xmrig | 34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
Size

1.3MB
MD5

506d2994c83a74901b2ee2141eacdcc9
SHA1

dd14409888a2f5d0d60ad2ebc5892455c57ccd54
SHA256

34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226
SHA512

34dd6a067244b43eac03fe3ca41a6f7e304085114b0acbdf97d8c21d5a2a7274debbf40785f1127e7a336c22f5027edc69813357c5cd9a06449208dba350b4dc
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbca:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5Q

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0007000000012117-2.dat	xmrig
behavioral1/files/0x0008000000016115-6.dat	xmrig
behavioral1/files/0x000800000001642d-18.dat	xmrig
behavioral1/files/0x0007000000016d5e-42.dat	xmrig
behavioral1/files/0x0006000000016d89-61.dat	xmrig
behavioral1/files/0x0006000000017079-71.dat	xmrig
behavioral1/files/0x00060000000174cc-98.dat	xmrig
behavioral1/files/0x00050000000186e4-110.dat	xmrig
behavioral1/files/0x0005000000018784-134.dat	xmrig
behavioral1/files/0x00050000000187a5-142.dat	xmrig
behavioral1/files/0x000500000001878f-138.dat	xmrig
behavioral1/files/0x000500000001873d-130.dat	xmrig
behavioral1/files/0x0005000000018728-127.dat	xmrig
behavioral1/files/0x00050000000186ee-126.dat	xmrig
behavioral1/files/0x00050000000186fd-121.dat	xmrig
behavioral1/files/0x00050000000186ea-114.dat	xmrig
behavioral1/files/0x0005000000018683-106.dat	xmrig
behavioral1/files/0x000d000000018676-102.dat	xmrig
behavioral1/files/0x0006000000017492-94.dat	xmrig
behavioral1/files/0x0006000000017488-90.dat	xmrig
behavioral1/files/0x00060000000173a9-86.dat	xmrig
behavioral1/files/0x00060000000171a8-79.dat	xmrig
behavioral1/files/0x00060000000173a7-82.dat	xmrig
behavioral1/files/0x0006000000016fdf-67.dat	xmrig
behavioral1/files/0x0006000000016d6d-58.dat	xmrig
behavioral1/files/0x0006000000016d68-52.dat	xmrig
behavioral1/files/0x0006000000016d64-48.dat	xmrig
behavioral1/files/0x0008000000016d29-39.dat	xmrig
behavioral1/files/0x0007000000016a66-34.dat	xmrig
behavioral1/files/0x0007000000016814-28.dat	xmrig
behavioral1/files/0x00070000000165c2-23.dat	xmrig
behavioral1/files/0x00080000000162b2-14.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2556	KcAWZcH.exe
2408	KDZzBPm.exe
1264	YLQXmIR.exe
2124	qcSFqgq.exe
2692	TSczfGQ.exe
2708	CbIMDFX.exe
2864	SfmBCHe.exe
2876	YojVVVo.exe
2724	PzkCRLH.exe
2892	KiicYZQ.exe
2760	APFsDsw.exe
2624	cQUaZBQ.exe
2768	ayWzosb.exe
2596	aKCQuuD.exe
2660	VeIjYvk.exe
1876	MgEQxcB.exe
2440	MhHDeCV.exe
1940	ZCFjFxp.exe
2812	aBccFPY.exe
560	hDRbdMA.exe
2796	eCUPXWk.exe
2816	GgsLKwO.exe
2840	fhnmIGk.exe
2836	oIUheke.exe
2968	nLaEXCE.exe
2308	WDkkvTr.exe
1564	FvpNRxw.exe
2072	yLPNMTV.exe
2396	hCpvNLz.exe
536	JFQeHeh.exe
1632	IOWFolp.exe
2312	bmsLTfC.exe
2980	lGQfmPA.exe
1028	GJVUSxI.exe
2068	uasZXsm.exe
1608	HrkqXCf.exe
448	NfnWwDj.exe
352	BvdifQK.exe
3036	ulWXwZW.exe
2580	XArsoxQ.exe
1284	pjKVLPz.exe
1664	fqKbxtz.exe
1372	ogFwtgJ.exe
2148	lHWRniD.exe
2468	QmnxQyT.exe
1684	PhYGSsW.exe
1528	KLYeiMy.exe
2460	eXULOqO.exe
2224	iXJelDU.exe
1756	fukSnKL.exe
768	jqZWgky.exe
2136	uJKPtch.exe
2188	uipiodG.exe
2152	YDTDsIY.exe
2464	KIWxRrk.exe
1884	tVPuSMS.exe
1796	ffsWaNO.exe
2316	LhbvKdP.exe
2192	OWKnRvC.exe
2248	kFCOjKm.exe
2444	NAKoLZk.exe
2524	uyhgqAT.exe
468	YbQKfna.exe
1872	XsXEBGf.exe

Loads dropped DLL 64 IoCs

pid	Process
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fqsCaic.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\QQFijHs.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\ZepQlbK.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\aaztjwU.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\xvUbIZS.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\DUbHbkB.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\wyzpCbo.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\YJPnPgK.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\NbbYbrH.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\ESleVsb.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\yEtKFwv.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\vFyYjhd.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\vjYNdfh.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\srwkqSB.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\gnIbzdL.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\IBIwlTc.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\jNhABfO.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\QLQCIkv.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\DdcVFYD.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\LYCehmx.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\mdSALFc.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\QtUTeGp.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\YMUiagi.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\DnoUhVo.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\pxBYVcr.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\ndMxxxl.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\PWUFPJO.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\qMMWxTC.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\vvlTyhy.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\NwkZRtJ.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\SyzxwDj.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\RfzpeQq.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\eaGaxLH.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\utbuzDV.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\SXPPkZc.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\HkmIcIB.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\vImOyta.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\YdVjyoe.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\ccMMDeT.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\MkIYDGY.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\oqToBOl.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\oUFmeRG.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\uaKmWCf.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\sZwDlNW.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\rJzKZtq.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\zszpSAb.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\TEQJLUv.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\WlqdoFN.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\GvpYVrT.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\GsdUMQB.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\QVqshwE.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\QYvApzD.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\aRhyrQF.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\BXDVmVj.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\kGoTMKw.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\RdATYtq.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\eCwuJHS.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\JXCvHko.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\YcaKQhR.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\FzNhaWh.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\YxvFYBn.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\vsrVKBg.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\sHCmFah.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
File created	C:\Windows\System\FtBrzhj.exe	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2556	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	31
PID 1044 wrote to memory of 2556	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	31
PID 1044 wrote to memory of 2556	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	31
PID 1044 wrote to memory of 2408	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	32
PID 1044 wrote to memory of 2408	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	32
PID 1044 wrote to memory of 2408	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	32
PID 1044 wrote to memory of 1264	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	33
PID 1044 wrote to memory of 1264	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	33
PID 1044 wrote to memory of 1264	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	33
PID 1044 wrote to memory of 2124	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	34
PID 1044 wrote to memory of 2124	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	34
PID 1044 wrote to memory of 2124	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	34
PID 1044 wrote to memory of 2692	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	35
PID 1044 wrote to memory of 2692	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	35
PID 1044 wrote to memory of 2692	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	35
PID 1044 wrote to memory of 2708	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	36
PID 1044 wrote to memory of 2708	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	36
PID 1044 wrote to memory of 2708	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	36
PID 1044 wrote to memory of 2864	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	37
PID 1044 wrote to memory of 2864	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	37
PID 1044 wrote to memory of 2864	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	37
PID 1044 wrote to memory of 2876	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	38
PID 1044 wrote to memory of 2876	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	38
PID 1044 wrote to memory of 2876	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	38
PID 1044 wrote to memory of 2724	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	39
PID 1044 wrote to memory of 2724	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	39
PID 1044 wrote to memory of 2724	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	39
PID 1044 wrote to memory of 2892	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	40
PID 1044 wrote to memory of 2892	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	40
PID 1044 wrote to memory of 2892	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	40
PID 1044 wrote to memory of 2760	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	41
PID 1044 wrote to memory of 2760	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	41
PID 1044 wrote to memory of 2760	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	41
PID 1044 wrote to memory of 2624	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	42
PID 1044 wrote to memory of 2624	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	42
PID 1044 wrote to memory of 2624	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	42
PID 1044 wrote to memory of 2768	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	43
PID 1044 wrote to memory of 2768	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	43
PID 1044 wrote to memory of 2768	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	43
PID 1044 wrote to memory of 2596	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	44
PID 1044 wrote to memory of 2596	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	44
PID 1044 wrote to memory of 2596	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	44
PID 1044 wrote to memory of 2660	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	45
PID 1044 wrote to memory of 2660	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	45
PID 1044 wrote to memory of 2660	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	45
PID 1044 wrote to memory of 1876	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	46
PID 1044 wrote to memory of 1876	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	46
PID 1044 wrote to memory of 1876	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	46
PID 1044 wrote to memory of 2440	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	47
PID 1044 wrote to memory of 2440	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	47
PID 1044 wrote to memory of 2440	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	47
PID 1044 wrote to memory of 1940	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	48
PID 1044 wrote to memory of 1940	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	48
PID 1044 wrote to memory of 1940	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	48
PID 1044 wrote to memory of 2812	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	49
PID 1044 wrote to memory of 2812	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	49
PID 1044 wrote to memory of 2812	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	49
PID 1044 wrote to memory of 560	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	50
PID 1044 wrote to memory of 560	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	50
PID 1044 wrote to memory of 560	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	50
PID 1044 wrote to memory of 2796	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	51
PID 1044 wrote to memory of 2796	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	51
PID 1044 wrote to memory of 2796	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	51
PID 1044 wrote to memory of 2816	1044	34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe	52

C:\Users\Admin\AppData\Local\Temp\34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe
"C:\Users\Admin\AppData\Local\Temp\34aab235bb6c2f56a7fdfd66f641c0bdbc33595b009ba658857216681d884226.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\System\KcAWZcH.exe
  C:\Windows\System\KcAWZcH.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\KDZzBPm.exe
  C:\Windows\System\KDZzBPm.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\YLQXmIR.exe
  C:\Windows\System\YLQXmIR.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\qcSFqgq.exe
  C:\Windows\System\qcSFqgq.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\TSczfGQ.exe
  C:\Windows\System\TSczfGQ.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\CbIMDFX.exe
  C:\Windows\System\CbIMDFX.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\SfmBCHe.exe
  C:\Windows\System\SfmBCHe.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\YojVVVo.exe
  C:\Windows\System\YojVVVo.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\PzkCRLH.exe
  C:\Windows\System\PzkCRLH.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\KiicYZQ.exe
  C:\Windows\System\KiicYZQ.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\APFsDsw.exe
  C:\Windows\System\APFsDsw.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\cQUaZBQ.exe
  C:\Windows\System\cQUaZBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\ayWzosb.exe
  C:\Windows\System\ayWzosb.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\aKCQuuD.exe
  C:\Windows\System\aKCQuuD.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\VeIjYvk.exe
  C:\Windows\System\VeIjYvk.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\MgEQxcB.exe
  C:\Windows\System\MgEQxcB.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\MhHDeCV.exe
  C:\Windows\System\MhHDeCV.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\ZCFjFxp.exe
  C:\Windows\System\ZCFjFxp.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\aBccFPY.exe
  C:\Windows\System\aBccFPY.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\hDRbdMA.exe
  C:\Windows\System\hDRbdMA.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\eCUPXWk.exe
  C:\Windows\System\eCUPXWk.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\GgsLKwO.exe
  C:\Windows\System\GgsLKwO.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\fhnmIGk.exe
  C:\Windows\System\fhnmIGk.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\oIUheke.exe
  C:\Windows\System\oIUheke.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\nLaEXCE.exe
  C:\Windows\System\nLaEXCE.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\FvpNRxw.exe
  C:\Windows\System\FvpNRxw.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\WDkkvTr.exe
  C:\Windows\System\WDkkvTr.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\yLPNMTV.exe
  C:\Windows\System\yLPNMTV.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\hCpvNLz.exe
  C:\Windows\System\hCpvNLz.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\JFQeHeh.exe
  C:\Windows\System\JFQeHeh.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\IOWFolp.exe
  C:\Windows\System\IOWFolp.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\bmsLTfC.exe
  C:\Windows\System\bmsLTfC.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\lGQfmPA.exe
  C:\Windows\System\lGQfmPA.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\GJVUSxI.exe
  C:\Windows\System\GJVUSxI.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\uasZXsm.exe
  C:\Windows\System\uasZXsm.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\HrkqXCf.exe
  C:\Windows\System\HrkqXCf.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\NfnWwDj.exe
  C:\Windows\System\NfnWwDj.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\BvdifQK.exe
  C:\Windows\System\BvdifQK.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\ulWXwZW.exe
  C:\Windows\System\ulWXwZW.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\XArsoxQ.exe
  C:\Windows\System\XArsoxQ.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\pjKVLPz.exe
  C:\Windows\System\pjKVLPz.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\fqKbxtz.exe
  C:\Windows\System\fqKbxtz.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\ogFwtgJ.exe
  C:\Windows\System\ogFwtgJ.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\lHWRniD.exe
  C:\Windows\System\lHWRniD.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\QmnxQyT.exe
  C:\Windows\System\QmnxQyT.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\PhYGSsW.exe
  C:\Windows\System\PhYGSsW.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\KLYeiMy.exe
  C:\Windows\System\KLYeiMy.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\eXULOqO.exe
  C:\Windows\System\eXULOqO.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\iXJelDU.exe
  C:\Windows\System\iXJelDU.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\fukSnKL.exe
  C:\Windows\System\fukSnKL.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\jqZWgky.exe
  C:\Windows\System\jqZWgky.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\uJKPtch.exe
  C:\Windows\System\uJKPtch.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\uipiodG.exe
  C:\Windows\System\uipiodG.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\YDTDsIY.exe
  C:\Windows\System\YDTDsIY.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\KIWxRrk.exe
  C:\Windows\System\KIWxRrk.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\tVPuSMS.exe
  C:\Windows\System\tVPuSMS.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\ffsWaNO.exe
  C:\Windows\System\ffsWaNO.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\LhbvKdP.exe
  C:\Windows\System\LhbvKdP.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\OWKnRvC.exe
  C:\Windows\System\OWKnRvC.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\kFCOjKm.exe
  C:\Windows\System\kFCOjKm.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\NAKoLZk.exe
  C:\Windows\System\NAKoLZk.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\uyhgqAT.exe
  C:\Windows\System\uyhgqAT.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\YbQKfna.exe
  C:\Windows\System\YbQKfna.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\XsXEBGf.exe
  C:\Windows\System\XsXEBGf.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\HXZhUXk.exe
  C:\Windows\System\HXZhUXk.exe
  2⤵
  PID:1864
- C:\Windows\System\YMBqmPo.exe
  C:\Windows\System\YMBqmPo.exe
  2⤵
  PID:2784
- C:\Windows\System\dhUUPFV.exe
  C:\Windows\System\dhUUPFV.exe
  2⤵
  PID:2748
- C:\Windows\System\WNfUdEq.exe
  C:\Windows\System\WNfUdEq.exe
  2⤵
  PID:2752
- C:\Windows\System\HTFnbse.exe
  C:\Windows\System\HTFnbse.exe
  2⤵
  PID:1900
- C:\Windows\System\CaHdsgo.exe
  C:\Windows\System\CaHdsgo.exe
  2⤵
  PID:1712
- C:\Windows\System\UZCWLds.exe
  C:\Windows\System\UZCWLds.exe
  2⤵
  PID:2884
- C:\Windows\System\WRxawpc.exe
  C:\Windows\System\WRxawpc.exe
  2⤵
  PID:2908
- C:\Windows\System\YcaKQhR.exe
  C:\Windows\System\YcaKQhR.exe
  2⤵
  PID:2644
- C:\Windows\System\qiHcvfh.exe
  C:\Windows\System\qiHcvfh.exe
  2⤵
  PID:2056
- C:\Windows\System\YtXFCnr.exe
  C:\Windows\System\YtXFCnr.exe
  2⤵
  PID:648
- C:\Windows\System\wQpcuWx.exe
  C:\Windows\System\wQpcuWx.exe
  2⤵
  PID:868
- C:\Windows\System\TXPdNhG.exe
  C:\Windows\System\TXPdNhG.exe
  2⤵
  PID:2956
- C:\Windows\System\IpFiVTR.exe
  C:\Windows\System\IpFiVTR.exe
  2⤵
  PID:2844
- C:\Windows\System\QqTsafC.exe
  C:\Windows\System\QqTsafC.exe
  2⤵
  PID:2792
- C:\Windows\System\GzxjQti.exe
  C:\Windows\System\GzxjQti.exe
  2⤵
  PID:1800
- C:\Windows\System\JOaIoay.exe
  C:\Windows\System\JOaIoay.exe
  2⤵
  PID:332
- C:\Windows\System\FBVEOPa.exe
  C:\Windows\System\FBVEOPa.exe
  2⤵
  PID:2528
- C:\Windows\System\ISnOIzB.exe
  C:\Windows\System\ISnOIzB.exe
  2⤵
  PID:876
- C:\Windows\System\nGqGlPX.exe
  C:\Windows\System\nGqGlPX.exe
  2⤵
  PID:1240
- C:\Windows\System\EYcYPJU.exe
  C:\Windows\System\EYcYPJU.exe
  2⤵
  PID:1916
- C:\Windows\System\iUJGpzs.exe
  C:\Windows\System\iUJGpzs.exe
  2⤵
  PID:3044
- C:\Windows\System\RMuycif.exe
  C:\Windows\System\RMuycif.exe
  2⤵
  PID:2488
- C:\Windows\System\YGGsaRd.exe
  C:\Windows\System\YGGsaRd.exe
  2⤵
  PID:1952
- C:\Windows\System\cFPwxHg.exe
  C:\Windows\System\cFPwxHg.exe
  2⤵
  PID:1352
- C:\Windows\System\xakllqm.exe
  C:\Windows\System\xakllqm.exe
  2⤵
  PID:1768
- C:\Windows\System\lDUYTNt.exe
  C:\Windows\System\lDUYTNt.exe
  2⤵
  PID:1760
- C:\Windows\System\iInyFag.exe
  C:\Windows\System\iInyFag.exe
  2⤵
  PID:1636
- C:\Windows\System\xonlfNd.exe
  C:\Windows\System\xonlfNd.exe
  2⤵
  PID:2412
- C:\Windows\System\cKKbVxU.exe
  C:\Windows\System\cKKbVxU.exe
  2⤵
  PID:2364
- C:\Windows\System\ngngomX.exe
  C:\Windows\System\ngngomX.exe
  2⤵
  PID:1496
- C:\Windows\System\bpwHexB.exe
  C:\Windows\System\bpwHexB.exe
  2⤵
  PID:2076
- C:\Windows\System\khLLAWj.exe
  C:\Windows\System\khLLAWj.exe
  2⤵
  PID:1652
- C:\Windows\System\KbcheXi.exe
  C:\Windows\System\KbcheXi.exe
  2⤵
  PID:2096
- C:\Windows\System\qzgRHyu.exe
  C:\Windows\System\qzgRHyu.exe
  2⤵
  PID:1624
- C:\Windows\System\EDXzVGq.exe
  C:\Windows\System\EDXzVGq.exe
  2⤵
  PID:2028
- C:\Windows\System\ajVTFVm.exe
  C:\Windows\System\ajVTFVm.exe
  2⤵
  PID:2536
- C:\Windows\System\GJaNLbO.exe
  C:\Windows\System\GJaNLbO.exe
  2⤵
  PID:1560
- C:\Windows\System\onrEStU.exe
  C:\Windows\System\onrEStU.exe
  2⤵
  PID:1860
- C:\Windows\System\clQgDSE.exe
  C:\Windows\System\clQgDSE.exe
  2⤵
  PID:2352
- C:\Windows\System\OSUJqAb.exe
  C:\Windows\System\OSUJqAb.exe
  2⤵
  PID:2564
- C:\Windows\System\fpxwBzm.exe
  C:\Windows\System\fpxwBzm.exe
  2⤵
  PID:2852
- C:\Windows\System\BRYuViW.exe
  C:\Windows\System\BRYuViW.exe
  2⤵
  PID:3020
- C:\Windows\System\UIPDSty.exe
  C:\Windows\System\UIPDSty.exe
  2⤵
  PID:2900
- C:\Windows\System\oQHntsz.exe
  C:\Windows\System\oQHntsz.exe
  2⤵
  PID:2540
- C:\Windows\System\pBHLGfl.exe
  C:\Windows\System\pBHLGfl.exe
  2⤵
  PID:1444
- C:\Windows\System\zPZhSkv.exe
  C:\Windows\System\zPZhSkv.exe
  2⤵
  PID:840
- C:\Windows\System\dlmyzCF.exe
  C:\Windows\System\dlmyzCF.exe
  2⤵
  PID:2356
- C:\Windows\System\QrbdWnY.exe
  C:\Windows\System\QrbdWnY.exe
  2⤵
  PID:2064
- C:\Windows\System\ZVnqoeA.exe
  C:\Windows\System\ZVnqoeA.exe
  2⤵
  PID:2696
- C:\Windows\System\gLjiXpw.exe
  C:\Windows\System\gLjiXpw.exe
  2⤵
  PID:1932
- C:\Windows\System\poBoAwa.exe
  C:\Windows\System\poBoAwa.exe
  2⤵
  PID:1436
- C:\Windows\System\wyzpCbo.exe
  C:\Windows\System\wyzpCbo.exe
  2⤵
  PID:3040
- C:\Windows\System\peubmsZ.exe
  C:\Windows\System\peubmsZ.exe
  2⤵
  PID:1328
- C:\Windows\System\IwdZqmk.exe
  C:\Windows\System\IwdZqmk.exe
  2⤵
  PID:1660
- C:\Windows\System\vjYNdfh.exe
  C:\Windows\System\vjYNdfh.exe
  2⤵
  PID:772
- C:\Windows\System\gfedovn.exe
  C:\Windows\System\gfedovn.exe
  2⤵
  PID:2004
- C:\Windows\System\DOrEIlW.exe
  C:\Windows\System\DOrEIlW.exe
  2⤵
  PID:2680
- C:\Windows\System\GNeUCof.exe
  C:\Windows\System\GNeUCof.exe
  2⤵
  PID:2180
- C:\Windows\System\AMaDZju.exe
  C:\Windows\System\AMaDZju.exe
  2⤵
  PID:2392
- C:\Windows\System\YyGEYYC.exe
  C:\Windows\System\YyGEYYC.exe
  2⤵
  PID:3008
- C:\Windows\System\AgPBhtU.exe
  C:\Windows\System\AgPBhtU.exe
  2⤵
  PID:1720
- C:\Windows\System\FkrWSgM.exe
  C:\Windows\System\FkrWSgM.exe
  2⤵
  PID:2168
- C:\Windows\System\nOUuFnP.exe
  C:\Windows\System\nOUuFnP.exe
  2⤵
  PID:2888
- C:\Windows\System\HWyDCaa.exe
  C:\Windows\System\HWyDCaa.exe
  2⤵
  PID:2860
- C:\Windows\System\maveNau.exe
  C:\Windows\System\maveNau.exe
  2⤵
  PID:2616
- C:\Windows\System\oPLHXfF.exe
  C:\Windows\System\oPLHXfF.exe
  2⤵
  PID:2688
- C:\Windows\System\RwkTVpI.exe
  C:\Windows\System\RwkTVpI.exe
  2⤵
  PID:700
- C:\Windows\System\dxIYqRg.exe
  C:\Windows\System\dxIYqRg.exe
  2⤵
  PID:1476
- C:\Windows\System\ZUaWWCj.exe
  C:\Windows\System\ZUaWWCj.exe
  2⤵
  PID:2988
- C:\Windows\System\VBneOwA.exe
  C:\Windows\System\VBneOwA.exe
  2⤵
  PID:1776
- C:\Windows\System\VSwFPvk.exe
  C:\Windows\System\VSwFPvk.exe
  2⤵
  PID:2880
- C:\Windows\System\vYQGUIx.exe
  C:\Windows\System\vYQGUIx.exe
  2⤵
  PID:3048
- C:\Windows\System\LALSlsW.exe
  C:\Windows\System\LALSlsW.exe
  2⤵
  PID:2384
- C:\Windows\System\FoTXTda.exe
  C:\Windows\System\FoTXTda.exe
  2⤵
  PID:1584
- C:\Windows\System\GGeyRfN.exe
  C:\Windows\System\GGeyRfN.exe
  2⤵
  PID:2008
- C:\Windows\System\mUHtQEt.exe
  C:\Windows\System\mUHtQEt.exe
  2⤵
  PID:1288
- C:\Windows\System\FCcnVYN.exe
  C:\Windows\System\FCcnVYN.exe
  2⤵
  PID:1544
- C:\Windows\System\ztjAuzW.exe
  C:\Windows\System\ztjAuzW.exe
  2⤵
  PID:2720
- C:\Windows\System\SIMwmgf.exe
  C:\Windows\System\SIMwmgf.exe
  2⤵
  PID:2328
- C:\Windows\System\UNidLOt.exe
  C:\Windows\System\UNidLOt.exe
  2⤵
  PID:1948
- C:\Windows\System\ikvfjPD.exe
  C:\Windows\System\ikvfjPD.exe
  2⤵
  PID:872
- C:\Windows\System\fnghvyG.exe
  C:\Windows\System\fnghvyG.exe
  2⤵
  PID:2628
- C:\Windows\System\QYvApzD.exe
  C:\Windows\System\QYvApzD.exe
  2⤵
  PID:2744
- C:\Windows\System\PGCrKHj.exe
  C:\Windows\System\PGCrKHj.exe
  2⤵
  PID:2868
- C:\Windows\System\kmSAivX.exe
  C:\Windows\System\kmSAivX.exe
  2⤵
  PID:2208
- C:\Windows\System\bxitKbJ.exe
  C:\Windows\System\bxitKbJ.exe
  2⤵
  PID:1140
- C:\Windows\System\RxuaROM.exe
  C:\Windows\System\RxuaROM.exe
  2⤵
  PID:2712
- C:\Windows\System\xXcTkbh.exe
  C:\Windows\System\xXcTkbh.exe
  2⤵
  PID:2612
- C:\Windows\System\NBtmlxv.exe
  C:\Windows\System\NBtmlxv.exe
  2⤵
  PID:2728
- C:\Windows\System\eIxSjpo.exe
  C:\Windows\System\eIxSjpo.exe
  2⤵
  PID:3088
- C:\Windows\System\toLyblB.exe
  C:\Windows\System\toLyblB.exe
  2⤵
  PID:3104
- C:\Windows\System\mvHbnif.exe
  C:\Windows\System\mvHbnif.exe
  2⤵
  PID:3128
- C:\Windows\System\aVQjFYm.exe
  C:\Windows\System\aVQjFYm.exe
  2⤵
  PID:3160
- C:\Windows\System\aDRiSDM.exe
  C:\Windows\System\aDRiSDM.exe
  2⤵
  PID:3212
- C:\Windows\System\TSrJndb.exe
  C:\Windows\System\TSrJndb.exe
  2⤵
  PID:3276
- C:\Windows\System\ZeCkMqI.exe
  C:\Windows\System\ZeCkMqI.exe
  2⤵
  PID:3292
- C:\Windows\System\YZxQNTI.exe
  C:\Windows\System\YZxQNTI.exe
  2⤵
  PID:3308
- C:\Windows\System\DOeTKWq.exe
  C:\Windows\System\DOeTKWq.exe
  2⤵
  PID:3324
- C:\Windows\System\NmODPnT.exe
  C:\Windows\System\NmODPnT.exe
  2⤵
  PID:3344
- C:\Windows\System\wfFeOVC.exe
  C:\Windows\System\wfFeOVC.exe
  2⤵
  PID:3360
- C:\Windows\System\eaPjTuQ.exe
  C:\Windows\System\eaPjTuQ.exe
  2⤵
  PID:3376
- C:\Windows\System\MdPRBWF.exe
  C:\Windows\System\MdPRBWF.exe
  2⤵
  PID:3392
- C:\Windows\System\ZGKKtaA.exe
  C:\Windows\System\ZGKKtaA.exe
  2⤵
  PID:3412
- C:\Windows\System\FKWFjFA.exe
  C:\Windows\System\FKWFjFA.exe
  2⤵
  PID:3428
- C:\Windows\System\tgWvxLm.exe
  C:\Windows\System\tgWvxLm.exe
  2⤵
  PID:3444
- C:\Windows\System\WmFVcrP.exe
  C:\Windows\System\WmFVcrP.exe
  2⤵
  PID:3460
- C:\Windows\System\OXxFtFS.exe
  C:\Windows\System\OXxFtFS.exe
  2⤵
  PID:3476
- C:\Windows\System\OKSyYUi.exe
  C:\Windows\System\OKSyYUi.exe
  2⤵
  PID:3492
- C:\Windows\System\GEqYiWS.exe
  C:\Windows\System\GEqYiWS.exe
  2⤵
  PID:3508
- C:\Windows\System\DhvbYMi.exe
  C:\Windows\System\DhvbYMi.exe
  2⤵
  PID:3524
- C:\Windows\System\ljKUilH.exe
  C:\Windows\System\ljKUilH.exe
  2⤵
  PID:3540
- C:\Windows\System\OZgXwMO.exe
  C:\Windows\System\OZgXwMO.exe
  2⤵
  PID:3556
- C:\Windows\System\FoZHnky.exe
  C:\Windows\System\FoZHnky.exe
  2⤵
  PID:3572
- C:\Windows\System\ZhHARFV.exe
  C:\Windows\System\ZhHARFV.exe
  2⤵
  PID:3588
- C:\Windows\System\saRsPAO.exe
  C:\Windows\System\saRsPAO.exe
  2⤵
  PID:3604
- C:\Windows\System\PauJqIi.exe
  C:\Windows\System\PauJqIi.exe
  2⤵
  PID:3620
- C:\Windows\System\trtwBcv.exe
  C:\Windows\System\trtwBcv.exe
  2⤵
  PID:3636
- C:\Windows\System\dDtgkqm.exe
  C:\Windows\System\dDtgkqm.exe
  2⤵
  PID:3652
- C:\Windows\System\ryjFktw.exe
  C:\Windows\System\ryjFktw.exe
  2⤵
  PID:3668
- C:\Windows\System\YFnkUXa.exe
  C:\Windows\System\YFnkUXa.exe
  2⤵
  PID:3684
- C:\Windows\System\MXaaVki.exe
  C:\Windows\System\MXaaVki.exe
  2⤵
  PID:3700
- C:\Windows\System\vQZabME.exe
  C:\Windows\System\vQZabME.exe
  2⤵
  PID:3724
- C:\Windows\System\TBKXLVs.exe
  C:\Windows\System\TBKXLVs.exe
  2⤵
  PID:3740
- C:\Windows\System\kVpWYul.exe
  C:\Windows\System\kVpWYul.exe
  2⤵
  PID:3756
- C:\Windows\System\qlRZxHu.exe
  C:\Windows\System\qlRZxHu.exe
  2⤵
  PID:3772
- C:\Windows\System\VHTGfij.exe
  C:\Windows\System\VHTGfij.exe
  2⤵
  PID:3788
- C:\Windows\System\kxEYwfM.exe
  C:\Windows\System\kxEYwfM.exe
  2⤵
  PID:3804
- C:\Windows\System\CrYBkKS.exe
  C:\Windows\System\CrYBkKS.exe
  2⤵
  PID:3820
- C:\Windows\System\KYzfgoY.exe
  C:\Windows\System\KYzfgoY.exe
  2⤵
  PID:3836
- C:\Windows\System\oNAPaxN.exe
  C:\Windows\System\oNAPaxN.exe
  2⤵
  PID:3852
- C:\Windows\System\kGNtfKk.exe
  C:\Windows\System\kGNtfKk.exe
  2⤵
  PID:3872
- C:\Windows\System\fItkhVh.exe
  C:\Windows\System\fItkhVh.exe
  2⤵
  PID:3892
- C:\Windows\System\aoVGKms.exe
  C:\Windows\System\aoVGKms.exe
  2⤵
  PID:3908
- C:\Windows\System\ZDYfhgS.exe
  C:\Windows\System\ZDYfhgS.exe
  2⤵
  PID:3924
- C:\Windows\System\owGSwMs.exe
  C:\Windows\System\owGSwMs.exe
  2⤵
  PID:3940
- C:\Windows\System\GOaydDY.exe
  C:\Windows\System\GOaydDY.exe
  2⤵
  PID:3956
- C:\Windows\System\CShytTM.exe
  C:\Windows\System\CShytTM.exe
  2⤵
  PID:3972
- C:\Windows\System\krhLARl.exe
  C:\Windows\System\krhLARl.exe
  2⤵
  PID:3988
- C:\Windows\System\IvHzhRm.exe
  C:\Windows\System\IvHzhRm.exe
  2⤵
  PID:4004
- C:\Windows\System\eLEnndZ.exe
  C:\Windows\System\eLEnndZ.exe
  2⤵
  PID:4020
- C:\Windows\System\ynXUGGn.exe
  C:\Windows\System\ynXUGGn.exe
  2⤵
  PID:4036
- C:\Windows\System\QniEqoo.exe
  C:\Windows\System\QniEqoo.exe
  2⤵
  PID:4052
- C:\Windows\System\CYJevfT.exe
  C:\Windows\System\CYJevfT.exe
  2⤵
  PID:4068
- C:\Windows\System\XHFZELq.exe
  C:\Windows\System\XHFZELq.exe
  2⤵
  PID:4084
- C:\Windows\System\XHETyfs.exe
  C:\Windows\System\XHETyfs.exe
  2⤵
  PID:2424
- C:\Windows\System\Ptnihrc.exe
  C:\Windows\System\Ptnihrc.exe
  2⤵
  PID:2156
- C:\Windows\System\NJBOTbS.exe
  C:\Windows\System\NJBOTbS.exe
  2⤵
  PID:3136
- C:\Windows\System\PErMQbT.exe
  C:\Windows\System\PErMQbT.exe
  2⤵
  PID:3148
- C:\Windows\System\yLMqQYt.exe
  C:\Windows\System\yLMqQYt.exe
  2⤵
  PID:2672
- C:\Windows\System\EtiwJdk.exe
  C:\Windows\System\EtiwJdk.exe
  2⤵
  PID:3220
- C:\Windows\System\TEQJLUv.exe
  C:\Windows\System\TEQJLUv.exe
  2⤵
  PID:3244
- C:\Windows\System\YGtuZFu.exe
  C:\Windows\System\YGtuZFu.exe
  2⤵
  PID:3260
- C:\Windows\System\zFtFHzp.exe
  C:\Windows\System\zFtFHzp.exe
  2⤵
  PID:3272
- C:\Windows\System\nVxNltb.exe
  C:\Windows\System\nVxNltb.exe
  2⤵
  PID:3120
- C:\Windows\System\cuAGyBo.exe
  C:\Windows\System\cuAGyBo.exe
  2⤵
  PID:3124
- C:\Windows\System\ZaFvblC.exe
  C:\Windows\System\ZaFvblC.exe
  2⤵
  PID:3180
- C:\Windows\System\MDuOJsG.exe
  C:\Windows\System\MDuOJsG.exe
  2⤵
  PID:3196
- C:\Windows\System\bquwZdG.exe
  C:\Windows\System\bquwZdG.exe
  2⤵
  PID:3288
- C:\Windows\System\snfYggO.exe
  C:\Windows\System\snfYggO.exe
  2⤵
  PID:3352
- C:\Windows\System\enywlKY.exe
  C:\Windows\System\enywlKY.exe
  2⤵
  PID:3420
- C:\Windows\System\Wcggvyq.exe
  C:\Windows\System\Wcggvyq.exe
  2⤵
  PID:756
- C:\Windows\System\yVFmZcf.exe
  C:\Windows\System\yVFmZcf.exe
  2⤵
  PID:3372
- C:\Windows\System\dnOTvcy.exe
  C:\Windows\System\dnOTvcy.exe
  2⤵
  PID:3408
- C:\Windows\System\rczOGYG.exe
  C:\Windows\System\rczOGYG.exe
  2⤵
  PID:3484
- C:\Windows\System\pNUxZOU.exe
  C:\Windows\System\pNUxZOU.exe
  2⤵
  PID:3548
- C:\Windows\System\rRIJZcg.exe
  C:\Windows\System\rRIJZcg.exe
  2⤵
  PID:3612
- C:\Windows\System\TtfFyhl.exe
  C:\Windows\System\TtfFyhl.exe
  2⤵
  PID:1120
- C:\Windows\System\niERlWs.exe
  C:\Windows\System\niERlWs.exe
  2⤵
  PID:3676
- C:\Windows\System\lERDHdh.exe
  C:\Windows\System\lERDHdh.exe
  2⤵
  PID:3748
- C:\Windows\System\ZQcOyfA.exe
  C:\Windows\System\ZQcOyfA.exe
  2⤵
  PID:3632
- C:\Windows\System\TZWKhBx.exe
  C:\Windows\System\TZWKhBx.exe
  2⤵
  PID:3696
- C:\Windows\System\gYXSLvi.exe
  C:\Windows\System\gYXSLvi.exe
  2⤵
  PID:3600
- C:\Windows\System\COVhImt.exe
  C:\Windows\System\COVhImt.exe
  2⤵
  PID:3536
- C:\Windows\System\eOFJUFb.exe
  C:\Windows\System\eOFJUFb.exe
  2⤵
  PID:3812
- C:\Windows\System\hzUHdOa.exe
  C:\Windows\System\hzUHdOa.exe
  2⤵
  PID:3768
- C:\Windows\System\yKixLpS.exe
  C:\Windows\System\yKixLpS.exe
  2⤵
  PID:3832
- C:\Windows\System\ZwEuyor.exe
  C:\Windows\System\ZwEuyor.exe
  2⤵
  PID:3764
- C:\Windows\System\MLxsOHm.exe
  C:\Windows\System\MLxsOHm.exe
  2⤵
  PID:3880
- C:\Windows\System\CKUAHIv.exe
  C:\Windows\System\CKUAHIv.exe
  2⤵
  PID:320
- C:\Windows\System\EzQiawg.exe
  C:\Windows\System\EzQiawg.exe
  2⤵
  PID:3920
- C:\Windows\System\Asxrtxc.exe
  C:\Windows\System\Asxrtxc.exe
  2⤵
  PID:3980
- C:\Windows\System\aARnYJn.exe
  C:\Windows\System\aARnYJn.exe
  2⤵
  PID:3964
- C:\Windows\System\AegHaRL.exe
  C:\Windows\System\AegHaRL.exe
  2⤵
  PID:4012
- C:\Windows\System\rKUjJWb.exe
  C:\Windows\System\rKUjJWb.exe
  2⤵
  PID:4044
- C:\Windows\System\ruWWVVN.exe
  C:\Windows\System\ruWWVVN.exe
  2⤵
  PID:4076
- C:\Windows\System\eYiazrS.exe
  C:\Windows\System\eYiazrS.exe
  2⤵
  PID:4060
- C:\Windows\System\JQXPnXF.exe
  C:\Windows\System\JQXPnXF.exe
  2⤵
  PID:2804
- C:\Windows\System\phPtArv.exe
  C:\Windows\System\phPtArv.exe
  2⤵
  PID:2764
- C:\Windows\System\HoHYyNP.exe
  C:\Windows\System\HoHYyNP.exe
  2⤵
  PID:2012
- C:\Windows\System\wQPaYUt.exe
  C:\Windows\System\wQPaYUt.exe
  2⤵
  PID:3156
- C:\Windows\System\akBlXpB.exe
  C:\Windows\System\akBlXpB.exe
  2⤵
  PID:3112
- C:\Windows\System\MaVTjPh.exe
  C:\Windows\System\MaVTjPh.exe
  2⤵
  PID:3300
- C:\Windows\System\zwtiBdv.exe
  C:\Windows\System\zwtiBdv.exe
  2⤵
  PID:3208
- C:\Windows\System\hQyWIRS.exe
  C:\Windows\System\hQyWIRS.exe
  2⤵
  PID:3192
- C:\Windows\System\ZHzqJbj.exe
  C:\Windows\System\ZHzqJbj.exe
  2⤵
  PID:3384
- C:\Windows\System\jvMhmHH.exe
  C:\Windows\System\jvMhmHH.exe
  2⤵
  PID:3456
- C:\Windows\System\LaEpyew.exe
  C:\Windows\System\LaEpyew.exe
  2⤵
  PID:3584
- C:\Windows\System\YdVjyoe.exe
  C:\Windows\System\YdVjyoe.exe
  2⤵
  PID:3400
- C:\Windows\System\RrpIVYh.exe
  C:\Windows\System\RrpIVYh.exe
  2⤵
  PID:3516
- C:\Windows\System\oqNyTPl.exe
  C:\Windows\System\oqNyTPl.exe
  2⤵
  PID:3720
- C:\Windows\System\eURPxBK.exe
  C:\Windows\System\eURPxBK.exe
  2⤵
  PID:3780
- C:\Windows\System\TvJRMkI.exe
  C:\Windows\System\TvJRMkI.exe
  2⤵
  PID:3564
- C:\Windows\System\cyFkSsu.exe
  C:\Windows\System\cyFkSsu.exe
  2⤵
  PID:3828
- C:\Windows\System\QiQTdKt.exe
  C:\Windows\System\QiQTdKt.exe
  2⤵
  PID:3916
- C:\Windows\System\BuWUwYb.exe
  C:\Windows\System\BuWUwYb.exe
  2⤵
  PID:4016
- C:\Windows\System\VfGkQVc.exe
  C:\Windows\System\VfGkQVc.exe
  2⤵
  PID:1404
- C:\Windows\System\zSMaPvB.exe
  C:\Windows\System\zSMaPvB.exe
  2⤵
  PID:4032
- C:\Windows\System\lfRsBFd.exe
  C:\Windows\System\lfRsBFd.exe
  2⤵
  PID:1788
- C:\Windows\System\vYyYZtm.exe
  C:\Windows\System\vYyYZtm.exe
  2⤵
  PID:2084
- C:\Windows\System\FzNhaWh.exe
  C:\Windows\System\FzNhaWh.exe
  2⤵
  PID:3100
- C:\Windows\System\QQWIqgT.exe
  C:\Windows\System\QQWIqgT.exe
  2⤵
  PID:3204
- C:\Windows\System\ozSPByL.exe
  C:\Windows\System\ozSPByL.exe
  2⤵
  PID:2824
- C:\Windows\System\OylsCdV.exe
  C:\Windows\System\OylsCdV.exe
  2⤵
  PID:3708
- C:\Windows\System\cAuzZbe.exe
  C:\Windows\System\cAuzZbe.exe
  2⤵
  PID:3692
- C:\Windows\System\KUkqUiW.exe
  C:\Windows\System\KUkqUiW.exe
  2⤵
  PID:3664
- C:\Windows\System\rtrAuTY.exe
  C:\Windows\System\rtrAuTY.exe
  2⤵
  PID:4092
- C:\Windows\System\eaGaxLH.exe
  C:\Windows\System\eaGaxLH.exe
  2⤵
  PID:3736
- C:\Windows\System\CIjKjaH.exe
  C:\Windows\System\CIjKjaH.exe
  2⤵
  PID:3936
- C:\Windows\System\ZjEaKWF.exe
  C:\Windows\System\ZjEaKWF.exe
  2⤵
  PID:3264
- C:\Windows\System\kGiRGHg.exe
  C:\Windows\System\kGiRGHg.exe
  2⤵
  PID:2904
- C:\Windows\System\svImrBT.exe
  C:\Windows\System\svImrBT.exe
  2⤵
  PID:2808
- C:\Windows\System\ALgZZsH.exe
  C:\Windows\System\ALgZZsH.exe
  2⤵
  PID:3860
- C:\Windows\System\rMiJMRp.exe
  C:\Windows\System\rMiJMRp.exe
  2⤵
  PID:3304
- C:\Windows\System\OmBTnba.exe
  C:\Windows\System\OmBTnba.exe
  2⤵
  PID:3080
- C:\Windows\System\VHRCYAl.exe
  C:\Windows\System\VHRCYAl.exe
  2⤵
  PID:4104
- C:\Windows\System\KsvTbin.exe
  C:\Windows\System\KsvTbin.exe
  2⤵
  PID:4120
- C:\Windows\System\wTlmRvv.exe
  C:\Windows\System\wTlmRvv.exe
  2⤵
  PID:4136
- C:\Windows\System\ElLYpaq.exe
  C:\Windows\System\ElLYpaq.exe
  2⤵
  PID:4152
- C:\Windows\System\wPxTcyO.exe
  C:\Windows\System\wPxTcyO.exe
  2⤵
  PID:4172
- C:\Windows\System\GbZwXze.exe
  C:\Windows\System\GbZwXze.exe
  2⤵
  PID:4188
- C:\Windows\System\LbCbaKp.exe
  C:\Windows\System\LbCbaKp.exe
  2⤵
  PID:4208
- C:\Windows\System\pIvgblu.exe
  C:\Windows\System\pIvgblu.exe
  2⤵
  PID:4224
- C:\Windows\System\xpypoLx.exe
  C:\Windows\System\xpypoLx.exe
  2⤵
  PID:4240
- C:\Windows\System\tyFIwBN.exe
  C:\Windows\System\tyFIwBN.exe
  2⤵
  PID:4256
- C:\Windows\System\bmQGPGi.exe
  C:\Windows\System\bmQGPGi.exe
  2⤵
  PID:4276
- C:\Windows\System\QPRZUxJ.exe
  C:\Windows\System\QPRZUxJ.exe
  2⤵
  PID:4308
- C:\Windows\System\ZiENDHe.exe
  C:\Windows\System\ZiENDHe.exe
  2⤵
  PID:4348
- C:\Windows\System\lGOKcPq.exe
  C:\Windows\System\lGOKcPq.exe
  2⤵
  PID:4420
- C:\Windows\System\vOFvrea.exe
  C:\Windows\System\vOFvrea.exe
  2⤵
  PID:4444
- C:\Windows\System\utbuzDV.exe
  C:\Windows\System\utbuzDV.exe
  2⤵
  PID:4460
- C:\Windows\System\HxSqcoM.exe
  C:\Windows\System\HxSqcoM.exe
  2⤵
  PID:4480
- C:\Windows\System\YVSRHsU.exe
  C:\Windows\System\YVSRHsU.exe
  2⤵
  PID:4496
- C:\Windows\System\LZrPMVv.exe
  C:\Windows\System\LZrPMVv.exe
  2⤵
  PID:4512
- C:\Windows\System\ehsBtyJ.exe
  C:\Windows\System\ehsBtyJ.exe
  2⤵
  PID:4528
- C:\Windows\System\eCwvnjL.exe
  C:\Windows\System\eCwvnjL.exe
  2⤵
  PID:4544
- C:\Windows\System\hZxiRWC.exe
  C:\Windows\System\hZxiRWC.exe
  2⤵
  PID:4564
- C:\Windows\System\NKTaLLL.exe
  C:\Windows\System\NKTaLLL.exe
  2⤵
  PID:4580
- C:\Windows\System\FmWJjPX.exe
  C:\Windows\System\FmWJjPX.exe
  2⤵
  PID:4600
- C:\Windows\System\iNlzAJB.exe
  C:\Windows\System\iNlzAJB.exe
  2⤵
  PID:4616
- C:\Windows\System\FMIkbob.exe
  C:\Windows\System\FMIkbob.exe
  2⤵
  PID:4632
- C:\Windows\System\aXILgSP.exe
  C:\Windows\System\aXILgSP.exe
  2⤵
  PID:4648
- C:\Windows\System\bSahuey.exe
  C:\Windows\System\bSahuey.exe
  2⤵
  PID:4664
- C:\Windows\System\nOBzUIu.exe
  C:\Windows\System\nOBzUIu.exe
  2⤵
  PID:4680
- C:\Windows\System\mMahfHI.exe
  C:\Windows\System\mMahfHI.exe
  2⤵
  PID:4696
- C:\Windows\System\ZcJbMOH.exe
  C:\Windows\System\ZcJbMOH.exe
  2⤵
  PID:4712
- C:\Windows\System\qZTQfAi.exe
  C:\Windows\System\qZTQfAi.exe
  2⤵
  PID:4728
- C:\Windows\System\BzBXOcJ.exe
  C:\Windows\System\BzBXOcJ.exe
  2⤵
  PID:4744
- C:\Windows\System\zEPhRrq.exe
  C:\Windows\System\zEPhRrq.exe
  2⤵
  PID:4760
- C:\Windows\System\WHYbxuf.exe
  C:\Windows\System\WHYbxuf.exe
  2⤵
  PID:4776
- C:\Windows\System\YDNoPsl.exe
  C:\Windows\System\YDNoPsl.exe
  2⤵
  PID:4796
- C:\Windows\System\bwAZYfR.exe
  C:\Windows\System\bwAZYfR.exe
  2⤵
  PID:4812
- C:\Windows\System\iAymABw.exe
  C:\Windows\System\iAymABw.exe
  2⤵
  PID:4832
- C:\Windows\System\PuXwlyR.exe
  C:\Windows\System\PuXwlyR.exe
  2⤵
  PID:4848
- C:\Windows\System\BefJiwH.exe
  C:\Windows\System\BefJiwH.exe
  2⤵
  PID:4864
- C:\Windows\System\CjsCMqf.exe
  C:\Windows\System\CjsCMqf.exe
  2⤵
  PID:4880
- C:\Windows\System\ccMMDeT.exe
  C:\Windows\System\ccMMDeT.exe
  2⤵
  PID:4896
- C:\Windows\System\QUbwAbE.exe
  C:\Windows\System\QUbwAbE.exe
  2⤵
  PID:4916
- C:\Windows\System\mdSALFc.exe
  C:\Windows\System\mdSALFc.exe
  2⤵
  PID:4936
- C:\Windows\System\kvZEMXy.exe
  C:\Windows\System\kvZEMXy.exe
  2⤵
  PID:4956
- C:\Windows\System\hGefLfO.exe
  C:\Windows\System\hGefLfO.exe
  2⤵
  PID:4972
- C:\Windows\System\CECjfPu.exe
  C:\Windows\System\CECjfPu.exe
  2⤵
  PID:4988
- C:\Windows\System\XGdkoja.exe
  C:\Windows\System\XGdkoja.exe
  2⤵
  PID:5008
- C:\Windows\System\LdrMKdT.exe
  C:\Windows\System\LdrMKdT.exe
  2⤵
  PID:5024
- C:\Windows\System\LGodmNP.exe
  C:\Windows\System\LGodmNP.exe
  2⤵
  PID:5040
- C:\Windows\System\mebhaNx.exe
  C:\Windows\System\mebhaNx.exe
  2⤵
  PID:5060
- C:\Windows\System\SjCXJzj.exe
  C:\Windows\System\SjCXJzj.exe
  2⤵
  PID:5076
- C:\Windows\System\qUWlqbn.exe
  C:\Windows\System\qUWlqbn.exe
  2⤵
  PID:5092
- C:\Windows\System\XWmKyGC.exe
  C:\Windows\System\XWmKyGC.exe
  2⤵
  PID:5108
- C:\Windows\System\aMSolCi.exe
  C:\Windows\System\aMSolCi.exe
  2⤵
  PID:3520
- C:\Windows\System\NaUGliw.exe
  C:\Windows\System\NaUGliw.exe
  2⤵
  PID:3800
- C:\Windows\System\ujyMuPd.exe
  C:\Windows\System\ujyMuPd.exe
  2⤵
  PID:3904
- C:\Windows\System\GGPxLHu.exe
  C:\Windows\System\GGPxLHu.exe
  2⤵
  PID:2032
- C:\Windows\System\SfxdbzB.exe
  C:\Windows\System\SfxdbzB.exe
  2⤵
  PID:4144
- C:\Windows\System\dXYFsQH.exe
  C:\Windows\System\dXYFsQH.exe
  2⤵
  PID:4164
- C:\Windows\System\zGGFNiX.exe
  C:\Windows\System\zGGFNiX.exe
  2⤵
  PID:4200
- C:\Windows\System\TeSOOnC.exe
  C:\Windows\System\TeSOOnC.exe
  2⤵
  PID:4232
- C:\Windows\System\nqvUPpp.exe
  C:\Windows\System\nqvUPpp.exe
  2⤵
  PID:4252
- C:\Windows\System\tLVSaJG.exe
  C:\Windows\System\tLVSaJG.exe
  2⤵
  PID:4288
- C:\Windows\System\WfAicsn.exe
  C:\Windows\System\WfAicsn.exe
  2⤵
  PID:4304
- C:\Windows\System\GUHpgmA.exe
  C:\Windows\System\GUHpgmA.exe
  2⤵
  PID:4332
- C:\Windows\System\PWUFPJO.exe
  C:\Windows\System\PWUFPJO.exe
  2⤵
  PID:4356
- C:\Windows\System\FvaPzii.exe
  C:\Windows\System\FvaPzii.exe
  2⤵
  PID:4372
- C:\Windows\System\NcDYVLr.exe
  C:\Windows\System\NcDYVLr.exe
  2⤵
  PID:4388
- C:\Windows\System\sMuQRyh.exe
  C:\Windows\System\sMuQRyh.exe
  2⤵
  PID:4404
- C:\Windows\System\XbftpBV.exe
  C:\Windows\System\XbftpBV.exe
  2⤵
  PID:4456
- C:\Windows\System\RIZnvUK.exe
  C:\Windows\System\RIZnvUK.exe
  2⤵
  PID:4524
- C:\Windows\System\qKxFNzF.exe
  C:\Windows\System\qKxFNzF.exe
  2⤵
  PID:2632
- C:\Windows\System\rBVckvD.exe
  C:\Windows\System\rBVckvD.exe
  2⤵
  PID:4596
- C:\Windows\System\HVaXVQZ.exe
  C:\Windows\System\HVaXVQZ.exe
  2⤵
  PID:4624
- C:\Windows\System\tTilxNZ.exe
  C:\Windows\System\tTilxNZ.exe
  2⤵
  PID:4436
- C:\Windows\System\jVjNfsi.exe
  C:\Windows\System\jVjNfsi.exe
  2⤵
  PID:4476
- C:\Windows\System\SAELxeg.exe
  C:\Windows\System\SAELxeg.exe
  2⤵
  PID:4644
- C:\Windows\System\ajvREll.exe
  C:\Windows\System\ajvREll.exe
  2⤵
  PID:4692
- C:\Windows\System\IwxnEqZ.exe
  C:\Windows\System\IwxnEqZ.exe
  2⤵
  PID:4752
- C:\Windows\System\eWyIKme.exe
  C:\Windows\System\eWyIKme.exe
  2⤵
  PID:4768
- C:\Windows\System\ZNIUiQV.exe
  C:\Windows\System\ZNIUiQV.exe
  2⤵
  PID:4820
- C:\Windows\System\DqTyjfp.exe
  C:\Windows\System\DqTyjfp.exe
  2⤵
  PID:4856
- C:\Windows\System\IviuXHw.exe
  C:\Windows\System\IviuXHw.exe
  2⤵
  PID:4872
- C:\Windows\System\zQoWNVI.exe
  C:\Windows\System\zQoWNVI.exe
  2⤵
  PID:4904
- C:\Windows\System\kXZMSTP.exe
  C:\Windows\System\kXZMSTP.exe
  2⤵
  PID:4912
- C:\Windows\System\AmJjXJC.exe
  C:\Windows\System\AmJjXJC.exe
  2⤵
  PID:4996
- C:\Windows\System\jsTjeEE.exe
  C:\Windows\System\jsTjeEE.exe
  2⤵
  PID:5016
- C:\Windows\System\fgSyWQR.exe
  C:\Windows\System\fgSyWQR.exe
  2⤵
  PID:4952
- C:\Windows\System\JKuXVzU.exe
  C:\Windows\System\JKuXVzU.exe
  2⤵
  PID:5048
- C:\Windows\System\mIYSuyn.exe
  C:\Windows\System\mIYSuyn.exe
  2⤵
  PID:5104
- C:\Windows\System\OnDYEsh.exe
  C:\Windows\System\OnDYEsh.exe
  2⤵
  PID:3628
- C:\Windows\System\eWPCLHT.exe
  C:\Windows\System\eWPCLHT.exe
  2⤵
  PID:2092
- C:\Windows\System\jTigCjC.exe
  C:\Windows\System\jTigCjC.exe
  2⤵
  PID:4128
- C:\Windows\System\VEnaVZI.exe
  C:\Windows\System\VEnaVZI.exe
  2⤵
  PID:4184
- C:\Windows\System\GaFpJuh.exe
  C:\Windows\System\GaFpJuh.exe
  2⤵
  PID:4320
- C:\Windows\System\wIjeSBg.exe
  C:\Windows\System\wIjeSBg.exe
  2⤵
  PID:4168
- C:\Windows\System\TRGLSdn.exe
  C:\Windows\System\TRGLSdn.exe
  2⤵
  PID:4300
- C:\Windows\System\SROAiVN.exe
  C:\Windows\System\SROAiVN.exe
  2⤵
  PID:4368
- C:\Windows\System\KrFUmTr.exe
  C:\Windows\System\KrFUmTr.exe
  2⤵
  PID:4492
- C:\Windows\System\OMXsPcg.exe
  C:\Windows\System\OMXsPcg.exe
  2⤵
  PID:4592
- C:\Windows\System\LDPlfSs.exe
  C:\Windows\System\LDPlfSs.exe
  2⤵
  PID:4504
- C:\Windows\System\rKDKLLO.exe
  C:\Windows\System\rKDKLLO.exe
  2⤵
  PID:4560
- C:\Windows\System\dIWXrhI.exe
  C:\Windows\System\dIWXrhI.exe
  2⤵
  PID:4468
- C:\Windows\System\cfsyKVV.exe
  C:\Windows\System\cfsyKVV.exe
  2⤵
  PID:4608
- C:\Windows\System\GxYldfz.exe
  C:\Windows\System\GxYldfz.exe
  2⤵
  PID:4536
- C:\Windows\System\zUlVrjQ.exe
  C:\Windows\System\zUlVrjQ.exe
  2⤵
  PID:4788
- C:\Windows\System\paCnvqg.exe
  C:\Windows\System\paCnvqg.exe
  2⤵
  PID:4804
- C:\Windows\System\abAQRvq.exe
  C:\Windows\System\abAQRvq.exe
  2⤵
  PID:4876
- C:\Windows\System\IYVGXSL.exe
  C:\Windows\System\IYVGXSL.exe
  2⤵
  PID:4928
- C:\Windows\System\NTJmFJL.exe
  C:\Windows\System\NTJmFJL.exe
  2⤵
  PID:4968
- C:\Windows\System\zHxaICG.exe
  C:\Windows\System\zHxaICG.exe
  2⤵
  PID:5036
- C:\Windows\System\sCaFjNd.exe
  C:\Windows\System\sCaFjNd.exe
  2⤵
  PID:5084
- C:\Windows\System\XWCXFyg.exe
  C:\Windows\System\XWCXFyg.exe
  2⤵
  PID:4272
- C:\Windows\System\krROrfS.exe
  C:\Windows\System\krROrfS.exe
  2⤵
  PID:4264
- C:\Windows\System\BUNgBAL.exe
  C:\Windows\System\BUNgBAL.exe
  2⤵
  PID:4116
- C:\Windows\System\RJUmLVj.exe
  C:\Windows\System\RJUmLVj.exe
  2⤵
  PID:4384
- C:\Windows\System\xiqMNyM.exe
  C:\Windows\System\xiqMNyM.exe
  2⤵
  PID:4452
- C:\Windows\System\oNPowwd.exe
  C:\Windows\System\oNPowwd.exe
  2⤵
  PID:4340
- C:\Windows\System\yRGkMlH.exe
  C:\Windows\System\yRGkMlH.exe
  2⤵
  PID:4756
- C:\Windows\System\PFIkqJf.exe
  C:\Windows\System\PFIkqJf.exe
  2⤵
  PID:4908
- C:\Windows\System\LalBHie.exe
  C:\Windows\System\LalBHie.exe
  2⤵
  PID:4792
- C:\Windows\System\idqQWZW.exe
  C:\Windows\System\idqQWZW.exe
  2⤵
  PID:3236
- C:\Windows\System\qMMWxTC.exe
  C:\Windows\System\qMMWxTC.exe
  2⤵
  PID:1704
- C:\Windows\System\uQgHNwx.exe
  C:\Windows\System\uQgHNwx.exe
  2⤵
  PID:5124
- C:\Windows\System\ucATEnW.exe
  C:\Windows\System\ucATEnW.exe
  2⤵
  PID:5140
- C:\Windows\System\sJetWAg.exe
  C:\Windows\System\sJetWAg.exe
  2⤵
  PID:5156
- C:\Windows\System\TnBpOHo.exe
  C:\Windows\System\TnBpOHo.exe
  2⤵
  PID:5172
- C:\Windows\System\bUufczi.exe
  C:\Windows\System\bUufczi.exe
  2⤵
  PID:5188
- C:\Windows\System\EhxxEgp.exe
  C:\Windows\System\EhxxEgp.exe
  2⤵
  PID:5204
- C:\Windows\System\wnYEedc.exe
  C:\Windows\System\wnYEedc.exe
  2⤵
  PID:5220
- C:\Windows\System\AyqdUQu.exe
  C:\Windows\System\AyqdUQu.exe
  2⤵
  PID:5236
- C:\Windows\System\eroUGZW.exe
  C:\Windows\System\eroUGZW.exe
  2⤵
  PID:5252
- C:\Windows\System\RQjPhhK.exe
  C:\Windows\System\RQjPhhK.exe
  2⤵
  PID:5268
- C:\Windows\System\NnaqjUu.exe
  C:\Windows\System\NnaqjUu.exe
  2⤵
  PID:5284
- C:\Windows\System\xYEWsDn.exe
  C:\Windows\System\xYEWsDn.exe
  2⤵
  PID:5300
- C:\Windows\System\poLKINt.exe
  C:\Windows\System\poLKINt.exe
  2⤵
  PID:5316
- C:\Windows\System\pxuqISk.exe
  C:\Windows\System\pxuqISk.exe
  2⤵
  PID:5332
- C:\Windows\System\tDjiJiu.exe
  C:\Windows\System\tDjiJiu.exe
  2⤵
  PID:5348
- C:\Windows\System\fERStYZ.exe
  C:\Windows\System\fERStYZ.exe
  2⤵
  PID:5364
- C:\Windows\System\ImzccKP.exe
  C:\Windows\System\ImzccKP.exe
  2⤵
  PID:5380
- C:\Windows\System\flScUxz.exe
  C:\Windows\System\flScUxz.exe
  2⤵
  PID:5396
- C:\Windows\System\igIBQWQ.exe
  C:\Windows\System\igIBQWQ.exe
  2⤵
  PID:5412
- C:\Windows\System\qRTsntg.exe
  C:\Windows\System\qRTsntg.exe
  2⤵
  PID:5428
- C:\Windows\System\CQoUyOc.exe
  C:\Windows\System\CQoUyOc.exe
  2⤵
  PID:5444
- C:\Windows\System\LlFtZWv.exe
  C:\Windows\System\LlFtZWv.exe
  2⤵
  PID:5460
- C:\Windows\System\OmeRjit.exe
  C:\Windows\System\OmeRjit.exe
  2⤵
  PID:5476
- C:\Windows\System\kqChcuK.exe
  C:\Windows\System\kqChcuK.exe
  2⤵
  PID:5492
- C:\Windows\System\EwTkpYH.exe
  C:\Windows\System\EwTkpYH.exe
  2⤵
  PID:5508
- C:\Windows\System\xRVWVFm.exe
  C:\Windows\System\xRVWVFm.exe
  2⤵
  PID:5524
- C:\Windows\System\oUFmeRG.exe
  C:\Windows\System\oUFmeRG.exe
  2⤵
  PID:5540
- C:\Windows\System\ftBoHpw.exe
  C:\Windows\System\ftBoHpw.exe
  2⤵
  PID:5556
- C:\Windows\System\MkRTYpV.exe
  C:\Windows\System\MkRTYpV.exe
  2⤵
  PID:5572
- C:\Windows\System\fbZxKmm.exe
  C:\Windows\System\fbZxKmm.exe
  2⤵
  PID:5588
- C:\Windows\System\ZTJNNWC.exe
  C:\Windows\System\ZTJNNWC.exe
  2⤵
  PID:5604
- C:\Windows\System\yAngwBc.exe
  C:\Windows\System\yAngwBc.exe
  2⤵
  PID:5620
- C:\Windows\System\slKYozO.exe
  C:\Windows\System\slKYozO.exe
  2⤵
  PID:5636
- C:\Windows\System\MFGLLHG.exe
  C:\Windows\System\MFGLLHG.exe
  2⤵
  PID:5652
- C:\Windows\System\HxTLFXF.exe
  C:\Windows\System\HxTLFXF.exe
  2⤵
  PID:5668
- C:\Windows\System\yRjSkEe.exe
  C:\Windows\System\yRjSkEe.exe
  2⤵
  PID:5684
- C:\Windows\System\klUuZVH.exe
  C:\Windows\System\klUuZVH.exe
  2⤵
  PID:6072
- C:\Windows\System\zaEWtVk.exe
  C:\Windows\System\zaEWtVk.exe
  2⤵
  PID:6116
- C:\Windows\System\ppTBwwa.exe
  C:\Windows\System\ppTBwwa.exe
  2⤵
  PID:4540
- C:\Windows\System\NQGGhNp.exe
  C:\Windows\System\NQGGhNp.exe
  2⤵
  PID:5132
- C:\Windows\System\RmjuKyu.exe
  C:\Windows\System\RmjuKyu.exe
  2⤵
  PID:5168
- C:\Windows\System\MEEUHcT.exe
  C:\Windows\System\MEEUHcT.exe
  2⤵
  PID:5228
- C:\Windows\System\zipxxLe.exe
  C:\Windows\System\zipxxLe.exe
  2⤵
  PID:4736
- C:\Windows\System\xooaEzD.exe
  C:\Windows\System\xooaEzD.exe
  2⤵
  PID:5296
- C:\Windows\System\TTaYDbU.exe
  C:\Windows\System\TTaYDbU.exe
  2⤵
  PID:4612
- C:\Windows\System\MbDfKCG.exe
  C:\Windows\System\MbDfKCG.exe
  2⤵
  PID:5392
- C:\Windows\System\psWIMQq.exe
  C:\Windows\System\psWIMQq.exe
  2⤵
  PID:4324
- C:\Windows\System\CSEbOek.exe
  C:\Windows\System\CSEbOek.exe
  2⤵
  PID:5456
- C:\Windows\System\HKfDaHx.exe
  C:\Windows\System\HKfDaHx.exe
  2⤵
  PID:5516
- C:\Windows\System\GkFkwBp.exe
  C:\Windows\System\GkFkwBp.exe
  2⤵
  PID:5244
- C:\Windows\System\umrfLKU.exe
  C:\Windows\System\umrfLKU.exe
  2⤵
  PID:1628
- C:\Windows\System\yflxVuf.exe
  C:\Windows\System\yflxVuf.exe
  2⤵
  PID:5216
- C:\Windows\System\akrLjfv.exe
  C:\Windows\System\akrLjfv.exe
  2⤵
  PID:5712
- C:\Windows\System\nmJyXVG.exe
  C:\Windows\System\nmJyXVG.exe
  2⤵
  PID:5728
- C:\Windows\System\NSDOdeG.exe
  C:\Windows\System\NSDOdeG.exe
  2⤵
  PID:5744
- C:\Windows\System\ylOUDWH.exe
  C:\Windows\System\ylOUDWH.exe
  2⤵
  PID:5764
- C:\Windows\System\ncpCxwp.exe
  C:\Windows\System\ncpCxwp.exe
  2⤵
  PID:5780
- C:\Windows\System\aZWpEWI.exe
  C:\Windows\System\aZWpEWI.exe
  2⤵
  PID:5796
- C:\Windows\System\KPaqDGd.exe
  C:\Windows\System\KPaqDGd.exe
  2⤵
  PID:5812
- C:\Windows\System\CAsVxRP.exe
  C:\Windows\System\CAsVxRP.exe
  2⤵
  PID:5828
- C:\Windows\System\GnESxBF.exe
  C:\Windows\System\GnESxBF.exe
  2⤵
  PID:5848
- C:\Windows\System\puBLuzd.exe
  C:\Windows\System\puBLuzd.exe
  2⤵
  PID:5868
- C:\Windows\System\BizHCQu.exe
  C:\Windows\System\BizHCQu.exe
  2⤵
  PID:5880
- C:\Windows\System\pSjVdZh.exe
  C:\Windows\System\pSjVdZh.exe
  2⤵
  PID:5896
- C:\Windows\System\EBnhiaC.exe
  C:\Windows\System\EBnhiaC.exe
  2⤵
  PID:5912
- C:\Windows\System\oNucHLC.exe
  C:\Windows\System\oNucHLC.exe
  2⤵
  PID:5928
- C:\Windows\System\ulPXrqL.exe
  C:\Windows\System\ulPXrqL.exe
  2⤵
  PID:5936
- C:\Windows\System\oSdonWs.exe
  C:\Windows\System\oSdonWs.exe
  2⤵
  PID:5960
- C:\Windows\System\aRhyrQF.exe
  C:\Windows\System\aRhyrQF.exe
  2⤵
  PID:5976
- C:\Windows\System\vvdLHSd.exe
  C:\Windows\System\vvdLHSd.exe
  2⤵
  PID:6032
- C:\Windows\System\pzMSjJQ.exe
  C:\Windows\System\pzMSjJQ.exe
  2⤵
  PID:6088
- C:\Windows\System\LVlzVeC.exe
  C:\Windows\System\LVlzVeC.exe
  2⤵
  PID:1040
- C:\Windows\System\yZylQja.exe
  C:\Windows\System\yZylQja.exe
  2⤵
  PID:6104
- C:\Windows\System\xiNVOWu.exe
  C:\Windows\System\xiNVOWu.exe
  2⤵
  PID:6136
- C:\Windows\System\ocjkhBT.exe
  C:\Windows\System\ocjkhBT.exe
  2⤵
  PID:5360
- C:\Windows\System\QOHsGzE.exe
  C:\Windows\System\QOHsGzE.exe
  2⤵
  PID:5484
- C:\Windows\System\sbOFzmp.exe
  C:\Windows\System\sbOFzmp.exe
  2⤵
  PID:4416

Analysis

Sharing

General

Malware Config

Signatures

Processes