xmrig | 37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
Size

1.4MB
MD5

3d7c58e2b5035d2e0cc61ff34f3a606a
SHA1

2b36a6b89aedb5987145cf827a9429826ca2642a
SHA256

37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63
SHA512

b8027b3b724a115ff8f2257cd856b7dd53a95376e101158009237e35ed22cb64471547f1913fd337553fcb72283b061395a1651088b07e22a77b3e6f0fbdce10
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IsSAN0z3Z4:GezaTF8FcNkNdfE0pZ9ozttwIRakGNrB

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000a00000001227e-2.dat	xmrig
behavioral1/files/0x0008000000016d0e-9.dat	xmrig
behavioral1/files/0x0008000000016d18-13.dat	xmrig
behavioral1/files/0x0008000000016d21-17.dat	xmrig
behavioral1/files/0x0007000000016d31-21.dat	xmrig
behavioral1/files/0x0007000000016d3a-24.dat	xmrig
behavioral1/files/0x0008000000016d5e-33.dat	xmrig
behavioral1/files/0x0007000000016d42-29.dat	xmrig
behavioral1/files/0x0006000000018683-36.dat	xmrig
behavioral1/files/0x00050000000186ea-44.dat	xmrig
behavioral1/files/0x00050000000186fd-52.dat	xmrig
behavioral1/files/0x0005000000018784-64.dat	xmrig
behavioral1/files/0x00050000000187a5-72.dat	xmrig
behavioral1/files/0x0005000000019282-88.dat	xmrig
behavioral1/files/0x000500000001941e-112.dat	xmrig
behavioral1/files/0x000500000001944f-128.dat	xmrig
behavioral1/files/0x0005000000019441-124.dat	xmrig
behavioral1/files/0x0005000000019431-120.dat	xmrig
behavioral1/files/0x0005000000019427-116.dat	xmrig
behavioral1/files/0x00050000000193e1-108.dat	xmrig
behavioral1/files/0x00050000000193c2-105.dat	xmrig
behavioral1/files/0x0005000000019350-96.dat	xmrig
behavioral1/files/0x00050000000193b4-100.dat	xmrig
behavioral1/files/0x0005000000019334-92.dat	xmrig
behavioral1/files/0x0005000000019261-84.dat	xmrig
behavioral1/files/0x000500000001925e-80.dat	xmrig
behavioral1/files/0x0006000000019023-76.dat	xmrig
behavioral1/files/0x000500000001878f-68.dat	xmrig
behavioral1/files/0x000500000001873d-60.dat	xmrig
behavioral1/files/0x0005000000018728-56.dat	xmrig
behavioral1/files/0x00050000000186ee-48.dat	xmrig
behavioral1/files/0x00050000000186e4-40.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2776	pJvXekp.exe
2052	bpbZfrO.exe
2692	bPUjqET.exe
2804	udTkNDh.exe
2668	JJXmhRK.exe
1680	xLdmkpp.exe
2548	DcTfjFN.exe
2608	SVNxwwA.exe
2588	anFADUi.exe
2700	OsXqOdJ.exe
536	XbuirqF.exe
792	nGYOkqP.exe
1136	DtREpbM.exe
1572	OKDJMgh.exe
556	YeVATKC.exe
1916	IborCBm.exe
1868	rdWrocN.exe
2500	zsSbSNE.exe
2088	nFNagpI.exe
2792	lsVlPoR.exe
1696	dHSZLea.exe
2592	tymaQOn.exe
2620	gkWJzYC.exe
1508	jWkeNmK.exe
2824	feSFQhO.exe
2028	exhxynN.exe
1232	gMquiWh.exe
2296	YbKEsia.exe
2788	CPYPzBR.exe
2396	BDVHveN.exe
2412	alOgHEX.exe
1888	iXyLMUb.exe
2408	AljnfPN.exe
1556	xOwjzSE.exe
840	XpFMYgN.exe
2424	EdhgmvI.exe
1568	EqHDRlC.exe
1228	qgKFNUY.exe
1972	FkjzELJ.exe
2260	goVTcqV.exe
444	lnqEZDh.exe
2204	etDSzOr.exe
2164	hszWmOi.exe
2128	mAEfYpB.exe
3040	RVwqAHJ.exe
1644	ZSnPHnZ.exe
1324	VcoyThU.exe
904	quVXtWb.exe
948	mjGnquG.exe
1744	LYsMCnP.exe
1468	dPtffVj.exe
1220	repaeXm.exe
1676	bvvIFFV.exe
1664	hhHtuAf.exe
972	hyctIwl.exe
888	XsBqRcT.exe
2492	DKETMVb.exe
1376	AfHVYPU.exe
2440	ICcmyBH.exe
2268	ApWCiOx.exe
2012	TlAXSNH.exe
1996	KlYFqIY.exe
2328	XIVdiuV.exe
2432	PdFGBAK.exe

Loads dropped DLL 64 IoCs

pid	Process
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fxkgChg.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\viZEOng.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\esHGOSw.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\lFWgLTb.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\sTzzIqt.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\WxzgicN.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\neNNocq.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\QiyFEsK.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\EhxEBoj.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\XnLdZlk.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ywWMIXa.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\zelaZGK.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ixSGlfV.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\GAmhvUK.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\CPemNfJ.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\MlxyCwX.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\MuVSpVQ.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\Skjukmb.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\mxCHVpb.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\RYMmGsm.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ZYCIeph.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\NbmEjOW.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\DevBeJX.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\nCgKjvQ.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\hRXuiqR.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\WRHjtan.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\McswlOm.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ugFyHhe.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\eGjdVFi.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\vfnrQHs.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\tcqBfOu.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\mLAcSab.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\Mbnxbdv.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ETqUdia.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\FlYvnUR.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\usLJXTU.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\NgcOuyT.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\aRALZsV.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\GfcyjnB.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\itTMkXj.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\tQXiMQn.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\GLgooro.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\SSjaIRn.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ZFRzHfX.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\MzesaKy.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\jwdMPfY.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\xNpgPrl.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\MEGhUVm.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\QPunOsQ.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\hsKSlOq.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\GOeNbQb.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\esylJDl.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ClyYmMo.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\EMBXbCD.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\QRroQBo.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\PGJegDE.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\GYXMwOc.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\uPRJPUk.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\xKAdVTY.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\NeEjdTd.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\kZVvKhN.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\EXLTOHx.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\UgGiApB.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\CalWUke.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2776	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	31
PID 2756 wrote to memory of 2776	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	31
PID 2756 wrote to memory of 2776	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	31
PID 2756 wrote to memory of 2052	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	32
PID 2756 wrote to memory of 2052	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	32
PID 2756 wrote to memory of 2052	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	32
PID 2756 wrote to memory of 2692	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	33
PID 2756 wrote to memory of 2692	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	33
PID 2756 wrote to memory of 2692	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	33
PID 2756 wrote to memory of 2804	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	34
PID 2756 wrote to memory of 2804	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	34
PID 2756 wrote to memory of 2804	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	34
PID 2756 wrote to memory of 2668	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	35
PID 2756 wrote to memory of 2668	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	35
PID 2756 wrote to memory of 2668	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	35
PID 2756 wrote to memory of 1680	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	36
PID 2756 wrote to memory of 1680	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	36
PID 2756 wrote to memory of 1680	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	36
PID 2756 wrote to memory of 2548	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	37
PID 2756 wrote to memory of 2548	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	37
PID 2756 wrote to memory of 2548	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	37
PID 2756 wrote to memory of 2608	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	38
PID 2756 wrote to memory of 2608	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	38
PID 2756 wrote to memory of 2608	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	38
PID 2756 wrote to memory of 2588	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	39
PID 2756 wrote to memory of 2588	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	39
PID 2756 wrote to memory of 2588	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	39
PID 2756 wrote to memory of 2700	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	40
PID 2756 wrote to memory of 2700	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	40
PID 2756 wrote to memory of 2700	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	40
PID 2756 wrote to memory of 536	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	41
PID 2756 wrote to memory of 536	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	41
PID 2756 wrote to memory of 536	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	41
PID 2756 wrote to memory of 792	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	42
PID 2756 wrote to memory of 792	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	42
PID 2756 wrote to memory of 792	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	42
PID 2756 wrote to memory of 1136	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	43
PID 2756 wrote to memory of 1136	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	43
PID 2756 wrote to memory of 1136	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	43
PID 2756 wrote to memory of 1572	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	44
PID 2756 wrote to memory of 1572	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	44
PID 2756 wrote to memory of 1572	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	44
PID 2756 wrote to memory of 556	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	45
PID 2756 wrote to memory of 556	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	45
PID 2756 wrote to memory of 556	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	45
PID 2756 wrote to memory of 1916	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	46
PID 2756 wrote to memory of 1916	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	46
PID 2756 wrote to memory of 1916	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	46
PID 2756 wrote to memory of 1868	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	47
PID 2756 wrote to memory of 1868	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	47
PID 2756 wrote to memory of 1868	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	47
PID 2756 wrote to memory of 2500	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	48
PID 2756 wrote to memory of 2500	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	48
PID 2756 wrote to memory of 2500	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	48
PID 2756 wrote to memory of 2088	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	49
PID 2756 wrote to memory of 2088	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	49
PID 2756 wrote to memory of 2088	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	49
PID 2756 wrote to memory of 2792	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	50
PID 2756 wrote to memory of 2792	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	50
PID 2756 wrote to memory of 2792	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	50
PID 2756 wrote to memory of 1696	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	51
PID 2756 wrote to memory of 1696	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	51
PID 2756 wrote to memory of 1696	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	51
PID 2756 wrote to memory of 2592	2756	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	52

C:\Users\Admin\AppData\Local\Temp\37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
"C:\Users\Admin\AppData\Local\Temp\37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\System\pJvXekp.exe
  C:\Windows\System\pJvXekp.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\bpbZfrO.exe
  C:\Windows\System\bpbZfrO.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\bPUjqET.exe
  C:\Windows\System\bPUjqET.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\udTkNDh.exe
  C:\Windows\System\udTkNDh.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\JJXmhRK.exe
  C:\Windows\System\JJXmhRK.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\xLdmkpp.exe
  C:\Windows\System\xLdmkpp.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\DcTfjFN.exe
  C:\Windows\System\DcTfjFN.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\SVNxwwA.exe
  C:\Windows\System\SVNxwwA.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\anFADUi.exe
  C:\Windows\System\anFADUi.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\OsXqOdJ.exe
  C:\Windows\System\OsXqOdJ.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\XbuirqF.exe
  C:\Windows\System\XbuirqF.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\nGYOkqP.exe
  C:\Windows\System\nGYOkqP.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\DtREpbM.exe
  C:\Windows\System\DtREpbM.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\OKDJMgh.exe
  C:\Windows\System\OKDJMgh.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\YeVATKC.exe
  C:\Windows\System\YeVATKC.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\IborCBm.exe
  C:\Windows\System\IborCBm.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\rdWrocN.exe
  C:\Windows\System\rdWrocN.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\zsSbSNE.exe
  C:\Windows\System\zsSbSNE.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\nFNagpI.exe
  C:\Windows\System\nFNagpI.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\lsVlPoR.exe
  C:\Windows\System\lsVlPoR.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\dHSZLea.exe
  C:\Windows\System\dHSZLea.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\tymaQOn.exe
  C:\Windows\System\tymaQOn.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\gkWJzYC.exe
  C:\Windows\System\gkWJzYC.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\jWkeNmK.exe
  C:\Windows\System\jWkeNmK.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\feSFQhO.exe
  C:\Windows\System\feSFQhO.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\exhxynN.exe
  C:\Windows\System\exhxynN.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\gMquiWh.exe
  C:\Windows\System\gMquiWh.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\YbKEsia.exe
  C:\Windows\System\YbKEsia.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\CPYPzBR.exe
  C:\Windows\System\CPYPzBR.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\BDVHveN.exe
  C:\Windows\System\BDVHveN.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\alOgHEX.exe
  C:\Windows\System\alOgHEX.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\iXyLMUb.exe
  C:\Windows\System\iXyLMUb.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\AljnfPN.exe
  C:\Windows\System\AljnfPN.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\xOwjzSE.exe
  C:\Windows\System\xOwjzSE.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\XpFMYgN.exe
  C:\Windows\System\XpFMYgN.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\EdhgmvI.exe
  C:\Windows\System\EdhgmvI.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\EqHDRlC.exe
  C:\Windows\System\EqHDRlC.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\qgKFNUY.exe
  C:\Windows\System\qgKFNUY.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\FkjzELJ.exe
  C:\Windows\System\FkjzELJ.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\goVTcqV.exe
  C:\Windows\System\goVTcqV.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\lnqEZDh.exe
  C:\Windows\System\lnqEZDh.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\etDSzOr.exe
  C:\Windows\System\etDSzOr.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\hszWmOi.exe
  C:\Windows\System\hszWmOi.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\mAEfYpB.exe
  C:\Windows\System\mAEfYpB.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\RVwqAHJ.exe
  C:\Windows\System\RVwqAHJ.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\ZSnPHnZ.exe
  C:\Windows\System\ZSnPHnZ.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\VcoyThU.exe
  C:\Windows\System\VcoyThU.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\quVXtWb.exe
  C:\Windows\System\quVXtWb.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\mjGnquG.exe
  C:\Windows\System\mjGnquG.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\LYsMCnP.exe
  C:\Windows\System\LYsMCnP.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\dPtffVj.exe
  C:\Windows\System\dPtffVj.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\repaeXm.exe
  C:\Windows\System\repaeXm.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\bvvIFFV.exe
  C:\Windows\System\bvvIFFV.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\hhHtuAf.exe
  C:\Windows\System\hhHtuAf.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\hyctIwl.exe
  C:\Windows\System\hyctIwl.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\XsBqRcT.exe
  C:\Windows\System\XsBqRcT.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\DKETMVb.exe
  C:\Windows\System\DKETMVb.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\AfHVYPU.exe
  C:\Windows\System\AfHVYPU.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\ICcmyBH.exe
  C:\Windows\System\ICcmyBH.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\ApWCiOx.exe
  C:\Windows\System\ApWCiOx.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\TlAXSNH.exe
  C:\Windows\System\TlAXSNH.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\KlYFqIY.exe
  C:\Windows\System\KlYFqIY.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\XIVdiuV.exe
  C:\Windows\System\XIVdiuV.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\PdFGBAK.exe
  C:\Windows\System\PdFGBAK.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\wtIIFtH.exe
  C:\Windows\System\wtIIFtH.exe
  2⤵
  PID:2336
- C:\Windows\System\wtXIxhA.exe
  C:\Windows\System\wtXIxhA.exe
  2⤵
  PID:2188
- C:\Windows\System\nhxbDHR.exe
  C:\Windows\System\nhxbDHR.exe
  2⤵
  PID:1688
- C:\Windows\System\OJdEnlR.exe
  C:\Windows\System\OJdEnlR.exe
  2⤵
  PID:2676
- C:\Windows\System\mxUxOZE.exe
  C:\Windows\System\mxUxOZE.exe
  2⤵
  PID:3024
- C:\Windows\System\jtoNtWV.exe
  C:\Windows\System\jtoNtWV.exe
  2⤵
  PID:2980
- C:\Windows\System\HCrixBW.exe
  C:\Windows\System\HCrixBW.exe
  2⤵
  PID:2380
- C:\Windows\System\tcqBfOu.exe
  C:\Windows\System\tcqBfOu.exe
  2⤵
  PID:1528
- C:\Windows\System\OniFpFM.exe
  C:\Windows\System\OniFpFM.exe
  2⤵
  PID:2848
- C:\Windows\System\zuDYuVw.exe
  C:\Windows\System\zuDYuVw.exe
  2⤵
  PID:2796
- C:\Windows\System\DudueLN.exe
  C:\Windows\System\DudueLN.exe
  2⤵
  PID:2524
- C:\Windows\System\RdYKPxw.exe
  C:\Windows\System\RdYKPxw.exe
  2⤵
  PID:3068
- C:\Windows\System\ciuJFEw.exe
  C:\Windows\System\ciuJFEw.exe
  2⤵
  PID:2136
- C:\Windows\System\EXpbXVA.exe
  C:\Windows\System\EXpbXVA.exe
  2⤵
  PID:1268
- C:\Windows\System\MfeyqEB.exe
  C:\Windows\System\MfeyqEB.exe
  2⤵
  PID:1424
- C:\Windows\System\WwFXDoc.exe
  C:\Windows\System\WwFXDoc.exe
  2⤵
  PID:2104
- C:\Windows\System\neNNocq.exe
  C:\Windows\System\neNNocq.exe
  2⤵
  PID:1456
- C:\Windows\System\iUFRaru.exe
  C:\Windows\System\iUFRaru.exe
  2⤵
  PID:2884
- C:\Windows\System\ycMUpzn.exe
  C:\Windows\System\ycMUpzn.exe
  2⤵
  PID:1852
- C:\Windows\System\AOgsYTi.exe
  C:\Windows\System\AOgsYTi.exe
  2⤵
  PID:2752
- C:\Windows\System\nhQSOmD.exe
  C:\Windows\System\nhQSOmD.exe
  2⤵
  PID:2800
- C:\Windows\System\URQiXdO.exe
  C:\Windows\System\URQiXdO.exe
  2⤵
  PID:2092
- C:\Windows\System\rkZuzPL.exe
  C:\Windows\System\rkZuzPL.exe
  2⤵
  PID:2428
- C:\Windows\System\bIMVSWj.exe
  C:\Windows\System\bIMVSWj.exe
  2⤵
  PID:2996
- C:\Windows\System\mIGkdrw.exe
  C:\Windows\System\mIGkdrw.exe
  2⤵
  PID:1864
- C:\Windows\System\JeKDNRs.exe
  C:\Windows\System\JeKDNRs.exe
  2⤵
  PID:2420
- C:\Windows\System\bLZFZKR.exe
  C:\Windows\System\bLZFZKR.exe
  2⤵
  PID:1176
- C:\Windows\System\VIxFNFD.exe
  C:\Windows\System\VIxFNFD.exe
  2⤵
  PID:1088
- C:\Windows\System\JKwzVzo.exe
  C:\Windows\System\JKwzVzo.exe
  2⤵
  PID:2400
- C:\Windows\System\VaLetuc.exe
  C:\Windows\System\VaLetuc.exe
  2⤵
  PID:432
- C:\Windows\System\DqWqEuU.exe
  C:\Windows\System\DqWqEuU.exe
  2⤵
  PID:2356
- C:\Windows\System\FjtxGfr.exe
  C:\Windows\System\FjtxGfr.exe
  2⤵
  PID:704
- C:\Windows\System\jhXcnMu.exe
  C:\Windows\System\jhXcnMu.exe
  2⤵
  PID:968
- C:\Windows\System\XHkKIcX.exe
  C:\Windows\System\XHkKIcX.exe
  2⤵
  PID:1944
- C:\Windows\System\UDOBzoH.exe
  C:\Windows\System\UDOBzoH.exe
  2⤵
  PID:1484
- C:\Windows\System\VwXsVdT.exe
  C:\Windows\System\VwXsVdT.exe
  2⤵
  PID:2552
- C:\Windows\System\sBtlTYY.exe
  C:\Windows\System\sBtlTYY.exe
  2⤵
  PID:1660
- C:\Windows\System\gqHQvNP.exe
  C:\Windows\System\gqHQvNP.exe
  2⤵
  PID:108
- C:\Windows\System\IDjHFgv.exe
  C:\Windows\System\IDjHFgv.exe
  2⤵
  PID:1712
- C:\Windows\System\xTHbdRz.exe
  C:\Windows\System\xTHbdRz.exe
  2⤵
  PID:2468
- C:\Windows\System\UcYnLSN.exe
  C:\Windows\System\UcYnLSN.exe
  2⤵
  PID:1936
- C:\Windows\System\KZKeLpA.exe
  C:\Windows\System\KZKeLpA.exe
  2⤵
  PID:2036
- C:\Windows\System\dkjAfbN.exe
  C:\Windows\System\dkjAfbN.exe
  2⤵
  PID:2008
- C:\Windows\System\fxkgChg.exe
  C:\Windows\System\fxkgChg.exe
  2⤵
  PID:2168
- C:\Windows\System\kZVvKhN.exe
  C:\Windows\System\kZVvKhN.exe
  2⤵
  PID:1960
- C:\Windows\System\xsaPROl.exe
  C:\Windows\System\xsaPROl.exe
  2⤵
  PID:1532
- C:\Windows\System\pDUDUYu.exe
  C:\Windows\System\pDUDUYu.exe
  2⤵
  PID:2656
- C:\Windows\System\TGceOcr.exe
  C:\Windows\System\TGceOcr.exe
  2⤵
  PID:1740
- C:\Windows\System\ObgFUdi.exe
  C:\Windows\System\ObgFUdi.exe
  2⤵
  PID:1928
- C:\Windows\System\DbnqZLh.exe
  C:\Windows\System\DbnqZLh.exe
  2⤵
  PID:2308
- C:\Windows\System\CKDCGEP.exe
  C:\Windows\System\CKDCGEP.exe
  2⤵
  PID:2376
- C:\Windows\System\ajfYlOy.exe
  C:\Windows\System\ajfYlOy.exe
  2⤵
  PID:768
- C:\Windows\System\kHQEEZo.exe
  C:\Windows\System\kHQEEZo.exe
  2⤵
  PID:2256
- C:\Windows\System\JazIeLN.exe
  C:\Windows\System\JazIeLN.exe
  2⤵
  PID:1216
- C:\Windows\System\Cjocsxv.exe
  C:\Windows\System\Cjocsxv.exe
  2⤵
  PID:2044
- C:\Windows\System\dCJKkJF.exe
  C:\Windows\System\dCJKkJF.exe
  2⤵
  PID:1548
- C:\Windows\System\LRdkZtv.exe
  C:\Windows\System\LRdkZtv.exe
  2⤵
  PID:276
- C:\Windows\System\CztWnMG.exe
  C:\Windows\System\CztWnMG.exe
  2⤵
  PID:1668
- C:\Windows\System\jmVsSke.exe
  C:\Windows\System\jmVsSke.exe
  2⤵
  PID:2284
- C:\Windows\System\fnzBHnw.exe
  C:\Windows\System\fnzBHnw.exe
  2⤵
  PID:1460
- C:\Windows\System\XAcgGsG.exe
  C:\Windows\System\XAcgGsG.exe
  2⤵
  PID:1240
- C:\Windows\System\YtGCcSt.exe
  C:\Windows\System\YtGCcSt.exe
  2⤵
  PID:1988
- C:\Windows\System\swAaggS.exe
  C:\Windows\System\swAaggS.exe
  2⤵
  PID:572
- C:\Windows\System\NqxPfSt.exe
  C:\Windows\System\NqxPfSt.exe
  2⤵
  PID:1536
- C:\Windows\System\PcfUahE.exe
  C:\Windows\System\PcfUahE.exe
  2⤵
  PID:3056
- C:\Windows\System\kWTPQkA.exe
  C:\Windows\System\kWTPQkA.exe
  2⤵
  PID:2836
- C:\Windows\System\dbWpkhE.exe
  C:\Windows\System\dbWpkhE.exe
  2⤵
  PID:2596
- C:\Windows\System\bLBnHHM.exe
  C:\Windows\System\bLBnHHM.exe
  2⤵
  PID:2540
- C:\Windows\System\myoicHx.exe
  C:\Windows\System\myoicHx.exe
  2⤵
  PID:1648
- C:\Windows\System\NmMzNSY.exe
  C:\Windows\System\NmMzNSY.exe
  2⤵
  PID:2032
- C:\Windows\System\RXbwtQe.exe
  C:\Windows\System\RXbwtQe.exe
  2⤵
  PID:1600
- C:\Windows\System\rbrCOPd.exe
  C:\Windows\System\rbrCOPd.exe
  2⤵
  PID:1112
- C:\Windows\System\receuTC.exe
  C:\Windows\System\receuTC.exe
  2⤵
  PID:2708
- C:\Windows\System\CETXbPs.exe
  C:\Windows\System\CETXbPs.exe
  2⤵
  PID:332
- C:\Windows\System\HIvvTyq.exe
  C:\Windows\System\HIvvTyq.exe
  2⤵
  PID:1588
- C:\Windows\System\FnBstTh.exe
  C:\Windows\System\FnBstTh.exe
  2⤵
  PID:584
- C:\Windows\System\ImnPNHx.exe
  C:\Windows\System\ImnPNHx.exe
  2⤵
  PID:2252
- C:\Windows\System\faQsdOS.exe
  C:\Windows\System\faQsdOS.exe
  2⤵
  PID:2160
- C:\Windows\System\IBZqIjr.exe
  C:\Windows\System\IBZqIjr.exe
  2⤵
  PID:596
- C:\Windows\System\iulRTlf.exe
  C:\Windows\System\iulRTlf.exe
  2⤵
  PID:1684
- C:\Windows\System\khOuPjX.exe
  C:\Windows\System\khOuPjX.exe
  2⤵
  PID:1276
- C:\Windows\System\HrwDXEl.exe
  C:\Windows\System\HrwDXEl.exe
  2⤵
  PID:328
- C:\Windows\System\ArZfugn.exe
  C:\Windows\System\ArZfugn.exe
  2⤵
  PID:1160
- C:\Windows\System\zelaZGK.exe
  C:\Windows\System\zelaZGK.exe
  2⤵
  PID:2176
- C:\Windows\System\fYWVZJx.exe
  C:\Windows\System\fYWVZJx.exe
  2⤵
  PID:2304
- C:\Windows\System\fCjxUBw.exe
  C:\Windows\System\fCjxUBw.exe
  2⤵
  PID:604
- C:\Windows\System\PTxGyuv.exe
  C:\Windows\System\PTxGyuv.exe
  2⤵
  PID:1004
- C:\Windows\System\ruoZPBG.exe
  C:\Windows\System\ruoZPBG.exe
  2⤵
  PID:2120
- C:\Windows\System\wkQOssG.exe
  C:\Windows\System\wkQOssG.exe
  2⤵
  PID:628
- C:\Windows\System\PASqRad.exe
  C:\Windows\System\PASqRad.exe
  2⤵
  PID:2276
- C:\Windows\System\ppUyoAO.exe
  C:\Windows\System\ppUyoAO.exe
  2⤵
  PID:1860
- C:\Windows\System\eXCKOHk.exe
  C:\Windows\System\eXCKOHk.exe
  2⤵
  PID:2556
- C:\Windows\System\LWQczMR.exe
  C:\Windows\System\LWQczMR.exe
  2⤵
  PID:2072
- C:\Windows\System\OTChmDS.exe
  C:\Windows\System\OTChmDS.exe
