xmrig | 35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
Size

1.5MB
MD5

8ba5be0d93eeead420cf60114f6e7729
SHA1

df6a306f4f987c2a5d06e647c04da2a9a3d0500c
SHA256

35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9
SHA512

3035b85e78c9fb54a624ed48f23da3cb50b350e68a4df69ad54575864f23b27c8fcaeef4d5cc9d4ab07d9f655f6f78dfc62cc7c2c1f71dc2fc840ec6a798da7a
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensziXoSPqZScXoiRIKdlXH:GezaTF8FcNkNdfE0pZ9ozttwIRRXRnnR

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0007000000012118-2.dat	xmrig
behavioral1/files/0x0007000000019259-9.dat	xmrig
behavioral1/files/0x0007000000019268-14.dat	xmrig
behavioral1/files/0x000700000001926c-15.dat	xmrig
behavioral1/files/0x0006000000019275-24.dat	xmrig
behavioral1/files/0x0006000000019278-28.dat	xmrig
behavioral1/files/0x000600000001929a-34.dat	xmrig
behavioral1/files/0x00050000000194d7-43.dat	xmrig
behavioral1/files/0x00050000000194df-48.dat	xmrig
behavioral1/files/0x0005000000019640-69.dat	xmrig
behavioral1/files/0x0005000000019642-73.dat	xmrig
behavioral1/files/0x000500000001964a-79.dat	xmrig
behavioral1/files/0x000500000001964b-83.dat	xmrig
behavioral1/files/0x00050000000197c2-88.dat	xmrig
behavioral1/files/0x0005000000019a72-93.dat	xmrig
behavioral1/files/0x0005000000019c87-123.dat	xmrig
behavioral1/files/0x0005000000019f6e-142.dat	xmrig
behavioral1/files/0x000500000001a0ab-158.dat	xmrig
behavioral1/files/0x000500000001a074-153.dat	xmrig
behavioral1/files/0x000500000001a06a-148.dat	xmrig
behavioral1/files/0x0005000000019f58-138.dat	xmrig
behavioral1/files/0x0005000000019d8c-133.dat	xmrig
behavioral1/files/0x0005000000019cbe-128.dat	xmrig
behavioral1/files/0x0005000000019c85-119.dat	xmrig
behavioral1/files/0x0005000000019c6c-113.dat	xmrig
behavioral1/files/0x00340000000191f6-108.dat	xmrig
behavioral1/files/0x0005000000019b0f-104.dat	xmrig
behavioral1/files/0x0005000000019b0d-99.dat	xmrig
behavioral1/files/0x000500000001953e-63.dat	xmrig
behavioral1/files/0x0005000000019513-58.dat	xmrig
behavioral1/files/0x000500000001950e-53.dat	xmrig
behavioral1/files/0x0006000000019319-38.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2732	ltfqflh.exe
2804	LuEKpMD.exe
2720	jolrFJk.exe
2228	qZnsagl.exe
2832	dAxInxK.exe
2836	rPcxXiv.exe
2624	mZkwXes.exe
2580	gpAjZdr.exe
2640	YpenkCT.exe
3028	KfZYiBh.exe
2748	YIIcBxm.exe
1580	rGYQOYZ.exe
1584	cyvpoDc.exe
448	rzeYznX.exe
1492	MSyOGMg.exe
2872	AirtPHt.exe
2980	dLnYYqd.exe
2408	WQzbNGM.exe
2616	LQCnGVD.exe
2664	PBoLgpT.exe
2156	BqXOvcX.exe
1960	LfbrORh.exe
560	DJFFLBU.exe
1272	saxYzto.exe
2216	zKUCOQK.exe
1996	pvgyvAL.exe
2384	iaUoTRU.exe
2364	CdeoaLp.exe
1644	DUmXbri.exe
2224	rdbLxXY.exe
964	NgVcIoM.exe
960	ySKSzMF.exe
328	IORmMBf.exe
112	bklrkMO.exe
1616	gJqxsbC.exe
2036	dQYJTvX.exe
1640	gDvQguo.exe
2204	uGFcRCG.exe
1696	XrzRKuP.exe
3008	mknZlvp.exe
376	zilCrqs.exe
1724	IyKSlUu.exe
2024	wPYETxj.exe
1268	XLimKex.exe
2944	GWoZzQu.exe
332	clmhEEY.exe
1244	WekIwSN.exe
820	bEObCjx.exe
320	EydfTAD.exe
1688	ElhPkKv.exe
2080	XoNxSga.exe
2348	FLGJwjm.exe
1048	zTKoJJz.exe
2172	ZlvGKYv.exe
1064	abFVCwV.exe
340	AXEpMfD.exe
2380	mrsaKJk.exe
2792	cHCNaLC.exe
1604	FqKmfBK.exe
2852	CycwYnn.exe
2812	nustiQx.exe
2920	KJNdvHT.exe
2628	jKgqTQi.exe
1676	MnzGkvf.exe

Loads dropped DLL 64 IoCs

pid	Process
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jaKiChb.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\QJAXUSx.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\jZGqaia.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\TVQUskz.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\TYpdhZX.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\byEDAUa.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\yysZWDv.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\eYDPvDd.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\NYgdJra.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\zAghNTc.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\pDViEZP.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\TBHXxvl.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\uYtZidy.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\NAzSxFz.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\JhcZxNR.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\DjvAXnU.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\jDCSAte.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\XTjkdhm.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\eaHIOlp.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\UdPUgnl.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\DsahZdK.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\HhSEPDH.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\DnXNoCE.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\EImXksZ.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\bkQcWnq.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\OPifMzZ.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\nEwfYNn.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\ztsvuuY.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\GqHAotl.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\PudIlWw.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\vZCbwwm.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\ehwLImS.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\HDdpHuu.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\YFrjWRJ.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\ukJjrXY.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\NIsByEj.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\RNIPNid.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\kBgWynz.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\ydaKPzF.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\zHUwnbw.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\nHuoxsc.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\PofLNcT.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\DDGAdmN.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\uzHJnjY.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\hHlJufJ.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\jbZIaFA.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\yRWogtK.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\HdfcZwP.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\GHKEzCY.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\DEqdLzS.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\urqRXcw.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\kJiOFUo.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\SkzvEnx.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\DlLEBBz.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\tDUzGvN.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\rkPuzDY.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\AbPXFIw.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\DOOzxMC.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\CvWuriF.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\LTaLlUT.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\llFaDmx.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\hEJPBfl.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\AWrzgVR.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
