xmrig | 34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
Size

1.8MB
MD5

c80e06ce06f1a5ec361eb5c0f39ce233
SHA1

07284531b130305cae2d098cf67be5f38cbe8ee4
SHA256

34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d
SHA512

df035bc86c0892785a8ea436706f827721cb9a2cfa8128804372c0104624ca1861b663d02b50f0641d7c648f43f7d407cef912518c59883f58293440f3b3dd28
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZddgJzOM:GemTLkNdfE0pZy4

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b85-4.dat	xmrig
behavioral2/files/0x000a000000023c71-9.dat	xmrig
behavioral2/files/0x0007000000023c78-14.dat	xmrig
behavioral2/files/0x0007000000023c79-19.dat	xmrig
behavioral2/files/0x0007000000023c7a-24.dat	xmrig
behavioral2/files/0x0007000000023c7b-30.dat	xmrig
behavioral2/files/0x0007000000023c7c-34.dat	xmrig
behavioral2/files/0x0007000000023c7e-37.dat	xmrig
behavioral2/files/0x0007000000023c7f-42.dat	xmrig
behavioral2/files/0x0007000000023c80-51.dat	xmrig
behavioral2/files/0x0007000000023c82-55.dat	xmrig
behavioral2/files/0x0008000000023c75-64.dat	xmrig
behavioral2/files/0x0007000000023c88-83.dat	xmrig
behavioral2/files/0x0007000000023c87-94.dat	xmrig
behavioral2/files/0x0007000000023c8a-100.dat	xmrig
behavioral2/files/0x0007000000023c8b-108.dat	xmrig
behavioral2/files/0x0007000000023c8e-117.dat	xmrig
behavioral2/files/0x0007000000023c92-129.dat	xmrig
behavioral2/files/0x0007000000023c91-138.dat	xmrig
behavioral2/files/0x0007000000023c90-136.dat	xmrig
behavioral2/files/0x0007000000023c8f-134.dat	xmrig
behavioral2/files/0x0007000000023c8d-130.dat	xmrig
behavioral2/files/0x0007000000023c8c-123.dat	xmrig
behavioral2/files/0x0007000000023c89-98.dat	xmrig
behavioral2/files/0x0007000000023c86-92.dat	xmrig
behavioral2/files/0x0007000000023c84-87.dat	xmrig
behavioral2/files/0x0007000000023c85-80.dat	xmrig
behavioral2/files/0x000d000000023b3c-150.dat	xmrig
behavioral2/files/0x000d000000023b3d-158.dat	xmrig
behavioral2/files/0x000d000000023b3f-160.dat	xmrig
behavioral2/files/0x0007000000023c93-152.dat	xmrig
behavioral2/files/0x000800000001db84-151.dat	xmrig
behavioral2/files/0x0007000000023c83-73.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4180	kyzuziE.exe
4288	yQYoBFZ.exe
2756	dZDzwkV.exe
1420	TbsJYTN.exe
3484	QScYDJc.exe
668	TRCtjKa.exe
4972	FUZMIOd.exe
2296	VEtSsUS.exe
244	GXRGrUz.exe
4484	BOfimdG.exe
2380	xeIpzkN.exe
4216	SBaIRPW.exe
3864	IdvMejp.exe
4692	EaCHgHl.exe
2896	rmxdrFr.exe
4444	nzZpLIH.exe
2092	sUNaUfS.exe
4760	AVykuUE.exe
2224	WDEswLY.exe
2656	OCdvFmT.exe
4316	gtMDGHs.exe
732	lzxgzeS.exe
4240	qDaNnwr.exe
2800	JmGWcoK.exe
1976	yMbQRQV.exe
1460	nsJfIOt.exe
4756	xjtMRby.exe
3504	FdWNZFz.exe
2168	DuqMsRn.exe
1448	TykIlTM.exe
3284	tAdIXtk.exe
5048	uBJXGIk.exe
4284	GbLwbYu.exe
3476	bfuzlXj.exe
3960	YgPbKpT.exe
4392	eULGagd.exe
8	GOsNFub.exe
880	kTIYzBe.exe
3908	QHRIdrP.exe
2052	FSidmGh.exe
4424	KrrUzIS.exe
3424	BwqTdeZ.exe
652	TBjPYSI.exe
1580	zbyfUsa.exe
440	YtdLybW.exe
2000	qYVKCJR.exe
4136	fElKqWS.exe
2864	nUmykFB.exe
4016	yfnIUsk.exe
1040	MIUkwtb.exe
3604	cXJKZrJ.exe
2136	ZyALHTs.exe
4200	jifKJYP.exe
3616	unBISVp.exe
684	aEeVveD.exe
888	TBuRbZg.exe
4664	DniUytd.exe
3872	YyilITf.exe
376	ovujbAM.exe
3332	jZDNtzt.exe
3488	FmgnSWZ.exe
640	BBTtHIA.exe
3428	otsektX.exe
1432	BvNSARn.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rMKYyoE.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\ArPRypG.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\BOfimdG.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\WDEswLY.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\xjtMRby.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\JygfpZI.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\hErtNFB.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\hOcoLuX.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\CfehOdn.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\pfaLhHU.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\lxrtHNU.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\QCLWKcH.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\LloOxhl.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\sDZUkDa.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\MMfpsZo.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\skxsYdv.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\fWpMFkC.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\MpnzbLw.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\udMpPCf.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\YSRtGFc.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\nGuxDyl.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\lZPMxFK.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\QGvpwAA.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\VEtSsUS.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\sUNaUfS.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\mNpKKgS.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\lkIvZgB.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\USDVHue.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\IAnMAdV.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\gUmTTHm.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\TkOxCwA.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\dbLoQxu.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\LYdtEbu.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\srPxlMd.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\DbHEkMv.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\aXrdHOx.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\ZUtaVFn.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\nsJfIOt.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\ooDybji.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\IraLrbe.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\BjyAtbY.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\YWyvgaZ.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\WoArNHO.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\ohOdIKC.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\TiPIbOb.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\IbsuaEM.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\yBkDgkh.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\YHfNZLX.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\hwAWlvs.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\DsHYCeC.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\AVykuUE.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\QaWtKYq.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\EpnRLrq.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\FCtpDPM.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\jHiFNzO.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\qDRBRJN.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\SYvoIap.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\wunglQa.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\jimYDSN.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\txTZISN.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\tKwqhPo.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\AyPGcfd.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\hZjvZwy.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
File created	C:\Windows\System\hBsEkLk.exe	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 4180	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	86
PID 3920 wrote to memory of 4180	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	86
PID 3920 wrote to memory of 4288	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	87
PID 3920 wrote to memory of 4288	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	87
PID 3920 wrote to memory of 2756	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	88
PID 3920 wrote to memory of 2756	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	88
PID 3920 wrote to memory of 1420	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	89
PID 3920 wrote to memory of 1420	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	89
PID 3920 wrote to memory of 3484	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	90
PID 3920 wrote to memory of 3484	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	90
PID 3920 wrote to memory of 668	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	91
PID 3920 wrote to memory of 668	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	91
PID 3920 wrote to memory of 4972	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	92
PID 3920 wrote to memory of 4972	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	92
PID 3920 wrote to memory of 2296	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	93
PID 3920 wrote to memory of 2296	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	93
PID 3920 wrote to memory of 244	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	94
PID 3920 wrote to memory of 244	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	94
PID 3920 wrote to memory of 4484	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	95
PID 3920 wrote to memory of 4484	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	95
PID 3920 wrote to memory of 2380	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	98
PID 3920 wrote to memory of 2380	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	98
PID 3920 wrote to memory of 4216	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	99
PID 3920 wrote to memory of 4216	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	99
PID 3920 wrote to memory of 3864	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	100
PID 3920 wrote to memory of 3864	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	100
PID 3920 wrote to memory of 4692	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	101
PID 3920 wrote to memory of 4692	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	101
PID 3920 wrote to memory of 2896	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	102
PID 3920 wrote to memory of 2896	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	102
PID 3920 wrote to memory of 4444	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	103
PID 3920 wrote to memory of 4444	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	103
PID 3920 wrote to memory of 2092	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	104
PID 3920 wrote to memory of 2092	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	104
PID 3920 wrote to memory of 4760	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	105
PID 3920 wrote to memory of 4760	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	105
PID 3920 wrote to memory of 2224	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	106
PID 3920 wrote to memory of 2224	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	106
PID 3920 wrote to memory of 2656	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	107
PID 3920 wrote to memory of 2656	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	107
PID 3920 wrote to memory of 4316	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	108
PID 3920 wrote to memory of 4316	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	108
PID 3920 wrote to memory of 732	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	109
PID 3920 wrote to memory of 732	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	109
PID 3920 wrote to memory of 4240	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	110
PID 3920 wrote to memory of 4240	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	110
PID 3920 wrote to memory of 2800	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	111
PID 3920 wrote to memory of 2800	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	111
PID 3920 wrote to memory of 1976	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	112
PID 3920 wrote to memory of 1976	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	112
PID 3920 wrote to memory of 1460	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	113
PID 3920 wrote to memory of 1460	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	113
PID 3920 wrote to memory of 4756	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	114
PID 3920 wrote to memory of 4756	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	114
PID 3920 wrote to memory of 3504	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	115
PID 3920 wrote to memory of 3504	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	115
PID 3920 wrote to memory of 2168	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	116
PID 3920 wrote to memory of 2168	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	116
PID 3920 wrote to memory of 1448	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	118
PID 3920 wrote to memory of 1448	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	118
PID 3920 wrote to memory of 3284	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	119
PID 3920 wrote to memory of 3284	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	119
PID 3920 wrote to memory of 5048	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	120
PID 3920 wrote to memory of 5048	3920	34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe	120

C:\Users\Admin\AppData\Local\Temp\34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe
"C:\Users\Admin\AppData\Local\Temp\34897b65b97ceb8e4074e89a40ec7ca1c387f4e8aafc086b9630717c7b77ae2d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\System\kyzuziE.exe
  C:\Windows\System\kyzuziE.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\yQYoBFZ.exe
  C:\Windows\System\yQYoBFZ.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\dZDzwkV.exe
  C:\Windows\System\dZDzwkV.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\TbsJYTN.exe
  C:\Windows\System\TbsJYTN.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\QScYDJc.exe
  C:\Windows\System\QScYDJc.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\TRCtjKa.exe
  C:\Windows\System\TRCtjKa.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\FUZMIOd.exe
  C:\Windows\System\FUZMIOd.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\VEtSsUS.exe
  C:\Windows\System\VEtSsUS.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\GXRGrUz.exe
  C:\Windows\System\GXRGrUz.exe
  2⤵
  - Executes dropped EXE
  PID:244
- C:\Windows\System\BOfimdG.exe
  C:\Windows\System\BOfimdG.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\xeIpzkN.exe
  C:\Windows\System\xeIpzkN.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\SBaIRPW.exe
  C:\Windows\System\SBaIRPW.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\IdvMejp.exe
  C:\Windows\System\IdvMejp.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\EaCHgHl.exe
  C:\Windows\System\EaCHgHl.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\rmxdrFr.exe
  C:\Windows\System\rmxdrFr.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\nzZpLIH.exe
  C:\Windows\System\nzZpLIH.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\sUNaUfS.exe
  C:\Windows\System\sUNaUfS.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\AVykuUE.exe
  C:\Windows\System\AVykuUE.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\WDEswLY.exe
  C:\Windows\System\WDEswLY.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\OCdvFmT.exe
  C:\Windows\System\OCdvFmT.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\gtMDGHs.exe
  C:\Windows\System\gtMDGHs.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\lzxgzeS.exe
  C:\Windows\System\lzxgzeS.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\qDaNnwr.exe
  C:\Windows\System\qDaNnwr.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\JmGWcoK.exe
  C:\Windows\System\JmGWcoK.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\yMbQRQV.exe
  C:\Windows\System\yMbQRQV.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\nsJfIOt.exe
  C:\Windows\System\nsJfIOt.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\xjtMRby.exe
  C:\Windows\System\xjtMRby.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\FdWNZFz.exe
  C:\Windows\System\FdWNZFz.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\DuqMsRn.exe
  C:\Windows\System\DuqMsRn.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\TykIlTM.exe
  C:\Windows\System\TykIlTM.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\tAdIXtk.exe
  C:\Windows\System\tAdIXtk.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\uBJXGIk.exe
  C:\Windows\System\uBJXGIk.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\GbLwbYu.exe
  C:\Windows\System\GbLwbYu.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\bfuzlXj.exe
  C:\Windows\System\bfuzlXj.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\YgPbKpT.exe
  C:\Windows\System\YgPbKpT.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\eULGagd.exe
  C:\Windows\System\eULGagd.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\GOsNFub.exe
  C:\Windows\System\GOsNFub.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\kTIYzBe.exe
  C:\Windows\System\kTIYzBe.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\FSidmGh.exe
  C:\Windows\System\FSidmGh.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\QHRIdrP.exe
  C:\Windows\System\QHRIdrP.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\KrrUzIS.exe
  C:\Windows\System\KrrUzIS.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\BwqTdeZ.exe
  C:\Windows\System\BwqTdeZ.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\TBjPYSI.exe
  C:\Windows\System\TBjPYSI.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\zbyfUsa.exe
  C:\Windows\System\zbyfUsa.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\YtdLybW.exe
  C:\Windows\System\YtdLybW.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\qYVKCJR.exe
  C:\Windows\System\qYVKCJR.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\fElKqWS.exe
  C:\Windows\System\fElKqWS.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\nUmykFB.exe
  C:\Windows\System\nUmykFB.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\yfnIUsk.exe
  C:\Windows\System\yfnIUsk.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\MIUkwtb.exe
  C:\Windows\System\MIUkwtb.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\cXJKZrJ.exe
  C:\Windows\System\cXJKZrJ.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\ZyALHTs.exe
  C:\Windows\System\ZyALHTs.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\jifKJYP.exe
  C:\Windows\System\jifKJYP.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\unBISVp.exe
  C:\Windows\System\unBISVp.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\aEeVveD.exe
  C:\Windows\System\aEeVveD.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\TBuRbZg.exe
  C:\Windows\System\TBuRbZg.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\DniUytd.exe
  C:\Windows\System\DniUytd.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\YyilITf.exe
  C:\Windows\System\YyilITf.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\ovujbAM.exe
  C:\Windows\System\ovujbAM.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\jZDNtzt.exe
  C:\Windows\System\jZDNtzt.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\FmgnSWZ.exe
  C:\Windows\System\FmgnSWZ.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\BBTtHIA.exe
  C:\Windows\System\BBTtHIA.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\otsektX.exe
  C:\Windows\System\otsektX.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\BvNSARn.exe
  C:\Windows\System\BvNSARn.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\IMFTybI.exe
  C:\Windows\System\IMFTybI.exe
  2⤵
  PID:3832
- C:\Windows\System\PHUVKLk.exe
  C:\Windows\System\PHUVKLk.exe
  2⤵
  PID:2580
- C:\Windows\System\oMzaUjZ.exe
  C:\Windows\System\oMzaUjZ.exe
  2⤵
  PID:1576
- C:\Windows\System\gloKPae.exe
  C:\Windows\System\gloKPae.exe
  2⤵
  PID:4864
- C:\Windows\System\cxsLKQH.exe
  C:\Windows\System\cxsLKQH.exe
  2⤵
  PID:2460
- C:\Windows\System\tqodZFq.exe
  C:\Windows\System\tqodZFq.exe
  2⤵
  PID:4340
- C:\Windows\System\UScUtDU.exe
  C:\Windows\System\UScUtDU.exe
  2⤵
  PID:3204
- C:\Windows\System\wmETwhp.exe
  C:\Windows\System\wmETwhp.exe
  2⤵
  PID:4872
- C:\Windows\System\exgyeyt.exe
  C:\Windows\System\exgyeyt.exe
  2⤵
  PID:3712
- C:\Windows\System\JAqnyrM.exe
  C:\Windows\System\JAqnyrM.exe
  2⤵
  PID:3696
- C:\Windows\System\bYSWxoU.exe
  C:\Windows\System\bYSWxoU.exe
  2⤵
  PID:100
- C:\Windows\System\GRzjQgR.exe
  C:\Windows\System\GRzjQgR.exe
  2⤵
  PID:3992
- C:\Windows\System\qCQoqHi.exe
  C:\Windows\System\qCQoqHi.exe
  2⤵
  PID:4248
- C:\Windows\System\ihYHMiO.exe
  C:\Windows\System\ihYHMiO.exe
  2⤵
  PID:564
- C:\Windows\System\MxiXqSg.exe
  C:\Windows\System\MxiXqSg.exe
  2⤵
  PID:1616
- C:\Windows\System\XGAmXZD.exe
  C:\Windows\System\XGAmXZD.exe
  2⤵
  PID:3260
- C:\Windows\System\BgGefJn.exe
  C:\Windows\System\BgGefJn.exe
  2⤵
  PID:2164
- C:\Windows\System\gjQcthO.exe
  C:\Windows\System\gjQcthO.exe
  2⤵
  PID:1872
- C:\Windows\System\iCskQXW.exe
  C:\Windows\System\iCskQXW.exe
  2⤵
  PID:1256
- C:\Windows\System\qgjKqYz.exe
  C:\Windows\System\qgjKqYz.exe
  2⤵
  PID:1028
- C:\Windows\System\uBsYvcW.exe
  C:\Windows\System\uBsYvcW.exe
  2⤵
  PID:1436
- C:\Windows\System\hJyAofn.exe
  C:\Windows\System\hJyAofn.exe
  2⤵
  PID:4428
- C:\Windows\System\XXdIELZ.exe
  C:\Windows\System\XXdIELZ.exe
  2⤵
  PID:5060
- C:\Windows\System\jtCKmsZ.exe
  C:\Windows\System\jtCKmsZ.exe
  2⤵
  PID:1856
- C:\Windows\System\cBWNUBN.exe
  C:\Windows\System\cBWNUBN.exe
  2⤵
  PID:3592
- C:\Windows\System\TlalPAo.exe
  C:\Windows\System\TlalPAo.exe
  2⤵
  PID:1900
- C:\Windows\System\mNpKKgS.exe
  C:\Windows\System\mNpKKgS.exe
  2⤵
  PID:3916
- C:\Windows\System\nbPMEaZ.exe
  C:\Windows\System\nbPMEaZ.exe
  2⤵
  PID:780
- C:\Windows\System\sRlHGfo.exe
  C:\Windows\System\sRlHGfo.exe
  2⤵
  PID:5024
- C:\Windows\System\KQmPOlP.exe
  C:\Windows\System\KQmPOlP.exe
  2⤵
  PID:4196
- C:\Windows\System\COJJUTi.exe
  C:\Windows\System\COJJUTi.exe
  2⤵
  PID:5160
- C:\Windows\System\YxdPzTY.exe
  C:\Windows\System\YxdPzTY.exe
  2⤵
  PID:5204
- C:\Windows\System\WuCcDHO.exe
  C:\Windows\System\WuCcDHO.exe
  2⤵
  PID:5232
- C:\Windows\System\AVLBIgD.exe
  C:\Windows\System\AVLBIgD.exe
  2⤵
  PID:5268
- C:\Windows\System\bFzzbDZ.exe
  C:\Windows\System\bFzzbDZ.exe
  2⤵
  PID:5296
- C:\Windows\System\uUnDncn.exe
  C:\Windows\System\uUnDncn.exe
  2⤵
  PID:5328
- C:\Windows\System\gxTDkbu.exe
  C:\Windows\System\gxTDkbu.exe
  2⤵
  PID:5364
- C:\Windows\System\PtWMimK.exe
  C:\Windows\System\PtWMimK.exe
  2⤵
  PID:5396
- C:\Windows\System\xXSzNnH.exe
  C:\Windows\System\xXSzNnH.exe
  2⤵
  PID:5416
- C:\Windows\System\fPpmWwg.exe
  C:\Windows\System\fPpmWwg.exe
  2⤵
  PID:5452
- C:\Windows\System\QsQTwOT.exe
  C:\Windows\System\QsQTwOT.exe
  2⤵
  PID:5492
- C:\Windows\System\TaUnAlH.exe
  C:\Windows\System\TaUnAlH.exe
  2⤵
  PID:5520
- C:\Windows\System\zHEXavr.exe
  C:\Windows\System\zHEXavr.exe
  2⤵
  PID:5564
- C:\Windows\System\FCNgtdA.exe
  C:\Windows\System\FCNgtdA.exe
  2⤵
  PID:5592
- C:\Windows\System\SYvoIap.exe
  C:\Windows\System\SYvoIap.exe
  2⤵
  PID:5632
- C:\Windows\System\SLFLWhl.exe
  C:\Windows\System\SLFLWhl.exe
  2⤵
  PID:5672
- C:\Windows\System\DBzkpEL.exe
  C:\Windows\System\DBzkpEL.exe
  2⤵
  PID:5712
- C:\Windows\System\qDMSQPi.exe
  C:\Windows\System\qDMSQPi.exe
  2⤵
  PID:5744
- C:\Windows\System\yktbjNh.exe
  C:\Windows\System\yktbjNh.exe
  2⤵
  PID:5776
- C:\Windows\System\koONhMb.exe
  C:\Windows\System\koONhMb.exe
  2⤵
  PID:5808
- C:\Windows\System\NURnmex.exe
  C:\Windows\System\NURnmex.exe
  2⤵
  PID:5840
- C:\Windows\System\JZdVdMl.exe
  C:\Windows\System\JZdVdMl.exe
  2⤵
  PID:5876
- C:\Windows\System\ISbqliR.exe
  C:\Windows\System\ISbqliR.exe
  2⤵
  PID:5892
- C:\Windows\System\RGCDMgz.exe
  C:\Windows\System\RGCDMgz.exe
  2⤵
  PID:5912
- C:\Windows\System\oIuLvqJ.exe
  C:\Windows\System\oIuLvqJ.exe
  2⤵
  PID:5932
- C:\Windows\System\SnfKiYN.exe
  C:\Windows\System\SnfKiYN.exe
  2⤵
  PID:5972
- C:\Windows\System\DSbCLKZ.exe
  C:\Windows\System\DSbCLKZ.exe
  2⤵
  PID:6004
- C:\Windows\System\XPKZiGf.exe
  C:\Windows\System\XPKZiGf.exe
  2⤵
  PID:6040
- C:\Windows\System\ghyfzix.exe
  C:\Windows\System\ghyfzix.exe
  2⤵
  PID:6068
- C:\Windows\System\LfyFzYe.exe
  C:\Windows\System\LfyFzYe.exe
  2⤵
  PID:6096
- C:\Windows\System\bAkjeEk.exe
  C:\Windows\System\bAkjeEk.exe
  2⤵
  PID:6128
- C:\Windows\System\PGLPiDy.exe
  C:\Windows\System\PGLPiDy.exe
  2⤵
  PID:5128
- C:\Windows\System\RLNzmay.exe
  C:\Windows\System\RLNzmay.exe
  2⤵
  PID:5176
- C:\Windows\System\FfowdBW.exe
  C:\Windows\System\FfowdBW.exe
  2⤵
  PID:5340
- C:\Windows\System\vNszbIp.exe
  C:\Windows\System\vNszbIp.exe
  2⤵
  PID:5408
- C:\Windows\System\gUmTTHm.exe
  C:\Windows\System\gUmTTHm.exe
  2⤵
  PID:5508
- C:\Windows\System\AkNOLJp.exe
  C:\Windows\System\AkNOLJp.exe
  2⤵
  PID:5604
- C:\Windows\System\snkTAYp.exe
  C:\Windows\System\snkTAYp.exe
  2⤵
  PID:5668
- C:\Windows\System\RZKgRea.exe
  C:\Windows\System\RZKgRea.exe
  2⤵
  PID:5752
- C:\Windows\System\Yputhsn.exe
  C:\Windows\System\Yputhsn.exe
  2⤵
  PID:5820
- C:\Windows\System\SnCjTkK.exe
  C:\Windows\System\SnCjTkK.exe
  2⤵
  PID:5868
- C:\Windows\System\HUNyLeM.exe
  C:\Windows\System\HUNyLeM.exe
  2⤵
  PID:5904
- C:\Windows\System\CdoqOBd.exe
  C:\Windows\System\CdoqOBd.exe
  2⤵
  PID:6028
- C:\Windows\System\CebStbm.exe
  C:\Windows\System\CebStbm.exe
  2⤵
  PID:6112
- C:\Windows\System\pjeJKfn.exe
  C:\Windows\System\pjeJKfn.exe
  2⤵
  PID:4968
- C:\Windows\System\ybAeIra.exe
  C:\Windows\System\ybAeIra.exe
  2⤵
  PID:5252
- C:\Windows\System\tkvyCuT.exe
  C:\Windows\System\tkvyCuT.exe
  2⤵
  PID:5532
- C:\Windows\System\PuCaqqR.exe
  C:\Windows\System\PuCaqqR.exe
  2⤵
  PID:5736
- C:\Windows\System\kQkRFuO.exe
  C:\Windows\System\kQkRFuO.exe
  2⤵
  PID:5884
- C:\Windows\System\EiRZzRM.exe
  C:\Windows\System\EiRZzRM.exe
  2⤵
  PID:5968
- C:\Windows\System\JvTBbIS.exe
  C:\Windows\System\JvTBbIS.exe
  2⤵
  PID:5228
- C:\Windows\System\dZsGXEl.exe
  C:\Windows\System\dZsGXEl.exe
  2⤵
  PID:5484
- C:\Windows\System\jdtqKdU.exe
  C:\Windows\System\jdtqKdU.exe
  2⤵
  PID:6024
- C:\Windows\System\VVMzQfi.exe
  C:\Windows\System\VVMzQfi.exe
  2⤵
  PID:5928
- C:\Windows\System\JpjPKDc.exe
  C:\Windows\System\JpjPKDc.exe
  2⤵
  PID:6332
- C:\Windows\System\IaDfrIy.exe
  C:\Windows\System\IaDfrIy.exe
  2⤵
  PID:6364
- C:\Windows\System\TbzESjG.exe
  C:\Windows\System\TbzESjG.exe
  2⤵
  PID:6396
- C:\Windows\System\aaklXjo.exe
  C:\Windows\System\aaklXjo.exe
  2⤵
  PID:6412
- C:\Windows\System\hMiJwfI.exe
  C:\Windows\System\hMiJwfI.exe
  2⤵
  PID:6440
- C:\Windows\System\MiKwdkz.exe
  C:\Windows\System\MiKwdkz.exe
  2⤵
  PID:6476
- C:\Windows\System\JjIUySv.exe
  C:\Windows\System\JjIUySv.exe
  2⤵
  PID:6516
- C:\Windows\System\BckuUYI.exe
  C:\Windows\System\BckuUYI.exe
  2⤵
  PID:6540
- C:\Windows\System\eJhQoIh.exe
  C:\Windows\System\eJhQoIh.exe
  2⤵
  PID:6584
- C:\Windows\System\FsIbslx.exe
  C:\Windows\System\FsIbslx.exe
  2⤵
  PID:6604
- C:\Windows\System\vOuGTeq.exe
  C:\Windows\System\vOuGTeq.exe
  2⤵
  PID:6632
- C:\Windows\System\biSYXYP.exe
  C:\Windows\System\biSYXYP.exe
  2⤵
  PID:6660
- C:\Windows\System\UQEcIyB.exe
  C:\Windows\System\UQEcIyB.exe
  2⤵
  PID:6688
- C:\Windows\System\rMKYyoE.exe
  C:\Windows\System\rMKYyoE.exe
  2⤵
  PID:6704
- C:\Windows\System\DbHEkMv.exe
  C:\Windows\System\DbHEkMv.exe
  2⤵
  PID:6744
- C:\Windows\System\yyfkAOr.exe
  C:\Windows\System\yyfkAOr.exe
  2⤵
  PID:6776
- C:\Windows\System\kZwCmKB.exe
  C:\Windows\System\kZwCmKB.exe
  2⤵
  PID:6800
- C:\Windows\System\MtgEuoh.exe
  C:\Windows\System\MtgEuoh.exe
  2⤵
  PID:6828
- C:\Windows\System\lPzAWIs.exe
  C:\Windows\System\lPzAWIs.exe
  2⤵
  PID:6844
- C:\Windows\System\ooDybji.exe
  C:\Windows\System\ooDybji.exe
  2⤵
  PID:6884
- C:\Windows\System\NECVWFG.exe
  C:\Windows\System\NECVWFG.exe
  2⤵
  PID:6916
- C:\Windows\System\LlkhHnu.exe
  C:\Windows\System\LlkhHnu.exe
  2⤵
  PID:6940
- C:\Windows\System\QKPQyIW.exe
  C:\Windows\System\QKPQyIW.exe
  2⤵
  PID:6972
- C:\Windows\System\azUsIok.exe
  C:\Windows\System\azUsIok.exe
  2⤵
  PID:7004
- C:\Windows\System\qIXiKrA.exe
  C:\Windows\System\qIXiKrA.exe
  2⤵
  PID:7028
- C:\Windows\System\pQdkeGr.exe
  C:\Windows\System\pQdkeGr.exe
  2⤵
  PID:7052
- C:\Windows\System\LJVKtzP.exe
  C:\Windows\System\LJVKtzP.exe
  2⤵
  PID:7080
- C:\Windows\System\hTMUfIa.exe
  C:\Windows\System\hTMUfIa.exe
  2⤵
  PID:7112
- C:\Windows\System\WEuuTTG.exe
  C:\Windows\System\WEuuTTG.exe
  2⤵
  PID:7136
- C:\Windows\System\qlzvQDg.exe
  C:\Windows\System\qlzvQDg.exe
  2⤵
  PID:7164
- C:\Windows\System\qmAeOzp.exe
  C:\Windows\System\qmAeOzp.exe
  2⤵
  PID:6168
- C:\Windows\System\HXLeIld.exe
  C:\Windows\System\HXLeIld.exe
  2⤵
  PID:6200
- C:\Windows\System\GbAchjn.exe
  C:\Windows\System\GbAchjn.exe
  2⤵
  PID:6240
- C:\Windows\System\UsTyPAr.exe
  C:\Windows\System\UsTyPAr.exe
  2⤵
  PID:6208
- C:\Windows\System\uvPgIGM.exe
  C:\Windows\System\uvPgIGM.exe
  2⤵
  PID:6272
- C:\Windows\System\tKuthSS.exe
  C:\Windows\System\tKuthSS.exe
  2⤵
  PID:6336
- C:\Windows\System\WNhsuNb.exe
  C:\Windows\System\WNhsuNb.exe
  2⤵
  PID:6392
- C:\Windows\System\TppTbTm.exe
  C:\Windows\System\TppTbTm.exe
  2⤵
  PID:6300
- C:\Windows\System\aXrdHOx.exe
  C:\Windows\System\aXrdHOx.exe
  2⤵
  PID:6460
- C:\Windows\System\yDVuttA.exe
  C:\Windows\System\yDVuttA.exe
  2⤵
  PID:6536
- C:\Windows\System\GSZttMj.exe
  C:\Windows\System\GSZttMj.exe
  2⤵
  PID:6596
- C:\Windows\System\TiPIbOb.exe
  C:\Windows\System\TiPIbOb.exe
  2⤵
  PID:6672
- C:\Windows\System\lhFfhfH.exe
  C:\Windows\System\lhFfhfH.exe
  2⤵
  PID:6732
- C:\Windows\System\OEYkRku.exe
  C:\Windows\System\OEYkRku.exe
  2⤵
  PID:6796
- C:\Windows\System\dsaSUVJ.exe
  C:\Windows\System\dsaSUVJ.exe
  2⤵
  PID:6868
- C:\Windows\System\nBTnOqh.exe
  C:\Windows\System\nBTnOqh.exe
  2⤵
  PID:6924
- C:\Windows\System\gMdsRNN.exe
  C:\Windows\System\gMdsRNN.exe
  2⤵
  PID:6988
- C:\Windows\System\AiZbacK.exe
  C:\Windows\System\AiZbacK.exe
  2⤵
  PID:7064
- C:\Windows\System\HRWmLfR.exe
  C:\Windows\System\HRWmLfR.exe
  2⤵
  PID:7128
- C:\Windows\System\VTwRxAL.exe
  C:\Windows\System\VTwRxAL.exe
  2⤵
  PID:6164
- C:\Windows\System\LGYiGta.exe
  C:\Windows\System\LGYiGta.exe
  2⤵
  PID:6172
- C:\Windows\System\IbsuaEM.exe
  C:\Windows\System\IbsuaEM.exe
  2⤵
  PID:6284
- C:\Windows\System\wcHSXgT.exe
  C:\Windows\System\wcHSXgT.exe
  2⤵
  PID:6304
- C:\Windows\System\MpuLvih.exe
  C:\Windows\System\MpuLvih.exe
  2⤵
  PID:6524
- C:\Windows\System\FCAFGBv.exe
  C:\Windows\System\FCAFGBv.exe
  2⤵
  PID:6716
- C:\Windows\System\JstgFpB.exe
  C:\Windows\System\JstgFpB.exe
  2⤵
  PID:6840
- C:\Windows\System\JWwliLQ.exe
  C:\Windows\System\JWwliLQ.exe
  2⤵
  PID:7016
- C:\Windows\System\zfgxdPb.exe
  C:\Windows\System\zfgxdPb.exe
  2⤵
  PID:7148
- C:\Windows\System\DFpKFIS.exe
  C:\Windows\System\DFpKFIS.exe
  2⤵
  PID:6384
- C:\Windows\System\tKwqhPo.exe
  C:\Windows\System\tKwqhPo.exe
  2⤵
  PID:6500
- C:\Windows\System\AIFHUQf.exe
  C:\Windows\System\AIFHUQf.exe
  2⤵
  PID:6820
- C:\Windows\System\bkqBAdg.exe
  C:\Windows\System\bkqBAdg.exe
  2⤵
  PID:6192
- C:\Windows\System\tiJCMSu.exe
  C:\Windows\System\tiJCMSu.exe
  2⤵
  PID:6756
- C:\Windows\System\rYphMDe.exe
  C:\Windows\System\rYphMDe.exe
  2⤵
  PID:6652
- C:\Windows\System\qbLsZNa.exe
  C:\Windows\System\qbLsZNa.exe
  2⤵
  PID:7188
- C:\Windows\System\udMpPCf.exe
  C:\Windows\System\udMpPCf.exe
  2⤵
  PID:7216
- C:\Windows\System\xxpnJUA.exe
  C:\Windows\System\xxpnJUA.exe
  2⤵
  PID:7244
- C:\Windows\System\ybhRbcL.exe
  C:\Windows\System\ybhRbcL.exe
  2⤵
  PID:7280
- C:\Windows\System\hltBJeh.exe
  C:\Windows\System\hltBJeh.exe
  2⤵
  PID:7300
- C:\Windows\System\LYDNqnD.exe
  C:\Windows\System\LYDNqnD.exe
  2⤵
  PID:7328
- C:\Windows\System\xpMZhYz.exe
  C:\Windows\System\xpMZhYz.exe
  2⤵
  PID:7356
- C:\Windows\System\RPVUJuW.exe
  C:\Windows\System\RPVUJuW.exe
  2⤵
  PID:7384
- C:\Windows\System\JiQmZsS.exe
  C:\Windows\System\JiQmZsS.exe
  2⤵
  PID:7408
- C:\Windows\System\kbbBzsd.exe
  C:\Windows\System\kbbBzsd.exe
  2⤵
  PID:7440
- C:\Windows\System\PIvaOFQ.exe
  C:\Windows\System\PIvaOFQ.exe
  2⤵
  PID:7468
- C:\Windows\System\PjOzWkH.exe
  C:\Windows\System\PjOzWkH.exe
  2⤵
  PID:7492
- C:\Windows\System\CdGzOqa.exe
  C:\Windows\System\CdGzOqa.exe
  2⤵
  PID:7520
- C:\Windows\System\CDApDmp.exe
  C:\Windows\System\CDApDmp.exe
  2⤵
  PID:7540
- C:\Windows\System\MWsvXHN.exe
  C:\Windows\System\MWsvXHN.exe
  2⤵
  PID:7568
- C:\Windows\System\hXUovHR.exe
  C:\Windows\System\hXUovHR.exe
  2⤵
  PID:7600
- C:\Windows\System\wBvXsUU.exe
  C:\Windows\System\wBvXsUU.exe
  2⤵
  PID:7636
- C:\Windows\System\NZucXmN.exe
  C:\Windows\System\NZucXmN.exe
  2⤵
  PID:7652
- C:\Windows\System\HqThbuf.exe
  C:\Windows\System\HqThbuf.exe
  2⤵
  PID:7680
- C:\Windows\System\VtjLjRL.exe
  C:\Windows\System\VtjLjRL.exe
  2⤵
  PID:7708
- C:\Windows\System\hCDOqVL.exe
  C:\Windows\System\hCDOqVL.exe
  2⤵
  PID:7732
- C:\Windows\System\swqgZkU.exe
  C:\Windows\System\swqgZkU.exe
  2⤵
  PID:7764
- C:\Windows\System\bGsHuDF.exe
  C:\Windows\System\bGsHuDF.exe
  2⤵
  PID:7792
- C:\Windows\System\LnLELfW.exe
  C:\Windows\System\LnLELfW.exe
  2⤵
  PID:7824
- C:\Windows\System\udBuCQf.exe
  C:\Windows\System\udBuCQf.exe
  2⤵
  PID:7856
- C:\Windows\System\XoiFPfg.exe
  C:\Windows\System\XoiFPfg.exe
  2⤵
  PID:7884
- C:\Windows\System\yPKjWDw.exe
  C:\Windows\System\yPKjWDw.exe
  2⤵
  PID:7908
- C:\Windows\System\FTKrpIr.exe
  C:\Windows\System\FTKrpIr.exe
  2⤵
  PID:7944
- C:\Windows\System\MmLAdFE.exe
  C:\Windows\System\MmLAdFE.exe
  2⤵
  PID:7972
- C:\Windows\System\cbmUnoo.exe
  C:\Windows\System\cbmUnoo.exe
  2⤵
  PID:8000
- C:\Windows\System\FhBCVgB.exe
  C:\Windows\System\FhBCVgB.exe
  2⤵
  PID:8024
- C:\Windows\System\FYMrEvG.exe
  C:\Windows\System\FYMrEvG.exe
  2⤵
  PID:8044
- C:\Windows\System\JUAHnmF.exe
  C:\Windows\System\JUAHnmF.exe
  2⤵
  PID:8072
- C:\Windows\System\dtMwrUZ.exe
  C:\Windows\System\dtMwrUZ.exe
  2⤵
  PID:8100
- C:\Windows\System\iMzhGDC.exe
  C:\Windows\System\iMzhGDC.exe
  2⤵
  PID:8128
- C:\Windows\System\qpUquDM.exe
  C:\Windows\System\qpUquDM.exe
  2⤵
  PID:8156
- C:\Windows\System\DmSOWoq.exe
  C:\Windows\System\DmSOWoq.exe
  2⤵
  PID:8176
- C:\Windows\System\EHZjwrd.exe
  C:\Windows\System\EHZjwrd.exe
  2⤵
  PID:7208
- C:\Windows\System\YOLYtUx.exe
  C:\Windows\System\YOLYtUx.exe
  2⤵
  PID:7288
- C:\Windows\System\ttUWdEl.exe
  C:\Windows\System\ttUWdEl.exe
  2⤵
  PID:7340
- C:\Windows\System\ttxEkbG.exe
  C:\Windows\System\ttxEkbG.exe
  2⤵
  PID:7428
- C:\Windows\System\vorwhri.exe
  C:\Windows\System\vorwhri.exe
  2⤵
  PID:7484
- C:\Windows\System\BsmrqhK.exe
  C:\Windows\System\BsmrqhK.exe
  2⤵
  PID:7556
- C:\Windows\System\hSTWnFW.exe
  C:\Windows\System\hSTWnFW.exe
  2⤵
  PID:7632
- C:\Windows\System\naoKLYb.exe
  C:\Windows\System\naoKLYb.exe
  2⤵
  PID:7668
- C:\Windows\System\jCyNlck.exe
  C:\Windows\System\jCyNlck.exe
  2⤵
  PID:7752
- C:\Windows\System\eVnsCcl.exe
  C:\Windows\System\eVnsCcl.exe
  2⤵
  PID:7832
- C:\Windows\System\qZJfmER.exe
  C:\Windows\System\qZJfmER.exe
  2⤵
  PID:7876
- C:\Windows\System\nVoyByU.exe
  C:\Windows\System\nVoyByU.exe
  2⤵
  PID:7932
- C:\Windows\System\hvaEbdd.exe
  C:\Windows\System\hvaEbdd.exe
  2⤵
  PID:7988
- C:\Windows\System\vQbpinw.exe
  C:\Windows\System\vQbpinw.exe
  2⤵
  PID:8068
- C:\Windows\System\yGJYvSX.exe
  C:\Windows\System\yGJYvSX.exe
  2⤵
  PID:8124
- C:\Windows\System\KuTKZwo.exe
  C:\Windows\System\KuTKZwo.exe
  2⤵
  PID:7256
- C:\Windows\System\fNndUEL.exe
  C:\Windows\System\fNndUEL.exe
  2⤵
  PID:7368
- C:\Windows\System\iWUDaBW.exe
  C:\Windows\System\iWUDaBW.exe
  2⤵
  PID:7532
- C:\Windows\System\frHWvpK.exe
  C:\Windows\System\frHWvpK.exe
  2⤵
  PID:7720
- C:\Windows\System\KVPOgie.exe
  C:\Windows\System\KVPOgie.exe
  2⤵
  PID:7804
- C:\Windows\System\nOCkZtS.exe
  C:\Windows\System\nOCkZtS.exe
  2⤵
  PID:8036
- C:\Windows\System\akHLjmx.exe
  C:\Windows\System\akHLjmx.exe
  2⤵
  PID:7324
- C:\Windows\System\sXFgvEJ.exe
  C:\Windows\System\sXFgvEJ.exe
  2⤵
  PID:8144
- C:\Windows\System\CfehOdn.exe
  C:\Windows\System\CfehOdn.exe
  2⤵
  PID:7840
- C:\Windows\System\OUeCZaK.exe
  C:\Windows\System\OUeCZaK.exe
  2⤵
  PID:7212
- C:\Windows\System\BzTzFVQ.exe
  C:\Windows\System\BzTzFVQ.exe
  2⤵
  PID:8216
- C:\Windows\System\AyPGcfd.exe
  C:\Windows\System\AyPGcfd.exe
  2⤵
  PID:8244
- C:\Windows\System\LsGSjeY.exe
  C:\Windows\System\LsGSjeY.exe
  2⤵
  PID:8284
- C:\Windows\System\XvRrIZS.exe
  C:\Windows\System\XvRrIZS.exe
  2⤵
  PID:8324
- C:\Windows\System\LloOxhl.exe
  C:\Windows\System\LloOxhl.exe
  2⤵
  PID:8344
- C:\Windows\System\QMECmor.exe
  C:\Windows\System\QMECmor.exe
  2⤵
  PID:8380
- C:\Windows\System\hGlMchP.exe
  C:\Windows\System\hGlMchP.exe
  2⤵
  PID:8412
- C:\Windows\System\Cenfakq.exe
  C:\Windows\System\Cenfakq.exe
  2⤵
  PID:8440
- C:\Windows\System\aZHzfIf.exe
  C:\Windows\System\aZHzfIf.exe
  2⤵
  PID:8468
- C:\Windows\System\hFieUQx.exe
  C:\Windows\System\hFieUQx.exe
  2⤵
  PID:8484
- C:\Windows\System\KbBCZCY.exe
  C:\Windows\System\KbBCZCY.exe
  2⤵
  PID:8524
- C:\Windows\System\lBdMbpu.exe
  C:\Windows\System\lBdMbpu.exe
  2⤵
  PID:8540
- C:\Windows\System\itPurhU.exe
  C:\Windows\System\itPurhU.exe
  2⤵
  PID:8568
- C:\Windows\System\IZHnwDj.exe
  C:\Windows\System\IZHnwDj.exe
  2⤵
  PID:8608
- C:\Windows\System\vQJSCWg.exe
  C:\Windows\System\vQJSCWg.exe
  2⤵
  PID:8648
- C:\Windows\System\WfYTXvl.exe
  C:\Windows\System\WfYTXvl.exe
  2⤵
  PID:8676
- C:\Windows\System\ntjgyRH.exe
  C:\Windows\System\ntjgyRH.exe
  2⤵
  PID:8692
- C:\Windows\System\XDQkKKK.exe
  C:\Windows\System\XDQkKKK.exe
  2⤵
  PID:8732
- C:\Windows\System\COtqNUr.exe
  C:\Windows\System\COtqNUr.exe
  2⤵
  PID:8752
- C:\Windows\System\JygfpZI.exe
  C:\Windows\System\JygfpZI.exe
  2⤵
  PID:8780
- C:\Windows\System\pTEumAw.exe
  C:\Windows\System\pTEumAw.exe
  2⤵
  PID:8808
- C:\Windows\System\wzBiKqk.exe
  C:\Windows\System\wzBiKqk.exe
  2⤵
  PID:8848
- C:\Windows\System\MDxwjpm.exe
  C:\Windows\System\MDxwjpm.exe
  2⤵
  PID:8868
- C:\Windows\System\qjyVaSH.exe
  C:\Windows\System\qjyVaSH.exe
  2⤵
  PID:8892
- C:\Windows\System\SSgwRZR.exe
  C:\Windows\System\SSgwRZR.exe
  2⤵
  PID:8920
- C:\Windows\System\KSbYobq.exe
  C:\Windows\System\KSbYobq.exe
  2⤵
  PID:8956
- C:\Windows\System\YrZvKLj.exe
  C:\Windows\System\YrZvKLj.exe
  2⤵
  PID:8976
- C:\Windows\System\QaWtKYq.exe
  C:\Windows\System\QaWtKYq.exe
  2⤵
  PID:8996
- C:\Windows\System\AMAYoHg.exe
  C:\Windows\System\AMAYoHg.exe
  2⤵
  PID:9024
- C:\Windows\System\bcWMSyc.exe
  C:\Windows\System\bcWMSyc.exe
  2⤵
  PID:9056
- C:\Windows\System\uPpSHMI.exe
  C:\Windows\System\uPpSHMI.exe
  2⤵
  PID:9080
- C:\Windows\System\glcNtHx.exe
  C:\Windows\System\glcNtHx.exe
  2⤵
  PID:9120
- C:\Windows\System\poHQcGd.exe
  C:\Windows\System\poHQcGd.exe
  2⤵
  PID:9140
- C:\Windows\System\uXlwpKe.exe
  C:\Windows\System\uXlwpKe.exe
  2⤵
  PID:9164
- C:\Windows\System\NzWkVJz.exe
  C:\Windows\System\NzWkVJz.exe
  2⤵
  PID:9184
- C:\Windows\System\KRhaBtC.exe
  C:\Windows\System\KRhaBtC.exe
  2⤵
  PID:7672
- C:\Windows\System\GkoFwVJ.exe
  C:\Windows\System\GkoFwVJ.exe
  2⤵
  PID:8140
- C:\Windows\System\wNUwLit.exe
  C:\Windows\System\wNUwLit.exe
  2⤵
  PID:8260
- C:\Windows\System\MdUHzjg.exe
  C:\Windows\System\MdUHzjg.exe
  2⤵
  PID:8376
- C:\Windows\System\SuswUmF.exe
  C:\Windows\System\SuswUmF.exe
  2⤵
  PID:8392
- C:\Windows\System\AdxRTOy.exe
  C:\Windows\System\AdxRTOy.exe
  2⤵
  PID:8432
- C:\Windows\System\KjzFuzI.exe
  C:\Windows\System\KjzFuzI.exe
  2⤵
  PID:8508
- C:\Windows\System\KszRNNC.exe
  C:\Windows\System\KszRNNC.exe
  2⤵
  PID:8592
- C:\Windows\System\qdQwwgn.exe
  C:\Windows\System\qdQwwgn.exe
  2⤵
  PID:8604
- C:\Windows\System\vXjTvbD.exe
  C:\Windows\System\vXjTvbD.exe
  2⤵
  PID:8704
- C:\Windows\System\hErtNFB.exe
  C:\Windows\System\hErtNFB.exe
  2⤵
  PID:8816
- C:\Windows\System\DbbsPCb.exe
  C:\Windows\System\DbbsPCb.exe
  2⤵
  PID:8888
- C:\Windows\System\YZOYTEi.exe
  C:\Windows\System\YZOYTEi.exe
  2⤵
  PID:8972
- C:\Windows\System\JOraTpJ.exe
  C:\Windows\System\JOraTpJ.exe
  2⤵
  PID:8968
- C:\Windows\System\wuqDOVC.exe
  C:\Windows\System\wuqDOVC.exe
  2⤵
  PID:9092
- C:\Windows\System\HfwHZDw.exe
  C:\Windows\System\HfwHZDw.exe
  2⤵
  PID:9148
- C:\Windows\System\FSojyuV.exe
  C:\Windows\System\FSojyuV.exe
  2⤵
  PID:9208
- C:\Windows\System\WVGPTuo.exe
  C:\Windows\System\WVGPTuo.exe
  2⤵
  PID:8196
- C:\Windows\System\hOcoLuX.exe
  C:\Windows\System\hOcoLuX.exe
  2⤵
  PID:8428
- C:\Windows\System\XuTpohe.exe
  C:\Windows\System\XuTpohe.exe
  2⤵
  PID:8688
- C:\Windows\System\wNCUVoi.exe
  C:\Windows\System\wNCUVoi.exe
  2⤵
  PID:8796
- C:\Windows\System\MDzaIYq.exe
  C:\Windows\System\MDzaIYq.exe
  2⤵
  PID:8936
- C:\Windows\System\chYTaZV.exe
  C:\Windows\System\chYTaZV.exe
  2⤵
  PID:9156
- C:\Windows\System\QZgIJJT.exe
  C:\Windows\System\QZgIJJT.exe
  2⤵
  PID:8204
- C:\Windows\System\JUxOeLT.exe
  C:\Windows\System\JUxOeLT.exe
  2⤵
  PID:8452
- C:\Windows\System\fWpMFkC.exe
  C:\Windows\System\fWpMFkC.exe
  2⤵
  PID:8840
- C:\Windows\System\owJfXDO.exe
  C:\Windows\System\owJfXDO.exe
  2⤵
  PID:8228
- C:\Windows\System\AGgXFyw.exe
  C:\Windows\System\AGgXFyw.exe
  2⤵
  PID:9008
- C:\Windows\System\HFgJsVJ.exe
  C:\Windows\System\HFgJsVJ.exe
  2⤵
  PID:9232
- C:\Windows\System\FcDaCjz.exe
  C:\Windows\System\FcDaCjz.exe
  2⤵
  PID:9260
- C:\Windows\System\VnEilMq.exe
  C:\Windows\System\VnEilMq.exe
  2⤵
  PID:9280
- C:\Windows\System\OffKwCW.exe
  C:\Windows\System\OffKwCW.exe
  2⤵
  PID:9316
- C:\Windows\System\TkOxCwA.exe
  C:\Windows\System\TkOxCwA.exe
  2⤵
  PID:9344
- C:\Windows\System\QNbMTDX.exe
  C:\Windows\System\QNbMTDX.exe
  2⤵
  PID:9380
- C:\Windows\System\yDVlZXf.exe
  C:\Windows\System\yDVlZXf.exe
  2⤵
  PID:9400
- C:\Windows\System\bQdDbFk.exe
  C:\Windows\System\bQdDbFk.exe
  2⤵
  PID:9432
- C:\Windows\System\radHFgW.exe
  C:\Windows\System\radHFgW.exe
  2⤵
  PID:9460
- C:\Windows\System\RUoLNqE.exe
  C:\Windows\System\RUoLNqE.exe
  2⤵
  PID:9484
- C:\Windows\System\EeETvXr.exe
  C:\Windows\System\EeETvXr.exe
  2⤵
  PID:9532
- C:\Windows\System\bpIsIrh.exe
  C:\Windows\System\bpIsIrh.exe
  2⤵
  PID:9552
- C:\Windows\System\FFgiheq.exe
  C:\Windows\System\FFgiheq.exe
  2⤵
  PID:9568
- C:\Windows\System\gdEilaa.exe
  C:\Windows\System\gdEilaa.exe
  2⤵
  PID:9596
- C:\Windows\System\DUbtmMa.exe
  C:\Windows\System\DUbtmMa.exe
  2⤵
  PID:9624
- C:\Windows\System\DGrhmgh.exe
  C:\Windows\System\DGrhmgh.exe
  2⤵
  PID:9652
- C:\Windows\System\IraLrbe.exe
  C:\Windows\System\IraLrbe.exe
  2⤵
  PID:9680
- C:\Windows\System\aUUqgaq.exe
  C:\Windows\System\aUUqgaq.exe
  2⤵
  PID:9704
- C:\Windows\System\MlBsjdo.exe
  C:\Windows\System\MlBsjdo.exe
  2⤵
  PID:9728
- C:\Windows\System\JsIyNPa.exe
  C:\Windows\System\JsIyNPa.exe
  2⤵
  PID:9764
- C:\Windows\System\QXepQZx.exe
  C:\Windows\System\QXepQZx.exe
  2⤵
  PID:9792
- C:\Windows\System\iPdWqMw.exe
  C:\Windows\System\iPdWqMw.exe
  2⤵
  PID:9820
- C:\Windows\System\vBSHYFi.exe
  C:\Windows\System\vBSHYFi.exe
  2⤵
  PID:9844
- C:\Windows\System\aXXJBqs.exe
  C:\Windows\System\aXXJBqs.exe
  2⤵
  PID:9868
- C:\Windows\System\lkIvZgB.exe
  C:\Windows\System\lkIvZgB.exe
  2⤵
  PID:9904
- C:\Windows\System\ejBCTFs.exe
  C:\Windows\System\ejBCTFs.exe
  2⤵
  PID:9932
- C:\Windows\System\pfaLhHU.exe
  C:\Windows\System\pfaLhHU.exe
  2⤵
  PID:9952
- C:\Windows\System\XRkjJEP.exe
  C:\Windows\System\XRkjJEP.exe
  2⤵
  PID:9968
- C:\Windows\System\QbbBifG.exe
  C:\Windows\System\QbbBifG.exe
  2⤵
  PID:9992
- C:\Windows\System\tfyELkS.exe
  C:\Windows\System\tfyELkS.exe
  2⤵
  PID:10020
- C:\Windows\System\FKFGuTk.exe
  C:\Windows\System\FKFGuTk.exe
  2⤵
  PID:10056
- C:\Windows\System\bbiYLfL.exe
  C:\Windows\System\bbiYLfL.exe
  2⤵
  PID:10084
- C:\Windows\System\pcbhKJm.exe
  C:\Windows\System\pcbhKJm.exe
  2⤵
  PID:10108
- C:\Windows\System\RsYYeMh.exe
  C:\Windows\System\RsYYeMh.exe
  2⤵
  PID:10144
- C:\Windows\System\lxrtHNU.exe
  C:\Windows\System\lxrtHNU.exe
  2⤵
  PID:10176
- C:\Windows\System\aOKnFZi.exe
  C:\Windows\System\aOKnFZi.exe
  2⤵
  PID:10192
- C:\Windows\System\WrPYfrc.exe
  C:\Windows\System\WrPYfrc.exe
  2⤵
  PID:10228
- C:\Windows\System\sDhdlTT.exe
  C:\Windows\System\sDhdlTT.exe
  2⤵
  PID:9228
- C:\Windows\System\vxCgnAH.exe
  C:\Windows\System\vxCgnAH.exe
  2⤵
  PID:9288
- C:\Windows\System\BjyAtbY.exe
  C:\Windows\System\BjyAtbY.exe
  2⤵
  PID:9336
- C:\Windows\System\JWlfqPZ.exe
  C:\Windows\System\JWlfqPZ.exe
  2⤵
  PID:9420
- C:\Windows\System\xypwIOe.exe
  C:\Windows\System\xypwIOe.exe
  2⤵
  PID:9504
- C:\Windows\System\fvfsUCc.exe
  C:\Windows\System\fvfsUCc.exe
  2⤵
  PID:9584
- C:\Windows\System\FBDQCpi.exe
  C:\Windows\System\FBDQCpi.exe
  2⤵
  PID:9644
- C:\Windows\System\YRkIoRu.exe
  C:\Windows\System\YRkIoRu.exe
  2⤵
  PID:9700
- C:\Windows\System\FccWxOC.exe
  C:\Windows\System\FccWxOC.exe
  2⤵
  PID:9776
- C:\Windows\System\CnmOyEB.exe
  C:\Windows\System\CnmOyEB.exe
  2⤵
  PID:9832
- C:\Windows\System\ryOrEGM.exe
  C:\Windows\System\ryOrEGM.exe
  2⤵
  PID:9876
- C:\Windows\System\KjFNYfR.exe
  C:\Windows\System\KjFNYfR.exe
  2⤵
  PID:9960
- C:\Windows\System\qMWVKZp.exe
  C:\Windows\System\qMWVKZp.exe
  2⤵
  PID:9980
- C:\Windows\System\oZqefaW.exe
  C:\Windows\System\oZqefaW.exe
  2⤵
  PID:10100
- C:\Windows\System\EtHOAIr.exe
  C:\Windows\System\EtHOAIr.exe
  2⤵
  PID:10160
- C:\Windows\System\PwGihkD.exe
  C:\Windows\System\PwGihkD.exe
  2⤵
  PID:9304
- C:\Windows\System\ZUtaVFn.exe
  C:\Windows\System\ZUtaVFn.exe
  2⤵
  PID:9396
- C:\Windows\System\CfWZzQO.exe
  C:\Windows\System\CfWZzQO.exe
  2⤵
  PID:9496
- C:\Windows\System\zBebcaf.exe
  C:\Windows\System\zBebcaf.exe
  2⤵
  PID:9608
- C:\Windows\System\NFUGAHR.exe
  C:\Windows\System\NFUGAHR.exe
  2⤵
  PID:9724
- C:\Windows\System\HwHziuF.exe
  C:\Windows\System\HwHziuF.exe
  2⤵
  PID:9944
- C:\Windows\System\kOFsSeL.exe
  C:\Windows\System\kOFsSeL.exe
  2⤵
  PID:10072
- C:\Windows\System\ztskuKp.exe
  C:\Windows\System\ztskuKp.exe
  2⤵
  PID:9468
- C:\Windows\System\LIvfRhL.exe
  C:\Windows\System\LIvfRhL.exe
  2⤵
  PID:9620
- C:\Windows\System\YLjMBLZ.exe
  C:\Windows\System\YLjMBLZ.exe
  2⤵
  PID:10008
- C:\Windows\System\ZOygnJL.exe
  C:\Windows\System\ZOygnJL.exe
  2⤵
  PID:10164
- C:\Windows\System\wjRAhTc.exe
  C:\Windows\System\wjRAhTc.exe
  2⤵
  PID:9940
- C:\Windows\System\YCxRjis.exe
  C:\Windows\System\YCxRjis.exe
  2⤵
  PID:10260
- C:\Windows\System\iuhCJQJ.exe
  C:\Windows\System\iuhCJQJ.exe
  2⤵
  PID:10288
- C:\Windows\System\YWyvgaZ.exe
  C:\Windows\System\YWyvgaZ.exe
  2⤵
  PID:10324
- C:\Windows\System\OaGnAIN.exe
  C:\Windows\System\OaGnAIN.exe
  2⤵
  PID:10344
- C:\Windows\System\uYLvtYH.exe
  C:\Windows\System\uYLvtYH.exe
  2⤵
  PID:10372
- C:\Windows\System\BjmWWyk.exe
  C:\Windows\System\BjmWWyk.exe
  2⤵
  PID:10404
- C:\Windows\System\eJjySQS.exe
  C:\Windows\System\eJjySQS.exe
  2⤵
  PID:10432
- C:\Windows\System\dWBeEWH.exe
  C:\Windows\System\dWBeEWH.exe
  2⤵
  PID:10456
- C:\Windows\System\xilhHvS.exe
  C:\Windows\System\xilhHvS.exe
  2⤵
  PID:10484
- C:\Windows\System\YhHMVkl.exe
  C:\Windows\System\YhHMVkl.exe
  2⤵
  PID:10512
- C:\Windows\System\GhdUMPf.exe
  C:\Windows\System\GhdUMPf.exe
  2⤵
  PID:10544
- C:\Windows\System\ezdUPLP.exe
  C:\Windows\System\ezdUPLP.exe
  2⤵
  PID:10572
- C:\Windows\System\dASLDkJ.exe
  C:\Windows\System\dASLDkJ.exe
  2⤵
  PID:10596
- C:\Windows\System\OsyBMTj.exe
  C:\Windows\System\OsyBMTj.exe
  2⤵
  PID:10616
- C:\Windows\System\SnxlSYm.exe
  C:\Windows\System\SnxlSYm.exe
  2⤵
  PID:10644
- C:\Windows\System\LPqvsVs.exe
  C:\Windows\System\LPqvsVs.exe
  2⤵
  PID:10680
- C:\Windows\System\nRBNFFr.exe
  C:\Windows\System\nRBNFFr.exe
  2⤵
  PID:10696
- C:\Windows\System\rpYSJKo.exe
  C:\Windows\System\rpYSJKo.exe
  2⤵
  PID:10724
- C:\Windows\System\MOObpdk.exe
  C:\Windows\System\MOObpdk.exe
  2⤵
  PID:10756
- C:\Windows\System\lCKMwBG.exe
  C:\Windows\System\lCKMwBG.exe
  2⤵
  PID:10792
- C:\Windows\System\OmokdFA.exe
  C:\Windows\System\OmokdFA.exe
  2⤵
  PID:10820
- C:\Windows\System\CxNqrzt.exe
  C:\Windows\System\CxNqrzt.exe
  2⤵
  PID:10848
- C:\Windows\System\YQsdZDI.exe
  C:\Windows\System\YQsdZDI.exe
  2⤵
  PID:10880
- C:\Windows\System\oFVFIsn.exe
  C:\Windows\System\oFVFIsn.exe
  2⤵
  PID:10908
- C:\Windows\System\BBdbtsA.exe
  C:\Windows\System\BBdbtsA.exe
  2⤵
  PID:10924
- C:\Windows\System\odlRAYw.exe
  C:\Windows\System\odlRAYw.exe
  2⤵
  PID:10948
- C:\Windows\System\TPyOckZ.exe
  C:\Windows\System\TPyOckZ.exe
  2⤵
  PID:10972
- C:\Windows\System\jrILHRS.exe
  C:\Windows\System\jrILHRS.exe
  2⤵
  PID:11008
- C:\Windows\System\bPvBjuF.exe
  C:\Windows\System\bPvBjuF.exe
  2⤵
  PID:11044
- C:\Windows\System\lFYUjea.exe
  C:\Windows\System\lFYUjea.exe
  2⤵
  PID:11084
- C:\Windows\System\ZUBaejV.exe
  C:\Windows\System\ZUBaejV.exe
  2⤵
  PID:11112
- C:\Windows\System\npYlMnb.exe
  C:\Windows\System\npYlMnb.exe
  2⤵
  PID:11140
- C:\Windows\System\bDJGHab.exe
  C:\Windows\System\bDJGHab.exe
  2⤵
  PID:11168
- C:\Windows\System\LcTRTYy.exe
  C:\Windows\System\LcTRTYy.exe
  2⤵
  PID:11196
- C:\Windows\System\YSRtGFc.exe
  C:\Windows\System\YSRtGFc.exe
  2⤵
  PID:11212
- C:\Windows\System\BRwPJps.exe
  C:\Windows\System\BRwPJps.exe
  2⤵
  PID:11240
- C:\Windows\System\BDUBjRB.exe
  C:\Windows\System\BDUBjRB.exe
  2⤵
  PID:10244
- C:\Windows\System\asGtaWr.exe
  C:\Windows\System\asGtaWr.exe
  2⤵
  PID:10312
- C:\Windows\System\DbaeWRd.exe
  C:\Windows\System\DbaeWRd.exe
  2⤵
  PID:10360
- C:\Windows\System\IYoIEsW.exe
  C:\Windows\System\IYoIEsW.exe
  2⤵
  PID:10412
- C:\Windows\System\OqUwcfp.exe
  C:\Windows\System\OqUwcfp.exe
  2⤵
  PID:10472
- C:\Windows\System\auLwYQf.exe
  C:\Windows\System\auLwYQf.exe
  2⤵
  PID:10592
- C:\Windows\System\KiGjvyD.exe
  C:\Windows\System\KiGjvyD.exe
  2⤵
  PID:10672
- C:\Windows\System\YlpQiwR.exe
  C:\Windows\System\YlpQiwR.exe
  2⤵
  PID:10688
- C:\Windows\System\VjNwBfv.exe
  C:\Windows\System\VjNwBfv.exe
  2⤵
  PID:10748
- C:\Windows\System\mkxNNSA.exe
  C:\Windows\System\mkxNNSA.exe
  2⤵
  PID:10832
- C:\Windows\System\ArPRypG.exe
  C:\Windows\System\ArPRypG.exe
  2⤵
  PID:10872
- C:\Windows\System\KEsxeSV.exe
  C:\Windows\System\KEsxeSV.exe
  2⤵
  PID:10940
- C:\Windows\System\ujSDgMV.exe
  C:\Windows\System\ujSDgMV.exe
  2⤵
  PID:11020
- C:\Windows\System\rLfZJMS.exe
  C:\Windows\System\rLfZJMS.exe
  2⤵
  PID:11100
- C:\Windows\System\ADDlKQX.exe
  C:\Windows\System\ADDlKQX.exe
  2⤵
  PID:11156
- C:\Windows\System\XrYjbjn.exe
  C:\Windows\System\XrYjbjn.exe
  2⤵
  PID:11224
- C:\Windows\System\NUhUWCn.exe
  C:\Windows\System\NUhUWCn.exe
  2⤵
  PID:10280
- C:\Windows\System\qmXHpZn.exe
  C:\Windows\System\qmXHpZn.exe
  2⤵
  PID:10440
- C:\Windows\System\fEZIGNa.exe
  C:\Windows\System\fEZIGNa.exe
  2⤵
  PID:10640
- C:\Windows\System\OazimIJ.exe
  C:\Windows\System\OazimIJ.exe
  2⤵
  PID:10932
- C:\Windows\System\IPXVDAQ.exe
  C:\Windows\System\IPXVDAQ.exe
  2⤵
  PID:10812
- C:\Windows\System\nGuxDyl.exe
  C:\Windows\System\nGuxDyl.exe
  2⤵
  PID:11096
- C:\Windows\System\EpnRLrq.exe
  C:\Windows\System\EpnRLrq.exe
  2⤵
  PID:9612
- C:\Windows\System\IuFJpNX.exe
  C:\Windows\System\IuFJpNX.exe
  2⤵
  PID:10716
- C:\Windows\System\EfSpgcl.exe
  C:\Windows\System\EfSpgcl.exe
  2⤵
  PID:11268
- C:\Windows\System\PKpgSLK.exe
  C:\Windows\System\PKpgSLK.exe
  2⤵
  PID:11312
- C:\Windows\System\oRijKGc.exe
  C:\Windows\System\oRijKGc.exe
  2⤵
  PID:11344
- C:\Windows\System\EeLBjiN.exe
  C:\Windows\System\EeLBjiN.exe
  2⤵
  PID:11368
- C:\Windows\System\bHXvJKb.exe
  C:\Windows\System\bHXvJKb.exe
  2⤵
  PID:11412
- C:\Windows\System\ZVRsrDs.exe
  C:\Windows\System\ZVRsrDs.exe
  2⤵
  PID:11432
- C:\Windows\System\rwszEAy.exe
  C:\Windows\System\rwszEAy.exe
  2⤵
  PID:11460
- C:\Windows\System\vGfbfcg.exe
  C:\Windows\System\vGfbfcg.exe
  2⤵
  PID:11496
- C:\Windows\System\JKJwBVZ.exe
  C:\Windows\System\JKJwBVZ.exe
  2⤵
  PID:11540
- C:\Windows\System\MnZPdpH.exe
  C:\Windows\System\MnZPdpH.exe
  2⤵
  PID:11576
- C:\Windows\System\OhBsXkq.exe
  C:\Windows\System\OhBsXkq.exe
  2⤵
  PID:11600
- C:\Windows\System\SGJMOjl.exe
  C:\Windows\System\SGJMOjl.exe
  2⤵
  PID:11636
- C:\Windows\System\wunglQa.exe
  C:\Windows\System\wunglQa.exe
  2⤵
  PID:11660
- C:\Windows\System\Quobxct.exe
  C:\Windows\System\Quobxct.exe
  2⤵
  PID:11696
- C:\Windows\System\vbPJpQB.exe
  C:\Windows\System\vbPJpQB.exe
  2⤵
  PID:11728
- C:\Windows\System\ivgtUdp.exe
  C:\Windows\System\ivgtUdp.exe
  2⤵
  PID:11764
- C:\Windows\System\nClBXud.exe
  C:\Windows\System\nClBXud.exe
  2⤵
  PID:11792
- C:\Windows\System\yVrMsFV.exe
  C:\Windows\System\yVrMsFV.exe
  2⤵
  PID:11828
- C:\Windows\System\TjxGemH.exe
  C:\Windows\System\TjxGemH.exe
  2⤵
  PID:11844
- C:\Windows\System\FGdxKcR.exe
  C:\Windows\System\FGdxKcR.exe
  2⤵
  PID:11876
- C:\Windows\System\ruQoXmp.exe
  C:\Windows\System\ruQoXmp.exe
  2⤵
  PID:11904
- C:\Windows\System\NGGjpoD.exe
  C:\Windows\System\NGGjpoD.exe
  2⤵
  PID:11932
- C:\Windows\System\sdTmsFL.exe
  C:\Windows\System\sdTmsFL.exe
  2⤵
  PID:11948
- C:\Windows\System\qltTGVJ.exe
  C:\Windows\System\qltTGVJ.exe
  2⤵
  PID:11976
- C:\Windows\System\XoDaKpm.exe
  C:\Windows\System\XoDaKpm.exe
  2⤵
  PID:11996
- C:\Windows\System\NbXdhsR.exe
  C:\Windows\System\NbXdhsR.exe
  2⤵
  PID:12024
- C:\Windows\System\mkZsJfe.exe
  C:\Windows\System\mkZsJfe.exe
  2⤵
  PID:12052
- C:\Windows\System\YyrhwKR.exe
  C:\Windows\System\YyrhwKR.exe
  2⤵
  PID:12084
- C:\Windows\System\GnXdTvf.exe
  C:\Windows\System\GnXdTvf.exe
  2⤵
  PID:12120
- C:\Windows\System\PHmnhNU.exe
  C:\Windows\System\PHmnhNU.exe
  2⤵
  PID:12144
- C:\Windows\System\wKppkun.exe
  C:\Windows\System\wKppkun.exe
  2⤵
  PID:12164
- C:\Windows\System\gjXWYwi.exe
  C:\Windows\System\gjXWYwi.exe
  2⤵
  PID:12192
- C:\Windows\System\SZAcxJS.exe
  C:\Windows\System\SZAcxJS.exe
  2⤵
  PID:12220
- C:\Windows\System\IuPwNEk.exe
  C:\Windows\System\IuPwNEk.exe
  2⤵
  PID:12248
- C:\Windows\System\WvEkAtP.exe
  C:\Windows\System\WvEkAtP.exe
  2⤵
  PID:12284
- C:\Windows\System\WaGOqAa.exe
  C:\Windows\System\WaGOqAa.exe
  2⤵
  PID:11292
- C:\Windows\System\KTcZOyB.exe
  C:\Windows\System\KTcZOyB.exe
  2⤵
  PID:11328
- C:\Windows\System\rxNsnCa.exe
  C:\Windows\System\rxNsnCa.exe
  2⤵
  PID:11420
- C:\Windows\System\CxDcmZa.exe
  C:\Windows\System\CxDcmZa.exe
  2⤵
  PID:11472
- C:\Windows\System\ghUZsiD.exe
  C:\Windows\System\ghUZsiD.exe
  2⤵
  PID:11564
- C:\Windows\System\TjyqwYA.exe
  C:\Windows\System\TjyqwYA.exe
  2⤵
  PID:11592
- C:\Windows\System\XUHNAit.exe
  C:\Windows\System\XUHNAit.exe
  2⤵
  PID:11748
- C:\Windows\System\oEopwkH.exe
  C:\Windows\System\oEopwkH.exe
  2⤵
  PID:11864
- C:\Windows\System\WoWoopu.exe
  C:\Windows\System\WoWoopu.exe
  2⤵
  PID:11872
- C:\Windows\System\bXZCFlx.exe
  C:\Windows\System\bXZCFlx.exe
  2⤵
  PID:12016
- C:\Windows\System\JcfyPRw.exe
  C:\Windows\System\JcfyPRw.exe
  2⤵
  PID:12020

Analysis

Sharing

General

Malware Config

Signatures

Processes