xmrig | 36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
Size

1.5MB
MD5

34d0a930653c406a8135fda8d097a8d7
SHA1

bb582c4f36fe5e46557d1d0265958b1b5d864c0f
SHA256

36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86
SHA512

88c303e5b375ebd050603067f2155e8d3194e2e1597b147bf1882a74cdae24ed2cd34a1acef3bc3fa98514b11bd06d8236b6f3b81e87cc0c2b50e007f4b3e011
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5pbkTPLEKA0:GezaTF8FcNkNdfE0pZ9ozttwIRxecd4X

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c00000001202c-2.dat	xmrig
behavioral1/files/0x000500000001962d-160.dat	xmrig
behavioral1/files/0x0005000000019629-150.dat	xmrig
behavioral1/files/0x000500000001962b-153.dat	xmrig
behavioral1/files/0x0005000000019625-134.dat	xmrig
behavioral1/files/0x0005000000019623-129.dat	xmrig
behavioral1/files/0x0005000000019627-141.dat	xmrig
behavioral1/files/0x0005000000019624-138.dat	xmrig
behavioral1/files/0x0005000000019621-125.dat	xmrig
behavioral1/files/0x00050000000195f0-119.dat	xmrig
behavioral1/files/0x000500000001958e-109.dat	xmrig
behavioral1/files/0x00050000000195ab-114.dat	xmrig
behavioral1/files/0x000500000001957e-104.dat	xmrig
behavioral1/files/0x0005000000019512-99.dat	xmrig
behavioral1/files/0x000500000001950e-94.dat	xmrig
behavioral1/files/0x0005000000019509-89.dat	xmrig
behavioral1/files/0x0005000000019502-84.dat	xmrig
behavioral1/files/0x00050000000194f1-79.dat	xmrig
behavioral1/files/0x00050000000194ee-74.dat	xmrig
behavioral1/files/0x00050000000194c9-69.dat	xmrig
behavioral1/files/0x00050000000194b9-64.dat	xmrig
behavioral1/files/0x00050000000194a9-59.dat	xmrig
behavioral1/files/0x0005000000019458-54.dat	xmrig
behavioral1/files/0x0005000000019451-49.dat	xmrig
behavioral1/files/0x00070000000193c4-40.dat	xmrig
behavioral1/files/0x00060000000193df-44.dat	xmrig
behavioral1/files/0x0006000000018739-28.dat	xmrig
behavioral1/files/0x00060000000186f4-27.dat	xmrig
behavioral1/files/0x0006000000018744-33.dat	xmrig
behavioral1/files/0x0006000000018704-21.dat	xmrig
behavioral1/files/0x00070000000186f1-13.dat	xmrig
behavioral1/files/0x00070000000186ed-9.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
892	gSybaOz.exe
2432	noXatkn.exe
2396	tgqBQCd.exe
2612	VakTcRg.exe
1880	iPpLTTr.exe
1668	ycCZbYy.exe
2220	ObvwGZS.exe
2080	lGKFbXw.exe
2892	UGyBrrb.exe
2836	RmBvgKz.exe
2248	kPkBIrn.exe
2900	oJxcwCE.exe
3016	YrrDDEn.exe
2820	IIFNktn.exe
2896	vpHJFXh.exe
2700	HIHUECs.exe
2756	eBFTkog.exe
552	DbpmFSS.exe
572	xIHqzNV.exe
3000	iwqlwXg.exe
3068	hyzWrUP.exe
2504	dpkQgaW.exe
2784	lLVVTFh.exe
3024	ELLiAPT.exe
1984	IIAQrwB.exe
856	unDNbsw.exe
1960	DSQqVAl.exe
2332	RXEaicA.exe
2644	QPKhcJr.exe
2156	DCgHxLM.exe
1596	glkYgib.exe
404	kcrwjMO.exe
1412	YIkkrWp.exe
2000	YqWamhS.exe
1312	RezGfOZ.exe
944	rKDwuts.exe
1268	OLAryuR.exe
328	WYfbejp.exe
1028	yKaZIsF.exe
3044	rSHYyHX.exe
1488	gMSmUEl.exe
2176	VsPXMNC.exe
2236	MCaiJmI.exe
708	wVHQeBK.exe
2580	NnySLJO.exe
2268	iZeDvUT.exe
1468	hnPQdUu.exe
2544	pqbbGqh.exe
2228	jADvjAK.exe
2768	ctaNErv.exe
1580	znAoxdf.exe
888	Uxhmazh.exe
2208	JLEeoHb.exe
2496	SrCAAhj.exe
1644	EYUSpNu.exe
1456	uEPsMHY.exe
1052	peqGmrX.exe
1664	cwZHhlp.exe
2600	xzyBFVM.exe
1020	NKlWkDd.exe
2880	MDFYwZr.exe
2688	YMMMQiJ.exe
2716	mcFWpIv.exe
3032	VOzqjTu.exe

Loads dropped DLL 64 IoCs

pid	Process
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bMkcVhB.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\KtoPvxi.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\SrvmiGd.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\snPXFLk.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\vlWKoIw.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\niaXfek.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\xtrkxmg.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\SGuyhuu.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\YCkXdTs.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\hzEBBir.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\MlDbcCp.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\eEMKFeZ.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\OhvVqnD.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\maPNkTN.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\ACNqAxl.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\RdhLTBm.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\GHleyXW.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\tkzfDpJ.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\LpQAtgY.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\yKaZIsF.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\jbDdFWM.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\Pvoygpl.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\oNNBKXP.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\dvxaGVm.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\ALRwJMg.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\ELLiAPT.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\DIckUJN.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\KDktkNq.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\jksSAEK.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\tGSVKhd.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\cqJJIms.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\Mgnafrw.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\OPXXtcR.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\JmoqlWD.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\OfNHSgD.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\LgfhVaV.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\dqEuzLp.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\DmyCyVA.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\VZOqZqb.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\AngAjhp.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\kFBtQnz.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\ElsnogR.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\gkNaqEz.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\LzNmysO.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\YynpmvO.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\oHKuEtz.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\QLoAHnc.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\BFyYdOC.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\bTMDruD.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\BDqxiNh.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\hNnzxam.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\LuxzwcY.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\AdbKqfD.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\lFCScgn.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\iuLfBlv.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\mYqgKbY.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\ecflvQF.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\YMMMQiJ.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\fTjDoFE.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\LTYyaQu.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\QqYvZzf.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\WSAYbFf.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\PmLDvXm.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
File created	C:\Windows\System\xSIFqfu.exe	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 892	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	31
PID 2404 wrote to memory of 892	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	31
PID 2404 wrote to memory of 892	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	31
PID 2404 wrote to memory of 2432	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	32
PID 2404 wrote to memory of 2432	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	32
PID 2404 wrote to memory of 2432	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	32
PID 2404 wrote to memory of 2396	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	33
PID 2404 wrote to memory of 2396	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	33
PID 2404 wrote to memory of 2396	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	33
PID 2404 wrote to memory of 1880	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	34
PID 2404 wrote to memory of 1880	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	34
PID 2404 wrote to memory of 1880	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	34
PID 2404 wrote to memory of 2612	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	35
PID 2404 wrote to memory of 2612	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	35
PID 2404 wrote to memory of 2612	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	35
PID 2404 wrote to memory of 1668	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	36
PID 2404 wrote to memory of 1668	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	36
PID 2404 wrote to memory of 1668	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	36
PID 2404 wrote to memory of 2220	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	37
PID 2404 wrote to memory of 2220	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	37
PID 2404 wrote to memory of 2220	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	37
PID 2404 wrote to memory of 2080	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	38
PID 2404 wrote to memory of 2080	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	38
PID 2404 wrote to memory of 2080	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	38
PID 2404 wrote to memory of 2892	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	39
PID 2404 wrote to memory of 2892	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	39
PID 2404 wrote to memory of 2892	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	39
PID 2404 wrote to memory of 2836	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	40
PID 2404 wrote to memory of 2836	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	40
PID 2404 wrote to memory of 2836	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	40
PID 2404 wrote to memory of 2248	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	41
PID 2404 wrote to memory of 2248	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	41
PID 2404 wrote to memory of 2248	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	41
PID 2404 wrote to memory of 2900	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	42
PID 2404 wrote to memory of 2900	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	42
PID 2404 wrote to memory of 2900	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	42
PID 2404 wrote to memory of 3016	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	43
PID 2404 wrote to memory of 3016	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	43
PID 2404 wrote to memory of 3016	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	43
PID 2404 wrote to memory of 2820	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	44
PID 2404 wrote to memory of 2820	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	44
PID 2404 wrote to memory of 2820	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	44
PID 2404 wrote to memory of 2896	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	45
PID 2404 wrote to memory of 2896	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	45
PID 2404 wrote to memory of 2896	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	45
PID 2404 wrote to memory of 2700	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	46
PID 2404 wrote to memory of 2700	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	46
PID 2404 wrote to memory of 2700	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	46
PID 2404 wrote to memory of 2756	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	47
PID 2404 wrote to memory of 2756	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	47
PID 2404 wrote to memory of 2756	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	47
PID 2404 wrote to memory of 552	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	48
PID 2404 wrote to memory of 552	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	48
PID 2404 wrote to memory of 552	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	48
PID 2404 wrote to memory of 572	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	49
PID 2404 wrote to memory of 572	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	49
PID 2404 wrote to memory of 572	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	49
PID 2404 wrote to memory of 3000	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	50
PID 2404 wrote to memory of 3000	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	50
PID 2404 wrote to memory of 3000	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	50
PID 2404 wrote to memory of 3068	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	51
PID 2404 wrote to memory of 3068	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	51
PID 2404 wrote to memory of 3068	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	51
PID 2404 wrote to memory of 2504	2404	36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe	52

C:\Users\Admin\AppData\Local\Temp\36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe
"C:\Users\Admin\AppData\Local\Temp\36c3eb1ddb2b5069dbcbd596dec1fa8157b9b4f89fe6a7e1f91586e2caf7ef86.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\System\gSybaOz.exe
  C:\Windows\System\gSybaOz.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\noXatkn.exe
  C:\Windows\System\noXatkn.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\tgqBQCd.exe
  C:\Windows\System\tgqBQCd.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\iPpLTTr.exe
  C:\Windows\System\iPpLTTr.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\VakTcRg.exe
  C:\Windows\System\VakTcRg.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\ycCZbYy.exe
  C:\Windows\System\ycCZbYy.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\ObvwGZS.exe
  C:\Windows\System\ObvwGZS.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\lGKFbXw.exe
  C:\Windows\System\lGKFbXw.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\UGyBrrb.exe
  C:\Windows\System\UGyBrrb.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\RmBvgKz.exe
  C:\Windows\System\RmBvgKz.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\kPkBIrn.exe
  C:\Windows\System\kPkBIrn.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\oJxcwCE.exe
  C:\Windows\System\oJxcwCE.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\YrrDDEn.exe
  C:\Windows\System\YrrDDEn.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\IIFNktn.exe
  C:\Windows\System\IIFNktn.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\vpHJFXh.exe
  C:\Windows\System\vpHJFXh.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\HIHUECs.exe
  C:\Windows\System\HIHUECs.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\eBFTkog.exe
  C:\Windows\System\eBFTkog.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\DbpmFSS.exe
  C:\Windows\System\DbpmFSS.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\xIHqzNV.exe
  C:\Windows\System\xIHqzNV.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\iwqlwXg.exe
  C:\Windows\System\iwqlwXg.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\hyzWrUP.exe
  C:\Windows\System\hyzWrUP.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\dpkQgaW.exe
  C:\Windows\System\dpkQgaW.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\lLVVTFh.exe
  C:\Windows\System\lLVVTFh.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\ELLiAPT.exe
  C:\Windows\System\ELLiAPT.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\IIAQrwB.exe
  C:\Windows\System\IIAQrwB.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\unDNbsw.exe
  C:\Windows\System\unDNbsw.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\DSQqVAl.exe
  C:\Windows\System\DSQqVAl.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\QPKhcJr.exe
  C:\Windows\System\QPKhcJr.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\RXEaicA.exe
  C:\Windows\System\RXEaicA.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\DCgHxLM.exe
  C:\Windows\System\DCgHxLM.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\glkYgib.exe
  C:\Windows\System\glkYgib.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\kcrwjMO.exe
  C:\Windows\System\kcrwjMO.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\YIkkrWp.exe
  C:\Windows\System\YIkkrWp.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\YqWamhS.exe
  C:\Windows\System\YqWamhS.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\RezGfOZ.exe
  C:\Windows\System\RezGfOZ.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\rKDwuts.exe
  C:\Windows\System\rKDwuts.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\OLAryuR.exe
  C:\Windows\System\OLAryuR.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\WYfbejp.exe
  C:\Windows\System\WYfbejp.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\yKaZIsF.exe
  C:\Windows\System\yKaZIsF.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\rSHYyHX.exe
  C:\Windows\System\rSHYyHX.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\gMSmUEl.exe
  C:\Windows\System\gMSmUEl.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\VsPXMNC.exe
  C:\Windows\System\VsPXMNC.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\MCaiJmI.exe
  C:\Windows\System\MCaiJmI.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\wVHQeBK.exe
  C:\Windows\System\wVHQeBK.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\NnySLJO.exe
  C:\Windows\System\NnySLJO.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\iZeDvUT.exe
  C:\Windows\System\iZeDvUT.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\hnPQdUu.exe
  C:\Windows\System\hnPQdUu.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\pqbbGqh.exe
  C:\Windows\System\pqbbGqh.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\jADvjAK.exe
  C:\Windows\System\jADvjAK.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\ctaNErv.exe
  C:\Windows\System\ctaNErv.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\znAoxdf.exe
  C:\Windows\System\znAoxdf.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\Uxhmazh.exe
  C:\Windows\System\Uxhmazh.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\JLEeoHb.exe
  C:\Windows\System\JLEeoHb.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\SrCAAhj.exe
  C:\Windows\System\SrCAAhj.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\EYUSpNu.exe
  C:\Windows\System\EYUSpNu.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\uEPsMHY.exe
  C:\Windows\System\uEPsMHY.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\peqGmrX.exe
  C:\Windows\System\peqGmrX.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\cwZHhlp.exe
  C:\Windows\System\cwZHhlp.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\xzyBFVM.exe
  C:\Windows\System\xzyBFVM.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\NKlWkDd.exe
  C:\Windows\System\NKlWkDd.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\MDFYwZr.exe
  C:\Windows\System\MDFYwZr.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\YMMMQiJ.exe
  C:\Windows\System\YMMMQiJ.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\mcFWpIv.exe
  C:\Windows\System\mcFWpIv.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\VOzqjTu.exe
  C:\Windows\System\VOzqjTu.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\GxEjAgb.exe
  C:\Windows\System\GxEjAgb.exe
  2⤵
  PID:2696
- C:\Windows\System\zxHSsaB.exe
  C:\Windows\System\zxHSsaB.exe
  2⤵
  PID:2748
- C:\Windows\System\VZbYTbV.exe
  C:\Windows\System\VZbYTbV.exe
  2⤵
  PID:1420
- C:\Windows\System\GoaXcOk.exe
  C:\Windows\System\GoaXcOk.exe
  2⤵
  PID:920
- C:\Windows\System\uVHDsCR.exe
  C:\Windows\System\uVHDsCR.exe
  2⤵
  PID:1712
- C:\Windows\System\mYVCIAa.exe
  C:\Windows\System\mYVCIAa.exe
  2⤵
  PID:2752
- C:\Windows\System\EfDsFVq.exe
  C:\Windows\System\EfDsFVq.exe
  2⤵
  PID:264
- C:\Windows\System\VeFIOWk.exe
  C:\Windows\System\VeFIOWk.exe
  2⤵
  PID:1936
- C:\Windows\System\nLeOirE.exe
  C:\Windows\System\nLeOirE.exe
  2⤵
  PID:2136
- C:\Windows\System\xcZIclc.exe
  C:\Windows\System\xcZIclc.exe
  2⤵
  PID:2444
- C:\Windows\System\WBniBAX.exe
  C:\Windows\System\WBniBAX.exe
  2⤵
  PID:1636
- C:\Windows\System\SXiYMtm.exe
  C:\Windows\System\SXiYMtm.exe
  2⤵
  PID:1516
- C:\Windows\System\exTUgXw.exe
  C:\Windows\System\exTUgXw.exe
  2⤵
  PID:1296
- C:\Windows\System\fmiHcta.exe
  C:\Windows\System\fmiHcta.exe
  2⤵
  PID:1992
- C:\Windows\System\zOLcrtc.exe
  C:\Windows\System\zOLcrtc.exe
  2⤵
  PID:376
- C:\Windows\System\oqejMrL.exe
  C:\Windows\System\oqejMrL.exe
  2⤵
  PID:2636
- C:\Windows\System\ENpCXlQ.exe
  C:\Windows\System\ENpCXlQ.exe
  2⤵
  PID:1232
- C:\Windows\System\HaIbdSp.exe
  C:\Windows\System\HaIbdSp.exe
  2⤵
  PID:1224
- C:\Windows\System\ntGAlpT.exe
  C:\Windows\System\ntGAlpT.exe
  2⤵
  PID:1360
- C:\Windows\System\bKkWMuW.exe
  C:\Windows\System\bKkWMuW.exe
  2⤵
  PID:2284
- C:\Windows\System\dTxbmUg.exe
  C:\Windows\System\dTxbmUg.exe
  2⤵
  PID:564
- C:\Windows\System\BSLoVUZ.exe
  C:\Windows\System\BSLoVUZ.exe
  2⤵
  PID:2244
- C:\Windows\System\HxeVwwq.exe
  C:\Windows\System\HxeVwwq.exe
  2⤵
  PID:1860
- C:\Windows\System\YCBaEXD.exe
  C:\Windows\System\YCBaEXD.exe
  2⤵
  PID:896
- C:\Windows\System\AqspQnK.exe
  C:\Windows\System\AqspQnK.exe
  2⤵
  PID:1544
- C:\Windows\System\MZkoBNn.exe
  C:\Windows\System\MZkoBNn.exe
  2⤵
  PID:1212
- C:\Windows\System\DLvIJnn.exe
  C:\Windows\System\DLvIJnn.exe
  2⤵
  PID:880
- C:\Windows\System\LKndlQv.exe
  C:\Windows\System\LKndlQv.exe
  2⤵
  PID:2552
- C:\Windows\System\IUrkcFI.exe
  C:\Windows\System\IUrkcFI.exe
  2⤵
  PID:2940
- C:\Windows\System\LBFgiKU.exe
  C:\Windows\System\LBFgiKU.exe
  2⤵
  PID:2808
- C:\Windows\System\MWzKmHJ.exe
  C:\Windows\System\MWzKmHJ.exe
  2⤵
  PID:2936
- C:\Windows\System\QMUfCZU.exe
  C:\Windows\System\QMUfCZU.exe
  2⤵
  PID:3084
- C:\Windows\System\TNGfcgX.exe
  C:\Windows\System\TNGfcgX.exe
  2⤵
  PID:3104
- C:\Windows\System\uOjxpYf.exe
  C:\Windows\System\uOjxpYf.exe
  2⤵
  PID:3124
- C:\Windows\System\gulxOzQ.exe
  C:\Windows\System\gulxOzQ.exe
  2⤵
  PID:3148
- C:\Windows\System\IQkPSwG.exe
  C:\Windows\System\IQkPSwG.exe
  2⤵
  PID:3168
- C:\Windows\System\oHKuEtz.exe
  C:\Windows\System\oHKuEtz.exe
  2⤵
  PID:3188
- C:\Windows\System\wIGEZuS.exe
  C:\Windows\System\wIGEZuS.exe
  2⤵
  PID:3208
- C:\Windows\System\DfpiYms.exe
  C:\Windows\System\DfpiYms.exe
  2⤵
  PID:3228
- C:\Windows\System\Gpnfonm.exe
  C:\Windows\System\Gpnfonm.exe
  2⤵
  PID:3248
- C:\Windows\System\aiUUUch.exe
  C:\Windows\System\aiUUUch.exe
  2⤵
  PID:3268
- C:\Windows\System\mjHrCmb.exe
  C:\Windows\System\mjHrCmb.exe
  2⤵
  PID:3288
- C:\Windows\System\DIckUJN.exe
  C:\Windows\System\DIckUJN.exe
  2⤵
  PID:3304
- C:\Windows\System\ibWJvKo.exe
  C:\Windows\System\ibWJvKo.exe
  2⤵
  PID:3328
- C:\Windows\System\KlHDxth.exe
  C:\Windows\System\KlHDxth.exe
  2⤵
  PID:3348
- C:\Windows\System\BHFaYEO.exe
  C:\Windows\System\BHFaYEO.exe
  2⤵
  PID:3368
- C:\Windows\System\rSsKCGK.exe
  C:\Windows\System\rSsKCGK.exe
  2⤵
  PID:3384
- C:\Windows\System\WOlEHWc.exe
  C:\Windows\System\WOlEHWc.exe
  2⤵
  PID:3404
- C:\Windows\System\uCQYgRr.exe
  C:\Windows\System\uCQYgRr.exe
  2⤵
  PID:3424
- C:\Windows\System\TnfasHY.exe
  C:\Windows\System\TnfasHY.exe
  2⤵
  PID:3444
- C:\Windows\System\oroCHyE.exe
  C:\Windows\System\oroCHyE.exe
  2⤵
  PID:3468
- C:\Windows\System\vtzdISx.exe
  C:\Windows\System\vtzdISx.exe
  2⤵
  PID:3484
- C:\Windows\System\SlltqXI.exe
  C:\Windows\System\SlltqXI.exe
  2⤵
  PID:3508
- C:\Windows\System\QLoAHnc.exe
  C:\Windows\System\QLoAHnc.exe
  2⤵
  PID:3524
- C:\Windows\System\SrvmiGd.exe
  C:\Windows\System\SrvmiGd.exe
  2⤵
  PID:3544
- C:\Windows\System\ViaZfIG.exe
  C:\Windows\System\ViaZfIG.exe
  2⤵
  PID:3564
- C:\Windows\System\MNMIPwX.exe
  C:\Windows\System\MNMIPwX.exe
  2⤵
  PID:3584
- C:\Windows\System\GfJlZcU.exe
  C:\Windows\System\GfJlZcU.exe
  2⤵
  PID:3608
- C:\Windows\System\xpAVmPS.exe
  C:\Windows\System\xpAVmPS.exe
  2⤵
  PID:3628
- C:\Windows\System\sCBDnwY.exe
  C:\Windows\System\sCBDnwY.exe
  2⤵
  PID:3644
- C:\Windows\System\NQSfDCq.exe
  C:\Windows\System\NQSfDCq.exe
  2⤵
  PID:3664
- C:\Windows\System\wsvuvjE.exe
  C:\Windows\System\wsvuvjE.exe
  2⤵
  PID:3684
- C:\Windows\System\AjpXWRe.exe
  C:\Windows\System\AjpXWRe.exe
  2⤵
  PID:3708
- C:\Windows\System\CjTfdrk.exe
  C:\Windows\System\CjTfdrk.exe
  2⤵
  PID:3724
- C:\Windows\System\oJuZsNh.exe
  C:\Windows\System\oJuZsNh.exe
  2⤵
  PID:3740
- C:\Windows\System\sgGVqZQ.exe
  C:\Windows\System\sgGVqZQ.exe
  2⤵
  PID:3768
- C:\Windows\System\yVmOhYx.exe
  C:\Windows\System\yVmOhYx.exe
  2⤵
  PID:3788
- C:\Windows\System\SBslgIP.exe
  C:\Windows\System\SBslgIP.exe
  2⤵
  PID:3804
- C:\Windows\System\IDIgYLT.exe
  C:\Windows\System\IDIgYLT.exe
  2⤵
  PID:3828
- C:\Windows\System\BqFelas.exe
  C:\Windows\System\BqFelas.exe
  2⤵
  PID:3848
- C:\Windows\System\sZYaifI.exe
  C:\Windows\System\sZYaifI.exe
  2⤵
  PID:3868
- C:\Windows\System\boyMxix.exe
  C:\Windows\System\boyMxix.exe
  2⤵
  PID:3888
- C:\Windows\System\BBSdTFP.exe
  C:\Windows\System\BBSdTFP.exe
  2⤵
  PID:3908
- C:\Windows\System\DJxSAwi.exe
  C:\Windows\System\DJxSAwi.exe
  2⤵
  PID:3928
- C:\Windows\System\mdgeSmw.exe
  C:\Windows\System\mdgeSmw.exe
  2⤵
  PID:3948
- C:\Windows\System\DKsftcU.exe
  C:\Windows\System\DKsftcU.exe
  2⤵
  PID:3964
- C:\Windows\System\Cfdaefh.exe
  C:\Windows\System\Cfdaefh.exe
  2⤵
  PID:3988
- C:\Windows\System\ihbvJzk.exe
  C:\Windows\System\ihbvJzk.exe
  2⤵
  PID:4004
- C:\Windows\System\vzlRrbJ.exe
  C:\Windows\System\vzlRrbJ.exe
  2⤵
  PID:4020
- C:\Windows\System\ycDSjVy.exe
  C:\Windows\System\ycDSjVy.exe
  2⤵
  PID:4044
- C:\Windows\System\GByeLVe.exe
  C:\Windows\System\GByeLVe.exe
  2⤵
  PID:4064
- C:\Windows\System\pFrDIXo.exe
  C:\Windows\System\pFrDIXo.exe
  2⤵
  PID:4084
- C:\Windows\System\PaGCKqu.exe
  C:\Windows\System\PaGCKqu.exe
  2⤵
  PID:1864
- C:\Windows\System\hSnQWZv.exe
  C:\Windows\System\hSnQWZv.exe
  2⤵
  PID:2772
- C:\Windows\System\DCsIeCB.exe
  C:\Windows\System\DCsIeCB.exe
  2⤵
  PID:480
- C:\Windows\System\ARWjHZL.exe
  C:\Windows\System\ARWjHZL.exe
  2⤵
  PID:3020
- C:\Windows\System\BUTeqDB.exe
  C:\Windows\System\BUTeqDB.exe
  2⤵
  PID:1948
- C:\Windows\System\qnGnzEk.exe
  C:\Windows\System\qnGnzEk.exe
  2⤵
  PID:2264
- C:\Windows\System\zmNYCFC.exe
  C:\Windows\System\zmNYCFC.exe
  2⤵
  PID:1908
- C:\Windows\System\olkYLvS.exe
  C:\Windows\System\olkYLvS.exe
  2⤵
  PID:1840
- C:\Windows\System\ojxHDDB.exe
  C:\Windows\System\ojxHDDB.exe
  2⤵
  PID:1720
- C:\Windows\System\daZbYLR.exe
  C:\Windows\System\daZbYLR.exe
  2⤵
  PID:1288
- C:\Windows\System\EEpPrGS.exe
  C:\Windows\System\EEpPrGS.exe
  2⤵
  PID:2056
- C:\Windows\System\HtSAdsT.exe
  C:\Windows\System\HtSAdsT.exe
  2⤵
  PID:2288
- C:\Windows\System\DsYZCIu.exe
  C:\Windows\System\DsYZCIu.exe
  2⤵
  PID:1928
- C:\Windows\System\GzIjVfG.exe
  C:\Windows\System\GzIjVfG.exe
  2⤵
  PID:1656
- C:\Windows\System\HsAxbdv.exe
  C:\Windows\System\HsAxbdv.exe
  2⤵
  PID:1540
- C:\Windows\System\GVbtUop.exe
  C:\Windows\System\GVbtUop.exe
  2⤵
  PID:2640
- C:\Windows\System\YRWAUyv.exe
  C:\Windows\System\YRWAUyv.exe
  2⤵
  PID:2092
- C:\Windows\System\WAugIqj.exe
  C:\Windows\System\WAugIqj.exe
  2⤵
  PID:2816
- C:\Windows\System\XvndWpB.exe
  C:\Windows\System\XvndWpB.exe
  2⤵
  PID:3096
- C:\Windows\System\ZAuXVIW.exe
  C:\Windows\System\ZAuXVIW.exe
  2⤵
  PID:3136
- C:\Windows\System\EaIdWWS.exe
  C:\Windows\System\EaIdWWS.exe
  2⤵
  PID:3116
- C:\Windows\System\azGbzkZ.exe
  C:\Windows\System\azGbzkZ.exe
  2⤵
  PID:3164
- C:\Windows\System\MIToeoM.exe
  C:\Windows\System\MIToeoM.exe
  2⤵
  PID:3200
- C:\Windows\System\xpKzkMC.exe
  C:\Windows\System\xpKzkMC.exe
  2⤵
  PID:3260
- C:\Windows\System\cGJDbmy.exe
  C:\Windows\System\cGJDbmy.exe
  2⤵
  PID:3300
- C:\Windows\System\bOSJCvt.exe
  C:\Windows\System\bOSJCvt.exe
  2⤵
  PID:3376
- C:\Windows\System\tyWVmSA.exe
  C:\Windows\System\tyWVmSA.exe
  2⤵
  PID:3356
- C:\Windows\System\wmcXvwb.exe
  C:\Windows\System\wmcXvwb.exe
  2⤵
  PID:3412
- C:\Windows\System\UCdmoIc.exe
  C:\Windows\System\UCdmoIc.exe
  2⤵
  PID:3464
- C:\Windows\System\FoCeoGA.exe
  C:\Windows\System\FoCeoGA.exe
  2⤵
  PID:3432
- C:\Windows\System\eBFoHtW.exe
  C:\Windows\System\eBFoHtW.exe
  2⤵
  PID:3504
- C:\Windows\System\YFXLnRd.exe
  C:\Windows\System\YFXLnRd.exe
  2⤵
  PID:3532
- C:\Windows\System\rYGwLsB.exe
  C:\Windows\System\rYGwLsB.exe
  2⤵
  PID:3556
- C:\Windows\System\PEzPhEH.exe
  C:\Windows\System\PEzPhEH.exe
  2⤵
  PID:3624
- C:\Windows\System\QuUsDTp.exe
  C:\Windows\System\QuUsDTp.exe
  2⤵
  PID:3596
- C:\Windows\System\tUsZonM.exe
  C:\Windows\System\tUsZonM.exe
  2⤵
  PID:3656
- C:\Windows\System\IvWhtio.exe
  C:\Windows\System\IvWhtio.exe
  2⤵
  PID:3672
- C:\Windows\System\yjwOruV.exe
  C:\Windows\System\yjwOruV.exe
  2⤵
  PID:3776
- C:\Windows\System\rNbgmnj.exe
  C:\Windows\System\rNbgmnj.exe
  2⤵
  PID:3748
- C:\Windows\System\ztEzwpv.exe
  C:\Windows\System\ztEzwpv.exe
  2⤵
  PID:3764
- C:\Windows\System\XbSWedM.exe
  C:\Windows\System\XbSWedM.exe
  2⤵
  PID:3820
- C:\Windows\System\yWRKyIN.exe
  C:\Windows\System\yWRKyIN.exe
  2⤵
  PID:3836
- C:\Windows\System\IgFOZNq.exe
  C:\Windows\System\IgFOZNq.exe
  2⤵
  PID:3936
- C:\Windows\System\gEOSSKS.exe
  C:\Windows\System\gEOSSKS.exe
  2⤵
  PID:3884
- C:\Windows\System\lYptlVo.exe
  C:\Windows\System\lYptlVo.exe
  2⤵
  PID:3972
- C:\Windows\System\IwLBNjO.exe
  C:\Windows\System\IwLBNjO.exe
  2⤵
  PID:3956
- C:\Windows\System\RuMKhaj.exe
  C:\Windows\System\RuMKhaj.exe
  2⤵
  PID:4052
- C:\Windows\System\jbDdFWM.exe
  C:\Windows\System\jbDdFWM.exe
  2⤵
  PID:4036
- C:\Windows\System\JAEtHgH.exe
  C:\Windows\System\JAEtHgH.exe
  2⤵
  PID:2684
- C:\Windows\System\tnadEVd.exe
  C:\Windows\System\tnadEVd.exe
  2⤵
  PID:2744
- C:\Windows\System\EwItjWy.exe
  C:\Windows\System\EwItjWy.exe
  2⤵
  PID:1728
- C:\Windows\System\opaUFzi.exe
  C:\Windows\System\opaUFzi.exe
  2⤵
  PID:2972
- C:\Windows\System\BMdKAVB.exe
  C:\Windows\System\BMdKAVB.exe
  2⤵
  PID:2280
- C:\Windows\System\yWiwbMK.exe
  C:\Windows\System\yWiwbMK.exe
  2⤵
  PID:348
- C:\Windows\System\PsDSBTF.exe
  C:\Windows\System\PsDSBTF.exe
  2⤵
  PID:1792
- C:\Windows\System\PpqIYFR.exe
  C:\Windows\System\PpqIYFR.exe
  2⤵
  PID:2616
- C:\Windows\System\AVELzFa.exe
  C:\Windows\System\AVELzFa.exe
  2⤵
  PID:1704
- C:\Windows\System\xZGfsWb.exe
  C:\Windows\System\xZGfsWb.exe
  2⤵
  PID:2472
- C:\Windows\System\LnOMPlv.exe
  C:\Windows\System\LnOMPlv.exe
  2⤵
  PID:2188
- C:\Windows\System\JldJZVB.exe
  C:\Windows\System\JldJZVB.exe
  2⤵
  PID:3100
- C:\Windows\System\yCmkcAI.exe
  C:\Windows\System\yCmkcAI.exe
  2⤵
  PID:1584
- C:\Windows\System\RkjmWZl.exe
  C:\Windows\System\RkjmWZl.exe
  2⤵
  PID:3196
- C:\Windows\System\jfIRwMr.exe
  C:\Windows\System\jfIRwMr.exe
  2⤵
  PID:3156
- C:\Windows\System\ISPUMlY.exe
  C:\Windows\System\ISPUMlY.exe
  2⤵
  PID:3236
- C:\Windows\System\VpWEDAp.exe
  C:\Windows\System\VpWEDAp.exe
  2⤵
  PID:3344
- C:\Windows\System\aLHNtzH.exe
  C:\Windows\System\aLHNtzH.exe
  2⤵
  PID:3364
- C:\Windows\System\OZTBRVy.exe
  C:\Windows\System\OZTBRVy.exe
  2⤵
  PID:3460
- C:\Windows\System\mcZrzxw.exe
  C:\Windows\System\mcZrzxw.exe
  2⤵
  PID:3396
- C:\Windows\System\yBsGlkC.exe
  C:\Windows\System\yBsGlkC.exe
  2⤵
  PID:3552
- C:\Windows\System\ugVEebO.exe
  C:\Windows\System\ugVEebO.exe
  2⤵
  PID:3480
- C:\Windows\System\hyeVxOF.exe
  C:\Windows\System\hyeVxOF.exe
  2⤵
  PID:3616
- C:\Windows\System\BFyYdOC.exe
  C:\Windows\System\BFyYdOC.exe
  2⤵
  PID:3580
- C:\Windows\System\DmyCyVA.exe
  C:\Windows\System\DmyCyVA.exe
  2⤵
  PID:3700
- C:\Windows\System\HLwApsd.exe
  C:\Windows\System\HLwApsd.exe
  2⤵
  PID:3816
- C:\Windows\System\aTCaNBU.exe
  C:\Windows\System\aTCaNBU.exe
  2⤵
  PID:3840
- C:\Windows\System\XqAuyhA.exe
  C:\Windows\System\XqAuyhA.exe
  2⤵
  PID:3924
- C:\Windows\System\mrVPAsN.exe
  C:\Windows\System\mrVPAsN.exe
  2⤵
  PID:4028
- C:\Windows\System\hiXCEHl.exe
  C:\Windows\System\hiXCEHl.exe
  2⤵
  PID:3760
- C:\Windows\System\OETQvgl.exe
  C:\Windows\System\OETQvgl.exe
  2⤵
  PID:3864
- C:\Windows\System\snGtWZL.exe
  C:\Windows\System\snGtWZL.exe
  2⤵
  PID:2216
- C:\Windows\System\mwZnlJK.exe
  C:\Windows\System\mwZnlJK.exe
  2⤵
  PID:4032
- C:\Windows\System\fpJzUii.exe
  C:\Windows\System\fpJzUii.exe
  2⤵
  PID:4080
- C:\Windows\System\PtmgLqI.exe
  C:\Windows\System\PtmgLqI.exe
  2⤵
  PID:2152
- C:\Windows\System\tezoXdE.exe
  C:\Windows\System\tezoXdE.exe
  2⤵
  PID:2620
- C:\Windows\System\gJUGFtW.exe
  C:\Windows\System\gJUGFtW.exe
  2⤵
  PID:3220
- C:\Windows\System\ANrjAWg.exe
  C:\Windows\System\ANrjAWg.exe
  2⤵
  PID:2296
- C:\Windows\System\uIqjRXV.exe
  C:\Windows\System\uIqjRXV.exe
  2⤵
  PID:3520
- C:\Windows\System\OPXXtcR.exe
  C:\Windows\System\OPXXtcR.exe
  2⤵
  PID:1732
- C:\Windows\System\SzYmpXk.exe
  C:\Windows\System\SzYmpXk.exe
  2⤵
  PID:3092
- C:\Windows\System\krfXuio.exe
  C:\Windows\System\krfXuio.exe
  2⤵
  PID:3640
- C:\Windows\System\lyYDzYF.exe
  C:\Windows\System\lyYDzYF.exe
  2⤵
  PID:3824
- C:\Windows\System\yjcOnML.exe
  C:\Windows\System\yjcOnML.exe
  2⤵
  PID:4016
- C:\Windows\System\hkkQQAl.exe
  C:\Windows\System\hkkQQAl.exe
  2⤵
  PID:4104
- C:\Windows\System\WHNTEMU.exe
  C:\Windows\System\WHNTEMU.exe
  2⤵
  PID:4124
- C:\Windows\System\kJzirLg.exe
  C:\Windows\System\kJzirLg.exe
  2⤵
  PID:4144
- C:\Windows\System\iLhYWbU.exe
  C:\Windows\System\iLhYWbU.exe
  2⤵
  PID:4160
- C:\Windows\System\MvDGgjz.exe
  C:\Windows\System\MvDGgjz.exe
  2⤵
  PID:4184
- C:\Windows\System\ZbvrLuc.exe
  C:\Windows\System\ZbvrLuc.exe
  2⤵
  PID:4200
- C:\Windows\System\UfGPogb.exe
  C:\Windows\System\UfGPogb.exe
  2⤵
  PID:4220
- C:\Windows\System\VZoBPni.exe
  C:\Windows\System\VZoBPni.exe
  2⤵
  PID:4240
- C:\Windows\System\BDqxiNh.exe
  C:\Windows\System\BDqxiNh.exe
  2⤵
  PID:4260
- C:\Windows\System\tbpStBt.exe
  C:\Windows\System\tbpStBt.exe
  2⤵
  PID:4284
- C:\Windows\System\iSmKfaE.exe
  C:\Windows\System\iSmKfaE.exe
  2⤵
  PID:4300
- C:\Windows\System\lyGxkvz.exe
  C:\Windows\System\lyGxkvz.exe
  2⤵
  PID:4320
- C:\Windows\System\vEBLmNH.exe
  C:\Windows\System\vEBLmNH.exe
  2⤵
  PID:4336
- C:\Windows\System\wglEYPt.exe
  C:\Windows\System\wglEYPt.exe
  2⤵
  PID:4360
- C:\Windows\System\lGDVGIi.exe
  C:\Windows\System\lGDVGIi.exe
  2⤵
  PID:4380
- C:\Windows\System\bWrJItL.exe
  C:\Windows\System\bWrJItL.exe
  2⤵
  PID:4400
- C:\Windows\System\iCOyCwc.exe
  C:\Windows\System\iCOyCwc.exe
  2⤵
  PID:4416
- C:\Windows\System\IEhfSOZ.exe
  C:\Windows\System\IEhfSOZ.exe
  2⤵
  PID:4444
- C:\Windows\System\pMAoMFD.exe
  C:\Windows\System\pMAoMFD.exe
  2⤵
  PID:4464
- C:\Windows\System\MNDpDAx.exe
  C:\Windows\System\MNDpDAx.exe
  2⤵
  PID:4480
- C:\Windows\System\WWVowkJ.exe
  C:\Windows\System\WWVowkJ.exe
  2⤵
  PID:4504
- C:\Windows\System\XDBfDat.exe
  C:\Windows\System\XDBfDat.exe
  2⤵
  PID:4520
- C:\Windows\System\hwCjiqt.exe
  C:\Windows\System\hwCjiqt.exe
  2⤵
  PID:4544
- C:\Windows\System\mVbxOgd.exe
  C:\Windows\System\mVbxOgd.exe
  2⤵
  PID:4560
- C:\Windows\System\NUDYEuR.exe
  C:\Windows\System\NUDYEuR.exe
  2⤵
  PID:4584
- C:\Windows\System\rbUcEaM.exe
  C:\Windows\System\rbUcEaM.exe
  2⤵
  PID:4604
- C:\Windows\System\AIZuZXl.exe
  C:\Windows\System\AIZuZXl.exe
  2⤵
  PID:4624
- C:\Windows\System\Fkzqzzs.exe
  C:\Windows\System\Fkzqzzs.exe
  2⤵
  PID:4644
- C:\Windows\System\LLCcLtg.exe
  C:\Windows\System\LLCcLtg.exe
  2⤵
  PID:4664
- C:\Windows\System\xGdmJva.exe
  C:\Windows\System\xGdmJva.exe
  2⤵
  PID:4684
- C:\Windows\System\qTRyXcp.exe
  C:\Windows\System\qTRyXcp.exe
  2⤵
  PID:4704
- C:\Windows\System\PeTFOdh.exe
  C:\Windows\System\PeTFOdh.exe
  2⤵
  PID:4724
- C:\Windows\System\ROxdXEu.exe
  C:\Windows\System\ROxdXEu.exe
  2⤵
  PID:4744
- C:\Windows\System\HEueExa.exe
  C:\Windows\System\HEueExa.exe
  2⤵
  PID:4760
- C:\Windows\System\Dpfqwun.exe
  C:\Windows\System\Dpfqwun.exe
  2⤵
  PID:4784
- C:\Windows\System\Zfrxqwd.exe
  C:\Windows\System\Zfrxqwd.exe
  2⤵
  PID:4804
- C:\Windows\System\UMMCHIh.exe
  C:\Windows\System\UMMCHIh.exe
  2⤵
  PID:4824
- C:\Windows\System\ewHcmRZ.exe
  C:\Windows\System\ewHcmRZ.exe
  2⤵
  PID:4844
- C:\Windows\System\Pvoygpl.exe
  C:\Windows\System\Pvoygpl.exe
  2⤵
  PID:4860
- C:\Windows\System\ZYKqghA.exe
  C:\Windows\System\ZYKqghA.exe
  2⤵
  PID:4884
- C:\Windows\System\PWbjKFP.exe
  C:\Windows\System\PWbjKFP.exe
  2⤵
  PID:4904
- C:\Windows\System\TYoRZbI.exe
  C:\Windows\System\TYoRZbI.exe
  2⤵
  PID:4920
- C:\Windows\System\wwAYnPC.exe
  C:\Windows\System\wwAYnPC.exe
  2⤵
  PID:4940
- C:\Windows\System\EQHoWSi.exe
  C:\Windows\System\EQHoWSi.exe
  2⤵
  PID:4960
- C:\Windows\System\kFBtQnz.exe
  C:\Windows\System\kFBtQnz.exe
  2⤵
  PID:4984
- C:\Windows\System\FJTiDpU.exe
  C:\Windows\System\FJTiDpU.exe
  2⤵
  PID:5004
- C:\Windows\System\NelNKxG.exe
  C:\Windows\System\NelNKxG.exe
  2⤵
  PID:5024
- C:\Windows\System\CUXxIyo.exe
  C:\Windows\System\CUXxIyo.exe
  2⤵
  PID:5040
- C:\Windows\System\tjCTnXL.exe
  C:\Windows\System\tjCTnXL.exe
  2⤵
  PID:5064
- C:\Windows\System\VzEuicM.exe
  C:\Windows\System\VzEuicM.exe
  2⤵
  PID:5080
- C:\Windows\System\EpTGNcf.exe
  C:\Windows\System\EpTGNcf.exe
  2⤵
  PID:5100
- C:\Windows\System\bwfhobK.exe
  C:\Windows\System\bwfhobK.exe
  2⤵
  PID:3732
- C:\Windows\System\KhzyjaW.exe
  C:\Windows\System\KhzyjaW.exe
  2⤵
  PID:3916
- C:\Windows\System\bvcFxKs.exe
  C:\Windows\System\bvcFxKs.exe
  2⤵
  PID:3604
- C:\Windows\System\qjgsAlE.exe
  C:\Windows\System\qjgsAlE.exe
  2⤵
  PID:2852
- C:\Windows\System\ukVvjZh.exe
  C:\Windows\System\ukVvjZh.exe
  2⤵
  PID:2328
- C:\Windows\System\IeQidsl.exe
  C:\Windows\System\IeQidsl.exe
  2⤵
  PID:3756
- C:\Windows\System\EtfbGtF.exe
  C:\Windows\System\EtfbGtF.exe
  2⤵
  PID:1532
- C:\Windows\System\XBmneyl.exe
  C:\Windows\System\XBmneyl.exe
  2⤵
  PID:4072
- C:\Windows\System\YDTnSMg.exe
  C:\Windows\System\YDTnSMg.exe
  2⤵
  PID:3452
- C:\Windows\System\zMudDSy.exe
  C:\Windows\System\zMudDSy.exe
  2⤵
  PID:2532
- C:\Windows\System\dAQTXVq.exe
  C:\Windows\System\dAQTXVq.exe
  2⤵
  PID:2884
- C:\Windows\System\rFVVjLp.exe
  C:\Windows\System\rFVVjLp.exe
  2⤵
  PID:3676
- C:\Windows\System\EZtnJuu.exe
  C:\Windows\System\EZtnJuu.exe
  2⤵
  PID:3076
- C:\Windows\System\mqqtCst.exe
  C:\Windows\System\mqqtCst.exe
  2⤵
  PID:3240
- C:\Windows\System\wYjJxjI.exe
  C:\Windows\System\wYjJxjI.exe
  2⤵
  PID:4132
- C:\Windows\System\rvquedB.exe
  C:\Windows\System\rvquedB.exe
  2⤵
  PID:4168
- C:\Windows\System\dDuFdGf.exe
  C:\Windows\System\dDuFdGf.exe
  2⤵
  PID:4176
- C:\Windows\System\yZeQQzZ.exe
  C:\Windows\System\yZeQQzZ.exe
  2⤵
  PID:4216
- C:\Windows\System\oDbJSnf.exe
  C:\Windows\System\oDbJSnf.exe
  2⤵
  PID:4228
- C:\Windows\System\ymCGhjS.exe
  C:\Windows\System\ymCGhjS.exe
  2⤵
  PID:4292
- C:\Windows\System\tIsjPGS.exe
  C:\Windows\System\tIsjPGS.exe
  2⤵
  PID:4276
- C:\Windows\System\KBjAkoE.exe
  C:\Windows\System\KBjAkoE.exe
  2⤵
  PID:4312
- C:\Windows\System\VitPUlW.exe
  C:\Windows\System\VitPUlW.exe
  2⤵
  PID:4372
- C:\Windows\System\IcrShAV.exe
  C:\Windows\System\IcrShAV.exe
  2⤵
  PID:4388
- C:\Windows\System\NSfDqms.exe
  C:\Windows\System\NSfDqms.exe
  2⤵
  PID:4452
- C:\Windows\System\VgYkaCX.exe
  C:\Windows\System\VgYkaCX.exe
  2⤵
  PID:2924
- C:\Windows\System\OTXjDSE.exe
  C:\Windows\System\OTXjDSE.exe
  2⤵
  PID:4424
- C:\Windows\System\zoHEcAn.exe
  C:\Windows\System\zoHEcAn.exe
  2⤵
  PID:4440
- C:\Windows\System\KRkiHLb.exe
  C:\Windows\System\KRkiHLb.exe
  2⤵
  PID:2912
- C:\Windows\System\XlUlgLY.exe
  C:\Windows\System\XlUlgLY.exe
  2⤵
  PID:4516
- C:\Windows\System\JPJkKBJ.exe
  C:\Windows\System\JPJkKBJ.exe
  2⤵
  PID:4556
- C:\Windows\System\WMYBtMl.exe
  C:\Windows\System\WMYBtMl.exe
  2⤵
  PID:2828
- C:\Windows\System\iWSlIfu.exe
  C:\Windows\System\iWSlIfu.exe
  2⤵
  PID:4576
- C:\Windows\System\tnsAtRz.exe
  C:\Windows\System\tnsAtRz.exe
  2⤵
  PID:4596
- C:\Windows\System\eXBgzho.exe
  C:\Windows\System\eXBgzho.exe
  2⤵
  PID:4632
- C:\Windows\System\wDjkgvE.exe
  C:\Windows\System\wDjkgvE.exe
  2⤵
  PID:2676
- C:\Windows\System\krdXMcE.exe
  C:\Windows\System\krdXMcE.exe
  2⤵
  PID:4672
- C:\Windows\System\xyGUpGL.exe
  C:\Windows\System\xyGUpGL.exe
  2⤵
  PID:4700
- C:\Windows\System\yPqUmOr.exe
  C:\Windows\System\yPqUmOr.exe
  2⤵
  PID:4736
- C:\Windows\System\JFrYPnA.exe
  C:\Windows\System\JFrYPnA.exe
  2⤵
  PID:4768
- C:\Windows\System\MyeZWfo.exe
  C:\Windows\System\MyeZWfo.exe
  2⤵
  PID:4820
- C:\Windows\System\QNslXmX.exe
  C:\Windows\System\QNslXmX.exe
  2⤵
  PID:2516
- C:\Windows\System\CAkLYvv.exe
  C:\Windows\System\CAkLYvv.exe
  2⤵
  PID:2728
- C:\Windows\System\yqUwDvx.exe
  C:\Windows\System\yqUwDvx.exe
  2⤵
  PID:4852
- C:\Windows\System\VsawUdD.exe
  C:\Windows\System\VsawUdD.exe
  2⤵
  PID:4896
- C:\Windows\System\rkYcrAr.exe
  C:\Windows\System\rkYcrAr.exe
  2⤵
  PID:4880
- C:\Windows\System\BnbRWKj.exe
  C:\Windows\System\BnbRWKj.exe
  2⤵
  PID:4936
- C:\Windows\System\vlOCdQR.exe
  C:\Windows\System\vlOCdQR.exe
  2⤵
  PID:4948
- C:\Windows\System\LLRKpUu.exe
  C:\Windows\System\LLRKpUu.exe
  2⤵
  PID:5088
- C:\Windows\System\xaRsDUa.exe
  C:\Windows\System\xaRsDUa.exe
  2⤵
  PID:3780
- C:\Windows\System\KDktkNq.exe
  C:\Windows\System\KDktkNq.exe
  2⤵
  PID:5112
- C:\Windows\System\RgIraGY.exe
  C:\Windows\System\RgIraGY.exe
  2⤵
  PID:3004
- C:\Windows\System\PmLDvXm.exe
  C:\Windows\System\PmLDvXm.exe
  2⤵
  PID:1016
- C:\Windows\System\QNGvZNC.exe
  C:\Windows\System\QNGvZNC.exe
  2⤵
  PID:3736
- C:\Windows\System\iCkiHwr.exe
  C:\Windows\System\iCkiHwr.exe
  2⤵
  PID:4012
- C:\Windows\System\yGylyyK.exe
  C:\Windows\System\yGylyyK.exe
  2⤵
  PID:1724
- C:\Windows\System\QebJqkE.exe
  C:\Windows\System\QebJqkE.exe
  2⤵
  PID:2868
- C:\Windows\System\SiLsqKP.exe
  C:\Windows\System\SiLsqKP.exe
  2⤵
  PID:2160
- C:\Windows\System\bcOjLtC.exe
  C:\Windows\System\bcOjLtC.exe
  2⤵
  PID:2436
- C:\Windows\System\iLjATia.exe
  C:\Windows\System\iLjATia.exe
  2⤵
  PID:1964
- C:\Windows\System\cYqfYCL.exe
  C:\Windows\System\cYqfYCL.exe
  2⤵
  PID:3132
- C:\Windows\System\vBUVgJv.exe
  C:\Windows\System\vBUVgJv.exe
  2⤵
  PID:3028
- C:\Windows\System\wcQiwtA.exe
  C:\Windows\System\wcQiwtA.exe
  2⤵
  PID:4100
- C:\Windows\System\CzXhYSj.exe
  C:\Windows\System\CzXhYSj.exe
  2⤵
  PID:2392
- C:\Windows\System\chHtJet.exe
  C:\Windows\System\chHtJet.exe
  2⤵
  PID:2384
- C:\Windows\System\bGbJjAL.exe
  C:\Windows\System\bGbJjAL.exe
  2⤵
  PID:4140
- C:\Windows\System\zeYcAFk.exe
  C:\Windows\System\zeYcAFk.exe
  2⤵
  PID:2932
- C:\Windows\System\mkMrEQU.exe
  C:\Windows\System\mkMrEQU.exe
  2⤵
  PID:2040
- C:\Windows\System\ykTEdgt.exe
  C:\Windows\System\ykTEdgt.exe
  2⤵
  PID:4352
- C:\Windows\System\zgtzYJn.exe
  C:\Windows\System\zgtzYJn.exe
  2⤵
  PID:2952
- C:\Windows\System\RdhLTBm.exe
  C:\Windows\System\RdhLTBm.exe
  2⤵
  PID:4196
- C:\Windows\System\oznigzz.exe
  C:\Windows\System\oznigzz.exe
  2⤵
  PID:2184
- C:\Windows\System\gzZLKCU.exe
  C:\Windows\System\gzZLKCU.exe
  2⤵
  PID:4512
- C:\Windows\System\orDAFGl.exe
  C:\Windows\System\orDAFGl.exe
  2⤵
  PID:4656
- C:\Windows\System\ljWxnSm.exe
  C:\Windows\System\ljWxnSm.exe
  2⤵
  PID:4500
- C:\Windows\System\WUpbzIP.exe
  C:\Windows\System\WUpbzIP.exe
  2⤵
  PID:4528
- C:\Windows\System\tzjvcrf.exe
  C:\Windows\System\tzjvcrf.exe
  2⤵
  PID:4616
- C:\Windows\System\SuCjtzf.exe
  C:\Windows\System\SuCjtzf.exe
  2⤵
  PID:2904
- C:\Windows\System\IcjDQXi.exe
  C:\Windows\System\IcjDQXi.exe
  2⤵
  PID:4796
- C:\Windows\System\BdWIdSJ.exe
  C:\Windows\System\BdWIdSJ.exe
  2⤵
  PID:4836
- C:\Windows\System\vChiXDm.exe
  C:\Windows\System\vChiXDm.exe
  2⤵
  PID:4976
- C:\Windows\System\xPkGcUo.exe
  C:\Windows\System\xPkGcUo.exe
  2⤵
  PID:4840
- C:\Windows\System\KNoNPLV.exe
  C:\Windows\System\KNoNPLV.exe
  2⤵
  PID:4916
- C:\Windows\System\NcxiFDF.exe
  C:\Windows\System\NcxiFDF.exe
  2⤵
  PID:5052
- C:\Windows\System\ZRRudsG.exe
  C:\Windows\System\ZRRudsG.exe
  2⤵
  PID:5060
- C:\Windows\System\uwURLBj.exe
  C:\Windows\System\uwURLBj.exe
  2⤵
  PID:3896
- C:\Windows\System\iZPxOLj.exe
  C:\Windows\System\iZPxOLj.exe
  2⤵
  PID:1976
- C:\Windows\System\SzPQdFU.exe
  C:\Windows\System\SzPQdFU.exe
  2⤵
  PID:1108
- C:\Windows\System\emGFtCx.exe
  C:\Windows\System\emGFtCx.exe
  2⤵
  PID:2588
- C:\Windows\System\EHVhqAT.exe
  C:\Windows\System\EHVhqAT.exe
  2⤵
  PID:1748
- C:\Windows\System\LOZpQjN.exe
  C:\Windows\System\LOZpQjN.exe
  2⤵
  PID:4348
- C:\Windows\System\TWyflWl.exe
  C:\Windows\System\TWyflWl.exe
  2⤵
  PID:4328
- C:\Windows\System\ZRZxoxR.exe
  C:\Windows\System\ZRZxoxR.exe
  2⤵
  PID:4580
- C:\Windows\System\LNzqjcx.exe
  C:\Windows\System\LNzqjcx.exe
  2⤵
  PID:4740
- C:\Windows\System\UhgeOpy.exe
  C:\Windows\System\UhgeOpy.exe
  2⤵
  PID:1196
- C:\Windows\System\GNcDHSC.exe
  C:\Windows\System\GNcDHSC.exe
  2⤵
  PID:2320
- C:\Windows\System\eWrdRqE.exe
  C:\Windows\System\eWrdRqE.exe
  2⤵
  PID:4252
- C:\Windows\System\dvNHmDK.exe
  C:\Windows\System\dvNHmDK.exe
  2⤵
  PID:4456
- C:\Windows\System\oBxCkIO.exe
  C:\Windows\System\oBxCkIO.exe
  2⤵
  PID:4572
- C:\Windows\System\tVnZilJ.exe
  C:\Windows\System\tVnZilJ.exe
  2⤵
  PID:2736
- C:\Windows\System\qZLbkyd.exe
  C:\Windows\System\qZLbkyd.exe
  2⤵
  PID:4692
- C:\Windows\System\QExXwFw.exe
  C:\Windows\System\QExXwFw.exe
  2⤵
  PID:5036
- C:\Windows\System\KndoruK.exe
  C:\Windows\System\KndoruK.exe
  2⤵
  PID:2420
- C:\Windows\System\KsyzaSi.exe
  C:\Windows\System\KsyzaSi.exe
  2⤵
  PID:4532
- C:\Windows\System\VbgnkXx.exe
  C:\Windows\System\VbgnkXx.exe
  2⤵
  PID:3012
- C:\Windows\System\HqLSqxO.exe
  C:\Windows\System\HqLSqxO.exe
  2⤵
  PID:4892
- C:\Windows\System\avNqIir.exe
  C:\Windows\System\avNqIir.exe
  2⤵
  PID:3204
- C:\Windows\System\JzsSXgY.exe
  C:\Windows\System\JzsSXgY.exe
  2⤵
  PID:4772
- C:\Windows\System\KDWcEgH.exe
  C:\Windows\System\KDWcEgH.exe
  2⤵
  PID:2252
- C:\Windows\System\JmoqlWD.exe
  C:\Windows\System\JmoqlWD.exe
  2⤵
  PID:3876
- C:\Windows\System\mQzBcdA.exe
  C:\Windows\System\mQzBcdA.exe
  2⤵
  PID:4408
- C:\Windows\System\fmiDoAC.exe
  C:\Windows\System\fmiDoAC.exe
  2⤵
  PID:4112
- C:\Windows\System\AVuLDRA.exe
  C:\Windows\System\AVuLDRA.exe
  2⤵
  PID:1856
- C:\Windows\System\DbgSLOn.exe
  C:\Windows\System\DbgSLOn.exe
  2⤵
  PID:2480
- C:\Windows\System\ezJcsUN.exe
  C:\Windows\System\ezJcsUN.exe
  2⤵
  PID:5128
- C:\Windows\System\GkeJVVD.exe
  C:\Windows\System\GkeJVVD.exe
  2⤵
  PID:5144
- C:\Windows\System\MlYucJL.exe
  C:\Windows\System\MlYucJL.exe
  2⤵
  PID:5224
- C:\Windows\System\YQpNqgT.exe
  C:\Windows\System\YQpNqgT.exe
  2⤵
  PID:5240
- C:\Windows\System\uNIPpSe.exe
  C:\Windows\System\uNIPpSe.exe
  2⤵
  PID:5256
- C:\Windows\System\XSxsSJI.exe
  C:\Windows\System\XSxsSJI.exe
  2⤵
  PID:5272
- C:\Windows\System\STWVHvx.exe
  C:\Windows\System\STWVHvx.exe
  2⤵
  PID:5288
- C:\Windows\System\avXvDTw.exe
  C:\Windows\System\avXvDTw.exe
  2⤵
  PID:5308
- C:\Windows\System\QdfVNYD.exe
  C:\Windows\System\QdfVNYD.exe
  2⤵
  PID:5328
- C:\Windows\System\JozroYq.exe
  C:\Windows\System\JozroYq.exe
  2⤵
  PID:5348
- C:\Windows\System\fQKXmAg.exe
  C:\Windows\System\fQKXmAg.exe
  2⤵
  PID:5364
- C:\Windows\System\JvTxumO.exe
  C:\Windows\System\JvTxumO.exe
  2⤵
  PID:5384
- C:\Windows\System\QvvqGYN.exe
  C:\Windows\System\QvvqGYN.exe
  2⤵
  PID:5408
- C:\Windows\System\MKcXtPV.exe
  C:\Windows\System\MKcXtPV.exe
  2⤵
  PID:5424
- C:\Windows\System\DdllCDN.exe
  C:\Windows\System\DdllCDN.exe
  2⤵
  PID:5440
- C:\Windows\System\SGKgkHR.exe
  C:\Windows\System\SGKgkHR.exe
  2⤵
  PID:5456
- C:\Windows\System\PvtmwEn.exe
  C:\Windows\System\PvtmwEn.exe
  2⤵
  PID:5484
- C:\Windows\System\fTjDoFE.exe
  C:\Windows\System\fTjDoFE.exe
  2⤵
  PID:5524
- C:\Windows\System\dRlYAyX.exe
  C:\Windows\System\dRlYAyX.exe
  2⤵
  PID:5540
- C:\Windows\System\XjnDjeH.exe
  C:\Windows\System\XjnDjeH.exe
  2⤵
  PID:5560
- C:\Windows\System\QouvgqL.exe
  C:\Windows\System\QouvgqL.exe
  2⤵
  PID:5576
- C:\Windows\System\oqgDkYU.exe
  C:\Windows\System\oqgDkYU.exe
  2⤵
  PID:5600
- C:\Windows\System\CWqYDtd.exe
  C:\Windows\System\CWqYDtd.exe
  2⤵
  PID:5616
- C:\Windows\System\ElWrerR.exe
  C:\Windows\System\ElWrerR.exe
  2⤵
  PID:5640
- C:\Windows\System\RSkNbPp.exe
  C:\Windows\System\RSkNbPp.exe
  2⤵
  PID:5656
- C:\Windows\System\DtrpjNV.exe
  C:\Windows\System\DtrpjNV.exe
  2⤵
  PID:5672
- C:\Windows\System\zzlMVgf.exe
  C:\Windows\System\zzlMVgf.exe
  2⤵
  PID:5688
- C:\Windows\System\STaQCRn.exe
  C:\Windows\System\STaQCRn.exe
  2⤵
  PID:5704
- C:\Windows\System\dwaVUYU.exe
  C:\Windows\System\dwaVUYU.exe
  2⤵
  PID:5724
- C:\Windows\System\PUWhXWX.exe
  C:\Windows\System\PUWhXWX.exe
  2⤵
  PID:5744
- C:\Windows\System\ypfXRJa.exe
  C:\Windows\System\ypfXRJa.exe
  2⤵
  PID:5760
- C:\Windows\System\DTFBzSE.exe
  C:\Windows\System\DTFBzSE.exe
  2⤵
  PID:5780
- C:\Windows\System\nnCvqqS.exe
  C:\Windows\System\nnCvqqS.exe
  2⤵
  PID:5796
- C:\Windows\System\GyfhhEd.exe
  C:\Windows\System\GyfhhEd.exe
  2⤵
  PID:5816
- C:\Windows\System\JKTUspY.exe
  C:\Windows\System\JKTUspY.exe
  2⤵
  PID:5832
- C:\Windows\System\adWsZiH.exe
  C:\Windows\System\adWsZiH.exe
  2⤵
  PID:5852
- C:\Windows\System\uGYinhJ.exe
  C:\Windows\System\uGYinhJ.exe
  2⤵
  PID:5868
- C:\Windows\System\fzZVCaS.exe
  C:\Windows\System\fzZVCaS.exe
  2⤵
  PID:5888
- C:\Windows\System\xgzIHXD.exe
  C:\Windows\System\xgzIHXD.exe
  2⤵
  PID:5908
- C:\Windows\System\BNpWZPA.exe
  C:\Windows\System\BNpWZPA.exe
  2⤵
  PID:5924
- C:\Windows\System\EHjEGkM.exe
  C:\Windows\System\EHjEGkM.exe
  2⤵
  PID:5944
- C:\Windows\System\ciMuhpj.exe
  C:\Windows\System\ciMuhpj.exe
  2⤵
  PID:5960
- C:\Windows\System\vinOuBZ.exe
  C:\Windows\System\vinOuBZ.exe
  2⤵
  PID:5980
- C:\Windows\System\PKCJQBW.exe
  C:\Windows\System\PKCJQBW.exe
  2⤵
  PID:5996
- C:\Windows\System\dyWYBDX.exe
  C:\Windows\System\dyWYBDX.exe
  2⤵
  PID:6012
- C:\Windows\System\tOKUvOm.exe
  C:\Windows\System\tOKUvOm.exe
  2⤵
  PID:6028
- C:\Windows\System\jZeNmba.exe
  C:\Windows\System\jZeNmba.exe
  2⤵
  PID:6048
- C:\Windows\System\juKqSHW.exe
  C:\Windows\System\juKqSHW.exe
  2⤵
  PID:6068
- C:\Windows\System\xcujIhy.exe
  C:\Windows\System\xcujIhy.exe
  2⤵
  PID:6084
- C:\Windows\System\sStfYYm.exe
  C:\Windows\System\sStfYYm.exe
  2⤵
  PID:6104
- C:\Windows\System\jReSCAZ.exe
  C:\Windows\System\jReSCAZ.exe
  2⤵
  PID:6120
- C:\Windows\System\PUdXNkA.exe
  C:\Windows\System\PUdXNkA.exe
  2⤵
  PID:6140
- C:\Windows\System\rxUdTcu.exe
  C:\Windows\System\rxUdTcu.exe
  2⤵
  PID:884
- C:\Windows\System\aUdRPoH.exe
  C:\Windows\System\aUdRPoH.exe
  2⤵
  PID:4996
- C:\Windows\System\LTYyaQu.exe
  C:\Windows\System\LTYyaQu.exe
  2⤵
  PID:4876
- C:\Windows\System\XCSTlUy.exe
  C:\Windows\System\XCSTlUy.exe
  2⤵
  PID:5152
- C:\Windows\System\SgRExxZ.exe
  C:\Windows\System\SgRExxZ.exe
  2⤵
  PID:4156
- C:\Windows\System\JAIQjCh.exe
  C:\Windows\System\JAIQjCh.exe
  2⤵
  PID:5136
- C:\Windows\System\TfKHKOr.exe
  C:\Windows\System\TfKHKOr.exe
  2⤵
  PID:4268
- C:\Windows\System\bRcVNDt.exe
  C:\Windows\System\bRcVNDt.exe
  2⤵
  PID:636
- C:\Windows\System\cluFFVr.exe
  C:\Windows\System\cluFFVr.exe
  2⤵
  PID:4492
- C:\Windows\System\LwSmAEp.exe
  C:\Windows\System\LwSmAEp.exe
  2⤵
  PID:2260
- C:\Windows\System\xbVkZrO.exe
  C:\Windows\System\xbVkZrO.exe
  2⤵
  PID:5168
- C:\Windows\System\PnmNutZ.exe
  C:\Windows\System\PnmNutZ.exe
  2⤵
  PID:5184
- C:\Windows\System\yczSyLP.exe
  C:\Windows\System\yczSyLP.exe
  2⤵
  PID:5204
- C:\Windows\System\fzDKyMj.exe
  C:\Windows\System\fzDKyMj.exe
  2⤵
  PID:5156
- C:\Windows\System\yoCjKSW.exe
  C:\Windows\System\yoCjKSW.exe
  2⤵
  PID:5284
- C:\Windows\System\gBJNUif.exe
  C:\Windows\System\gBJNUif.exe
  2⤵
  PID:5360
- C:\Windows\System\kqypyRq.exe
  C:\Windows\System\kqypyRq.exe
  2⤵
  PID:5404
- C:\Windows\System\YbRZwft.exe
  C:\Windows\System\YbRZwft.exe
  2⤵
  PID:5296
- C:\Windows\System\ejPuKOk.exe
  C:\Windows\System\ejPuKOk.exe
  2⤵
  PID:5344
- C:\Windows\System\sTaeQVt.exe
  C:\Windows\System\sTaeQVt.exe
  2⤵
  PID:5432
- C:\Windows\System\gKbKkyO.exe
  C:\Windows\System\gKbKkyO.exe
  2⤵
  PID:5264
- C:\Windows\System\lIOvsku.exe
  C:\Windows\System\lIOvsku.exe
  2⤵
  PID:5464
- C:\Windows\System\pmehpCM.exe
  C:\Windows\System\pmehpCM.exe
  2⤵
  PID:5536
- C:\Windows\System\rvjfOOI.exe
  C:\Windows\System\rvjfOOI.exe
  2⤵
  PID:5608
- C:\Windows\System\pScCDMb.exe
  C:\Windows\System\pScCDMb.exe
  2⤵
  PID:5680
- C:\Windows\System\lGtTIYm.exe
  C:\Windows\System\lGtTIYm.exe
  2⤵
  PID:5716
- C:\Windows\System\HIChrkS.exe
  C:\Windows\System\HIChrkS.exe
  2⤵
  PID:5860
- C:\Windows\System\CJgYAXL.exe
  C:\Windows\System\CJgYAXL.exe
  2⤵
  PID:6036
- C:\Windows\System\GoyOahd.exe
  C:\Windows\System\GoyOahd.exe
  2⤵
  PID:5000
- C:\Windows\System\qiVGzeu.exe
  C:\Windows\System\qiVGzeu.exe
  2⤵
  PID:3696
- C:\Windows\System\ArxBYsY.exe
  C:\Windows\System\ArxBYsY.exe
  2⤵
  PID:5160
- C:\Windows\System\JnNQtKy.exe
  C:\Windows\System\JnNQtKy.exe
  2⤵
  PID:5200
- C:\Windows\System\MuCgsxC.exe
  C:\Windows\System\MuCgsxC.exe
  2⤵
  PID:5400
- C:\Windows\System\gmeyKfU.exe
  C:\Windows\System\gmeyKfU.exe
  2⤵
  PID:5476
- C:\Windows\System\xQKUzZX.exe
  C:\Windows\System\xQKUzZX.exe
  2⤵
  PID:5584
- C:\Windows\System\xjIOHpW.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes