xmrig | 37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63

Analysis

max time kernel
90s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
Size

1.4MB
MD5

3d7c58e2b5035d2e0cc61ff34f3a606a
SHA1

2b36a6b89aedb5987145cf827a9429826ca2642a
SHA256

37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63
SHA512

b8027b3b724a115ff8f2257cd856b7dd53a95376e101158009237e35ed22cb64471547f1913fd337553fcb72283b061395a1651088b07e22a77b3e6f0fbdce10
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IsSAN0z3Z4:GezaTF8FcNkNdfE0pZ9ozttwIRakGNrB

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023b92-4.dat	xmrig
behavioral2/files/0x000a000000023b97-6.dat	xmrig
behavioral2/files/0x000a000000023b96-7.dat	xmrig
behavioral2/files/0x000a000000023b98-17.dat	xmrig
behavioral2/files/0x000a000000023b99-25.dat	xmrig
behavioral2/files/0x000a000000023b9a-30.dat	xmrig
behavioral2/files/0x000a000000023b9b-41.dat	xmrig
behavioral2/files/0x000a000000023b9d-49.dat	xmrig
behavioral2/files/0x000a000000023b9e-51.dat	xmrig
behavioral2/files/0x000a000000023ba0-64.dat	xmrig
behavioral2/files/0x000b000000023ba3-80.dat	xmrig
behavioral2/files/0x000b000000023ba5-89.dat	xmrig
behavioral2/files/0x000b000000023ba4-87.dat	xmrig
behavioral2/files/0x000a000000023ba2-83.dat	xmrig
behavioral2/files/0x000a000000023ba1-75.dat	xmrig
behavioral2/files/0x000a000000023b9f-66.dat	xmrig
behavioral2/files/0x000b000000023b93-48.dat	xmrig
behavioral2/files/0x000a000000023b9c-45.dat	xmrig
behavioral2/files/0x000a000000023bad-93.dat	xmrig
behavioral2/files/0x000e000000023bb4-96.dat	xmrig
behavioral2/files/0x0009000000023bc2-108.dat	xmrig
behavioral2/files/0x0009000000023bc4-116.dat	xmrig
behavioral2/files/0x0008000000023bcd-129.dat	xmrig
behavioral2/files/0x0008000000023bd0-140.dat	xmrig
behavioral2/files/0x0008000000023bff-150.dat	xmrig
behavioral2/files/0x0008000000023bcf-146.dat	xmrig
behavioral2/files/0x0008000000023bce-144.dat	xmrig
behavioral2/files/0x0008000000023bca-125.dat	xmrig
behavioral2/files/0x000e000000023bc8-123.dat	xmrig
behavioral2/files/0x0008000000023bbd-105.dat	xmrig
behavioral2/files/0x0008000000023c00-160.dat	xmrig
behavioral2/files/0x0008000000023c01-161.dat	xmrig
behavioral2/files/0x0008000000023c02-159.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2920	stPCwDZ.exe
1428	vYUZhbD.exe
1072	CHDOHPW.exe
4156	Udxvafa.exe
780	ZsUhCzF.exe
2620	AVHayXB.exe
1268	MNRPbnW.exe
1740	lcyBtyd.exe
1920	cPEPruk.exe
5024	aTgzXhm.exe
5052	tvazmdA.exe
1120	ngTFYQx.exe
4124	JupQJhG.exe
844	rPJnSDD.exe
1416	XKGqWQm.exe
4932	RHcvKdh.exe
4328	ImciJys.exe
4660	wppbamS.exe
4384	YnOnfHZ.exe
2344	AcDPLkO.exe
3108	oAZwTpr.exe
1388	jkCsaPY.exe
3600	iWiUDYt.exe
4996	HQIEFJq.exe
1480	ppUryXD.exe
3200	BKYmYWx.exe
768	beMTtdI.exe
4368	rqUzyZE.exe
2516	JseAmZe.exe
404	cMOrhuY.exe
4976	qmKSwKH.exe
2292	lvwRbbd.exe
4732	bhusOML.exe
4844	mvSRdqF.exe
208	xYBAvES.exe
4820	nfdUFXu.exe
4612	YRHHSub.exe
1904	CfHsuQT.exe
5096	tElZLZG.exe
764	cBZPRuc.exe
3876	CueqExE.exe
4920	HSKxtGJ.exe
1724	XJiEBVs.exe
2176	LRUZaCw.exe
1080	eNNRmEn.exe
4272	ywdKnCk.exe
4924	mNadLgA.exe
2832	syXYSss.exe
1308	jUCROsL.exe
4968	dzVuOac.exe
2144	JMHGVHy.exe
2776	RuWvDcx.exe
4896	tHeJpNW.exe
3116	IPjtDCc.exe
3468	Slkspzo.exe
932	TomRKuk.exe
2220	ftTtPGI.exe
4432	elPRxIi.exe
928	BwigwPv.exe
4908	QMockns.exe
4004	YeVEQFP.exe
448	ukZgYmh.exe
2872	AGbgTFL.exe
3540	QFryjyZ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TAnUoFe.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\fbgjvtD.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\qViSJtB.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ngHWcQf.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\cypCODl.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\cPEPruk.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ElcMHft.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\HqfATyd.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\OfCQbth.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\fPHikgp.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ZSHIrWv.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ovPlugH.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\WnOVIkT.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\CqyIMlc.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ZbiDWHA.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ZUgfVfh.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\rtxzNsp.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\uoeDOUz.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\PKjKHAh.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\OEhBORe.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\GDXTvFy.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\hAXUmAi.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\EEexCai.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\VKHapsi.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\dqrnEoh.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\OMhQXme.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\XJJBwrv.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\mBeODYN.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ImciJys.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\XPRCQTc.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\AYRnFbv.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\wjnZzcc.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\sTuWeJa.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\zeSUvhF.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\blTilfW.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\YdAOoXJ.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\nHFuxSD.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\gGQZamn.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\RuWvDcx.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\KYHgvVm.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\icWDCRy.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\fuXNHMI.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\MuVrPlY.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\aNhAPPh.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\eYEBUYI.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\dPXwnyr.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ERsIUid.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ZQvFcGh.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\aNXDavt.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\Oyfwmic.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\usDWYOK.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\xRtdZPr.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\HSKxtGJ.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\CxmkeVm.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\TVSwCsD.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\oAZwTpr.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\rnfeIVm.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\tiCTNSz.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\MUNzePS.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\RyGQQVD.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\vNSxZuI.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\QhTOXRV.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\ZWxOgDY.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
File created	C:\Windows\System\YaVQLqH.exe	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 2920	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	86
PID 3592 wrote to memory of 2920	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	86
PID 3592 wrote to memory of 1428	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	87
PID 3592 wrote to memory of 1428	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	87
PID 3592 wrote to memory of 1072	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	88
PID 3592 wrote to memory of 1072	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	88
PID 3592 wrote to memory of 4156	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	89
PID 3592 wrote to memory of 4156	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	89
PID 3592 wrote to memory of 780	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	90
PID 3592 wrote to memory of 780	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	90
PID 3592 wrote to memory of 2620	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	91
PID 3592 wrote to memory of 2620	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	91
PID 3592 wrote to memory of 1268	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	92
PID 3592 wrote to memory of 1268	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	92
PID 3592 wrote to memory of 1740	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	93
PID 3592 wrote to memory of 1740	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	93
PID 3592 wrote to memory of 1920	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	94
PID 3592 wrote to memory of 1920	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	94
PID 3592 wrote to memory of 5024	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	95
PID 3592 wrote to memory of 5024	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	95
PID 3592 wrote to memory of 5052	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	96
PID 3592 wrote to memory of 5052	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	96
PID 3592 wrote to memory of 1120	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	97
PID 3592 wrote to memory of 1120	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	97
PID 3592 wrote to memory of 4124	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	98
PID 3592 wrote to memory of 4124	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	98
PID 3592 wrote to memory of 844	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	99
PID 3592 wrote to memory of 844	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	99
PID 3592 wrote to memory of 1416	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	100
PID 3592 wrote to memory of 1416	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	100
PID 3592 wrote to memory of 4932	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	101
PID 3592 wrote to memory of 4932	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	101
PID 3592 wrote to memory of 4328	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	102
PID 3592 wrote to memory of 4328	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	102
PID 3592 wrote to memory of 4660	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	104
PID 3592 wrote to memory of 4660	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	104
PID 3592 wrote to memory of 4384	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	106
PID 3592 wrote to memory of 4384	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	106
PID 3592 wrote to memory of 2344	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	107
PID 3592 wrote to memory of 2344	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	107
PID 3592 wrote to memory of 3108	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	108
PID 3592 wrote to memory of 3108	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	108
PID 3592 wrote to memory of 1388	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	109
PID 3592 wrote to memory of 1388	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	109
PID 3592 wrote to memory of 3600	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	110
PID 3592 wrote to memory of 3600	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	110
PID 3592 wrote to memory of 4996	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	111
PID 3592 wrote to memory of 4996	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	111
PID 3592 wrote to memory of 1480	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	112
PID 3592 wrote to memory of 1480	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	112
PID 3592 wrote to memory of 3200	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	114
PID 3592 wrote to memory of 3200	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	114
PID 3592 wrote to memory of 768	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	115
PID 3592 wrote to memory of 768	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	115
PID 3592 wrote to memory of 4368	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	116
PID 3592 wrote to memory of 4368	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	116
PID 3592 wrote to memory of 2516	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	117
PID 3592 wrote to memory of 2516	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	117
PID 3592 wrote to memory of 404	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	118
PID 3592 wrote to memory of 404	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	118
PID 3592 wrote to memory of 4976	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	119
PID 3592 wrote to memory of 4976	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	119
PID 3592 wrote to memory of 4732	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	120
PID 3592 wrote to memory of 4732	3592	37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe	120

C:\Users\Admin\AppData\Local\Temp\37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe
"C:\Users\Admin\AppData\Local\Temp\37f0201427b8a591a9d4f4b24af1089aaa2ec4b527ac5568a7aee39f2932db63.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\System\stPCwDZ.exe
  C:\Windows\System\stPCwDZ.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\vYUZhbD.exe
  C:\Windows\System\vYUZhbD.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\CHDOHPW.exe
  C:\Windows\System\CHDOHPW.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\Udxvafa.exe
  C:\Windows\System\Udxvafa.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\ZsUhCzF.exe
  C:\Windows\System\ZsUhCzF.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\AVHayXB.exe
  C:\Windows\System\AVHayXB.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\MNRPbnW.exe
  C:\Windows\System\MNRPbnW.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\lcyBtyd.exe
  C:\Windows\System\lcyBtyd.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\cPEPruk.exe
  C:\Windows\System\cPEPruk.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\aTgzXhm.exe
  C:\Windows\System\aTgzXhm.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\tvazmdA.exe
  C:\Windows\System\tvazmdA.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\ngTFYQx.exe
  C:\Windows\System\ngTFYQx.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\JupQJhG.exe
  C:\Windows\System\JupQJhG.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\rPJnSDD.exe
  C:\Windows\System\rPJnSDD.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\XKGqWQm.exe
  C:\Windows\System\XKGqWQm.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\RHcvKdh.exe
  C:\Windows\System\RHcvKdh.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\ImciJys.exe
  C:\Windows\System\ImciJys.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\wppbamS.exe
  C:\Windows\System\wppbamS.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\YnOnfHZ.exe
  C:\Windows\System\YnOnfHZ.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\AcDPLkO.exe
  C:\Windows\System\AcDPLkO.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\oAZwTpr.exe
  C:\Windows\System\oAZwTpr.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\jkCsaPY.exe
  C:\Windows\System\jkCsaPY.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\iWiUDYt.exe
  C:\Windows\System\iWiUDYt.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\HQIEFJq.exe
  C:\Windows\System\HQIEFJq.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\ppUryXD.exe
  C:\Windows\System\ppUryXD.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\BKYmYWx.exe
  C:\Windows\System\BKYmYWx.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\beMTtdI.exe
  C:\Windows\System\beMTtdI.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\rqUzyZE.exe
  C:\Windows\System\rqUzyZE.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\JseAmZe.exe
  C:\Windows\System\JseAmZe.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\cMOrhuY.exe
  C:\Windows\System\cMOrhuY.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\qmKSwKH.exe
  C:\Windows\System\qmKSwKH.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\bhusOML.exe
  C:\Windows\System\bhusOML.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\lvwRbbd.exe
  C:\Windows\System\lvwRbbd.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\mvSRdqF.exe
  C:\Windows\System\mvSRdqF.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\xYBAvES.exe
  C:\Windows\System\xYBAvES.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\nfdUFXu.exe
  C:\Windows\System\nfdUFXu.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\YRHHSub.exe
  C:\Windows\System\YRHHSub.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\CfHsuQT.exe
  C:\Windows\System\CfHsuQT.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\tElZLZG.exe
  C:\Windows\System\tElZLZG.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\cBZPRuc.exe
  C:\Windows\System\cBZPRuc.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\CueqExE.exe
  C:\Windows\System\CueqExE.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\HSKxtGJ.exe
  C:\Windows\System\HSKxtGJ.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\XJiEBVs.exe
  C:\Windows\System\XJiEBVs.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\LRUZaCw.exe
  C:\Windows\System\LRUZaCw.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\eNNRmEn.exe
  C:\Windows\System\eNNRmEn.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\ywdKnCk.exe
  C:\Windows\System\ywdKnCk.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\mNadLgA.exe
  C:\Windows\System\mNadLgA.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\syXYSss.exe
  C:\Windows\System\syXYSss.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\jUCROsL.exe
  C:\Windows\System\jUCROsL.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\dzVuOac.exe
  C:\Windows\System\dzVuOac.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\JMHGVHy.exe
  C:\Windows\System\JMHGVHy.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\tHeJpNW.exe
  C:\Windows\System\tHeJpNW.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\RuWvDcx.exe
  C:\Windows\System\RuWvDcx.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\IPjtDCc.exe
  C:\Windows\System\IPjtDCc.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\Slkspzo.exe
  C:\Windows\System\Slkspzo.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\TomRKuk.exe
  C:\Windows\System\TomRKuk.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\ftTtPGI.exe
  C:\Windows\System\ftTtPGI.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\elPRxIi.exe
  C:\Windows\System\elPRxIi.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\BwigwPv.exe
  C:\Windows\System\BwigwPv.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\QMockns.exe
  C:\Windows\System\QMockns.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\YeVEQFP.exe
  C:\Windows\System\YeVEQFP.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\ukZgYmh.exe
  C:\Windows\System\ukZgYmh.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\AGbgTFL.exe
  C:\Windows\System\AGbgTFL.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\QFryjyZ.exe
  C:\Windows\System\QFryjyZ.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\bgNkStL.exe
  C:\Windows\System\bgNkStL.exe
  2⤵
  PID:1376
- C:\Windows\System\tqGEvhk.exe
  C:\Windows\System\tqGEvhk.exe
  2⤵
  PID:1188
- C:\Windows\System\sYNuehw.exe
  C:\Windows\System\sYNuehw.exe
  2⤵
  PID:1296
- C:\Windows\System\XPRCQTc.exe
  C:\Windows\System\XPRCQTc.exe
  2⤵
  PID:4828
- C:\Windows\System\TAnUoFe.exe
  C:\Windows\System\TAnUoFe.exe
  2⤵
  PID:4668
- C:\Windows\System\blTilfW.exe
  C:\Windows\System\blTilfW.exe
  2⤵
  PID:3868
- C:\Windows\System\SiEGuAT.exe
  C:\Windows\System\SiEGuAT.exe
  2⤵
  PID:1664
- C:\Windows\System\MXNimLx.exe
  C:\Windows\System\MXNimLx.exe
  2⤵
  PID:3208
- C:\Windows\System\iUKFjtT.exe
  C:\Windows\System\iUKFjtT.exe
  2⤵
  PID:1276
- C:\Windows\System\alnBTzS.exe
  C:\Windows\System\alnBTzS.exe
  2⤵
  PID:4916
- C:\Windows\System\FqRtOgk.exe
  C:\Windows\System\FqRtOgk.exe
  2⤵
  PID:2056
- C:\Windows\System\YTEJQDQ.exe
  C:\Windows\System\YTEJQDQ.exe
  2⤵
  PID:3816
- C:\Windows\System\EgDOzjB.exe
  C:\Windows\System\EgDOzjB.exe
  2⤵
  PID:1884
- C:\Windows\System\ERTqmAR.exe
  C:\Windows\System\ERTqmAR.exe
  2⤵
  PID:2040
- C:\Windows\System\FNMaKxq.exe
  C:\Windows\System\FNMaKxq.exe
  2⤵
  PID:4552
- C:\Windows\System\cuGWmZx.exe
  C:\Windows\System\cuGWmZx.exe
  2⤵
  PID:1832
- C:\Windows\System\eAeCokC.exe
  C:\Windows\System\eAeCokC.exe
  2⤵
  PID:4600
- C:\Windows\System\XOGbcpp.exe
  C:\Windows\System\XOGbcpp.exe
  2⤵
  PID:1476
- C:\Windows\System\tydTXYS.exe
  C:\Windows\System\tydTXYS.exe
  2⤵
  PID:1108
- C:\Windows\System\ncLNQDm.exe
  C:\Windows\System\ncLNQDm.exe
  2⤵
  PID:348
- C:\Windows\System\GkLbHrF.exe
  C:\Windows\System\GkLbHrF.exe
  2⤵
  PID:3928
- C:\Windows\System\NkGdWLp.exe
  C:\Windows\System\NkGdWLp.exe
  2⤵
  PID:4764
- C:\Windows\System\IcrZJvy.exe
  C:\Windows\System\IcrZJvy.exe
  2⤵
  PID:2508
- C:\Windows\System\YrXqCXs.exe
  C:\Windows\System\YrXqCXs.exe
  2⤵
  PID:4812
- C:\Windows\System\yyQuALz.exe
  C:\Windows\System\yyQuALz.exe
  2⤵
  PID:4724
- C:\Windows\System\XKQrodk.exe
  C:\Windows\System\XKQrodk.exe
  2⤵
  PID:3712
- C:\Windows\System\JOjjWVH.exe
  C:\Windows\System\JOjjWVH.exe
  2⤵
  PID:2428
- C:\Windows\System\gtOJwxA.exe
  C:\Windows\System\gtOJwxA.exe
  2⤵
  PID:1372
- C:\Windows\System\duwjvkH.exe
  C:\Windows\System\duwjvkH.exe
  2⤵
  PID:3956
- C:\Windows\System\RSvMrAr.exe
  C:\Windows\System\RSvMrAr.exe
  2⤵
  PID:3584
- C:\Windows\System\AYRnFbv.exe
  C:\Windows\System\AYRnFbv.exe
  2⤵
  PID:3676
- C:\Windows\System\rjCIxXk.exe
  C:\Windows\System\rjCIxXk.exe
  2⤵
  PID:2200
- C:\Windows\System\bTaPxHI.exe
  C:\Windows\System\bTaPxHI.exe
  2⤵
  PID:2904
- C:\Windows\System\cTZMJAk.exe
  C:\Windows\System\cTZMJAk.exe
  2⤵
  PID:1544
- C:\Windows\System\YvYFEWW.exe
  C:\Windows\System\YvYFEWW.exe
  2⤵
  PID:3240
- C:\Windows\System\FGeMzKR.exe
  C:\Windows\System\FGeMzKR.exe
  2⤵
  PID:4052
- C:\Windows\System\xOQAfKQ.exe
  C:\Windows\System\xOQAfKQ.exe
  2⤵
  PID:3840
- C:\Windows\System\NtGQhnh.exe
  C:\Windows\System\NtGQhnh.exe
  2⤵
  PID:5140
- C:\Windows\System\sVXSdSe.exe
  C:\Windows\System\sVXSdSe.exe
  2⤵
  PID:5176
- C:\Windows\System\sahkwqm.exe
  C:\Windows\System\sahkwqm.exe
  2⤵
  PID:5204
- C:\Windows\System\ZyStXEb.exe
  C:\Windows\System\ZyStXEb.exe
  2⤵
  PID:5224
- C:\Windows\System\RxBnBco.exe
  C:\Windows\System\RxBnBco.exe
  2⤵
  PID:5248
- C:\Windows\System\RNkZApM.exe
  C:\Windows\System\RNkZApM.exe
  2⤵
  PID:5276
- C:\Windows\System\peHnYmW.exe
  C:\Windows\System\peHnYmW.exe
  2⤵
  PID:5308
- C:\Windows\System\ClRQRtf.exe
  C:\Windows\System\ClRQRtf.exe
  2⤵
  PID:5332
- C:\Windows\System\BNiaael.exe
  C:\Windows\System\BNiaael.exe
  2⤵
  PID:5360
- C:\Windows\System\AhYRXyl.exe
  C:\Windows\System\AhYRXyl.exe
  2⤵
  PID:5392
- C:\Windows\System\aqcmKBc.exe
  C:\Windows\System\aqcmKBc.exe
  2⤵
  PID:5416
- C:\Windows\System\kYgYJNC.exe
  C:\Windows\System\kYgYJNC.exe
  2⤵
  PID:5436
- C:\Windows\System\cLkTKQx.exe
  C:\Windows\System\cLkTKQx.exe
  2⤵
  PID:5464
- C:\Windows\System\vpszjXO.exe
  C:\Windows\System\vpszjXO.exe
  2⤵
  PID:5500
- C:\Windows\System\wdqHSGa.exe
  C:\Windows\System\wdqHSGa.exe
  2⤵
  PID:5532
- C:\Windows\System\JOXsCbj.exe
  C:\Windows\System\JOXsCbj.exe
  2⤵
  PID:5556
- C:\Windows\System\usDWYOK.exe
  C:\Windows\System\usDWYOK.exe
  2⤵
  PID:5580
- C:\Windows\System\JqkWdiI.exe
  C:\Windows\System\JqkWdiI.exe
  2⤵
  PID:5600
- C:\Windows\System\BNWsFgg.exe
  C:\Windows\System\BNWsFgg.exe
  2⤵
  PID:5632
- C:\Windows\System\WWwrkGH.exe
  C:\Windows\System\WWwrkGH.exe
  2⤵
  PID:5664
- C:\Windows\System\jJqEWMV.exe
  C:\Windows\System\jJqEWMV.exe
  2⤵
  PID:5688
- C:\Windows\System\CwwvUtB.exe
  C:\Windows\System\CwwvUtB.exe
  2⤵
  PID:5716
- C:\Windows\System\zydQhjz.exe
  C:\Windows\System\zydQhjz.exe
  2⤵
  PID:5752
- C:\Windows\System\oTohjvt.exe
  C:\Windows\System\oTohjvt.exe
  2⤵
  PID:5768
- C:\Windows\System\VKHapsi.exe
  C:\Windows\System\VKHapsi.exe
  2⤵
  PID:5796
- C:\Windows\System\NNjxsLE.exe
  C:\Windows\System\NNjxsLE.exe
  2⤵
  PID:5820
- C:\Windows\System\aIfVKfG.exe
  C:\Windows\System\aIfVKfG.exe
  2⤵
  PID:5836
- C:\Windows\System\ZtWawoA.exe
  C:\Windows\System\ZtWawoA.exe
  2⤵
  PID:5868
- C:\Windows\System\PofdlOB.exe
  C:\Windows\System\PofdlOB.exe
  2⤵
  PID:5896
- C:\Windows\System\nltRkux.exe
  C:\Windows\System\nltRkux.exe
  2⤵
  PID:5932
- C:\Windows\System\UIGJKYs.exe
  C:\Windows\System\UIGJKYs.exe
  2⤵
  PID:5960
- C:\Windows\System\miAAMuz.exe
  C:\Windows\System\miAAMuz.exe
  2⤵
  PID:6000
- C:\Windows\System\VPyuxhG.exe
  C:\Windows\System\VPyuxhG.exe
  2⤵
  PID:6028
- C:\Windows\System\vWopveC.exe
  C:\Windows\System\vWopveC.exe
  2⤵
  PID:6056
- C:\Windows\System\hvuQjfd.exe
  C:\Windows\System\hvuQjfd.exe
  2⤵
  PID:5128
- C:\Windows\System\LgsWEwZ.exe
  C:\Windows\System\LgsWEwZ.exe
  2⤵
  PID:5136
- C:\Windows\System\aFlumLF.exe
  C:\Windows\System\aFlumLF.exe
  2⤵
  PID:2688
- C:\Windows\System\CqyIMlc.exe
  C:\Windows\System\CqyIMlc.exe
  2⤵
  PID:5192
- C:\Windows\System\MIRUcqF.exe
  C:\Windows\System\MIRUcqF.exe
  2⤵
  PID:5272
- C:\Windows\System\IGkajzD.exe
  C:\Windows\System\IGkajzD.exe
  2⤵
  PID:5328
- C:\Windows\System\UNWAvhl.exe
  C:\Windows\System\UNWAvhl.exe
  2⤵
  PID:5376
- C:\Windows\System\XRieydh.exe
  C:\Windows\System\XRieydh.exe
  2⤵
  PID:5428
- C:\Windows\System\hmCwurV.exe
  C:\Windows\System\hmCwurV.exe
  2⤵
  PID:5480
- C:\Windows\System\iAkAAPW.exe
  C:\Windows\System\iAkAAPW.exe
  2⤵
  PID:5564
- C:\Windows\System\vNSxZuI.exe
  C:\Windows\System\vNSxZuI.exe
  2⤵
  PID:5648
- C:\Windows\System\fuXNHMI.exe
  C:\Windows\System\fuXNHMI.exe
  2⤵
  PID:5700
- C:\Windows\System\xODjCCL.exe
  C:\Windows\System\xODjCCL.exe
  2⤵
  PID:5736
- C:\Windows\System\uoeDOUz.exe
  C:\Windows\System\uoeDOUz.exe
  2⤵
  PID:5856
- C:\Windows\System\Syeekdg.exe
  C:\Windows\System\Syeekdg.exe
  2⤵
  PID:5892
- C:\Windows\System\EpFVrSl.exe
  C:\Windows\System\EpFVrSl.exe
  2⤵
  PID:5944
- C:\Windows\System\mGPyjoy.exe
  C:\Windows\System\mGPyjoy.exe
  2⤵
  PID:6040
- C:\Windows\System\HCQyPUF.exe
  C:\Windows\System\HCQyPUF.exe
  2⤵
  PID:6044
- C:\Windows\System\qOOBsOu.exe
  C:\Windows\System\qOOBsOu.exe
  2⤵
  PID:4684
- C:\Windows\System\IbhZiRC.exe
  C:\Windows\System\IbhZiRC.exe
  2⤵
  PID:5288
- C:\Windows\System\EvVPXNh.exe
  C:\Windows\System\EvVPXNh.exe
  2⤵
  PID:5368
- C:\Windows\System\GlwxQxD.exe
  C:\Windows\System\GlwxQxD.exe
  2⤵
  PID:5404
- C:\Windows\System\dPXwnyr.exe
  C:\Windows\System\dPXwnyr.exe
  2⤵
  PID:5644
- C:\Windows\System\ElcMHft.exe
  C:\Windows\System\ElcMHft.exe
  2⤵
  PID:5576
- C:\Windows\System\YCZOABB.exe
  C:\Windows\System\YCZOABB.exe
  2⤵
  PID:5972
- C:\Windows\System\BpTVIwy.exe
  C:\Windows\System\BpTVIwy.exe
  2⤵
  PID:5968
- C:\Windows\System\ngHWcQf.exe
  C:\Windows\System\ngHWcQf.exe
  2⤵
  PID:5152
- C:\Windows\System\nrRMjWp.exe
  C:\Windows\System\nrRMjWp.exe
  2⤵
  PID:5780
- C:\Windows\System\yFPiKqS.exe
  C:\Windows\System\yFPiKqS.exe
  2⤵
  PID:5976
- C:\Windows\System\zbwbTpa.exe
  C:\Windows\System\zbwbTpa.exe
  2⤵
  PID:5160
- C:\Windows\System\TJljeCp.exe
  C:\Windows\System\TJljeCp.exe
  2⤵
  PID:5452
- C:\Windows\System\WxRfAEc.exe
  C:\Windows\System\WxRfAEc.exe
  2⤵
  PID:6172
- C:\Windows\System\lkDHaZs.exe
  C:\Windows\System\lkDHaZs.exe
  2⤵
  PID:6188
- C:\Windows\System\cZqgKkQ.exe
  C:\Windows\System\cZqgKkQ.exe
  2⤵
  PID:6216
- C:\Windows\System\dJdKwWA.exe
  C:\Windows\System\dJdKwWA.exe
  2⤵
  PID:6252
- C:\Windows\System\xhVvvYf.exe
  C:\Windows\System\xhVvvYf.exe
  2⤵
  PID:6272
- C:\Windows\System\PWtkYpi.exe
  C:\Windows\System\PWtkYpi.exe
  2⤵
  PID:6288
- C:\Windows\System\CWexYRs.exe
  C:\Windows\System\CWexYRs.exe
  2⤵
  PID:6320
- C:\Windows\System\jNSuScI.exe
  C:\Windows\System\jNSuScI.exe
  2⤵
  PID:6344
- C:\Windows\System\ePiZURx.exe
  C:\Windows\System\ePiZURx.exe
  2⤵
  PID:6368
- C:\Windows\System\BGTaNJs.exe
  C:\Windows\System\BGTaNJs.exe
  2⤵
  PID:6392
- C:\Windows\System\wmDjxGr.exe
  C:\Windows\System\wmDjxGr.exe
  2⤵
  PID:6416
- C:\Windows\System\YYpeBxS.exe
  C:\Windows\System\YYpeBxS.exe
  2⤵
  PID:6444
- C:\Windows\System\KXuBoeB.exe
  C:\Windows\System\KXuBoeB.exe
  2⤵
  PID:6468
- C:\Windows\System\udGBpUd.exe
  C:\Windows\System\udGBpUd.exe
  2⤵
  PID:6484
- C:\Windows\System\DnhfJhF.exe
  C:\Windows\System\DnhfJhF.exe
  2⤵
  PID:6512
- C:\Windows\System\GgrLSxu.exe
  C:\Windows\System\GgrLSxu.exe
  2⤵
  PID:6548
- C:\Windows\System\XjQhShy.exe
  C:\Windows\System\XjQhShy.exe
  2⤵
  PID:6564
- C:\Windows\System\XLTkLLA.exe
  C:\Windows\System\XLTkLLA.exe
  2⤵
  PID:6592
- C:\Windows\System\RtaLmXh.exe
  C:\Windows\System\RtaLmXh.exe
  2⤵
  PID:6624
- C:\Windows\System\smwKFvA.exe
  C:\Windows\System\smwKFvA.exe
  2⤵
  PID:6648
- C:\Windows\System\MuVrPlY.exe
  C:\Windows\System\MuVrPlY.exe
  2⤵
  PID:6680
- C:\Windows\System\gDizGkc.exe
  C:\Windows\System\gDizGkc.exe
  2⤵
  PID:6700
- C:\Windows\System\iolLhcE.exe
  C:\Windows\System\iolLhcE.exe
  2⤵
  PID:6736
- C:\Windows\System\neqIsvS.exe
  C:\Windows\System\neqIsvS.exe
  2⤵
  PID:6760
- C:\Windows\System\RfuWCLb.exe
  C:\Windows\System\RfuWCLb.exe
  2⤵
  PID:6788
- C:\Windows\System\VfAWcqI.exe
  C:\Windows\System\VfAWcqI.exe
  2⤵
  PID:6812
- C:\Windows\System\CUEMIHe.exe
  C:\Windows\System\CUEMIHe.exe
  2⤵
  PID:6836
- C:\Windows\System\LvFPiVa.exe
  C:\Windows\System\LvFPiVa.exe
  2⤵
  PID:6856
- C:\Windows\System\XMzoluz.exe
  C:\Windows\System\XMzoluz.exe
  2⤵
  PID:6876
- C:\Windows\System\JIrcmuP.exe
  C:\Windows\System\JIrcmuP.exe
  2⤵
  PID:6912
- C:\Windows\System\CrnJkig.exe
  C:\Windows\System\CrnJkig.exe
  2⤵
  PID:6932
- C:\Windows\System\epdprfA.exe
  C:\Windows\System\epdprfA.exe
  2⤵
  PID:6964
- C:\Windows\System\XBUrMdj.exe
  C:\Windows\System\XBUrMdj.exe
  2⤵
  PID:6996
- C:\Windows\System\DvBgaNx.exe
  C:\Windows\System\DvBgaNx.exe
  2⤵
  PID:7012
- C:\Windows\System\viFfSYB.exe
  C:\Windows\System\viFfSYB.exe
  2⤵
  PID:7036
- C:\Windows\System\QNlnZhl.exe
  C:\Windows\System\QNlnZhl.exe
  2⤵
  PID:7056
- C:\Windows\System\MGBlPBT.exe
  C:\Windows\System\MGBlPBT.exe
  2⤵
  PID:7092
- C:\Windows\System\nDlwqDB.exe
  C:\Windows\System\nDlwqDB.exe
  2⤵
  PID:7116
- C:\Windows\System\tFnQXji.exe
  C:\Windows\System\tFnQXji.exe
  2⤵
  PID:7136
- C:\Windows\System\kQgtKXP.exe
  C:\Windows\System\kQgtKXP.exe
  2⤵
  PID:7160
- C:\Windows\System\ANYmAnh.exe
  C:\Windows\System\ANYmAnh.exe
  2⤵
  PID:6164
- C:\Windows\System\aWcLRkN.exe
  C:\Windows\System\aWcLRkN.exe
  2⤵
  PID:6268
- C:\Windows\System\iovDhOw.exe
  C:\Windows\System\iovDhOw.exe
  2⤵
  PID:6308
- C:\Windows\System\bYAFOiz.exe
  C:\Windows\System\bYAFOiz.exe
  2⤵
  PID:6248
- C:\Windows\System\TOGMeeh.exe
  C:\Windows\System\TOGMeeh.exe
  2⤵
  PID:6376
- C:\Windows\System\HLbcKSH.exe
  C:\Windows\System\HLbcKSH.exe
  2⤵
  PID:6436
- C:\Windows\System\CxEhEbe.exe
  C:\Windows\System\CxEhEbe.exe
  2⤵
  PID:6340
- C:\Windows\System\WjyuWPh.exe
  C:\Windows\System\WjyuWPh.exe
  2⤵
  PID:6640
- C:\Windows\System\YwzOvxz.exe
  C:\Windows\System\YwzOvxz.exe
  2⤵
  PID:6560
- C:\Windows\System\ZbiDWHA.exe
  C:\Windows\System\ZbiDWHA.exe
  2⤵
  PID:6732
- C:\Windows\System\fJwszRy.exe
  C:\Windows\System\fJwszRy.exe
  2⤵
  PID:6632
- C:\Windows\System\GDvNzOZ.exe
  C:\Windows\System\GDvNzOZ.exe
  2⤵
  PID:6724
- C:\Windows\System\ERsIUid.exe
  C:\Windows\System\ERsIUid.exe
  2⤵
  PID:6796
- C:\Windows\System\TfsszLt.exe
  C:\Windows\System\TfsszLt.exe
  2⤵
  PID:6832
- C:\Windows\System\dsnYztc.exe
  C:\Windows\System\dsnYztc.exe
  2⤵
  PID:6772
- C:\Windows\System\FHoPIpC.exe
  C:\Windows\System\FHoPIpC.exe
  2⤵
  PID:7132
- C:\Windows\System\oEQkGVh.exe
  C:\Windows\System\oEQkGVh.exe
  2⤵
  PID:6152
- C:\Windows\System\KexBBai.exe
  C:\Windows\System\KexBBai.exe
  2⤵
  PID:6228
- C:\Windows\System\VaNTgWF.exe
  C:\Windows\System\VaNTgWF.exe
  2⤵
  PID:4960
- C:\Windows\System\PBeJOry.exe
  C:\Windows\System\PBeJOry.exe
  2⤵
  PID:6556
- C:\Windows\System\gjkRilZ.exe
  C:\Windows\System\gjkRilZ.exe
  2⤵
  PID:7108
- C:\Windows\System\idclHWJ.exe
  C:\Windows\System\idclHWJ.exe
  2⤵
  PID:6608
- C:\Windows\System\ZyWjOGX.exe
  C:\Windows\System\ZyWjOGX.exe
  2⤵
  PID:6404
- C:\Windows\System\UftfsrY.exe
  C:\Windows\System\UftfsrY.exe
  2⤵
  PID:7188
- C:\Windows\System\orDbYDQ.exe
  C:\Windows\System\orDbYDQ.exe
  2⤵
  PID:7208
- C:\Windows\System\jOAQLTe.exe
  C:\Windows\System\jOAQLTe.exe
  2⤵
  PID:7232
- C:\Windows\System\tWmafVP.exe
  C:\Windows\System\tWmafVP.exe
  2⤵
  PID:7256
- C:\Windows\System\VlYWWBE.exe
  C:\Windows\System\VlYWWBE.exe
  2⤵
  PID:7276
- C:\Windows\System\SOnqEGX.exe
  C:\Windows\System\SOnqEGX.exe
  2⤵
  PID:7292
- C:\Windows\System\UNgBkWh.exe
  C:\Windows\System\UNgBkWh.exe
  2⤵
  PID:7312
- C:\Windows\System\ogCDlsB.exe
  C:\Windows\System\ogCDlsB.exe
  2⤵
  PID:7340
- C:\Windows\System\kbjizyV.exe
  C:\Windows\System\kbjizyV.exe
  2⤵
  PID:7364
- C:\Windows\System\CfNVOxy.exe
  C:\Windows\System\CfNVOxy.exe
  2⤵
  PID:7388
- C:\Windows\System\hPtogMo.exe
  C:\Windows\System\hPtogMo.exe
  2⤵
  PID:7404
- C:\Windows\System\UmiRjYu.exe
  C:\Windows\System\UmiRjYu.exe
  2⤵
  PID:7432
- C:\Windows\System\BKkKjxb.exe
  C:\Windows\System\BKkKjxb.exe
  2⤵
  PID:7464
- C:\Windows\System\SGbpQIN.exe
  C:\Windows\System\SGbpQIN.exe
  2⤵
  PID:7484
- C:\Windows\System\LrCuBCu.exe
  C:\Windows\System\LrCuBCu.exe
  2⤵
  PID:7508
- C:\Windows\System\GwakXSA.exe
  C:\Windows\System\GwakXSA.exe
  2⤵
  PID:7540
- C:\Windows\System\mLITlik.exe
  C:\Windows\System\mLITlik.exe
  2⤵
  PID:7560
- C:\Windows\System\gNgvoBr.exe
  C:\Windows\System\gNgvoBr.exe
  2⤵
  PID:7580
- C:\Windows\System\fivywas.exe
  C:\Windows\System\fivywas.exe
  2⤵
  PID:7608
- C:\Windows\System\OjAoYlI.exe
  C:\Windows\System\OjAoYlI.exe
  2⤵
  PID:7632
- C:\Windows\System\PLTYgdj.exe
  C:\Windows\System\PLTYgdj.exe
  2⤵
  PID:7660
- C:\Windows\System\SMEFqED.exe
  C:\Windows\System\SMEFqED.exe
  2⤵
  PID:7684
- C:\Windows\System\dLjCdpi.exe
  C:\Windows\System\dLjCdpi.exe
  2⤵
  PID:7708
- C:\Windows\System\pZJveLf.exe
  C:\Windows\System\pZJveLf.exe
  2⤵
  PID:7740
- C:\Windows\System\gpllfKs.exe
  C:\Windows\System\gpllfKs.exe
  2⤵
  PID:7760
- C:\Windows\System\ZDNyKaA.exe
  C:\Windows\System\ZDNyKaA.exe
  2⤵
  PID:7788
- C:\Windows\System\GDsABsZ.exe
  C:\Windows\System\GDsABsZ.exe
  2⤵
  PID:7804
- C:\Windows\System\anSlJLr.exe
  C:\Windows\System\anSlJLr.exe
  2⤵
  PID:7832
- C:\Windows\System\fzWrtfv.exe
  C:\Windows\System\fzWrtfv.exe
  2⤵
  PID:7852
- C:\Windows\System\ZGjmlQE.exe
  C:\Windows\System\ZGjmlQE.exe
  2⤵
  PID:7880
- C:\Windows\System\JuwaHEH.exe
  C:\Windows\System\JuwaHEH.exe
  2⤵
  PID:7908
- C:\Windows\System\UuwxGci.exe
  C:\Windows\System\UuwxGci.exe
  2⤵
  PID:7928
- C:\Windows\System\jdlAFJj.exe
  C:\Windows\System\jdlAFJj.exe
  2⤵
  PID:7956
- C:\Windows\System\WHoZDoK.exe
  C:\Windows\System\WHoZDoK.exe
  2⤵
  PID:7984
- C:\Windows\System\WrOaRvZ.exe
  C:\Windows\System\WrOaRvZ.exe
  2⤵
  PID:8008
- C:\Windows\System\ybInRJH.exe
  C:\Windows\System\ybInRJH.exe
  2⤵
  PID:8028
- C:\Windows\System\jxDPSOl.exe
  C:\Windows\System\jxDPSOl.exe
  2⤵
  PID:8056
- C:\Windows\System\XvmzMEH.exe
  C:\Windows\System\XvmzMEH.exe
  2⤵
  PID:8076
- C:\Windows\System\VpyiFPi.exe
  C:\Windows\System\VpyiFPi.exe
  2⤵
  PID:8104
- C:\Windows\System\LZYnqkR.exe
  C:\Windows\System\LZYnqkR.exe
  2⤵
  PID:8132
- C:\Windows\System\SSjLaxf.exe
  C:\Windows\System\SSjLaxf.exe
  2⤵
  PID:8164
- C:\Windows\System\wjnZzcc.exe
  C:\Windows\System\wjnZzcc.exe
  2⤵
  PID:8180
- C:\Windows\System\ZfBvrce.exe
  C:\Windows\System\ZfBvrce.exe
  2⤵
  PID:7084
- C:\Windows\System\xeitHic.exe
  C:\Windows\System\xeitHic.exe
  2⤵
  PID:7064
- C:\Windows\System\hcsCRtW.exe
  C:\Windows\System\hcsCRtW.exe
  2⤵
  PID:6456
- C:\Windows\System\LvYpwnD.exe
  C:\Windows\System\LvYpwnD.exe
  2⤵
  PID:7004
- C:\Windows\System\LrnBaPB.exe
  C:\Windows\System\LrnBaPB.exe
  2⤵
  PID:7228
- C:\Windows\System\kvbxGFU.exe
  C:\Windows\System\kvbxGFU.exe
  2⤵
  PID:6588
- C:\Windows\System\lvvaiaY.exe
  C:\Windows\System\lvvaiaY.exe
  2⤵
  PID:7376
- C:\Windows\System\biWdreP.exe
  C:\Windows\System\biWdreP.exe
  2⤵
  PID:7448
- C:\Windows\System\dcLWJxy.exe
  C:\Windows\System\dcLWJxy.exe
  2⤵
  PID:7252
- C:\Windows\System\uzQzNDc.exe
  C:\Windows\System\uzQzNDc.exe
  2⤵
  PID:7548
- C:\Windows\System\bRRHWVs.exe
  C:\Windows\System\bRRHWVs.exe
  2⤵
  PID:7576
- C:\Windows\System\WLmBWrI.exe
  C:\Windows\System\WLmBWrI.exe
  2⤵
  PID:7476
- C:\Windows\System\RGXBsRr.exe
  C:\Windows\System\RGXBsRr.exe
  2⤵
  PID:7524
- C:\Windows\System\wATMqnN.exe
  C:\Windows\System\wATMqnN.exe
  2⤵
  PID:7780
- C:\Windows\System\fRgWytL.exe
  C:\Windows\System\fRgWytL.exe
  2⤵
  PID:7596
- C:\Windows\System\bpHEynb.exe
  C:\Windows\System\bpHEynb.exe
  2⤵
  PID:7940
- C:\Windows\System\dKEGuZY.exe
  C:\Windows\System\dKEGuZY.exe
  2⤵
  PID:8016
- C:\Windows\System\xyPYSsr.exe
  C:\Windows\System\xyPYSsr.exe
  2⤵
  PID:7796
- C:\Windows\System\YToKLsh.exe
  C:\Windows\System\YToKLsh.exe
  2⤵
  PID:7032
- C:\Windows\System\mYpLnvh.exe
  C:\Windows\System\mYpLnvh.exe
  2⤵
  PID:7896
- C:\Windows\System\RdxTkaH.exe
  C:\Windows\System\RdxTkaH.exe
  2⤵
  PID:6612
- C:\Windows\System\JYfRsdF.exe
  C:\Windows\System\JYfRsdF.exe
  2⤵
  PID:7304
- C:\Windows\System\IlIRiPp.exe
  C:\Windows\System\IlIRiPp.exe
  2⤵
  PID:7400
- C:\Windows\System\QsBPRPO.exe
  C:\Windows\System\QsBPRPO.exe
  2⤵
  PID:8208
- C:\Windows\System\DtqagEI.exe
  C:\Windows\System\DtqagEI.exe
  2⤵
  PID:8240
- C:\Windows\System\eqSFdOk.exe
  C:\Windows\System\eqSFdOk.exe
  2⤵
  PID:8268
- C:\Windows\System\TVqUDUY.exe
  C:\Windows\System\TVqUDUY.exe
  2⤵
  PID:8292
- C:\Windows\System\rfLPhWj.exe
  C:\Windows\System\rfLPhWj.exe
  2⤵
  PID:8316
- C:\Windows\System\YfXiVvV.exe
  C:\Windows\System\YfXiVvV.exe
  2⤵
  PID:8348
- C:\Windows\System\fKtbphJ.exe
  C:\Windows\System\fKtbphJ.exe
  2⤵
  PID:8376
- C:\Windows\System\wYAheNF.exe
  C:\Windows\System\wYAheNF.exe
  2⤵
  PID:8400
- C:\Windows\System\qffYGxu.exe
  C:\Windows\System\qffYGxu.exe
  2⤵
  PID:8424
- C:\Windows\System\HUMQNBh.exe
  C:\Windows\System\HUMQNBh.exe
  2⤵
  PID:8448
- C:\Windows\System\SuofaWf.exe
  C:\Windows\System\SuofaWf.exe
  2⤵
  PID:8468
- C:\Windows\System\YAlkArU.exe
  C:\Windows\System\YAlkArU.exe
  2⤵
  PID:8488
- C:\Windows\System\LNuzAoN.exe
  C:\Windows\System\LNuzAoN.exe
  2⤵
  PID:8504
- C:\Windows\System\fwCDiVk.exe
  C:\Windows\System\fwCDiVk.exe
  2⤵
  PID:8532
- C:\Windows\System\CqszQhK.exe
  C:\Windows\System\CqszQhK.exe
  2⤵
  PID:8552
- C:\Windows\System\dQUftHw.exe
  C:\Windows\System\dQUftHw.exe
  2⤵
  PID:8572
- C:\Windows\System\wzENMyK.exe
  C:\Windows\System\wzENMyK.exe
  2⤵
  PID:8600
- C:\Windows\System\kpRmwXI.exe
  C:\Windows\System\kpRmwXI.exe
  2⤵
  PID:8616
- C:\Windows\System\zgqUtHS.exe
  C:\Windows\System\zgqUtHS.exe
  2⤵
  PID:8640
- C:\Windows\System\DRddVBy.exe
  C:\Windows\System\DRddVBy.exe
  2⤵
  PID:8660
- C:\Windows\System\yeVhfSO.exe
  C:\Windows\System\yeVhfSO.exe
  2⤵
  PID:8688
- C:\Windows\System\ptkEJYz.exe
  C:\Windows\System\ptkEJYz.exe
  2⤵
  PID:8704
- C:\Windows\System\JYLgGtO.exe
  C:\Windows\System\JYLgGtO.exe
  2⤵
  PID:8728
- C:\Windows\System\HbXKEez.exe
  C:\Windows\System\HbXKEez.exe
  2⤵
  PID:8752
- C:\Windows\System\DaFKjTU.exe
  C:\Windows\System\DaFKjTU.exe
  2⤵
  PID:8776
- C:\Windows\System\gUePtBT.exe
  C:\Windows\System\gUePtBT.exe
  2⤵
  PID:8804
- C:\Windows\System\lQAKzsR.exe
  C:\Windows\System\lQAKzsR.exe
  2⤵
  PID:8824
- C:\Windows\System\VDYVwcg.exe
  C:\Windows\System\VDYVwcg.exe
  2⤵
  PID:8848
- C:\Windows\System\PeaVcli.exe
  C:\Windows\System\PeaVcli.exe
  2⤵
  PID:8880
- C:\Windows\System\IPZLJrF.exe
  C:\Windows\System\IPZLJrF.exe
  2⤵
  PID:8900
- C:\Windows\System\CpzVgpU.exe
  C:\Windows\System\CpzVgpU.exe
  2⤵
  PID:8924
- C:\Windows\System\uvojsRB.exe
  C:\Windows\System\uvojsRB.exe
  2⤵
  PID:8948
- C:\Windows\System\QvtrabX.exe
  C:\Windows\System\QvtrabX.exe
  2⤵
  PID:8968
- C:\Windows\System\WJqhjGl.exe
  C:\Windows\System\WJqhjGl.exe
  2⤵
  PID:8992
- C:\Windows\System\ZqmPBjU.exe
  C:\Windows\System\ZqmPBjU.exe
  2⤵
  PID:9020
- C:\Windows\System\HqfATyd.exe
  C:\Windows\System\HqfATyd.exe
  2⤵
  PID:9048
- C:\Windows\System\zNSjwun.exe
  C:\Windows\System\zNSjwun.exe
  2⤵
  PID:9072
- C:\Windows\System\nCLVlpV.exe
  C:\Windows\System\nCLVlpV.exe
  2⤵
  PID:9096
- C:\Windows\System\iugMopz.exe
  C:\Windows\System\iugMopz.exe
  2⤵
  PID:9124
- C:\Windows\System\oeaDLIK.exe
  C:\Windows\System\oeaDLIK.exe
  2⤵
  PID:9144
- C:\Windows\System\kLpwLTd.exe
  C:\Windows\System\kLpwLTd.exe
  2⤵
  PID:9168
- C:\Windows\System\thTpguW.exe
  C:\Windows\System\thTpguW.exe
  2⤵
  PID:9188
- C:\Windows\System\XShrOvK.exe
  C:\Windows\System\XShrOvK.exe
  2⤵
  PID:8096
- C:\Windows\System\EwKxkGh.exe
  C:\Windows\System\EwKxkGh.exe
  2⤵
  PID:7752
- C:\Windows\System\ZUgfVfh.exe
  C:\Windows\System\ZUgfVfh.exe
  2⤵
  PID:7536
- C:\Windows\System\PKjKHAh.exe
  C:\Windows\System\PKjKHAh.exe
  2⤵
  PID:7776
- C:\Windows\System\jpFyCGT.exe
  C:\Windows\System\jpFyCGT.exe
  2⤵
  PID:7872
- C:\Windows\System\QhTOXRV.exe
  C:\Windows\System\QhTOXRV.exe
  2⤵
  PID:7444
- C:\Windows\System\BXkVpLs.exe
  C:\Windows\System\BXkVpLs.exe
  2⤵
  PID:6356
- C:\Windows\System\DFmbCFk.exe
  C:\Windows\System\DFmbCFk.exe
  2⤵
  PID:7628
- C:\Windows\System\kbcEwuF.exe
  C:\Windows\System\kbcEwuF.exe
  2⤵
  PID:8172
- C:\Windows\System\qjmOLnr.exe
  C:\Windows\System\qjmOLnr.exe
  2⤵
  PID:7800
- C:\Windows\System\ceqXEmH.exe
  C:\Windows\System\ceqXEmH.exe
  2⤵
  PID:8416
- C:\Windows\System\roqFCrn.exe
  C:\Windows\System\roqFCrn.exe
  2⤵
  PID:8484
- C:\Windows\System\xgqfctC.exe
  C:\Windows\System\xgqfctC.exe
  2⤵
  PID:8520
- C:\Windows\System\VGZxdli.exe
  C:\Windows\System\VGZxdli.exe
  2⤵
  PID:7724
- C:\Windows\System\ZSHIrWv.exe
  C:\Windows\System\ZSHIrWv.exe
  2⤵
  PID:8716
- C:\Windows\System\JbJYarV.exe
  C:\Windows\System\JbJYarV.exe
  2⤵
  PID:8436
- C:\Windows\System\jEJkYTG.exe
  C:\Windows\System\jEJkYTG.exe
  2⤵
  PID:8956
- C:\Windows\System\ymnYQIE.exe
  C:\Windows\System\ymnYQIE.exe
  2⤵
  PID:8988
- C:\Windows\System\RSZbkfl.exe
  C:\Windows\System\RSZbkfl.exe
  2⤵
  PID:9044
- C:\Windows\System\svSMPYy.exe
  C:\Windows\System\svSMPYy.exe
  2⤵
  PID:9092
- C:\Windows\System\KktNWUi.exe
  C:\Windows\System\KktNWUi.exe
  2⤵
  PID:9140
- C:\Windows\System\HNYMGhY.exe
  C:\Windows\System\HNYMGhY.exe
  2⤵
  PID:9228
- C:\Windows\System\czrSzzK.exe
  C:\Windows\System\czrSzzK.exe
  2⤵
  PID:9248
- C:\Windows\System\LFmarry.exe
  C:\Windows\System\LFmarry.exe
  2⤵
  PID:9280
- C:\Windows\System\CNOfrcD.exe
  C:\Windows\System\CNOfrcD.exe
  2⤵
  PID:9304
- C:\Windows\System\hjxwPJI.exe
  C:\Windows\System\hjxwPJI.exe
  2⤵
  PID:9328
- C:\Windows\System\OFOCNEU.exe
  C:\Windows\System\OFOCNEU.exe
  2⤵
  PID:9348
- C:\Windows\System\nXSukkH.exe
  C:\Windows\System\nXSukkH.exe
  2⤵
  PID:9380
- C:\Windows\System\LtlxZde.exe
  C:\Windows\System\LtlxZde.exe
  2⤵
  PID:9408
- C:\Windows\System\vkxjdYK.exe
  C:\Windows\System\vkxjdYK.exe
  2⤵
  PID:9428
- C:\Windows\System\dRquSeo.exe
  C:\Windows\System\dRquSeo.exe
  2⤵
  PID:9444
- C:\Windows\System\NueIGoF.exe
  C:\Windows\System\NueIGoF.exe
  2⤵
  PID:9464
- C:\Windows\System\sPHRRZO.exe
  C:\Windows\System\sPHRRZO.exe
  2⤵
  PID:9496
- C:\Windows\System\LKwwkIq.exe
  C:\Windows\System\LKwwkIq.exe
  2⤵
  PID:9516
- C:\Windows\System\tZPiunh.exe
  C:\Windows\System\tZPiunh.exe
  2⤵
  PID:9552
- C:\Windows\System\KIiTswR.exe
  C:\Windows\System\KIiTswR.exe
  2⤵
  PID:9572
- C:\Windows\System\sptfYnB.exe
  C:\Windows\System\sptfYnB.exe
  2⤵
  PID:9596
- C:\Windows\System\bDRuChf.exe
  C:\Windows\System\bDRuChf.exe
  2⤵
  PID:9620
- C:\Windows\System\QbtykDn.exe
  C:\Windows\System\QbtykDn.exe
  2⤵
  PID:9648
- C:\Windows\System\aNhAPPh.exe
  C:\Windows\System\aNhAPPh.exe
  2⤵
  PID:9676
- C:\Windows\System\GnlkyOu.exe
  C:\Windows\System\GnlkyOu.exe
  2⤵
  PID:9696
- C:\Windows\System\UYlHuUt.exe
  C:\Windows\System\UYlHuUt.exe
  2⤵
  PID:9728
- C:\Windows\System\YdAOoXJ.exe
  C:\Windows\System\YdAOoXJ.exe
  2⤵
  PID:9748
- C:\Windows\System\saBjuPS.exe
  C:\Windows\System\saBjuPS.exe
  2⤵
  PID:10064
- C:\Windows\System\KGeDaah.exe
  C:\Windows\System\KGeDaah.exe
  2⤵
  PID:10096
- C:\Windows\System\bjKPtCV.exe
  C:\Windows\System\bjKPtCV.exe
  2⤵
  PID:10132
- C:\Windows\System\hkECgMl.exe
  C:\Windows\System\hkECgMl.exe
  2⤵
  PID:10164
- C:\Windows\System\qZixNsc.exe
  C:\Windows\System\qZixNsc.exe
  2⤵
  PID:10192
- C:\Windows\System\sTuWeJa.exe
  C:\Windows\System\sTuWeJa.exe
  2⤵
  PID:10208
- C:\Windows\System\oMpcWYS.exe
  C:\Windows\System\oMpcWYS.exe
  2⤵
  PID:8768
- C:\Windows\System\vmPGDhU.exe
  C:\Windows\System\vmPGDhU.exe
  2⤵
  PID:8840
- C:\Windows\System\SmjNFTa.exe
  C:\Windows\System\SmjNFTa.exe
  2⤵
  PID:8920
- C:\Windows\System\ihMkttp.exe
  C:\Windows\System\ihMkttp.exe
  2⤵
  PID:8356
- C:\Windows\System\Fxcxhcx.exe
  C:\Windows\System\Fxcxhcx.exe
  2⤵
  PID:8500
- C:\Windows\System\tdhMrsH.exe
  C:\Windows\System\tdhMrsH.exe
  2⤵
  PID:7372
- C:\Windows\System\rnfeIVm.exe
  C:\Windows\System\rnfeIVm.exe
  2⤵
  PID:9120
- C:\Windows\System\qAszPNm.exe
  C:\Windows\System\qAszPNm.exe
  2⤵
  PID:8764
- C:\Windows\System\FIymCdl.exe
  C:\Windows\System\FIymCdl.exe
  2⤵
  PID:9300
- C:\Windows\System\EjrNsio.exe
  C:\Windows\System\EjrNsio.exe
  2⤵
  PID:8000
- C:\Windows\System\AyIHibv.exe
  C:\Windows\System\AyIHibv.exe
  2⤵
  PID:9588
- C:\Windows\System\fjxGVAK.exe
  C:\Windows\System\fjxGVAK.exe
  2⤵
  PID:9104
- C:\Windows\System\NtlMtQy.exe
  C:\Windows\System\NtlMtQy.exe
  2⤵
  PID:9160
- C:\Windows\System\KPAOAqI.exe
  C:\Windows\System\KPAOAqI.exe
  2⤵
  PID:9212
- C:\Windows\System\afkNIrn.exe
  C:\Windows\System\afkNIrn.exe
  2⤵
  PID:7268
- C:\Windows\System\EJYEbpX.exe
  C:\Windows\System\EJYEbpX.exe
  2⤵
  PID:9548
- C:\Windows\System\MyHeOmV.exe
  C:\Windows\System\MyHeOmV.exe
  2⤵
  PID:9764
- C:\Windows\System\QSKzNRL.exe
  C:\Windows\System\QSKzNRL.exe
  2⤵
  PID:9136
- C:\Windows\System\GrPauWr.exe
  C:\Windows\System\GrPauWr.exe
  2⤵
  PID:9244
- C:\Windows\System\OEhBORe.exe
  C:\Windows\System\OEhBORe.exe
  2⤵
  PID:9368
- C:\Windows\System\tiodUNt.exe
  C:\Windows\System\tiodUNt.exe
  2⤵
  PID:9908
- C:\Windows\System\iqissUs.exe
  C:\Windows\System\iqissUs.exe
  2⤵
  PID:10124
- C:\Windows\System\FjfFXQv.exe
  C:\Windows\System\FjfFXQv.exe
  2⤵
  PID:9796
- C:\Windows\System\lCgKrdY.exe
  C:\Windows\System\lCgKrdY.exe
  2⤵
  PID:10024
- C:\Windows\System\tetrUre.exe
  C:\Windows\System\tetrUre.exe
  2⤵
  PID:7964
- C:\Windows\System\MpwfAYu.exe
  C:\Windows\System\MpwfAYu.exe
  2⤵
  PID:9268
- C:\Windows\System\jYZJmup.exe
  C:\Windows\System\jYZJmup.exe
  2⤵
  PID:10188
- C:\Windows\System\LCfPJEX.exe
  C:\Windows\System\LCfPJEX.exe
  2⤵
  PID:8388
- C:\Windows\System\FhKfhev.exe
  C:\Windows\System\FhKfhev.exe
  2⤵
  PID:9276
- C:\Windows\System\CxmkeVm.exe
  C:\Windows\System\CxmkeVm.exe
  2⤵
  PID:9664
- C:\Windows\System\PVAdFML.exe
  C:\Windows\System\PVAdFML.exe
  2⤵
  PID:9132
- C:\Windows\System\dFDgkWE.exe
  C:\Windows\System\dFDgkWE.exe
  2⤵
  PID:7480
- C:\Windows\System\CtVMHDM.exe
  C:\Windows\System\CtVMHDM.exe
  2⤵
  PID:8820
- C:\Windows\System\ZQvFcGh.exe
  C:\Windows\System\ZQvFcGh.exe
  2⤵
  PID:8260
- C:\Windows\System\KUUxTSk.exe
  C:\Windows\System\KUUxTSk.exe
  2⤵
  PID:9004
- C:\Windows\System\MYdSKkE.exe
  C:\Windows\System\MYdSKkE.exe
  2⤵
  PID:9720
- C:\Windows\System\FvQOwDN.exe
  C:\Windows\System\FvQOwDN.exe
  2⤵
  PID:9936
- C:\Windows\System\jlaVmzF.exe
  C:\Windows\System\jlaVmzF.exe
  2⤵
  PID:10244
- C:\Windows\System\BRdMisF.exe
  C:\Windows\System\BRdMisF.exe
  2⤵
  PID:10272
- C:\Windows\System\BjPIMSA.exe
  C:\Windows\System\BjPIMSA.exe
  2⤵
  PID:10296
- C:\Windows\System\JBmaONE.exe
  C:\Windows\System\JBmaONE.exe
  2⤵
  PID:10312
- C:\Windows\System\CEyPoiM.exe
  C:\Windows\System\CEyPoiM.exe
  2⤵
  PID:10332
- C:\Windows\System\ZWxOgDY.exe
  C:\Windows\System\ZWxOgDY.exe
  2⤵
  PID:10352
- C:\Windows\System\kQXMIfQ.exe
  C:\Windows\System\kQXMIfQ.exe
  2⤵
  PID:10372
- C:\Windows\System\GWaqdsO.exe
  C:\Windows\System\GWaqdsO.exe
  2⤵
  PID:10400
- C:\Windows\System\PhIpocw.exe
  C:\Windows\System\PhIpocw.exe
  2⤵
  PID:10424
- C:\Windows\System\RRhnmfu.exe
  C:\Windows\System\RRhnmfu.exe
  2⤵
  PID:10440
- C:\Windows\System\kQyCKdA.exe
  C:\Windows\System\kQyCKdA.exe
  2⤵
  PID:10464
- C:\Windows\System\IGOtcXf.exe
  C:\Windows\System\IGOtcXf.exe
  2⤵
  PID:10492
- C:\Windows\System\pNarolR.exe
  C:\Windows\System\pNarolR.exe
  2⤵
  PID:10512
- C:\Windows\System\tODTLkt.exe
  C:\Windows\System\tODTLkt.exe
  2⤵
  PID:10532
- C:\Windows\System\eYEBUYI.exe
  C:\Windows\System\eYEBUYI.exe
  2⤵
  PID:10552
- C:\Windows\System\MtyZJPv.exe
  C:\Windows\System\MtyZJPv.exe
  2⤵
  PID:10572
- C:\Windows\System\uFRDCBO.exe
  C:\Windows\System\uFRDCBO.exe
  2⤵
  PID:10588
- C:\Windows\System\FBzfeFp.exe
  C:\Windows\System\FBzfeFp.exe
  2⤵
  PID:10604
- C:\Windows\System\FhDTMyE.exe
  C:\Windows\System\FhDTMyE.exe
  2⤵
  PID:10628
- C:\Windows\System\OzqLGBs.exe
  C:\Windows\System\OzqLGBs.exe
  2⤵
  PID:10648
- C:\Windows\System\OJxRYOl.exe
  C:\Windows\System\OJxRYOl.exe
  2⤵
  PID:10676
- C:\Windows\System\eJWsgaD.exe
  C:\Windows\System\eJWsgaD.exe
  2⤵
  PID:10692
- C:\Windows\System\tKEEkhc.exe
  C:\Windows\System\tKEEkhc.exe
  2⤵
  PID:10708
- C:\Windows\System\xaRbwIV.exe
  C:\Windows\System\xaRbwIV.exe
  2⤵
  PID:10736
- C:\Windows\System\iQgFDJp.exe
  C:\Windows\System\iQgFDJp.exe
  2⤵
  PID:10752
- C:\Windows\System\mHUAveq.exe
  C:\Windows\System\mHUAveq.exe
  2⤵
  PID:10768
- C:\Windows\System\tVgWirp.exe
  C:\Windows\System\tVgWirp.exe
  2⤵
  PID:10796
- C:\Windows\System\kqEtruv.exe
  C:\Windows\System\kqEtruv.exe
  2⤵
  PID:10820
- C:\Windows\System\bOhosHG.exe
  C:\Windows\System\bOhosHG.exe
  2⤵
  PID:10836
- C:\Windows\System\TgcqZTk.exe
  C:\Windows\System\TgcqZTk.exe
  2⤵
  PID:10852
- C:\Windows\System\KBIkRDn.exe
  C:\Windows\System\KBIkRDn.exe
  2⤵
  PID:10880
- C:\Windows\System\zhkzPRT.exe
  C:\Windows\System\zhkzPRT.exe
  2⤵
  PID:10896
- C:\Windows\System\iXOJpdA.exe
  C:\Windows\System\iXOJpdA.exe
  2⤵
  PID:10928
- C:\Windows\System\JNbgIWe.exe
  C:\Windows\System\JNbgIWe.exe
  2⤵
  PID:10952
- C:\Windows\System\fJiqxre.exe
  C:\Windows\System\fJiqxre.exe
  2⤵
  PID:10980
- C:\Windows\System\zWSmJmy.exe
  C:\Windows\System\zWSmJmy.exe
  2⤵
  PID:11004
- C:\Windows\System\rWbgOxk.exe
  C:\Windows\System\rWbgOxk.exe
  2⤵
  PID:11040
- C:\Windows\System\UQqFxhL.exe
  C:\Windows\System\UQqFxhL.exe
  2⤵
  PID:11064
- C:\Windows\System\JMEnVSe.exe
  C:\Windows\System\JMEnVSe.exe
  2⤵
  PID:11084
- C:\Windows\System\FyAIYMp.exe
  C:\Windows\System\FyAIYMp.exe
  2⤵
  PID:11112
- C:\Windows\System\cRfpOOR.exe
  C:\Windows\System\cRfpOOR.exe
  2⤵
  PID:11148
- C:\Windows\System\JyWqbjs.exe
  C:\Windows\System\JyWqbjs.exe
  2⤵
  PID:11168
- C:\Windows\System\onbxsTB.exe
  C:\Windows\System\onbxsTB.exe
  2⤵
  PID:11196
- C:\Windows\System\mfJwjBw.exe
  C:\Windows\System\mfJwjBw.exe
  2⤵
  PID:11216
- C:\Windows\System\gxHRQKF.exe
  C:\Windows\System\gxHRQKF.exe
  2⤵
  PID:11232
- C:\Windows\System\gWEqmgn.exe
  C:\Windows\System\gWEqmgn.exe
  2⤵
  PID:11256
- C:\Windows\System\TAzmRLp.exe
  C:\Windows\System\TAzmRLp.exe
  2⤵
  PID:9820
- C:\Windows\System\mhJMTOu.exe
  C:\Windows\System\mhJMTOu.exe
  2⤵
  PID:8160
- C:\Windows\System\OMxjUyr.exe
  C:\Windows\System\OMxjUyr.exe
  2⤵
  PID:9856
- C:\Windows\System\JqelbWN.exe
  C:\Windows\System\JqelbWN.exe
  2⤵
  PID:9220
- C:\Windows\System\SLZrUBV.exe
  C:\Windows\System\SLZrUBV.exe
  2⤵
  PID:10256
- C:\Windows\System\OSqenee.exe
  C:\Windows\System\OSqenee.exe
  2⤵
  PID:10308
- C:\Windows\System\pFdNPoR.exe
  C:\Windows\System\pFdNPoR.exe
  2⤵
  PID:10340
- C:\Windows\System\XOwJeyt.exe
  C:\Windows\System\XOwJeyt.exe
  2⤵
  PID:8648
- C:\Windows\System\NXWcJfs.exe
  C:\Windows\System\NXWcJfs.exe
  2⤵
  PID:7472
- C:\Windows\System\hssKKju.exe
  C:\Windows\System\hssKKju.exe
  2⤵
  PID:8048
- C:\Windows\System\PWyHpJG.exe
  C:\Windows\System\PWyHpJG.exe
  2⤵
  PID:10520
- C:\Windows\System\RDeeHHl.exe
  C:\Windows\System\RDeeHHl.exe
  2⤵
  PID:10568
- C:\Windows\System\KclAtjU.exe
  C:\Windows\System\KclAtjU.exe
  2⤵
  PID:10688
- C:\Windows\System\qddiekH.exe
  C:\Windows\System\qddiekH.exe
  2⤵
  PID:10724
- C:\Windows\System\uLaMDfp.exe
  C:\Windows\System\uLaMDfp.exe
  2⤵
  PID:9204
- C:\Windows\System\mnVKAIo.exe
  C:\Windows\System\mnVKAIo.exe
  2⤵
  PID:10844
- C:\Windows\System\QIAtKMO.exe
  C:\Windows\System\QIAtKMO.exe
  2⤵
  PID:10548
- C:\Windows\System\PJIgKOQ.exe
  C:\Windows\System\PJIgKOQ.exe
  2⤵
  PID:11032
- C:\Windows\System\FeVYuNi.exe
  C:\Windows\System\FeVYuNi.exe
  2⤵
  PID:10664
- C:\Windows\System\kqKDMRn.exe
  C:\Windows\System\kqKDMRn.exe
  2⤵
  PID:10684
- C:\Windows\System\fXjhZdU.exe
  C:\Windows\System\fXjhZdU.exe
  2⤵
  PID:11268
- C:\Windows\System\GcShcHZ.exe
  C:\Windows\System\GcShcHZ.exe
  2⤵
  PID:11296
- C:\Windows\System\nrBVqSE.exe
  C:\Windows\System\nrBVqSE.exe
  2⤵
  PID:11316
- C:\Windows\System\nHFuxSD.exe
  C:\Windows\System\nHFuxSD.exe
  2⤵
  PID:11336
- C:\Windows\System\eQYZNcV.exe
  C:\Windows\System\eQYZNcV.exe
  2⤵
  PID:11356
- C:\Windows\System\zyTMHtD.exe
  C:\Windows\System\zyTMHtD.exe
  2⤵
  PID:11380
- C:\Windows\System\QZTKHmm.exe
  C:\Windows\System\QZTKHmm.exe
  2⤵
  PID:11412
- C:\Windows\System\WoDvAPr.exe
  C:\Windows\System\WoDvAPr.exe
  2⤵
  PID:11436
- C:\Windows\System\gbyvUJv.exe
  C:\Windows\System\gbyvUJv.exe
  2⤵
  PID:11456
- C:\Windows\System\qCdwqhx.exe
  C:\Windows\System\qCdwqhx.exe
  2⤵
  PID:11484
- C:\Windows\System\xCgyRhl.exe
  C:\Windows\System\xCgyRhl.exe
  2⤵
  PID:11504
- C:\Windows\System\GDXTvFy.exe
  C:\Windows\System\GDXTvFy.exe
  2⤵
  PID:11532
- C:\Windows\System\OAhIOnX.exe
  C:\Windows\System\OAhIOnX.exe
  2⤵
  PID:11560
- C:\Windows\System\ECrEEaS.exe
  C:\Windows\System\ECrEEaS.exe
  2⤵
  PID:11584
- C:\Windows\System\UPyEsXT.exe
  C:\Windows\System\UPyEsXT.exe
  2⤵
  PID:11608
- C:\Windows\System\pawHbCK.exe
  C:\Windows\System\pawHbCK.exe
  2⤵
  PID:11624
- C:\Windows\System\XOCSQSA.exe
  C:\Windows\System\XOCSQSA.exe
  2⤵
  PID:11652
- C:\Windows\System\VHCJGtT.exe
  C:\Windows\System\VHCJGtT.exe
  2⤵
  PID:11676
- C:\Windows\System\NdEKbnU.exe
  C:\Windows\System\NdEKbnU.exe
  2⤵
  PID:11696

Analysis

Sharing

General

Malware Config

Signatures

Processes