  2⤵
  PID:1452
- C:\Windows\System\htXrsca.exe
  C:\Windows\System\htXrsca.exe
  2⤵
  PID:2812
- C:\Windows\System\OzXVsBs.exe
  C:\Windows\System\OzXVsBs.exe
  2⤵
  PID:2784
- C:\Windows\System\HPVMewA.exe
  C:\Windows\System\HPVMewA.exe
  2⤵
  PID:2860
- C:\Windows\System\ADILdwn.exe
  C:\Windows\System\ADILdwn.exe
  2⤵
  PID:1932
- C:\Windows\System\bhvISmf.exe
  C:\Windows\System\bhvISmf.exe
  2⤵
  PID:2868
- C:\Windows\System\tBmGrfu.exe
  C:\Windows\System\tBmGrfu.exe
  2⤵
  PID:2340
- C:\Windows\System\goTfyZv.exe
  C:\Windows\System\goTfyZv.exe
  2⤵
  PID:2820
- C:\Windows\System\zdzxYef.exe
  C:\Windows\System\zdzxYef.exe
  2⤵
  PID:2992
- C:\Windows\System\AVMrFpN.exe
  C:\Windows\System\AVMrFpN.exe
  2⤵
  PID:1420
- C:\Windows\System\zSHAbfP.exe
  C:\Windows\System\zSHAbfP.exe
  2⤵
  PID:2068
- C:\Windows\System\bgXRPWh.exe
  C:\Windows\System\bgXRPWh.exe
  2⤵
  PID:2292
- C:\Windows\System\EhooAOz.exe
  C:\Windows\System\EhooAOz.exe
  2⤵
  PID:2568
- C:\Windows\System\otIbfZw.exe
  C:\Windows\System\otIbfZw.exe
  2⤵
  PID:1704
- C:\Windows\System\ZrngTOb.exe
  C:\Windows\System\ZrngTOb.exe
  2⤵
  PID:2880
- C:\Windows\System\lemqRGL.exe
  C:\Windows\System\lemqRGL.exe
  2⤵
  PID:1540
- C:\Windows\System\ypqJrVm.exe
  C:\Windows\System\ypqJrVm.exe
  2⤵
  PID:3088
- C:\Windows\System\GZNubDc.exe
  C:\Windows\System\GZNubDc.exe
  2⤵
  PID:3104
- C:\Windows\System\HpqSTod.exe
  C:\Windows\System\HpqSTod.exe
  2⤵
  PID:3120
- C:\Windows\System\XpkGJhT.exe
  C:\Windows\System\XpkGJhT.exe
  2⤵
  PID:3136
- C:\Windows\System\ibpBEot.exe
  C:\Windows\System\ibpBEot.exe
  2⤵
  PID:3152
- C:\Windows\System\FtgJiWk.exe
  C:\Windows\System\FtgJiWk.exe
  2⤵
  PID:3168
- C:\Windows\System\zqmRPiO.exe
  C:\Windows\System\zqmRPiO.exe
  2⤵
  PID:3184
- C:\Windows\System\QonVwzK.exe
  C:\Windows\System\QonVwzK.exe
  2⤵
  PID:3208
- C:\Windows\System\kWpLBfT.exe
  C:\Windows\System\kWpLBfT.exe
  2⤵
  PID:3268
- C:\Windows\System\AiNZijt.exe
  C:\Windows\System\AiNZijt.exe
  2⤵
  PID:3296
- C:\Windows\System\JIROIEA.exe
  C:\Windows\System\JIROIEA.exe
  2⤵
  PID:3312
- C:\Windows\System\UisUcxm.exe
  C:\Windows\System\UisUcxm.exe
  2⤵
  PID:3328
- C:\Windows\System\kXrEjPV.exe
  C:\Windows\System\kXrEjPV.exe
  2⤵
  PID:3344
- C:\Windows\System\UDFIhFG.exe
  C:\Windows\System\UDFIhFG.exe
  2⤵
  PID:3364
- C:\Windows\System\bLEXKzH.exe
  C:\Windows\System\bLEXKzH.exe
  2⤵
  PID:3380
- C:\Windows\System\KskZXSw.exe
  C:\Windows\System\KskZXSw.exe
  2⤵
  PID:3396
- C:\Windows\System\InOzECt.exe
  C:\Windows\System\InOzECt.exe
  2⤵
  PID:3412
- C:\Windows\System\iGsrByv.exe
  C:\Windows\System\iGsrByv.exe
  2⤵
  PID:3428
- C:\Windows\System\esylJDl.exe
  C:\Windows\System\esylJDl.exe
  2⤵
  PID:3444
- C:\Windows\System\bBrgKtZ.exe
  C:\Windows\System\bBrgKtZ.exe
  2⤵
  PID:3460
- C:\Windows\System\eLvEbFN.exe
  C:\Windows\System\eLvEbFN.exe
  2⤵
  PID:3476
- C:\Windows\System\ClyYmMo.exe
  C:\Windows\System\ClyYmMo.exe
  2⤵
  PID:3492
- C:\Windows\System\EHPNGxj.exe
  C:\Windows\System\EHPNGxj.exe
  2⤵
  PID:3508
- C:\Windows\System\FHUTbbS.exe
  C:\Windows\System\FHUTbbS.exe
  2⤵
  PID:3524
- C:\Windows\System\EgmYPDL.exe
  C:\Windows\System\EgmYPDL.exe
  2⤵
  PID:3540
- C:\Windows\System\uBCNIoe.exe
  C:\Windows\System\uBCNIoe.exe
  2⤵
  PID:3556
- C:\Windows\System\HSojKmy.exe
  C:\Windows\System\HSojKmy.exe
  2⤵
  PID:3572
- C:\Windows\System\EDxeewz.exe
  C:\Windows\System\EDxeewz.exe
  2⤵
  PID:3588
- C:\Windows\System\oCnvQmy.exe
  C:\Windows\System\oCnvQmy.exe
  2⤵
  PID:3608
- C:\Windows\System\UvdsgHQ.exe
  C:\Windows\System\UvdsgHQ.exe
  2⤵
  PID:3624
- C:\Windows\System\ROVmNCy.exe
  C:\Windows\System\ROVmNCy.exe
  2⤵
  PID:3640
- C:\Windows\System\SbHyCIE.exe
  C:\Windows\System\SbHyCIE.exe
  2⤵
  PID:3656
- C:\Windows\System\HsKsmDo.exe
  C:\Windows\System\HsKsmDo.exe
  2⤵
  PID:3672
- C:\Windows\System\uyplZSN.exe
  C:\Windows\System\uyplZSN.exe
  2⤵
  PID:3688
- C:\Windows\System\GgKHxor.exe
  C:\Windows\System\GgKHxor.exe
  2⤵
  PID:3704
- C:\Windows\System\xqNzhmj.exe
  C:\Windows\System\xqNzhmj.exe
  2⤵
  PID:3720
- C:\Windows\System\DTPbMvG.exe
  C:\Windows\System\DTPbMvG.exe
  2⤵
  PID:3736
- C:\Windows\System\AGbAMzp.exe
  C:\Windows\System\AGbAMzp.exe
  2⤵
  PID:3752
- C:\Windows\System\osPuHpu.exe
  C:\Windows\System\osPuHpu.exe
  2⤵
  PID:3768
- C:\Windows\System\mzoQtiZ.exe
  C:\Windows\System\mzoQtiZ.exe
  2⤵
  PID:3784
- C:\Windows\System\EBfTIRS.exe
  C:\Windows\System\EBfTIRS.exe
  2⤵
  PID:3800
- C:\Windows\System\frrtomy.exe
  C:\Windows\System\frrtomy.exe
  2⤵
  PID:3816
- C:\Windows\System\UYPeSha.exe
  C:\Windows\System\UYPeSha.exe
  2⤵
  PID:3832
- C:\Windows\System\UqwYvqX.exe
  C:\Windows\System\UqwYvqX.exe
  2⤵
  PID:3848
- C:\Windows\System\keyXJwv.exe
  C:\Windows\System\keyXJwv.exe
  2⤵
  PID:3864
- C:\Windows\System\pQGQlvd.exe
  C:\Windows\System\pQGQlvd.exe
  2⤵
  PID:3880
- C:\Windows\System\lINlYuJ.exe
  C:\Windows\System\lINlYuJ.exe
  2⤵
  PID:3896
- C:\Windows\System\zSMXjPj.exe
  C:\Windows\System\zSMXjPj.exe
  2⤵
  PID:3912
- C:\Windows\System\sOmPOJZ.exe
  C:\Windows\System\sOmPOJZ.exe
  2⤵
  PID:3928
- C:\Windows\System\ruaXuCn.exe
  C:\Windows\System\ruaXuCn.exe
  2⤵
  PID:3944
- C:\Windows\System\yuVqOoU.exe
  C:\Windows\System\yuVqOoU.exe
  2⤵
  PID:3960
- C:\Windows\System\rSkDbAt.exe
  C:\Windows\System\rSkDbAt.exe
  2⤵
  PID:3976
- C:\Windows\System\AgTYCDm.exe
  C:\Windows\System\AgTYCDm.exe
  2⤵
  PID:3992
- C:\Windows\System\JDPvmSI.exe
  C:\Windows\System\JDPvmSI.exe
  2⤵
  PID:4008
- C:\Windows\System\rAuMDNh.exe
  C:\Windows\System\rAuMDNh.exe
  2⤵
  PID:4024
- C:\Windows\System\pvJfhBH.exe
  C:\Windows\System\pvJfhBH.exe
  2⤵
  PID:4040
- C:\Windows\System\GfcyjnB.exe
  C:\Windows\System\GfcyjnB.exe
  2⤵
  PID:4056
- C:\Windows\System\oQwmfLr.exe
  C:\Windows\System\oQwmfLr.exe
  2⤵
  PID:4076
- C:\Windows\System\hBULlnh.exe
  C:\Windows\System\hBULlnh.exe
  2⤵
  PID:4092
- C:\Windows\System\qGMPyWc.exe
  C:\Windows\System\qGMPyWc.exe
  2⤵
  PID:3028
- C:\Windows\System\tFdWOJw.exe
  C:\Windows\System\tFdWOJw.exe
  2⤵
  PID:3112
- C:\Windows\System\BCEPtBe.exe
  C:\Windows\System\BCEPtBe.exe
  2⤵
  PID:3144
- C:\Windows\System\EXLTOHx.exe
  C:\Windows\System\EXLTOHx.exe
  2⤵
  PID:3164
- C:\Windows\System\xKyNVwn.exe
  C:\Windows\System\xKyNVwn.exe
  2⤵
  PID:3200
- C:\Windows\System\YbcLjUi.exe
  C:\Windows\System\YbcLjUi.exe
  2⤵
  PID:3236
- C:\Windows\System\bVJtZxO.exe
  C:\Windows\System\bVJtZxO.exe
  2⤵
  PID:3244
- C:\Windows\System\KNAgBCp.exe
  C:\Windows\System\KNAgBCp.exe
  2⤵
  PID:3260
- C:\Windows\System\lhyqIQr.exe
  C:\Windows\System\lhyqIQr.exe
  2⤵
  PID:3284
- C:\Windows\System\jrwewUT.exe
  C:\Windows\System\jrwewUT.exe
  2⤵
  PID:3320
- C:\Windows\System\rwxaqmn.exe
  C:\Windows\System\rwxaqmn.exe
  2⤵
  PID:3388
- C:\Windows\System\HYjOLBS.exe
  C:\Windows\System\HYjOLBS.exe
  2⤵
  PID:3452
- C:\Windows\System\SZHHMLh.exe
  C:\Windows\System\SZHHMLh.exe
  2⤵
  PID:3404
- C:\Windows\System\ZsNMqnl.exe
  C:\Windows\System\ZsNMqnl.exe
  2⤵
  PID:3500
- C:\Windows\System\WMQRzoC.exe
  C:\Windows\System\WMQRzoC.exe
  2⤵
  PID:3336
- C:\Windows\System\MCokpKB.exe
  C:\Windows\System\MCokpKB.exe
  2⤵
  PID:3472
- C:\Windows\System\SVELVMB.exe
  C:\Windows\System\SVELVMB.exe
  2⤵
  PID:3596
- C:\Windows\System\TjpzQFe.exe
  C:\Windows\System\TjpzQFe.exe
  2⤵
  PID:3584
- C:\Windows\System\MghIycQ.exe
  C:\Windows\System\MghIycQ.exe
  2⤵
  PID:3652
- C:\Windows\System\jdIMARZ.exe
  C:\Windows\System\jdIMARZ.exe
  2⤵
  PID:3684
- C:\Windows\System\vQTEFCz.exe
  C:\Windows\System\vQTEFCz.exe
  2⤵
  PID:3744
- C:\Windows\System\nfvCXph.exe
  C:\Windows\System\nfvCXph.exe
  2⤵
  PID:3564
- C:\Windows\System\lelCwrE.exe
  C:\Windows\System\lelCwrE.exe
  2⤵
  PID:3760
- C:\Windows\System\dqCFcNb.exe
  C:\Windows\System\dqCFcNb.exe
  2⤵
  PID:3776
- C:\Windows\System\Awlilae.exe
  C:\Windows\System\Awlilae.exe
  2⤵
  PID:3840
- C:\Windows\System\nzeCrdY.exe
  C:\Windows\System\nzeCrdY.exe
  2⤵
  PID:3828
- C:\Windows\System\yPaoIVj.exe
  C:\Windows\System\yPaoIVj.exe
  2⤵
  PID:3764
- C:\Windows\System\WxPjsjR.exe
  C:\Windows\System\WxPjsjR.exe
  2⤵
  PID:3888
- C:\Windows\System\GkXlTCG.exe
  C:\Windows\System\GkXlTCG.exe
  2⤵
  PID:3956
- C:\Windows\System\YhuQUIK.exe
  C:\Windows\System\YhuQUIK.exe
  2⤵
  PID:3972
- C:\Windows\System\hKuBWbZ.exe
  C:\Windows\System\hKuBWbZ.exe
  2⤵
  PID:4000
- C:\Windows\System\ehIWbjA.exe
  C:\Windows\System\ehIWbjA.exe
  2⤵
  PID:4064
- C:\Windows\System\yNucwyc.exe
  C:\Windows\System\yNucwyc.exe
  2⤵
  PID:2564
- C:\Windows\System\YIKxeIJ.exe
  C:\Windows\System\YIKxeIJ.exe
  2⤵
  PID:3240
- C:\Windows\System\henvayx.exe
  C:\Windows\System\henvayx.exe
  2⤵
  PID:3280
- C:\Windows\System\FElnQha.exe
  C:\Windows\System\FElnQha.exe
  2⤵
  PID:3216
- C:\Windows\System\YkHvIYo.exe
  C:\Windows\System\YkHvIYo.exe
  2⤵
  PID:4084
- C:\Windows\System\DvEnukS.exe
  C:\Windows\System\DvEnukS.exe
  2⤵
  PID:4016
- C:\Windows\System\PNTXYNv.exe
  C:\Windows\System\PNTXYNv.exe
  2⤵
  PID:3252
- C:\Windows\System\kqKTbdO.exe
  C:\Windows\System\kqKTbdO.exe
  2⤵
  PID:3100
- C:\Windows\System\HGpelOu.exe
  C:\Windows\System\HGpelOu.exe
  2⤵
  PID:3372
- C:\Windows\System\mTFAqUk.exe
  C:\Windows\System\mTFAqUk.exe
  2⤵
  PID:3716
- C:\Windows\System\ANIpXAp.exe
  C:\Windows\System\ANIpXAp.exe
  2⤵
  PID:3096
- C:\Windows\System\lxrOhRR.exe
  C:\Windows\System\lxrOhRR.exe
  2⤵
  PID:3532
- C:\Windows\System\cidFZZr.exe
  C:\Windows\System\cidFZZr.exe
  2⤵
  PID:3696
- C:\Windows\System\UmdMyVg.exe
  C:\Windows\System\UmdMyVg.exe
  2⤵
  PID:2672
- C:\Windows\System\XRGXQSi.exe
  C:\Windows\System\XRGXQSi.exe
  2⤵
  PID:3968
- C:\Windows\System\pmnkNHs.exe
  C:\Windows\System\pmnkNHs.exe
  2⤵
  PID:3892
- C:\Windows\System\ETlIkAQ.exe
  C:\Windows\System\ETlIkAQ.exe
  2⤵
  PID:3176
- C:\Windows\System\PYJsyJL.exe
  C:\Windows\System\PYJsyJL.exe
  2⤵
  PID:3456
- C:\Windows\System\ZTUcVJC.exe
  C:\Windows\System\ZTUcVJC.exe
  2⤵
  PID:3600
- C:\Windows\System\vXtwSCZ.exe
  C:\Windows\System\vXtwSCZ.exe
  2⤵
  PID:3580
- C:\Windows\System\WunCWcT.exe
  C:\Windows\System\WunCWcT.exe
  2⤵
  PID:3668
- C:\Windows\System\yTQcUay.exe
  C:\Windows\System\yTQcUay.exe
  2⤵
  PID:3796
- C:\Windows\System\DWGOvnH.exe
  C:\Windows\System\DWGOvnH.exe
  2⤵
  PID:3552
- C:\Windows\System\YqXgiSg.exe
  C:\Windows\System\YqXgiSg.exe
  2⤵
  PID:3860
- C:\Windows\System\YksFrta.exe
  C:\Windows\System\YksFrta.exe
  2⤵
  PID:4036
- C:\Windows\System\ixSGlfV.exe
  C:\Windows\System\ixSGlfV.exe
  2⤵
  PID:3288
- C:\Windows\System\ChzordY.exe
  C:\Windows\System\ChzordY.exe
  2⤵
  PID:4048
- C:\Windows\System\RNcBaUn.exe
  C:\Windows\System\RNcBaUn.exe
  2⤵
  PID:3808
- C:\Windows\System\meuwQqW.exe
  C:\Windows\System\meuwQqW.exe
  2⤵
  PID:3700
- C:\Windows\System\OaKeNsc.exe
  C:\Windows\System\OaKeNsc.exe
  2⤵
  PID:3520
- C:\Windows\System\tOxsQtw.exe
  C:\Windows\System\tOxsQtw.exe
  2⤵
  PID:3936
- C:\Windows\System\FkwqYZI.exe
  C:\Windows\System\FkwqYZI.exe
  2⤵
  PID:3080
- C:\Windows\System\nmrXnuz.exe
  C:\Windows\System\nmrXnuz.exe
  2⤵
  PID:3732
- C:\Windows\System\ddPqMWC.exe
  C:\Windows\System\ddPqMWC.exe
  2⤵
  PID:3924
- C:\Windows\System\xzUlnnp.exe
  C:\Windows\System\xzUlnnp.exe
  2⤵
  PID:3276
- C:\Windows\System\iKsaNZb.exe
  C:\Windows\System\iKsaNZb.exe
  2⤵
  PID:3376
- C:\Windows\System\zvqiFYs.exe
  C:\Windows\System\zvqiFYs.exe
  2⤵
  PID:4108
- C:\Windows\System\OAncqAK.exe
  C:\Windows\System\OAncqAK.exe
  2⤵
  PID:4124
- C:\Windows\System\ajCrddM.exe
  C:\Windows\System\ajCrddM.exe
  2⤵
  PID:4140
- C:\Windows\System\HFCezqa.exe
  C:\Windows\System\HFCezqa.exe
  2⤵
  PID:4156
- C:\Windows\System\zglIBYm.exe
  C:\Windows\System\zglIBYm.exe
  2⤵
  PID:4172
- C:\Windows\System\TuaTEOq.exe
  C:\Windows\System\TuaTEOq.exe
  2⤵
  PID:4188
- C:\Windows\System\zvmkncE.exe
  C:\Windows\System\zvmkncE.exe
  2⤵
  PID:4204
- C:\Windows\System\sIWlJUN.exe
  C:\Windows\System\sIWlJUN.exe
  2⤵
  PID:4224
- C:\Windows\System\TOumBpB.exe
  C:\Windows\System\TOumBpB.exe
  2⤵
  PID:4240
- C:\Windows\System\SFdpKLD.exe
  C:\Windows\System\SFdpKLD.exe
  2⤵
  PID:4256
- C:\Windows\System\ZjYNzio.exe
  C:\Windows\System\ZjYNzio.exe
  2⤵
  PID:4272
- C:\Windows\System\uUfSmOk.exe
  C:\Windows\System\uUfSmOk.exe
  2⤵
  PID:4288
- C:\Windows\System\ZfOhyII.exe
  C:\Windows\System\ZfOhyII.exe
  2⤵
  PID:4304
- C:\Windows\System\CTmXdkV.exe
  C:\Windows\System\CTmXdkV.exe
  2⤵
  PID:4320
- C:\Windows\System\PRFqjZX.exe
  C:\Windows\System\PRFqjZX.exe
  2⤵
  PID:4336
- C:\Windows\System\IFdgZWb.exe
  C:\Windows\System\IFdgZWb.exe
  2⤵
  PID:4352
- C:\Windows\System\QPitvcT.exe
  C:\Windows\System\QPitvcT.exe
  2⤵
  PID:4368
- C:\Windows\System\oBmdEwt.exe
  C:\Windows\System\oBmdEwt.exe
  2⤵
  PID:4384
- C:\Windows\System\UdNZays.exe
  C:\Windows\System\UdNZays.exe
  2⤵
  PID:4400
- C:\Windows\System\LIxJUWj.exe
  C:\Windows\System\LIxJUWj.exe
  2⤵
  PID:4416
- C:\Windows\System\xhpcKKH.exe
  C:\Windows\System\xhpcKKH.exe
  2⤵
  PID:4432
- C:\Windows\System\iktxgup.exe
  C:\Windows\System\iktxgup.exe
  2⤵
  PID:4448
- C:\Windows\System\UZepbpX.exe
  C:\Windows\System\UZepbpX.exe
  2⤵
  PID:4464
- C:\Windows\System\ExIDoiH.exe
  C:\Windows\System\ExIDoiH.exe
  2⤵
  PID:4488
- C:\Windows\System\iNSFnGX.exe
  C:\Windows\System\iNSFnGX.exe
  2⤵
  PID:4504
- C:\Windows\System\YLIzUJY.exe
  C:\Windows\System\YLIzUJY.exe
  2⤵
  PID:4520
- C:\Windows\System\EBIlKHA.exe
  C:\Windows\System\EBIlKHA.exe
  2⤵
  PID:4536
- C:\Windows\System\zUMqNCc.exe
  C:\Windows\System\zUMqNCc.exe
  2⤵
  PID:4552
- C:\Windows\System\kCKaxEd.exe
  C:\Windows\System\kCKaxEd.exe
  2⤵
  PID:4568
- C:\Windows\System\AyyPItK.exe
  C:\Windows\System\AyyPItK.exe
  2⤵
  PID:4588
- C:\Windows\System\AhpPQAv.exe
  C:\Windows\System\AhpPQAv.exe
  2⤵
  PID:4604
- C:\Windows\System\rPIThpe.exe
  C:\Windows\System\rPIThpe.exe
  2⤵
  PID:4620
- C:\Windows\System\shXIyRW.exe
  C:\Windows\System\shXIyRW.exe
  2⤵
  PID:4640
- C:\Windows\System\LFNCAic.exe
  C:\Windows\System\LFNCAic.exe
  2⤵
  PID:4660
- C:\Windows\System\COvFuUM.exe
  C:\Windows\System\COvFuUM.exe
  2⤵
  PID:4676
- C:\Windows\System\cctkase.exe
  C:\Windows\System\cctkase.exe
  2⤵
  PID:4692
- C:\Windows\System\hHPZome.exe
  C:\Windows\System\hHPZome.exe
  2⤵
  PID:4708
- C:\Windows\System\XmqTxDA.exe
  C:\Windows\System\XmqTxDA.exe
  2⤵
  PID:4724
- C:\Windows\System\ZstnivL.exe
  C:\Windows\System\ZstnivL.exe
  2⤵
  PID:4740
- C:\Windows\System\aokClkE.exe
  C:\Windows\System\aokClkE.exe
  2⤵
  PID:4756
- C:\Windows\System\NlSHqWL.exe
  C:\Windows\System\NlSHqWL.exe
  2⤵
  PID:4772
- C:\Windows\System\yJBIUBB.exe
  C:\Windows\System\yJBIUBB.exe
  2⤵
  PID:4788
- C:\Windows\System\BqcoHSJ.exe
  C:\Windows\System\BqcoHSJ.exe
  2⤵
  PID:4804
- C:\Windows\System\wUJPAMv.exe
  C:\Windows\System\wUJPAMv.exe
  2⤵
  PID:4820
- C:\Windows\System\YhQsjKF.exe
  C:\Windows\System\YhQsjKF.exe
  2⤵
  PID:4836
- C:\Windows\System\ViUvcbJ.exe
  C:\Windows\System\ViUvcbJ.exe
  2⤵
  PID:4852
- C:\Windows\System\vSZEThY.exe
  C:\Windows\System\vSZEThY.exe
  2⤵
  PID:4872
- C:\Windows\System\bofeGhR.exe
  C:\Windows\System\bofeGhR.exe
  2⤵
  PID:4892
- C:\Windows\System\sxpTHTA.exe
  C:\Windows\System\sxpTHTA.exe
  2⤵
  PID:4908
- C:\Windows\System\dCgJMvg.exe
  C:\Windows\System\dCgJMvg.exe
  2⤵
  PID:4924
- C:\Windows\System\mLAcSab.exe
  C:\Windows\System\mLAcSab.exe
  2⤵
  PID:4940
- C:\Windows\System\Rytnmuz.exe
  C:\Windows\System\Rytnmuz.exe
  2⤵
  PID:4960
- C:\Windows\System\eMHHWae.exe
  C:\Windows\System\eMHHWae.exe
  2⤵
  PID:4976
- C:\Windows\System\bSteEeL.exe
  C:\Windows\System\bSteEeL.exe
  2⤵
  PID:4992
- C:\Windows\System\yIzFIpk.exe
  C:\Windows\System\yIzFIpk.exe
  2⤵
  PID:5008
- C:\Windows\System\gochsux.exe
  C:\Windows\System\gochsux.exe
  2⤵
  PID:5024
- C:\Windows\System\pZPOZqx.exe
  C:\Windows\System\pZPOZqx.exe
  2⤵
  PID:5040
- C:\Windows\System\TYSpqJa.exe
  C:\Windows\System\TYSpqJa.exe
  2⤵
  PID:5056
- C:\Windows\System\fibRYzl.exe
  C:\Windows\System\fibRYzl.exe
  2⤵
  PID:5072
- C:\Windows\System\AUnnAhp.exe
  C:\Windows\System\AUnnAhp.exe
  2⤵
  PID:5088
- C:\Windows\System\fYfOkqS.exe
  C:\Windows\System\fYfOkqS.exe
  2⤵
  PID:5104
- C:\Windows\System\QdTDbVi.exe
  C:\Windows\System\QdTDbVi.exe
  2⤵
  PID:4100
- C:\Windows\System\rInrJQG.exe
  C:\Windows\System\rInrJQG.exe
  2⤵
  PID:3988
- C:\Windows\System\erQPByx.exe
  C:\Windows\System\erQPByx.exe
  2⤵
  PID:4136
- C:\Windows\System\YMGYRzj.exe
  C:\Windows\System\YMGYRzj.exe
  2⤵
  PID:4236
- C:\Windows\System\tTsAHTJ.exe
  C:\Windows\System\tTsAHTJ.exe
  2⤵
  PID:4248
- C:\Windows\System\sDQFdYJ.exe
  C:\Windows\System\sDQFdYJ.exe
  2⤵
  PID:4216
- C:\Windows\System\rRPxDAl.exe
  C:\Windows\System\rRPxDAl.exe
  2⤵
  PID:4268
- C:\Windows\System\hsCLFQJ.exe
  C:\Windows\System\hsCLFQJ.exe
  2⤵
  PID:4300
- C:\Windows\System\xuHmBPP.exe
  C:\Windows\System\xuHmBPP.exe
  2⤵
  PID:4360
- C:\Windows\System\aaLXwwa.exe
  C:\Windows\System\aaLXwwa.exe
  2⤵
  PID:4348
- C:\Windows\System\ytCkvwY.exe
  C:\Windows\System\ytCkvwY.exe
  2⤵
  PID:4392
- C:\Windows\System\HsxCKlQ.exe
  C:\Windows\System\HsxCKlQ.exe
  2⤵
  PID:4424
- C:\Windows\System\MjYkgTA.exe
  C:\Windows\System\MjYkgTA.exe
  2⤵
  PID:4440
- C:\Windows\System\pVeQloQ.exe
  C:\Windows\System\pVeQloQ.exe
  2⤵
  PID:4480
- C:\Windows\System\inKeADk.exe
  C:\Windows\System\inKeADk.exe
  2⤵
  PID:4472
- C:\Windows\System\YGiOEQm.exe
  C:\Windows\System\YGiOEQm.exe
  2⤵
  PID:4560
- C:\Windows\System\HPfYLSl.exe
  C:\Windows\System\HPfYLSl.exe
  2⤵
  PID:4548
- C:\Windows\System\QmIdVkx.exe
  C:\Windows\System\QmIdVkx.exe
  2⤵
  PID:4600
- C:\Windows\System\qDQcAHp.exe
  C:\Windows\System\qDQcAHp.exe
  2⤵
  PID:4668
- C:\Windows\System\WowiGkZ.exe
  C:\Windows\System\WowiGkZ.exe
  2⤵
  PID:4616
- C:\Windows\System\dKePkbE.exe
  C:\Windows\System\dKePkbE.exe
  2⤵
  PID:4736
- C:\Windows\System\MZBHTAM.exe
  C:\Windows\System\MZBHTAM.exe
  2⤵
  PID:4800
- C:\Windows\System\oCVbMdI.exe
  C:\Windows\System\oCVbMdI.exe
  2⤵
  PID:4688
- C:\Windows\System\ToiNynH.exe
  C:\Windows\System\ToiNynH.exe
  2⤵
  PID:4748
- C:\Windows\System\RJjFFOH.exe
  C:\Windows\System\RJjFFOH.exe
  2⤵
  PID:4816
- C:\Windows\System\wQGMbeA.exe
  C:\Windows\System\wQGMbeA.exe
  2⤵
  PID:4864
- C:\Windows\System\PjmqrFN.exe
  C:\Windows\System\PjmqrFN.exe
  2⤵
  PID:4932
- C:\Windows\System\YfxxvBu.exe
  C:\Windows\System\YfxxvBu.exe
  2⤵
  PID:5000
- C:\Windows\System\NMreiuy.exe
  C:\Windows\System\NMreiuy.exe
  2⤵
  PID:5064
- C:\Windows\System\saLnpjD.exe
  C:\Windows\System\saLnpjD.exe
  2⤵
  PID:4848
- C:\Windows\System\nnHHHHO.exe
  C:\Windows\System\nnHHHHO.exe
  2⤵
  PID:5048
- C:\Windows\System\HtrPgqp.exe
  C:\Windows\System\HtrPgqp.exe
  2⤵
  PID:4916
- C:\Windows\System\hgAGnPZ.exe
  C:\Windows\System\hgAGnPZ.exe
  2⤵
  PID:4952
- C:\Windows\System\GAmhvUK.exe
  C:\Windows\System\GAmhvUK.exe
  2⤵
  PID:5052
- C:\Windows\System\ttgmBsB.exe
  C:\Windows\System\ttgmBsB.exe
  2⤵
  PID:4296
- C:\Windows\System\mmSWxxe.exe
  C:\Windows\System\mmSWxxe.exe
  2⤵
  PID:4412
- C:\Windows\System\sRvrcfV.exe
  C:\Windows\System\sRvrcfV.exe
  2⤵
  PID:4496
- C:\Windows\System\tFoCWHV.exe
  C:\Windows\System\tFoCWHV.exe
  2⤵
  PID:4700
- C:\Windows\System\buAGNNL.exe
  C:\Windows\System\buAGNNL.exe
  2⤵
  PID:4720
- C:\Windows\System\kfrmChV.exe
  C:\Windows\System\kfrmChV.exe
  2⤵
  PID:4968
- C:\Windows\System\TSEiNpS.exe
  C:\Windows\System\TSEiNpS.exe
  2⤵
  PID:5100
- C:\Windows\System\aktfukq.exe
  C:\Windows\System\aktfukq.exe
  2⤵
  PID:4988
- C:\Windows\System\JAHwPIb.exe
  C:\Windows\System\JAHwPIb.exe
  2⤵
  PID:4376
- C:\Windows\System\QZGVsRU.exe
  C:\Windows\System\QZGVsRU.exe
  2⤵
  PID:4456
- C:\Windows\System\oWPLPdS.exe
  C:\Windows\System\oWPLPdS.exe
  2⤵
  PID:4596
- C:\Windows\System\rUeoIKn.exe
  C:\Windows\System\rUeoIKn.exe
  2⤵
  PID:4168
- C:\Windows\System\ijAwJno.exe
  C:\Windows\System\ijAwJno.exe
  2⤵
  PID:4212
- C:\Windows\System\SKlrRUx.exe
  C:\Windows\System\SKlrRUx.exe
  2⤵
  PID:4576
- C:\Windows\System\hpuzuoE.exe
  C:\Windows\System\hpuzuoE.exe
  2⤵
  PID:4656
- C:\Windows\System\jpyFFQs.exe
  C:\Windows\System\jpyFFQs.exe
  2⤵
  PID:4784
- C:\Windows\System\PzjfJMo.exe
  C:\Windows\System\PzjfJMo.exe
  2⤵
  PID:5032
- C:\Windows\System\wSTRkkD.exe
  C:\Windows\System\wSTRkkD.exe
  2⤵
  PID:4884
- C:\Windows\System\YwJMwRl.exe
  C:\Windows\System\YwJMwRl.exe
  2⤵
  PID:4116
- C:\Windows\System\OXciZMv.exe
  C:\Windows\System\OXciZMv.exe
  2⤵
  PID:4860
- C:\Windows\System\ZWeMSLn.exe
  C:\Windows\System\ZWeMSLn.exe
  2⤵
  PID:4180
- C:\Windows\System\IHrDzzm.exe
  C:\Windows\System\IHrDzzm.exe
  2⤵
  PID:4632
- C:\Windows\System\TnXCTXm.exe
  C:\Windows\System\TnXCTXm.exe
  2⤵
  PID:4904
- C:\Windows\System\gaaUegL.exe
  C:\Windows\System\gaaUegL.exe
  2⤵
  PID:4796
- C:\Windows\System\bROMMJP.exe
  C:\Windows\System\bROMMJP.exe
  2⤵
  PID:5132
- C:\Windows\System\fJHVynf.exe
  C:\Windows\System\fJHVynf.exe
  2⤵
  PID:5148
- C:\Windows\System\oQMnmOk.exe
  C:\Windows\System\oQMnmOk.exe
  2⤵
  PID:5164
- C:\Windows\System\dkvNmJZ.exe
  C:\Windows\System\dkvNmJZ.exe
  2⤵
  PID:5180
- C:\Windows\System\hDvsNof.exe
  C:\Windows\System\hDvsNof.exe
  2⤵
  PID:5196
- C:\Windows\System\hcRRCOU.exe
  C:\Windows\System\hcRRCOU.exe
  2⤵
  PID:5212
- C:\Windows\System\FeUtKqs.exe
  C:\Windows\System\FeUtKqs.exe
  2⤵
  PID:5228
- C:\Windows\System\sxaHFDI.exe
  C:\Windows\System\sxaHFDI.exe
  2⤵
  PID:5244
- C:\Windows\System\melMNrm.exe
  C:\Windows\System\melMNrm.exe
  2⤵
  PID:5260
- C:\Windows\System\YNBnPcH.exe
  C:\Windows\System\YNBnPcH.exe
  2⤵
  PID:5276
- C:\Windows\System\pQvbHuI.exe
  C:\Windows\System\pQvbHuI.exe
  2⤵
  PID:5292
- C:\Windows\System\wZYdmTx.exe
  C:\Windows\System\wZYdmTx.exe
  2⤵
  PID:5308
- C:\Windows\System\hxgauwJ.exe
  C:\Windows\System\hxgauwJ.exe
  2⤵
  PID:5324
- C:\Windows\System\NXsgQbE.exe
  C:\Windows\System\NXsgQbE.exe
  2⤵
  PID:5340
- C:\Windows\System\TvUijdZ.exe
  C:\Windows\System\TvUijdZ.exe
  2⤵
  PID:5356
- C:\Windows\System\IuDDCCC.exe
  C:\Windows\System\IuDDCCC.exe
  2⤵
  PID:5372
- C:\Windows\System\htYCTQy.exe
  C:\Windows\System\htYCTQy.exe
  2⤵
  PID:5388
- C:\Windows\System\itTMkXj.exe
  C:\Windows\System\itTMkXj.exe
  2⤵
  PID:5404
- C:\Windows\System\ijAPJbA.exe
  C:\Windows\System\ijAPJbA.exe
  2⤵
  PID:5420
- C:\Windows\System\RQJCSyd.exe
  C:\Windows\System\RQJCSyd.exe
  2⤵
  PID:5436
- C:\Windows\System\JhMziLa.exe
  C:\Windows\System\JhMziLa.exe
  2⤵
  PID:5452
- C:\Windows\System\XscWWEF.exe
  C:\Windows\System\XscWWEF.exe
  2⤵
  PID:5468
- C:\Windows\System\zLnyRuf.exe
  C:\Windows\System\zLnyRuf.exe
  2⤵
  PID:5484
- C:\Windows\System\Mbnxbdv.exe
  C:\Windows\System\Mbnxbdv.exe
  2⤵
  PID:5500
- C:\Windows\System\RYMmGsm.exe
  C:\Windows\System\RYMmGsm.exe
  2⤵
  PID:5516
- C:\Windows\System\oYCgJqR.exe
  C:\Windows\System\oYCgJqR.exe
  2⤵
  PID:5532
- C:\Windows\System\PgBofjH.exe
  C:\Windows\System\PgBofjH.exe
  2⤵
  PID:5548
- C:\Windows\System\BMcEbWg.exe
  C:\Windows\System\BMcEbWg.exe
  2⤵
  PID:5564
- C:\Windows\System\rgLelar.exe
  C:\Windows\System\rgLelar.exe
  2⤵
  PID:5580
- C:\Windows\System\VlRREcH.exe
  C:\Windows\System\VlRREcH.exe
  2⤵
  PID:5596
- C:\Windows\System\lOZKbob.exe
  C:\Windows\System\lOZKbob.exe
  2⤵
  PID:5612
- C:\Windows\System\UmRvrKw.exe
  C:\Windows\System\UmRvrKw.exe
  2⤵
  PID:5628
- C:\Windows\System\vfHVVHa.exe
  C:\Windows\System\vfHVVHa.exe
  2⤵
  PID:5644
- C:\Windows\System\ZIrLQCe.exe
  C:\Windows\System\ZIrLQCe.exe
  2⤵
  PID:5660
- C:\Windows\System\fLDXmwo.exe
  C:\Windows\System\fLDXmwo.exe
  2⤵
  PID:5676
- C:\Windows\System\YhsxXPl.exe
  C:\Windows\System\YhsxXPl.exe
  2⤵
  PID:5692
- C:\Windows\System\ifuaqvh.exe
  C:\Windows\System\ifuaqvh.exe
  2⤵
  PID:5708
- C:\Windows\System\nPKnWwt.exe
  C:\Windows\System\nPKnWwt.exe
  2⤵
  PID:5724
- C:\Windows\System\OWPjTTd.exe
  C:\Windows\System\OWPjTTd.exe
  2⤵
  PID:5740
- C:\Windows\System\GLfvHFg.exe
  C:\Windows\System\GLfvHFg.exe
  2⤵
  PID:5756
- C:\Windows\System\jhuZsPg.exe
  C:\Windows\System\jhuZsPg.exe
  2⤵
  PID:5772
- C:\Windows\System\HLJaFXD.exe
  C:\Windows\System\HLJaFXD.exe
  2⤵
  PID:5788
- C:\Windows\System\qDqEUhG.exe
  C:\Windows\System\qDqEUhG.exe
  2⤵
  PID:5804
- C:\Windows\System\pmbONrm.exe
  C:\Windows\System\pmbONrm.exe
  2⤵
  PID:5820
- C:\Windows\System\dMTtNFr.exe
  C:\Windows\System\dMTtNFr.exe
  2⤵
  PID:5836
- C:\Windows\System\HxAziBE.exe
  C:\Windows\System\HxAziBE.exe
  2⤵
  PID:5852
- C:\Windows\System\JTBLZsp.exe
  C:\Windows\System\JTBLZsp.exe
  2⤵
  PID:5868
- C:\Windows\System\VHRkOve.exe
  C:\Windows\System\VHRkOve.exe
  2⤵
  PID:5884
- C:\Windows\System\HzQBpLx.exe
  C:\Windows\System\HzQBpLx.exe
  2⤵
  PID:5900
- C:\Windows\System\VsTlziT.exe
  C:\Windows\System\VsTlziT.exe
  2⤵
  PID:5916
- C:\Windows\System\LOaFWeu.exe
  C:\Windows\System\LOaFWeu.exe
  2⤵
  PID:5932
- C:\Windows\System\tRjIYeZ.exe
  C:\Windows\System\tRjIYeZ.exe
  2⤵
  PID:5948
- C:\Windows\System\iNSBhEr.exe
  C:\Windows\System\iNSBhEr.exe
  2⤵
  PID:5964
- C:\Windows\System\EJzVuSt.exe
  C:\Windows\System\EJzVuSt.exe
  2⤵
  PID:5980
- C:\Windows\System\Ynhrdbs.exe
  C:\Windows\System\Ynhrdbs.exe
  2⤵
  PID:5996
- C:\Windows\System\ekzsogi.exe
  C:\Windows\System\ekzsogi.exe
  2⤵
  PID:6012
- C:\Windows\System\XlEnKYz.exe
  C:\Windows\System\XlEnKYz.exe
  2⤵
  PID:6028
- C:\Windows\System\viZEOng.exe
  C:\Windows\System\viZEOng.exe
  2⤵
  PID:6044
- C:\Windows\System\AHkGGaJ.exe
  C:\Windows\System\AHkGGaJ.exe
  2⤵
  PID:6060
- C:\Windows\System\bhNuVSi.exe
  C:\Windows\System\bhNuVSi.exe
  2⤵
  PID:6076
- C:\Windows\System\UHSxnbw.exe
  C:\Windows\System\UHSxnbw.exe
  2⤵
  PID:6092
- C:\Windows\System\irhbjYp.exe
  C:\Windows\System\irhbjYp.exe
  2⤵
  PID:6108
- C:\Windows\System\FwtkTOb.exe
  C:\Windows\System\FwtkTOb.exe
  2⤵
  PID:6124
- C:\Windows\System\cxVMRdD.exe
  C:\Windows\System\cxVMRdD.exe
  2⤵
  PID:6140
- C:\Windows\System\vhZaHsw.exe
  C:\Windows\System\vhZaHsw.exe
  2⤵
  PID:4684
- C:\Windows\System\PIHCrPa.exe
  C:\Windows\System\PIHCrPa.exe
  2⤵
  PID:4584
- C:\Windows\System\qiMEYLB.exe
  C:\Windows\System\qiMEYLB.exe
  2⤵
  PID:5220
- C:\Windows\System\DVtcfXN.exe
  C:\Windows\System\DVtcfXN.exe
  2⤵
  PID:5172
- C:\Windows\System\xnqnKcz.exe
  C:\Windows\System\xnqnKcz.exe
  2⤵
  PID:5156
- C:\Windows\System\vqtXYWW.exe
  C:\Windows\System\vqtXYWW.exe
  2⤵
  PID:5252
- C:\Windows\System\gCgYuaP.exe
  C:\Windows\System\gCgYuaP.exe
  2⤵
  PID:5316
- C:\Windows\System\YmQQVcQ.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes