDQzPG.exe
4984	jogqRfm.exe
1032	eRtphgy.exe
2180	UPCcHLO.exe
4932	TzQXFus.exe
2068	osxtuZR.exe
5020	JlRKHke.exe
2652	PfcBqLe.exe
1464	TlPaOug.exe
4644	PIGVmgt.exe
3596	zJNhiVd.exe
2036	ukuNeUC.exe
2956	ZxFcQmK.exe
3016	eQVNNNf.exe
1516	PlrpRSE.exe
2292	UeZhvQW.exe
4516	vyBhdbC.exe
3148	FsWTDol.exe
1304	UWmwbed.exe
2676	miHPLjc.exe
4492	OaMWJFd.exe
4080	cJOkmas.exe
3648	lVBfpnt.exe
4876	FhhDWAF.exe
2748	pbZtlfp.exe
920	OUDPcbn.exe
3320	iybTXcl.exe
1480	rreWepT.exe
3028	LgASiGy.exe
4752	mTAAhLy.exe
1692	fNDPOjt.exe
2256	tNYwRcu.exe
960	fFzrkSH.exe
4112	NjVGACS.exe
4620	ANMOOTX.exe
3340	yyVkfgX.exe
1240	HdWSToT.exe
868	qprySaj.exe
3172	qoJnZll.exe
1984	TIhSDpb.exe
4608	KCqsTcf.exe
1608	BSUywKd.exe
4020	OYJxAZh.exe
464	deoOxsW.exe
2072	kNmWute.exe
1648	eVYrPsm.exe
640	KTfHMYO.exe
4304	ZzpkJVk.exe
1448	mcosKvE.exe
976	ZurOqBe.exe
4888	afMwtKk.exe
5032	ZqTzGeh.exe
4744	MJaAvlQ.exe
828	sLpXhYu.exe
1324	uBaZVyJ.exe
2848	ZnUyXoH.exe
972	PjjiKFq.exe
588	ezwDqGJ.exe
2876	MHBGuHK.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hJtWKkB.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\WwBavGM.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\ndUMfgA.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\jYzPNeT.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\UYnLJXZ.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\MYqVahL.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\jhIroDT.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\eRtphgy.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\FhhDWAF.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\EUCtEKr.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\duBCwXB.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\tvvHkUl.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\VavOEhz.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\MUaKTYp.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\BGOasMh.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\lqKUEhq.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\eQVNNNf.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\ltAfMBn.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\iNxiMCj.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\jihDyPI.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\ZnsbmDi.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\xouJcRi.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\uCEQgHC.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\EYwtyWg.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\SBnYbQP.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\szBpqDG.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\eISIJfA.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\pUsLeNz.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\ODQeYCU.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\mOtrlUZ.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\OCOLyMA.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\fraufLx.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\nkshnsj.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\jogqRfm.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\yPihCDG.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\gmJVSOY.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\TKXGDHl.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\EdBDCux.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\RvaKDJV.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\iBjwQIG.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\uZdMzqO.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\DocjjVS.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\GozwvhM.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\lkhSdnP.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\TTjyZfA.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\RYmPpFR.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\irdhZyE.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\UfIakrH.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\NUCaKXG.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\LUUgexG.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\uBuIVJS.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\LjgeSRA.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\FdFxGEI.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\BvRGyAC.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\thYGgQH.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\DGieIkt.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\CBmRKrD.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\wXjiiPu.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\nVVUuqU.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\bVslInx.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\KSACQlu.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\OyJZUpW.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\rhVXmGK.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
File created	C:\Windows\System\DwGeFVK.exe	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2440	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	84
PID 2624 wrote to memory of 2440	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	84
PID 2624 wrote to memory of 4212	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	85
PID 2624 wrote to memory of 4212	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	85
PID 2624 wrote to memory of 2096	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	86
PID 2624 wrote to memory of 2096	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	86
PID 2624 wrote to memory of 3816	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	87
PID 2624 wrote to memory of 3816	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	87
PID 2624 wrote to memory of 3684	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	88
PID 2624 wrote to memory of 3684	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	88
PID 2624 wrote to memory of 1112	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	89
PID 2624 wrote to memory of 1112	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	89
PID 2624 wrote to memory of 4984	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	90
PID 2624 wrote to memory of 4984	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	90
PID 2624 wrote to memory of 1032	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	91
PID 2624 wrote to memory of 1032	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	91
PID 2624 wrote to memory of 2180	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	92
PID 2624 wrote to memory of 2180	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	92
PID 2624 wrote to memory of 4932	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	93
PID 2624 wrote to memory of 4932	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	93
PID 2624 wrote to memory of 2068	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	94
PID 2624 wrote to memory of 2068	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	94
PID 2624 wrote to memory of 5020	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	95
PID 2624 wrote to memory of 5020	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	95
PID 2624 wrote to memory of 2652	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	96
PID 2624 wrote to memory of 2652	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	96
PID 2624 wrote to memory of 1464	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	97
PID 2624 wrote to memory of 1464	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	97
PID 2624 wrote to memory of 4644	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	98
PID 2624 wrote to memory of 4644	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	98
PID 2624 wrote to memory of 3596	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	99
PID 2624 wrote to memory of 3596	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	99
PID 2624 wrote to memory of 2036	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	100
PID 2624 wrote to memory of 2036	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	100
PID 2624 wrote to memory of 2956	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	101
PID 2624 wrote to memory of 2956	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	101
PID 2624 wrote to memory of 3016	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	102
PID 2624 wrote to memory of 3016	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	102
PID 2624 wrote to memory of 1516	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	103
PID 2624 wrote to memory of 1516	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	103
PID 2624 wrote to memory of 2292	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	104
PID 2624 wrote to memory of 2292	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	104
PID 2624 wrote to memory of 4516	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	105
PID 2624 wrote to memory of 4516	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	105
PID 2624 wrote to memory of 3148	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	106
PID 2624 wrote to memory of 3148	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	106
PID 2624 wrote to memory of 1304	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	107
PID 2624 wrote to memory of 1304	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	107
PID 2624 wrote to memory of 2676	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	108
PID 2624 wrote to memory of 2676	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	108
PID 2624 wrote to memory of 4492	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	109
PID 2624 wrote to memory of 4492	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	109
PID 2624 wrote to memory of 4080	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	110
PID 2624 wrote to memory of 4080	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	110
PID 2624 wrote to memory of 3648	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	111
PID 2624 wrote to memory of 3648	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	111
PID 2624 wrote to memory of 4876	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	112
PID 2624 wrote to memory of 4876	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	112
PID 2624 wrote to memory of 2748	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	113
PID 2624 wrote to memory of 2748	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	113
PID 2624 wrote to memory of 920	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	114
PID 2624 wrote to memory of 920	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	114
PID 2624 wrote to memory of 3320	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	115
PID 2624 wrote to memory of 3320	2624	40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe	115

C:\Users\Admin\AppData\Local\Temp\40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe
"C:\Users\Admin\AppData\Local\Temp\40cdc810d948aa9324556a616c26d394c8d6dbf6c802a41aadbfa483719336b4.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\System\vyfxryB.exe
  C:\Windows\System\vyfxryB.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\UkaKeEc.exe
  C:\Windows\System\UkaKeEc.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\LbhdNpZ.exe
  C:\Windows\System\LbhdNpZ.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\EgsuwnV.exe
  C:\Windows\System\EgsuwnV.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\jeFtrOt.exe
  C:\Windows\System\jeFtrOt.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\aPDQzPG.exe
  C:\Windows\System\aPDQzPG.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\jogqRfm.exe
  C:\Windows\System\jogqRfm.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\eRtphgy.exe
  C:\Windows\System\eRtphgy.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\UPCcHLO.exe
  C:\Windows\System\UPCcHLO.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\TzQXFus.exe
  C:\Windows\System\TzQXFus.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\osxtuZR.exe
  C:\Windows\System\osxtuZR.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\JlRKHke.exe
  C:\Windows\System\JlRKHke.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\PfcBqLe.exe
  C:\Windows\System\PfcBqLe.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\TlPaOug.exe
  C:\Windows\System\TlPaOug.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\PIGVmgt.exe
  C:\Windows\System\PIGVmgt.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\zJNhiVd.exe
  C:\Windows\System\zJNhiVd.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\ukuNeUC.exe
  C:\Windows\System\ukuNeUC.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\ZxFcQmK.exe
  C:\Windows\System\ZxFcQmK.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\eQVNNNf.exe
  C:\Windows\System\eQVNNNf.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\PlrpRSE.exe
  C:\Windows\System\PlrpRSE.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\UeZhvQW.exe
  C:\Windows\System\UeZhvQW.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\vyBhdbC.exe
  C:\Windows\System\vyBhdbC.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\FsWTDol.exe
  C:\Windows\System\FsWTDol.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\UWmwbed.exe
  C:\Windows\System\UWmwbed.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\miHPLjc.exe
  C:\Windows\System\miHPLjc.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\OaMWJFd.exe
  C:\Windows\System\OaMWJFd.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\cJOkmas.exe
  C:\Windows\System\cJOkmas.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\lVBfpnt.exe
  C:\Windows\System\lVBfpnt.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\FhhDWAF.exe
  C:\Windows\System\FhhDWAF.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\pbZtlfp.exe
  C:\Windows\System\pbZtlfp.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\OUDPcbn.exe
  C:\Windows\System\OUDPcbn.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\iybTXcl.exe
  C:\Windows\System\iybTXcl.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\rreWepT.exe
  C:\Windows\System\rreWepT.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\LgASiGy.exe
  C:\Windows\System\LgASiGy.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\mTAAhLy.exe
  C:\Windows\System\mTAAhLy.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\fNDPOjt.exe
  C:\Windows\System\fNDPOjt.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\tNYwRcu.exe
  C:\Windows\System\tNYwRcu.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\fFzrkSH.exe
  C:\Windows\System\fFzrkSH.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\NjVGACS.exe
  C:\Windows\System\NjVGACS.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\ANMOOTX.exe
  C:\Windows\System\ANMOOTX.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\yyVkfgX.exe
  C:\Windows\System\yyVkfgX.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\HdWSToT.exe
  C:\Windows\System\HdWSToT.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\qprySaj.exe
  C:\Windows\System\qprySaj.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\qoJnZll.exe
  C:\Windows\System\qoJnZll.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\TIhSDpb.exe
  C:\Windows\System\TIhSDpb.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\KCqsTcf.exe
  C:\Windows\System\KCqsTcf.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\BSUywKd.exe
  C:\Windows\System\BSUywKd.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\OYJxAZh.exe
  C:\Windows\System\OYJxAZh.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\deoOxsW.exe
  C:\Windows\System\deoOxsW.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\kNmWute.exe
  C:\Windows\System\kNmWute.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\eVYrPsm.exe
  C:\Windows\System\eVYrPsm.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\KTfHMYO.exe
  C:\Windows\System\KTfHMYO.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\ZzpkJVk.exe
  C:\Windows\System\ZzpkJVk.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\mcosKvE.exe
  C:\Windows\System\mcosKvE.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\ZurOqBe.exe
  C:\Windows\System\ZurOqBe.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\afMwtKk.exe
  C:\Windows\System\afMwtKk.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\ZqTzGeh.exe
  C:\Windows\System\ZqTzGeh.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\MJaAvlQ.exe
  C:\Windows\System\MJaAvlQ.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\sLpXhYu.exe
  C:\Windows\System\sLpXhYu.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\uBaZVyJ.exe
  C:\Windows\System\uBaZVyJ.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\ZnUyXoH.exe
  C:\Windows\System\ZnUyXoH.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\PjjiKFq.exe
  C:\Windows\System\PjjiKFq.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\ezwDqGJ.exe
  C:\Windows\System\ezwDqGJ.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\MHBGuHK.exe
  C:\Windows\System\MHBGuHK.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\FjggiDy.exe
  C:\Windows\System\FjggiDy.exe
  2⤵
  PID:936
- C:\Windows\System\TWXTigo.exe
  C:\Windows\System\TWXTigo.exe
  2⤵
  PID:3212
- C:\Windows\System\RFIgvTr.exe
  C:\Windows\System\RFIgvTr.exe
  2⤵
  PID:2428
- C:\Windows\System\AQmFluB.exe
  C:\Windows\System\AQmFluB.exe
  2⤵
  PID:4224
- C:\Windows\System\WNOPmlR.exe
  C:\Windows\System\WNOPmlR.exe
  2⤵
  PID:1656
- C:\Windows\System\GsOmZPl.exe
  C:\Windows\System\GsOmZPl.exe
  2⤵
  PID:2640
- C:\Windows\System\PzYLiSM.exe
  C:\Windows\System\PzYLiSM.exe
  2⤵
  PID:2752
- C:\Windows\System\VajElvn.exe
  C:\Windows\System\VajElvn.exe
  2⤵
  PID:3400
- C:\Windows\System\bUXlFYG.exe
  C:\Windows\System\bUXlFYG.exe
  2⤵
  PID:4220
- C:\Windows\System\QmBYVGz.exe
  C:\Windows\System\QmBYVGz.exe
  2⤵
  PID:4128
- C:\Windows\System\bIODTpJ.exe
  C:\Windows\System\bIODTpJ.exe
  2⤵
  PID:2736
- C:\Windows\System\vrClKUA.exe
  C:\Windows\System\vrClKUA.exe
  2⤵
  PID:636
- C:\Windows\System\DffwHvX.exe
  C:\Windows\System\DffwHvX.exe
  2⤵
  PID:4300
- C:\Windows\System\rewJNKw.exe
  C:\Windows\System\rewJNKw.exe
  2⤵
  PID:1520
- C:\Windows\System\edXCYdr.exe
  C:\Windows\System\edXCYdr.exe
  2⤵
  PID:3184
- C:\Windows\System\SeDDCxS.exe
  C:\Windows\System\SeDDCxS.exe
  2⤵
  PID:2380
- C:\Windows\System\DEyeWZh.exe
  C:\Windows\System\DEyeWZh.exe
  2⤵
  PID:3240
- C:\Windows\System\JSVnRln.exe
  C:\Windows\System\JSVnRln.exe
  2⤵
  PID:5124
- C:\Windows\System\XjVBNxo.exe
  C:\Windows\System\XjVBNxo.exe
  2⤵
  PID:5152
- C:\Windows\System\YqjQtuw.exe
  C:\Windows\System\YqjQtuw.exe
  2⤵
  PID:5184
- C:\Windows\System\wwjFUxR.exe
  C:\Windows\System\wwjFUxR.exe
  2⤵
  PID:5212
- C:\Windows\System\OWPewvC.exe
  C:\Windows\System\OWPewvC.exe
  2⤵
  PID:5236
- C:\Windows\System\BPDDPWC.exe
  C:\Windows\System\BPDDPWC.exe
  2⤵
  PID:5264
- C:\Windows\System\YqStWNy.exe
  C:\Windows\System\YqStWNy.exe
  2⤵
  PID:5292
- C:\Windows\System\hzILMNu.exe
  C:\Windows\System\hzILMNu.exe
  2⤵
  PID:5320
- C:\Windows\System\RJXGabR.exe
  C:\Windows\System\RJXGabR.exe
  2⤵
  PID:5348
- C:\Windows\System\mxeNMjB.exe
  C:\Windows\System\mxeNMjB.exe
  2⤵
  PID:5372
- C:\Windows\System\aTPpDYK.exe
  C:\Windows\System\aTPpDYK.exe
  2⤵
  PID:5404
- C:\Windows\System\vZZsusu.exe
  C:\Windows\System\vZZsusu.exe
  2⤵
  PID:5436
- C:\Windows\System\tQGLzYn.exe
  C:\Windows\System\tQGLzYn.exe
  2⤵
  PID:5460
- C:\Windows\System\QnoGYjI.exe
  C:\Windows\System\QnoGYjI.exe
  2⤵
  PID:5488
- C:\Windows\System\mlazLPh.exe
  C:\Windows\System\mlazLPh.exe
  2⤵
  PID:5520
- C:\Windows\System\VgkXGjV.exe
  C:\Windows\System\VgkXGjV.exe
  2⤵
  PID:5548
- C:\Windows\System\vbfWdIS.exe
  C:\Windows\System\vbfWdIS.exe
  2⤵
  PID:5576
- C:\Windows\System\RxBjALT.exe
  C:\Windows\System\RxBjALT.exe
  2⤵
  PID:5600
- C:\Windows\System\LqytkDG.exe
  C:\Windows\System\LqytkDG.exe
  2⤵
  PID:5628
- C:\Windows\System\AzdHUHn.exe
  C:\Windows\System\AzdHUHn.exe
  2⤵
  PID:5660
- C:\Windows\System\LaKXjzn.exe
  C:\Windows\System\LaKXjzn.exe
  2⤵
  PID:5684
- C:\Windows\System\TEsnYnv.exe
  C:\Windows\System\TEsnYnv.exe
  2⤵
  PID:5712
- C:\Windows\System\MKAwkMn.exe
  C:\Windows\System\MKAwkMn.exe
  2⤵
  PID:5740
- C:\Windows\System\XBQZYsu.exe
  C:\Windows\System\XBQZYsu.exe
  2⤵
  PID:5768
- C:\Windows\System\DmZZTUq.exe
  C:\Windows\System\DmZZTUq.exe
  2⤵
  PID:5800
- C:\Windows\System\gUlkOSM.exe
  C:\Windows\System\gUlkOSM.exe
  2⤵
  PID:5824
- C:\Windows\System\VksWzdH.exe
  C:\Windows\System\VksWzdH.exe
  2⤵
  PID:5856
- C:\Windows\System\AJBzanS.exe
  C:\Windows\System\AJBzanS.exe
  2⤵
  PID:5880
- C:\Windows\System\wpabpXL.exe
  C:\Windows\System\wpabpXL.exe
  2⤵
  PID:5908
- C:\Windows\System\EzfZbQF.exe
  C:\Windows\System\EzfZbQF.exe
  2⤵
  PID:5936
- C:\Windows\System\UPbgFFi.exe
  C:\Windows\System\UPbgFFi.exe
  2⤵
  PID:5964
- C:\Windows\System\mqhizGT.exe
  C:\Windows\System\mqhizGT.exe
  2⤵
  PID:5992
- C:\Windows\System\RvHJMKl.exe
  C:\Windows\System\RvHJMKl.exe
  2⤵
  PID:6020
- C:\Windows\System\YxxXsiC.exe
  C:\Windows\System\YxxXsiC.exe
  2⤵
  PID:6048
- C:\Windows\System\jdnplBE.exe
  C:\Windows\System\jdnplBE.exe
  2⤵
  PID:6076
- C:\Windows\System\AYzVDuT.exe
  C:\Windows\System\AYzVDuT.exe
  2⤵
  PID:6100
- C:\Windows\System\NUCaKXG.exe
  C:\Windows\System\NUCaKXG.exe
  2⤵
  PID:6132
- C:\Windows\System\nyKvBrf.exe
  C:\Windows\System\nyKvBrf.exe
  2⤵
  PID:700
- C:\Windows\System\nPWxzEr.exe
  C:\Windows\System\nPWxzEr.exe
  2⤵
  PID:2888
- C:\Windows\System\iVyDxzf.exe
  C:\Windows\System\iVyDxzf.exe
  2⤵
  PID:1832
- C:\Windows\System\ODQeYCU.exe
  C:\Windows\System\ODQeYCU.exe
  2⤵
  PID:3688
- C:\Windows\System\umxCLFk.exe
  C:\Windows\System\umxCLFk.exe
  2⤵
  PID:900
- C:\Windows\System\ppSveRt.exe
  C:\Windows\System\ppSveRt.exe
  2⤵
  PID:4924
- C:\Windows\System\sMGOaRa.exe
  C:\Windows\System\sMGOaRa.exe
  2⤵
  PID:1708
- C:\Windows\System\pmGlnow.exe
  C:\Windows\System\pmGlnow.exe
  2⤵
  PID:5136
- C:\Windows\System\wWqRibX.exe
  C:\Windows\System\wWqRibX.exe
  2⤵
  PID:5200
- C:\Windows\System\LUUgexG.exe
  C:\Windows\System\LUUgexG.exe
  2⤵
  PID:5256
- C:\Windows\System\fgWUHey.exe
  C:\Windows\System\fgWUHey.exe
  2⤵
  PID:5336
- C:\Windows\System\rWQeHjK.exe
  C:\Windows\System\rWQeHjK.exe
  2⤵
  PID:5392
- C:\Windows\System\BsHPANT.exe
  C:\Windows\System\BsHPANT.exe
  2⤵
  PID:5456
- C:\Windows\System\YFdZYuU.exe
  C:\Windows\System\YFdZYuU.exe
  2⤵
  PID:5508
- C:\Windows\System\omffUzu.exe
  C:\Windows\System\omffUzu.exe
  2⤵
  PID:5584
- C:\Windows\System\OWRFBdG.exe
  C:\Windows\System\OWRFBdG.exe
  2⤵
  PID:5728
- C:\Windows\System\jReoKFm.exe
  C:\Windows\System\jReoKFm.exe
  2⤵
  PID:5756
- C:\Windows\System\WkwZQqJ.exe
  C:\Windows\System\WkwZQqJ.exe
  2⤵
  PID:5788
- C:\Windows\System\qdcfcbA.exe
  C:\Windows\System\qdcfcbA.exe
  2⤵
  PID:5844
- C:\Windows\System\QKAoOOS.exe
  C:\Windows\System\QKAoOOS.exe
  2⤵
  PID:5896
- C:\Windows\System\ldLnYpm.exe
  C:\Windows\System\ldLnYpm.exe
  2⤵
  PID:5952
- C:\Windows\System\IBUMnap.exe
  C:\Windows\System\IBUMnap.exe
  2⤵
  PID:6008
- C:\Windows\System\qeFdMTQ.exe
  C:\Windows\System\qeFdMTQ.exe
  2⤵
  PID:6068
- C:\Windows\System\crSoTXb.exe
  C:\Windows\System\crSoTXb.exe
  2⤵
  PID:6124
- C:\Windows\System\WBeYUvR.exe
  C:\Windows\System\WBeYUvR.exe
  2⤵
  PID:1868
- C:\Windows\System\sQVYzsf.exe
  C:\Windows\System\sQVYzsf.exe
  2⤵
  PID:5064
- C:\Windows\System\gAYIlfb.exe
  C:\Windows\System\gAYIlfb.exe
  2⤵
  PID:4760
- C:\Windows\System\HpTSFsB.exe
  C:\Windows\System\HpTSFsB.exe
  2⤵
  PID:5172
- C:\Windows\System\TAzEQUi.exe
  C:\Windows\System\TAzEQUi.exe
  2⤵
  PID:5360
- C:\Windows\System\SrTIEsz.exe
  C:\Windows\System\SrTIEsz.exe
  2⤵
  PID:5500
- C:\Windows\System\OjwnSPS.exe
  C:\Windows\System\OjwnSPS.exe
  2⤵
  PID:5704
- C:\Windows\System\FyuOCIt.exe
  C:\Windows\System\FyuOCIt.exe
  2⤵
  PID:6168
- C:\Windows\System\NFtoZOC.exe
  C:\Windows\System\NFtoZOC.exe
  2⤵
  PID:6196
- C:\Windows\System\PvhNqcY.exe
  C:\Windows\System\PvhNqcY.exe
  2⤵
  PID:6228
- C:\Windows\System\YoWnGRD.exe
  C:\Windows\System\YoWnGRD.exe
  2⤵
  PID:6260
- C:\Windows\System\fOlCYke.exe
  C:\Windows\System\fOlCYke.exe
  2⤵
  PID:6288
- C:\Windows\System\WXyJGLU.exe
  C:\Windows\System\WXyJGLU.exe
  2⤵
  PID:6308
- C:\Windows\System\rhVXmGK.exe
  C:\Windows\System\rhVXmGK.exe
  2⤵
  PID:6332
- C:\Windows\System\gbNcLsg.exe
  C:\Windows\System\gbNcLsg.exe
  2⤵
  PID:6360
- C:\Windows\System\yJsyrtZ.exe
  C:\Windows\System\yJsyrtZ.exe
  2⤵
  PID:6392
- C:\Windows\System\yzexpRw.exe
  C:\Windows\System\yzexpRw.exe
  2⤵
  PID:6420
- C:\Windows\System\sBxFGZe.exe
  C:\Windows\System\sBxFGZe.exe
  2⤵
  PID:6452
- C:\Windows\System\LJvVVDD.exe
  C:\Windows\System\LJvVVDD.exe
  2⤵
  PID:6476
- C:\Windows\System\xTFJwVS.exe
  C:\Windows\System\xTFJwVS.exe
  2⤵
  PID:6504
- C:\Windows\System\xqacgGa.exe
  C:\Windows\System\xqacgGa.exe
  2⤵
  PID:6536
- C:\Windows\System\MiiTYTH.exe
  C:\Windows\System\MiiTYTH.exe
  2⤵
  PID:6560
- C:\Windows\System\sTBhTFU.exe
  C:\Windows\System\sTBhTFU.exe
  2⤵
  PID:6584
- C:\Windows\System\TjOoPGG.exe
  C:\Windows\System\TjOoPGG.exe
  2⤵
  PID:6612
- C:\Windows\System\xgMlftk.exe
  C:\Windows\System\xgMlftk.exe
  2⤵
  PID:6644
- C:\Windows\System\DZvhtZQ.exe
  C:\Windows\System\DZvhtZQ.exe
  2⤵
  PID:6676
- C:\Windows\System\wkIzKqA.exe
  C:\Windows\System\wkIzKqA.exe
  2⤵
  PID:6704
- C:\Windows\System\thYGgQH.exe
  C:\Windows\System\thYGgQH.exe
  2⤵
  PID:6728
- C:\Windows\System\JwlNLaO.exe
  C:\Windows\System\JwlNLaO.exe
  2⤵
  PID:6756
- C:\Windows\System\cTZGXCI.exe
  C:\Windows\System\cTZGXCI.exe
  2⤵
  PID:6784
- C:\Windows\System\gYhgRNS.exe
  C:\Windows\System\gYhgRNS.exe
  2⤵
  PID:6812
- C:\Windows\System\GXWzCvV.exe
  C:\Windows\System\GXWzCvV.exe
  2⤵
  PID:6840
- C:\Windows\System\nTuFITw.exe
  C:\Windows\System\nTuFITw.exe
  2⤵
  PID:6868
- C:\Windows\System\skIzFkw.exe
  C:\Windows\System\skIzFkw.exe
  2⤵
  PID:6900
- C:\Windows\System\PhvCCle.exe
  C:\Windows\System\PhvCCle.exe
  2⤵
  PID:6928
- C:\Windows\System\YPKyrzW.exe
  C:\Windows\System\YPKyrzW.exe
  2⤵
  PID:6952
- C:\Windows\System\szBpqDG.exe
  C:\Windows\System\szBpqDG.exe
  2⤵
  PID:6984
- C:\Windows\System\BFcjJjE.exe
  C:\Windows\System\BFcjJjE.exe
  2⤵
  PID:7012
- C:\Windows\System\JikYlnk.exe
  C:\Windows\System\JikYlnk.exe
  2⤵
  PID:7040
- C:\Windows\System\EUCtEKr.exe
  C:\Windows\System\EUCtEKr.exe
  2⤵
  PID:7064
- C:\Windows\System\VmvAuei.exe
  C:\Windows\System\VmvAuei.exe
  2⤵
  PID:7096
- C:\Windows\System\XCGwcQA.exe
  C:\Windows\System\XCGwcQA.exe
  2⤵
  PID:7120
- C:\Windows\System\zDTMSlw.exe
  C:\Windows\System\zDTMSlw.exe
  2⤵
  PID:7148
- C:\Windows\System\jiuaiDa.exe
  C:\Windows\System\jiuaiDa.exe
  2⤵
  PID:5780
- C:\Windows\System\RWYitGv.exe
  C:\Windows\System\RWYitGv.exe
  2⤵
  PID:5892
- C:\Windows\System\hQzmEyd.exe
  C:\Windows\System\hQzmEyd.exe
  2⤵
  PID:3836
- C:\Windows\System\GuTJprC.exe
  C:\Windows\System\GuTJprC.exe
  2⤵
  PID:5164
- C:\Windows\System\oAfXKVO.exe
  C:\Windows\System\oAfXKVO.exe
  2⤵
  PID:5424
- C:\Windows\System\yVZvRtZ.exe
  C:\Windows\System\yVZvRtZ.exe
  2⤵
  PID:6180
- C:\Windows\System\AnJwxzI.exe
  C:\Windows\System\AnJwxzI.exe
  2⤵
  PID:6248
- C:\Windows\System\hItILaN.exe
  C:\Windows\System\hItILaN.exe
  2⤵
  PID:716
- C:\Windows\System\OjDFgqF.exe
  C:\Windows\System\OjDFgqF.exe
  2⤵
  PID:1992
- C:\Windows\System\nVVUuqU.exe
  C:\Windows\System\nVVUuqU.exe
  2⤵
  PID:6404
- C:\Windows\System\lkhSdnP.exe
  C:\Windows\System\lkhSdnP.exe
  2⤵
  PID:6472
- C:\Windows\System\IlTbzJJ.exe
  C:\Windows\System\IlTbzJJ.exe
  2⤵
  PID:6496
- C:\Windows\System\WniUbZi.exe
  C:\Windows\System\WniUbZi.exe
  2⤵
  PID:6572
- C:\Windows\System\vrhHkTa.exe
  C:\Windows\System\vrhHkTa.exe
  2⤵
  PID:6604
- C:\Windows\System\CHZVERs.exe
  C:\Windows\System\CHZVERs.exe
  2⤵
  PID:5000
- C:\Windows\System\lVzpmYK.exe
  C:\Windows\System\lVzpmYK.exe
  2⤵
  PID:6696
- C:\Windows\System\dwyeWuD.exe
  C:\Windows\System\dwyeWuD.exe
  2⤵
  PID:6740
- C:\Windows\System\VELBVcQ.exe
  C:\Windows\System\VELBVcQ.exe
  2⤵
  PID:6776
- C:\Windows\System\ZOLoGGa.exe
  C:\Windows\System\ZOLoGGa.exe
  2⤵
  PID:6808
- C:\Windows\System\ThaJFaf.exe
  C:\Windows\System\ThaJFaf.exe
  2⤵
  PID:4336
- C:\Windows\System\sLtMyax.exe
  C:\Windows\System\sLtMyax.exe
  2⤵
  PID:6916
- C:\Windows\System\JprOGXO.exe
  C:\Windows\System\JprOGXO.exe
  2⤵
  PID:5028
- C:\Windows\System\jLtUAXS.exe
  C:\Windows\System\jLtUAXS.exe
  2⤵
  PID:6996
- C:\Windows\System\drSbqPo.exe
  C:\Windows\System\drSbqPo.exe
  2⤵
  PID:1672
- C:\Windows\System\jihDyPI.exe
  C:\Windows\System\jihDyPI.exe
  2⤵
  PID:5112
- C:\Windows\System\UCNewbt.exe
  C:\Windows\System\UCNewbt.exe
  2⤵
  PID:3128
- C:\Windows\System\sYJRdLh.exe
  C:\Windows\System\sYJRdLh.exe
  2⤵
  PID:3940
- C:\Windows\System\udxEIYj.exe
  C:\Windows\System\udxEIYj.exe
  2⤵
  PID:4056
- C:\Windows\System\gmuIFXD.exe
  C:\Windows\System\gmuIFXD.exe
  2⤵
  PID:1704
- C:\Windows\System\dPcpJYV.exe
  C:\Windows\System\dPcpJYV.exe
  2⤵
  PID:1820
- C:\Windows\System\ICUwdDk.exe
  C:\Windows\System\ICUwdDk.exe
  2⤵
  PID:6164
- C:\Windows\System\rAlNaeU.exe
  C:\Windows\System\rAlNaeU.exe
  2⤵
  PID:6320
- C:\Windows\System\zkigacI.exe
  C:\Windows\System\zkigacI.exe
  2⤵
  PID:4564
- C:\Windows\System\BaZvIET.exe
  C:\Windows\System\BaZvIET.exe
  2⤵
  PID:4024
- C:\Windows\System\NHcnsWZ.exe
  C:\Windows\System\NHcnsWZ.exe
  2⤵
  PID:6672
- C:\Windows\System\qiACZbO.exe
  C:\Windows\System\qiACZbO.exe
  2⤵
  PID:6768
- C:\Windows\System\atQddpu.exe
  C:\Windows\System\atQddpu.exe
  2⤵
  PID:6856
- C:\Windows\System\tiiZRsu.exe
  C:\Windows\System\tiiZRsu.exe
  2⤵
  PID:4008
- C:\Windows\System\DPqOaLg.exe
  C:\Windows\System\DPqOaLg.exe
  2⤵
  PID:1828
- C:\Windows\System\VhCUJoA.exe
  C:\Windows\System\VhCUJoA.exe
  2⤵
  PID:3472
- C:\Windows\System\EeTuvmf.exe
  C:\Windows\System\EeTuvmf.exe
  2⤵
  PID:6224
- C:\Windows\System\cnFVAhp.exe
  C:\Windows\System\cnFVAhp.exe
  2⤵
  PID:6468
- C:\Windows\System\QRjyLSf.exe
  C:\Windows\System\QRjyLSf.exe
  2⤵
  PID:3888
- C:\Windows\System\LVcxpLn.exe
  C:\Windows\System\LVcxpLn.exe
  2⤵
  PID:7144
- C:\Windows\System\QcoRKKw.exe
  C:\Windows\System\QcoRKKw.exe
  2⤵
  PID:7112
- C:\Windows\System\vESowms.exe
  C:\Windows\System\vESowms.exe
  2⤵
  PID:1460
- C:\Windows\System\DmdAfWi.exe
  C:\Windows\System\DmdAfWi.exe
  2⤵
  PID:6636
- C:\Windows\System\OyJlLKW.exe
  C:\Windows\System\OyJlLKW.exe
  2⤵
  PID:7180
- C:\Windows\System\WViBJYU.exe
  C:\Windows\System\WViBJYU.exe
  2⤵
  PID:7220
- C:\Windows\System\olxtdlg.exe
  C:\Windows\System\olxtdlg.exe
  2⤵
  PID:7248
- C:\Windows\System\rSqLpAA.exe
  C:\Windows\System\rSqLpAA.exe
  2⤵
  PID:7280
- C:\Windows\System\WFvbkiX.exe
  C:\Windows\System\WFvbkiX.exe
  2⤵
  PID:7324
- C:\Windows\System\ltAfMBn.exe
  C:\Windows\System\ltAfMBn.exe
  2⤵
  PID:7344
- C:\Windows\System\LffFHvv.exe
  C:\Windows\System\LffFHvv.exe
  2⤵
  PID:7368
- C:\Windows\System\vqcbarD.exe
  C:\Windows\System\vqcbarD.exe
  2⤵
  PID:7396
- C:\Windows\System\swmzUBF.exe
  C:\Windows\System\swmzUBF.exe
  2⤵
  PID:7428
- C:\Windows\System\VRyaeIX.exe
  C:\Windows\System\VRyaeIX.exe
  2⤵
  PID:7452
- C:\Windows\System\Hqwasgs.exe
  C:\Windows\System\Hqwasgs.exe
  2⤵
  PID:7484
- C:\Windows\System\uuKrnHg.exe
  C:\Windows\System\uuKrnHg.exe
  2⤵
  PID:7508
- C:\Windows\System\tXcLfkT.exe
  C:\Windows\System\tXcLfkT.exe
  2⤵
  PID:7536
- C:\Windows\System\MkytxKG.exe
  C:\Windows\System\MkytxKG.exe
  2⤵
  PID:7568
- C:\Windows\System\oGsRNGp.exe
  C:\Windows\System\oGsRNGp.exe
  2⤵
  PID:7596
- C:\Windows\System\hhWaadb.exe
  C:\Windows\System\hhWaadb.exe
  2⤵
  PID:7616
- C:\Windows\System\FKMCWNE.exe
  C:\Windows\System\FKMCWNE.exe
  2⤵
  PID:7648
- C:\Windows\System\mrWWUfI.exe
  C:\Windows\System\mrWWUfI.exe
  2⤵
  PID:7688
- C:\Windows\System\yJLqjiz.exe
  C:\Windows\System\yJLqjiz.exe
  2⤵
  PID:7712
- C:\Windows\System\YsRudJA.exe
  C:\Windows\System\YsRudJA.exe
  2⤵
  PID:7756
- C:\Windows\System\VCTbVwc.exe
  C:\Windows\System\VCTbVwc.exe
  2⤵
  PID:7784
- C:\Windows\System\Cuxrnvu.exe
  C:\Windows\System\Cuxrnvu.exe
  2⤵
  PID:7812
- C:\Windows\System\xkxJehh.exe
  C:\Windows\System\xkxJehh.exe
  2⤵
  PID:7840
- C:\Windows\System\DwGeFVK.exe
  C:\Windows\System\DwGeFVK.exe
  2⤵
  PID:7872
- C:\Windows\System\rESBIkv.exe
  C:\Windows\System\rESBIkv.exe
  2⤵
  PID:7892
- C:\Windows\System\DGOupAd.exe
  C:\Windows\System\DGOupAd.exe
  2⤵
  PID:7920
- C:\Windows\System\HQSfsLy.exe
  C:\Windows\System\HQSfsLy.exe
  2⤵
  PID:7944
- C:\Windows\System\eISIJfA.exe
  C:\Windows\System\eISIJfA.exe
  2⤵
  PID:7960
- C:\Windows\System\KiSVirE.exe
  C:\Windows\System\KiSVirE.exe
  2⤵
  PID:7992
- C:\Windows\System\XngIfye.exe
  C:\Windows\System\XngIfye.exe
  2⤵
  PID:8020
- C:\Windows\System\ohwRjuJ.exe
  C:\Windows\System\ohwRjuJ.exe
  2⤵
  PID:8048
- C:\Windows\System\ndUMfgA.exe
  C:\Windows\System\ndUMfgA.exe
  2⤵
  PID:8080
- C:\Windows\System\hqTwCnz.exe
  C:\Windows\System\hqTwCnz.exe
  2⤵
  PID:8100
- C:\Windows\System\ADkjHVJ.exe
  C:\Windows\System\ADkjHVJ.exe
  2⤵
  PID:8116
- C:\Windows\System\fQGaGUX.exe
  C:\Windows\System\fQGaGUX.exe
  2⤵
  PID:8132
- C:\Windows\System\DzjZcTJ.exe
  C:\Windows\System\DzjZcTJ.exe
  2⤵
  PID:8180
- C:\Windows\System\uzuLSdP.exe
  C:\Windows\System\uzuLSdP.exe
  2⤵
  PID:7164
- C:\Windows\System\FDWNIXu.exe
  C:\Windows\System\FDWNIXu.exe
  2⤵
  PID:7232
- C:\Windows\System\FxEsTIW.exe
  C:\Windows\System\FxEsTIW.exe
  2⤵
  PID:7304
- C:\Windows\System\URJuJmR.exe
  C:\Windows\System\URJuJmR.exe
  2⤵
  PID:7392
- C:\Windows\System\OKiSBgg.exe
  C:\Windows\System\OKiSBgg.exe
  2⤵
  PID:7476
- C:\Windows\System\WwBavGM.exe
  C:\Windows\System\WwBavGM.exe
  2⤵
  PID:7500
- C:\Windows\System\wqOCkKB.exe
  C:\Windows\System\wqOCkKB.exe
  2⤵
  PID:7516
- C:\Windows\System\hYnrkrW.exe
  C:\Windows\System\hYnrkrW.exe
  2⤵
  PID:7672
- C:\Windows\System\hUUouMS.exe
  C:\Windows\System\hUUouMS.exe
  2⤵
  PID:7700
- C:\Windows\System\XuLyDog.exe
  C:\Windows\System\XuLyDog.exe
  2⤵
  PID:7752
- C:\Windows\System\xscLrAf.exe
  C:\Windows\System\xscLrAf.exe
  2⤵
  PID:7836
- C:\Windows\System\rPFZplQ.exe
  C:\Windows\System\rPFZplQ.exe
  2⤵
  PID:7912
- C:\Windows\System\XgJfFdA.exe
  C:\Windows\System\XgJfFdA.exe
  2⤵
  PID:7988
- C:\Windows\System\tgGILwH.exe
  C:\Windows\System\tgGILwH.exe
  2⤵
  PID:7984
- C:\Windows\System\ZXXoGQA.exe
  C:\Windows\System\ZXXoGQA.exe
  2⤵
  PID:8044
- C:\Windows\System\KwVzgoA.exe
  C:\Windows\System\KwVzgoA.exe
  2⤵
  PID:8108
- C:\Windows\System\nPdjOmv.exe
  C:\Windows\System\nPdjOmv.exe
  2⤵
  PID:8168
- C:\Windows\System\TcEllya.exe
  C:\Windows\System\TcEllya.exe
  2⤵
  PID:7244
- C:\Windows\System\jNWKbhE.exe
  C:\Windows\System\jNWKbhE.exe
  2⤵
  PID:7404
- C:\Windows\System\BDLuatz.exe
  C:\Windows\System\BDLuatz.exe
  2⤵
  PID:7492
- C:\Windows\System\ndcnsTk.exe
  C:\Windows\System\ndcnsTk.exe
  2⤵
  PID:7612
- C:\Windows\System\WdXSqeO.exe
  C:\Windows\System\WdXSqeO.exe
  2⤵
  PID:7860
- C:\Windows\System\tvvHkUl.exe
  C:\Windows\System\tvvHkUl.exe
  2⤵
  PID:8112
- C:\Windows\System\pQsOnem.exe
  C:\Windows\System\pQsOnem.exe
  2⤵
  PID:7364
- C:\Windows\System\UkHQYxT.exe
  C:\Windows\System\UkHQYxT.exe
  2⤵
  PID:7684
- C:\Windows\System\QAavcER.exe
  C:\Windows\System\QAavcER.exe
  2⤵
  PID:8068
- C:\Windows\System\dLsDnDX.exe
  C:\Windows\System\dLsDnDX.exe
  2⤵
  PID:7528
- C:\Windows\System\ekamRSs.exe
  C:\Windows\System\ekamRSs.exe
  2⤵
  PID:8224
- C:\Windows\System\bcwdyDv.exe
  C:\Windows\System\bcwdyDv.exe
  2⤵
  PID:8240
- C:\Windows\System\QsvQVzu.exe
  C:\Windows\System\QsvQVzu.exe
  2⤵
  PID:8264
- C:\Windows\System\hBsQacU.exe
  C:\Windows\System\hBsQacU.exe
  2⤵
  PID:8292
- C:\Windows\System\HdxweUD.exe
  C:\Windows\System\HdxweUD.exe
  2⤵
  PID:8320
- C:\Windows\System\KfdhDDS.exe
  C:\Windows\System\KfdhDDS.exe
  2⤵
  PID:8340
- C:\Windows\System\zzTUpRU.exe
  C:\Windows\System\zzTUpRU.exe
  2⤵
  PID:8356
- C:\Windows\System\HXFHtKA.exe
  C:\Windows\System\HXFHtKA.exe
  2⤵
  PID:8384
- C:\Windows\System\fqonXBI.exe
  C:\Windows\System\fqonXBI.exe
  2⤵
  PID:8416
- C:\Windows\System\pDqYkkm.exe
  C:\Windows\System\pDqYkkm.exe
  2⤵
  PID:8432
- C:\Windows\System\FUwJRgq.exe
  C:\Windows\System\FUwJRgq.exe
  2⤵
  PID:8464
- C:\Windows\System\rjOZqZH.exe
  C:\Windows\System\rjOZqZH.exe
  2⤵
  PID:8512
- C:\Windows\System\AexiLwH.exe
  C:\Windows\System\AexiLwH.exe
  2⤵
  PID:8532
- C:\Windows\System\TgLjlUa.exe
  C:\Windows\System\TgLjlUa.exe
  2⤵
  PID:8564
- C:\Windows\System\vfwRLTN.exe
  C:\Windows\System\vfwRLTN.exe
  2⤵
  PID:8584
- C:\Windows\System\SBnYbQP.exe
  C:\Windows\System\SBnYbQP.exe
  2⤵
  PID:8632
- C:\Windows\System\tzZCEtG.exe
  C:\Windows\System\tzZCEtG.exe
  2⤵
  PID:8660
- C:\Windows\System\mkrYPfo.exe
  C:\Windows\System\mkrYPfo.exe
  2⤵
  PID:8676
- C:\Windows\System\nmWgNvA.exe
  C:\Windows\System\nmWgNvA.exe
  2⤵
  PID:8700
- C:\Windows\System\eAUoVaI.exe
  C:\Windows\System\eAUoVaI.exe
  2⤵
  PID:8728
- C:\Windows\System\AiACMqq.exe
  C:\Windows\System\AiACMqq.exe
  2⤵
  PID:8784
- C:\Windows\System\PQeUoYy.exe
  C:\Windows\System\PQeUoYy.exe
  2⤵
  PID:8800
- C:\Windows\System\ZnsbmDi.exe
  C:\Windows\System\ZnsbmDi.exe
  2⤵
  PID:8840
- C:\Windows\System\QXGINzk.exe
  C:\Windows\System\QXGINzk.exe
  2⤵
  PID:8864
- C:\Windows\System\QfbrNyW.exe
  C:\Windows\System\QfbrNyW.exe
  2⤵
  PID:8884
- C:\Windows\System\dsTjwEl.exe
  C:\Windows\System\dsTjwEl.exe
  2⤵
  PID:8924
- C:\Windows\System\WfsJCbi.exe
  C:\Windows\System\WfsJCbi.exe
  2⤵
  PID:8956
- C:\Windows\System\dAuhGTJ.exe
  C:\Windows\System\dAuhGTJ.exe
  2⤵
  PID:8976
- C:\Windows\System\qzlqaId.exe
  C:\Windows\System\qzlqaId.exe
  2⤵
  PID:9000
- C:\Windows\System\SQUBVMF.exe
  C:\Windows\System\SQUBVMF.exe
  2⤵
  PID:9024
- C:\Windows\System\LvTUhxx.exe
  C:\Windows\System\LvTUhxx.exe
  2⤵
  PID:9048
- C:\Windows\System\UONtdik.exe
  C:\Windows\System\UONtdik.exe
  2⤵
  PID:9088
- C:\Windows\System\rEbVTGy.exe
  C:\Windows\System\rEbVTGy.exe
  2⤵
  PID:9112
- C:\Windows\System\spkvcLA.exe
  C:\Windows\System\spkvcLA.exe
  2⤵
  PID:9136
- C:\Windows\System\SIwzoMc.exe
  C:\Windows\System\SIwzoMc.exe
  2⤵
  PID:9164
- C:\Windows\System\HylGfCw.exe
  C:\Windows\System\HylGfCw.exe
  2⤵
  PID:9188
- C:\Windows\System\woZyPyw.exe
  C:\Windows\System\woZyPyw.exe
  2⤵
  PID:7952
- C:\Windows\System\nSNszDg.exe
  C:\Windows\System\nSNszDg.exe
  2⤵
  PID:8204
- C:\Windows\System\VavOEhz.exe
  C:\Windows\System\VavOEhz.exe
  2⤵
  PID:8312
- C:\Windows\System\IMmUhTZ.exe
  C:\Windows\System\IMmUhTZ.exe
  2⤵
  PID:8380
- C:\Windows\System\wEEHWoO.exe
  C:\Windows\System\wEEHWoO.exe
  2⤵
  PID:8428
- C:\Windows\System\YETymvr.exe
  C:\Windows\System\YETymvr.exe
  2⤵
  PID:8456
- C:\Windows\System\ekhAAkK.exe
  C:\Windows\System\ekhAAkK.exe
  2⤵
  PID:8524
- C:\Windows\System\xouJcRi.exe
  C:\Windows\System\xouJcRi.exe
  2⤵
  PID:8548
- C:\Windows\System\TQvVxiP.exe
  C:\Windows\System\TQvVxiP.exe
  2⤵
  PID:8720
- C:\Windows\System\agjWgdG.exe
  C:\Windows\System\agjWgdG.exe
  2⤵
  PID:8772
- C:\Windows\System\XtdgvrB.exe
  C:\Windows\System\XtdgvrB.exe
  2⤵
  PID:8816
- C:\Windows\System\yZZuglE.exe
  C:\Windows\System\yZZuglE.exe
  2⤵
  PID:8860
- C:\Windows\System\QVeddPa.exe
  C:\Windows\System\QVeddPa.exe
  2⤵
  PID:8940
- C:\Windows\System\mMOBKun.exe
  C:\Windows\System\mMOBKun.exe
  2⤵
  PID:9020
- C:\Windows\System\xFSHBAH.exe
  C:\Windows\System\xFSHBAH.exe
  2⤵
  PID:9060
- C:\Windows\System\ApILUTJ.exe
  C:\Windows\System\ApILUTJ.exe
  2⤵
  PID:9108
- C:\Windows\System\oArnmPt.exe
  C:\Windows\System\oArnmPt.exe
  2⤵
  PID:9196
- C:\Windows\System\tGuXLoI.exe
  C:\Windows\System\tGuXLoI.exe
  2⤵
  PID:8232
- C:\Windows\System\ojmVjJB.exe
  C:\Windows\System\ojmVjJB.exe
  2⤵
  PID:8284
- C:\Windows\System\qLswfnx.exe
  C:\Windows\System\qLswfnx.exe
  2⤵
  PID:8404
- C:\Windows\System\ZYitGOX.exe
  C:\Windows\System\ZYitGOX.exe
  2⤵
  PID:8500
- C:\Windows\System\xcmbAYj.exe
  C:\Windows\System\xcmbAYj.exe
  2⤵
  PID:8752
- C:\Windows\System\yHHddSB.exe
  C:\Windows\System\yHHddSB.exe
  2⤵
  PID:8824
- C:\Windows\System\ZLVNAub.exe
  C:\Windows\System\ZLVNAub.exe
  2⤵
  PID:9096
- C:\Windows\System\CvEqekY.exe
  C:\Windows\System\CvEqekY.exe
  2⤵
  PID:8580
- C:\Windows\System\rJQugak.exe
  C:\Windows\System\rJQugak.exe
  2⤵
  PID:8452
- C:\Windows\System\MUaKTYp.exe
  C:\Windows\System\MUaKTYp.exe
  2⤵
  PID:9156
- C:\Windows\System\gGQvEnd.exe
  C:\Windows\System\gGQvEnd.exe
  2⤵
  PID:9224
- C:\Windows\System\mgnDbCh.exe
  C:\Windows\System\mgnDbCh.exe
  2⤵
  PID:9260
- C:\Windows\System\NCnEcCm.exe
  C:\Windows\System\NCnEcCm.exe
  2⤵
  PID:9296
- C:\Windows\System\RPHkKRi.exe
  C:\Windows\System\RPHkKRi.exe
  2⤵
  PID:9324
- C:\Windows\System\AyFJDWR.exe
  C:\Windows\System\AyFJDWR.exe
  2⤵
  PID:9344
- C:\Windows\System\vgZNkSF.exe
  C:\Windows\System\vgZNkSF.exe
  2⤵
  PID:9368
- C:\Windows\System\cjClGXZ.exe
  C:\Windows\System\cjClGXZ.exe
  2⤵
  PID:9408
- C:\Windows\System\SIjWoCf.exe
  C:\Windows\System\SIjWoCf.exe
  2⤵
  PID:9436
- C:\Windows\System\mGgsUOJ.exe
  C:\Windows\System\mGgsUOJ.exe
  2⤵
  PID:9452
- C:\Windows\System\aQqhozZ.exe
  C:\Windows\System\aQqhozZ.exe
  2⤵
  PID:9492
- C:\Windows\System\eiQOfrT.exe
  C:\Windows\System\eiQOfrT.exe
  2⤵
  PID:9508
- C:\Windows\System\mxBLpAe.exe
  C:\Windows\System\mxBLpAe.exe
  2⤵
  PID:9548
- C:\Windows\System\qlYEsBH.exe
  C:\Windows\System\qlYEsBH.exe
  2⤵
  PID:9564
- C:\Windows\System\mOtrlUZ.exe
  C:\Windows\System\mOtrlUZ.exe
  2⤵
  PID:9596
- C:\Windows\System\KIJbvBa.exe
  C:\Windows\System\KIJbvBa.exe
  2⤵
  PID:9620
- C:\Windows\System\nOvCYav.exe
  C:\Windows\System\nOvCYav.exe
  2⤵
  PID:9660
- C:\Windows\System\cwPrWAE.exe
  C:\Windows\System\cwPrWAE.exe
  2⤵
  PID:9688
- C:\Windows\System\TKTqBZi.exe
  C:\Windows\System\TKTqBZi.exe
  2⤵
  PID:9708
- C:\Windows\System\olLznyO.exe
  C:\Windows\System\olLznyO.exe
  2⤵
  PID:9728
- C:\Windows\System\iutMzzJ.exe
  C:\Windows\System\iutMzzJ.exe
  2⤵
  PID:9748
- C:\Windows\System\shhtnRT.exe
  C:\Windows\System\shhtnRT.exe
  2⤵
  PID:9772
- C:\Windows\System\HZovlEP.exe
  C:\Windows\System\HZovlEP.exe
  2⤵
  PID:9800
- C:\Windows\System\efFDbNO.exe
  C:\Windows\System\efFDbNO.exe
  2⤵
  PID:9840
- C:\Windows\System\ssFQsgU.exe
  C:\Windows\System\ssFQsgU.exe
  2⤵
  PID:9876
- C:\Windows\System\vNwoeur.exe
  C:\Windows\System\vNwoeur.exe
  2⤵
  PID:9900
- C:\Windows\System\LLebKnn.exe
  C:\Windows\System\LLebKnn.exe
  2⤵
  PID:9916
- C:\Windows\System\kjSNRFV.exe
  C:\Windows\System\kjSNRFV.exe
  2⤵
  PID:9940
- C:\Windows\System\DNyTTQU.exe
  C:\Windows\System\DNyTTQU.exe
  2⤵
  PID:9984
- C:\Windows\System\duBCwXB.exe
  C:\Windows\System\duBCwXB.exe
  2⤵
  PID:10012
- C:\Windows\System\XxMkeWE.exe
  C:\Windows\System\XxMkeWE.exe
  2⤵
  PID:10032
- C:\Windows\System\woxMMNG.exe
  C:\Windows\System\woxMMNG.exe
  2⤵
  PID:10056
- C:\Windows\System\UzDBtCW.exe
  C:\Windows\System\UzDBtCW.exe
  2⤵
  PID:10084
- C:\Windows\System\JnLppJW.exe
  C:\Windows\System\JnLppJW.exe
  2⤵
  PID:10108
- C:\Windows\System\YIZpjDo.exe
  C:\Windows\System\YIZpjDo.exe
  2⤵
  PID:10164
- C:\Windows\System\YJOgxxb.exe
  C:\Windows\System\YJOgxxb.exe
  2⤵
  PID:10192
- C:\Windows\System\dCENZbk.exe
  C:\Windows\System\dCENZbk.exe
  2⤵
  PID:10208
- C:\Windows\System\paegdtB.exe
  C:\Windows\System\paegdtB.exe
  2⤵
  PID:8644
- C:\Windows\System\GoHQJzq.exe
  C:\Windows\System\GoHQJzq.exe
  2⤵
  PID:9240
- C:\Windows\System\GjTQtJe.exe
  C:\Windows\System\GjTQtJe.exe
  2⤵
  PID:9316
- C:\Windows\System\uBuIVJS.exe
  C:\Windows\System\uBuIVJS.exe
  2⤵
  PID:9392
- C:\Windows\System\cXSMOUA.exe
  C:\Windows\System\cXSMOUA.exe
  2⤵
  PID:9428
- C:\Windows\System\Rcqqziw.exe
  C:\Windows\System\Rcqqziw.exe
  2⤵
  PID:9476
- C:\Windows\System\BvRGyAC.exe
  C:\Windows\System\BvRGyAC.exe
  2⤵
  PID:9536
- C:\Windows\System\NaEtSFs.exe
  C:\Windows\System\NaEtSFs.exe
  2⤵
  PID:9580
- C:\Windows\System\RPpiIfl.exe
  C:\Windows\System\RPpiIfl.exe
  2⤵
  PID:9648
- C:\Windows\System\NjkkUiW.exe
  C:\Windows\System\NjkkUiW.exe
  2⤵
  PID:9768
- C:\Windows\System\AmRrywj.exe
  C:\Windows\System\AmRrywj.exe
  2⤵
  PID:9816
- C:\Windows\System\yTpfkeJ.exe
  C:\Windows\System\yTpfkeJ.exe
  2⤵
  PID:9892
- C:\Windows\System\CmYtuHh.exe
  C:\Windows\System\CmYtuHh.exe
  2⤵
  PID:9960
- C:\Windows\System\nNBshpx.exe
  C:\Windows\System\nNBshpx.exe
  2⤵
  PID:9936
- C:\Windows\System\GrBxIUZ.exe
  C:\Windows\System\GrBxIUZ.exe
  2⤵
  PID:10040
- C:\Windows\System\LswdXXk.exe
  C:\Windows\System\LswdXXk.exe
  2⤵
  PID:10156
- C:\Windows\System\JlkFTLs.exe
  C:\Windows\System\JlkFTLs.exe
  2⤵
  PID:10176
- C:\Windows\System\WgRIyIu.exe
  C:\Windows\System\WgRIyIu.exe
  2⤵
  PID:10232
- C:\Windows\System\GWSWhyC.exe
  C:\Windows\System\GWSWhyC.exe
  2⤵
  PID:9340
- C:\Windows\System\ZOZCgtv.exe
  C:\Windows\System\ZOZCgtv.exe
  2⤵
  PID:9488
- C:\Windows\System\ddHixPd.exe
  C:\Windows\System\ddHixPd.exe
  2⤵
  PID:9696
- C:\Windows\System\ozxmTuM.exe
  C:\Windows\System\ozxmTuM.exe
  2⤵
  PID:9832
- C:\Windows\System\gLtAnCh.exe
  C:\Windows\System\gLtAnCh.exe
  2⤵
  PID:9856
- C:\Windows\System\NlFPUqa.exe
  C:\Windows\System\NlFPUqa.exe
  2⤵
  PID:9932
- C:\Windows\System\CSWJcgG.exe
  C:\Windows\System\CSWJcgG.exe
  2⤵
  PID:10188
- C:\Windows\System\TaUrKDC.exe
  C:\Windows\System\TaUrKDC.exe
  2⤵
  PID:9424
- C:\Windows\System\lMFTrfW.exe
  C:\Windows\System\lMFTrfW.exe
  2⤵
  PID:9616
- C:\Windows\System\RQTRoJM.exe
  C:\Windows\System\RQTRoJM.exe
  2⤵
  PID:10124
- C:\Windows\System\XFsHHMe.exe
  C:\Windows\System\XFsHHMe.exe
  2⤵
  PID:10248
- C:\Windows\System\lJieRlO.exe
  C:\Windows\System\lJieRlO.exe
  2⤵
  PID:10268
- C:\Windows\System\CDYZnrV.exe
  C:\Windows\System\CDYZnrV.exe
  2⤵
  PID:10288
- C:\Windows\System\kdzcbUm.exe
  C:\Windows\System\kdzcbUm.exe
  2⤵
  PID:10312
- C:\Windows\System\WYqMVFH.exe
  C:\Windows\System\WYqMVFH.exe
  2⤵
  PID:10332
- C:\Windows\System\SSCMFlD.exe
  C:\Windows\System\SSCMFlD.exe
  2⤵
  PID:10400
- C:\Windows\System\NpdoCHO.exe
  C:\Windows\System\NpdoCHO.exe
  2⤵
  PID:10420
- C:\Windows\System\tZkkRFT.exe
  C:\Windows\System\tZkkRFT.exe
  2⤵
  PID:10436
- C:\Windows\System\SxAuCLB.exe
  C:\Windows\System\SxAuCLB.exe
  2⤵
  PID:10468
- C:\Windows\System\LjgeSRA.exe
  C:\Windows\System\LjgeSRA.exe
  2⤵
  PID:10484
- C:\Windows\System\ozvtXtj.exe
  C:\Windows\System\ozvtXtj.exe
  2⤵
  PID:10500
- C:\Windows\System\mDeHUEj.exe
  C:\Windows\System\mDeHUEj.exe
  2⤵
  PID:10536
- C:\Windows\System\btAsmVc.exe
  C:\Windows\System\btAsmVc.exe
  2⤵
  PID:10584
- C:\Windows\System\oFDUdgq.exe
  C:\Windows\System\oFDUdgq.exe
  2⤵
  PID:10616
- C:\Windows\System\MhbBBQc.exe
  C:\Windows\System\MhbBBQc.exe
  2⤵
  PID:10644
- C:\Windows\System\CdnsDTF.exe
  C:\Windows\System\CdnsDTF.exe
  2⤵
  PID:10664
- C:\Windows\System\bnwaIuM.exe
  C:\Windows\System\bnwaIuM.exe
  2⤵
  PID:10692
- C:\Windows\System\DLwDIUM.exe
  C:\Windows\System\DLwDIUM.exe
  2⤵
  PID:10712
- C:\Windows\System\FGgSZXI.exe
  C:\Windows\System\FGgSZXI.exe
  2⤵
  PID:10744
- C:\Windows\System\jYzPNeT.exe
  C:\Windows\System\jYzPNeT.exe
  2⤵
  PID:10764
- C:\Windows\System\QApwGgC.exe
  C:\Windows\System\QApwGgC.exe
  2⤵
  PID:10784
- C:\Windows\System\PbOEpYD.exe
  C:\Windows\System\PbOEpYD.exe
  2⤵
  PID:10852
- C:\Windows\System\sIvkzkr.exe
  C:\Windows\System\sIvkzkr.exe
  2⤵
  PID:10876
- C:\Windows\System\eNOBPEm.exe
  C:\Windows\System\eNOBPEm.exe
  2⤵
  PID:10912
- C:\Windows\System\FHnlJbs.exe
  C:\Windows\System\FHnlJbs.exe
  2⤵
  PID:10928
- C:\Windows\System\UFQpqAk.exe
  C:\Windows\System\UFQpqAk.exe
  2⤵
  PID:10944
- C:\Windows\System\WiKMRYx.exe
  C:\Windows\System\WiKMRYx.exe
  2⤵
  PID:11008
- C:\Windows\System\WxykNuf.exe
  C:\Windows\System\WxykNuf.exe
  2⤵
  PID:11024
- C:\Windows\System\zpYZGLK.exe
  C:\Windows\System\zpYZGLK.exe
  2⤵
  PID:11044
- C:\Windows\System\oMJbIbf.exe
  C:\Windows\System\oMJbIbf.exe
  2⤵
  PID:11076
- C:\Windows\System\xdtejyt.exe
  C:\Windows\System\xdtejyt.exe
  2⤵
  PID:11096
- C:\Windows\System\gHYvoAL.exe
  C:\Windows\System\gHYvoAL.exe
  2⤵
  PID:11116
- C:\Windows\System\tPLGcVK.exe
  C:\Windows\System\tPLGcVK.exe
  2⤵
  PID:11136
- C:\Windows\System\gWynzcQ.exe
  C:\Windows\System\gWynzcQ.exe
  2⤵
  PID:11152
- C:\Windows\System\YwNcTcB.exe
  C:\Windows\System\YwNcTcB.exe
  2⤵
  PID:11168
- C:\Windows\System\zjbqWBd.exe
  C:\Windows\System\zjbqWBd.exe
  2⤵
  PID:11188
- C:\Windows\System\SgeZeWI.exe
  C:\Windows\System\SgeZeWI.exe
  2⤵
  PID:11248
- C:\Windows\System\UcbvJlX.exe
  C:\Windows\System\UcbvJlX.exe
  2⤵
  PID:9432
- C:\Windows\System\ERMKyLx.exe
  C:\Windows\System\ERMKyLx.exe
  2⤵
  PID:10264
- C:\Windows\System\PQRmFHV.exe
  C:\Windows\System\PQRmFHV.exe
  2⤵
  PID:10328
- C:\Windows\System\AauEcnN.exe
  C:\Windows\System\AauEcnN.exe
  2⤵
  PID:10496
- C:\Windows\System\tijsYvk.exe
  C:\Windows\System\tijsYvk.exe
  2⤵
  PID:10480
- C:\Windows\System\zUEvXqH.exe
  C:\Windows\System\zUEvXqH.exe
  2⤵
  PID:10568
- C:\Windows\System\eNSMHno.exe
  C:\Windows\System\eNSMHno.exe
  2⤵
  PID:10576
- C:\Windows\System\rIveNgg.exe
  C:\Windows\System\rIveNgg.exe
  2⤵
  PID:10724
- C:\Windows\System\vTKTJrp.exe
  C:\Windows\System\vTKTJrp.exe
  2⤵
  PID:10700
- C:\Windows\System\BGOasMh.exe
  C:\Windows\System\BGOasMh.exe
  2⤵
  PID:10772
- C:\Windows\System\qeRzkQz.exe
  C:\Windows\System\qeRzkQz.exe
  2⤵
  PID:10900
- C:\Windows\System\jWrlfAw.exe
  C:\Windows\System\jWrlfAw.exe
  2⤵
  PID:10984
- C:\Windows\System\QjwNhmp.exe
  C:\Windows\System\QjwNhmp.exe
  2⤵
  PID:11088
- C:\Windows\System\mqkgJoK.exe
  C:\Windows\System\mqkgJoK.exe
  2⤵
  PID:11112
- C:\Windows\System\PZueKWT.exe
  C:\Windows\System\PZueKWT.exe
  2⤵
  PID:11180
- C:\Windows\System\wXjeBFc.exe
  C:\Windows\System\wXjeBFc.exe
  2⤵
  PID:11240
- C:\Windows\System\EshutXK.exe
  C:\Windows\System\EshutXK.exe
  2⤵
  PID:10244
- C:\Windows\System\hbeLykh.exe
  C:\Windows\System\hbeLykh.exe
  2⤵
  PID:10396
- C:\Windows\System\KRhgarZ.exe
  C:\Windows\System\KRhgarZ.exe
  2⤵
  PID:10704
- C:\Windows\System\EmqhlJA.exe
  C:\Windows\System\EmqhlJA.exe
  2⤵
  PID:10832
- C:\Windows\System\YcfSDLT.exe
  C:\Windows\System\YcfSDLT.exe
  2⤵
  PID:10872
- C:\Windows\System\OyJZUpW.exe
  C:\Windows\System\OyJZUpW.exe
  2⤵
  PID:11128
- C:\Windows\System\ByvLstQ.exe
  C:\Windows\System\ByvLstQ.exe
  2⤵
  PID:10308
- C:\Windows\System\lqKUEhq.exe
  C:\Windows\System\lqKUEhq.exe
  2⤵
  PID:10640
- C:\Windows\System\cAZRFoS.exe
  C:\Windows\System\cAZRFoS.exe
  2⤵
  PID:11020
- C:\Windows\System\IcVGuvm.exe
  C:\Windows\System\IcVGuvm.exe
  2⤵
  PID:11208
- C:\Windows\System\CLstwon.exe
  C:\Windows\System\CLstwon.exe
  2⤵
  PID:10676
- C:\Windows\System\ZvGEkTj.exe
  C:\Windows\System\ZvGEkTj.exe
  2⤵
  PID:11276
- C:\Windows\System\iUFQDoQ.exe
  C:\Windows\System\iUFQDoQ.exe
  2⤵
  PID:11296
- C:\Windows\System\QAOGsxD.exe
  C:\Windows\System\QAOGsxD.exe
  2⤵
  PID:11328
- C:\Windows\System\osxmBOg.exe
  C:\Windows\System\osxmBOg.exe
  2⤵
  PID:11372
- C:\Windows\System\BMejGSL.exe
  C:\Windows\System\BMejGSL.exe
  2⤵
  PID:11400
- C:\Windows\System\ykNWcer.exe
  C:\Windows\System\ykNWcer.exe
  2⤵
  PID:11428
- C:\Windows\System\nUgSZez.exe
  C:\Windows\System\nUgSZez.exe
  2⤵
  PID:11448
- C:\Windows\System\sJazQVd.exe
  C:\Windows\System\sJazQVd.exe
  2⤵
  PID:11464
- C:\Windows\System\irdhZyE.exe
  C:\Windows\System\irdhZyE.exe
  2⤵
  PID:11516
- C:\Windows\System\hAtRHak.exe
  C:\Windows\System\hAtRHak.exe
  2⤵
  PID:11544
- C:\Windows\System\SZygBcS.exe
  C:\Windows\System\SZygBcS.exe
  2⤵
  PID:11564
- C:\Windows\System\UDFtnzN.exe
  C:\Windows\System\UDFtnzN.exe
  2⤵
  PID:11588
- C:\Windows\System\mrUIUce.exe
  C:\Windows\System\mrUIUce.exe
  2⤵
  PID:11636
- C:\Windows\System\CEOCQLG.exe
  C:\Windows\System\CEOCQLG.exe
  2⤵
  PID:11708
- C:\Windows\System\sPjegUi.exe
  C:\Windows\System\sPjegUi.exe
  2⤵
  PID:11736
- C:\Windows\System\mPMuIVp.exe
  C:\Windows\System\mPMuIVp.exe
  2⤵
  PID:11756
- C:\Windows\System\WpyrEJP.exe
  C:\Windows\System\WpyrEJP.exe
  2⤵
  PID:11780
- C:\Windows\System\KNpkCXK.exe
  C:\Windows\System\KNpkCXK.exe
  2⤵
  PID:11800
- C:\Windows\System\XjGbNmM.exe
  C:\Windows\System\XjGbNmM.exe
  2⤵
  PID:11828
- C:\Windows\System\bjVxwVS.exe
  C:\Windows\System\bjVxwVS.exe
  2⤵
  PID:11848
- C:\Windows\System\WRTGFvf.exe
  C:\Windows\System\WRTGFvf.exe
  2⤵
  PID:11888

Analysis

Sharing

General

Malware Config

Signatures

Processes