xmrig | 377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
Size

1.2MB
MD5

a9168fd4385f4c4d7f006c6da93b6773
SHA1

42cb497c903268ff2d428c6d40698943e60957a3
SHA256

377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb
SHA512

9626fde29743e60e56db8cc9ef7f7eefaf37e0e6a800bd0001ad20a2ee702bfdf0f40922914199596c52d0d74e81fa5d8919dd1cc440e7c514dee24f5438adb3
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6PbMdhzp:GezaTF8FcNkNdfE0pZ9ozttwIRx3iZ

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x00080000000120f9-2.dat	xmrig
behavioral1/files/0x0008000000016ab9-6.dat	xmrig
behavioral1/files/0x0008000000016c56-9.dat	xmrig
behavioral1/files/0x0008000000016c73-15.dat	xmrig
behavioral1/files/0x0007000000016cc5-23.dat	xmrig
behavioral1/files/0x0007000000016ce7-27.dat	xmrig
behavioral1/files/0x0008000000016d2e-35.dat	xmrig
behavioral1/files/0x0008000000016d36-42.dat	xmrig
behavioral1/files/0x00060000000175e7-47.dat	xmrig
behavioral1/files/0x0011000000018682-62.dat	xmrig
behavioral1/files/0x00050000000186f2-72.dat	xmrig
behavioral1/files/0x000500000001925e-117.dat	xmrig
behavioral1/files/0x0005000000019261-120.dat	xmrig
behavioral1/files/0x0005000000019284-137.dat	xmrig
behavioral1/files/0x00050000000193a4-156.dat	xmrig
behavioral1/files/0x000500000001939d-152.dat	xmrig
behavioral1/files/0x0005000000019379-147.dat	xmrig
behavioral1/files/0x00050000000192a9-142.dat	xmrig
behavioral1/files/0x0005000000019279-132.dat	xmrig
behavioral1/files/0x000500000001922c-112.dat	xmrig
behavioral1/files/0x000500000001926a-127.dat	xmrig
behavioral1/files/0x0005000000019227-107.dat	xmrig
behavioral1/files/0x0006000000018bf3-102.dat	xmrig
behavioral1/files/0x000500000001878c-97.dat	xmrig
behavioral1/files/0x0005000000018781-92.dat	xmrig
behavioral1/files/0x0005000000018742-87.dat	xmrig
behavioral1/files/0x0005000000018731-82.dat	xmrig
behavioral1/files/0x00050000000186f8-77.dat	xmrig
behavioral1/files/0x000500000001868b-67.dat	xmrig
behavioral1/files/0x001400000001866f-57.dat	xmrig
behavioral1/files/0x0006000000018669-52.dat	xmrig
behavioral1/files/0x0007000000016d1d-33.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2268	BboFBsp.exe
2420	gzyTfBG.exe
2548	HvOHTGo.exe
2404	CjxpBkl.exe
2140	YVLRJCU.exe
1272	ftsuIOA.exe
2736	PZbpBPv.exe
2804	ytSsmTN.exe
2748	IIJYkVj.exe
1632	AQTlZtC.exe
2728	SIQQyyb.exe
2832	BUMjRiK.exe
2844	ldqbxws.exe
2908	PKgRQST.exe
2764	wvpfKlw.exe
2600	mdkNPjl.exe
2648	KOEVNQl.exe
3044	yHAjTEO.exe
3048	hfTEtDh.exe
1112	zghowRW.exe
1324	aGZisjF.exe
2468	fuMIyRz.exe
2312	DNrAjiO.exe
1312	USlIYqu.exe
1684	mQmxaUv.exe
1964	okronEB.exe
1764	eApFkUL.exe
3068	uccmMnY.exe
2252	ELoutMc.exe
2212	QQEFhdg.exe
2084	XOmqhca.exe
2280	uxYEdsn.exe
1704	MzzcCiy.exe
1128	eqVntwj.exe
1144	XtmwoTW.exe
2136	ZyRRZEL.exe
2504	ERYrlUJ.exe
1860	yQKqlny.exe
284	dxzkDOT.exe
2028	qDJqvBf.exe
1600	vmCgxYT.exe
1576	VRwRgmM.exe
1672	MPvGKUj.exe
2004	rRmsvKK.exe
920	aMyPjim.exe
924	rZuauMS.exe
1636	kQKvDgR.exe
2024	YDzlwKQ.exe
320	wSqJgbp.exe
704	aMarJNu.exe
2424	YYTLLgM.exe
2324	wVkmUIg.exe
696	trvamQe.exe
292	VqBFVcA.exe
1484	DqIzWAz.exe
2532	udvvSPL.exe
892	JZrwKIG.exe
2496	ACsqqbq.exe
1564	sYRqUQH.exe
1808	XLDZYVB.exe
1668	fHOjgJZ.exe
2436	OTjKLps.exe
2372	OspHjpd.exe
2196	AZbwYOj.exe

Loads dropped DLL 64 IoCs

pid	Process
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pdrIFGa.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\zldgsxY.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\WJcDbTw.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\qZLFYcG.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\zonyJvG.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\WtQCFmU.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\DCakuPF.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\gcvjPuH.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\nutYswK.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\hfZcZLF.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\xqwIxnK.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\iQqKILc.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\WMwuLlD.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\tUqAeMZ.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\cjDbXAH.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\xBnSOXg.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\mtCUUKU.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\Tsjxmrf.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\sOwZVwx.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\YLqucAP.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\pqbOJVY.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\sBHkbKY.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\ngSwwEj.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\TXhmkOg.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\OBlSUPy.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\RIacuox.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\pRErdhS.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\bnILFaJ.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\iXEfrHR.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\WGBvmOy.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\aGKmTat.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\wHyqUzU.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\CReOwyX.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\vJPfead.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\AoPMToJ.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\UkphdBy.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\GuteOAj.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\RNUhRab.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\xueHXLN.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\mhyddMO.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\QNudPDZ.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\QqmzNWa.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\uaDWYjV.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\mzxRnzS.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\BVnXADg.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\DwmRboC.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\VWoBpxq.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\WSNwMxf.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\wnqZmSX.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\yBTtQRB.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\GzSSPMD.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\mAunRSC.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\KUXJqdv.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\amkuGRp.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\DamoBgW.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\NsGRdqN.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\MSJvbuT.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\SldtboU.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\VcXnbTB.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\mpqHBYi.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\WvwQtfe.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\tmXpsrp.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\dxzkDOT.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