File created	C:\Windows\System\hffMlSL.exe	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2732	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	31
PID 2176 wrote to memory of 2732	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	31
PID 2176 wrote to memory of 2732	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	31
PID 2176 wrote to memory of 2804	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	32
PID 2176 wrote to memory of 2804	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	32
PID 2176 wrote to memory of 2804	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	32
PID 2176 wrote to memory of 2720	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	33
PID 2176 wrote to memory of 2720	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	33
PID 2176 wrote to memory of 2720	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	33
PID 2176 wrote to memory of 2228	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	34
PID 2176 wrote to memory of 2228	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	34
PID 2176 wrote to memory of 2228	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	34
PID 2176 wrote to memory of 2832	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	35
PID 2176 wrote to memory of 2832	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	35
PID 2176 wrote to memory of 2832	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	35
PID 2176 wrote to memory of 2836	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	36
PID 2176 wrote to memory of 2836	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	36
PID 2176 wrote to memory of 2836	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	36
PID 2176 wrote to memory of 2624	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	37
PID 2176 wrote to memory of 2624	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	37
PID 2176 wrote to memory of 2624	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	37
PID 2176 wrote to memory of 2580	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	38
PID 2176 wrote to memory of 2580	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	38
PID 2176 wrote to memory of 2580	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	38
PID 2176 wrote to memory of 2640	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	39
PID 2176 wrote to memory of 2640	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	39
PID 2176 wrote to memory of 2640	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	39
PID 2176 wrote to memory of 3028	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	40
PID 2176 wrote to memory of 3028	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	40
PID 2176 wrote to memory of 3028	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	40
PID 2176 wrote to memory of 2748	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	41
PID 2176 wrote to memory of 2748	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	41
PID 2176 wrote to memory of 2748	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	41
PID 2176 wrote to memory of 1580	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	42
PID 2176 wrote to memory of 1580	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	42
PID 2176 wrote to memory of 1580	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	42
PID 2176 wrote to memory of 1584	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	43
PID 2176 wrote to memory of 1584	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	43
PID 2176 wrote to memory of 1584	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	43
PID 2176 wrote to memory of 448	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	44
PID 2176 wrote to memory of 448	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	44
PID 2176 wrote to memory of 448	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	44
PID 2176 wrote to memory of 1492	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	45
PID 2176 wrote to memory of 1492	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	45
PID 2176 wrote to memory of 1492	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	45
PID 2176 wrote to memory of 2872	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	46
PID 2176 wrote to memory of 2872	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	46
PID 2176 wrote to memory of 2872	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	46
PID 2176 wrote to memory of 2980	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	47
PID 2176 wrote to memory of 2980	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	47
PID 2176 wrote to memory of 2980	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	47
PID 2176 wrote to memory of 2408	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	48
PID 2176 wrote to memory of 2408	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	48
PID 2176 wrote to memory of 2408	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	48
PID 2176 wrote to memory of 2616	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	49
PID 2176 wrote to memory of 2616	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	49
PID 2176 wrote to memory of 2616	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	49
PID 2176 wrote to memory of 2664	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	50
PID 2176 wrote to memory of 2664	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	50
PID 2176 wrote to memory of 2664	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	50
PID 2176 wrote to memory of 2156	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	51
PID 2176 wrote to memory of 2156	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	51
PID 2176 wrote to memory of 2156	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	51
PID 2176 wrote to memory of 1960	2176	35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe	52

C:\Users\Admin\AppData\Local\Temp\35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe
"C:\Users\Admin\AppData\Local\Temp\35e3080ec53e3798749be12bebffdc7eb1bdc3fbf322e7bf37078c3bea7758c9.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System\ltfqflh.exe
  C:\Windows\System\ltfqflh.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\LuEKpMD.exe
  C:\Windows\System\LuEKpMD.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\jolrFJk.exe
  C:\Windows\System\jolrFJk.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\qZnsagl.exe
  C:\Windows\System\qZnsagl.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\dAxInxK.exe
  C:\Windows\System\dAxInxK.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\rPcxXiv.exe
  C:\Windows\System\rPcxXiv.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\mZkwXes.exe
  C:\Windows\System\mZkwXes.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\gpAjZdr.exe
  C:\Windows\System\gpAjZdr.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\YpenkCT.exe
  C:\Windows\System\YpenkCT.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\KfZYiBh.exe
  C:\Windows\System\KfZYiBh.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\YIIcBxm.exe
  C:\Windows\System\YIIcBxm.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\rGYQOYZ.exe
  C:\Windows\System\rGYQOYZ.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\cyvpoDc.exe
  C:\Windows\System\cyvpoDc.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\rzeYznX.exe
  C:\Windows\System\rzeYznX.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\MSyOGMg.exe
  C:\Windows\System\MSyOGMg.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\AirtPHt.exe
  C:\Windows\System\AirtPHt.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\dLnYYqd.exe
  C:\Windows\System\dLnYYqd.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\WQzbNGM.exe
  C:\Windows\System\WQzbNGM.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\LQCnGVD.exe
  C:\Windows\System\LQCnGVD.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\PBoLgpT.exe
  C:\Windows\System\PBoLgpT.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\BqXOvcX.exe
  C:\Windows\System\BqXOvcX.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\LfbrORh.exe
  C:\Windows\System\LfbrORh.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\DJFFLBU.exe
  C:\Windows\System\DJFFLBU.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\saxYzto.exe
  C:\Windows\System\saxYzto.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\zKUCOQK.exe
  C:\Windows\System\zKUCOQK.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\pvgyvAL.exe
  C:\Windows\System\pvgyvAL.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\iaUoTRU.exe
  C:\Windows\System\iaUoTRU.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\CdeoaLp.exe
  C:\Windows\System\CdeoaLp.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\DUmXbri.exe
  C:\Windows\System\DUmXbri.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\rdbLxXY.exe
  C:\Windows\System\rdbLxXY.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\NgVcIoM.exe
  C:\Windows\System\NgVcIoM.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\ySKSzMF.exe
  C:\Windows\System\ySKSzMF.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\IORmMBf.exe
  C:\Windows\System\IORmMBf.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\bklrkMO.exe
  C:\Windows\System\bklrkMO.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\gJqxsbC.exe
  C:\Windows\System\gJqxsbC.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\dQYJTvX.exe
  C:\Windows\System\dQYJTvX.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\gDvQguo.exe
  C:\Windows\System\gDvQguo.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\uGFcRCG.exe
  C:\Windows\System\uGFcRCG.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\XrzRKuP.exe
  C:\Windows\System\XrzRKuP.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\mknZlvp.exe
  C:\Windows\System\mknZlvp.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\zilCrqs.exe
  C:\Windows\System\zilCrqs.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\IyKSlUu.exe
  C:\Windows\System\IyKSlUu.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\wPYETxj.exe
  C:\Windows\System\wPYETxj.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\XLimKex.exe
  C:\Windows\System\XLimKex.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\GWoZzQu.exe
  C:\Windows\System\GWoZzQu.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\clmhEEY.exe
  C:\Windows\System\clmhEEY.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\WekIwSN.exe
  C:\Windows\System\WekIwSN.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\bEObCjx.exe
  C:\Windows\System\bEObCjx.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\EydfTAD.exe
  C:\Windows\System\EydfTAD.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\ElhPkKv.exe
  C:\Windows\System\ElhPkKv.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\XoNxSga.exe
  C:\Windows\System\XoNxSga.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\FLGJwjm.exe
  C:\Windows\System\FLGJwjm.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\zTKoJJz.exe
  C:\Windows\System\zTKoJJz.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\abFVCwV.exe
  C:\Windows\System\abFVCwV.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\ZlvGKYv.exe
  C:\Windows\System\ZlvGKYv.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\AXEpMfD.exe
  C:\Windows\System\AXEpMfD.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\mrsaKJk.exe
  C:\Windows\System\mrsaKJk.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\FqKmfBK.exe
  C:\Windows\System\FqKmfBK.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\cHCNaLC.exe
  C:\Windows\System\cHCNaLC.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\CycwYnn.exe
  C:\Windows\System\CycwYnn.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\nustiQx.exe
  C:\Windows\System\nustiQx.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\KJNdvHT.exe
  C:\Windows\System\KJNdvHT.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\jKgqTQi.exe
  C:\Windows\System\jKgqTQi.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\MnzGkvf.exe
  C:\Windows\System\MnzGkvf.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\HvYRZnD.exe
  C:\Windows\System\HvYRZnD.exe
  2⤵
  PID:2824
- C:\Windows\System\QdpHcEm.exe
  C:\Windows\System\QdpHcEm.exe
  2⤵
  PID:2004
- C:\Windows\System\Wsmlxix.exe
  C:\Windows\System\Wsmlxix.exe
  2⤵
  PID:1496
- C:\Windows\System\jDCSAte.exe
  C:\Windows\System\jDCSAte.exe
  2⤵
  PID:1808
- C:\Windows\System\aSNZQDQ.exe
  C:\Windows\System\aSNZQDQ.exe
  2⤵
  PID:2400
- C:\Windows\System\FYnKYNz.exe
  C:\Windows\System\FYnKYNz.exe
  2⤵
  PID:2972
- C:\Windows\System\eBzRgHU.exe
  C:\Windows\System\eBzRgHU.exe
  2⤵
  PID:2868
- C:\Windows\System\PWaFgPh.exe
  C:\Windows\System\PWaFgPh.exe
  2⤵
  PID:2068
- C:\Windows\System\cLnOCVA.exe
  C:\Windows\System\cLnOCVA.exe
  2⤵
  PID:1872
- C:\Windows\System\YgagDjo.exe
  C:\Windows\System\YgagDjo.exe
  2⤵
  PID:908
- C:\Windows\System\MgaZxgx.exe
  C:\Windows\System\MgaZxgx.exe
  2⤵
  PID:2692
- C:\Windows\System\Cklyytz.exe
  C:\Windows\System\Cklyytz.exe
  2⤵
  PID:2840
- C:\Windows\System\hkwDTqH.exe
  C:\Windows\System\hkwDTqH.exe
  2⤵
  PID:2120
- C:\Windows\System\CncgLXX.exe
  C:\Windows\System\CncgLXX.exe
  2⤵
  PID:2040
- C:\Windows\System\TMjRRYS.exe
  C:\Windows\System\TMjRRYS.exe
  2⤵
  PID:2764
- C:\Windows\System\LecUoIn.exe
  C:\Windows\System\LecUoIn.exe
  2⤵
  PID:628
- C:\Windows\System\hCSoofx.exe
  C:\Windows\System\hCSoofx.exe
  2⤵
  PID:1888
- C:\Windows\System\peTTarW.exe
  C:\Windows\System\peTTarW.exe
  2⤵
  PID:2332
- C:\Windows\System\SQoDiFt.exe
  C:\Windows\System\SQoDiFt.exe
  2⤵
  PID:2236
- C:\Windows\System\GmAROuM.exe
  C:\Windows\System\GmAROuM.exe
  2⤵
  PID:1100
- C:\Windows\System\qfNNCij.exe
  C:\Windows\System\qfNNCij.exe
  2⤵
  PID:2148
- C:\Windows\System\fkBVpHA.exe
  C:\Windows\System\fkBVpHA.exe
  2⤵
  PID:2352
- C:\Windows\System\pSjTvuA.exe
  C:\Windows\System\pSjTvuA.exe
  2⤵
  PID:1564
- C:\Windows\System\ZWBNBkd.exe
  C:\Windows\System\ZWBNBkd.exe
  2⤵
  PID:548
- C:\Windows\System\BSYGurr.exe
  C:\Windows\System\BSYGurr.exe
  2⤵
  PID:712
- C:\Windows\System\lDZSbxO.exe
  C:\Windows\System\lDZSbxO.exe
  2⤵
  PID:1460
- C:\Windows\System\keDhGSX.exe
  C:\Windows\System\keDhGSX.exe
  2⤵
  PID:1744
- C:\Windows\System\Pgaosxj.exe
  C:\Windows\System\Pgaosxj.exe
  2⤵
  PID:1052
- C:\Windows\System\OlpsVbU.exe
  C:\Windows\System\OlpsVbU.exe
  2⤵
  PID:2440
- C:\Windows\System\oXERMzX.exe
  C:\Windows\System\oXERMzX.exe
  2⤵
  PID:1768
- C:\Windows\System\qDAPcjh.exe
  C:\Windows\System\qDAPcjh.exe
  2⤵
  PID:2784
- C:\Windows\System\CIVTppO.exe
  C:\Windows\System\CIVTppO.exe
  2⤵
  PID:2584
- C:\Windows\System\zHUwnbw.exe
  C:\Windows\System\zHUwnbw.exe
  2⤵
  PID:2808
- C:\Windows\System\urupZJl.exe
  C:\Windows\System\urupZJl.exe
  2⤵
  PID:2736
- C:\Windows\System\lgjUqVA.exe
  C:\Windows\System\lgjUqVA.exe
  2⤵
  PID:1296
- C:\Windows\System\hmifSQC.exe
  C:\Windows\System\hmifSQC.exe
  2⤵
  PID:2552
- C:\Windows\System\IbxHRXB.exe
  C:\Windows\System\IbxHRXB.exe
  2⤵
  PID:1780
- C:\Windows\System\YyPxcGe.exe
  C:\Windows\System\YyPxcGe.exe
  2⤵
  PID:1260
- C:\Windows\System\FYfzzxx.exe
  C:\Windows\System\FYfzzxx.exe
  2⤵
  PID:2900
- C:\Windows\System\vFtweNQ.exe
  C:\Windows\System\vFtweNQ.exe
  2⤵
  PID:796
- C:\Windows\System\Nhajwns.exe
  C:\Windows\System\Nhajwns.exe
  2⤵
  PID:2244
- C:\Windows\System\xcBJudo.exe
  C:\Windows\System\xcBJudo.exe
  2⤵
  PID:2588
- C:\Windows\System\vZRAjyh.exe
  C:\Windows\System\vZRAjyh.exe
  2⤵
  PID:1784
- C:\Windows\System\cOUdhpt.exe
  C:\Windows\System\cOUdhpt.exe
  2⤵
  PID:608
- C:\Windows\System\kgpcYQy.exe
  C:\Windows\System\kgpcYQy.exe
  2⤵
  PID:1652
- C:\Windows\System\ViNPDRh.exe
  C:\Windows\System\ViNPDRh.exe
  2⤵
  PID:1308
- C:\Windows\System\iXIjYCv.exe
  C:\Windows\System\iXIjYCv.exe
  2⤵
  PID:1372
- C:\Windows\System\oqqEDvR.exe
  C:\Windows\System\oqqEDvR.exe
  2⤵
  PID:1732
- C:\Windows\System\ovqiUdL.exe
  C:\Windows\System\ovqiUdL.exe
  2⤵
  PID:468
- C:\Windows\System\pfxQfsO.exe
  C:\Windows\System\pfxQfsO.exe
  2⤵
  PID:1804
- C:\Windows\System\AQzRxtF.exe
  C:\Windows\System\AQzRxtF.exe
  2⤵
  PID:2336
- C:\Windows\System\RWxyjFO.exe
  C:\Windows\System\RWxyjFO.exe
  2⤵
  PID:3004
- C:\Windows\System\btmBMaK.exe
  C:\Windows\System\btmBMaK.exe
  2⤵
  PID:2448
- C:\Windows\System\SfRXuCI.exe
  C:\Windows\System\SfRXuCI.exe
  2⤵
  PID:2424
- C:\Windows\System\ukCCabt.exe
  C:\Windows\System\ukCCabt.exe
  2⤵
  PID:2772
- C:\Windows\System\TIlvcit.exe
  C:\Windows\System\TIlvcit.exe
  2⤵
  PID:2724
- C:\Windows\System\ebZVmKs.exe
  C:\Windows\System\ebZVmKs.exe
  2⤵
  PID:2212
- C:\Windows\System\cEspTkc.exe
  C:\Windows\System\cEspTkc.exe
  2⤵
  PID:2536
- C:\Windows\System\yhKVoHk.exe
  C:\Windows\System\yhKVoHk.exe
  2⤵
  PID:2912
- C:\Windows\System\eOhtqSC.exe
  C:\Windows\System\eOhtqSC.exe
  2⤵
  PID:2896
- C:\Windows\System\nLPcyNU.exe
  C:\Windows\System\nLPcyNU.exe
  2⤵
  PID:1664
- C:\Windows\System\drQJxks.exe
  C:\Windows\System\drQJxks.exe
  2⤵
  PID:2388
- C:\Windows\System\IPuYJUD.exe
  C:\Windows\System\IPuYJUD.exe
  2⤵
  PID:3088
- C:\Windows\System\LPEiqPC.exe
  C:\Windows\System\LPEiqPC.exe
  2⤵
  PID:3108
- C:\Windows\System\qvaLmNo.exe
  C:\Windows\System\qvaLmNo.exe
  2⤵
  PID:3128
- C:\Windows\System\csBZjSe.exe
  C:\Windows\System\csBZjSe.exe
  2⤵
  PID:3148
- C:\Windows\System\UfihNcM.exe
  C:\Windows\System\UfihNcM.exe
  2⤵
  PID:3164
- C:\Windows\System\MgnsBtZ.exe
  C:\Windows\System\MgnsBtZ.exe
  2⤵
  PID:3184
- C:\Windows\System\NoRuiqU.exe
  C:\Windows\System\NoRuiqU.exe
  2⤵
  PID:3224
- C:\Windows\System\QvQXUEP.exe
  C:\Windows\System\QvQXUEP.exe
  2⤵
  PID:3240
- C:\Windows\System\fPXoAgb.exe
  C:\Windows\System\fPXoAgb.exe
  2⤵
  PID:3260
- C:\Windows\System\JMgAgOw.exe
  C:\Windows\System\JMgAgOw.exe
  2⤵
  PID:3276
- C:\Windows\System\oXhIngq.exe
  C:\Windows\System\oXhIngq.exe
  2⤵
  PID:3296
- C:\Windows\System\DEyKwsk.exe
  C:\Windows\System\DEyKwsk.exe
  2⤵
  PID:3316
- C:\Windows\System\rkAjtwm.exe
  C:\Windows\System\rkAjtwm.exe
  2⤵
  PID:3332
- C:\Windows\System\KjXnseA.exe
  C:\Windows\System\KjXnseA.exe
  2⤵
  PID:3348
- C:\Windows\System\MiIbHOj.exe
  C:\Windows\System\MiIbHOj.exe
  2⤵
  PID:3376
- C:\Windows\System\BZkwJaa.exe
  C:\Windows\System\BZkwJaa.exe
  2⤵
  PID:3400
- C:\Windows\System\HIVWaAM.exe
  C:\Windows\System\HIVWaAM.exe
  2⤵
  PID:3416
- C:\Windows\System\IOWYFnP.exe
  C:\Windows\System\IOWYFnP.exe
  2⤵
  PID:3440
- C:\Windows\System\JbuXrHV.exe
  C:\Windows\System\JbuXrHV.exe
  2⤵
  PID:3464
- C:\Windows\System\DEqdLzS.exe
  C:\Windows\System\DEqdLzS.exe
  2⤵
  PID:3480
- C:\Windows\System\YAtPDfJ.exe
  C:\Windows\System\YAtPDfJ.exe
  2⤵
  PID:3500
- C:\Windows\System\LlZJfsV.exe
  C:\Windows\System\LlZJfsV.exe
  2⤵
  PID:3524
- C:\Windows\System\WPOZwat.exe
  C:\Windows\System\WPOZwat.exe
  2⤵
  PID:3540
- C:\Windows\System\DUlSHiX.exe
  C:\Windows\System\DUlSHiX.exe
  2⤵
  PID:3556
- C:\Windows\System\EezNaDI.exe
  C:\Windows\System\EezNaDI.exe
  2⤵
  PID:3580
- C:\Windows\System\BTiDHdc.exe
  C:\Windows\System\BTiDHdc.exe
  2⤵
  PID:3600
- C:\Windows\System\zwyiByl.exe
  C:\Windows\System\zwyiByl.exe
  2⤵
  PID:3620
- C:\Windows\System\YvZErcb.exe
  C:\Windows\System\YvZErcb.exe
  2⤵
  PID:3636
- C:\Windows\System\KSpXlyI.exe
  C:\Windows\System\KSpXlyI.exe
  2⤵
  PID:3664
- C:\Windows\System\OdDDtiQ.exe
  C:\Windows\System\OdDDtiQ.exe
  2⤵
  PID:3684
- C:\Windows\System\bCJXLKA.exe
  C:\Windows\System\bCJXLKA.exe
  2⤵
  PID:3700
- C:\Windows\System\BScjBOK.exe
  C:\Windows\System\BScjBOK.exe
  2⤵
  PID:3720
- C:\Windows\System\LPhCTem.exe
  C:\Windows\System\LPhCTem.exe
  2⤵
  PID:3740
- C:\Windows\System\HqkpURM.exe
  C:\Windows\System\HqkpURM.exe
  2⤵
  PID:3764
- C:\Windows\System\SylqhtJ.exe
  C:\Windows\System\SylqhtJ.exe
  2⤵
  PID:3780
- C:\Windows\System\jGSLyrW.exe
  C:\Windows\System\jGSLyrW.exe
  2⤵
  PID:3796
- C:\Windows\System\kIfsxJz.exe
  C:\Windows\System\kIfsxJz.exe
  2⤵
  PID:3820
- C:\Windows\System\jhdAxYm.exe
  C:\Windows\System\jhdAxYm.exe
  2⤵
  PID:3836
- C:\Windows\System\GPynjZc.exe
  C:\Windows\System\GPynjZc.exe
  2⤵
  PID:3856
- C:\Windows\System\nkjRFhK.exe
  C:\Windows\System\nkjRFhK.exe
  2⤵
  PID:3880
- C:\Windows\System\MjYoScm.exe
  C:\Windows\System\MjYoScm.exe
  2⤵
  PID:3900
- C:\Windows\System\qeKQtJZ.exe
  C:\Windows\System\qeKQtJZ.exe
  2⤵
  PID:3924
- C:\Windows\System\PyxeIkX.exe
  C:\Windows\System\PyxeIkX.exe
  2⤵
  PID:3940
- C:\Windows\System\EvzNrMk.exe
  C:\Windows\System\EvzNrMk.exe
  2⤵
  PID:3960
- C:\Windows\System\afRUDao.exe
  C:\Windows\System\afRUDao.exe
  2⤵
  PID:3976
- C:\Windows\System\TDLAOBg.exe
  C:\Windows\System\TDLAOBg.exe
  2⤵
  PID:3996
- C:\Windows\System\dyZYzdP.exe
  C:\Windows\System\dyZYzdP.exe
  2⤵
  PID:4016
- C:\Windows\System\OFippWe.exe
  C:\Windows\System\OFippWe.exe
  2⤵
  PID:4036
- C:\Windows\System\TuVAXDF.exe
  C:\Windows\System\TuVAXDF.exe
  2⤵
  PID:4056
- C:\Windows\System\FRkTNlg.exe
  C:\Windows\System\FRkTNlg.exe
  2⤵
  PID:4072
- C:\Windows\System\YTShwCn.exe
  C:\Windows\System\YTShwCn.exe
  2⤵
  PID:4092
- C:\Windows\System\cpYWfYW.exe
  C:\Windows\System\cpYWfYW.exe
  2⤵
  PID:2952
- C:\Windows\System\aNUqUMK.exe
  C:\Windows\System\aNUqUMK.exe
  2⤵
  PID:1632
- C:\Windows\System\qQcyxbD.exe
  C:\Windows\System\qQcyxbD.exe
  2⤵
  PID:1984
- C:\Windows\System\XIRAjRr.exe
  C:\Windows\System\XIRAjRr.exe
  2⤵
  PID:1736
- C:\Windows\System\qCHklNS.exe
  C:\Windows\System\qCHklNS.exe
  2⤵
  PID:2604
- C:\Windows\System\vxqcfea.exe
  C:\Windows\System\vxqcfea.exe
  2⤵
  PID:2492
- C:\Windows\System\wsxewMR.exe
  C:\Windows\System\wsxewMR.exe
  2⤵
  PID:2696
- C:\Windows\System\vGbCgbn.exe
  C:\Windows\System\vGbCgbn.exe
  2⤵
  PID:3036
- C:\Windows\System\iHDpnag.exe
  C:\Windows\System\iHDpnag.exe
  2⤵
  PID:904
- C:\Windows\System\XLyyYdE.exe
  C:\Windows\System\XLyyYdE.exe
  2⤵
  PID:1576
- C:\Windows\System\aNbGWBq.exe
  C:\Windows\System\aNbGWBq.exe
  2⤵
  PID:3096
- C:\Windows\System\icqXrsR.exe
  C:\Windows\System\icqXrsR.exe
  2⤵
  PID:3140
- C:\Windows\System\NwgQRed.exe
  C:\Windows\System\NwgQRed.exe
  2⤵
  PID:3084
- C:\Windows\System\yDhWOPj.exe
  C:\Windows\System\yDhWOPj.exe
  2⤵
  PID:3124
- C:\Windows\System\wPpuFub.exe
  C:\Windows\System\wPpuFub.exe
  2⤵
  PID:2196
- C:\Windows\System\SdSoCTY.exe
  C:\Windows\System\SdSoCTY.exe
  2⤵
  PID:3232
- C:\Windows\System\TLlMfOM.exe
  C:\Windows\System\TLlMfOM.exe
  2⤵
  PID:3304
- C:\Windows\System\giKBTBA.exe
  C:\Windows\System\giKBTBA.exe
  2⤵
  PID:3196
- C:\Windows\System\GSNAFWp.exe
  C:\Windows\System\GSNAFWp.exe
  2⤵
  PID:3340
- C:\Windows\System\nTEFcQJ.exe
  C:\Windows\System\nTEFcQJ.exe
  2⤵
  PID:3384
- C:\Windows\System\bQzajEC.exe
  C:\Windows\System\bQzajEC.exe
  2⤵
  PID:3252
- C:\Windows\System\hXZbHNj.exe
  C:\Windows\System\hXZbHNj.exe
  2⤵
  PID:3356
- C:\Windows\System\qhxolPq.exe
  C:\Windows\System\qhxolPq.exe
  2⤵
  PID:3372
- C:\Windows\System\opNlmfr.exe
  C:\Windows\System\opNlmfr.exe
  2⤵
  PID:3428
- C:\Windows\System\CofQduf.exe
  C:\Windows\System\CofQduf.exe
  2⤵
  PID:3472
- C:\Windows\System\AMOfVbQ.exe
  C:\Windows\System\AMOfVbQ.exe
  2⤵
  PID:3520
- C:\Windows\System\elngwUF.exe
  C:\Windows\System\elngwUF.exe
  2⤵
  PID:2988
- C:\Windows\System\WcULrpZ.exe
  C:\Windows\System\WcULrpZ.exe
  2⤵
  PID:2340
- C:\Windows\System\NpemDql.exe
  C:\Windows\System\NpemDql.exe
  2⤵
  PID:3632
- C:\Windows\System\IuRnmFJ.exe
  C:\Windows\System\IuRnmFJ.exe
  2⤵
  PID:3616
- C:\Windows\System\MOyhTts.exe
  C:\Windows\System\MOyhTts.exe
  2⤵
  PID:3676
- C:\Windows\System\ZdtAoMp.exe
  C:\Windows\System\ZdtAoMp.exe
  2⤵
  PID:3652
- C:\Windows\System\zexrZYj.exe
  C:\Windows\System\zexrZYj.exe
  2⤵
  PID:3716
- C:\Windows\System\kFGBYrz.exe
  C:\Windows\System\kFGBYrz.exe
  2⤵
  PID:2360
- C:\Windows\System\fKIAuFx.exe
  C:\Windows\System\fKIAuFx.exe
  2⤵
  PID:3788
- C:\Windows\System\BjXqYtR.exe
  C:\Windows\System\BjXqYtR.exe
  2⤵
  PID:3792
- C:\Windows\System\XBijfcK.exe
  C:\Windows\System\XBijfcK.exe
  2⤵
  PID:3828
- C:\Windows\System\ckIdrkj.exe
  C:\Windows\System\ckIdrkj.exe
  2⤵
  PID:3876
- C:\Windows\System\fXyzeol.exe
  C:\Windows\System\fXyzeol.exe
  2⤵
  PID:3816
- C:\Windows\System\uzVVTxy.exe
  C:\Windows\System\uzVVTxy.exe
  2⤵
  PID:3888
- C:\Windows\System\FARTsIS.exe
  C:\Windows\System\FARTsIS.exe
  2⤵
  PID:3916
- C:\Windows\System\CXanZLn.exe
  C:\Windows\System\CXanZLn.exe
  2⤵
  PID:3952
- C:\Windows\System\YJKlsQp.exe
  C:\Windows\System\YJKlsQp.exe
  2⤵
  PID:3892
- C:\Windows\System\jfPruaK.exe
  C:\Windows\System\jfPruaK.exe
  2⤵
  PID:3932
- C:\Windows\System\jEdvpOx.exe
  C:\Windows\System\jEdvpOx.exe
  2⤵
  PID:4024
- C:\Windows\System\NiPvFSq.exe
  C:\Windows\System\NiPvFSq.exe
  2⤵
  PID:4068
- C:\Windows\System\MAntfPf.exe
  C:\Windows\System\MAntfPf.exe
  2⤵
  PID:3972
- C:\Windows\System\JAYmSjy.exe
  C:\Windows\System\JAYmSjy.exe
  2⤵
  PID:1620
- C:\Windows\System\nOSflIN.exe
  C:\Windows\System\nOSflIN.exe
  2⤵
  PID:2856
- C:\Windows\System\dvLFNGU.exe
  C:\Windows\System\dvLFNGU.exe
  2⤵
  PID:4084
- C:\Windows\System\NqOsuJN.exe
  C:\Windows\System\NqOsuJN.exe
  2⤵
  PID:2676
- C:\Windows\System\AczQCiw.exe
  C:\Windows\System\AczQCiw.exe
  2⤵
  PID:1720
- C:\Windows\System\bUgoxQh.exe
  C:\Windows\System\bUgoxQh.exe
  2⤵
  PID:1672
- C:\Windows\System\AVPMbPA.exe
  C:\Windows\System\AVPMbPA.exe
  2⤵
  PID:1772
- C:\Windows\System\YYzdQcX.exe
  C:\Windows\System\YYzdQcX.exe
  2⤵
  PID:652
- C:\Windows\System\rFahCxe.exe
  C:\Windows\System\rFahCxe.exe
  2⤵
  PID:1104
- C:\Windows\System\txJGxuN.exe
  C:\Windows\System\txJGxuN.exe
  2⤵
  PID:2592
- C:\Windows\System\mqQewkp.exe
  C:\Windows\System\mqQewkp.exe
  2⤵
  PID:2800
- C:\Windows\System\lSHayEX.exe
  C:\Windows\System\lSHayEX.exe
  2⤵
  PID:2060
- C:\Windows\System\EAxlpRe.exe
  C:\Windows\System\EAxlpRe.exe
  2⤵
  PID:2444
- C:\Windows\System\weohOwW.exe
  C:\Windows\System\weohOwW.exe
  2⤵
  PID:2144
- C:\Windows\System\cMcsEDW.exe
  C:\Windows\System\cMcsEDW.exe
  2⤵
  PID:3208
- C:\Windows\System\cvPTYCA.exe
  C:\Windows\System\cvPTYCA.exe
  2⤵
  PID:3256
- C:\Windows\System\xFnirrG.exe
  C:\Windows\System\xFnirrG.exe
  2⤵
  PID:3120
- C:\Windows\System\uzHJnjY.exe
  C:\Windows\System\uzHJnjY.exe
  2⤵
  PID:3392
- C:\Windows\System\fRdsHZx.exe
  C:\Windows\System\fRdsHZx.exe
  2⤵
  PID:2252
- C:\Windows\System\fIWZqkv.exe
  C:\Windows\System\fIWZqkv.exe
  2⤵
  PID:3364
- C:\Windows\System\lukTHeK.exe
  C:\Windows\System\lukTHeK.exe
  2⤵
  PID:3412
- C:\Windows\System\revwzbN.exe
  C:\Windows\System\revwzbN.exe
  2⤵
  PID:3328
- C:\Windows\System\pDViEZP.exe
  C:\Windows\System\pDViEZP.exe
  2⤵
  PID:3076
- C:\Windows\System\fVNWpMD.exe
  C:\Windows\System\fVNWpMD.exe
  2⤵
  PID:3508
- C:\Windows\System\ErXTdwd.exe
  C:\Windows\System\ErXTdwd.exe
  2⤵
  PID:2256
- C:\Windows\System\bplqsue.exe
  C:\Windows\System\bplqsue.exe
  2⤵
  PID:3588
- C:\Windows\System\vRhQgKd.exe
  C:\Windows\System\vRhQgKd.exe
  2⤵
  PID:3576
- C:\Windows\System\DVDtgVQ.exe
  C:\Windows\System\DVDtgVQ.exe
  2⤵
  PID:3752
- C:\Windows\System\XOBPceT.exe
  C:\Windows\System\XOBPceT.exe
  2⤵
  PID:3736
- C:\Windows\System\hiKGpbK.exe
  C:\Windows\System\hiKGpbK.exe
  2⤵
  PID:3848
- C:\Windows\System\UBSMVir.exe
  C:\Windows\System\UBSMVir.exe
  2⤵
  PID:2888
- C:\Windows\System\jTuABHx.exe
  C:\Windows\System\jTuABHx.exe
  2⤵
  PID:3596
- C:\Windows\System\GqHAotl.exe
  C:\Windows\System\GqHAotl.exe
  2⤵
  PID:3712
- C:\Windows\System\FmNEzUE.exe
  C:\Windows\System\FmNEzUE.exe
  2⤵
  PID:3808
- C:\Windows\System\DOOzxMC.exe
  C:\Windows\System\DOOzxMC.exe
  2⤵
  PID:2084
- C:\Windows\System\wrhojDs.exe
  C:\Windows\System\wrhojDs.exe
  2⤵
  PID:4048
- C:\Windows\System\QBndXoI.exe
  C:\Windows\System\QBndXoI.exe
  2⤵
  PID:2088
- C:\Windows\System\bvLdUTZ.exe
  C:\Windows\System\bvLdUTZ.exe
  2⤵
  PID:1884
- C:\Windows\System\XBhdYCZ.exe
  C:\Windows\System\XBhdYCZ.exe
  2⤵
  PID:1988
- C:\Windows\System\hHlJufJ.exe
  C:\Windows\System\hHlJufJ.exe
  2⤵
  PID:4088
- C:\Windows\System\iuyGULT.exe
  C:\Windows\System\iuyGULT.exe
  2⤵
  PID:2164
- C:\Windows\System\rxLMIbD.exe
  C:\Windows\System\rxLMIbD.exe
  2⤵
  PID:3176
- C:\Windows\System\UUbLXgQ.exe
  C:\Windows\System\UUbLXgQ.exe
  2⤵
  PID:2908
- C:\Windows\System\HlwrExu.exe
  C:\Windows\System\HlwrExu.exe
  2⤵
  PID:3116
- C:\Windows\System\DuAJByR.exe
  C:\Windows\System\DuAJByR.exe
  2⤵
  PID:3708
- C:\Windows\System\xztovOr.exe
  C:\Windows\System\xztovOr.exe
  2⤵
  PID:4080
- C:\Windows\System\afyTtBS.exe
  C:\Windows\System\afyTtBS.exe
  2⤵
  PID:1776
- C:\Windows\System\azLbCMr.exe
  C:\Windows\System\azLbCMr.exe
  2⤵
  PID:3160
- C:\Windows\System\SCsNcNQ.exe
  C:\Windows\System\SCsNcNQ.exe
  2⤵
  PID:2876
- C:\Windows\System\nssbMMC.exe
  C:\Windows\System\nssbMMC.exe
  2⤵
  PID:2996
- C:\Windows\System\umDgaOq.exe
  C:\Windows\System\umDgaOq.exe
  2⤵
  PID:3452
- C:\Windows\System\dBITAvR.exe
  C:\Windows\System\dBITAvR.exe
  2⤵
  PID:3988
- C:\Windows\System\OAIMkJK.exe
  C:\Windows\System\OAIMkJK.exe
  2⤵
  PID:3956
- C:\Windows\System\FpIqGCc.exe
  C:\Windows\System\FpIqGCc.exe
  2⤵
  PID:4004
- C:\Windows\System\cLvxrSi.exe
  C:\Windows\System\cLvxrSi.exe
  2⤵
  PID:3436
- C:\Windows\System\gMtsGBT.exe
  C:\Windows\System\gMtsGBT.exe
  2⤵
  PID:3272
- C:\Windows\System\mFCHnwW.exe
  C:\Windows\System\mFCHnwW.exe
  2⤵
  PID:3424
- C:\Windows\System\EAJztrT.exe
  C:\Windows\System\EAJztrT.exe
  2⤵
  PID:3868
- C:\Windows\System\hffMlSL.exe
  C:\Windows\System\hffMlSL.exe
  2⤵
  PID:3592
- C:\Windows\System\wevGWlO.exe
  C:\Windows\System\wevGWlO.exe
  2⤵
  PID:3648
- C:\Windows\System\ZQGMVsp.exe
  C:\Windows\System\ZQGMVsp.exe
  2⤵
  PID:2712
- C:\Windows\System\efPbYOP.exe
  C:\Windows\System\efPbYOP.exe
  2⤵
  PID:3968
- C:\Windows\System\XTjkdhm.exe
  C:\Windows\System\XTjkdhm.exe
  2⤵
  PID:3212
- C:\Windows\System\XHVtzzx.exe
  C:\Windows\System\XHVtzzx.exe
  2⤵
  PID:3496
- C:\Windows\System\uLQiqJW.exe
  C:\Windows\System\uLQiqJW.exe
  2⤵
  PID:3068
- C:\Windows\System\KFeUvHx.exe
  C:\Windows\System\KFeUvHx.exe
  2⤵
  PID:3656
- C:\Windows\System\avmPVer.exe
  C:\Windows\System\avmPVer.exe
  2⤵
  PID:272
- C:\Windows\System\PudIlWw.exe
  C:\Windows\System\PudIlWw.exe
  2⤵
  PID:4108
- C:\Windows\System\oEQnhRN.exe
  C:\Windows\System\oEQnhRN.exe
  2⤵
  PID:4124
- C:\Windows\System\gyjqwws.exe
  C:\Windows\System\gyjqwws.exe
  2⤵
  PID:4140
- C:\Windows\System\EoPcUKQ.exe
  C:\Windows\System\EoPcUKQ.exe
  2⤵
  PID:4156
- C:\Windows\System\NuYivQb.exe
  C:\Windows\System\NuYivQb.exe
  2⤵
  PID:4172
- C:\Windows\System\GfIHrvM.exe
  C:\Windows\System\GfIHrvM.exe
  2⤵
  PID:4188
- C:\Windows\System\aMPdIVs.exe
  C:\Windows\System\aMPdIVs.exe
  2⤵
  PID:4204
- C:\Windows\System\qULNJsg.exe
  C:\Windows\System\qULNJsg.exe
  2⤵
  PID:4220
- C:\Windows\System\pbNzJUi.exe
  C:\Windows\System\pbNzJUi.exe
  2⤵
  PID:4240
- C:\Windows\System\SOUzZzb.exe
  C:\Windows\System\SOUzZzb.exe
  2⤵
  PID:4256
- C:\Windows\System\LBkcZOn.exe
  C:\Windows\System\LBkcZOn.exe
  2⤵
  PID:4272
- C:\Windows\System\xPAEAPT.exe
  C:\Windows\System\xPAEAPT.exe
  2⤵
  PID:4288
- C:\Windows\System\mRpIfZa.exe
  C:\Windows\System\mRpIfZa.exe
  2⤵
  PID:4304
- C:\Windows\System\qZCeggJ.exe
  C:\Windows\System\qZCeggJ.exe
  2⤵
  PID:4324
- C:\Windows\System\uRhhkHU.exe
  C:\Windows\System\uRhhkHU.exe
  2⤵
  PID:4340
- C:\Windows\System\byhYkth.exe
  C:\Windows\System\byhYkth.exe
  2⤵
  PID:4356
- C:\Windows\System\VSljpaf.exe
  C:\Windows\System\VSljpaf.exe
  2⤵
  PID:4372
- C:\Windows\System\txfwXWC.exe
  C:\Windows\System\txfwXWC.exe
  2⤵
  PID:4388
- C:\Windows\System\lVZHvuP.exe
  C:\Windows\System\lVZHvuP.exe
  2⤵
  PID:4404
- C:\Windows\System\cUYILRc.exe
  C:\Windows\System\cUYILRc.exe
  2⤵
  PID:4420
- C:\Windows\System\WZkbXWu.exe
  C:\Windows\System\WZkbXWu.exe
  2⤵
  PID:4436
- C:\Windows\System\CiFytyc.exe
  C:\Windows\System\CiFytyc.exe
  2⤵
  PID:4452
- C:\Windows\System\dwzJewR.exe
  C:\Windows\System\dwzJewR.exe
  2⤵
  PID:4468
- C:\Windows\System\VEAjhwo.exe
  C:\Windows\System\VEAjhwo.exe
  2⤵
  PID:4484
- C:\Windows\System\RotMhdf.exe
  C:\Windows\System\RotMhdf.exe
  2⤵
  PID:4500
- C:\Windows\System\GHzBFVn.exe
  C:\Windows\System\GHzBFVn.exe
  2⤵
  PID:4596
- C:\Windows\System\KjtvDdm.exe
  C:\Windows\System\KjtvDdm.exe
  2⤵
  PID:4612
- C:\Windows\System\DdxkuiL.exe
  C:\Windows\System\DdxkuiL.exe
  2⤵
  PID:4628
- C:\Windows\System\acWYlCB.exe
  C:\Windows\System\acWYlCB.exe
  2⤵
  PID:4644
- C:\Windows\System\SkzvEnx.exe
  C:\Windows\System\SkzvEnx.exe
  2⤵
  PID:4660
- C:\Windows\System\JawqMkN.exe
  C:\Windows\System\JawqMkN.exe
  2⤵
  PID:4680
- C:\Windows\System\hitVrxS.exe
  C:\Windows\System\hitVrxS.exe
  2⤵
  PID:4696
- C:\Windows\System\vZCbwwm.exe
  C:\Windows\System\vZCbwwm.exe
  2⤵
  PID:4716
- C:\Windows\System\fcliDGs.exe
  C:\Windows\System\fcliDGs.exe
  2⤵
  PID:4732
- C:\Windows\System\EApTAbA.exe
  C:\Windows\System\EApTAbA.exe
  2⤵
  PID:4752
- C:\Windows\System\tqGusbM.exe
  C:\Windows\System\tqGusbM.exe
  2⤵
  PID:4768
- C:\Windows\System\jlagAEt.exe
  C:\Windows\System\jlagAEt.exe
  2⤵
  PID:4788
- C:\Windows\System\osNZkSI.exe
  C:\Windows\System\osNZkSI.exe
  2⤵
  PID:4808
- C:\Windows\System\eFClbto.exe
  C:\Windows\System\eFClbto.exe
  2⤵
  PID:4824
- C:\Windows\System\fxwxUDa.exe
  C:\Windows\System\fxwxUDa.exe
  2⤵
  PID:4844
- C:\Windows\System\VzrSCnq.exe
  C:\Windows\System\VzrSCnq.exe
  2⤵
  PID:4860
- C:\Windows\System\iFjYLpX.exe
  C:\Windows\System\iFjYLpX.exe
  2⤵
  PID:4876
- C:\Windows\System\WXaBNZp.exe
  C:\Windows\System\WXaBNZp.exe
  2⤵
  PID:4892
- C:\Windows\System\YZJCayT.exe
  C:\Windows\System\YZJCayT.exe
  2⤵
  PID:4908
- C:\Windows\System\rnHbhib.exe
  C:\Windows\System\rnHbhib.exe
  2⤵
  PID:4924
- C:\Windows\System\AteFSzX.exe
  C:\Windows\System\AteFSzX.exe
  2⤵
  PID:4940
- C:\Windows\System\gPqXTpy.exe
  C:\Windows\System\gPqXTpy.exe
  2⤵
  PID:4956
- C:\Windows\System\vSPcJej.exe
  C:\Windows\System\vSPcJej.exe
  2⤵
  PID:4972
- C:\Windows\System\nyKQsVU.exe
  C:\Windows\System\nyKQsVU.exe
  2⤵
  PID:4988
- C:\Windows\System\OlgzEwV.exe
  C:\Windows\System\OlgzEwV.exe
  2⤵
  PID:5004
- C:\Windows\System\TqlNcZd.exe
  C:\Windows\System\TqlNcZd.exe
  2⤵
  PID:5024
- C:\Windows\System\tpEzBvY.exe
  C:\Windows\System\tpEzBvY.exe
  2⤵
  PID:5040
- C:\Windows\System\sVZxuIz.exe
  C:\Windows\System\sVZxuIz.exe
  2⤵
  PID:5060
- C:\Windows\System\ylQQasC.exe
  C:\Windows\System\ylQQasC.exe
  2⤵
  PID:5076
- C:\Windows\System\CFdondF.exe
  C:\Windows\System\CFdondF.exe
  2⤵
  PID:1440
- C:\Windows\System\evcKWEJ.exe
  C:\Windows\System\evcKWEJ.exe
  2⤵
  PID:4100
- C:\Windows\System\vOJvjzG.exe
  C:\Windows\System\vOJvjzG.exe
  2⤵
  PID:4184
- C:\Windows\System\eGkihJq.exe
  C:\Windows\System\eGkihJq.exe
  2⤵
  PID:4248
- C:\Windows\System\pZgyRNJ.exe
  C:\Windows\System\pZgyRNJ.exe
  2⤵
  PID:4316
- C:\Windows\System\HSJowpS.exe
  C:\Windows\System\HSJowpS.exe
  2⤵
  PID:4104
- C:\Windows\System\QNzvrdX.exe
  C:\Windows\System\QNzvrdX.exe
  2⤵
  PID:4412
- C:\Windows\System\ztCRUjq.exe
  C:\Windows\System\ztCRUjq.exe
  2⤵
  PID:4132
- C:\Windows\System\MMNyHxD.exe
  C:\Windows\System\MMNyHxD.exe
  2⤵
  PID:4232
- C:\Windows\System\BvJiOYb.exe
  C:\Windows\System\BvJiOYb.exe
  2⤵
  PID:4480
- C:\Windows\System\TQNSHzO.exe
  C:\Windows\System\TQNSHzO.exe
  2⤵
  PID:3284
- C:\Windows\System\GhkuhGx.exe
  C:\Windows\System\GhkuhGx.exe
  2⤵
  PID:4532
- C:\Windows\System\ZmUQhnC.exe
  C:\Windows\System\ZmUQhnC.exe
  2⤵
  PID:4552
- C:\Windows\System\JStqzRt.exe
  C:\Windows\System\JStqzRt.exe
  2⤵
  PID:4568
- C:\Windows\System\YrYmMLY.exe
  C:\Windows\System\YrYmMLY.exe
  2⤵
  PID:4584
- C:\Windows\System\jWQMjsi.exe
  C:\Windows\System\jWQMjsi.exe
  2⤵
  PID:4624
- C:\Windows\System\xmoITDI.exe
  C:\Windows\System\xmoITDI.exe
  2⤵
  PID:4368
- C:\Windows\System\IPWRwCg.exe
  C:\Windows\System\IPWRwCg.exe
  2⤵
  PID:4432
- C:\Windows\System\tKBnKwM.exe
  C:\Windows\System\tKBnKwM.exe
  2⤵
  PID:4496
- C:\Windows\System\TBHXxvl.exe
  C:\Windows\System\TBHXxvl.exe
  2⤵
  PID:4656
- C:\Windows\System\XeqrHoa.exe
  C:\Windows\System\XeqrHoa.exe
  2⤵
  PID:4816
- C:\Windows\System\AJeyHUL.exe
  C:\Windows\System\AJeyHUL.exe
  2⤵
  PID:5048
- C:\Windows\System\aQXdGhF.exe
  C:\Windows\System\aQXdGhF.exe
  2⤵
  PID:4636
- C:\Windows\System\gbeevhI.exe
  C:\Windows\System\gbeevhI.exe
  2⤵
  PID:4704
- C:\Windows\System\xYXGSOF.exe
  C:\Windows\System\xYXGSOF.exe
  2⤵
  PID:4796
- C:\Windows\System\ujVktmG.exe
  C:\Windows\System\ujVktmG.exe
  2⤵
  PID:4748
- C:\Windows\System\DLicfEu.exe
  C:\Windows\System\DLicfEu.exe
  2⤵
  PID:4888
- C:\Windows\System\lQZKsHQ.exe
  C:\Windows\System\lQZKsHQ.exe
  2⤵
  PID:4980
- C:\Windows\System\vCwtGcE.exe
  C:\Windows\System\vCwtGcE.exe
  2⤵
  PID:5052
- C:\Windows\System\nHuoxsc.exe
  C:\Windows\System\nHuoxsc.exe
  2⤵
  PID:5100
- C:\Windows\System\vqbudfT.exe
  C:\Windows\System\vqbudfT.exe
  2⤵
  PID:4836
- C:\Windows\System\hjkJjDe.exe
  C:\Windows\System\hjkJjDe.exe
  2⤵
  PID:4900
- C:\Windows\System\XHQltJu.exe
  C:\Windows\System\XHQltJu.exe
  2⤵
  PID:5116
- C:\Windows\System\tiDDWVx.exe
  C:\Windows\System\tiDDWVx.exe
  2⤵
  PID:1928
- C:\Windows\System\jAcGVwB.exe
  C:\Windows\System\jAcGVwB.exe
  2⤵
  PID:4444
- C:\Windows\System\hxFAwzd.exe
  C:\Windows\System\hxFAwzd.exe
  2⤵
  PID:4932
- C:\Windows\System\HGafbDt.exe
  C:\Windows\System\HGafbDt.exe
  2⤵
  PID:4384
- C:\Windows\System\GrlXLSr.exe
  C:\Windows\System\GrlXLSr.exe
  2⤵
  PID:4180
- C:\Windows\System\fEywGEX.exe
  C:\Windows\System\fEywGEX.exe
  2⤵
  PID:2184
- C:\Windows\System\EJfSYZY.exe
  C:\Windows\System\EJfSYZY.exe
  2⤵
  PID:4228
- C:\Windows\System\ntzsWSs.exe
  C:\Windows\System\ntzsWSs.exe
  2⤵
  PID:4548
- C:\Windows\System\xiYRmMr.exe
  C:\Windows\System\xiYRmMr.exe
  2⤵
  PID:4364
- C:\Windows\System\WCJRLVh.exe
  C:\Windows\System\WCJRLVh.exe
  2⤵
  PID:4800
- C:\Windows\System\tjssHqr.exe
  C:\Windows\System\tjssHqr.exe
  2⤵
  PID:5016
- C:\Windows\System\RYtkHmj.exe
  C:\Windows\System\RYtkHmj.exe
  2⤵
  PID:3992
- C:\Windows\System\VEJGOhy.exe
  C:\Windows\System\VEJGOhy.exe
  2⤵
  PID:4968
- C:\Windows\System\HSOUPEf.exe
  C:\Windows\System\HSOUPEf.exe
  2⤵
  PID:4996
- C:\Windows\System\qBOsTeL.exe
  C:\Windows\System\qBOsTeL.exe
  2⤵
  PID:4620
- C:\Windows\System\JeNfaWT.exe
  C:\Windows\System\JeNfaWT.exe
  2⤵
  PID:4400
- C:\Windows\System\gitLHcJ.exe
  C:\Windows\System\gitLHcJ.exe
  2⤵
  PID:4428
- C:\Windows\System\wIkPOZO.exe
  C:\Windows\System\wIkPOZO.exe
  2⤵
  PID:4216
- C:\Windows\System\QbeglmK.exe
  C:\Windows\System\QbeglmK.exe
  2⤵
  PID:3948
- C:\Windows\System\gWBpKtD.exe
  C:\Windows\System\gWBpKtD.exe
  2⤵
  PID:5136
- C:\Windows\System\GiSQSyU.exe
  C:\Windows\System\GiSQSyU.exe
  2⤵
  PID:5152
- C:\Windows\System\LcKnVey.exe
  C:\Windows\System\LcKnVey.exe
  2⤵
  PID:5168
- C:\Windows\System\bmxgfgB.exe
  C:\Windows\System\bmxgfgB.exe
  2⤵
  PID:5184
- C:\Windows\System\pVYtbRo.exe
  C:\Windows\System\pVYtbRo.exe
  2⤵
  PID:5200
- C:\Windows\System\XvvxoJi.exe
  C:\Windows\System\XvvxoJi.exe
  2⤵
  PID:5220
- C:\Windows\System\alRhTLM.exe
  C:\Windows\System\alRhTLM.exe
  2⤵
  PID:5260
- C:\Windows\System\ZlIEqMS.exe
  C:\Windows\System\ZlIEqMS.exe
  2⤵
  PID:5288
- C:\Windows\System\lCnLYcf.exe
  C:\Windows\System\lCnLYcf.exe
  2⤵
  PID:5320
- C:\Windows\System\WmKpKcT.exe
  C:\Windows\System\WmKpKcT.exe
  2⤵
  PID:5336
- C:\Windows\System\eaHIOlp.exe
  C:\Windows\System\eaHIOlp.exe
  2⤵
  PID:5352
- C:\Windows\System\jLEUckO.exe
  C:\Windows\System\jLEUckO.exe
  2⤵
  PID:5368
- C:\Windows\System\fKoWSEk.exe
  C:\Windows\System\fKoWSEk.exe
  2⤵
  PID:5388
- C:\Windows\System\yElhgTh.exe
  C:\Windows\System\yElhgTh.exe
  2⤵
  PID:5404
- C:\Windows\System\cExOGhW.exe
  C:\Windows\System\cExOGhW.exe
  2⤵
  PID:5424
- C:\Windows\System\avCaSzR.exe
  C:\Windows\System\avCaSzR.exe
  2⤵
  PID:5440
- C:\Windows\System\BRBYRJL.exe
  C:\Windows\System\BRBYRJL.exe
  2⤵
  PID:5456
- C:\Windows\System\SfgjeEh.exe
  C:\Windows\System\SfgjeEh.exe
  2⤵
  PID:5472
- C:\Windows\System\FYFyQCQ.exe
  C:\Windows\System\FYFyQCQ.exe
  2⤵
  PID:5488
- C:\Windows\System\ggWjZOt.exe
  C:\Windows\System\ggWjZOt.exe
  2⤵
  PID:5504
- C:\Windows\System\wQgVPAT.exe
  C:\Windows\System\wQgVPAT.exe
  2⤵
  PID:5520
- C:\Windows\System\GjwGLJp.exe
  C:\Windows\System\GjwGLJp.exe
  2⤵
  PID:5536
- C:\Windows\System\qknIQkd.exe
  C:\Windows\System\qknIQkd.exe
  2⤵
  PID:5592
- C:\Windows\System\kmEjtpy.exe
  C:\Windows\System\kmEjtpy.exe
  2⤵
  PID:5608
- C:\Windows\System\iNyMJbR.exe
  C:\Windows\System\iNyMJbR.exe
  2⤵
  PID:5624
- C:\Windows\System\jJpABRp.exe
  C:\Windows\System\jJpABRp.exe
  2⤵
  PID:5640
- C:\Windows\System\eZkOtoT.exe
  C:\Windows\System\eZkOtoT.exe
  2⤵
  PID:5656
- C:\Windows\System\bkeglmo.exe
  C:\Windows\System\bkeglmo.exe
  2⤵
  PID:5672
- C:\Windows\System\SRBhTbm.exe
  C:\Windows\System\SRBhTbm.exe
  2⤵
  PID:5688
- C:\Windows\System\UddHSSO.exe
  C:\Windows\System\UddHSSO.exe
  2⤵
  PID:5704
- C:\Windows\System\CoPGWfe.exe
  C:\Windows\System\CoPGWfe.exe
  2⤵
  PID:5720
- C:\Windows\System\yoCPaJx.exe
  C:\Windows\System\yoCPaJx.exe
  2⤵
  PID:5736
- C:\Windows\System\PGJNDqO.exe
  C:\Windows\System\PGJNDqO.exe
  2⤵
  PID:5752
- C:\Windows\System\XQeAYJQ.exe
  C:\Windows\System\XQeAYJQ.exe
  2⤵
  PID:5768
- C:\Windows\System\VPFNCIO.exe
  C:\Windows\System\VPFNCIO.exe
  2⤵
  PID:5784
- C:\Windows\System\vPABana.exe
  C:\Windows\System\vPABana.exe
  2⤵
  PID:5800
- C:\Windows\System\zGxhYTQ.exe
  C:\Windows\System\zGxhYTQ.exe
  2⤵
  PID:5816
- C:\Windows\System\PolSyqu.exe
  C:\Windows\System\PolSyqu.exe
  2⤵
  PID:5832
- C:\Windows\System\mhsMTzh.exe
  C:\Windows\System\mhsMTzh.exe
  2⤵
  PID:5848
- C:\Windows\System\CSvhyLb.exe
  C:\Windows\System\CSvhyLb.exe
  2⤵
  PID:5864
- C:\Windows\System\OVhmcrF.exe
  C:\Windows\System\OVhmcrF.exe
  2⤵
  PID:5880
- C:\Windows\System\XMtvdwQ.exe
  C:\Windows\System\XMtvdwQ.exe
  2⤵
  PID:5896
- C:\Windows\System\qnWlNRx.exe
  C:\Windows\System\qnWlNRx.exe
  2⤵
  PID:5912
- C:\Windows\System\sedXUZr.exe
  C:\Windows\System\sedXUZr.exe
  2⤵
  PID:5928
- C:\Windows\System\XCdSYPk.exe
  C:\Windows\System\XCdSYPk.exe
  2⤵
  PID:6000
- C:\Windows\System\EFmRoAD.exe
  C:\Windows\System\EFmRoAD.exe
  2⤵
  PID:6016
- C:\Windows\System\WrhPggK.exe
  C:\Windows\System\WrhPggK.exe
  2⤵
  PID:6048
- C:\Windows\System\eeTkXzw.exe
  C:\Windows\System\eeTkXzw.exe
  2⤵
  PID:6076
- C:\Windows\System\yjZXqpJ.exe
  C:\Windows\System\yjZXqpJ.exe
  2⤵
  PID:6092
- C:\Windows\System\DrPGapS.exe
  C:\Windows\System\DrPGapS.exe
  2⤵
  PID:6108
- C:\Windows\System\mBJlPnC.exe
  C:\Windows\System\mBJlPnC.exe
  2⤵
  PID:6124
- C:\Windows\System\VPSzigc.exe
  C:\Windows\System\VPSzigc.exe
  2⤵
  PID:6140
- C:\Windows\System\kJmghyA.exe
  C:\Windows\System\kJmghyA.exe
  2⤵
  PID:4608
- C:\Windows\System\gWWGKZu.exe
  C:\Windows\System\gWWGKZu.exe
  2⤵
  PID:4676
- C:\Windows\System\jZGqaia.exe
  C:\Windows\System\jZGqaia.exe
  2⤵
  PID:4952
- C:\Windows\System\WCdLgwC.exe
  C:\Windows\System\WCdLgwC.exe
  2⤵
  PID:4872
- C:\Windows\System\LpWEEKF.exe
  C:\Windows\System\LpWEEKF.exe
  2⤵
  PID:4540
- C:\Windows\System\VldJPqo.exe
  C:\Windows\System\VldJPqo.exe
  2⤵
  PID:4592
- C:\Windows\System\jEJkKSj.exe
  C:\Windows\System\jEJkKSj.exe
  2⤵
  PID:3548
- C:\Windows\System\GLMBJRL.exe
  C:\Windows\System\GLMBJRL.exe
  2⤵
  PID:4740
- C:\Windows\System\VTYeqxU.exe
  C:\Windows\System\VTYeqxU.exe
  2⤵
  PID:5072
- C:\Windows\System\EuBDijx.exe
  C:\Windows\System\EuBDijx.exe
  2⤵
  PID:5128
- C:\Windows\System\rSGsZPa.exe
  C:\Windows\System\rSGsZPa.exe
  2⤵
  PID:5192
- C:\Windows\System\BWAdshf.exe
  C:\Windows\System\BWAdshf.exe
  2⤵
  PID:5228
- C:\Windows\System\SuRJOxU.exe
  C:\Windows\System\SuRJOxU.exe
  2⤵
  PID:5244
- C:\Windows\System\ZEtKtjs.exe
  C:\Windows\System\ZEtKtjs.exe
  2⤵
  PID:5296
- C:\Windows\System\VUihyQB.exe
  C:\Windows\System\VUihyQB.exe
  2⤵
  PID:5312
- C:\Windows\System\KqWXPRX.exe
  C:\Windows\System\KqWXPRX.exe
  2⤵
  PID:5384
- C:\Windows\System\LcywQzU.exe
  C:\Windows\System\LcywQzU.exe
  2⤵
  PID:5420
- C:\Windows\System\KoSLIKe.exe
  C:\Windows\System\KoSLIKe.exe
  2⤵
  PID:5516
- C:\Windows\System\NnvNxaO.exe
  C:\Windows\System\NnvNxaO.exe
  2⤵
  PID:5548
- C:\Windows\System\eSwdwPU.exe
  C:\Windows\System\eSwdwPU.exe
  2⤵
  PID:4152
- C:\Windows\System\wUGMfnE.exe
  C:\Windows\System\wUGMfnE.exe
  2⤵
  PID:5572
- C:\Windows\System\cUqCeGM.exe
  C:\Windows\System\cUqCeGM.exe
  2⤵
  PID:5680
- C:\Windows\System\DvugMdA.exe
  C:\Windows\System\DvugMdA.exe
  2⤵
  PID:5616
- C:\Windows\System\owWswvx.exe
  C:\Windows\System\owWswvx.exe
  2⤵
  PID:5648
- C:\Windows\System\vufeSBV.exe
  C:\Windows\System\vufeSBV.exe
  2⤵
  PID:5748
- C:\Windows\System\VxNNGtC.exe
  C:\Windows\System\VxNNGtC.exe
  2⤵
  PID:5876
- C:\Windows\System\lYblgHi.exe
  C:\Windows\System\lYblgHi.exe
  2⤵
  PID:5948
- C:\Windows\System\QRHGzEx.exe
  C:\Windows\System\QRHGzEx.exe
  2⤵
  PID:5964
- C:\Windows\System\uPFNPiA.exe
  C:\Windows\System\uPFNPiA.exe
  2⤵
  PID:5980
- C:\Windows\System\nyMNqwA.exe
  C:\Windows\System\nyMNqwA.exe
  2⤵
  PID:5996
- C:\Windows\System\ozqyqUq.exe
  C:\Windows\System\ozqyqUq.exe
  2⤵
  PID:5280
- C:\Windows\System\HOzQUow.exe
  C:\Windows\System\HOzQUow.exe
  2⤵
  PID:5364
- C:\Windows\System\SceBgxM.exe
  C:\Windows\System\SceBgxM.exe
  2⤵
  PID:5500
- C:\Windows\System\uniAxLl.exe
  C:\Windows\System\uniAxLl.exe
  2⤵
  PID:5664
- C:\Windows\System\zuzVcuu.exe
  C:\Windows\System\zuzVcuu.exe
  2⤵
  PID:5728
- C:\Windows\System\XLAZeyQ.exe
  C:\Windows\System\XLAZeyQ.exe
  2⤵
  PID:5792
- C:\Windows\System\ZNiMIPe.exe
  C:\Windows\System\ZNiMIPe.exe
  2⤵
  PID:5012
- C:\Windows\System\NfOBFRE.exe
  C:\Windows\System\NfOBFRE.exe
  2⤵
  PID:5212
- C:\Windows\System\abDDGjg.exe
  C:\Windows\System\abDDGjg.exe
  2⤵
  PID:5272
- C:\Windows\System\NcFHmcl.exe
  C:\Windows\System\NcFHmcl.exe
  2⤵
  PID:5432
- C:\Windows\System\WwSCopG.exe
  C:\Windows\System\WwSCopG.exe
  2⤵
  PID:5796
- C:\Windows\System\LgPRGQG.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes