xmrig | 384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d

Analysis

max time kernel
144s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
Size

1.6MB
MD5

bfc09abab2232e38e633ab440ff978f5
SHA1

5a6b236286d4724ec400b3e03d2fbb96daf080a9
SHA256

384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d
SHA512

a610e6ca2431c0b157128214b9d8c54a543476f50521c43a9c18dcf449a0bb54d788e535002b0a4aa1cfcd0396e89656bb306642a7bd8420536d63409510446c
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOYgDpHBxg:GemTLkNdfE0pZyG

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000400000001e432-3.dat	xmrig
behavioral2/files/0x000a000000023b97-7.dat	xmrig
behavioral2/files/0x000c000000023b8e-8.dat	xmrig
behavioral2/files/0x000a000000023b99-17.dat	xmrig
behavioral2/files/0x000a000000023b9c-29.dat	xmrig
behavioral2/files/0x000a000000023b9a-30.dat	xmrig
behavioral2/files/0x000a000000023b9b-34.dat	xmrig
behavioral2/files/0x000a000000023b9d-39.dat	xmrig
behavioral2/files/0x000a000000023ba0-54.dat	xmrig
behavioral2/files/0x000a000000023ba1-57.dat	xmrig
behavioral2/files/0x000a000000023ba3-66.dat	xmrig
behavioral2/files/0x000a000000023ba2-67.dat	xmrig
behavioral2/files/0x000a000000023b9e-51.dat	xmrig
behavioral2/files/0x000a000000023b9f-50.dat	xmrig
behavioral2/files/0x000d000000023ad1-85.dat	xmrig
behavioral2/files/0x000e000000023ad5-89.dat	xmrig
behavioral2/files/0x000f000000023ab0-80.dat	xmrig
behavioral2/files/0x000a000000023ba4-75.dat	xmrig
behavioral2/files/0x000a000000023ad6-92.dat	xmrig
behavioral2/files/0x000a000000023ba5-102.dat	xmrig
behavioral2/files/0x000a000000023ba7-114.dat	xmrig
behavioral2/files/0x000a000000023ba8-117.dat	xmrig
behavioral2/files/0x000b000000023baa-122.dat	xmrig
behavioral2/files/0x0008000000023bc3-146.dat	xmrig
behavioral2/files/0x0009000000023bc9-157.dat	xmrig
behavioral2/files/0x0008000000023bd0-170.dat	xmrig
behavioral2/files/0x000e000000023bce-166.dat	xmrig
behavioral2/files/0x0009000000023bca-162.dat	xmrig
behavioral2/files/0x000e000000023bba-156.dat	xmrig
behavioral2/files/0x000b000000023bab-151.dat	xmrig
behavioral2/files/0x0009000000023bc8-150.dat	xmrig
behavioral2/files/0x000a000000023bb3-135.dat	xmrig
behavioral2/files/0x000b000000023ba9-137.dat	xmrig
behavioral2/files/0x000b000000023b94-118.dat	xmrig
behavioral2/files/0x000a000000023ba6-108.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
844	hbXPRiv.exe
4348	PhAupcU.exe
4784	LIbWTCu.exe
3648	HaLAWXl.exe
4004	PohnmzW.exe
5064	tHEVXwd.exe
2684	itqjFQj.exe
3492	DYhFJcB.exe
5040	OaxklSM.exe
3188	MyXbJTp.exe
1836	wtpGedn.exe
1220	JFRcGxy.exe
220	aIKSmNP.exe
3852	jkgwhtH.exe
3444	GuIIkNm.exe
2896	BKpjcse.exe
4788	dbqSDEh.exe
820	ExcBDze.exe
2360	lKoejDG.exe
1944	eoLgTPY.exe
1408	nMhKTPw.exe
4848	gvKUPmG.exe
4712	gJucRqT.exe
4720	nGrvopt.exe
4268	VsqTPIn.exe
2768	bdZMImB.exe
4012	SUovqWX.exe
1464	IqvhLuy.exe
748	PEcYjMs.exe
4520	vOclvSn.exe
3464	ZmRRxIN.exe
2384	edkZXiZ.exe
1076	UIhvZrD.exe
4036	QdwmwDX.exe
1344	pQTDOfm.exe
3640	YLAECqt.exe
1832	vKYmgds.exe
1560	UzwjZkF.exe
1784	AmNdpGp.exe
3380	oXmSEDU.exe
4660	LmEPVsa.exe
2264	oiydKUn.exe
4772	Sylpbru.exe
4360	fTZUiWu.exe
5072	OAXQpQy.exe
3840	dzVsnuI.exe
1272	qfdUJNP.exe
1924	joBrHRk.exe
3080	udKoHox.exe
2416	RjUepTK.exe
4708	ciVyvis.exe
4824	eEoGfuF.exe
1752	TzAYgTm.exe
2928	TXRndBS.exe
1732	XIoiSVm.exe
3200	oQjSjiJ.exe
4292	UOBUWAi.exe
3920	vgQPrRn.exe
3076	wxmABVY.exe
5036	SprzeGU.exe
4228	bjdvaHL.exe
5080	jpjBVgk.exe
3944	unEWPGa.exe
1264	YnfpNOc.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\joBrHRk.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\uyrsWvI.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\aVnPrVO.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\eGFBlIf.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\HvJTPIa.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\kVfrJRA.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\usmRKkD.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\trufLcN.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\dPLBlIF.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\gdNjNaA.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\vKYmgds.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\GwjQgBY.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\ffsIVkY.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\mqzxovB.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\kqefabR.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\zaozHnG.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\UtVYuls.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\vOoQUiG.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\mtXrIdO.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\EzwfrJR.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\OBksOaG.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\mzQCJDD.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\rzQEDSr.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\JlLixFE.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\xuAzVZC.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\jSlnnua.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\SWycCQF.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\NOsHkvw.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\yUEHOws.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\MFXZpjP.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\PnnYBSx.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\PSUqIOm.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\OKumrIo.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\VJPrZie.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\FBWFbhq.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\IgHLFnf.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\IAlxRap.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\AiWNNIU.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\ZJkFqho.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\epjHdIv.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\rnUOzUf.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\hbXPRiv.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\wjgOloj.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\KbzIcJl.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\GOERdyc.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\wWAcAPZ.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\PSacbnA.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\VKKPMly.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\ftnKzvR.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\KezJIis.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\CTOMHzk.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\LLfGxAw.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\BXCUEvu.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\xszPPrB.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\AhubcRk.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\rKFiVhT.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\iZoMgkP.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\HNDrSTe.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\idsDgXK.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\Mqgallx.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\PZpDiml.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\AthAiLa.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\wryNvjP.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
File created	C:\Windows\System\TNtkJnu.exe	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17124	dwm.exe
Token: SeChangeNotifyPrivilege	17124	dwm.exe
Token: 33	17124	dwm.exe
Token: SeIncBasePriorityPrivilege	17124	dwm.exe
Token: SeShutdownPrivilege	17124	dwm.exe
Token: SeCreatePagefilePrivilege	17124	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 844	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	84
PID 1552 wrote to memory of 844	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	84
PID 1552 wrote to memory of 4348	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	85
PID 1552 wrote to memory of 4348	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	85
PID 1552 wrote to memory of 4784	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	86
PID 1552 wrote to memory of 4784	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	86
PID 1552 wrote to memory of 3648	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	87
PID 1552 wrote to memory of 3648	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	87
PID 1552 wrote to memory of 4004	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	88
PID 1552 wrote to memory of 4004	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	88
PID 1552 wrote to memory of 5064	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	89
PID 1552 wrote to memory of 5064	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	89
PID 1552 wrote to memory of 2684	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	90
PID 1552 wrote to memory of 2684	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	90
PID 1552 wrote to memory of 3492	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	93
PID 1552 wrote to memory of 3492	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	93
PID 1552 wrote to memory of 3188	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	94
PID 1552 wrote to memory of 3188	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	94
PID 1552 wrote to memory of 5040	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	95
PID 1552 wrote to memory of 5040	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	95
PID 1552 wrote to memory of 1836	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	96
PID 1552 wrote to memory of 1836	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	96
PID 1552 wrote to memory of 1220	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	98
PID 1552 wrote to memory of 1220	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	98
PID 1552 wrote to memory of 220	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	99
PID 1552 wrote to memory of 220	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	99
PID 1552 wrote to memory of 3852	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	100
PID 1552 wrote to memory of 3852	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	100
PID 1552 wrote to memory of 3444	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	101
PID 1552 wrote to memory of 3444	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	101
PID 1552 wrote to memory of 2896	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	102
PID 1552 wrote to memory of 2896	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	102
PID 1552 wrote to memory of 4788	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	103
PID 1552 wrote to memory of 4788	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	103
PID 1552 wrote to memory of 820	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	104
PID 1552 wrote to memory of 820	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	104
PID 1552 wrote to memory of 2360	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	105
PID 1552 wrote to memory of 2360	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	105
PID 1552 wrote to memory of 1944	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	106
PID 1552 wrote to memory of 1944	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	106
PID 1552 wrote to memory of 1408	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	107
PID 1552 wrote to memory of 1408	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	107
PID 1552 wrote to memory of 4848	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	108
PID 1552 wrote to memory of 4848	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	108
PID 1552 wrote to memory of 4712	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	109
PID 1552 wrote to memory of 4712	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	109
PID 1552 wrote to memory of 4720	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	110
PID 1552 wrote to memory of 4720	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	110
PID 1552 wrote to memory of 4268	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	111
PID 1552 wrote to memory of 4268	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	111
PID 1552 wrote to memory of 2768	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	112
PID 1552 wrote to memory of 2768	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	112
PID 1552 wrote to memory of 4012	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	113
PID 1552 wrote to memory of 4012	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	113
PID 1552 wrote to memory of 1464	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	114
PID 1552 wrote to memory of 1464	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	114
PID 1552 wrote to memory of 748	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	115
PID 1552 wrote to memory of 748	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	115
PID 1552 wrote to memory of 4520	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	116
PID 1552 wrote to memory of 4520	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	116
PID 1552 wrote to memory of 3464	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	117
PID 1552 wrote to memory of 3464	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	117
PID 1552 wrote to memory of 2384	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	118
PID 1552 wrote to memory of 2384	1552	384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe	118

C:\Users\Admin\AppData\Local\Temp\384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe
"C:\Users\Admin\AppData\Local\Temp\384a18e3fe0dd2f24780b947c6a7ebdc1cc70270a4febf14b02970dcfd46973d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\System\hbXPRiv.exe
  C:\Windows\System\hbXPRiv.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\PhAupcU.exe
  C:\Windows\System\PhAupcU.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\LIbWTCu.exe
  C:\Windows\System\LIbWTCu.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\HaLAWXl.exe
  C:\Windows\System\HaLAWXl.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\PohnmzW.exe
  C:\Windows\System\PohnmzW.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\tHEVXwd.exe
  C:\Windows\System\tHEVXwd.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\itqjFQj.exe
  C:\Windows\System\itqjFQj.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\DYhFJcB.exe
  C:\Windows\System\DYhFJcB.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\MyXbJTp.exe
  C:\Windows\System\MyXbJTp.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\OaxklSM.exe
  C:\Windows\System\OaxklSM.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\wtpGedn.exe
  C:\Windows\System\wtpGedn.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\JFRcGxy.exe
  C:\Windows\System\JFRcGxy.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\aIKSmNP.exe
  C:\Windows\System\aIKSmNP.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\jkgwhtH.exe
  C:\Windows\System\jkgwhtH.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\GuIIkNm.exe
  C:\Windows\System\GuIIkNm.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\BKpjcse.exe
  C:\Windows\System\BKpjcse.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\dbqSDEh.exe
  C:\Windows\System\dbqSDEh.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\ExcBDze.exe
  C:\Windows\System\ExcBDze.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\lKoejDG.exe
  C:\Windows\System\lKoejDG.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\eoLgTPY.exe
  C:\Windows\System\eoLgTPY.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\nMhKTPw.exe
  C:\Windows\System\nMhKTPw.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\gvKUPmG.exe
  C:\Windows\System\gvKUPmG.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\gJucRqT.exe
  C:\Windows\System\gJucRqT.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\nGrvopt.exe
  C:\Windows\System\nGrvopt.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\VsqTPIn.exe
  C:\Windows\System\VsqTPIn.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\bdZMImB.exe
  C:\Windows\System\bdZMImB.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\SUovqWX.exe
  C:\Windows\System\SUovqWX.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\IqvhLuy.exe
  C:\Windows\System\IqvhLuy.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\PEcYjMs.exe
  C:\Windows\System\PEcYjMs.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\vOclvSn.exe
  C:\Windows\System\vOclvSn.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\ZmRRxIN.exe
  C:\Windows\System\ZmRRxIN.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\edkZXiZ.exe
  C:\Windows\System\edkZXiZ.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\UIhvZrD.exe
  C:\Windows\System\UIhvZrD.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\QdwmwDX.exe
  C:\Windows\System\QdwmwDX.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\pQTDOfm.exe
  C:\Windows\System\pQTDOfm.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\YLAECqt.exe
  C:\Windows\System\YLAECqt.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\vKYmgds.exe
  C:\Windows\System\vKYmgds.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\UzwjZkF.exe
  C:\Windows\System\UzwjZkF.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\AmNdpGp.exe
  C:\Windows\System\AmNdpGp.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\oXmSEDU.exe
  C:\Windows\System\oXmSEDU.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\LmEPVsa.exe
  C:\Windows\System\LmEPVsa.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\oiydKUn.exe
  C:\Windows\System\oiydKUn.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\Sylpbru.exe
  C:\Windows\System\Sylpbru.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\fTZUiWu.exe
  C:\Windows\System\fTZUiWu.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\OAXQpQy.exe
  C:\Windows\System\OAXQpQy.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\dzVsnuI.exe
  C:\Windows\System\dzVsnuI.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\qfdUJNP.exe
  C:\Windows\System\qfdUJNP.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\joBrHRk.exe
  C:\Windows\System\joBrHRk.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\udKoHox.exe
  C:\Windows\System\udKoHox.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\RjUepTK.exe
  C:\Windows\System\RjUepTK.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\ciVyvis.exe
  C:\Windows\System\ciVyvis.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\eEoGfuF.exe
  C:\Windows\System\eEoGfuF.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\TzAYgTm.exe
  C:\Windows\System\TzAYgTm.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\TXRndBS.exe
  C:\Windows\System\TXRndBS.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\XIoiSVm.exe
  C:\Windows\System\XIoiSVm.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\oQjSjiJ.exe
  C:\Windows\System\oQjSjiJ.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\UOBUWAi.exe
  C:\Windows\System\UOBUWAi.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\vgQPrRn.exe
  C:\Windows\System\vgQPrRn.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\wxmABVY.exe
  C:\Windows\System\wxmABVY.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\SprzeGU.exe
  C:\Windows\System\SprzeGU.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\bjdvaHL.exe
  C:\Windows\System\bjdvaHL.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\jpjBVgk.exe
  C:\Windows\System\jpjBVgk.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\unEWPGa.exe
  C:\Windows\System\unEWPGa.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\YnfpNOc.exe
  C:\Windows\System\YnfpNOc.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\fkcDayk.exe
  C:\Windows\System\fkcDayk.exe
  2⤵
  PID:3600
- C:\Windows\System\rrwhrdl.exe
  C:\Windows\System\rrwhrdl.exe
  2⤵
  PID:2584
- C:\Windows\System\ZOAcxgp.exe
  C:\Windows\System\ZOAcxgp.exe
  2⤵
  PID:4100
- C:\Windows\System\kDWsPwW.exe
  C:\Windows\System\kDWsPwW.exe
  2⤵
  PID:4608
- C:\Windows\System\AiWNNIU.exe
  C:\Windows\System\AiWNNIU.exe
  2⤵
  PID:1696
- C:\Windows\System\VtzJBSK.exe
  C:\Windows\System\VtzJBSK.exe
  2⤵
  PID:1908
- C:\Windows\System\crEdCNL.exe
  C:\Windows\System\crEdCNL.exe
  2⤵
  PID:3216
- C:\Windows\System\wjgOloj.exe
  C:\Windows\System\wjgOloj.exe
  2⤵
  PID:2472
- C:\Windows\System\PNMETkE.exe
  C:\Windows\System\PNMETkE.exe
  2⤵
  PID:1628
- C:\Windows\System\PtYofqN.exe
  C:\Windows\System\PtYofqN.exe
  2⤵
  PID:2232
- C:\Windows\System\idsDgXK.exe
  C:\Windows\System\idsDgXK.exe
  2⤵
  PID:4644
- C:\Windows\System\neFCnYx.exe
  C:\Windows\System\neFCnYx.exe
  2⤵
  PID:4344
- C:\Windows\System\jDYmkeL.exe
  C:\Windows\System\jDYmkeL.exe
  2⤵
  PID:4472
- C:\Windows\System\oWYdoOC.exe
  C:\Windows\System\oWYdoOC.exe
  2⤵
  PID:872
- C:\Windows\System\vpGuTxS.exe
  C:\Windows\System\vpGuTxS.exe
  2⤵
  PID:3796
- C:\Windows\System\dJDhXLp.exe
  C:\Windows\System\dJDhXLp.exe
  2⤵
  PID:1692
- C:\Windows\System\vLtnXgn.exe
  C:\Windows\System\vLtnXgn.exe
  2⤵
  PID:2068
- C:\Windows\System\ajWKeYK.exe
  C:\Windows\System\ajWKeYK.exe
  2⤵
  PID:3152
- C:\Windows\System\TKAfAnn.exe
  C:\Windows\System\TKAfAnn.exe
  2⤵
  PID:2248
- C:\Windows\System\GHXKAVw.exe
  C:\Windows\System\GHXKAVw.exe
  2⤵
  PID:5052
- C:\Windows\System\ihLMavo.exe
  C:\Windows\System\ihLMavo.exe
  2⤵
  PID:4696
- C:\Windows\System\kooEAAo.exe
  C:\Windows\System\kooEAAo.exe
  2⤵
  PID:720
- C:\Windows\System\zzEkZwx.exe
  C:\Windows\System\zzEkZwx.exe
  2⤵
  PID:3208
- C:\Windows\System\zIfZdaX.exe
  C:\Windows\System\zIfZdaX.exe
  2⤵
  PID:2064
- C:\Windows\System\mMsFZlA.exe
  C:\Windows\System\mMsFZlA.exe
  2⤵
  PID:752
- C:\Windows\System\UomusCK.exe
  C:\Windows\System\UomusCK.exe
  2⤵
  PID:4448
- C:\Windows\System\YlFaaxx.exe
  C:\Windows\System\YlFaaxx.exe
  2⤵
  PID:2376
- C:\Windows\System\MkeRYyn.exe
  C:\Windows\System\MkeRYyn.exe
  2⤵
  PID:4528
- C:\Windows\System\bHAQPED.exe
  C:\Windows\System\bHAQPED.exe
  2⤵
  PID:1084
- C:\Windows\System\ZZGblgM.exe
  C:\Windows\System\ZZGblgM.exe
  2⤵
  PID:2392
- C:\Windows\System\HvJTPIa.exe
  C:\Windows\System\HvJTPIa.exe
  2⤵
  PID:4048
- C:\Windows\System\TnSnqAP.exe
  C:\Windows\System\TnSnqAP.exe
  2⤵
  PID:3928
- C:\Windows\System\cWJSxck.exe
  C:\Windows\System\cWJSxck.exe
  2⤵
  PID:632
- C:\Windows\System\jAZBmmJ.exe
  C:\Windows\System\jAZBmmJ.exe
  2⤵
  PID:116
- C:\Windows\System\STNZIDu.exe
  C:\Windows\System\STNZIDu.exe
  2⤵
  PID:4776
- C:\Windows\System\klaDxMa.exe
  C:\Windows\System\klaDxMa.exe
  2⤵
  PID:1372
- C:\Windows\System\mwUmaqJ.exe
  C:\Windows\System\mwUmaqJ.exe
  2⤵
  PID:4912
- C:\Windows\System\SVSyvDy.exe
  C:\Windows\System\SVSyvDy.exe
  2⤵
  PID:2736
- C:\Windows\System\imwozen.exe
  C:\Windows\System\imwozen.exe
  2⤵
  PID:3936
- C:\Windows\System\UfwjVKP.exe
  C:\Windows\System\UfwjVKP.exe
  2⤵
  PID:3344
- C:\Windows\System\okLNMTz.exe
  C:\Windows\System\okLNMTz.exe
  2⤵
  PID:5132
- C:\Windows\System\yEroakm.exe
  C:\Windows\System\yEroakm.exe
  2⤵
  PID:5152
- C:\Windows\System\CWmQjxz.exe
  C:\Windows\System\CWmQjxz.exe
  2⤵
  PID:5180
- C:\Windows\System\ufmXYgL.exe
  C:\Windows\System\ufmXYgL.exe
  2⤵
  PID:5216
- C:\Windows\System\CNKXEbq.exe
  C:\Windows\System\CNKXEbq.exe
  2⤵
  PID:5240
- C:\Windows\System\DplVnHE.exe
  C:\Windows\System\DplVnHE.exe
  2⤵
  PID:5268
- C:\Windows\System\SGupkSX.exe
  C:\Windows\System\SGupkSX.exe
  2⤵
  PID:5300
- C:\Windows\System\IKavQIS.exe
  C:\Windows\System\IKavQIS.exe
  2⤵
  PID:5320
- C:\Windows\System\WigHCpb.exe
  C:\Windows\System\WigHCpb.exe
  2⤵
  PID:5348
- C:\Windows\System\DeKSEeD.exe
  C:\Windows\System\DeKSEeD.exe
  2⤵
  PID:5380
- C:\Windows\System\uzFzYcy.exe
  C:\Windows\System\uzFzYcy.exe
  2⤵
  PID:5412
- C:\Windows\System\EiinMGR.exe
  C:\Windows\System\EiinMGR.exe
  2⤵
  PID:5432
- C:\Windows\System\YrfoWHh.exe
  C:\Windows\System\YrfoWHh.exe
  2⤵
  PID:5468
- C:\Windows\System\ygKbysI.exe
  C:\Windows\System\ygKbysI.exe
  2⤵
  PID:5492
- C:\Windows\System\jQLXYzy.exe
  C:\Windows\System\jQLXYzy.exe
  2⤵
  PID:5524
- C:\Windows\System\fcTwVNs.exe
  C:\Windows\System\fcTwVNs.exe
  2⤵
  PID:5548
- C:\Windows\System\aQvbpMN.exe
  C:\Windows\System\aQvbpMN.exe
  2⤵
  PID:5584
- C:\Windows\System\ieLotaX.exe
  C:\Windows\System\ieLotaX.exe
  2⤵
  PID:5600
- C:\Windows\System\Dhxhwtu.exe
  C:\Windows\System\Dhxhwtu.exe
  2⤵
  PID:5640
- C:\Windows\System\mFEjghL.exe
  C:\Windows\System\mFEjghL.exe
  2⤵
  PID:5656
- C:\Windows\System\LTJHKGP.exe
  C:\Windows\System\LTJHKGP.exe
  2⤵
  PID:5684
- C:\Windows\System\OCaoZyy.exe
  C:\Windows\System\OCaoZyy.exe
  2⤵
  PID:5712
- C:\Windows\System\epjHdIv.exe
  C:\Windows\System\epjHdIv.exe
  2⤵
  PID:5740
- C:\Windows\System\HoMIGcI.exe
  C:\Windows\System\HoMIGcI.exe
  2⤵
  PID:5768
- C:\Windows\System\pWDcGwJ.exe
  C:\Windows\System\pWDcGwJ.exe
  2⤵
  PID:5796
- C:\Windows\System\SkBQGys.exe
  C:\Windows\System\SkBQGys.exe
  2⤵
  PID:5824
- C:\Windows\System\NPxyEOm.exe
  C:\Windows\System\NPxyEOm.exe
  2⤵
  PID:5852
- C:\Windows\System\qFohmDj.exe
  C:\Windows\System\qFohmDj.exe
  2⤵
  PID:5880
- C:\Windows\System\pbwauKb.exe
  C:\Windows\System\pbwauKb.exe
  2⤵
  PID:5908
- C:\Windows\System\fvEfbzj.exe
  C:\Windows\System\fvEfbzj.exe
  2⤵
  PID:5936
- C:\Windows\System\rKFiVhT.exe
  C:\Windows\System\rKFiVhT.exe
  2⤵
  PID:5964
- C:\Windows\System\EEDOrBj.exe
  C:\Windows\System\EEDOrBj.exe
  2⤵
  PID:5992
- C:\Windows\System\oKQeUbn.exe
  C:\Windows\System\oKQeUbn.exe
  2⤵
  PID:6020
- C:\Windows\System\TCPIKiL.exe
  C:\Windows\System\TCPIKiL.exe
  2⤵
  PID:6048
- C:\Windows\System\TYMwyqu.exe
  C:\Windows\System\TYMwyqu.exe
  2⤵
  PID:6076
- C:\Windows\System\XknSTCM.exe
  C:\Windows\System\XknSTCM.exe
  2⤵
  PID:6104
- C:\Windows\System\LFHxvLw.exe
  C:\Windows\System\LFHxvLw.exe
  2⤵
  PID:6132
- C:\Windows\System\yCRjiDo.exe
  C:\Windows\System\yCRjiDo.exe
  2⤵
  PID:5164
- C:\Windows\System\usmRKkD.exe
  C:\Windows\System\usmRKkD.exe
  2⤵
  PID:5232
- C:\Windows\System\rLGGmeX.exe
  C:\Windows\System\rLGGmeX.exe
  2⤵
  PID:5308
- C:\Windows\System\aUzsGyJ.exe
  C:\Windows\System\aUzsGyJ.exe
  2⤵
  PID:5368
- C:\Windows\System\MvMlSBZ.exe
  C:\Windows\System\MvMlSBZ.exe
  2⤵
  PID:5428
- C:\Windows\System\AthAiLa.exe
  C:\Windows\System\AthAiLa.exe
  2⤵
  PID:5500
- C:\Windows\System\DudusGw.exe
  C:\Windows\System\DudusGw.exe
  2⤵
  PID:5564
- C:\Windows\System\QhJlDkm.exe
  C:\Windows\System\QhJlDkm.exe
  2⤵
  PID:5636
- C:\Windows\System\mtXrIdO.exe
  C:\Windows\System\mtXrIdO.exe
  2⤵
  PID:5696
- C:\Windows\System\bJIehVA.exe
  C:\Windows\System\bJIehVA.exe
  2⤵
  PID:5764
- C:\Windows\System\RhfDsXz.exe
  C:\Windows\System\RhfDsXz.exe
  2⤵
  PID:5820
- C:\Windows\System\UYLRyxe.exe
  C:\Windows\System\UYLRyxe.exe
  2⤵
  PID:5872
- C:\Windows\System\kKfIuYF.exe
  C:\Windows\System\kKfIuYF.exe
  2⤵
  PID:5956
- C:\Windows\System\FtiUzFG.exe
  C:\Windows\System\FtiUzFG.exe
  2⤵
  PID:6032
- C:\Windows\System\FWoucYY.exe
  C:\Windows\System\FWoucYY.exe
  2⤵
  PID:6096
- C:\Windows\System\qEfMHps.exe
  C:\Windows\System\qEfMHps.exe
  2⤵
  PID:2372
- C:\Windows\System\JUDnqmM.exe
  C:\Windows\System\JUDnqmM.exe
  2⤵
  PID:5288
- C:\Windows\System\NxLjYOg.exe
  C:\Windows\System\NxLjYOg.exe
  2⤵
  PID:5424
- C:\Windows\System\vnpARuH.exe
  C:\Windows\System\vnpARuH.exe
  2⤵
  PID:5556
- C:\Windows\System\OYjuxgd.exe
  C:\Windows\System\OYjuxgd.exe
  2⤵
  PID:5752
- C:\Windows\System\qOeMdCp.exe
  C:\Windows\System\qOeMdCp.exe
  2⤵
  PID:5928
- C:\Windows\System\uuqrnwQ.exe
  C:\Windows\System\uuqrnwQ.exe
  2⤵
  PID:6124
- C:\Windows\System\hzXrkdD.exe
  C:\Windows\System\hzXrkdD.exe
  2⤵
  PID:5396
- C:\Windows\System\AsLllgP.exe
  C:\Windows\System\AsLllgP.exe
  2⤵
  PID:5732
- C:\Windows\System\CjXXwFz.exe
  C:\Windows\System\CjXXwFz.exe
  2⤵
  PID:6068
- C:\Windows\System\xDeicue.exe
  C:\Windows\System\xDeicue.exe
  2⤵
  PID:5892
- C:\Windows\System\AOvIvto.exe
  C:\Windows\System\AOvIvto.exe
  2⤵
  PID:6148
- C:\Windows\System\tKgored.exe
  C:\Windows\System\tKgored.exe
  2⤵
  PID:6180
- C:\Windows\System\IBAuQJQ.exe
  C:\Windows\System\IBAuQJQ.exe
  2⤵
  PID:6208
- C:\Windows\System\VUgvcEq.exe
  C:\Windows\System\VUgvcEq.exe
  2⤵
  PID:6236
- C:\Windows\System\HzJQaNg.exe
  C:\Windows\System\HzJQaNg.exe
  2⤵
  PID:6264
- C:\Windows\System\WUoeLGZ.exe
  C:\Windows\System\WUoeLGZ.exe
  2⤵
  PID:6284
- C:\Windows\System\BaHArzZ.exe
  C:\Windows\System\BaHArzZ.exe
  2⤵
  PID:6312
- C:\Windows\System\fxRXbuk.exe
  C:\Windows\System\fxRXbuk.exe
  2⤵
  PID:6336
- C:\Windows\System\xPzSdcP.exe
  C:\Windows\System\xPzSdcP.exe
  2⤵
  PID:6360
- C:\Windows\System\EndLRgq.exe
  C:\Windows\System\EndLRgq.exe
  2⤵
  PID:6388
- C:\Windows\System\MEMOBiH.exe
  C:\Windows\System\MEMOBiH.exe
  2⤵
  PID:6408
- C:\Windows\System\CDiDDTS.exe
  C:\Windows\System\CDiDDTS.exe
  2⤵
  PID:6432
- C:\Windows\System\vqbirUt.exe
  C:\Windows\System\vqbirUt.exe
  2⤵
  PID:6460
- C:\Windows\System\QibXNYe.exe
  C:\Windows\System\QibXNYe.exe
  2⤵
  PID:6484
- C:\Windows\System\SGdYymK.exe
  C:\Windows\System\SGdYymK.exe
  2⤵
  PID:6520
- C:\Windows\System\XqUJgfu.exe
  C:\Windows\System\XqUJgfu.exe
  2⤵
  PID:6540
- C:\Windows\System\ZSntMIZ.exe
  C:\Windows\System\ZSntMIZ.exe
  2⤵
  PID:6568
- C:\Windows\System\wWAcAPZ.exe
  C:\Windows\System\wWAcAPZ.exe
  2⤵
  PID:6600
- C:\Windows\System\DUeEJMJ.exe
  C:\Windows\System\DUeEJMJ.exe
  2⤵
  PID:6624
- C:\Windows\System\eEwBPtG.exe
  C:\Windows\System\eEwBPtG.exe
  2⤵
  PID:6648
- C:\Windows\System\gyqdaqa.exe
  C:\Windows\System\gyqdaqa.exe
  2⤵
  PID:6680
- C:\Windows\System\dukrveJ.exe
  C:\Windows\System\dukrveJ.exe
  2⤵
  PID:6716
- C:\Windows\System\KwEwIHt.exe
  C:\Windows\System\KwEwIHt.exe
  2⤵
  PID:6736
- C:\Windows\System\ETIOefN.exe
  C:\Windows\System\ETIOefN.exe
  2⤵
  PID:6756
- C:\Windows\System\dbNnMDH.exe
  C:\Windows\System\dbNnMDH.exe
  2⤵
  PID:6776
- C:\Windows\System\RQYHBiy.exe
  C:\Windows\System\RQYHBiy.exe
  2⤵
  PID:6808
- C:\Windows\System\QLKPJQJ.exe
  C:\Windows\System\QLKPJQJ.exe
  2⤵
  PID:6848
- C:\Windows\System\xPTfDtV.exe
  C:\Windows\System\xPTfDtV.exe
  2⤵
  PID:6876
- C:\Windows\System\GwjQgBY.exe
  C:\Windows\System\GwjQgBY.exe
  2⤵
  PID:6900
- C:\Windows\System\trufLcN.exe
  C:\Windows\System\trufLcN.exe
  2⤵
  PID:6928
- C:\Windows\System\lCLfsag.exe
  C:\Windows\System\lCLfsag.exe
  2⤵
  PID:6964
- C:\Windows\System\iZoMgkP.exe
  C:\Windows\System\iZoMgkP.exe
  2⤵
  PID:6980
- C:\Windows\System\HhCrBna.exe
  C:\Windows\System\HhCrBna.exe
  2⤵
  PID:7012
- C:\Windows\System\SOnftUr.exe
  C:\Windows\System\SOnftUr.exe
  2⤵
  PID:7040
- C:\Windows\System\LGeErHE.exe
  C:\Windows\System\LGeErHE.exe
  2⤵
  PID:7068
- C:\Windows\System\fODQqtM.exe
  C:\Windows\System\fODQqtM.exe
  2⤵
  PID:7104
- C:\Windows\System\MrLAemT.exe
  C:\Windows\System\MrLAemT.exe
  2⤵
  PID:7132
- C:\Windows\System\KKqYYMk.exe
  C:\Windows\System\KKqYYMk.exe
  2⤵
  PID:7152
- C:\Windows\System\RygKCSq.exe
  C:\Windows\System\RygKCSq.exe
  2⤵
  PID:5360
- C:\Windows\System\ZPECLBD.exe
  C:\Windows\System\ZPECLBD.exe
  2⤵
  PID:6200
- C:\Windows\System\pfpDKKO.exe
  C:\Windows\System\pfpDKKO.exe
  2⤵
  PID:6256
- C:\Windows\System\PSacbnA.exe
  C:\Windows\System\PSacbnA.exe
  2⤵
  PID:6320
- C:\Windows\System\MOKBTwR.exe
  C:\Windows\System\MOKBTwR.exe
  2⤵
  PID:6404
- C:\Windows\System\ZqBoxwb.exe
  C:\Windows\System\ZqBoxwb.exe
  2⤵
  PID:6448
- C:\Windows\System\RWRTfOY.exe
  C:\Windows\System\RWRTfOY.exe
  2⤵
  PID:6508
- C:\Windows\System\OnnmhlW.exe
  C:\Windows\System\OnnmhlW.exe
  2⤵
  PID:6576
- C:\Windows\System\gPBTkEY.exe
  C:\Windows\System\gPBTkEY.exe
  2⤵
  PID:6640
- C:\Windows\System\YFCpLoe.exe
  C:\Windows\System\YFCpLoe.exe
  2⤵
  PID:6712
- C:\Windows\System\HNvMkll.exe
  C:\Windows\System\HNvMkll.exe
  2⤵
  PID:6804
- C:\Windows\System\bZFmyHn.exe
  C:\Windows\System\bZFmyHn.exe
  2⤵
  PID:6868
- C:\Windows\System\rzAeECi.exe
  C:\Windows\System\rzAeECi.exe
  2⤵
  PID:6936
- C:\Windows\System\JzcKNVh.exe
  C:\Windows\System\JzcKNVh.exe
  2⤵
  PID:7028
- C:\Windows\System\jgzVKxp.exe
  C:\Windows\System\jgzVKxp.exe
  2⤵
  PID:7060
- C:\Windows\System\gFjEVfj.exe
  C:\Windows\System\gFjEVfj.exe
  2⤵
  PID:7160
- C:\Windows\System\xxeYnNY.exe
  C:\Windows\System\xxeYnNY.exe
  2⤵
  PID:6304
- C:\Windows\System\pMDolDt.exe
  C:\Windows\System\pMDolDt.exe
  2⤵
  PID:6472
- C:\Windows\System\HOsRiFZ.exe
  C:\Windows\System\HOsRiFZ.exe
  2⤵
  PID:6660
- C:\Windows\System\EDbgEaf.exe
  C:\Windows\System\EDbgEaf.exe
  2⤵
  PID:6752
- C:\Windows\System\jvjaOaI.exe
  C:\Windows\System\jvjaOaI.exe
  2⤵
  PID:6732
- C:\Windows\System\ZPoEAit.exe
  C:\Windows\System\ZPoEAit.exe
  2⤵
  PID:6796
- C:\Windows\System\DSxBCsB.exe
  C:\Windows\System\DSxBCsB.exe
  2⤵
  PID:7084
- C:\Windows\System\KPrAJnY.exe
  C:\Windows\System\KPrAJnY.exe
  2⤵
  PID:6228
- C:\Windows\System\LydVVqU.exe
  C:\Windows\System\LydVVqU.exe
  2⤵
  PID:6384
- C:\Windows\System\GASYgYg.exe
  C:\Windows\System\GASYgYg.exe
  2⤵
  PID:6888
- C:\Windows\System\jsnQaFw.exe
  C:\Windows\System\jsnQaFw.exe
  2⤵
  PID:7196
- C:\Windows\System\rBzRpfu.exe
  C:\Windows\System\rBzRpfu.exe
  2⤵
  PID:7220
- C:\Windows\System\wUxrfOY.exe
  C:\Windows\System\wUxrfOY.exe
  2⤵
  PID:7256
- C:\Windows\System\XtFVbUs.exe
  C:\Windows\System\XtFVbUs.exe
  2⤵
  PID:7288
- C:\Windows\System\MQSqDcJ.exe
  C:\Windows\System\MQSqDcJ.exe
  2⤵
  PID:7320
- C:\Windows\System\FWbRkmF.exe
  C:\Windows\System\FWbRkmF.exe
  2⤵
  PID:7352
- C:\Windows\System\ZNzcZVp.exe
  C:\Windows\System\ZNzcZVp.exe
  2⤵
  PID:7376
- C:\Windows\System\JtirURs.exe
  C:\Windows\System\JtirURs.exe
  2⤵
  PID:7408
- C:\Windows\System\IvwBJgd.exe
  C:\Windows\System\IvwBJgd.exe
  2⤵
  PID:7428
- C:\Windows\System\fRnOSiY.exe
  C:\Windows\System\fRnOSiY.exe
  2⤵
  PID:7460
- C:\Windows\System\FdilbSZ.exe
  C:\Windows\System\FdilbSZ.exe
  2⤵
  PID:7492
- C:\Windows\System\uyrsWvI.exe
  C:\Windows\System\uyrsWvI.exe
  2⤵
  PID:7520
- C:\Windows\System\AuSKKNR.exe
  C:\Windows\System\AuSKKNR.exe
  2⤵
  PID:7560
- C:\Windows\System\jjfiuKt.exe
  C:\Windows\System\jjfiuKt.exe
  2⤵
  PID:7592
- C:\Windows\System\nUJfVag.exe
  C:\Windows\System\nUJfVag.exe
  2⤵
  PID:7612
- C:\Windows\System\NbzhYaP.exe
  C:\Windows\System\NbzhYaP.exe
  2⤵
  PID:7644
- C:\Windows\System\LLfGxAw.exe
  C:\Windows\System\LLfGxAw.exe
  2⤵
  PID:7672
- C:\Windows\System\oRDWNhZ.exe
  C:\Windows\System\oRDWNhZ.exe
  2⤵
  PID:7696
- C:\Windows\System\fciPGKh.exe
  C:\Windows\System\fciPGKh.exe
  2⤵
  PID:7716
- C:\Windows\System\PeEZMCg.exe
  C:\Windows\System\PeEZMCg.exe
  2⤵
  PID:7752
- C:\Windows\System\zLTZySJ.exe
  C:\Windows\System\zLTZySJ.exe
  2⤵
  PID:7772
- C:\Windows\System\bsAPRmp.exe
  C:\Windows\System\bsAPRmp.exe
  2⤵
  PID:7788
- C:\Windows\System\rOcuPOf.exe
  C:\Windows\System\rOcuPOf.exe
  2⤵
  PID:7808
- C:\Windows\System\eekyyty.exe
  C:\Windows\System\eekyyty.exe
  2⤵
  PID:7840
- C:\Windows\System\KOOCjCo.exe
  C:\Windows\System\KOOCjCo.exe
  2⤵
  PID:7872
- C:\Windows\System\PPjoQhA.exe
  C:\Windows\System\PPjoQhA.exe
  2⤵
  PID:7892
- C:\Windows\System\duTJqrt.exe
  C:\Windows\System\duTJqrt.exe
  2⤵
  PID:7912
- C:\Windows\System\oRRpwlb.exe
  C:\Windows\System\oRRpwlb.exe
  2⤵
  PID:7940
- C:\Windows\System\vXVdyqu.exe
  C:\Windows\System\vXVdyqu.exe
  2⤵
  PID:7964
- C:\Windows\System\TVMEivJ.exe
  C:\Windows\System\TVMEivJ.exe
  2⤵
  PID:7992
- C:\Windows\System\sxRMvtR.exe
  C:\Windows\System\sxRMvtR.exe
  2⤵
  PID:8020
- C:\Windows\System\bBBzhdM.exe
  C:\Windows\System\bBBzhdM.exe
  2⤵
  PID:8052
- C:\Windows\System\SXVXVFP.exe
  C:\Windows\System\SXVXVFP.exe
  2⤵
  PID:8084
- C:\Windows\System\FUHQcxr.exe
  C:\Windows\System\FUHQcxr.exe
  2⤵
  PID:8112
- C:\Windows\System\dRGjQRv.exe
  C:\Windows\System\dRGjQRv.exe
  2⤵
  PID:8132
- C:\Windows\System\zyfojRx.exe
  C:\Windows\System\zyfojRx.exe
  2⤵
  PID:8168
- C:\Windows\System\yORPcpa.exe
  C:\Windows\System\yORPcpa.exe
  2⤵
  PID:6692
- C:\Windows\System\RFEmBjC.exe
  C:\Windows\System\RFEmBjC.exe
  2⤵
  PID:7184
- C:\Windows\System\NvdLykB.exe
  C:\Windows\System\NvdLykB.exe
  2⤵
  PID:7280
- C:\Windows\System\CHANQVs.exe
  C:\Windows\System\CHANQVs.exe
  2⤵
  PID:7344
- C:\Windows\System\qmYIUPc.exe
  C:\Windows\System\qmYIUPc.exe
  2⤵
  PID:7436
- C:\Windows\System\UcwlROK.exe
  C:\Windows\System\UcwlROK.exe
  2⤵
  PID:7508
- C:\Windows\System\goUEpuY.exe
  C:\Windows\System\goUEpuY.exe
  2⤵
  PID:7572
- C:\Windows\System\ImKVlae.exe
  C:\Windows\System\ImKVlae.exe
  2⤵
  PID:7636
- C:\Windows\System\kOPaVQR.exe
  C:\Windows\System\kOPaVQR.exe
  2⤵
  PID:7692
- C:\Windows\System\iUdHAfI.exe
  C:\Windows\System\iUdHAfI.exe
  2⤵
  PID:7712
- C:\Windows\System\odFoidO.exe
  C:\Windows\System\odFoidO.exe
  2⤵
  PID:7832
- C:\Windows\System\Spbqkag.exe
  C:\Windows\System\Spbqkag.exe
  2⤵
  PID:7796
- C:\Windows\System\QEHlFft.exe
  C:\Windows\System\QEHlFft.exe
  2⤵
  PID:7884
- C:\Windows\System\fLdNVMN.exe
  C:\Windows\System\fLdNVMN.exe
  2⤵
  PID:8028
- C:\Windows\System\VKKPMly.exe
  C:\Windows\System\VKKPMly.exe
  2⤵
  PID:8064
- C:\Windows\System\gMNooHS.exe
  C:\Windows\System\gMNooHS.exe
  2⤵
  PID:8108
- C:\Windows\System\DktJNMK.exe
  C:\Windows\System\DktJNMK.exe
  2⤵
  PID:6828
- C:\Windows\System\hMvPPFs.exe
  C:\Windows\System\hMvPPFs.exe
  2⤵
  PID:7176
- C:\Windows\System\ftnKzvR.exe
  C:\Windows\System\ftnKzvR.exe
  2⤵
  PID:7456
- C:\Windows\System\ynqDJTj.exe
  C:\Windows\System\ynqDJTj.exe
  2⤵
  PID:7516
- C:\Windows\System\lDnWsRx.exe
  C:\Windows\System\lDnWsRx.exe
  2⤵
  PID:7760
- C:\Windows\System\gWRIpHY.exe
  C:\Windows\System\gWRIpHY.exe
  2⤵
  PID:7888
- C:\Windows\System\QzoYbLU.exe
  C:\Windows\System\QzoYbLU.exe
  2⤵
  PID:8096
- C:\Windows\System\oWiVhoc.exe
  C:\Windows\System\oWiVhoc.exe
  2⤵
  PID:7388
- C:\Windows\System\GKaIwiC.exe
  C:\Windows\System\GKaIwiC.exe
  2⤵
  PID:7404
- C:\Windows\System\yYDSuqH.exe
  C:\Windows\System\yYDSuqH.exe
  2⤵
  PID:7576
- C:\Windows\System\pSamoGG.exe
  C:\Windows\System\pSamoGG.exe
  2⤵
  PID:7656
- C:\Windows\System\HTQxDRG.exe
  C:\Windows\System\HTQxDRG.exe
  2⤵
  PID:8224
- C:\Windows\System\ocGHiea.exe
  C:\Windows\System\ocGHiea.exe
  2⤵
  PID:8244
- C:\Windows\System\HNNgeuo.exe
  C:\Windows\System\HNNgeuo.exe
  2⤵
  PID:8272
- C:\Windows\System\sOXBecS.exe
  C:\Windows\System\sOXBecS.exe
  2⤵
  PID:8304
- C:\Windows\System\bdHnGQH.exe
  C:\Windows\System\bdHnGQH.exe
  2⤵
  PID:8328
- C:\Windows\System\zpVafmW.exe
  C:\Windows\System\zpVafmW.exe
  2⤵
  PID:8360
- C:\Windows\System\DPuXuKs.exe
  C:\Windows\System\DPuXuKs.exe
  2⤵
  PID:8392
- C:\Windows\System\KYyyOCe.exe
  C:\Windows\System\KYyyOCe.exe
  2⤵
  PID:8428
- C:\Windows\System\BydEUOJ.exe
  C:\Windows\System\BydEUOJ.exe
  2⤵
  PID:8456
- C:\Windows\System\mVxzNFG.exe
  C:\Windows\System\mVxzNFG.exe
  2⤵
  PID:8492
- C:\Windows\System\PIwSbni.exe
  C:\Windows\System\PIwSbni.exe
  2⤵
  PID:8512
- C:\Windows\System\AEwQBYN.exe
  C:\Windows\System\AEwQBYN.exe
  2⤵
  PID:8540
- C:\Windows\System\SnMDTfI.exe
  C:\Windows\System\SnMDTfI.exe
  2⤵
  PID:8572
- C:\Windows\System\NXUgEFq.exe
  C:\Windows\System\NXUgEFq.exe
  2⤵
  PID:8600
- C:\Windows\System\NAbYrcz.exe
  C:\Windows\System\NAbYrcz.exe
  2⤵
  PID:8628
- C:\Windows\System\mrMvvxy.exe
  C:\Windows\System\mrMvvxy.exe
  2⤵
  PID:8656
- C:\Windows\System\kCVHfbf.exe
  C:\Windows\System\kCVHfbf.exe
  2⤵
  PID:8684
- C:\Windows\System\zrHTexZ.exe
  C:\Windows\System\zrHTexZ.exe
  2⤵
  PID:8712
- C:\Windows\System\VJfuSZs.exe
  C:\Windows\System\VJfuSZs.exe
  2⤵
  PID:8744
- C:\Windows\System\jmZOQdY.exe
  C:\Windows\System\jmZOQdY.exe
  2⤵
  PID:8768
- C:\Windows\System\gOfNRbo.exe
  C:\Windows\System\gOfNRbo.exe
  2⤵
  PID:8804
- C:\Windows\System\rIhSaFN.exe
  C:\Windows\System\rIhSaFN.exe
  2⤵
  PID:8824
- C:\Windows\System\MMoiwWc.exe
  C:\Windows\System\MMoiwWc.exe
  2⤵
  PID:8852
- C:\Windows\System\tumtQPW.exe
  C:\Windows\System\tumtQPW.exe
  2⤵
  PID:8880
- C:\Windows\System\aiSrxmc.exe
  C:\Windows\System\aiSrxmc.exe
  2⤵
  PID:8908
- C:\Windows\System\GenoIGk.exe
  C:\Windows\System\GenoIGk.exe
  2⤵
  PID:8944
- C:\Windows\System\dnlmhEd.exe
  C:\Windows\System\dnlmhEd.exe
  2⤵
  PID:8968
- C:\Windows\System\ZqVDIuC.exe
  C:\Windows\System\ZqVDIuC.exe
  2⤵
  PID:8996
- C:\Windows\System\tSXxSZj.exe
  C:\Windows\System\tSXxSZj.exe
  2⤵
  PID:9024
- C:\Windows\System\ZDUDXRv.exe
  C:\Windows\System\ZDUDXRv.exe
  2⤵
  PID:9040
- C:\Windows\System\NCmoRLL.exe
  C:\Windows\System\NCmoRLL.exe
  2⤵
  PID:9064
- C:\Windows\System\xNkPOFS.exe
  C:\Windows\System\xNkPOFS.exe
  2⤵
  PID:9080
- C:\Windows\System\ZJkFqho.exe
  C:\Windows\System\ZJkFqho.exe
  2⤵
  PID:9104
- C:\Windows\System\rFMWSQl.exe
  C:\Windows\System\rFMWSQl.exe
  2⤵
  PID:9140
- C:\Windows\System\dqVMvYu.exe
  C:\Windows\System\dqVMvYu.exe
  2⤵
  PID:9168
- C:\Windows\System\uehuWzw.exe
  C:\Windows\System\uehuWzw.exe
  2⤵
  PID:9204
- C:\Windows\System\hFmoRGf.exe
  C:\Windows\System\hFmoRGf.exe
  2⤵
  PID:7824
- C:\Windows\System\qatEOet.exe
  C:\Windows\System\qatEOet.exe
  2⤵
  PID:8256
- C:\Windows\System\KbzIcJl.exe
  C:\Windows\System\KbzIcJl.exe
  2⤵
  PID:8292
- C:\Windows\System\nghSxMw.exe
  C:\Windows\System\nghSxMw.exe
  2⤵
  PID:8340
- C:\Windows\System\wIaZEMd.exe
  C:\Windows\System\wIaZEMd.exe
  2⤵
  PID:8372
- C:\Windows\System\KTbwnQs.exe
  C:\Windows\System\KTbwnQs.exe
  2⤵
  PID:8440
- C:\Windows\System\XDQAZwd.exe
  C:\Windows\System\XDQAZwd.exe
  2⤵
  PID:8500
- C:\Windows\System\PkqrMet.exe
  C:\Windows\System\PkqrMet.exe
  2⤵
  PID:8584
- C:\Windows\System\jxzkTVP.exe
  C:\Windows\System\jxzkTVP.exe
  2⤵
  PID:8676
- C:\Windows\System\EzwfrJR.exe
  C:\Windows\System\EzwfrJR.exe
  2⤵
  PID:8760
- C:\Windows\System\ujLnXSV.exe
  C:\Windows\System\ujLnXSV.exe
  2⤵
  PID:8816
- C:\Windows\System\lwDAgeB.exe
  C:\Windows\System\lwDAgeB.exe
  2⤵
  PID:8864
- C:\Windows\System\ZVOxtrz.exe
  C:\Windows\System\ZVOxtrz.exe
  2⤵
  PID:8932
- C:\Windows\System\kVLBriE.exe
  C:\Windows\System\kVLBriE.exe
  2⤵
  PID:9020
- C:\Windows\System\xlPKMQT.exe
  C:\Windows\System\xlPKMQT.exe
  2⤵
  PID:9060
- C:\Windows\System\msjkwUj.exe
  C:\Windows\System\msjkwUj.exe
  2⤵
  PID:9132
- C:\Windows\System\PojuAgd.exe
  C:\Windows\System\PojuAgd.exe
  2⤵
  PID:7188
- C:\Windows\System\zApDOSE.exe
  C:\Windows\System\zApDOSE.exe
  2⤵
  PID:8324
- C:\Windows\System\KdzarQM.exe
  C:\Windows\System\KdzarQM.exe
  2⤵
  PID:8480
- C:\Windows\System\tXmuiAW.exe
  C:\Windows\System\tXmuiAW.exe
  2⤵
  PID:8420
- C:\Windows\System\RnjfHdh.exe
  C:\Windows\System\RnjfHdh.exe
  2⤵
  PID:8672
- C:\Windows\System\PXuObpc.exe
  C:\Windows\System\PXuObpc.exe
  2⤵
  PID:8928
- C:\Windows\System\xGSJOPq.exe
  C:\Windows\System\xGSJOPq.exe
  2⤵
  PID:9076
- C:\Windows\System\YdxGOdz.exe
  C:\Windows\System\YdxGOdz.exe
  2⤵
  PID:8404
- C:\Windows\System\tQoSAWw.exe
  C:\Windows\System\tQoSAWw.exe
  2⤵
  PID:8564
- C:\Windows\System\ympRErg.exe
  C:\Windows\System\ympRErg.exe
  2⤵
  PID:8920
- C:\Windows\System\pBQlYSU.exe
  C:\Windows\System\pBQlYSU.exe
  2⤵
  PID:8508
- C:\Windows\System\IqEDbQH.exe
  C:\Windows\System\IqEDbQH.exe
  2⤵
  PID:9212
- C:\Windows\System\CpMLSod.exe
  C:\Windows\System\CpMLSod.exe
  2⤵
  PID:9248
- C:\Windows\System\FKFHITV.exe
  C:\Windows\System\FKFHITV.exe
  2⤵
  PID:9276
- C:\Windows\System\oOwAiNu.exe
  C:\Windows\System\oOwAiNu.exe
  2⤵
  PID:9292
- C:\Windows\System\rnkBTqm.exe
  C:\Windows\System\rnkBTqm.exe
  2⤵
  PID:9308
- C:\Windows\System\gjFozJV.exe
  C:\Windows\System\gjFozJV.exe
  2⤵
  PID:9344
- C:\Windows\System\XHerxrP.exe
  C:\Windows\System\XHerxrP.exe
  2⤵
  PID:9372
- C:\Windows\System\cuJRxwJ.exe
  C:\Windows\System\cuJRxwJ.exe
  2⤵
  PID:9396
- C:\Windows\System\MnHeTdu.exe
  C:\Windows\System\MnHeTdu.exe
  2⤵
  PID:9420
- C:\Windows\System\BrWjgmO.exe
  C:\Windows\System\BrWjgmO.exe
  2⤵
  PID:9452
- C:\Windows\System\cGKBmLd.exe
  C:\Windows\System\cGKBmLd.exe
  2⤵
  PID:9480
- C:\Windows\System\YXbnCSp.exe
  C:\Windows\System\YXbnCSp.exe
  2⤵
  PID:9516
- C:\Windows\System\HeyXVdH.exe
  C:\Windows\System\HeyXVdH.exe
  2⤵
  PID:9544
- C:\Windows\System\kTVLdXm.exe
  C:\Windows\System\kTVLdXm.exe
  2⤵
  PID:9572
- C:\Windows\System\IgHLFnf.exe
  C:\Windows\System\IgHLFnf.exe
  2⤵
  PID:9604
- C:\Windows\System\iezilHC.exe
  C:\Windows\System\iezilHC.exe
  2⤵
  PID:9640
- C:\Windows\System\FmypNnh.exe
  C:\Windows\System\FmypNnh.exe
  2⤵
  PID:9668
- C:\Windows\System\IgFryfk.exe
  C:\Windows\System\IgFryfk.exe
  2⤵
  PID:9684
- C:\Windows\System\PFkfRLs.exe
  C:\Windows\System\PFkfRLs.exe
  2⤵
  PID:9700
- C:\Windows\System\LmiAaEg.exe
  C:\Windows\System\LmiAaEg.exe
  2⤵
  PID:9728
- C:\Windows\System\CMNREBM.exe
  C:\Windows\System\CMNREBM.exe
  2⤵
  PID:9764
- C:\Windows\System\IRrIYaG.exe
  C:\Windows\System\IRrIYaG.exe
  2⤵
  PID:9784
- C:\Windows\System\seapsbo.exe
  C:\Windows\System\seapsbo.exe
  2⤵
  PID:9808
- C:\Windows\System\ffsIVkY.exe
  C:\Windows\System\ffsIVkY.exe
  2⤵
  PID:9828
- C:\Windows\System\YVOysLh.exe
  C:\Windows\System\YVOysLh.exe
  2⤵
  PID:9844
- C:\Windows\System\jSlnnua.exe
  C:\Windows\System\jSlnnua.exe
  2⤵
  PID:9876
- C:\Windows\System\ZCsuVHt.exe
  C:\Windows\System\ZCsuVHt.exe
  2⤵
  PID:9900
- C:\Windows\System\oTIWGMn.exe
  C:\Windows\System\oTIWGMn.exe
  2⤵
  PID:9928
- C:\Windows\System\cCGMDWa.exe
  C:\Windows\System\cCGMDWa.exe
  2⤵
  PID:9960
- C:\Windows\System\GVdOiKQ.exe
  C:\Windows\System\GVdOiKQ.exe
  2⤵
  PID:9996
- C:\Windows\System\APWffTZ.exe
  C:\Windows\System\APWffTZ.exe
  2⤵
  PID:10020
- C:\Windows\System\SZAAqDz.exe
  C:\Windows\System\SZAAqDz.exe
  2⤵
  PID:10040
- C:\Windows\System\aBKbwBQ.exe
  C:\Windows\System\aBKbwBQ.exe
  2⤵
  PID:10068
- C:\Windows\System\YOJLmoF.exe
  C:\Windows\System\YOJLmoF.exe
  2⤵
  PID:10104
- C:\Windows\System\jZoNIIq.exe
  C:\Windows\System\jZoNIIq.exe
  2⤵
  PID:10136
- C:\Windows\System\jImZEJq.exe
  C:\Windows\System\jImZEJq.exe
  2⤵
  PID:10160
- C:\Windows\System\vitdqmH.exe
  C:\Windows\System\vitdqmH.exe
  2⤵
  PID:10196
- C:\Windows\System\PvKTUfc.exe
  C:\Windows\System\PvKTUfc.exe
  2⤵
  PID:10212
- C:\Windows\System\OGMCuGh.exe
  C:\Windows\System\OGMCuGh.exe
  2⤵
  PID:10236
- C:\Windows\System\bsyGrtH.exe
  C:\Windows\System\bsyGrtH.exe
  2⤵
  PID:9228
- C:\Windows\System\xSbDgLq.exe
  C:\Windows\System\xSbDgLq.exe
  2⤵
  PID:9300
- C:\Windows\System\bmKrjhd.exe
  C:\Windows\System\bmKrjhd.exe
  2⤵
  PID:9352
- C:\Windows\System\RzSkzyq.exe
  C:\Windows\System\RzSkzyq.exe
  2⤵
  PID:9436
- C:\Windows\System\eHacgpo.exe
  C:\Windows\System\eHacgpo.exe
  2⤵
  PID:9508
- C:\Windows\System\yvJFZek.exe
  C:\Windows\System\yvJFZek.exe
  2⤵
  PID:9556
- C:\Windows\System\JyIAZoK.exe
  C:\Windows\System\JyIAZoK.exe
  2⤵
  PID:9656
- C:\Windows\System\FBWFbhq.exe
  C:\Windows\System\FBWFbhq.exe
  2⤵
  PID:9720
- C:\Windows\System\phZvxBH.exe
  C:\Windows\System\phZvxBH.exe
  2⤵
  PID:9816
- C:\Windows\System\uoXZlxL.exe
  C:\Windows\System\uoXZlxL.exe
  2⤵
  PID:9836
- C:\Windows\System\CnihFCJ.exe
  C:\Windows\System\CnihFCJ.exe
  2⤵
  PID:9872
- C:\Windows\System\wEgZPGM.exe
  C:\Windows\System\wEgZPGM.exe
  2⤵
  PID:10012
- C:\Windows\System\bITUZCR.exe
  C:\Windows\System\bITUZCR.exe
  2⤵
  PID:10008
- C:\Windows\System\SlRpmkj.exe
  C:\Windows\System\SlRpmkj.exe
  2⤵
  PID:10056
- C:\Windows\System\cWhfhzL.exe
  C:\Windows\System\cWhfhzL.exe
  2⤵
  PID:8356
- C:\Windows\System\NcuPmvt.exe
  C:\Windows\System\NcuPmvt.exe
  2⤵
  PID:9304
- C:\Windows\System\ZxnhogF.exe
  C:\Windows\System\ZxnhogF.exe
  2⤵
  PID:9404
- C:\Windows\System\JZTosEu.exe
  C:\Windows\System\JZTosEu.exe
  2⤵
  PID:9772
- C:\Windows\System\AEpqNST.exe
  C:\Windows\System\AEpqNST.exe
  2⤵
  PID:9696
- C:\Windows\System\MqhufOc.exe
  C:\Windows\System\MqhufOc.exe
  2⤵
  PID:9796
- C:\Windows\System\bzAEqhI.exe
  C:\Windows\System\bzAEqhI.exe
  2⤵
  PID:10128
- C:\Windows\System\XlHfxXj.exe
  C:\Windows\System\XlHfxXj.exe
  2⤵
  PID:10148
- C:\Windows\System\SpuuQJr.exe
  C:\Windows\System\SpuuQJr.exe
  2⤵
  PID:10208
- C:\Windows\System\ozWQHay.exe
  C:\Windows\System\ozWQHay.exe
  2⤵
  PID:9536
- C:\Windows\System\oTMmXeb.exe
  C:\Windows\System\oTMmXeb.exe
  2⤵
  PID:8868
- C:\Windows\System\sXBysAR.exe
  C:\Windows\System\sXBysAR.exe
  2⤵
  PID:9968
- C:\Windows\System\FxOqTSX.exe
  C:\Windows\System\FxOqTSX.exe
  2⤵
  PID:10248
- C:\Windows\System\Bkhmyxn.exe
  C:\Windows\System\Bkhmyxn.exe
  2⤵
  PID:10264
- C:\Windows\System\uvaGRtU.exe
  C:\Windows\System\uvaGRtU.exe
  2⤵
  PID:10296
- C:\Windows\System\RWOyiqk.exe
  C:\Windows\System\RWOyiqk.exe
  2⤵
  PID:10320
- C:\Windows\System\joqNorJ.exe
  C:\Windows\System\joqNorJ.exe
  2⤵
  PID:10360
- C:\Windows\System\EKerAqB.exe
  C:\Windows\System\EKerAqB.exe
  2⤵
  PID:10384
- C:\Windows\System\kocaGZg.exe
  C:\Windows\System\kocaGZg.exe
  2⤵
  PID:10412
- C:\Windows\System\rINHLon.exe
  C:\Windows\System\rINHLon.exe
  2⤵
  PID:10436
- C:\Windows\System\LUtgKIX.exe
  C:\Windows\System\LUtgKIX.exe
  2⤵
  PID:10472
- C:\Windows\System\JJzbZda.exe
  C:\Windows\System\JJzbZda.exe
  2⤵
  PID:10508
- C:\Windows\System\OXUvRoI.exe
  C:\Windows\System\OXUvRoI.exe
  2⤵
  PID:10532
- C:\Windows\System\AGBVmQn.exe
  C:\Windows\System\AGBVmQn.exe
  2⤵
  PID:10560
- C:\Windows\System\pduucxz.exe
  C:\Windows\System\pduucxz.exe
  2⤵
  PID:10584
- C:\Windows\System\YucABsX.exe
  C:\Windows\System\YucABsX.exe
  2⤵
  PID:10608
- C:\Windows\System\WATMpzM.exe
  C:\Windows\System\WATMpzM.exe
  2⤵
  PID:10636
- C:\Windows\System\RuFNZTf.exe
  C:\Windows\System\RuFNZTf.exe
  2⤵
  PID:10660
- C:\Windows\System\IsDIDyY.exe
  C:\Windows\System\IsDIDyY.exe
  2⤵
  PID:10688
- C:\Windows\System\KqAzdlm.exe
  C:\Windows\System\KqAzdlm.exe
  2⤵
  PID:10712
- C:\Windows\System\qnoLJOU.exe
  C:\Windows\System\qnoLJOU.exe
  2⤵
  PID:10732
- C:\Windows\System\AMwPgFL.exe
  C:\Windows\System\AMwPgFL.exe
  2⤵
  PID:10760
- C:\Windows\System\DWLHAEb.exe
  C:\Windows\System\DWLHAEb.exe
  2⤵
  PID:10780
- C:\Windows\System\edliSTP.exe
  C:\Windows\System\edliSTP.exe
  2⤵
  PID:10816
- C:\Windows\System\KcwfmWb.exe
  C:\Windows\System\KcwfmWb.exe
  2⤵
  PID:10856
- C:\Windows\System\EaoFsin.exe
  C:\Windows\System\EaoFsin.exe
  2⤵
  PID:10884
- C:\Windows\System\VnrIdQY.exe
  C:\Windows\System\VnrIdQY.exe
  2⤵
  PID:10912
- C:\Windows\System\wQlEIQZ.exe
  C:\Windows\System\wQlEIQZ.exe
  2⤵
  PID:10940
- C:\Windows\System\dQuwpoV.exe
  C:\Windows\System\dQuwpoV.exe
  2⤵
  PID:10972
- C:\Windows\System\DczaYbH.exe
  C:\Windows\System\DczaYbH.exe
  2⤵
  PID:11004
- C:\Windows\System\fADCOEk.exe
  C:\Windows\System\fADCOEk.exe
  2⤵
  PID:11032
- C:\Windows\System\QRiAOgP.exe
  C:\Windows\System\QRiAOgP.exe
  2⤵
  PID:11060
- C:\Windows\System\WXKcwIx.exe
  C:\Windows\System\WXKcwIx.exe
  2⤵
  PID:11088
- C:\Windows\System\dvCVCia.exe
  C:\Windows\System\dvCVCia.exe
  2⤵
  PID:11120
- C:\Windows\System\ZMUwZld.exe
  C:\Windows\System\ZMUwZld.exe
  2⤵
  PID:11144
- C:\Windows\System\fDDsTgF.exe
  C:\Windows\System\fDDsTgF.exe
  2⤵
  PID:11172
- C:\Windows\System\ZcAzVRf.exe
  C:\Windows\System\ZcAzVRf.exe
  2⤵
  PID:11192
- C:\Windows\System\aZIfPJs.exe
  C:\Windows\System\aZIfPJs.exe
  2⤵
  PID:11220
- C:\Windows\System\kDyuMlr.exe
  C:\Windows\System\kDyuMlr.exe
  2⤵
  PID:11256
- C:\Windows\System\wbAiOts.exe
  C:\Windows\System\wbAiOts.exe
  2⤵
  PID:10260
- C:\Windows\System\njtPMBw.exe
  C:\Windows\System\njtPMBw.exe
  2⤵
  PID:10356
- C:\Windows\System\RMXpNgB.exe
  C:\Windows\System\RMXpNgB.exe
  2⤵
  PID:10344
- C:\Windows\System\bwcCRlS.exe
  C:\Windows\System\bwcCRlS.exe
  2⤵
  PID:10456
- C:\Windows\System\LGBLMYC.exe
  C:\Windows\System\LGBLMYC.exe
  2⤵
  PID:10504
- C:\Windows\System\rXeWWsm.exe
  C:\Windows\System\rXeWWsm.exe
  2⤵
  PID:10620
- C:\Windows\System\HNDrSTe.exe
  C:\Windows\System\HNDrSTe.exe
  2⤵
  PID:10648
- C:\Windows\System\thZjpfk.exe
  C:\Windows\System\thZjpfk.exe
  2⤵
  PID:10672
- C:\Windows\System\wryNvjP.exe
  C:\Windows\System\wryNvjP.exe
  2⤵
  PID:10756
- C:\Windows\System\PSbazdU.exe
  C:\Windows\System\PSbazdU.exe
  2⤵
  PID:10744
- C:\Windows\System\idWrNuO.exe
  C:\Windows\System\idWrNuO.exe
  2⤵
  PID:10892
- C:\Windows\System\fhJvEMs.exe
  C:\Windows\System\fhJvEMs.exe
  2⤵
  PID:10928
- C:\Windows\System\iTEVTOy.exe
  C:\Windows\System\iTEVTOy.exe
  2⤵
  PID:10968
- C:\Windows\System\TTJwaXH.exe
  C:\Windows\System\TTJwaXH.exe
  2⤵
  PID:11072
- C:\Windows\System\SYnZtFV.exe
  C:\Windows\System\SYnZtFV.exe
  2⤵
  PID:11116
- C:\Windows\System\ADDbgyC.exe
  C:\Windows\System\ADDbgyC.exe
  2⤵
  PID:11132
- C:\Windows\System\QhfRFyb.exe
  C:\Windows\System\QhfRFyb.exe
  2⤵
  PID:10244
- C:\Windows\System\swfLGgR.exe
  C:\Windows\System\swfLGgR.exe
  2⤵
  PID:10332
- C:\Windows\System\CMWgxGr.exe
  C:\Windows\System\CMWgxGr.exe
  2⤵
  PID:10556
- C:\Windows\System\gZCVehx.exe
  C:\Windows\System\gZCVehx.exe
  2⤵
  PID:10432
- C:\Windows\System\ALFJEgz.exe
  C:\Windows\System\ALFJEgz.exe
  2⤵
  PID:10844
- C:\Windows\System\GYFYOKa.exe
  C:\Windows\System\GYFYOKa.exe
  2⤵
  PID:11080
- C:\Windows\System\FFsoyqu.exe
  C:\Windows\System\FFsoyqu.exe
  2⤵
  PID:11152
- C:\Windows\System\hdoGQdo.exe
  C:\Windows\System\hdoGQdo.exe
  2⤵
  PID:10316
- C:\Windows\System\TwhgWYD.exe
  C:\Windows\System\TwhgWYD.exe
  2⤵
  PID:10776
- C:\Windows\System\CFMQgHQ.exe
  C:\Windows\System\CFMQgHQ.exe
  2⤵
  PID:10952
- C:\Windows\System\BhEPJnX.exe
  C:\Windows\System\BhEPJnX.exe
  2⤵
  PID:11276
- C:\Windows\System\GRzYcSu.exe
  C:\Windows\System\GRzYcSu.exe
  2⤵
  PID:11312
- C:\Windows\System\tEwQmAj.exe
  C:\Windows\System\tEwQmAj.exe
  2⤵
  PID:11344
- C:\Windows\System\RgKhgRy.exe
  C:\Windows\System\RgKhgRy.exe
  2⤵
  PID:11372
- C:\Windows\System\CMQGFJg.exe
  C:\Windows\System\CMQGFJg.exe
  2⤵
  PID:11404
- C:\Windows\System\dTQdLNf.exe
  C:\Windows\System\dTQdLNf.exe
  2⤵
  PID:11436
- C:\Windows\System\adfrtQL.exe
  C:\Windows\System\adfrtQL.exe
  2⤵
  PID:11496

Analysis

Sharing

General

Malware Config

Signatures

Processes