File created	C:\Windows\System\BJxyeVS.exe	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2268	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	31
PID 2116 wrote to memory of 2268	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	31
PID 2116 wrote to memory of 2268	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	31
PID 2116 wrote to memory of 2420	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	32
PID 2116 wrote to memory of 2420	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	32
PID 2116 wrote to memory of 2420	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	32
PID 2116 wrote to memory of 2548	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	33
PID 2116 wrote to memory of 2548	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	33
PID 2116 wrote to memory of 2548	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	33
PID 2116 wrote to memory of 2404	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	34
PID 2116 wrote to memory of 2404	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	34
PID 2116 wrote to memory of 2404	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	34
PID 2116 wrote to memory of 2140	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	35
PID 2116 wrote to memory of 2140	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	35
PID 2116 wrote to memory of 2140	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	35
PID 2116 wrote to memory of 1272	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	36
PID 2116 wrote to memory of 1272	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	36
PID 2116 wrote to memory of 1272	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	36
PID 2116 wrote to memory of 2736	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	37
PID 2116 wrote to memory of 2736	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	37
PID 2116 wrote to memory of 2736	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	37
PID 2116 wrote to memory of 2804	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	38
PID 2116 wrote to memory of 2804	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	38
PID 2116 wrote to memory of 2804	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	38
PID 2116 wrote to memory of 2748	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	39
PID 2116 wrote to memory of 2748	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	39
PID 2116 wrote to memory of 2748	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	39
PID 2116 wrote to memory of 1632	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	40
PID 2116 wrote to memory of 1632	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	40
PID 2116 wrote to memory of 1632	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	40
PID 2116 wrote to memory of 2728	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	41
PID 2116 wrote to memory of 2728	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	41
PID 2116 wrote to memory of 2728	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	41
PID 2116 wrote to memory of 2832	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	42
PID 2116 wrote to memory of 2832	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	42
PID 2116 wrote to memory of 2832	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	42
PID 2116 wrote to memory of 2844	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	43
PID 2116 wrote to memory of 2844	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	43
PID 2116 wrote to memory of 2844	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	43
PID 2116 wrote to memory of 2908	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	44
PID 2116 wrote to memory of 2908	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	44
PID 2116 wrote to memory of 2908	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	44
PID 2116 wrote to memory of 2764	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	45
PID 2116 wrote to memory of 2764	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	45
PID 2116 wrote to memory of 2764	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	45
PID 2116 wrote to memory of 2600	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	46
PID 2116 wrote to memory of 2600	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	46
PID 2116 wrote to memory of 2600	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	46
PID 2116 wrote to memory of 2648	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	47
PID 2116 wrote to memory of 2648	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	47
PID 2116 wrote to memory of 2648	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	47
PID 2116 wrote to memory of 3044	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	48
PID 2116 wrote to memory of 3044	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	48
PID 2116 wrote to memory of 3044	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	48
PID 2116 wrote to memory of 3048	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	49
PID 2116 wrote to memory of 3048	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	49
PID 2116 wrote to memory of 3048	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	49
PID 2116 wrote to memory of 1112	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	50
PID 2116 wrote to memory of 1112	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	50
PID 2116 wrote to memory of 1112	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	50
PID 2116 wrote to memory of 1324	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	51
PID 2116 wrote to memory of 1324	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	51
PID 2116 wrote to memory of 1324	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	51
PID 2116 wrote to memory of 2468	2116	377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe	52

C:\Users\Admin\AppData\Local\Temp\377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe
"C:\Users\Admin\AppData\Local\Temp\377f46c880736df37de5bd532c4e8abaeba6d1c0da18c735ddfbd1bacfd610eb.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\System\BboFBsp.exe
  C:\Windows\System\BboFBsp.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\gzyTfBG.exe
  C:\Windows\System\gzyTfBG.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\HvOHTGo.exe
  C:\Windows\System\HvOHTGo.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\CjxpBkl.exe
  C:\Windows\System\CjxpBkl.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\YVLRJCU.exe
  C:\Windows\System\YVLRJCU.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\ftsuIOA.exe
  C:\Windows\System\ftsuIOA.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\PZbpBPv.exe
  C:\Windows\System\PZbpBPv.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\ytSsmTN.exe
  C:\Windows\System\ytSsmTN.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\IIJYkVj.exe
  C:\Windows\System\IIJYkVj.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\AQTlZtC.exe
  C:\Windows\System\AQTlZtC.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\SIQQyyb.exe
  C:\Windows\System\SIQQyyb.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\BUMjRiK.exe
  C:\Windows\System\BUMjRiK.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\ldqbxws.exe
  C:\Windows\System\ldqbxws.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\PKgRQST.exe
  C:\Windows\System\PKgRQST.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\wvpfKlw.exe
  C:\Windows\System\wvpfKlw.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\mdkNPjl.exe
  C:\Windows\System\mdkNPjl.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\KOEVNQl.exe
  C:\Windows\System\KOEVNQl.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\yHAjTEO.exe
  C:\Windows\System\yHAjTEO.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\hfTEtDh.exe
  C:\Windows\System\hfTEtDh.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\zghowRW.exe
  C:\Windows\System\zghowRW.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\aGZisjF.exe
  C:\Windows\System\aGZisjF.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\fuMIyRz.exe
  C:\Windows\System\fuMIyRz.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\DNrAjiO.exe
  C:\Windows\System\DNrAjiO.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\USlIYqu.exe
  C:\Windows\System\USlIYqu.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\mQmxaUv.exe
  C:\Windows\System\mQmxaUv.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\okronEB.exe
  C:\Windows\System\okronEB.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\eApFkUL.exe
  C:\Windows\System\eApFkUL.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\uccmMnY.exe
  C:\Windows\System\uccmMnY.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\ELoutMc.exe
  C:\Windows\System\ELoutMc.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\QQEFhdg.exe
  C:\Windows\System\QQEFhdg.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\XOmqhca.exe
  C:\Windows\System\XOmqhca.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\uxYEdsn.exe
  C:\Windows\System\uxYEdsn.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\MzzcCiy.exe
  C:\Windows\System\MzzcCiy.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\eqVntwj.exe
  C:\Windows\System\eqVntwj.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\XtmwoTW.exe
  C:\Windows\System\XtmwoTW.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\ZyRRZEL.exe
  C:\Windows\System\ZyRRZEL.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\ERYrlUJ.exe
  C:\Windows\System\ERYrlUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\yQKqlny.exe
  C:\Windows\System\yQKqlny.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\dxzkDOT.exe
  C:\Windows\System\dxzkDOT.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\qDJqvBf.exe
  C:\Windows\System\qDJqvBf.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\vmCgxYT.exe
  C:\Windows\System\vmCgxYT.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\VRwRgmM.exe
  C:\Windows\System\VRwRgmM.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\MPvGKUj.exe
  C:\Windows\System\MPvGKUj.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\rRmsvKK.exe
  C:\Windows\System\rRmsvKK.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\aMyPjim.exe
  C:\Windows\System\aMyPjim.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\rZuauMS.exe
  C:\Windows\System\rZuauMS.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\kQKvDgR.exe
  C:\Windows\System\kQKvDgR.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\YDzlwKQ.exe
  C:\Windows\System\YDzlwKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\wSqJgbp.exe
  C:\Windows\System\wSqJgbp.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\aMarJNu.exe
  C:\Windows\System\aMarJNu.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\YYTLLgM.exe
  C:\Windows\System\YYTLLgM.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\wVkmUIg.exe
  C:\Windows\System\wVkmUIg.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\trvamQe.exe
  C:\Windows\System\trvamQe.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\VqBFVcA.exe
  C:\Windows\System\VqBFVcA.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\DqIzWAz.exe
  C:\Windows\System\DqIzWAz.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\udvvSPL.exe
  C:\Windows\System\udvvSPL.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\JZrwKIG.exe
  C:\Windows\System\JZrwKIG.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\ACsqqbq.exe
  C:\Windows\System\ACsqqbq.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\XLDZYVB.exe
  C:\Windows\System\XLDZYVB.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\sYRqUQH.exe
  C:\Windows\System\sYRqUQH.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\fHOjgJZ.exe
  C:\Windows\System\fHOjgJZ.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\OTjKLps.exe
  C:\Windows\System\OTjKLps.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\OspHjpd.exe
  C:\Windows\System\OspHjpd.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\AZbwYOj.exe
  C:\Windows\System\AZbwYOj.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\rMgixfe.exe
  C:\Windows\System\rMgixfe.exe
  2⤵
  PID:2688
- C:\Windows\System\QevMEBP.exe
  C:\Windows\System\QevMEBP.exe
  2⤵
  PID:2792
- C:\Windows\System\lgBiSAQ.exe
  C:\Windows\System\lgBiSAQ.exe
  2⤵
  PID:2296
- C:\Windows\System\hgzjPZE.exe
  C:\Windows\System\hgzjPZE.exe
  2⤵
  PID:2440
- C:\Windows\System\XIKIORQ.exe
  C:\Windows\System\XIKIORQ.exe
  2⤵
  PID:2900
- C:\Windows\System\NqtdHsf.exe
  C:\Windows\System\NqtdHsf.exe
  2⤵
  PID:2816
- C:\Windows\System\GGsXSiZ.exe
  C:\Windows\System\GGsXSiZ.exe
  2⤵
  PID:2640
- C:\Windows\System\KaAzYHi.exe
  C:\Windows\System\KaAzYHi.exe
  2⤵
  PID:2392
- C:\Windows\System\DwDmcgX.exe
  C:\Windows\System\DwDmcgX.exe
  2⤵
  PID:2656
- C:\Windows\System\gvCXVHq.exe
  C:\Windows\System\gvCXVHq.exe
  2⤵
  PID:1720
- C:\Windows\System\NxDQWBg.exe
  C:\Windows\System\NxDQWBg.exe
  2⤵
  PID:1700
- C:\Windows\System\oQSDBHU.exe
  C:\Windows\System\oQSDBHU.exe
  2⤵
  PID:1756
- C:\Windows\System\UsZQDIa.exe
  C:\Windows\System\UsZQDIa.exe
  2⤵
  PID:2128
- C:\Windows\System\lirheUM.exe
  C:\Windows\System\lirheUM.exe
  2⤵
  PID:1648
- C:\Windows\System\eofMCWS.exe
  C:\Windows\System\eofMCWS.exe
  2⤵
  PID:2448
- C:\Windows\System\FcBHDik.exe
  C:\Windows\System\FcBHDik.exe
  2⤵
  PID:1052
- C:\Windows\System\lyvlfUa.exe
  C:\Windows\System\lyvlfUa.exe
  2⤵
  PID:2052
- C:\Windows\System\srIuHYv.exe
  C:\Windows\System\srIuHYv.exe
  2⤵
  PID:1476
- C:\Windows\System\fonINbs.exe
  C:\Windows\System\fonINbs.exe
  2⤵
  PID:2124
- C:\Windows\System\jSronaK.exe
  C:\Windows\System\jSronaK.exe
  2⤵
  PID:1028
- C:\Windows\System\eOjRiyX.exe
  C:\Windows\System\eOjRiyX.exe
  2⤵
  PID:1480
- C:\Windows\System\qixKDdi.exe
  C:\Windows\System\qixKDdi.exe
  2⤵
  PID:1344
- C:\Windows\System\hqwFgIY.exe
  C:\Windows\System\hqwFgIY.exe
  2⤵
  PID:1748
- C:\Windows\System\dJLCZTT.exe
  C:\Windows\System\dJLCZTT.exe
  2⤵
  PID:2456
- C:\Windows\System\sEIAKbX.exe
  C:\Windows\System\sEIAKbX.exe
  2⤵
  PID:1692
- C:\Windows\System\TeHtSXW.exe
  C:\Windows\System\TeHtSXW.exe
  2⤵
  PID:2544
- C:\Windows\System\JUEzfxk.exe
  C:\Windows\System\JUEzfxk.exe
  2⤵
  PID:1124
- C:\Windows\System\fgtOmKn.exe
  C:\Windows\System\fgtOmKn.exe
  2⤵
  PID:344
- C:\Windows\System\FjxhqoX.exe
  C:\Windows\System\FjxhqoX.exe
  2⤵
  PID:780
- C:\Windows\System\xPvdOlR.exe
  C:\Windows\System\xPvdOlR.exe
  2⤵
  PID:2540
- C:\Windows\System\SDmCbzj.exe
  C:\Windows\System\SDmCbzj.exe
  2⤵
  PID:2960
- C:\Windows\System\qQPDXTJ.exe
  C:\Windows\System\qQPDXTJ.exe
  2⤵
  PID:2016
- C:\Windows\System\SDPthOI.exe
  C:\Windows\System\SDPthOI.exe
  2⤵
  PID:2412
- C:\Windows\System\UubyNWG.exe
  C:\Windows\System\UubyNWG.exe
  2⤵
  PID:816
- C:\Windows\System\EbuayoZ.exe
  C:\Windows\System\EbuayoZ.exe
  2⤵
  PID:2912
- C:\Windows\System\SkuAeyz.exe
  C:\Windows\System\SkuAeyz.exe
  2⤵
  PID:2088
- C:\Windows\System\zjuwHYZ.exe
  C:\Windows\System\zjuwHYZ.exe
  2⤵
  PID:2232
- C:\Windows\System\JmLyvSy.exe
  C:\Windows\System\JmLyvSy.exe
  2⤵
  PID:2784
- C:\Windows\System\zbyEuYv.exe
  C:\Windows\System\zbyEuYv.exe
  2⤵
  PID:2308
- C:\Windows\System\UFAXZjK.exe
  C:\Windows\System\UFAXZjK.exe
  2⤵
  PID:2652
- C:\Windows\System\lxmkKjG.exe
  C:\Windows\System\lxmkKjG.exe
  2⤵
  PID:2304
- C:\Windows\System\JnanEIM.exe
  C:\Windows\System\JnanEIM.exe
  2⤵
  PID:860
- C:\Windows\System\wDcuWIr.exe
  C:\Windows\System\wDcuWIr.exe
  2⤵
  PID:636
- C:\Windows\System\xPKyHaw.exe
  C:\Windows\System\xPKyHaw.exe
  2⤵
  PID:2584
- C:\Windows\System\MgtmJce.exe
  C:\Windows\System\MgtmJce.exe
  2⤵
  PID:3056
- C:\Windows\System\hGKkYhJ.exe
  C:\Windows\System\hGKkYhJ.exe
  2⤵
  PID:2676
- C:\Windows\System\PFzYFPj.exe
  C:\Windows\System\PFzYFPj.exe
  2⤵
  PID:1160
- C:\Windows\System\Ltmqhmn.exe
  C:\Windows\System\Ltmqhmn.exe
  2⤵
  PID:352
- C:\Windows\System\VmgatIq.exe
  C:\Windows\System\VmgatIq.exe
  2⤵
  PID:2944
- C:\Windows\System\ylCEcYR.exe
  C:\Windows\System\ylCEcYR.exe
  2⤵
  PID:1040
- C:\Windows\System\xqQsnOM.exe
  C:\Windows\System\xqQsnOM.exe
  2⤵
  PID:912
- C:\Windows\System\oPiedqd.exe
  C:\Windows\System\oPiedqd.exe
  2⤵
  PID:880
- C:\Windows\System\FzvxRvs.exe
  C:\Windows\System\FzvxRvs.exe
  2⤵
  PID:1528
- C:\Windows\System\GjdANxQ.exe
  C:\Windows\System\GjdANxQ.exe
  2⤵
  PID:1292
- C:\Windows\System\YsfvvhA.exe
  C:\Windows\System\YsfvvhA.exe
  2⤵
  PID:2680
- C:\Windows\System\ORGCKhq.exe
  C:\Windows\System\ORGCKhq.exe
  2⤵
  PID:2172
- C:\Windows\System\yDrBKJZ.exe
  C:\Windows\System\yDrBKJZ.exe
  2⤵
  PID:2740
- C:\Windows\System\XjnnWBn.exe
  C:\Windows\System\XjnnWBn.exe
  2⤵
  PID:2508
- C:\Windows\System\iOxjExD.exe
  C:\Windows\System\iOxjExD.exe
  2⤵
  PID:2836
- C:\Windows\System\VKUcHKR.exe
  C:\Windows\System\VKUcHKR.exe
  2⤵
  PID:2272
- C:\Windows\System\vxtnVfV.exe
  C:\Windows\System\vxtnVfV.exe
  2⤵
  PID:2056
- C:\Windows\System\DBvNhlE.exe
  C:\Windows\System\DBvNhlE.exe
  2⤵
  PID:2788
- C:\Windows\System\vZRUHxv.exe
  C:\Windows\System\vZRUHxv.exe
  2⤵
  PID:2012
- C:\Windows\System\wkVmvlt.exe
  C:\Windows\System\wkVmvlt.exe
  2⤵
  PID:2168
- C:\Windows\System\mRLjSRI.exe
  C:\Windows\System\mRLjSRI.exe
  2⤵
  PID:3040
- C:\Windows\System\dnFFseg.exe
  C:\Windows\System\dnFFseg.exe
  2⤵
  PID:3060
- C:\Windows\System\gPWtoyE.exe
  C:\Windows\System\gPWtoyE.exe
  2⤵
  PID:2064
- C:\Windows\System\vhUHeIQ.exe
  C:\Windows\System\vhUHeIQ.exe
  2⤵
  PID:548
- C:\Windows\System\zufBtZf.exe
  C:\Windows\System\zufBtZf.exe
  2⤵
  PID:1540
- C:\Windows\System\GzSSPMD.exe
  C:\Windows\System\GzSSPMD.exe
  2⤵
  PID:1248
- C:\Windows\System\TupmRnk.exe
  C:\Windows\System\TupmRnk.exe
  2⤵
  PID:2228
- C:\Windows\System\uOtKVca.exe
  C:\Windows\System\uOtKVca.exe
  2⤵
  PID:2756
- C:\Windows\System\RgJKFCc.exe
  C:\Windows\System\RgJKFCc.exe
  2⤵
  PID:2512
- C:\Windows\System\MhCAeZy.exe
  C:\Windows\System\MhCAeZy.exe
  2⤵
  PID:316
- C:\Windows\System\Ocbjrww.exe
  C:\Windows\System\Ocbjrww.exe
  2⤵
  PID:884
- C:\Windows\System\JcvbVWB.exe
  C:\Windows\System\JcvbVWB.exe
  2⤵
  PID:2720
- C:\Windows\System\cApsVQN.exe
  C:\Windows\System\cApsVQN.exe
  2⤵
  PID:2928
- C:\Windows\System\zSdqRHO.exe
  C:\Windows\System\zSdqRHO.exe
  2⤵
  PID:868
- C:\Windows\System\PqDWiml.exe
  C:\Windows\System\PqDWiml.exe
  2⤵
  PID:2260
- C:\Windows\System\sNnAueG.exe
  C:\Windows\System\sNnAueG.exe
  2⤵
  PID:2616
- C:\Windows\System\HOmGmDc.exe
  C:\Windows\System\HOmGmDc.exe
  2⤵
  PID:2528
- C:\Windows\System\zWKFCUE.exe
  C:\Windows\System\zWKFCUE.exe
  2⤵
  PID:2516
- C:\Windows\System\fKpaofu.exe
  C:\Windows\System\fKpaofu.exe
  2⤵
  PID:1740
- C:\Windows\System\sFdJqpg.exe
  C:\Windows\System\sFdJqpg.exe
  2⤵
  PID:2360
- C:\Windows\System\LEfrbIa.exe
  C:\Windows\System\LEfrbIa.exe
  2⤵
  PID:940
- C:\Windows\System\RfdaVbG.exe
  C:\Windows\System\RfdaVbG.exe
  2⤵
  PID:956
- C:\Windows\System\BiEctbn.exe
  C:\Windows\System\BiEctbn.exe
  2⤵
  PID:616
- C:\Windows\System\sFbytTH.exe
  C:\Windows\System\sFbytTH.exe
  2⤵
  PID:1584
- C:\Windows\System\QcKPuHw.exe
  C:\Windows\System\QcKPuHw.exe
  2⤵
  PID:3084
- C:\Windows\System\HTUJXqK.exe
  C:\Windows\System\HTUJXqK.exe
  2⤵
  PID:3100
- C:\Windows\System\RmpFAVN.exe
  C:\Windows\System\RmpFAVN.exe
  2⤵
  PID:3116
- C:\Windows\System\PkmmWgn.exe
  C:\Windows\System\PkmmWgn.exe
  2⤵
  PID:3132
- C:\Windows\System\jhhsPMZ.exe
  C:\Windows\System\jhhsPMZ.exe
  2⤵
  PID:3148
- C:\Windows\System\hbdOIsk.exe
  C:\Windows\System\hbdOIsk.exe
  2⤵
  PID:3172
- C:\Windows\System\pEqoZsO.exe
  C:\Windows\System\pEqoZsO.exe
  2⤵
  PID:3192
- C:\Windows\System\bawVrJT.exe
  C:\Windows\System\bawVrJT.exe
  2⤵
  PID:3216
- C:\Windows\System\ngSwwEj.exe
  C:\Windows\System\ngSwwEj.exe
  2⤵
  PID:3288
- C:\Windows\System\bwuMEUd.exe
  C:\Windows\System\bwuMEUd.exe
  2⤵
  PID:3308
- C:\Windows\System\eEIyQIm.exe
  C:\Windows\System\eEIyQIm.exe
  2⤵
  PID:3324
- C:\Windows\System\hhocvHU.exe
  C:\Windows\System\hhocvHU.exe
  2⤵
  PID:3340
- C:\Windows\System\DkWZTMs.exe
  C:\Windows\System\DkWZTMs.exe
  2⤵
  PID:3372
- C:\Windows\System\zfYcxvn.exe
  C:\Windows\System\zfYcxvn.exe
  2⤵
  PID:3388
- C:\Windows\System\rahNgdt.exe
  C:\Windows\System\rahNgdt.exe
  2⤵
  PID:3404
- C:\Windows\System\PRVghBw.exe
  C:\Windows\System\PRVghBw.exe
  2⤵
  PID:3420
- C:\Windows\System\uHWuXbJ.exe
  C:\Windows\System\uHWuXbJ.exe
  2⤵
  PID:3440
- C:\Windows\System\agigDOL.exe
  C:\Windows\System\agigDOL.exe
  2⤵
  PID:3460
- C:\Windows\System\cBUspLn.exe
  C:\Windows\System\cBUspLn.exe
  2⤵
  PID:3476
- C:\Windows\System\RSchfRf.exe
  C:\Windows\System\RSchfRf.exe
  2⤵
  PID:3492
- C:\Windows\System\yqSwGWu.exe
  C:\Windows\System\yqSwGWu.exe
  2⤵
  PID:3516
- C:\Windows\System\GMaYLge.exe
  C:\Windows\System\GMaYLge.exe
  2⤵
  PID:3540
- C:\Windows\System\pnQfXkc.exe
  C:\Windows\System\pnQfXkc.exe
  2⤵
  PID:3556
- C:\Windows\System\TVzjZaV.exe
  C:\Windows\System\TVzjZaV.exe
  2⤵
  PID:3572
- C:\Windows\System\jmjjLAl.exe
  C:\Windows\System\jmjjLAl.exe
  2⤵
  PID:3592
- C:\Windows\System\gBhoOSE.exe
  C:\Windows\System\gBhoOSE.exe
  2⤵
  PID:3608
- C:\Windows\System\fuHAZto.exe
  C:\Windows\System\fuHAZto.exe
  2⤵
  PID:3632
- C:\Windows\System\bqkcaKc.exe
  C:\Windows\System\bqkcaKc.exe
  2⤵
  PID:3648
- C:\Windows\System\GsiqDya.exe
  C:\Windows\System\GsiqDya.exe
  2⤵
  PID:3668
- C:\Windows\System\WDEtBnV.exe
  C:\Windows\System\WDEtBnV.exe
  2⤵
  PID:3684
- C:\Windows\System\LbRxJEy.exe
  C:\Windows\System\LbRxJEy.exe
  2⤵
  PID:3700
- C:\Windows\System\TOjkNYk.exe
  C:\Windows\System\TOjkNYk.exe
  2⤵
  PID:3716
- C:\Windows\System\BqenGQB.exe
  C:\Windows\System\BqenGQB.exe
  2⤵
  PID:3752
- C:\Windows\System\DOfORoL.exe
  C:\Windows\System\DOfORoL.exe
  2⤵
  PID:3776
- C:\Windows\System\KfBsPKv.exe
  C:\Windows\System\KfBsPKv.exe
  2⤵
  PID:3792
- C:\Windows\System\QVTIbvt.exe
  C:\Windows\System\QVTIbvt.exe
  2⤵
  PID:3808
- C:\Windows\System\nkJPcpK.exe
  C:\Windows\System\nkJPcpK.exe
  2⤵
  PID:3824
- C:\Windows\System\ObDBXSV.exe
  C:\Windows\System\ObDBXSV.exe
  2⤵
  PID:3840
- C:\Windows\System\PKpKMrX.exe
  C:\Windows\System\PKpKMrX.exe
  2⤵
  PID:3856
- C:\Windows\System\NgEfcge.exe
  C:\Windows\System\NgEfcge.exe
  2⤵
  PID:3876
- C:\Windows\System\ZuCCwEZ.exe
  C:\Windows\System\ZuCCwEZ.exe
  2⤵
  PID:3900
- C:\Windows\System\bqZoiOF.exe
  C:\Windows\System\bqZoiOF.exe
  2⤵
  PID:3916
- C:\Windows\System\klQbBhc.exe
  C:\Windows\System\klQbBhc.exe
  2⤵
  PID:3936
- C:\Windows\System\UPBIdVi.exe
  C:\Windows\System\UPBIdVi.exe
  2⤵
  PID:3992
- C:\Windows\System\TqGlaVa.exe
  C:\Windows\System\TqGlaVa.exe
  2⤵
  PID:4012
- C:\Windows\System\BZvEnfC.exe
  C:\Windows\System\BZvEnfC.exe
  2⤵
  PID:4044
- C:\Windows\System\TXhmkOg.exe
  C:\Windows\System\TXhmkOg.exe
  2⤵
  PID:4064
- C:\Windows\System\XnOUlUi.exe
  C:\Windows\System\XnOUlUi.exe
  2⤵
  PID:4080
- C:\Windows\System\BtCGHmb.exe
  C:\Windows\System\BtCGHmb.exe
  2⤵
  PID:1912
- C:\Windows\System\axVxnTh.exe
  C:\Windows\System\axVxnTh.exe
  2⤵
  PID:1780
- C:\Windows\System\bSFJboE.exe
  C:\Windows\System\bSFJboE.exe
  2⤵
  PID:2428
- C:\Windows\System\pYXVWPv.exe
  C:\Windows\System\pYXVWPv.exe
  2⤵
  PID:2812
- C:\Windows\System\BHeEVYL.exe
  C:\Windows\System\BHeEVYL.exe
  2⤵
  PID:3012
- C:\Windows\System\fqrMAxu.exe
  C:\Windows\System\fqrMAxu.exe
  2⤵
  PID:3096
- C:\Windows\System\uwoJzIj.exe
  C:\Windows\System\uwoJzIj.exe
  2⤵
  PID:3160
- C:\Windows\System\AQXsnCB.exe
  C:\Windows\System\AQXsnCB.exe
  2⤵
  PID:3208
- C:\Windows\System\LSkZyEH.exe
  C:\Windows\System\LSkZyEH.exe
  2⤵
  PID:3232
- C:\Windows\System\DnxOnlV.exe
  C:\Windows\System\DnxOnlV.exe
  2⤵
  PID:2672
- C:\Windows\System\eHhcpXL.exe
  C:\Windows\System\eHhcpXL.exe
  2⤵
  PID:1552
- C:\Windows\System\NnnTJFD.exe
  C:\Windows\System\NnnTJFD.exe
  2⤵
  PID:3112
- C:\Windows\System\QJYAGHT.exe
  C:\Windows\System\QJYAGHT.exe
  2⤵
  PID:3252
- C:\Windows\System\KkMnwTw.exe
  C:\Windows\System\KkMnwTw.exe
  2⤵
  PID:3268
- C:\Windows\System\zbZdgNg.exe
  C:\Windows\System\zbZdgNg.exe
  2⤵
  PID:3284
- C:\Windows\System\bccGXoz.exe
  C:\Windows\System\bccGXoz.exe
  2⤵
  PID:3304
- C:\Windows\System\OQnIjtA.exe
  C:\Windows\System\OQnIjtA.exe
  2⤵
  PID:2144
- C:\Windows\System\kxXAnZK.exe
  C:\Windows\System\kxXAnZK.exe
  2⤵
  PID:3320
- C:\Windows\System\ZmsyQOm.exe
  C:\Windows\System\ZmsyQOm.exe
  2⤵
  PID:3064
- C:\Windows\System\qgfYyQO.exe
  C:\Windows\System\qgfYyQO.exe
  2⤵
  PID:3452
- C:\Windows\System\iqmJBQv.exe
  C:\Windows\System\iqmJBQv.exe
  2⤵
  PID:3428
- C:\Windows\System\vTixmsQ.exe
  C:\Windows\System\vTixmsQ.exe
  2⤵
  PID:3536
- C:\Windows\System\OBlSUPy.exe
  C:\Windows\System\OBlSUPy.exe
  2⤵
  PID:3604
- C:\Windows\System\YaKSuAc.exe
  C:\Windows\System\YaKSuAc.exe
  2⤵
  PID:3708
- C:\Windows\System\DCFbwdI.exe
  C:\Windows\System\DCFbwdI.exe
  2⤵
  PID:1712
- C:\Windows\System\Tsjxmrf.exe
  C:\Windows\System\Tsjxmrf.exe
  2⤵
  PID:3728
- C:\Windows\System\gWDpgUg.exe
  C:\Windows\System\gWDpgUg.exe
  2⤵
  PID:3584
- C:\Windows\System\PjUNIhC.exe
  C:\Windows\System\PjUNIhC.exe
  2⤵
  PID:3660
- C:\Windows\System\vfExyUe.exe
  C:\Windows\System\vfExyUe.exe
  2⤵
  PID:2120
- C:\Windows\System\UpsyLrT.exe
  C:\Windows\System\UpsyLrT.exe
  2⤵
  PID:3772
- C:\Windows\System\jJDrUHl.exe
  C:\Windows\System\jJDrUHl.exe
  2⤵
  PID:2400
- C:\Windows\System\mfIrAoV.exe
  C:\Windows\System\mfIrAoV.exe
  2⤵
  PID:3908
- C:\Windows\System\plJVlOL.exe
  C:\Windows\System\plJVlOL.exe
  2⤵
  PID:3552
- C:\Windows\System\wvPMdsK.exe
  C:\Windows\System\wvPMdsK.exe
  2⤵
  PID:3960
- C:\Windows\System\CGNOnzP.exe
  C:\Windows\System\CGNOnzP.exe
  2⤵
  PID:3972
- C:\Windows\System\scfxolY.exe
  C:\Windows\System\scfxolY.exe
  2⤵
  PID:3052
- C:\Windows\System\FKZFmUm.exe
  C:\Windows\System\FKZFmUm.exe
  2⤵
  PID:2188
- C:\Windows\System\BimUDNZ.exe
  C:\Windows\System\BimUDNZ.exe
  2⤵
  PID:3748
- C:\Windows\System\SFcPPie.exe
  C:\Windows\System\SFcPPie.exe
  2⤵
  PID:3892
- C:\Windows\System\DAKjslb.exe
  C:\Windows\System\DAKjslb.exe
  2⤵
  PID:4000
- C:\Windows\System\xytmpii.exe
  C:\Windows\System\xytmpii.exe
  2⤵
  PID:4032
- C:\Windows\System\RPZDTsK.exe
  C:\Windows\System\RPZDTsK.exe
  2⤵
  PID:3032
- C:\Windows\System\VMbvWDX.exe
  C:\Windows\System\VMbvWDX.exe
  2⤵
  PID:2032
- C:\Windows\System\NBiGQfY.exe
  C:\Windows\System\NBiGQfY.exe
  2⤵
  PID:1420
- C:\Windows\System\ovqTPlw.exe
  C:\Windows\System\ovqTPlw.exe
  2⤵
  PID:3204
- C:\Windows\System\QYgiKsL.exe
  C:\Windows\System\QYgiKsL.exe
  2⤵
  PID:2860
- C:\Windows\System\hifcIku.exe
  C:\Windows\System\hifcIku.exe
  2⤵
  PID:3264
- C:\Windows\System\ACdJzCh.exe
  C:\Windows\System\ACdJzCh.exe
  2⤵
  PID:3356
- C:\Windows\System\bcNaHqz.exe
  C:\Windows\System\bcNaHqz.exe
  2⤵
  PID:3448
- C:\Windows\System\UrUhmwz.exe
  C:\Windows\System\UrUhmwz.exe
  2⤵
  PID:3244
- C:\Windows\System\aiitomU.exe
  C:\Windows\System\aiitomU.exe
  2⤵
  PID:3248
- C:\Windows\System\tXVkzie.exe
  C:\Windows\System\tXVkzie.exe
  2⤵
  PID:3336
- C:\Windows\System\AaLyGQB.exe
  C:\Windows\System\AaLyGQB.exe
  2⤵
  PID:2776
- C:\Windows\System\AFTyOdQ.exe
  C:\Windows\System\AFTyOdQ.exe
  2⤵
  PID:4092
- C:\Windows\System\OHwNSsY.exe
  C:\Windows\System\OHwNSsY.exe
  2⤵
  PID:3352
- C:\Windows\System\DPFYMXX.exe
  C:\Windows\System\DPFYMXX.exe
  2⤵
  PID:2888
- C:\Windows\System\uLhiiey.exe
  C:\Windows\System\uLhiiey.exe
  2⤵
  PID:3628
- C:\Windows\System\dbPbjCp.exe
  C:\Windows\System\dbPbjCp.exe
  2⤵
  PID:3944
- C:\Windows\System\ooYAIfT.exe
  C:\Windows\System\ooYAIfT.exe
  2⤵
  PID:3984
- C:\Windows\System\vdOtxdV.exe
  C:\Windows\System\vdOtxdV.exe
  2⤵
  PID:1864
- C:\Windows\System\IQuwOBF.exe
  C:\Windows\System\IQuwOBF.exe
  2⤵
  PID:3848
- C:\Windows\System\PfHSQbW.exe
  C:\Windows\System\PfHSQbW.exe
  2⤵
  PID:2608
- C:\Windows\System\iglGIXv.exe
  C:\Windows\System\iglGIXv.exe
  2⤵
  PID:3932
- C:\Windows\System\UmWJXle.exe
  C:\Windows\System\UmWJXle.exe
  2⤵
  PID:3616
- C:\Windows\System\zVzrZMv.exe
  C:\Windows\System\zVzrZMv.exe
  2⤵
  PID:2708
- C:\Windows\System\cCRIetU.exe
  C:\Windows\System\cCRIetU.exe
  2⤵
  PID:3472
- C:\Windows\System\lihqqEX.exe
  C:\Windows\System\lihqqEX.exe
  2⤵
  PID:3400
- C:\Windows\System\XlQjfGu.exe
  C:\Windows\System\XlQjfGu.exe
  2⤵
  PID:3768
- C:\Windows\System\mkeGscp.exe
  C:\Windows\System\mkeGscp.exe
  2⤵
  PID:3924
- C:\Windows\System\leEIQJH.exe
  C:\Windows\System\leEIQJH.exe
  2⤵
  PID:556
- C:\Windows\System\sOwZVwx.exe
  C:\Windows\System\sOwZVwx.exe
  2⤵
  PID:380
- C:\Windows\System\ZRsnnhy.exe
  C:\Windows\System\ZRsnnhy.exe
  2⤵
  PID:2208
- C:\Windows\System\tGtYDvt.exe
  C:\Windows\System\tGtYDvt.exe
  2⤵
  PID:3184
- C:\Windows\System\rOKHSNd.exe
  C:\Windows\System\rOKHSNd.exe
  2⤵
  PID:4020
- C:\Windows\System\vHSZVQw.exe
  C:\Windows\System\vHSZVQw.exe
  2⤵
  PID:3624
- C:\Windows\System\rSVCOIY.exe
  C:\Windows\System\rSVCOIY.exe
  2⤵
  PID:3108
- C:\Windows\System\anzoIuV.exe
  C:\Windows\System\anzoIuV.exe
  2⤵
  PID:3360
- C:\Windows\System\tQzpvhD.exe
  C:\Windows\System\tQzpvhD.exe
  2⤵
  PID:3724
- C:\Windows\System\EoEqSJv.exe
  C:\Windows\System\EoEqSJv.exe
  2⤵
  PID:3180
- C:\Windows\System\qZLFYcG.exe
  C:\Windows\System\qZLFYcG.exe
  2⤵
  PID:3276
- C:\Windows\System\ohkeUGw.exe
  C:\Windows\System\ohkeUGw.exe
  2⤵
  PID:3528
- C:\Windows\System\JNLCCwe.exe
  C:\Windows\System\JNLCCwe.exe
  2⤵
  PID:4072
- C:\Windows\System\ScwKLfe.exe
  C:\Windows\System\ScwKLfe.exe
  2⤵
  PID:3296
- C:\Windows\System\vJPfead.exe
  C:\Windows\System\vJPfead.exe
  2⤵
  PID:3588
- C:\Windows\System\dAZVLUV.exe
  C:\Windows\System\dAZVLUV.exe
  2⤵
  PID:2664
- C:\Windows\System\MXMoFCq.exe
  C:\Windows\System\MXMoFCq.exe
  2⤵
  PID:3168
- C:\Windows\System\GGEaAlR.exe
  C:\Windows\System\GGEaAlR.exe
  2⤵
  PID:3080
- C:\Windows\System\iQqKILc.exe
  C:\Windows\System\iQqKILc.exe
  2⤵
  PID:3888
- C:\Windows\System\iLsYpnn.exe
  C:\Windows\System\iLsYpnn.exe
  2⤵
  PID:4108
- C:\Windows\System\nXxKWlZ.exe
  C:\Windows\System\nXxKWlZ.exe
  2⤵
  PID:4128
- C:\Windows\System\mjnwuRp.exe
  C:\Windows\System\mjnwuRp.exe
  2⤵
  PID:4144
- C:\Windows\System\cUhQbpH.exe
  C:\Windows\System\cUhQbpH.exe
  2⤵
  PID:4168
- C:\Windows\System\AoPMToJ.exe
  C:\Windows\System\AoPMToJ.exe
  2⤵
  PID:4184
- C:\Windows\System\HbUdTsX.exe
  C:\Windows\System\HbUdTsX.exe
  2⤵
  PID:4204
- C:\Windows\System\kUYHQfK.exe
  C:\Windows\System\kUYHQfK.exe
  2⤵
  PID:4228
- C:\Windows\System\qQgCuvz.exe
  C:\Windows\System\qQgCuvz.exe
  2⤵
  PID:4244
- C:\Windows\System\PgAZnoK.exe
  C:\Windows\System\PgAZnoK.exe
  2⤵
  PID:4264
- C:\Windows\System\SoijyGp.exe
  C:\Windows\System\SoijyGp.exe
  2⤵
  PID:4308
- C:\Windows\System\QNXfHHK.exe
  C:\Windows\System\QNXfHHK.exe
  2⤵
  PID:4324
- C:\Windows\System\amhzWra.exe
  C:\Windows\System\amhzWra.exe
  2⤵
  PID:4340
- C:\Windows\System\MgRtcLC.exe
  C:\Windows\System\MgRtcLC.exe
  2⤵
  PID:4356
- C:\Windows\System\TINGHsF.exe
  C:\Windows\System\TINGHsF.exe
  2⤵
  PID:4372
- C:\Windows\System\uookijZ.exe
  C:\Windows\System\uookijZ.exe
  2⤵
  PID:4388
- C:\Windows\System\IUiNxxx.exe
  C:\Windows\System\IUiNxxx.exe
  2⤵
  PID:4404
- C:\Windows\System\JaKakas.exe
  C:\Windows\System\JaKakas.exe
  2⤵
  PID:4420
- C:\Windows\System\kzvtWDk.exe
  C:\Windows\System\kzvtWDk.exe
  2⤵
  PID:4456
- C:\Windows\System\UkphdBy.exe
  C:\Windows\System\UkphdBy.exe
  2⤵
  PID:4472
- C:\Windows\System\JTPCqPF.exe
  C:\Windows\System\JTPCqPF.exe
  2⤵
  PID:4488
- C:\Windows\System\GNvDOgh.exe
  C:\Windows\System\GNvDOgh.exe
  2⤵
  PID:4504
- C:\Windows\System\NBPVfIL.exe
  C:\Windows\System\NBPVfIL.exe
  2⤵
  PID:4520
- C:\Windows\System\RBZXbHv.exe
  C:\Windows\System\RBZXbHv.exe
  2⤵
  PID:4536
- C:\Windows\System\WMwuLlD.exe
  C:\Windows\System\WMwuLlD.exe
  2⤵
  PID:4552
- C:\Windows\System\wLcCJCX.exe
  C:\Windows\System\wLcCJCX.exe
  2⤵
  PID:4568
- C:\Windows\System\RbkzvLv.exe
  C:\Windows\System\RbkzvLv.exe
  2⤵
  PID:4584
- C:\Windows\System\zHBMMHw.exe
  C:\Windows\System\zHBMMHw.exe
  2⤵
  PID:4600
- C:\Windows\System\uaDWYjV.exe
  C:\Windows\System\uaDWYjV.exe
  2⤵
  PID:4624
- C:\Windows\System\uhHPTax.exe
  C:\Windows\System\uhHPTax.exe
  2⤵
  PID:4640
- C:\Windows\System\xvCApHN.exe
  C:\Windows\System\xvCApHN.exe
  2⤵
  PID:4676
- C:\Windows\System\XIiNoan.exe
  C:\Windows\System\XIiNoan.exe
  2⤵
  PID:4696
- C:\Windows\System\NsgjLac.exe
  C:\Windows\System\NsgjLac.exe
  2⤵
  PID:4712
- C:\Windows\System\eNoEBtS.exe
  C:\Windows\System\eNoEBtS.exe
  2⤵
  PID:4732
- C:\Windows\System\bHOxLXN.exe
  C:\Windows\System\bHOxLXN.exe
  2⤵
  PID:4780
- C:\Windows\System\NSlMqOt.exe
  C:\Windows\System\NSlMqOt.exe
  2⤵
  PID:4800
- C:\Windows\System\pimQCWe.exe
  C:\Windows\System\pimQCWe.exe
  2⤵
  PID:4816
- C:\Windows\System\NgMHhFD.exe
  C:\Windows\System\NgMHhFD.exe
  2⤵
  PID:4836
- C:\Windows\System\YJjqGqr.exe
  C:\Windows\System\YJjqGqr.exe
  2⤵
  PID:4852
- C:\Windows\System\ThAZQXz.exe
  C:\Windows\System\ThAZQXz.exe
  2⤵
  PID:4868
- C:\Windows\System\msfRkKR.exe
  C:\Windows\System\msfRkKR.exe
  2⤵
  PID:4884
- C:\Windows\System\xeASssB.exe
  C:\Windows\System\xeASssB.exe
  2⤵
  PID:4900
- C:\Windows\System\aCaboDm.exe
  C:\Windows\System\aCaboDm.exe
  2⤵
  PID:4920
- C:\Windows\System\zXDjkAS.exe
  C:\Windows\System\zXDjkAS.exe
  2⤵
  PID:4940
- C:\Windows\System\QZfbFUf.exe
  C:\Windows\System\QZfbFUf.exe
  2⤵
  PID:4956
- C:\Windows\System\HIaoNgK.exe
  C:\Windows\System\HIaoNgK.exe
  2⤵
  PID:4976
- C:\Windows\System\WGRccLG.exe
  C:\Windows\System\WGRccLG.exe
  2⤵
  PID:4992
- C:\Windows\System\ldozjau.exe
  C:\Windows\System\ldozjau.exe
  2⤵
  PID:5012
- C:\Windows\System\upXdamM.exe
  C:\Windows\System\upXdamM.exe
  2⤵
  PID:5032
- C:\Windows\System\jOTwoIL.exe
  C:\Windows\System\jOTwoIL.exe
  2⤵
  PID:5056
- C:\Windows\System\kmoWFqB.exe
  C:\Windows\System\kmoWFqB.exe
  2⤵
  PID:5072
- C:\Windows\System\cQphMMB.exe
  C:\Windows\System\cQphMMB.exe
  2⤵
  PID:5092
- C:\Windows\System\FpCemdz.exe
  C:\Windows\System\FpCemdz.exe
  2⤵
  PID:5112
- C:\Windows\System\RIHzEGi.exe
  C:\Windows\System\RIHzEGi.exe
  2⤵
  PID:4192
- C:\Windows\System\Pxixfxw.exe
  C:\Windows\System\Pxixfxw.exe
  2⤵
  PID:4236
- C:\Windows\System\oBMsOjv.exe
  C:\Windows\System\oBMsOjv.exe
  2⤵
  PID:4280
- C:\Windows\System\aQovcBq.exe
  C:\Windows\System\aQovcBq.exe
  2⤵
  PID:4136
- C:\Windows\System\UqNsmtz.exe
  C:\Windows\System\UqNsmtz.exe
  2⤵
  PID:3956
- C:\Windows\System\usNTUMe.exe
  C:\Windows\System\usNTUMe.exe
  2⤵
  PID:3532
- C:\Windows\System\noiNUMi.exe
  C:\Windows\System\noiNUMi.exe
  2⤵
  PID:4060
- C:\Windows\System\KlTzPSb.exe
  C:\Windows\System\KlTzPSb.exe
  2⤵
  PID:4260
- C:\Windows\System\ZZFxTly.exe
  C:\Windows\System\ZZFxTly.exe
  2⤵
  PID:4292
- C:\Windows\System\snVxNfp.exe
  C:\Windows\System\snVxNfp.exe
  2⤵
  PID:4216
- C:\Windows\System\UkzKIAs.exe
  C:\Windows\System\UkzKIAs.exe
  2⤵
  PID:4332
- C:\Windows\System\YoLlkCd.exe
  C:\Windows\System\YoLlkCd.exe
  2⤵
  PID:4364
- C:\Windows\System\nUOGGAr.exe
  C:\Windows\System\nUOGGAr.exe
  2⤵
  PID:4428
- C:\Windows\System\ULlxNkb.exe
  C:\Windows\System\ULlxNkb.exe
  2⤵
  PID:4444
- C:\Windows\System\ZZROAVB.exe
  C:\Windows\System\ZZROAVB.exe
  2⤵
  PID:4484
- C:\Windows\System\fKJLOwR.exe
  C:\Windows\System\fKJLOwR.exe
  2⤵
  PID:4320
- C:\Windows\System\uIUaoUb.exe
  C:\Windows\System\uIUaoUb.exe
  2⤵
  PID:4672
- C:\Windows\System\VNAOfAe.exe
  C:\Windows\System\VNAOfAe.exe
  2⤵
  PID:4412
- C:\Windows\System\JnyTYap.exe
  C:\Windows\System\JnyTYap.exe
  2⤵
  PID:4464
- C:\Windows\System\SGugSxs.exe
  C:\Windows\System\SGugSxs.exe
  2⤵
  PID:4744
- C:\Windows\System\cvuCaDL.exe
  C:\Windows\System\cvuCaDL.exe
  2⤵
  PID:4496
- C:\Windows\System\RjSJpYM.exe
  C:\Windows\System\RjSJpYM.exe
  2⤵
  PID:4772
- C:\Windows\System\GNTyGzZ.exe
  C:\Windows\System\GNTyGzZ.exe
  2⤵
  PID:4812
- C:\Windows\System\etLxQQO.exe
  C:\Windows\System\etLxQQO.exe
  2⤵
  PID:4564
- C:\Windows\System\sgfQcxh.exe
  C:\Windows\System\sgfQcxh.exe
  2⤵
  PID:4844
- C:\Windows\System\PKsVExT.exe
  C:\Windows\System\PKsVExT.exe
  2⤵
  PID:4880
- C:\Windows\System\UKDmnDT.exe
  C:\Windows\System\UKDmnDT.exe
  2⤵
  PID:4984
- C:\Windows\System\KnYbhWG.exe
  C:\Windows\System\KnYbhWG.exe
  2⤵
  PID:4724
- C:\Windows\System\IjDTzJU.exe
  C:\Windows\System\IjDTzJU.exe
  2⤵
  PID:5040
- C:\Windows\System\fRGHXpq.exe
  C:\Windows\System\fRGHXpq.exe
  2⤵
  PID:4828
- C:\Windows\System\jWRvfUo.exe
  C:\Windows\System\jWRvfUo.exe
  2⤵
  PID:5108
- C:\Windows\System\kWgLmFJ.exe
  C:\Windows\System\kWgLmFJ.exe
  2⤵
  PID:4972
- C:\Windows\System\ZJeGgfq.exe
  C:\Windows\System\ZJeGgfq.exe
  2⤵
  PID:5044
- C:\Windows\System\wGhdtNJ.exe
  C:\Windows\System\wGhdtNJ.exe
  2⤵
  PID:4860
- C:\Windows\System\ZECoDML.exe
  C:\Windows\System\ZECoDML.exe
  2⤵
  PID:4076
- C:\Windows\System\wQeFSgP.exe
  C:\Windows\System\wQeFSgP.exe
  2⤵
  PID:4252
- C:\Windows\System\rRSgHnE.exe
  C:\Windows\System\rRSgHnE.exe
  2⤵
  PID:4140
- C:\Windows\System\XEYAdmu.exe
  C:\Windows\System\XEYAdmu.exe
  2⤵
  PID:3948
- C:\Windows\System\NXKvDEQ.exe
  C:\Windows\System\NXKvDEQ.exe
  2⤵
  PID:3156
- C:\Windows\System\xYVMBmh.exe
  C:\Windows\System\xYVMBmh.exe
  2⤵
  PID:4436
- C:\Windows\System\cfkBWgw.exe
  C:\Windows\System\cfkBWgw.exe
  2⤵
  PID:4576
- C:\Windows\System\IpkLhzz.exe
  C:\Windows\System\IpkLhzz.exe
  2⤵
  PID:4040
- C:\Windows\System\jZRiePY.exe
  C:\Windows\System\jZRiePY.exe
  2⤵
  PID:4400
- C:\Windows\System\sHMuxFw.exe
  C:\Windows\System\sHMuxFw.exe
  2⤵
  PID:4316
- C:\Windows\System\AyuKpLj.exe
  C:\Windows\System\AyuKpLj.exe
  2⤵
  PID:4164
- C:\Windows\System\rIbCFIU.exe
  C:\Windows\System\rIbCFIU.exe
  2⤵
  PID:4352
- C:\Windows\System\bqUsDQI.exe
  C:\Windows\System\bqUsDQI.exe
  2⤵
  PID:4480
- C:\Windows\System\pomAXmN.exe
  C:\Windows\System\pomAXmN.exe
  2⤵
  PID:4656
- C:\Windows\System\riMtHNl.exe
  C:\Windows\System\riMtHNl.exe
  2⤵
  PID:4768
- C:\Windows\System\jnSbgyn.exe
  C:\Windows\System\jnSbgyn.exe
  2⤵
  PID:4912
- C:\Windows\System\fWcENUY.exe
  C:\Windows\System\fWcENUY.exe
  2⤵
  PID:5028
- C:\Windows\System\hTWBgaA.exe
  C:\Windows\System\hTWBgaA.exe
  2⤵
  PID:4932
- C:\Windows\System\QzgaLHs.exe
  C:\Windows\System\QzgaLHs.exe
  2⤵
  PID:4936
- C:\Windows\System\loCtcqF.exe
  C:\Windows\System\loCtcqF.exe
  2⤵
  PID:4788
- C:\Windows\System\ujKiAbt.exe
  C:\Windows\System\ujKiAbt.exe
  2⤵
  PID:5088
- C:\Windows\System\AyfwoHS.exe
  C:\Windows\System\AyfwoHS.exe
  2⤵
  PID:2636
- C:\Windows\System\WFtVdZP.exe
  C:\Windows\System\WFtVdZP.exe
  2⤵
  PID:4612
- C:\Windows\System\mmOdpEf.exe
  C:\Windows\System\mmOdpEf.exe
  2⤵
  PID:4648
- C:\Windows\System\prLVumo.exe
  C:\Windows\System\prLVumo.exe
  2⤵
  PID:4632
- C:\Windows\System\MyYnzOJ.exe
  C:\Windows\System\MyYnzOJ.exe
  2⤵
  PID:4796
- C:\Windows\System\PXIWpAM.exe
  C:\Windows\System\PXIWpAM.exe
  2⤵
  PID:4760
- C:\Windows\System\VWJpBGY.exe
  C:\Windows\System\VWJpBGY.exe
  2⤵
  PID:4212
- C:\Windows\System\KHlcRNd.exe
  C:\Windows\System\KHlcRNd.exe
  2⤵
  PID:5008
- C:\Windows\System\hgmMEsH.exe
  C:\Windows\System\hgmMEsH.exe
  2⤵
  PID:5068
- C:\Windows\System\IzdOLRu.exe
  C:\Windows\System\IzdOLRu.exe
  2⤵
  PID:4224
- C:\Windows\System\gmExrfL.exe
  C:\Windows\System\gmExrfL.exe
  2⤵
  PID:4124
- C:\Windows\System\XenYWbh.exe
  C:\Windows\System\XenYWbh.exe
  2⤵
  PID:4156
- C:\Windows\System\DVKIiKs.exe
  C:\Windows\System\DVKIiKs.exe
  2⤵
  PID:4528
- C:\Windows\System\KmRcAKD.exe
  C:\Windows\System\KmRcAKD.exe
  2⤵
  PID:4688
- C:\Windows\System\lUJIkPh.exe
  C:\Windows\System\lUJIkPh.exe
  2⤵
  PID:4468
- C:\Windows\System\dudTwlF.exe
  C:\Windows\System\dudTwlF.exe
  2⤵
  PID:4104
- C:\Windows\System\puehlgS.exe
  C:\Windows\System\puehlgS.exe
  2⤵
  PID:4384
- C:\Windows\System\WofLOpv.exe
  C:\Windows\System\WofLOpv.exe
  2⤵
  PID:4180
- C:\Windows\System\LklvFWX.exe
  C:\Windows\System\LklvFWX.exe
  2⤵
  PID:4620
- C:\Windows\System\VldMZSi.exe
  C:\Windows\System\VldMZSi.exe
  2⤵
  PID:4708
- C:\Windows\System\ruDDadB.exe
  C:\Windows\System\ruDDadB.exe
  2⤵
  PID:4808
- C:\Windows\System\aCIcsTZ.exe
  C:\Windows\System\aCIcsTZ.exe
  2⤵
  PID:4516
- C:\Windows\System\amXUXqw.exe
  C:\Windows\System\amXUXqw.exe
  2⤵
  PID:5004
- C:\Windows\System\NuproWB.exe
  C:\Windows\System\NuproWB.exe
  2⤵
  PID:4592
- C:\Windows\System\ZsgAJIc.exe
  C:\Windows\System\ZsgAJIc.exe
  2⤵
  PID:4968
- C:\Windows\System\YxmTiYs.exe
  C:\Windows\System\YxmTiYs.exe
  2⤵
  PID:4916
- C:\Windows\System\hzTXDqO.exe
  C:\Windows\System\hzTXDqO.exe
  2⤵
  PID:4752
- C:\Windows\System\ACGpeHx.exe
  C:\Windows\System\ACGpeHx.exe
  2⤵
  PID:4272
- C:\Windows\System\DXGtZYU.exe
  C:\Windows\System\DXGtZYU.exe
  2⤵
  PID:3836
- C:\Windows\System\HBgAiAB.exe
  C:\Windows\System\HBgAiAB.exe
  2⤵
  PID:5140
- C:\Windows\System\gcYmevF.exe
  C:\Windows\System\gcYmevF.exe
  2⤵
  PID:5160
- C:\Windows\System\VsJpTjf.exe
  C:\Windows\System\VsJpTjf.exe
  2⤵
  PID:5176
- C:\Windows\System\BYcZHrj.exe
  C:\Windows\System\BYcZHrj.exe
  2⤵
  PID:5196
- C:\Windows\System\ROOegMU.exe
  C:\Windows\System\ROOegMU.exe
  2⤵
  PID:5216
- C:\Windows\System\aRXFVoC.exe
  C:\Windows\System\aRXFVoC.exe
  2⤵
  PID:5232
- C:\Windows\System\gEiJAQd.exe
  C:\Windows\System\gEiJAQd.exe
  2⤵
  PID:5252
- C:\Windows\System\QbjonST.exe
  C:\Windows\System\QbjonST.exe
  2⤵
  PID:5268
- C:\Windows\System\hTctTdV.exe
  C:\Windows\System\hTctTdV.exe
  2⤵
  PID:5284
- C:\Windows\System\jVrrPML.exe
  C:\Windows\System\jVrrPML.exe
  2⤵
  PID:5304
- C:\Windows\System\zLWMbnH.exe
  C:\Windows\System\zLWMbnH.exe
  2⤵
  PID:5320
- C:\Windows\System\pBZRhOu.exe
  C:\Windows\System\pBZRhOu.exe
  2⤵
  PID:5344
- C:\Windows\System\BHPktHX.exe
  C:\Windows\System\BHPktHX.exe
  2⤵
  PID:5364
- C:\Windows\System\jTjuEAV.exe
  C:\Windows\System\jTjuEAV.exe
  2⤵
  PID:5380
- C:\Windows\System\qbDuHcX.exe
  C:\Windows\System\qbDuHcX.exe
  2⤵
  PID:5396
- C:\Windows\System\beNEAnU.exe
  C:\Windows\System\beNEAnU.exe
  2⤵
  PID:5416
- C:\Windows\System\ZcIqmjn.exe
  C:\Windows\System\ZcIqmjn.exe
  2⤵
  PID:5436
- C:\Windows\System\SYjobKR.exe
  C:\Windows\System\SYjobKR.exe
  2⤵
  PID:5456
- C:\Windows\System\wkIJgdT.exe
  C:\Windows\System\wkIJgdT.exe
  2⤵
  PID:5476
- C:\Windows\System\uTCwLDP.exe
  C:\Windows\System\uTCwLDP.exe
  2⤵
  PID:5492
- C:\Windows\System\PrHlkDf.exe
  C:\Windows\System\PrHlkDf.exe
  2⤵
  PID:5508
- C:\Windows\System\BbfHtpb.exe
  C:\Windows\System\BbfHtpb.exe
  2⤵
  PID:5536
- C:\Windows\System\NfjFxBC.exe
  C:\Windows\System\NfjFxBC.exe
  2⤵
  PID:5556
- C:\Windows\System\DcuQdMP.exe
  C:\Windows\System\DcuQdMP.exe
  2⤵
  PID:5572
- C:\Windows\System\NAbpBLm.exe
  C:\Windows\System\NAbpBLm.exe
  2⤵
  PID:5588
- C:\Windows\System\rgZDaQn.exe
  C:\Windows\System\rgZDaQn.exe
  2⤵
  PID:5604
- C:\Windows\System\pYBiaXK.exe
  C:\Windows\System\pYBiaXK.exe
  2⤵
  PID:5624
- C:\Windows\System\taRyxHK.exe
  C:\Windows\System\taRyxHK.exe
  2⤵
  PID:5640
- C:\Windows\System\ubxOPya.exe
  C:\Windows\System\ubxOPya.exe
  2⤵
  PID:5660
- C:\Windows\System\Ahqubdo.exe
  C:\Windows\System\Ahqubdo.exe
  2⤵
  PID:5676
- C:\Windows\System\ZrykOcj.exe
  C:\Windows\System\ZrykOcj.exe
  2⤵
  PID:5696
- C:\Windows\System\IpqzWnO.exe
  C:\Windows\System\IpqzWnO.exe
  2⤵
  PID:5720
- C:\Windows\System\vXYGbDp.exe
  C:\Windows\System\vXYGbDp.exe
  2⤵
  PID:5740
- C:\Windows\System\JVfpPEy.exe
  C:\Windows\System\JVfpPEy.exe
  2⤵
  PID:5760
- C:\Windows\System\NdipXYH.exe
  C:\Windows\System\NdipXYH.exe
  2⤵
  PID:5776
- C:\Windows\System\eTCebly.exe
  C:\Windows\System\eTCebly.exe
  2⤵
  PID:5796
- C:\Windows\System\ZcBhcWw.exe
  C:\Windows\System\ZcBhcWw.exe
  2⤵
  PID:5816
- C:\Windows\System\kauALmR.exe
  C:\Windows\System\kauALmR.exe
  2⤵
  PID:5836
- C:\Windows\System\POSJRAv.exe
  C:\Windows\System\POSJRAv.exe
  2⤵
  PID:5860
- C:\Windows\System\fCOzOWR.exe
  C:\Windows\System\fCOzOWR.exe
  2⤵
  PID:5876
- C:\Windows\System\tIoJktK.exe
  C:\Windows\System\tIoJktK.exe
  2⤵
  PID:5900
- C:\Windows\System\wjmnFXn.exe
  C:\Windows\System\wjmnFXn.exe
  2⤵
  PID:5976
- C:\Windows\System\sNreJCN.exe
  C:\Windows\System\sNreJCN.exe
  2⤵
  PID:5992
- C:\Windows\System\kXjCeRl.exe
  C:\Windows\System\kXjCeRl.exe
  2⤵
  PID:6016
- C:\Windows\System\YcJzFEz.exe
  C:\Windows\System\YcJzFEz.exe
  2⤵
  PID:6032
- C:\Windows\System\YLqucAP.exe
  C:\Windows\System\YLqucAP.exe
  2⤵
  PID:6052
- C:\Windows\System\EbJwzuh.exe
  C:\Windows\System\EbJwzuh.exe
  2⤵
  PID:6072
- C:\Windows\System\tAiUDvf.exe
  C:\Windows\System\tAiUDvf.exe
  2⤵
  PID:6092
- C:\Windows\System\XfpqANI.exe
  C:\Windows\System\XfpqANI.exe
  2⤵
  PID:6112
- C:\Windows\System\nLSMuHT.exe
  C:\Windows\System\nLSMuHT.exe
  2⤵
  PID:6132
- C:\Windows\System\YfyoSaR.exe
  C:\Windows\System\YfyoSaR.exe
  2⤵
  PID:5148
- C:\Windows\System\ZnhLQYT.exe
  C:\Windows\System\ZnhLQYT.exe
  2⤵
  PID:5188
- C:\Windows\System\DFXRbWr.exe
  C:\Windows\System\DFXRbWr.exe
  2⤵
  PID:5264
- C:\Windows\System\EsRFiPB.exe
  C:\Windows\System\EsRFiPB.exe
  2⤵
  PID:5332
- C:\Windows\System\pPPDTWx.exe
  C:\Windows\System\pPPDTWx.exe
  2⤵
  PID:4500
- C:\Windows\System\fCTAgBs.exe
  C:\Windows\System\fCTAgBs.exe
  2⤵
  PID:5484
- C:\Windows\System\xMFcTsl.exe
  C:\Windows\System\xMFcTsl.exe
  2⤵
  PID:5524
- C:\Windows\System\QOGGnRV.exe
  C:\Windows\System\QOGGnRV.exe
  2⤵
  PID:5568
- C:\Windows\System\GRvHmfN.exe
  C:\Windows\System\GRvHmfN.exe
  2⤵
  PID:5632
- C:\Windows\System\ZOAKSrp.exe
  C:\Windows\System\ZOAKSrp.exe
  2⤵
  PID:5716
- C:\Windows\System\Toesslu.exe
  C:\Windows\System\Toesslu.exe
  2⤵
  PID:5752
- C:\Windows\System\cpyikao.exe
  C:\Windows\System\cpyikao.exe
  2⤵
  PID:5824
- C:\Windows\System\OpvUUZz.exe
  C:\Windows\System\OpvUUZz.exe
  2⤵
  PID:5908
- C:\Windows\System\sSXJWrZ.exe
  C:\Windows\System\sSXJWrZ.exe
  2⤵
  PID:5916
- C:\Windows\System\tUqAeMZ.exe
  C:\Windows\System\tUqAeMZ.exe
  2⤵
  PID:5940
- C:\Windows\System\InQDWWb.exe
  C:\Windows\System\InQDWWb.exe
  2⤵
  PID:5648
- C:\Windows\System\ZZxsnPF.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes