xmrig | 387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
Size

1.8MB
MD5

16382ad2f2e482239932e26b97d95526
SHA1

41dc04f1e25dc6fad00792769503c9c9a167b1a2
SHA256

387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5
SHA512

364833f3be0f265f823b7d26a7c405fc773ee6ca895b7b8fa312bfc7473e67147233cf018730cfa6929acdc205b4bc6ce8538ebe271ea6dd967cfcbed3667419
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQR:GemTLkNdfE0pZyu

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b40-4.dat	xmrig
behavioral2/files/0x000a000000023b9d-6.dat	xmrig
behavioral2/files/0x000b000000023b9c-7.dat	xmrig
behavioral2/files/0x000a000000023b9e-19.dat	xmrig
behavioral2/files/0x000a000000023b9f-32.dat	xmrig
behavioral2/files/0x000a000000023ba3-40.dat	xmrig
behavioral2/files/0x000a000000023ba8-66.dat	xmrig
behavioral2/files/0x000a000000023ba6-80.dat	xmrig
behavioral2/files/0x000a000000023ba5-78.dat	xmrig
behavioral2/files/0x000a000000023bb0-107.dat	xmrig
behavioral2/files/0x000a000000023bad-136.dat	xmrig
behavioral2/files/0x0009000000023bd3-161.dat	xmrig
behavioral2/files/0x0009000000023bd2-159.dat	xmrig
behavioral2/files/0x0009000000023bd1-157.dat	xmrig
behavioral2/files/0x0008000000023bcc-155.dat	xmrig
behavioral2/files/0x000e000000023bc3-153.dat	xmrig
behavioral2/files/0x000a000000023bb1-151.dat	xmrig
behavioral2/files/0x000a000000023bbc-149.dat	xmrig
behavioral2/files/0x000b000000023bb4-147.dat	xmrig
behavioral2/files/0x000e000000023bd7-144.dat	xmrig
behavioral2/files/0x000b000000023bb2-143.dat	xmrig
behavioral2/files/0x000a000000023bac-134.dat	xmrig
behavioral2/files/0x000a000000023baf-131.dat	xmrig
behavioral2/files/0x000b000000023bb3-124.dat	xmrig
behavioral2/files/0x000a000000023bab-121.dat	xmrig
behavioral2/files/0x000a000000023bae-118.dat	xmrig
behavioral2/files/0x000a000000023baa-115.dat	xmrig
behavioral2/files/0x000a000000023ba7-96.dat	xmrig
behavioral2/files/0x000a000000023ba9-89.dat	xmrig
behavioral2/files/0x000a000000023ba4-76.dat	xmrig
behavioral2/files/0x000a000000023ba1-51.dat	xmrig
behavioral2/files/0x000a000000023ba0-41.dat	xmrig
behavioral2/files/0x000a000000023ba2-34.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2448	RYLtkAC.exe
868	xgjBnjg.exe
3216	xdFKaqO.exe
3584	RUvlGGv.exe
2716	kBEFwpJ.exe
4012	BISZtqG.exe
1372	MLkowRA.exe
3412	FkrOWCa.exe
2840	bsboEst.exe
3516	JUkYRzz.exe
2796	eAfAbSW.exe
3384	uRhZtPM.exe
3376	lQUkKny.exe
4368	GWyRPcG.exe
2352	bGDgpXQ.exe
2036	OlEJAbd.exe
4128	uiBxIoe.exe
4280	HlPllrO.exe
4604	yLinYWH.exe
4492	IISHhpO.exe
4168	eTSeezA.exe
3176	ENVNWiJ.exe
5012	HvWblfZ.exe
3528	FoLgXfR.exe
1472	ubZYmmW.exe
2480	QGMSkRJ.exe
1368	SbLwtqO.exe
5036	HfIICcV.exe
2100	GskufCB.exe
1620	wHFNanS.exe
2260	guFyNaV.exe
1072	dRJrkGd.exe
1432	QlodFGJ.exe
3712	DUABhIj.exe
4248	WdjmbTO.exe
1064	MxVfvMD.exe
1976	bKHvUcd.exe
4164	AYzDUWk.exe
396	pLCKjoq.exe
3220	joeAnhK.exe
2560	mfDLaVJ.exe
3140	beyyjFI.exe
1696	yByOifb.exe
848	ueZUImp.exe
4432	rIxXMJj.exe
4644	uPPfTHD.exe
4904	BOVsaPm.exe
1796	zjVlXGW.exe
4092	nBugCJI.exe
3924	tUIReFR.exe
4984	IbgrhkA.exe
3648	frwSXTi.exe
4652	TDRDCmA.exe
4344	xXhblWH.exe
2964	RWAeXNV.exe
3200	csDfncA.exe
1176	ePqJedF.exe
3324	RnfzrEK.exe
3320	pBySWhq.exe
2816	BcedpnX.exe
1068	KCvKOSd.exe
1824	usfdTUz.exe
3316	ZFewcJa.exe
4024	vGeNQBn.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ImyjAhy.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\nwbXlYK.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\rDGJlcP.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\CCfFhiP.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\RGdlYUz.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\lwLuyUH.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\TlsfAQK.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\ePqJedF.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\KhwBKdH.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\mfaQAiX.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\OCdnfjU.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\DrAyKXC.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\ZqHxoKS.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\VHWKkzh.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\PbkxstL.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\QQONkQs.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\QdKiNJj.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\RWNWKPw.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\QGowaFw.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\NQBGPxA.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\jHtxnez.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\mopermx.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\qXEYvQi.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\ETHtzAD.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\DmYFZPk.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\jVbsaPs.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\bpVXJBX.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\KCvKOSd.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\mKiAgES.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\nQPNWBo.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\yGPqKHj.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\ulpFkte.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\mnCfWPx.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\yzNBKfV.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\SVMzvbs.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\pYvAsQU.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\yAPyeoD.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\gvXvzsY.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\CtraNfX.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\VwZzLQV.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\JxSXpjj.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\nlZJePQ.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\tDyQBDB.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\uJWWTBs.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\DjXRkto.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\ygPYmdu.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\WxsZarE.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\bVOYWkj.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\ADUxUbs.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\ENVNWiJ.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\XBAMIyX.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\WIQzQqi.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\UWAbDAE.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\bVkqBhl.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\zjVlXGW.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\NYrSfsR.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\gcIuRHq.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\Anivmar.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\xEHUmci.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\wHFNanS.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\uPPfTHD.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\MnvYXPU.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\xdJcgBR.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
File created	C:\Windows\System\SUhOqVH.exe	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2448	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	84
PID 2648 wrote to memory of 2448	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	84
PID 2648 wrote to memory of 868	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	85
PID 2648 wrote to memory of 868	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	85
PID 2648 wrote to memory of 3216	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	86
PID 2648 wrote to memory of 3216	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	86
PID 2648 wrote to memory of 3584	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	87
PID 2648 wrote to memory of 3584	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	87
PID 2648 wrote to memory of 2716	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	88
PID 2648 wrote to memory of 2716	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	88
PID 2648 wrote to memory of 4012	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	89
PID 2648 wrote to memory of 4012	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	89
PID 2648 wrote to memory of 1372	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	90
PID 2648 wrote to memory of 1372	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	90
PID 2648 wrote to memory of 3412	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	91
PID 2648 wrote to memory of 3412	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	91
PID 2648 wrote to memory of 2840	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	92
PID 2648 wrote to memory of 2840	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	92
PID 2648 wrote to memory of 3516	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	93
PID 2648 wrote to memory of 3516	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	93
PID 2648 wrote to memory of 2796	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	94
PID 2648 wrote to memory of 2796	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	94
PID 2648 wrote to memory of 3384	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	95
PID 2648 wrote to memory of 3384	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	95
PID 2648 wrote to memory of 3376	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	96
PID 2648 wrote to memory of 3376	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	96
PID 2648 wrote to memory of 4368	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	97
PID 2648 wrote to memory of 4368	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	97
PID 2648 wrote to memory of 2352	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	98
PID 2648 wrote to memory of 2352	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	98
PID 2648 wrote to memory of 2036	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	99
PID 2648 wrote to memory of 2036	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	99
PID 2648 wrote to memory of 4128	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	100
PID 2648 wrote to memory of 4128	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	100
PID 2648 wrote to memory of 4280	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	101
PID 2648 wrote to memory of 4280	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	101
PID 2648 wrote to memory of 4604	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	102
PID 2648 wrote to memory of 4604	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	102
PID 2648 wrote to memory of 4492	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	103
PID 2648 wrote to memory of 4492	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	103
PID 2648 wrote to memory of 4168	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	104
PID 2648 wrote to memory of 4168	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	104
PID 2648 wrote to memory of 3176	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	105
PID 2648 wrote to memory of 3176	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	105
PID 2648 wrote to memory of 5012	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	106
PID 2648 wrote to memory of 5012	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	106
PID 2648 wrote to memory of 1072	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	107
PID 2648 wrote to memory of 1072	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	107
PID 2648 wrote to memory of 3528	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	108
PID 2648 wrote to memory of 3528	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	108
PID 2648 wrote to memory of 1472	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	109
PID 2648 wrote to memory of 1472	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	109
PID 2648 wrote to memory of 2480	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	110
PID 2648 wrote to memory of 2480	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	110
PID 2648 wrote to memory of 1368	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	111
PID 2648 wrote to memory of 1368	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	111
PID 2648 wrote to memory of 5036	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	112
PID 2648 wrote to memory of 5036	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	112
PID 2648 wrote to memory of 2100	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	113
PID 2648 wrote to memory of 2100	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	113
PID 2648 wrote to memory of 1620	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	114
PID 2648 wrote to memory of 1620	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	114
PID 2648 wrote to memory of 2260	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	115
PID 2648 wrote to memory of 2260	2648	387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe	115

C:\Users\Admin\AppData\Local\Temp\387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe
"C:\Users\Admin\AppData\Local\Temp\387f043e11f56b568841b7779d1c1b41d198dc91707097bb7eb8ac5ef3e6f9f5.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\System\RYLtkAC.exe
  C:\Windows\System\RYLtkAC.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\xgjBnjg.exe
  C:\Windows\System\xgjBnjg.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\xdFKaqO.exe
  C:\Windows\System\xdFKaqO.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\RUvlGGv.exe
  C:\Windows\System\RUvlGGv.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\kBEFwpJ.exe
  C:\Windows\System\kBEFwpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\BISZtqG.exe
  C:\Windows\System\BISZtqG.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\MLkowRA.exe
  C:\Windows\System\MLkowRA.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\FkrOWCa.exe
  C:\Windows\System\FkrOWCa.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\bsboEst.exe
  C:\Windows\System\bsboEst.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\JUkYRzz.exe
  C:\Windows\System\JUkYRzz.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\eAfAbSW.exe
  C:\Windows\System\eAfAbSW.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\uRhZtPM.exe
  C:\Windows\System\uRhZtPM.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\lQUkKny.exe
  C:\Windows\System\lQUkKny.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\GWyRPcG.exe
  C:\Windows\System\GWyRPcG.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\bGDgpXQ.exe
  C:\Windows\System\bGDgpXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\OlEJAbd.exe
  C:\Windows\System\OlEJAbd.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\uiBxIoe.exe
  C:\Windows\System\uiBxIoe.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\HlPllrO.exe
  C:\Windows\System\HlPllrO.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\yLinYWH.exe
  C:\Windows\System\yLinYWH.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\IISHhpO.exe
  C:\Windows\System\IISHhpO.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\eTSeezA.exe
  C:\Windows\System\eTSeezA.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\ENVNWiJ.exe
  C:\Windows\System\ENVNWiJ.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\HvWblfZ.exe
  C:\Windows\System\HvWblfZ.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\dRJrkGd.exe
  C:\Windows\System\dRJrkGd.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\FoLgXfR.exe
  C:\Windows\System\FoLgXfR.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\ubZYmmW.exe
  C:\Windows\System\ubZYmmW.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\QGMSkRJ.exe
  C:\Windows\System\QGMSkRJ.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\SbLwtqO.exe
  C:\Windows\System\SbLwtqO.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\HfIICcV.exe
  C:\Windows\System\HfIICcV.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\GskufCB.exe
  C:\Windows\System\GskufCB.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\wHFNanS.exe
  C:\Windows\System\wHFNanS.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\guFyNaV.exe
  C:\Windows\System\guFyNaV.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\QlodFGJ.exe
  C:\Windows\System\QlodFGJ.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\DUABhIj.exe
  C:\Windows\System\DUABhIj.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\WdjmbTO.exe
  C:\Windows\System\WdjmbTO.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\MxVfvMD.exe
  C:\Windows\System\MxVfvMD.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\bKHvUcd.exe
  C:\Windows\System\bKHvUcd.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\AYzDUWk.exe
  C:\Windows\System\AYzDUWk.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\pLCKjoq.exe
  C:\Windows\System\pLCKjoq.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\joeAnhK.exe
  C:\Windows\System\joeAnhK.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\mfDLaVJ.exe
  C:\Windows\System\mfDLaVJ.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\beyyjFI.exe
  C:\Windows\System\beyyjFI.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\yByOifb.exe
  C:\Windows\System\yByOifb.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\ueZUImp.exe
  C:\Windows\System\ueZUImp.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\rIxXMJj.exe
  C:\Windows\System\rIxXMJj.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\uPPfTHD.exe
  C:\Windows\System\uPPfTHD.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\BOVsaPm.exe
  C:\Windows\System\BOVsaPm.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\zjVlXGW.exe
  C:\Windows\System\zjVlXGW.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\nBugCJI.exe
  C:\Windows\System\nBugCJI.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\tUIReFR.exe
  C:\Windows\System\tUIReFR.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\IbgrhkA.exe
  C:\Windows\System\IbgrhkA.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\frwSXTi.exe
  C:\Windows\System\frwSXTi.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\TDRDCmA.exe
  C:\Windows\System\TDRDCmA.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\xXhblWH.exe
  C:\Windows\System\xXhblWH.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\RWAeXNV.exe
  C:\Windows\System\RWAeXNV.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\csDfncA.exe
  C:\Windows\System\csDfncA.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\ePqJedF.exe
  C:\Windows\System\ePqJedF.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\RnfzrEK.exe
  C:\Windows\System\RnfzrEK.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\pBySWhq.exe
  C:\Windows\System\pBySWhq.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\BcedpnX.exe
  C:\Windows\System\BcedpnX.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\KCvKOSd.exe
  C:\Windows\System\KCvKOSd.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\usfdTUz.exe
  C:\Windows\System\usfdTUz.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\ZFewcJa.exe
  C:\Windows\System\ZFewcJa.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\vGeNQBn.exe
  C:\Windows\System\vGeNQBn.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\EfIBdaI.exe
  C:\Windows\System\EfIBdaI.exe
  2⤵
  PID:1044
- C:\Windows\System\iDpglIv.exe
  C:\Windows\System\iDpglIv.exe
  2⤵
  PID:672
- C:\Windows\System\dZgCOVC.exe
  C:\Windows\System\dZgCOVC.exe
  2⤵
  PID:2000
- C:\Windows\System\BhNOaRX.exe
  C:\Windows\System\BhNOaRX.exe
  2⤵
  PID:4428
- C:\Windows\System\rUNoxUj.exe
  C:\Windows\System\rUNoxUj.exe
  2⤵
  PID:1592
- C:\Windows\System\AxGfouy.exe
  C:\Windows\System\AxGfouy.exe
  2⤵
  PID:2760
- C:\Windows\System\KAxQbpK.exe
  C:\Windows\System\KAxQbpK.exe
  2⤵
  PID:4276
- C:\Windows\System\MxzikOr.exe
  C:\Windows\System\MxzikOr.exe
  2⤵
  PID:4944
- C:\Windows\System\ygPYmdu.exe
  C:\Windows\System\ygPYmdu.exe
  2⤵
  PID:4256
- C:\Windows\System\IApEYSx.exe
  C:\Windows\System\IApEYSx.exe
  2⤵
  PID:4556
- C:\Windows\System\OdeqGML.exe
  C:\Windows\System\OdeqGML.exe
  2⤵
  PID:4700
- C:\Windows\System\bDfTJAE.exe
  C:\Windows\System\bDfTJAE.exe
  2⤵
  PID:2956
- C:\Windows\System\PEkSkET.exe
  C:\Windows\System\PEkSkET.exe
  2⤵
  PID:4620
- C:\Windows\System\PSszSlY.exe
  C:\Windows\System\PSszSlY.exe
  2⤵
  PID:2656
- C:\Windows\System\jpYTofM.exe
  C:\Windows\System\jpYTofM.exe
  2⤵
  PID:3424
- C:\Windows\System\vpGqmwM.exe
  C:\Windows\System\vpGqmwM.exe
  2⤵
  PID:1012
- C:\Windows\System\zWnifXz.exe
  C:\Windows\System\zWnifXz.exe
  2⤵
  PID:4200
- C:\Windows\System\SQKVCuO.exe
  C:\Windows\System\SQKVCuO.exe
  2⤵
  PID:3408
- C:\Windows\System\rVHtBuC.exe
  C:\Windows\System\rVHtBuC.exe
  2⤵
  PID:2200
- C:\Windows\System\sghsBeP.exe
  C:\Windows\System\sghsBeP.exe
  2⤵
  PID:4324
- C:\Windows\System\XqhxFXJ.exe
  C:\Windows\System\XqhxFXJ.exe
  2⤵
  PID:4844
- C:\Windows\System\dDRpTat.exe
  C:\Windows\System\dDRpTat.exe
  2⤵
  PID:1716
- C:\Windows\System\luOujQp.exe
  C:\Windows\System\luOujQp.exe
  2⤵
  PID:4816
- C:\Windows\System\IRdXdce.exe
  C:\Windows\System\IRdXdce.exe
  2⤵
  PID:4424
- C:\Windows\System\TaffVpe.exe
  C:\Windows\System\TaffVpe.exe
  2⤵
  PID:3708
- C:\Windows\System\xBjJMup.exe
  C:\Windows\System\xBjJMup.exe
  2⤵
  PID:1392
- C:\Windows\System\IgIKXrw.exe
  C:\Windows\System\IgIKXrw.exe
  2⤵
  PID:2876
- C:\Windows\System\iiRwYIP.exe
  C:\Windows\System\iiRwYIP.exe
  2⤵
  PID:1724
- C:\Windows\System\DrAyKXC.exe
  C:\Windows\System\DrAyKXC.exe
  2⤵
  PID:1700
- C:\Windows\System\CruDTcH.exe
  C:\Windows\System\CruDTcH.exe
  2⤵
  PID:3252
- C:\Windows\System\DspBsOm.exe
  C:\Windows\System\DspBsOm.exe
  2⤵
  PID:2104
- C:\Windows\System\vpeXhdE.exe
  C:\Windows\System\vpeXhdE.exe
  2⤵
  PID:3084
- C:\Windows\System\CFXVtWR.exe
  C:\Windows\System\CFXVtWR.exe
  2⤵
  PID:4528
- C:\Windows\System\iAlLoUN.exe
  C:\Windows\System\iAlLoUN.exe
  2⤵
  PID:3156
- C:\Windows\System\mDYEEVO.exe
  C:\Windows\System\mDYEEVO.exe
  2⤵
  PID:4868
- C:\Windows\System\SnfTKJx.exe
  C:\Windows\System\SnfTKJx.exe
  2⤵
  PID:2444
- C:\Windows\System\btETrEH.exe
  C:\Windows\System\btETrEH.exe
  2⤵
  PID:3132
- C:\Windows\System\BWIXJhy.exe
  C:\Windows\System\BWIXJhy.exe
  2⤵
  PID:2472
- C:\Windows\System\IDtZfAF.exe
  C:\Windows\System\IDtZfAF.exe
  2⤵
  PID:4392
- C:\Windows\System\CfkWOMS.exe
  C:\Windows\System\CfkWOMS.exe
  2⤵
  PID:3420
- C:\Windows\System\ZuKSCRu.exe
  C:\Windows\System\ZuKSCRu.exe
  2⤵
  PID:4436
- C:\Windows\System\jijWAeu.exe
  C:\Windows\System\jijWAeu.exe
  2⤵
  PID:4780
- C:\Windows\System\fjBxmJV.exe
  C:\Windows\System\fjBxmJV.exe
  2⤵
  PID:1248
- C:\Windows\System\TeqxpbF.exe
  C:\Windows\System\TeqxpbF.exe
  2⤵
  PID:4404
- C:\Windows\System\ImqMykz.exe
  C:\Windows\System\ImqMykz.exe
  2⤵
  PID:612
- C:\Windows\System\PGkwggR.exe
  C:\Windows\System\PGkwggR.exe
  2⤵
  PID:4792
- C:\Windows\System\YTvEpAj.exe
  C:\Windows\System\YTvEpAj.exe
  2⤵
  PID:2668
- C:\Windows\System\CfHjAgm.exe
  C:\Windows\System\CfHjAgm.exe
  2⤵
  PID:392
- C:\Windows\System\nigbpSA.exe
  C:\Windows\System\nigbpSA.exe
  2⤵
  PID:3340
- C:\Windows\System\ctpjHDw.exe
  C:\Windows\System\ctpjHDw.exe
  2⤵
  PID:5160
- C:\Windows\System\wnvUOzC.exe
  C:\Windows\System\wnvUOzC.exe
  2⤵
  PID:5200
- C:\Windows\System\dAcxnuJ.exe
  C:\Windows\System\dAcxnuJ.exe
  2⤵
  PID:5220
- C:\Windows\System\dttODjq.exe
  C:\Windows\System\dttODjq.exe
  2⤵
  PID:5248
- C:\Windows\System\IGVdNEJ.exe
  C:\Windows\System\IGVdNEJ.exe
  2⤵
  PID:5292
- C:\Windows\System\PAQAamh.exe
  C:\Windows\System\PAQAamh.exe
  2⤵
  PID:5316
- C:\Windows\System\NuROZao.exe
  C:\Windows\System\NuROZao.exe
  2⤵
  PID:5332
- C:\Windows\System\kYGMtrW.exe
  C:\Windows\System\kYGMtrW.exe
  2⤵
  PID:5352
- C:\Windows\System\hsdFkkb.exe
  C:\Windows\System\hsdFkkb.exe
  2⤵
  PID:5376
- C:\Windows\System\mnCfWPx.exe
  C:\Windows\System\mnCfWPx.exe
  2⤵
  PID:5416
- C:\Windows\System\devlWUo.exe
  C:\Windows\System\devlWUo.exe
  2⤵
  PID:5448
- C:\Windows\System\VwZzLQV.exe
  C:\Windows\System\VwZzLQV.exe
  2⤵
  PID:5472
- C:\Windows\System\flsNHGx.exe
  C:\Windows\System\flsNHGx.exe
  2⤵
  PID:5504
- C:\Windows\System\GfjqxDg.exe
  C:\Windows\System\GfjqxDg.exe
  2⤵
  PID:5540
- C:\Windows\System\LlHmDwD.exe
  C:\Windows\System\LlHmDwD.exe
  2⤵
  PID:5568
- C:\Windows\System\IYoHAFR.exe
  C:\Windows\System\IYoHAFR.exe
  2⤵
  PID:5596
- C:\Windows\System\BBDFQTD.exe
  C:\Windows\System\BBDFQTD.exe
  2⤵
  PID:5624
- C:\Windows\System\ARaSzbs.exe
  C:\Windows\System\ARaSzbs.exe
  2⤵
  PID:5656
- C:\Windows\System\llQHNdq.exe
  C:\Windows\System\llQHNdq.exe
  2⤵
  PID:5680
- C:\Windows\System\cwtxCFy.exe
  C:\Windows\System\cwtxCFy.exe
  2⤵
  PID:5708
- C:\Windows\System\XDMRpjV.exe
  C:\Windows\System\XDMRpjV.exe
  2⤵
  PID:5740
- C:\Windows\System\SmeHoxx.exe
  C:\Windows\System\SmeHoxx.exe
  2⤵
  PID:5764
- C:\Windows\System\LyqzPhC.exe
  C:\Windows\System\LyqzPhC.exe
  2⤵
  PID:5792
- C:\Windows\System\uFVzHGi.exe
  C:\Windows\System\uFVzHGi.exe
  2⤵
  PID:5808
- C:\Windows\System\tYWRvcs.exe
  C:\Windows\System\tYWRvcs.exe
  2⤵
  PID:5840
- C:\Windows\System\JWdmgMK.exe
  C:\Windows\System\JWdmgMK.exe
  2⤵
  PID:5876
- C:\Windows\System\MieIPkc.exe
  C:\Windows\System\MieIPkc.exe
  2⤵
  PID:5904
- C:\Windows\System\jPHZiSi.exe
  C:\Windows\System\jPHZiSi.exe
  2⤵
  PID:5932
- C:\Windows\System\pYzckrR.exe
  C:\Windows\System\pYzckrR.exe
  2⤵
  PID:5956
- C:\Windows\System\guyxtvT.exe
  C:\Windows\System\guyxtvT.exe
  2⤵
  PID:5988
- C:\Windows\System\jJvslnF.exe
  C:\Windows\System\jJvslnF.exe
  2⤵
  PID:6020
- C:\Windows\System\xVpixGF.exe
  C:\Windows\System\xVpixGF.exe
  2⤵
  PID:6044
- C:\Windows\System\YukqkEb.exe
  C:\Windows\System\YukqkEb.exe
  2⤵
  PID:6072
- C:\Windows\System\yfUYUgz.exe
  C:\Windows\System\yfUYUgz.exe
  2⤵
  PID:6108
- C:\Windows\System\MjStxsY.exe
  C:\Windows\System\MjStxsY.exe
  2⤵
  PID:6128
- C:\Windows\System\esshUSI.exe
  C:\Windows\System\esshUSI.exe
  2⤵
  PID:5180
- C:\Windows\System\WLaorjV.exe
  C:\Windows\System\WLaorjV.exe
  2⤵
  PID:5212
- C:\Windows\System\rgBsshQ.exe
  C:\Windows\System\rgBsshQ.exe
  2⤵
  PID:5328
- C:\Windows\System\VKQwnZN.exe
  C:\Windows\System\VKQwnZN.exe
  2⤵
  PID:5340
- C:\Windows\System\qOSgaHw.exe
  C:\Windows\System\qOSgaHw.exe
  2⤵
  PID:5432
- C:\Windows\System\RexfEbG.exe
  C:\Windows\System\RexfEbG.exe
  2⤵
  PID:5516
- C:\Windows\System\KKsouSc.exe
  C:\Windows\System\KKsouSc.exe
  2⤵
  PID:5588
- C:\Windows\System\uklEKJg.exe
  C:\Windows\System\uklEKJg.exe
  2⤵
  PID:5620
- C:\Windows\System\enjdTxx.exe
  C:\Windows\System\enjdTxx.exe
  2⤵
  PID:5668
- C:\Windows\System\bPyrUDW.exe
  C:\Windows\System\bPyrUDW.exe
  2⤵
  PID:5756
- C:\Windows\System\qnvgUuh.exe
  C:\Windows\System\qnvgUuh.exe
  2⤵
  PID:5864
- C:\Windows\System\YzPASdY.exe
  C:\Windows\System\YzPASdY.exe
  2⤵
  PID:5900
- C:\Windows\System\ogntsYw.exe
  C:\Windows\System\ogntsYw.exe
  2⤵
  PID:6000
- C:\Windows\System\dttHDKB.exe
  C:\Windows\System\dttHDKB.exe
  2⤵
  PID:6008
- C:\Windows\System\oxAnhqr.exe
  C:\Windows\System\oxAnhqr.exe
  2⤵
  PID:6088
- C:\Windows\System\xHsBEzG.exe
  C:\Windows\System\xHsBEzG.exe
  2⤵
  PID:6140
- C:\Windows\System\CJfoung.exe
  C:\Windows\System\CJfoung.exe
  2⤵
  PID:5308
- C:\Windows\System\qBLHSQo.exe
  C:\Windows\System\qBLHSQo.exe
  2⤵
  PID:5360
- C:\Windows\System\bVOYWkj.exe
  C:\Windows\System\bVOYWkj.exe
  2⤵
  PID:5640
- C:\Windows\System\zpudplf.exe
  C:\Windows\System\zpudplf.exe
  2⤵
  PID:5720
- C:\Windows\System\ZqHxoKS.exe
  C:\Windows\System\ZqHxoKS.exe
  2⤵
  PID:5940
- C:\Windows\System\NaIfRBD.exe
  C:\Windows\System\NaIfRBD.exe
  2⤵
  PID:6084
- C:\Windows\System\XYHKwTR.exe
  C:\Windows\System\XYHKwTR.exe
  2⤵
  PID:5344
- C:\Windows\System\RtcKBkd.exe
  C:\Windows\System\RtcKBkd.exe
  2⤵
  PID:5920
- C:\Windows\System\AQPZYuA.exe
  C:\Windows\System\AQPZYuA.exe
  2⤵
  PID:5556
- C:\Windows\System\JXCBvhK.exe
  C:\Windows\System\JXCBvhK.exe
  2⤵
  PID:6028
- C:\Windows\System\otmICqQ.exe
  C:\Windows\System\otmICqQ.exe
  2⤵
  PID:6172
- C:\Windows\System\rLEtlcQ.exe
  C:\Windows\System\rLEtlcQ.exe
  2⤵
  PID:6188
- C:\Windows\System\LmDxaXH.exe
  C:\Windows\System\LmDxaXH.exe
  2⤵
  PID:6216
- C:\Windows\System\YpUzmoY.exe
  C:\Windows\System\YpUzmoY.exe
  2⤵
  PID:6244
- C:\Windows\System\XHBVxgp.exe
  C:\Windows\System\XHBVxgp.exe
  2⤵
  PID:6276
- C:\Windows\System\PEJfGGY.exe
  C:\Windows\System\PEJfGGY.exe
  2⤵
  PID:6300
- C:\Windows\System\mgfztrC.exe
  C:\Windows\System\mgfztrC.exe
  2⤵
  PID:6324
- C:\Windows\System\LPLygLa.exe
  C:\Windows\System\LPLygLa.exe
  2⤵
  PID:6356
- C:\Windows\System\qpVldLk.exe
  C:\Windows\System\qpVldLk.exe
  2⤵
  PID:6392
- C:\Windows\System\CBKBMii.exe
  C:\Windows\System\CBKBMii.exe
  2⤵
  PID:6412
- C:\Windows\System\LDXRUVX.exe
  C:\Windows\System\LDXRUVX.exe
  2⤵
  PID:6428
- C:\Windows\System\TVnnNHp.exe
  C:\Windows\System\TVnnNHp.exe
  2⤵
  PID:6464
- C:\Windows\System\pmlpIQy.exe
  C:\Windows\System\pmlpIQy.exe
  2⤵
  PID:6488
- C:\Windows\System\eDqRFCU.exe
  C:\Windows\System\eDqRFCU.exe
  2⤵
  PID:6524
- C:\Windows\System\byKYwwn.exe
  C:\Windows\System\byKYwwn.exe
  2⤵
  PID:6544
- C:\Windows\System\QZulCFA.exe
  C:\Windows\System\QZulCFA.exe
  2⤵
  PID:6564
- C:\Windows\System\gzSHZhx.exe
  C:\Windows\System\gzSHZhx.exe
  2⤵
  PID:6588
- C:\Windows\System\CAEAaek.exe
  C:\Windows\System\CAEAaek.exe
  2⤵
  PID:6620
- C:\Windows\System\BDBFJRu.exe
  C:\Windows\System\BDBFJRu.exe
  2⤵
  PID:6644
- C:\Windows\System\mEVbosO.exe
  C:\Windows\System\mEVbosO.exe
  2⤵
  PID:6664
- C:\Windows\System\mxJUpqY.exe
  C:\Windows\System\mxJUpqY.exe
  2⤵
  PID:6688
- C:\Windows\System\luNzegB.exe
  C:\Windows\System\luNzegB.exe
  2⤵
  PID:6716
- C:\Windows\System\hooeEkz.exe
  C:\Windows\System\hooeEkz.exe
  2⤵
  PID:6748
- C:\Windows\System\WAMpsoJ.exe
  C:\Windows\System\WAMpsoJ.exe
  2⤵
  PID:6780
- C:\Windows\System\hvqBsVz.exe
  C:\Windows\System\hvqBsVz.exe
  2⤵
  PID:6800
- C:\Windows\System\wqOJTly.exe
  C:\Windows\System\wqOJTly.exe
  2⤵
  PID:6824
- C:\Windows\System\WBYBbLW.exe
  C:\Windows\System\WBYBbLW.exe
  2⤵
  PID:6856
- C:\Windows\System\wAqDTYq.exe
  C:\Windows\System\wAqDTYq.exe
  2⤵
  PID:6884
- C:\Windows\System\ifLHMiW.exe
  C:\Windows\System\ifLHMiW.exe
  2⤵
  PID:6916
- C:\Windows\System\SjsQshL.exe
  C:\Windows\System\SjsQshL.exe
  2⤵
  PID:6948
- C:\Windows\System\uzmlcXq.exe
  C:\Windows\System\uzmlcXq.exe
  2⤵
  PID:6968
- C:\Windows\System\QkkoZEK.exe
  C:\Windows\System\QkkoZEK.exe
  2⤵
  PID:7000
- C:\Windows\System\SCOVBrW.exe
  C:\Windows\System\SCOVBrW.exe
  2⤵
  PID:7032
- C:\Windows\System\SFBHBsz.exe
  C:\Windows\System\SFBHBsz.exe
  2⤵
  PID:7060
- C:\Windows\System\IteyStW.exe
  C:\Windows\System\IteyStW.exe
  2⤵
  PID:7092
- C:\Windows\System\wxidzbC.exe
  C:\Windows\System\wxidzbC.exe
  2⤵
  PID:7120
- C:\Windows\System\kZYACsN.exe
  C:\Windows\System\kZYACsN.exe
  2⤵
  PID:7160
- C:\Windows\System\hIpFbVJ.exe
  C:\Windows\System\hIpFbVJ.exe
  2⤵
  PID:6164
- C:\Windows\System\MPvdIKQ.exe
  C:\Windows\System\MPvdIKQ.exe
  2⤵
  PID:6268
- C:\Windows\System\IiBXpwo.exe
  C:\Windows\System\IiBXpwo.exe
  2⤵
  PID:6308
- C:\Windows\System\CPcVMKv.exe
  C:\Windows\System\CPcVMKv.exe
  2⤵
  PID:6404
- C:\Windows\System\EHHSSMm.exe
  C:\Windows\System\EHHSSMm.exe
  2⤵
  PID:6420
- C:\Windows\System\doFpGdk.exe
  C:\Windows\System\doFpGdk.exe
  2⤵
  PID:6500
- C:\Windows\System\VHWKkzh.exe
  C:\Windows\System\VHWKkzh.exe
  2⤵
  PID:6604
- C:\Windows\System\TNvupQZ.exe
  C:\Windows\System\TNvupQZ.exe
  2⤵
  PID:6636
- C:\Windows\System\wsCjLLs.exe
  C:\Windows\System\wsCjLLs.exe
  2⤵
  PID:6672
- C:\Windows\System\UyhZlsW.exe
  C:\Windows\System\UyhZlsW.exe
  2⤵
  PID:6816
- C:\Windows\System\hGgiVxL.exe
  C:\Windows\System\hGgiVxL.exe
  2⤵
  PID:6756
- C:\Windows\System\WwCnHen.exe
  C:\Windows\System\WwCnHen.exe
  2⤵
  PID:6936
- C:\Windows\System\VzTnQzC.exe
  C:\Windows\System\VzTnQzC.exe
  2⤵
  PID:6992
- C:\Windows\System\XEdBltD.exe
  C:\Windows\System\XEdBltD.exe
  2⤵
  PID:7016
- C:\Windows\System\CVJHLGK.exe
  C:\Windows\System\CVJHLGK.exe
  2⤵
  PID:7052
- C:\Windows\System\hPgELVF.exe
  C:\Windows\System\hPgELVF.exe
  2⤵
  PID:7116
- C:\Windows\System\oOqLlQv.exe
  C:\Windows\System\oOqLlQv.exe
  2⤵
  PID:6152
- C:\Windows\System\UkjnKPl.exe
  C:\Windows\System\UkjnKPl.exe
  2⤵
  PID:6380
- C:\Windows\System\kfDpcih.exe
  C:\Windows\System\kfDpcih.exe
  2⤵
  PID:6580
- C:\Windows\System\MhwezAN.exe
  C:\Windows\System\MhwezAN.exe
  2⤵
  PID:6712
- C:\Windows\System\TILWlRK.exe
  C:\Windows\System\TILWlRK.exe
  2⤵
  PID:6944
- C:\Windows\System\yNlrVvZ.exe
  C:\Windows\System\yNlrVvZ.exe
  2⤵
  PID:7080
- C:\Windows\System\SyQKHel.exe
  C:\Windows\System\SyQKHel.exe
  2⤵
  PID:6288
- C:\Windows\System\NtOvVaO.exe
  C:\Windows\System\NtOvVaO.exe
  2⤵
  PID:6788
- C:\Windows\System\zNcmPkI.exe
  C:\Windows\System\zNcmPkI.exe
  2⤵
  PID:7044
- C:\Windows\System\yuEkLar.exe
  C:\Windows\System\yuEkLar.exe
  2⤵
  PID:6440
- C:\Windows\System\kGaFpzD.exe
  C:\Windows\System\kGaFpzD.exe
  2⤵
  PID:6540
- C:\Windows\System\zGTmFol.exe
  C:\Windows\System\zGTmFol.exe
  2⤵
  PID:7020
- C:\Windows\System\jHtxnez.exe
  C:\Windows\System\jHtxnez.exe
  2⤵
  PID:7196
- C:\Windows\System\kDIqBse.exe
  C:\Windows\System\kDIqBse.exe
  2⤵
  PID:7224
- C:\Windows\System\ECIgRSh.exe
  C:\Windows\System\ECIgRSh.exe
  2⤵
  PID:7268
- C:\Windows\System\hYbzIPq.exe
  C:\Windows\System\hYbzIPq.exe
  2⤵
  PID:7296
- C:\Windows\System\yGBtPhj.exe
  C:\Windows\System\yGBtPhj.exe
  2⤵
  PID:7332
- C:\Windows\System\ZqesnlL.exe
  C:\Windows\System\ZqesnlL.exe
  2⤵
  PID:7368
- C:\Windows\System\jWnKySH.exe
  C:\Windows\System\jWnKySH.exe
  2⤵
  PID:7388
- C:\Windows\System\tDbmaQj.exe
  C:\Windows\System\tDbmaQj.exe
  2⤵
  PID:7408
- C:\Windows\System\NYrSfsR.exe
  C:\Windows\System\NYrSfsR.exe
  2⤵
  PID:7444
- C:\Windows\System\jpGeQfU.exe
  C:\Windows\System\jpGeQfU.exe
  2⤵
  PID:7464
- C:\Windows\System\rrQHUvA.exe
  C:\Windows\System\rrQHUvA.exe
  2⤵
  PID:7496
- C:\Windows\System\noZzmPh.exe
  C:\Windows\System\noZzmPh.exe
  2⤵
  PID:7536
- C:\Windows\System\nimDHko.exe
  C:\Windows\System\nimDHko.exe
  2⤵
  PID:7572
- C:\Windows\System\kQSXyPH.exe
  C:\Windows\System\kQSXyPH.exe
  2⤵
  PID:7588
- C:\Windows\System\mfPHQUt.exe
  C:\Windows\System\mfPHQUt.exe
  2⤵
  PID:7628
- C:\Windows\System\WlyHXDZ.exe
  C:\Windows\System\WlyHXDZ.exe
  2⤵
  PID:7656
- C:\Windows\System\AbMoaNn.exe
  C:\Windows\System\AbMoaNn.exe
  2⤵
  PID:7672
- C:\Windows\System\uBPdusb.exe
  C:\Windows\System\uBPdusb.exe
  2⤵
  PID:7688
- C:\Windows\System\vKzngPO.exe
  C:\Windows\System\vKzngPO.exe
  2⤵
  PID:7708
- C:\Windows\System\WtLnTgW.exe
  C:\Windows\System\WtLnTgW.exe
  2⤵
  PID:7732
- C:\Windows\System\zmoTWUI.exe
  C:\Windows\System\zmoTWUI.exe
  2⤵
  PID:7768
- C:\Windows\System\EfPpqOi.exe
  C:\Windows\System\EfPpqOi.exe
  2⤵
  PID:7804
- C:\Windows\System\rvFhGYg.exe
  C:\Windows\System\rvFhGYg.exe
  2⤵
  PID:7832
- C:\Windows\System\mjHePdN.exe
  C:\Windows\System\mjHePdN.exe
  2⤵
  PID:7856
- C:\Windows\System\rPsorAM.exe
  C:\Windows\System\rPsorAM.exe
  2⤵
  PID:7888
- C:\Windows\System\DzxqeQB.exe
  C:\Windows\System\DzxqeQB.exe
  2⤵
  PID:7916
- C:\Windows\System\PhPybjJ.exe
  C:\Windows\System\PhPybjJ.exe
  2⤵
  PID:7948
- C:\Windows\System\xduqYGU.exe
  C:\Windows\System\xduqYGU.exe
  2⤵
  PID:7984
- C:\Windows\System\ZvqXPqy.exe
  C:\Windows\System\ZvqXPqy.exe
  2⤵
  PID:8012
- C:\Windows\System\HHJakKY.exe
  C:\Windows\System\HHJakKY.exe
  2⤵
  PID:8040
- C:\Windows\System\PyHcwyr.exe
  C:\Windows\System\PyHcwyr.exe
  2⤵
  PID:8068
- C:\Windows\System\AcEJsfQ.exe
  C:\Windows\System\AcEJsfQ.exe
  2⤵
  PID:8096
- C:\Windows\System\DNqMlLU.exe
  C:\Windows\System\DNqMlLU.exe
  2⤵
  PID:8128
- C:\Windows\System\zwsUdMW.exe
  C:\Windows\System\zwsUdMW.exe
  2⤵
  PID:8152
- C:\Windows\System\ncjwedC.exe
  C:\Windows\System\ncjwedC.exe
  2⤵
  PID:8180
- C:\Windows\System\BDstWWR.exe
  C:\Windows\System\BDstWWR.exe
  2⤵
  PID:7188
- C:\Windows\System\DzpADba.exe
  C:\Windows\System\DzpADba.exe
  2⤵
  PID:7288
- C:\Windows\System\cKJftlK.exe
  C:\Windows\System\cKJftlK.exe
  2⤵
  PID:7356
- C:\Windows\System\yqSouVz.exe
  C:\Windows\System\yqSouVz.exe
  2⤵
  PID:7432
- C:\Windows\System\iROJGXe.exe
  C:\Windows\System\iROJGXe.exe
  2⤵
  PID:7476
- C:\Windows\System\jcKdyVY.exe
  C:\Windows\System\jcKdyVY.exe
  2⤵
  PID:7512
- C:\Windows\System\FQzBIDd.exe
  C:\Windows\System\FQzBIDd.exe
  2⤵
  PID:7580
- C:\Windows\System\HdrykkF.exe
  C:\Windows\System\HdrykkF.exe
  2⤵
  PID:7652
- C:\Windows\System\yDKhFEd.exe
  C:\Windows\System\yDKhFEd.exe
  2⤵
  PID:7800
- C:\Windows\System\pOuVihg.exe
  C:\Windows\System\pOuVihg.exe
  2⤵
  PID:7728
- C:\Windows\System\sGUmYJp.exe
  C:\Windows\System\sGUmYJp.exe
  2⤵
  PID:7824
- C:\Windows\System\jrbEbAV.exe
  C:\Windows\System\jrbEbAV.exe
  2⤵
  PID:7852
- C:\Windows\System\WrrBBmy.exe
  C:\Windows\System\WrrBBmy.exe
  2⤵
  PID:7900
- C:\Windows\System\XKnTGQC.exe
  C:\Windows\System\XKnTGQC.exe
  2⤵
  PID:7932
- C:\Windows\System\GawPJGK.exe
  C:\Windows\System\GawPJGK.exe
  2⤵
  PID:7996
- C:\Windows\System\dCwRXlF.exe
  C:\Windows\System\dCwRXlF.exe
  2⤵
  PID:8084
- C:\Windows\System\UmExihB.exe
  C:\Windows\System\UmExihB.exe
  2⤵
  PID:8168
- C:\Windows\System\vulbUGH.exe
  C:\Windows\System\vulbUGH.exe
  2⤵
  PID:7256
- C:\Windows\System\UUyaPxd.exe
  C:\Windows\System\UUyaPxd.exe
  2⤵
  PID:7420
- C:\Windows\System\CzJyOpx.exe
  C:\Windows\System\CzJyOpx.exe
  2⤵
  PID:7556
- C:\Windows\System\IjcCMQa.exe
  C:\Windows\System\IjcCMQa.exe
  2⤵
  PID:7748
- C:\Windows\System\GnjDGej.exe
  C:\Windows\System\GnjDGej.exe
  2⤵
  PID:7972
- C:\Windows\System\fWdExYB.exe
  C:\Windows\System\fWdExYB.exe
  2⤵
  PID:8104
- C:\Windows\System\ODUWCBR.exe
  C:\Windows\System\ODUWCBR.exe
  2⤵
  PID:7376
- C:\Windows\System\OjLOsPs.exe
  C:\Windows\System\OjLOsPs.exe
  2⤵
  PID:8052
- C:\Windows\System\SsCtUxe.exe
  C:\Windows\System\SsCtUxe.exe
  2⤵
  PID:7640
- C:\Windows\System\TYYTuXI.exe
  C:\Windows\System\TYYTuXI.exe
  2⤵
  PID:8148
- C:\Windows\System\fcLQCxn.exe
  C:\Windows\System\fcLQCxn.exe
  2⤵
  PID:8212
- C:\Windows\System\YwNfXuV.exe
  C:\Windows\System\YwNfXuV.exe
  2⤵
  PID:8240
- C:\Windows\System\djyeRuc.exe
  C:\Windows\System\djyeRuc.exe
  2⤵
  PID:8268
- C:\Windows\System\tHTmEtc.exe
  C:\Windows\System\tHTmEtc.exe
  2⤵
  PID:8296
- C:\Windows\System\emHKgHg.exe
  C:\Windows\System\emHKgHg.exe
  2⤵
  PID:8312
- C:\Windows\System\lgJHYlN.exe
  C:\Windows\System\lgJHYlN.exe
  2⤵
  PID:8328
- C:\Windows\System\KPmFzBi.exe
  C:\Windows\System\KPmFzBi.exe
  2⤵
  PID:8352
- C:\Windows\System\zhcnOkC.exe
  C:\Windows\System\zhcnOkC.exe
  2⤵
  PID:8368
- C:\Windows\System\gstZiNw.exe
  C:\Windows\System\gstZiNw.exe
  2⤵
  PID:8388
- C:\Windows\System\VcwpimB.exe
  C:\Windows\System\VcwpimB.exe
  2⤵
  PID:8404
- C:\Windows\System\qXEYvQi.exe
  C:\Windows\System\qXEYvQi.exe
  2⤵
  PID:8420
- C:\Windows\System\fcydUhU.exe
  C:\Windows\System\fcydUhU.exe
  2⤵
  PID:8444
- C:\Windows\System\LotgGeF.exe
  C:\Windows\System\LotgGeF.exe
  2⤵
  PID:8476
- C:\Windows\System\ETLzkrR.exe
  C:\Windows\System\ETLzkrR.exe
  2⤵
  PID:8504
- C:\Windows\System\hAsFsqv.exe
  C:\Windows\System\hAsFsqv.exe
  2⤵
  PID:8544
- C:\Windows\System\EmefVHE.exe
  C:\Windows\System\EmefVHE.exe
  2⤵
  PID:8572
- C:\Windows\System\YTlhgWv.exe
  C:\Windows\System\YTlhgWv.exe
  2⤵
  PID:8600
- C:\Windows\System\oNLLUpN.exe
  C:\Windows\System\oNLLUpN.exe
  2⤵
  PID:8636
- C:\Windows\System\ciQIzXH.exe
  C:\Windows\System\ciQIzXH.exe
  2⤵
  PID:8656
- C:\Windows\System\HYbdtvQ.exe
  C:\Windows\System\HYbdtvQ.exe
  2⤵
  PID:8672
- C:\Windows\System\tBMfMcf.exe
  C:\Windows\System\tBMfMcf.exe
  2⤵
  PID:8712
- C:\Windows\System\MdknmMB.exe
  C:\Windows\System\MdknmMB.exe
  2⤵
  PID:8744
- C:\Windows\System\drZxZLi.exe
  C:\Windows\System\drZxZLi.exe
  2⤵
  PID:8764
- C:\Windows\System\NHCVttS.exe
  C:\Windows\System\NHCVttS.exe
  2⤵
  PID:8792
- C:\Windows\System\bPcELRW.exe
  C:\Windows\System\bPcELRW.exe
  2⤵
  PID:8824
- C:\Windows\System\rcGDdxK.exe
  C:\Windows\System\rcGDdxK.exe
  2⤵
  PID:8844
- C:\Windows\System\pAXMQon.exe
  C:\Windows\System\pAXMQon.exe
  2⤵
  PID:8876
- C:\Windows\System\dbEfnxY.exe
  C:\Windows\System\dbEfnxY.exe
  2⤵
  PID:8908
- C:\Windows\System\MpeyYrt.exe
  C:\Windows\System\MpeyYrt.exe
  2⤵
  PID:8936
- C:\Windows\System\sbDtRUP.exe
  C:\Windows\System\sbDtRUP.exe
  2⤵
  PID:8964
- C:\Windows\System\MdTumzI.exe
  C:\Windows\System\MdTumzI.exe
  2⤵
  PID:8996
- C:\Windows\System\MnvYXPU.exe
  C:\Windows\System\MnvYXPU.exe
  2⤵
  PID:9036
- C:\Windows\System\yGPqKHj.exe
  C:\Windows\System\yGPqKHj.exe
  2⤵
  PID:9068
- C:\Windows\System\fvngyPm.exe
  C:\Windows\System\fvngyPm.exe
  2⤵
  PID:9092
- C:\Windows\System\atXphcC.exe
  C:\Windows\System\atXphcC.exe
  2⤵
  PID:9208
- C:\Windows\System\fVnSqQP.exe
  C:\Windows\System\fVnSqQP.exe
  2⤵
  PID:7816
- C:\Windows\System\VaYJKpM.exe
  C:\Windows\System\VaYJKpM.exe
  2⤵
  PID:8260
- C:\Windows\System\ghPrubC.exe
  C:\Windows\System\ghPrubC.exe
  2⤵
  PID:8288
- C:\Windows\System\lcfuKJu.exe
  C:\Windows\System\lcfuKJu.exe
  2⤵
  PID:8340
- C:\Windows\System\MBrCyyq.exe
  C:\Windows\System\MBrCyyq.exe
  2⤵
  PID:8308
- C:\Windows\System\BkMxaKl.exe
  C:\Windows\System\BkMxaKl.exe
  2⤵
  PID:8468
- C:\Windows\System\mdNEMhc.exe
  C:\Windows\System\mdNEMhc.exe
  2⤵
  PID:8528
- C:\Windows\System\jhoSORc.exe
  C:\Windows\System\jhoSORc.exe
  2⤵
  PID:8596
- C:\Windows\System\irOxxFZ.exe
  C:\Windows\System\irOxxFZ.exe
  2⤵
  PID:8652
- C:\Windows\System\rSQsegf.exe
  C:\Windows\System\rSQsegf.exe
  2⤵
  PID:8776
- C:\Windows\System\oGJSOGl.exe
  C:\Windows\System\oGJSOGl.exe
  2⤵
  PID:8808
- C:\Windows\System\IDqOAXX.exe
  C:\Windows\System\IDqOAXX.exe
  2⤵
  PID:8840
- C:\Windows\System\PLqdTRN.exe
  C:\Windows\System\PLqdTRN.exe
  2⤵
  PID:8956
- C:\Windows\System\mSEaRbK.exe
  C:\Windows\System\mSEaRbK.exe
  2⤵
  PID:8932
- C:\Windows\System\wImJlGM.exe
  C:\Windows\System\wImJlGM.exe
  2⤵
  PID:9060
- C:\Windows\System\JxSXpjj.exe
  C:\Windows\System\JxSXpjj.exe
  2⤵
  PID:9168
- C:\Windows\System\iHJYbnA.exe
  C:\Windows\System\iHJYbnA.exe
  2⤵
  PID:7784
- C:\Windows\System\zXLsAlp.exe
  C:\Windows\System\zXLsAlp.exe
  2⤵
  PID:9076
- C:\Windows\System\qwDfhAf.exe
  C:\Windows\System\qwDfhAf.exe
  2⤵
  PID:9200
- C:\Windows\System\nBCPKwD.exe
  C:\Windows\System\nBCPKwD.exe
  2⤵
  PID:8232
- C:\Windows\System\HIZaUSy.exe
  C:\Windows\System\HIZaUSy.exe
  2⤵
  PID:8436
- C:\Windows\System\SNRGWsG.exe
  C:\Windows\System\SNRGWsG.exe
  2⤵
  PID:8380
- C:\Windows\System\SUhOqVH.exe
  C:\Windows\System\SUhOqVH.exe
  2⤵
  PID:8416
- C:\Windows\System\kuHaHuR.exe
  C:\Windows\System\kuHaHuR.exe
  2⤵
  PID:8668
- C:\Windows\System\VJGwjxQ.exe
  C:\Windows\System\VJGwjxQ.exe
  2⤵
  PID:8920
- C:\Windows\System\gcIuRHq.exe
  C:\Windows\System\gcIuRHq.exe
  2⤵
  PID:8752
- C:\Windows\System\mopermx.exe
  C:\Windows\System\mopermx.exe
  2⤵
  PID:4860
- C:\Windows\System\GZpnkuw.exe
  C:\Windows\System\GZpnkuw.exe
  2⤵
  PID:8284
- C:\Windows\System\OuEsfTP.exe
  C:\Windows\System\OuEsfTP.exe
  2⤵
  PID:8680
- C:\Windows\System\nXCaJub.exe
  C:\Windows\System\nXCaJub.exe
  2⤵
  PID:9156
- C:\Windows\System\xdJcgBR.exe
  C:\Windows\System\xdJcgBR.exe
  2⤵
  PID:9232
- C:\Windows\System\mzvENBv.exe
  C:\Windows\System\mzvENBv.exe
  2⤵
  PID:9264
- C:\Windows\System\vRUZFXi.exe
  C:\Windows\System\vRUZFXi.exe
  2⤵
  PID:9292
- C:\Windows\System\DzStYKx.exe
  C:\Windows\System\DzStYKx.exe
  2⤵
  PID:9316
- C:\Windows\System\QYKUoQJ.exe
  C:\Windows\System\QYKUoQJ.exe
  2⤵
  PID:9352
- C:\Windows\System\KhwBKdH.exe
  C:\Windows\System\KhwBKdH.exe
  2⤵
  PID:9388
- C:\Windows\System\fYVuJKq.exe
  C:\Windows\System\fYVuJKq.exe
  2⤵
  PID:9408
- C:\Windows\System\FDwvdgs.exe
  C:\Windows\System\FDwvdgs.exe
  2⤵
  PID:9440
- C:\Windows\System\pzasojL.exe
  C:\Windows\System\pzasojL.exe
  2⤵
  PID:9476
- C:\Windows\System\KKAbrXZ.exe
  C:\Windows\System\KKAbrXZ.exe
  2⤵
  PID:9508
- C:\Windows\System\ItwMWjI.exe
  C:\Windows\System\ItwMWjI.exe
  2⤵
  PID:9532
- C:\Windows\System\RWNWKPw.exe
  C:\Windows\System\RWNWKPw.exe
  2⤵
  PID:9556
- C:\Windows\System\LxyEfaa.exe
  C:\Windows\System\LxyEfaa.exe
  2⤵
  PID:9584
- C:\Windows\System\cfcyzwK.exe
  C:\Windows\System\cfcyzwK.exe
  2⤵
  PID:9616
- C:\Windows\System\mUOUkyD.exe
  C:\Windows\System\mUOUkyD.exe
  2⤵
  PID:9640
- C:\Windows\System\EZcKnNj.exe
  C:\Windows\System\EZcKnNj.exe
  2⤵
  PID:9676
- C:\Windows\System\sITZPLZ.exe
  C:\Windows\System\sITZPLZ.exe
  2⤵
  PID:9700
- C:\Windows\System\KifNsPl.exe
  C:\Windows\System\KifNsPl.exe
  2⤵
  PID:9728
- C:\Windows\System\imlQrLs.exe
  C:\Windows\System\imlQrLs.exe
  2⤵
  PID:9760
- C:\Windows\System\nIRsmcv.exe
  C:\Windows\System\nIRsmcv.exe
  2⤵
  PID:9796
- C:\Windows\System\maxoeex.exe
  C:\Windows\System\maxoeex.exe
  2⤵
  PID:9836
- C:\Windows\System\PXjquPM.exe
  C:\Windows\System\PXjquPM.exe
  2⤵
  PID:9856
- C:\Windows\System\xTVSpzE.exe
  C:\Windows\System\xTVSpzE.exe
  2⤵
  PID:9884
- C:\Windows\System\VypSrPc.exe
  C:\Windows\System\VypSrPc.exe
  2⤵
  PID:9920
- C:\Windows\System\dPWOdmX.exe
  C:\Windows\System\dPWOdmX.exe
  2⤵
  PID:9948
- C:\Windows\System\mtByqbg.exe
  C:\Windows\System\mtByqbg.exe
  2⤵
  PID:9976
- C:\Windows\System\HxMebWj.exe
  C:\Windows\System\HxMebWj.exe
  2⤵
  PID:10004
- C:\Windows\System\LyuLuFX.exe
  C:\Windows\System\LyuLuFX.exe
  2⤵
  PID:10032
- C:\Windows\System\dcplSBI.exe
  C:\Windows\System\dcplSBI.exe
  2⤵
  PID:10052
- C:\Windows\System\AwlfiQW.exe
  C:\Windows\System\AwlfiQW.exe
  2⤵
  PID:10088
- C:\Windows\System\GksXgWx.exe
  C:\Windows\System\GksXgWx.exe
  2⤵
  PID:10120
- C:\Windows\System\bdJwDtD.exe
  C:\Windows\System\bdJwDtD.exe
  2⤵
  PID:10148
- C:\Windows\System\HpTCaLY.exe
  C:\Windows\System\HpTCaLY.exe
  2⤵
  PID:10172
- C:\Windows\System\hSLwTTR.exe
  C:\Windows\System\hSLwTTR.exe
  2⤵
  PID:10192
- C:\Windows\System\XUdbTHD.exe
  C:\Windows\System\XUdbTHD.exe
  2⤵
  PID:10224
- C:\Windows\System\tVJurPc.exe
  C:\Windows\System\tVJurPc.exe
  2⤵
  PID:9012
- C:\Windows\System\isqajdB.exe
  C:\Windows\System\isqajdB.exe
  2⤵
  PID:8872
- C:\Windows\System\bYiTIqu.exe
  C:\Windows\System\bYiTIqu.exe
  2⤵
  PID:9312
- C:\Windows\System\hkcfIRf.exe
  C:\Windows\System\hkcfIRf.exe
  2⤵
  PID:9344
- C:\Windows\System\xFIVETj.exe
  C:\Windows\System\xFIVETj.exe
  2⤵
  PID:9380
- C:\Windows\System\XzWCzaS.exe
  C:\Windows\System\XzWCzaS.exe
  2⤵
  PID:9404
- C:\Windows\System\DaqDiGJ.exe
  C:\Windows\System\DaqDiGJ.exe
  2⤵
  PID:9516
- C:\Windows\System\PorHILk.exe
  C:\Windows\System\PorHILk.exe
  2⤵
  PID:9604
- C:\Windows\System\LIEmPyf.exe
  C:\Windows\System\LIEmPyf.exe
  2⤵
  PID:9660
- C:\Windows\System\ERLrEWw.exe
  C:\Windows\System\ERLrEWw.exe
  2⤵
  PID:9696
- C:\Windows\System\TRJrgtO.exe
  C:\Windows\System\TRJrgtO.exe
  2⤵
  PID:9784
- C:\Windows\System\kjPomGC.exe
  C:\Windows\System\kjPomGC.exe
  2⤵
  PID:9916
- C:\Windows\System\hriuxuH.exe
  C:\Windows\System\hriuxuH.exe
  2⤵
  PID:9932
- C:\Windows\System\FYmRzvp.exe
  C:\Windows\System\FYmRzvp.exe
  2⤵
  PID:9992
- C:\Windows\System\FMmlcEi.exe
  C:\Windows\System\FMmlcEi.exe
  2⤵
  PID:10040
- C:\Windows\System\nFYBMpu.exe
  C:\Windows\System\nFYBMpu.exe
  2⤵
  PID:10100
- C:\Windows\System\gQJMyYP.exe
  C:\Windows\System\gQJMyYP.exe
  2⤵
  PID:10168
- C:\Windows\System\reKnBtf.exe
  C:\Windows\System\reKnBtf.exe
  2⤵
  PID:9228
- C:\Windows\System\AOpqDKH.exe
  C:\Windows\System\AOpqDKH.exe
  2⤵
  PID:9280
- C:\Windows\System\EQLsiEg.exe
  C:\Windows\System\EQLsiEg.exe
  2⤵
  PID:9432
- C:\Windows\System\hBymZcK.exe
  C:\Windows\System\hBymZcK.exe
  2⤵
  PID:9552
- C:\Windows\System\keYFTlU.exe
  C:\Windows\System\keYFTlU.exe
  2⤵
  PID:9768
- C:\Windows\System\EJvaJQR.exe
  C:\Windows\System\EJvaJQR.exe
  2⤵
  PID:9816
- C:\Windows\System\rOGfVDO.exe
  C:\Windows\System\rOGfVDO.exe
  2⤵
  PID:10084
- C:\Windows\System\lIrgRWJ.exe
  C:\Windows\System\lIrgRWJ.exe
  2⤵
  PID:2208
- C:\Windows\System\EmaXqgr.exe
  C:\Windows\System\EmaXqgr.exe
  2⤵
  PID:9276
- C:\Windows\System\ugakmoa.exe
  C:\Windows\System\ugakmoa.exe
  2⤵
  PID:8400
- C:\Windows\System\ossKvuL.exe
  C:\Windows\System\ossKvuL.exe
  2⤵
  PID:10020
- C:\Windows\System\wtzXbwn.exe
  C:\Windows\System\wtzXbwn.exe
  2⤵
  PID:9684
- C:\Windows\System\PgygDDs.exe
  C:\Windows\System\PgygDDs.exe
  2⤵
  PID:10260
- C:\Windows\System\iUDsoRf.exe
  C:\Windows\System\iUDsoRf.exe
  2⤵
  PID:10292
- C:\Windows\System\WpeLcdw.exe
  C:\Windows\System\WpeLcdw.exe
  2⤵
  PID:10328
- C:\Windows\System\fUcJNno.exe
  C:\Windows\System\fUcJNno.exe
  2⤵
  PID:10348
- C:\Windows\System\JlLyZef.exe
  C:\Windows\System\JlLyZef.exe
  2⤵
  PID:10380
- C:\Windows\System\vJFkvZh.exe
  C:\Windows\System\vJFkvZh.exe
  2⤵
  PID:10416
- C:\Windows\System\OHnHxPA.exe
  C:\Windows\System\OHnHxPA.exe
  2⤵
  PID:10444
- C:\Windows\System\nlZJePQ.exe
  C:\Windows\System\nlZJePQ.exe
  2⤵
  PID:10472
- C:\Windows\System\zsBWlZt.exe
  C:\Windows\System\zsBWlZt.exe
  2⤵
  PID:10500
- C:\Windows\System\phMXQPd.exe
  C:\Windows\System\phMXQPd.exe
  2⤵
  PID:10524
- C:\Windows\System\yNfuvpv.exe
  C:\Windows\System\yNfuvpv.exe
  2⤵
  PID:10552
- C:\Windows\System\JMFdaaM.exe
  C:\Windows\System\JMFdaaM.exe
  2⤵
  PID:10580
- C:\Windows\System\RggjzbO.exe
  C:\Windows\System\RggjzbO.exe
  2⤵
  PID:10612
- C:\Windows\System\wwlSwaV.exe
  C:\Windows\System\wwlSwaV.exe
  2⤵
  PID:10644
- C:\Windows\System\WXqKkST.exe
  C:\Windows\System\WXqKkST.exe
  2⤵
  PID:10676
- C:\Windows\System\rdBiMEM.exe
  C:\Windows\System\rdBiMEM.exe
  2⤵
  PID:10704
- C:\Windows\System\kIgHVFA.exe
  C:\Windows\System\kIgHVFA.exe
  2⤵
  PID:10736
- C:\Windows\System\oluEyhJ.exe
  C:\Windows\System\oluEyhJ.exe
  2⤵
  PID:10772
- C:\Windows\System\VRVSXir.exe
  C:\Windows\System\VRVSXir.exe
  2⤵
  PID:10788
- C:\Windows\System\PjVzIlb.exe
  C:\Windows\System\PjVzIlb.exe
  2⤵
  PID:10816
- C:\Windows\System\ueKOeuM.exe
  C:\Windows\System\ueKOeuM.exe
  2⤵
  PID:10840
- C:\Windows\System\uVCLqTd.exe
  C:\Windows\System\uVCLqTd.exe
  2⤵
  PID:10872
- C:\Windows\System\QTfAhKr.exe
  C:\Windows\System\QTfAhKr.exe
  2⤵
  PID:10900
- C:\Windows\System\nwbXlYK.exe
  C:\Windows\System\nwbXlYK.exe
  2⤵
  PID:10928
- C:\Windows\System\PNAxXDP.exe
  C:\Windows\System\PNAxXDP.exe
  2⤵
  PID:10956
- C:\Windows\System\VLbMcMj.exe
  C:\Windows\System\VLbMcMj.exe
  2⤵
  PID:10984
- C:\Windows\System\SZWlpzF.exe
  C:\Windows\System\SZWlpzF.exe
  2⤵
  PID:11012
- C:\Windows\System\ubpNcyD.exe
  C:\Windows\System\ubpNcyD.exe
  2⤵
  PID:11036
- C:\Windows\System\cSyHobD.exe
  C:\Windows\System\cSyHobD.exe
  2⤵
  PID:11068
- C:\Windows\System\QGowaFw.exe
  C:\Windows\System\QGowaFw.exe
  2⤵
  PID:11096
- C:\Windows\System\UQywRzU.exe
  C:\Windows\System\UQywRzU.exe
  2⤵
  PID:11124
- C:\Windows\System\QuJhSvH.exe
  C:\Windows\System\QuJhSvH.exe
  2⤵
  PID:11152
- C:\Windows\System\HhigMEd.exe
  C:\Windows\System\HhigMEd.exe
  2⤵
  PID:11172
- C:\Windows\System\mWvApVa.exe
  C:\Windows\System\mWvApVa.exe
  2⤵
  PID:11200
- C:\Windows\System\QdPGSbi.exe
  C:\Windows\System\QdPGSbi.exe
  2⤵
  PID:11228
- C:\Windows\System\AcJdkXR.exe
  C:\Windows\System\AcJdkXR.exe
  2⤵
  PID:9968
- C:\Windows\System\TvJGsSa.exe
  C:\Windows\System\TvJGsSa.exe
  2⤵
  PID:9960
- C:\Windows\System\DxzHJIl.exe
  C:\Windows\System\DxzHJIl.exe
  2⤵
  PID:10272
- C:\Windows\System\OTVUKeK.exe
  C:\Windows\System\OTVUKeK.exe
  2⤵
  PID:10316
- C:\Windows\System\tvVEBwl.exe
  C:\Windows\System\tvVEBwl.exe
  2⤵
  PID:10372
- C:\Windows\System\AjUnhcb.exe
  C:\Windows\System\AjUnhcb.exe
  2⤵
  PID:10440
- C:\Windows\System\FDUawxE.exe
  C:\Windows\System\FDUawxE.exe
  2⤵
  PID:10496
- C:\Windows\System\tmlFmuQ.exe
  C:\Windows\System\tmlFmuQ.exe
  2⤵
  PID:10520
- C:\Windows\System\EeASKWI.exe
  C:\Windows\System\EeASKWI.exe
  2⤵
  PID:10604
- C:\Windows\System\EoZaiEc.exe
  C:\Windows\System\EoZaiEc.exe
  2⤵
  PID:10688
- C:\Windows\System\OtReXYU.exe
  C:\Windows\System\OtReXYU.exe
  2⤵
  PID:10760
- C:\Windows\System\QblZyyu.exe
  C:\Windows\System\QblZyyu.exe
  2⤵
  PID:10832
- C:\Windows\System\RyieIBP.exe
  C:\Windows\System\RyieIBP.exe
  2⤵
  PID:10868
- C:\Windows\System\oBQsNfK.exe
  C:\Windows\System\oBQsNfK.exe
  2⤵
  PID:10980
- C:\Windows\System\jUshJbO.exe
  C:\Windows\System\jUshJbO.exe
  2⤵
  PID:11056
- C:\Windows\System\ASkEUfH.exe
  C:\Windows\System\ASkEUfH.exe
  2⤵
  PID:11084
- C:\Windows\System\ANDdUQT.exe
  C:\Windows\System\ANDdUQT.exe
  2⤵
  PID:11136
- C:\Windows\System\mtBMJYk.exe
  C:\Windows\System\mtBMJYk.exe
  2⤵
  PID:11212
- C:\Windows\System\yJKMaQS.exe
  C:\Windows\System\yJKMaQS.exe
  2⤵
  PID:10280
- C:\Windows\System\EYFqNpI.exe
  C:\Windows\System\EYFqNpI.exe
  2⤵
  PID:10488
- C:\Windows\System\yzNBKfV.exe
  C:\Windows\System\yzNBKfV.exe
  2⤵
  PID:10640
- C:\Windows\System\uvdkfag.exe
  C:\Windows\System\uvdkfag.exe
  2⤵
  PID:10860
- C:\Windows\System\LNvfXwe.exe
  C:\Windows\System\LNvfXwe.exe
  2⤵
  PID:10828
- C:\Windows\System\idOtQUo.exe
  C:\Windows\System\idOtQUo.exe
  2⤵
  PID:11140
- C:\Windows\System\BJmjuYK.exe
  C:\Windows\System\BJmjuYK.exe
  2⤵
  PID:10136
- C:\Windows\System\NcHpPcu.exe
  C:\Windows\System\NcHpPcu.exe
  2⤵
  PID:10344
- C:\Windows\System\fFccads.exe
  C:\Windows\System\fFccads.exe
  2⤵
  PID:11060
- C:\Windows\System\tnzVlOA.exe
  C:\Windows\System\tnzVlOA.exe
  2⤵
  PID:10492
- C:\Windows\System\ZIWwHCi.exe
  C:\Windows\System\ZIWwHCi.exe
  2⤵
  PID:10800
- C:\Windows\System\GxyilRf.exe
  C:\Windows\System\GxyilRf.exe
  2⤵
  PID:11292
- C:\Windows\System\QsWsRbB.exe
  C:\Windows\System\QsWsRbB.exe
  2⤵
  PID:11320
- C:\Windows\System\aoNVjOB.exe
  C:\Windows\System\aoNVjOB.exe
  2⤵
  PID:11340
- C:\Windows\System\xieujaI.exe
  C:\Windows\System\xieujaI.exe
  2⤵
  PID:11372
- C:\Windows\System\xZItTte.exe
  C:\Windows\System\xZItTte.exe
  2⤵
  PID:11404
- C:\Windows\System\ZcnCDpG.exe
  C:\Windows\System\ZcnCDpG.exe
  2⤵
  PID:11424
- C:\Windows\System\AmvFOBk.exe
  C:\Windows\System\AmvFOBk.exe
  2⤵
  PID:11448
- C:\Windows\System\qVnlOur.exe
  C:\Windows\System\qVnlOur.exe
  2⤵
  PID:11476
- C:\Windows\System\AzeDFPG.exe
  C:\Windows\System\AzeDFPG.exe
  2⤵
  PID:11512
- C:\Windows\System\ydPMSpr.exe
  C:\Windows\System\ydPMSpr.exe
  2⤵
  PID:11528
- C:\Windows\System\wLkHWkG.exe
  C:\Windows\System\wLkHWkG.exe
  2⤵
  PID:11548
- C:\Windows\System\QGhlPzO.exe
  C:\Windows\System\QGhlPzO.exe
  2⤵
  PID:11568
- C:\Windows\System\BDmiELv.exe
  C:\Windows\System\BDmiELv.exe
  2⤵
  PID:11592

Analysis

Sharing

General

Malware Config

Signatures

Processes