xmrig | ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
Size

1.3MB
MD5

35ac71ebd545880e22c50e5b9f4649f4
SHA1

bd2aed102b499001a2d17879e692f3f83f397096
SHA256

ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd
SHA512

832b2b7ad3af9c1e4b77812ecc43f5d67279e075d26891651707118530e6d2e5a68ef54723f733bc2354dc0a92edde2f345a534078e871ef8f4620689e3375b9
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6Pb5x8r8:GezaTF8FcNkNdfE0pZ9ozttwIRx3T2zI

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c000000012277-2.dat	xmrig
behavioral1/files/0x0008000000016c73-9.dat	xmrig
behavioral1/files/0x0007000000016cc5-10.dat	xmrig
behavioral1/files/0x0007000000016ce7-17.dat	xmrig
behavioral1/files/0x0007000000016d1d-21.dat	xmrig
behavioral1/files/0x0009000000016d2e-24.dat	xmrig
behavioral1/files/0x0009000000016d36-29.dat	xmrig
behavioral1/files/0x000700000001743a-32.dat	xmrig
behavioral1/files/0x000600000001747d-36.dat	xmrig
behavioral1/files/0x0006000000017491-40.dat	xmrig
behavioral1/files/0x00060000000175e7-44.dat	xmrig
behavioral1/files/0x001400000001866f-52.dat	xmrig
behavioral1/files/0x0011000000018682-56.dat	xmrig
behavioral1/files/0x0005000000018731-70.dat	xmrig
behavioral1/files/0x0006000000018bf3-88.dat	xmrig
behavioral1/files/0x000500000001925e-100.dat	xmrig
behavioral1/files/0x000500000001939d-128.dat	xmrig
behavioral1/files/0x0005000000019379-124.dat	xmrig
behavioral1/files/0x00050000000192a9-120.dat	xmrig
behavioral1/files/0x0005000000019284-116.dat	xmrig
behavioral1/files/0x0005000000019279-112.dat	xmrig
behavioral1/files/0x000500000001926a-108.dat	xmrig
behavioral1/files/0x0005000000019261-105.dat	xmrig
behavioral1/files/0x000500000001922c-96.dat	xmrig
behavioral1/files/0x0005000000019227-92.dat	xmrig
behavioral1/files/0x000500000001878c-84.dat	xmrig
behavioral1/files/0x0005000000018781-80.dat	xmrig
behavioral1/files/0x0005000000018742-76.dat	xmrig
behavioral1/files/0x00050000000186f8-68.dat	xmrig
behavioral1/files/0x00050000000186f2-64.dat	xmrig
behavioral1/files/0x000500000001868b-60.dat	xmrig
behavioral1/files/0x0006000000018669-48.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2176	iOnubPV.exe
2568	DrpUFdl.exe
2516	JgvYiiG.exe
2456	GOdhyXA.exe
2504	tUiHbJI.exe
2528	xtjpsGL.exe
2448	RAIjdpD.exe
1476	rFlKbRI.exe
2280	zSBlOJo.exe
2840	PlIMWUo.exe
2824	ZpOlsNH.exe
2752	FtMGmpy.exe
2892	FaJNaXN.exe
2652	JgsrcgZ.exe
2640	pjZCPqI.exe
2784	nJgFeVz.exe
1076	BnmyXCw.exe
2628	YATszMK.exe
2688	RtbdVKB.exe
704	BOEYusF.exe
2216	ztgFSFw.exe
316	XVVbXui.exe
2868	RWzuXWo.exe
3008	msRRqgI.exe
2844	LTGfKWq.exe
1044	vUwDoyB.exe
1612	CqMedyS.exe
1936	FXdFnTx.exe
1648	pfMAvyr.exe
2336	vbdLFgB.exe
2076	RiAdPlI.exe
2300	DExkYuJ.exe
2152	duQEHFq.exe
2188	cvTDZAP.exe
1092	nTpAKTf.exe
1268	QQZYVIZ.exe
2136	EyJTeWG.exe
1764	pLwRkkX.exe
444	PuCkiGn.exe
1964	Oshnixe.exe
2520	tMNJGrT.exe
904	EpKHauW.exe
2020	eniDWBk.exe
1608	BlcdYdd.exe
1540	xQUbAff.exe
2072	IRQyLDO.exe
1844	wxmCqMj.exe
2184	ywLFMas.exe
1924	WLqqqpQ.exe
1316	kcrjTzR.exe
768	qZIiKpk.exe
1788	lKhadjG.exe
1784	wJAyAIk.exe
936	szNFxkt.exe
592	AbecPWy.exe
1700	LzoGVys.exe
2588	WtEJbdO.exe
1040	GwIOlGQ.exe
2920	PJhoyIA.exe
1740	skwWPMW.exe
1664	YFWbJXk.exe
988	oqNikuF.exe
2556	lkozkcV.exe
1480	gButhRf.exe

Loads dropped DLL 64 IoCs

pid	Process
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lhKwfbN.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\qToENKT.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\WgJVTMV.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\OFnVagY.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\HAcLMUX.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\zSSnWVF.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\kmYTBnv.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\RnBUtkp.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\mKWhqRk.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\KOkgjeH.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\fjfffpV.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\mWcnSHi.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\paWunQt.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\TQkYYlS.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\URZqZVT.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\uSwesbF.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\QJmatxN.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\Oyztnuy.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\pykOfHr.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\KqslqFV.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\tVdJDaO.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\TEGvdRB.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\wBknLXn.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\HVDMrDK.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\eNlSKpz.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\ZpOlsNH.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\dlKDxaE.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\ayMLFXD.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\tJgKBqa.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\NlAPYub.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\bQYVVuZ.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\XsuLgau.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\NDhBWBi.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\TbFArnE.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\dbHMxvz.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\qsbDVhA.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\WrPLFiu.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\oSGaCZC.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\EVGvtbP.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\KnJEJNV.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\GtBoOiR.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\xszVFmB.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\mPNqUOG.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\yEMEmOp.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\tMNJGrT.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\htGvjmO.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\MlupOyI.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\UmtAlUj.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\crohYbC.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\ytjrOki.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\pFieqLP.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\tOLKuHZ.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\MSooFNI.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\uuBvGby.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\qCuUZIR.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\Zedaufz.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\kcrjTzR.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\xcAFyDt.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\TGyfvlh.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\zBeblBD.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\cLjOAOX.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\JwFzfgp.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\ChTwlPJ.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\szxQwSB.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 2176	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	31
PID 340 wrote to memory of 2176	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	31
PID 340 wrote to memory of 2176	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	31
PID 340 wrote to memory of 2568	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	32
PID 340 wrote to memory of 2568	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	32
PID 340 wrote to memory of 2568	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	32
PID 340 wrote to memory of 2516	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	33
PID 340 wrote to memory of 2516	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	33
PID 340 wrote to memory of 2516	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	33
PID 340 wrote to memory of 2456	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	34
PID 340 wrote to memory of 2456	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	34
PID 340 wrote to memory of 2456	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	34
PID 340 wrote to memory of 2504	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	35
PID 340 wrote to memory of 2504	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	35
PID 340 wrote to memory of 2504	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	35
PID 340 wrote to memory of 2528	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	36
PID 340 wrote to memory of 2528	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	36
PID 340 wrote to memory of 2528	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	36
PID 340 wrote to memory of 2448	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	37
PID 340 wrote to memory of 2448	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	37
PID 340 wrote to memory of 2448	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	37
PID 340 wrote to memory of 1476	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	38
PID 340 wrote to memory of 1476	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	38
PID 340 wrote to memory of 1476	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	38
PID 340 wrote to memory of 2280	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	39
PID 340 wrote to memory of 2280	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	39
PID 340 wrote to memory of 2280	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	39
PID 340 wrote to memory of 2840	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	40
PID 340 wrote to memory of 2840	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	40
PID 340 wrote to memory of 2840	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	40
PID 340 wrote to memory of 2824	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	41
PID 340 wrote to memory of 2824	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	41
PID 340 wrote to memory of 2824	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	41
PID 340 wrote to memory of 2752	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	42
PID 340 wrote to memory of 2752	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	42
PID 340 wrote to memory of 2752	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	42
PID 340 wrote to memory of 2892	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	43
PID 340 wrote to memory of 2892	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	43
PID 340 wrote to memory of 2892	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	43
PID 340 wrote to memory of 2652	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	44
PID 340 wrote to memory of 2652	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	44
PID 340 wrote to memory of 2652	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	44
PID 340 wrote to memory of 2640	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	45
PID 340 wrote to memory of 2640	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	45
PID 340 wrote to memory of 2640	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	45
PID 340 wrote to memory of 2784	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	46
PID 340 wrote to memory of 2784	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	46
PID 340 wrote to memory of 2784	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	46
PID 340 wrote to memory of 1076	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	47
PID 340 wrote to memory of 1076	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	47
PID 340 wrote to memory of 1076	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	47
PID 340 wrote to memory of 2628	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	48
PID 340 wrote to memory of 2628	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	48
PID 340 wrote to memory of 2628	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	48
PID 340 wrote to memory of 2688	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	49
PID 340 wrote to memory of 2688	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	49
PID 340 wrote to memory of 2688	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	49
PID 340 wrote to memory of 704	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	50
PID 340 wrote to memory of 704	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	50
PID 340 wrote to memory of 704	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	50
PID 340 wrote to memory of 2216	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	51
PID 340 wrote to memory of 2216	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	51
PID 340 wrote to memory of 2216	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	51
PID 340 wrote to memory of 316	340	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	52

C:\Users\Admin\AppData\Local\Temp\ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
"C:\Users\Admin\AppData\Local\Temp\ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\System\iOnubPV.exe
  C:\Windows\System\iOnubPV.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\DrpUFdl.exe
  C:\Windows\System\DrpUFdl.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\JgvYiiG.exe
  C:\Windows\System\JgvYiiG.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\GOdhyXA.exe
  C:\Windows\System\GOdhyXA.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\tUiHbJI.exe
  C:\Windows\System\tUiHbJI.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\xtjpsGL.exe
  C:\Windows\System\xtjpsGL.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\RAIjdpD.exe
  C:\Windows\System\RAIjdpD.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\rFlKbRI.exe
  C:\Windows\System\rFlKbRI.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\zSBlOJo.exe
  C:\Windows\System\zSBlOJo.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\PlIMWUo.exe
  C:\Windows\System\PlIMWUo.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\ZpOlsNH.exe
  C:\Windows\System\ZpOlsNH.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\FtMGmpy.exe
  C:\Windows\System\FtMGmpy.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\FaJNaXN.exe
  C:\Windows\System\FaJNaXN.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\JgsrcgZ.exe
  C:\Windows\System\JgsrcgZ.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\pjZCPqI.exe
  C:\Windows\System\pjZCPqI.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\nJgFeVz.exe
  C:\Windows\System\nJgFeVz.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\BnmyXCw.exe
  C:\Windows\System\BnmyXCw.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\YATszMK.exe
  C:\Windows\System\YATszMK.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\RtbdVKB.exe
  C:\Windows\System\RtbdVKB.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\BOEYusF.exe
  C:\Windows\System\BOEYusF.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\ztgFSFw.exe
  C:\Windows\System\ztgFSFw.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\XVVbXui.exe
  C:\Windows\System\XVVbXui.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\RWzuXWo.exe
  C:\Windows\System\RWzuXWo.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\msRRqgI.exe
  C:\Windows\System\msRRqgI.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\LTGfKWq.exe
  C:\Windows\System\LTGfKWq.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\vUwDoyB.exe
  C:\Windows\System\vUwDoyB.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\CqMedyS.exe
  C:\Windows\System\CqMedyS.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\FXdFnTx.exe
  C:\Windows\System\FXdFnTx.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\pfMAvyr.exe
  C:\Windows\System\pfMAvyr.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\vbdLFgB.exe
  C:\Windows\System\vbdLFgB.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\RiAdPlI.exe
  C:\Windows\System\RiAdPlI.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\DExkYuJ.exe
  C:\Windows\System\DExkYuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\duQEHFq.exe
  C:\Windows\System\duQEHFq.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\cvTDZAP.exe
  C:\Windows\System\cvTDZAP.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\nTpAKTf.exe
  C:\Windows\System\nTpAKTf.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\QQZYVIZ.exe
  C:\Windows\System\QQZYVIZ.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\EyJTeWG.exe
  C:\Windows\System\EyJTeWG.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\pLwRkkX.exe
  C:\Windows\System\pLwRkkX.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\PuCkiGn.exe
  C:\Windows\System\PuCkiGn.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\Oshnixe.exe
  C:\Windows\System\Oshnixe.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\tMNJGrT.exe
  C:\Windows\System\tMNJGrT.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\EpKHauW.exe
  C:\Windows\System\EpKHauW.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\eniDWBk.exe
  C:\Windows\System\eniDWBk.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\BlcdYdd.exe
  C:\Windows\System\BlcdYdd.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\xQUbAff.exe
  C:\Windows\System\xQUbAff.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\IRQyLDO.exe
  C:\Windows\System\IRQyLDO.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\wxmCqMj.exe
  C:\Windows\System\wxmCqMj.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\ywLFMas.exe
  C:\Windows\System\ywLFMas.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\WLqqqpQ.exe
  C:\Windows\System\WLqqqpQ.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\kcrjTzR.exe
  C:\Windows\System\kcrjTzR.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\qZIiKpk.exe
  C:\Windows\System\qZIiKpk.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\lKhadjG.exe
  C:\Windows\System\lKhadjG.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\wJAyAIk.exe
  C:\Windows\System\wJAyAIk.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\szNFxkt.exe
  C:\Windows\System\szNFxkt.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\AbecPWy.exe
  C:\Windows\System\AbecPWy.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\LzoGVys.exe
  C:\Windows\System\LzoGVys.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\WtEJbdO.exe
  C:\Windows\System\WtEJbdO.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\GwIOlGQ.exe
  C:\Windows\System\GwIOlGQ.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\PJhoyIA.exe
  C:\Windows\System\PJhoyIA.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\skwWPMW.exe
  C:\Windows\System\skwWPMW.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\YFWbJXk.exe
  C:\Windows\System\YFWbJXk.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\oqNikuF.exe
  C:\Windows\System\oqNikuF.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\lkozkcV.exe
  C:\Windows\System\lkozkcV.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\gButhRf.exe
  C:\Windows\System\gButhRf.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\MAsfkBa.exe
  C:\Windows\System\MAsfkBa.exe
  2⤵
  PID:1652
- C:\Windows\System\IVbmOpR.exe
  C:\Windows\System\IVbmOpR.exe
  2⤵
  PID:1060
- C:\Windows\System\KAZdgaQ.exe
  C:\Windows\System\KAZdgaQ.exe
  2⤵
  PID:488
- C:\Windows\System\ZoWseSd.exe
  C:\Windows\System\ZoWseSd.exe
  2⤵
  PID:2696
- C:\Windows\System\XpETpwY.exe
  C:\Windows\System\XpETpwY.exe
  2⤵
  PID:2168
- C:\Windows\System\wKlaFzi.exe
  C:\Windows\System\wKlaFzi.exe
  2⤵
  PID:1568
- C:\Windows\System\nRMJDIY.exe
  C:\Windows\System\nRMJDIY.exe
  2⤵
  PID:1592
- C:\Windows\System\ILWPIuf.exe
  C:\Windows\System\ILWPIuf.exe
  2⤵
  PID:1320
- C:\Windows\System\BHOOpnN.exe
  C:\Windows\System\BHOOpnN.exe
  2⤵
  PID:3032
- C:\Windows\System\NkgLToD.exe
  C:\Windows\System\NkgLToD.exe
  2⤵
  PID:2452
- C:\Windows\System\XKrBQTC.exe
  C:\Windows\System\XKrBQTC.exe
  2⤵
  PID:596
- C:\Windows\System\nlcvTWy.exe
  C:\Windows\System\nlcvTWy.exe
  2⤵
  PID:2260
- C:\Windows\System\rYZLQai.exe
  C:\Windows\System\rYZLQai.exe
  2⤵
  PID:2888
- C:\Windows\System\nsRaBFr.exe
  C:\Windows\System\nsRaBFr.exe
  2⤵
  PID:3044
- C:\Windows\System\xWEtdfS.exe
  C:\Windows\System\xWEtdfS.exe
  2⤵
  PID:2896
- C:\Windows\System\HqxjkuL.exe
  C:\Windows\System\HqxjkuL.exe
  2⤵
  PID:2808
- C:\Windows\System\wHLBUjx.exe
  C:\Windows\System\wHLBUjx.exe
  2⤵
  PID:2668
- C:\Windows\System\opXkOvX.exe
  C:\Windows\System\opXkOvX.exe
  2⤵
  PID:1604
- C:\Windows\System\fNKymjS.exe
  C:\Windows\System\fNKymjS.exe
  2⤵
  PID:2660
- C:\Windows\System\aJPPEhQ.exe
  C:\Windows\System\aJPPEhQ.exe
  2⤵
  PID:868
- C:\Windows\System\PMUGDKp.exe
  C:\Windows\System\PMUGDKp.exe
  2⤵
  PID:844
- C:\Windows\System\rwXxPGI.exe
  C:\Windows\System\rwXxPGI.exe
  2⤵
  PID:2036
- C:\Windows\System\IbJzFFM.exe
  C:\Windows\System\IbJzFFM.exe
  2⤵
  PID:1968
- C:\Windows\System\KnJEJNV.exe
  C:\Windows\System\KnJEJNV.exe
  2⤵
  PID:1632
- C:\Windows\System\vkQakdI.exe
  C:\Windows\System\vkQakdI.exe
  2⤵
  PID:2084
- C:\Windows\System\qahJOfH.exe
  C:\Windows\System\qahJOfH.exe
  2⤵
  PID:2080
- C:\Windows\System\EvZhERk.exe
  C:\Windows\System\EvZhERk.exe
  2⤵
  PID:2068
- C:\Windows\System\siLxNkZ.exe
  C:\Windows\System\siLxNkZ.exe
  2⤵
  PID:2144
- C:\Windows\System\ygEUGVX.exe
  C:\Windows\System\ygEUGVX.exe
  2⤵
  PID:404
- C:\Windows\System\DWXVXgm.exe
  C:\Windows\System\DWXVXgm.exe
  2⤵
  PID:2496
- C:\Windows\System\tzXikBh.exe
  C:\Windows\System\tzXikBh.exe
  2⤵
  PID:2540
- C:\Windows\System\ePojqhR.exe
  C:\Windows\System\ePojqhR.exe
  2⤵
  PID:1716
- C:\Windows\System\uSwesbF.exe
  C:\Windows\System\uSwesbF.exe
  2⤵
  PID:2404
- C:\Windows\System\WpdjcAY.exe
  C:\Windows\System\WpdjcAY.exe
  2⤵
  PID:2088
- C:\Windows\System\ceXfmLJ.exe
  C:\Windows\System\ceXfmLJ.exe
  2⤵
  PID:2000
- C:\Windows\System\ZNSpanP.exe
  C:\Windows\System\ZNSpanP.exe
  2⤵
  PID:2032
- C:\Windows\System\UEVLnDV.exe
  C:\Windows\System\UEVLnDV.exe
  2⤵
  PID:1548
- C:\Windows\System\zedDNNS.exe
  C:\Windows\System\zedDNNS.exe
  2⤵
  PID:2552
- C:\Windows\System\iBkteiO.exe
  C:\Windows\System\iBkteiO.exe
  2⤵
  PID:2524
- C:\Windows\System\TlmCdbL.exe
  C:\Windows\System\TlmCdbL.exe
  2⤵
  PID:2116
- C:\Windows\System\oCXVXnu.exe
  C:\Windows\System\oCXVXnu.exe
  2⤵
  PID:548
- C:\Windows\System\tNifBpZ.exe
  C:\Windows\System\tNifBpZ.exe
  2⤵
  PID:1868
- C:\Windows\System\lWRIFen.exe
  C:\Windows\System\lWRIFen.exe
  2⤵
  PID:2196
- C:\Windows\System\kCutcMM.exe
  C:\Windows\System\kCutcMM.exe
  2⤵
  PID:1752
- C:\Windows\System\XhxkAMy.exe
  C:\Windows\System\XhxkAMy.exe
  2⤵
  PID:3048
- C:\Windows\System\DZOBrdO.exe
  C:\Windows\System\DZOBrdO.exe
  2⤵
  PID:1600
- C:\Windows\System\TrEXAll.exe
  C:\Windows\System\TrEXAll.exe
  2⤵
  PID:532
- C:\Windows\System\UbmwhWn.exe
  C:\Windows\System\UbmwhWn.exe
  2⤵
  PID:2276
- C:\Windows\System\HOCeimi.exe
  C:\Windows\System\HOCeimi.exe
  2⤵
  PID:2748
- C:\Windows\System\ktcxYXQ.exe
  C:\Windows\System\ktcxYXQ.exe
  2⤵
  PID:2352
- C:\Windows\System\odYZtWO.exe
  C:\Windows\System\odYZtWO.exe
  2⤵
  PID:2432
- C:\Windows\System\xvgTHfi.exe
  C:\Windows\System\xvgTHfi.exe
  2⤵
  PID:2616
- C:\Windows\System\OSXcxUc.exe
  C:\Windows\System\OSXcxUc.exe
  2⤵
  PID:588
- C:\Windows\System\XdHJaAf.exe
  C:\Windows\System\XdHJaAf.exe
  2⤵
  PID:2964
- C:\Windows\System\lhKwfbN.exe
  C:\Windows\System\lhKwfbN.exe
  2⤵
  PID:2224
- C:\Windows\System\kmYTBnv.exe
  C:\Windows\System\kmYTBnv.exe
  2⤵
  PID:2124
- C:\Windows\System\GjsjDVO.exe
  C:\Windows\System\GjsjDVO.exe
  2⤵
  PID:2712
- C:\Windows\System\aUftDiJ.exe
  C:\Windows\System\aUftDiJ.exe
  2⤵
  PID:1280
- C:\Windows\System\LsMQUNK.exe
  C:\Windows\System\LsMQUNK.exe
  2⤵
  PID:2500
- C:\Windows\System\xcAFyDt.exe
  C:\Windows\System\xcAFyDt.exe
  2⤵
  PID:1820
- C:\Windows\System\UmqtSrU.exe
  C:\Windows\System\UmqtSrU.exe
  2⤵
  PID:2420
- C:\Windows\System\oetXvUd.exe
  C:\Windows\System\oetXvUd.exe
  2⤵
  PID:916
- C:\Windows\System\csqdBcH.exe
  C:\Windows\System\csqdBcH.exe
  2⤵
  PID:744
- C:\Windows\System\kuglCDT.exe
  C:\Windows\System\kuglCDT.exe
  2⤵
  PID:2380
- C:\Windows\System\ovPaqzN.exe
  C:\Windows\System\ovPaqzN.exe
  2⤵
  PID:1336
- C:\Windows\System\ZnVBWOM.exe
  C:\Windows\System\ZnVBWOM.exe
  2⤵
  PID:1760
- C:\Windows\System\TDIqsfM.exe
  C:\Windows\System\TDIqsfM.exe
  2⤵
  PID:1588
- C:\Windows\System\pcVXPNz.exe
  C:\Windows\System\pcVXPNz.exe
  2⤵
  PID:1096
- C:\Windows\System\tFgXkgr.exe
  C:\Windows\System\tFgXkgr.exe
  2⤵
  PID:2764
- C:\Windows\System\ZQCVbRq.exe
  C:\Windows\System\ZQCVbRq.exe
  2⤵
  PID:2732
- C:\Windows\System\LgfdOyJ.exe
  C:\Windows\System\LgfdOyJ.exe
  2⤵
  PID:2212
- C:\Windows\System\ODjIodO.exe
  C:\Windows\System\ODjIodO.exe
  2⤵
  PID:1816
- C:\Windows\System\oqeNDtz.exe
  C:\Windows\System\oqeNDtz.exe
  2⤵
  PID:1524
- C:\Windows\System\XSGQxKk.exe
  C:\Windows\System\XSGQxKk.exe
  2⤵
  PID:1692
- C:\Windows\System\pnxuGuZ.exe
  C:\Windows\System\pnxuGuZ.exe
  2⤵
  PID:616
- C:\Windows\System\PqTuFXT.exe
  C:\Windows\System\PqTuFXT.exe
  2⤵
  PID:1808
- C:\Windows\System\pNGOwAX.exe
  C:\Windows\System\pNGOwAX.exe
  2⤵
  PID:2208
- C:\Windows\System\rZtwLhl.exe
  C:\Windows\System\rZtwLhl.exe
  2⤵
  PID:3028
- C:\Windows\System\TbFArnE.exe
  C:\Windows\System\TbFArnE.exe
  2⤵
  PID:2768
- C:\Windows\System\kPvKHli.exe
  C:\Windows\System\kPvKHli.exe
  2⤵
  PID:2436
- C:\Windows\System\YcUukkj.exe
  C:\Windows\System\YcUukkj.exe
  2⤵
  PID:2880
- C:\Windows\System\xGppAok.exe
  C:\Windows\System\xGppAok.exe
  2⤵
  PID:3084
- C:\Windows\System\dtODOSW.exe
  C:\Windows\System\dtODOSW.exe
  2⤵
  PID:3100
- C:\Windows\System\FNGdOVA.exe
  C:\Windows\System\FNGdOVA.exe
  2⤵
  PID:3116
- C:\Windows\System\TGyfvlh.exe
  C:\Windows\System\TGyfvlh.exe
  2⤵
  PID:3132
- C:\Windows\System\gdlysWb.exe
  C:\Windows\System\gdlysWb.exe
  2⤵
  PID:3148
- C:\Windows\System\GGGSgHu.exe
  C:\Windows\System\GGGSgHu.exe
  2⤵
  PID:3164
- C:\Windows\System\DTBUSDa.exe
  C:\Windows\System\DTBUSDa.exe
  2⤵
  PID:3180
- C:\Windows\System\EiyMDDa.exe
  C:\Windows\System\EiyMDDa.exe
  2⤵
  PID:3196
- C:\Windows\System\gMXlwtv.exe
  C:\Windows\System\gMXlwtv.exe
  2⤵
  PID:3212
- C:\Windows\System\WATtBMa.exe
  C:\Windows\System\WATtBMa.exe
  2⤵
  PID:3228
- C:\Windows\System\aDNvDlf.exe
  C:\Windows\System\aDNvDlf.exe
  2⤵
  PID:3244
- C:\Windows\System\Lcoxwax.exe
  C:\Windows\System\Lcoxwax.exe
  2⤵
  PID:3260
- C:\Windows\System\QOVNhtd.exe
  C:\Windows\System\QOVNhtd.exe
  2⤵
  PID:3276
- C:\Windows\System\LbtuNEX.exe
  C:\Windows\System\LbtuNEX.exe
  2⤵
  PID:3292
- C:\Windows\System\MxlLanp.exe
  C:\Windows\System\MxlLanp.exe
  2⤵
  PID:3308
- C:\Windows\System\hUrvSVU.exe
  C:\Windows\System\hUrvSVU.exe
  2⤵
  PID:3324
- C:\Windows\System\LjQsRjt.exe
  C:\Windows\System\LjQsRjt.exe
  2⤵
  PID:3340
- C:\Windows\System\FZnPLdD.exe
  C:\Windows\System\FZnPLdD.exe
  2⤵
  PID:3356
- C:\Windows\System\BQtFDuC.exe
  C:\Windows\System\BQtFDuC.exe
  2⤵
  PID:3372
- C:\Windows\System\UbTUlec.exe
  C:\Windows\System\UbTUlec.exe
  2⤵
  PID:3388
- C:\Windows\System\zDOUjOr.exe
  C:\Windows\System\zDOUjOr.exe
  2⤵
  PID:3404
- C:\Windows\System\PsVtTfx.exe
  C:\Windows\System\PsVtTfx.exe
  2⤵
  PID:3420
- C:\Windows\System\VpEBNnU.exe
  C:\Windows\System\VpEBNnU.exe
  2⤵
  PID:3436
- C:\Windows\System\NFxPPzb.exe
  C:\Windows\System\NFxPPzb.exe
  2⤵
  PID:3452
- C:\Windows\System\htGvjmO.exe
  C:\Windows\System\htGvjmO.exe
  2⤵
  PID:3468
- C:\Windows\System\FZSFzkx.exe
  C:\Windows\System\FZSFzkx.exe
  2⤵
  PID:3484
- C:\Windows\System\poffXyA.exe
  C:\Windows\System\poffXyA.exe
  2⤵
  PID:3500
- C:\Windows\System\dWyVpKA.exe
  C:\Windows\System\dWyVpKA.exe
  2⤵
  PID:3516
- C:\Windows\System\YTImnfz.exe
  C:\Windows\System\YTImnfz.exe
  2⤵
  PID:3532
- C:\Windows\System\ATJzWSg.exe
  C:\Windows\System\ATJzWSg.exe
  2⤵
  PID:3548
- C:\Windows\System\iVXbvYO.exe
  C:\Windows\System\iVXbvYO.exe
  2⤵
  PID:3564
- C:\Windows\System\WOydbqZ.exe
  C:\Windows\System\WOydbqZ.exe
  2⤵
  PID:3580
- C:\Windows\System\NSmUrhf.exe
  C:\Windows\System\NSmUrhf.exe
  2⤵
  PID:3596
- C:\Windows\System\iVtBeGQ.exe
  C:\Windows\System\iVtBeGQ.exe
  2⤵
  PID:3612
- C:\Windows\System\neCuVGi.exe
  C:\Windows\System\neCuVGi.exe
  2⤵
  PID:3628
- C:\Windows\System\kCPpLhM.exe
  C:\Windows\System\kCPpLhM.exe
  2⤵
  PID:3644
- C:\Windows\System\jwMHWUf.exe
  C:\Windows\System\jwMHWUf.exe
  2⤵
  PID:3660
- C:\Windows\System\XcwSsTR.exe
  C:\Windows\System\XcwSsTR.exe
  2⤵
  PID:3676
- C:\Windows\System\EiFBHmh.exe
  C:\Windows\System\EiFBHmh.exe
  2⤵
  PID:3692
- C:\Windows\System\wurJYNv.exe
  C:\Windows\System\wurJYNv.exe
  2⤵
  PID:3708
- C:\Windows\System\bQcVPzB.exe
  C:\Windows\System\bQcVPzB.exe
  2⤵
  PID:3724
- C:\Windows\System\DXZgcLL.exe
  C:\Windows\System\DXZgcLL.exe
  2⤵
  PID:3740
- C:\Windows\System\TNOumRl.exe
  C:\Windows\System\TNOumRl.exe
  2⤵
  PID:3756
- C:\Windows\System\JpXQFFA.exe
  C:\Windows\System\JpXQFFA.exe
  2⤵
  PID:3772
- C:\Windows\System\XfYbPKm.exe
  C:\Windows\System\XfYbPKm.exe
  2⤵
  PID:3788
- C:\Windows\System\WDcjCTl.exe
  C:\Windows\System\WDcjCTl.exe
  2⤵
  PID:3804
- C:\Windows\System\xWXBlEC.exe
  C:\Windows\System\xWXBlEC.exe
  2⤵
  PID:3864
- C:\Windows\System\CjSNoEB.exe
  C:\Windows\System\CjSNoEB.exe
  2⤵
  PID:3988
- C:\Windows\System\HVkkBlW.exe
  C:\Windows\System\HVkkBlW.exe
  2⤵
  PID:4008
- C:\Windows\System\FuAAHKr.exe
  C:\Windows\System\FuAAHKr.exe
  2⤵
  PID:4024
- C:\Windows\System\UKsHwUL.exe
  C:\Windows\System\UKsHwUL.exe
  2⤵
  PID:4040
- C:\Windows\System\ztQcdqp.exe
  C:\Windows\System\ztQcdqp.exe
  2⤵
  PID:4056
- C:\Windows\System\cwmDotX.exe
  C:\Windows\System\cwmDotX.exe
  2⤵
  PID:4072
- C:\Windows\System\xZuZJsb.exe
  C:\Windows\System\xZuZJsb.exe
  2⤵
  PID:4088
- C:\Windows\System\ccGaZtw.exe
  C:\Windows\System\ccGaZtw.exe
  2⤵
  PID:2836
- C:\Windows\System\KXQbyDz.exe
  C:\Windows\System\KXQbyDz.exe
  2⤵
  PID:1360
- C:\Windows\System\mHdlqmp.exe
  C:\Windows\System\mHdlqmp.exe
  2⤵
  PID:2248
- C:\Windows\System\PsATXXK.exe
  C:\Windows\System\PsATXXK.exe
  2⤵
  PID:2804
- C:\Windows\System\FRmsXXG.exe
  C:\Windows\System\FRmsXXG.exe
  2⤵
  PID:3092
- C:\Windows\System\PmVNvPe.exe
  C:\Windows\System\PmVNvPe.exe
  2⤵
  PID:2776
- C:\Windows\System\FsYJNVJ.exe
  C:\Windows\System\FsYJNVJ.exe
  2⤵
  PID:3144
- C:\Windows\System\vKiMFIQ.exe
  C:\Windows\System\vKiMFIQ.exe
  2⤵
  PID:3176
- C:\Windows\System\ADrhxSc.exe
  C:\Windows\System\ADrhxSc.exe
  2⤵
  PID:2744
- C:\Windows\System\yrbqFBi.exe
  C:\Windows\System\yrbqFBi.exe
  2⤵
  PID:3236
- C:\Windows\System\hKTGkeo.exe
  C:\Windows\System\hKTGkeo.exe
  2⤵
  PID:2780
- C:\Windows\System\zVkekfN.exe
  C:\Windows\System\zVkekfN.exe
  2⤵
  PID:3288
- C:\Windows\System\yLAKkYB.exe
  C:\Windows\System\yLAKkYB.exe
  2⤵
  PID:3320
- C:\Windows\System\EMEKVdw.exe
  C:\Windows\System\EMEKVdw.exe
  2⤵
  PID:3348
- C:\Windows\System\AHFisaU.exe
  C:\Windows\System\AHFisaU.exe
  2⤵
  PID:3380
- C:\Windows\System\FynEDBQ.exe
  C:\Windows\System\FynEDBQ.exe
  2⤵
  PID:2904
- C:\Windows\System\UmncNPp.exe
  C:\Windows\System\UmncNPp.exe
  2⤵
  PID:3428
- C:\Windows\System\fCeVWYK.exe
  C:\Windows\System\fCeVWYK.exe
  2⤵
  PID:3508
- C:\Windows\System\jJaBHFL.exe
  C:\Windows\System\jJaBHFL.exe
  2⤵
  PID:3688
- C:\Windows\System\YYGRUmG.exe
  C:\Windows\System\YYGRUmG.exe
  2⤵
  PID:1780
- C:\Windows\System\BaxTQxu.exe
  C:\Windows\System\BaxTQxu.exe
  2⤵
  PID:3192
- C:\Windows\System\kLubgAi.exe
  C:\Windows\System\kLubgAi.exe
  2⤵
  PID:2472
- C:\Windows\System\MRKQjYJ.exe
  C:\Windows\System\MRKQjYJ.exe
  2⤵
  PID:1108
- C:\Windows\System\YsTEKHm.exe
  C:\Windows\System\YsTEKHm.exe
  2⤵
  PID:3352
- C:\Windows\System\ajvTUmQ.exe
  C:\Windows\System\ajvTUmQ.exe
  2⤵
  PID:3460
- C:\Windows\System\GUBXzep.exe
  C:\Windows\System\GUBXzep.exe
  2⤵
  PID:2684
- C:\Windows\System\ccgRALJ.exe
  C:\Windows\System\ccgRALJ.exe
  2⤵
  PID:2932
- C:\Windows\System\qYDHvBU.exe
  C:\Windows\System\qYDHvBU.exe
  2⤵
  PID:3524
- C:\Windows\System\yoHLMcu.exe
  C:\Windows\System\yoHLMcu.exe
  2⤵
  PID:1768
- C:\Windows\System\AYqZhTe.exe
  C:\Windows\System\AYqZhTe.exe
  2⤵
  PID:3572
- C:\Windows\System\xOBrcDZ.exe
  C:\Windows\System\xOBrcDZ.exe
  2⤵
  PID:3592
- C:\Windows\System\SChscmS.exe
  C:\Windows\System\SChscmS.exe
  2⤵
  PID:3620
- C:\Windows\System\DyHWkcH.exe
  C:\Windows\System\DyHWkcH.exe
  2⤵
  PID:3624
- C:\Windows\System\szxQwSB.exe
  C:\Windows\System\szxQwSB.exe
  2⤵
  PID:1272
- C:\Windows\System\mQTUGwi.exe
  C:\Windows\System\mQTUGwi.exe
  2⤵
  PID:3668
- C:\Windows\System\hzvKyQz.exe
  C:\Windows\System\hzvKyQz.exe
  2⤵
  PID:2620
- C:\Windows\System\IzbdfNV.exe
  C:\Windows\System\IzbdfNV.exe
  2⤵
  PID:1532
- C:\Windows\System\fHZutGJ.exe
  C:\Windows\System\fHZutGJ.exe
  2⤵
  PID:3796
- C:\Windows\System\PXUWWxZ.exe
  C:\Windows\System\PXUWWxZ.exe
  2⤵
  PID:3784
- C:\Windows\System\TUZxIGo.exe
  C:\Windows\System\TUZxIGo.exe
  2⤵
  PID:3752
- C:\Windows\System\BHVaoDH.exe
  C:\Windows\System\BHVaoDH.exe
  2⤵
  PID:3716
- C:\Windows\System\kwhKjfQ.exe
  C:\Windows\System\kwhKjfQ.exe
  2⤵
  PID:3816
- C:\Windows\System\piRPXcs.exe
  C:\Windows\System\piRPXcs.exe
  2⤵
  PID:3844
- C:\Windows\System\JZvhBfB.exe
  C:\Windows\System\JZvhBfB.exe
  2⤵
  PID:3736
- C:\Windows\System\zvXMDuz.exe
  C:\Windows\System\zvXMDuz.exe
  2⤵
  PID:3872
- C:\Windows\System\yaZAlZC.exe
  C:\Windows\System\yaZAlZC.exe
  2⤵
  PID:3920
- C:\Windows\System\OlAkPcI.exe
  C:\Windows\System\OlAkPcI.exe
  2⤵
  PID:3932
- C:\Windows\System\gRCzpjX.exe
  C:\Windows\System\gRCzpjX.exe
  2⤵
  PID:572
- C:\Windows\System\JNTwvnC.exe
  C:\Windows\System\JNTwvnC.exe
  2⤵
  PID:3172
- C:\Windows\System\RnBUtkp.exe
  C:\Windows\System\RnBUtkp.exe
  2⤵
  PID:1624
- C:\Windows\System\gjitWBY.exe
  C:\Windows\System\gjitWBY.exe
  2⤵
  PID:2560
- C:\Windows\System\btPJSbb.exe
  C:\Windows\System\btPJSbb.exe
  2⤵
  PID:2680
- C:\Windows\System\QYgiyfa.exe
  C:\Windows\System\QYgiyfa.exe
  2⤵
  PID:3968
- C:\Windows\System\idNciwX.exe
  C:\Windows\System\idNciwX.exe
  2⤵
  PID:4016
- C:\Windows\System\MiGRLod.exe
  C:\Windows\System\MiGRLod.exe
  2⤵
  PID:4080
- C:\Windows\System\FqlWPyx.exe
  C:\Windows\System\FqlWPyx.exe
  2⤵
  PID:3160
- C:\Windows\System\lBPaLBZ.exe
  C:\Windows\System\lBPaLBZ.exe
  2⤵
  PID:3220
- C:\Windows\System\mNMWVhu.exe
  C:\Windows\System\mNMWVhu.exe
  2⤵
  PID:3400
- C:\Windows\System\MyBMRWk.exe
  C:\Windows\System\MyBMRWk.exe
  2⤵
  PID:4068
- C:\Windows\System\iQZTrHq.exe
  C:\Windows\System\iQZTrHq.exe
  2⤵
  PID:2792
- C:\Windows\System\dlKDxaE.exe
  C:\Windows\System\dlKDxaE.exe
  2⤵
  PID:3768
- C:\Windows\System\yVOuFaj.exe
  C:\Windows\System\yVOuFaj.exe
  2⤵
  PID:3848
- C:\Windows\System\GtBoOiR.exe
  C:\Windows\System\GtBoOiR.exe
  2⤵
  PID:3976
- C:\Windows\System\VLjXAOH.exe
  C:\Windows\System\VLjXAOH.exe
  2⤵
  PID:3952
- C:\Windows\System\RwFtRPx.exe
  C:\Windows\System\RwFtRPx.exe
  2⤵
  PID:4004
- C:\Windows\System\zBeblBD.exe
  C:\Windows\System\zBeblBD.exe
  2⤵
  PID:2924
- C:\Windows\System\dINadDx.exe
  C:\Windows\System\dINadDx.exe
  2⤵
  PID:2356
- C:\Windows\System\BEwtNOb.exe
  C:\Windows\System\BEwtNOb.exe
  2⤵
  PID:4048
- C:\Windows\System\ZizlIzR.exe
  C:\Windows\System\ZizlIzR.exe
  2⤵
  PID:4036
- C:\Windows\System\NCMhXTd.exe
  C:\Windows\System\NCMhXTd.exe
  2⤵
  PID:3204
- C:\Windows\System\xkCUfVZ.exe
  C:\Windows\System\xkCUfVZ.exe
  2⤵
  PID:344
- C:\Windows\System\hmlcvQV.exe
  C:\Windows\System\hmlcvQV.exe
  2⤵
  PID:3960
- C:\Windows\System\dKbdhMR.exe
  C:\Windows\System\dKbdhMR.exe
  2⤵
  PID:3732
- C:\Windows\System\TMqoChX.exe
  C:\Windows\System\TMqoChX.exe
  2⤵
  PID:3720
- C:\Windows\System\mafcpfv.exe
  C:\Windows\System\mafcpfv.exe
  2⤵
  PID:2512
- C:\Windows\System\yQWsBdv.exe
  C:\Windows\System\yQWsBdv.exe
  2⤵
  PID:2056
- C:\Windows\System\uPoVqLL.exe
  C:\Windows\System\uPoVqLL.exe
  2⤵
  PID:3540
- C:\Windows\System\cukINHi.exe
  C:\Windows\System\cukINHi.exe
  2⤵
  PID:3544
- C:\Windows\System\SvBAZRJ.exe
  C:\Windows\System\SvBAZRJ.exe
  2⤵
  PID:3652
- C:\Windows\System\fHWtuLA.exe
  C:\Windows\System\fHWtuLA.exe
  2⤵
  PID:3836
- C:\Windows\System\hlGMyBI.exe
  C:\Windows\System\hlGMyBI.exe
  2⤵
  PID:3820
- C:\Windows\System\xAKwBVv.exe
  C:\Windows\System\xAKwBVv.exe
  2⤵
  PID:3964
- C:\Windows\System\ueqCsHd.exe
  C:\Windows\System\ueqCsHd.exe
  2⤵
  PID:2024
- C:\Windows\System\uFfOJly.exe
  C:\Windows\System\uFfOJly.exe
  2⤵
  PID:3128
- C:\Windows\System\LSQuyxa.exe
  C:\Windows\System\LSQuyxa.exe
  2⤵
  PID:2760
- C:\Windows\System\VKdJjkG.exe
  C:\Windows\System\VKdJjkG.exe
  2⤵
  PID:1300
- C:\Windows\System\uYKmFIu.exe
  C:\Windows\System\uYKmFIu.exe
  2⤵
  PID:3764
- C:\Windows\System\SDDlryu.exe
  C:\Windows\System\SDDlryu.exe
  2⤵
  PID:3936
- C:\Windows\System\tdtYVCO.exe
  C:\Windows\System\tdtYVCO.exe
  2⤵
  PID:4112
- C:\Windows\System\NxzJNjC.exe
  C:\Windows\System\NxzJNjC.exe
  2⤵
  PID:4128
- C:\Windows\System\aRdHSIj.exe
  C:\Windows\System\aRdHSIj.exe
  2⤵
  PID:4144
- C:\Windows\System\YyhoQzA.exe
  C:\Windows\System\YyhoQzA.exe
  2⤵
  PID:4160
- C:\Windows\System\aSlYhyA.exe
  C:\Windows\System\aSlYhyA.exe
  2⤵
  PID:4180
- C:\Windows\System\ACvbMeT.exe
  C:\Windows\System\ACvbMeT.exe
  2⤵
  PID:4196
- C:\Windows\System\uaQJens.exe
  C:\Windows\System\uaQJens.exe
  2⤵
  PID:4220
- C:\Windows\System\DlYltKI.exe
  C:\Windows\System\DlYltKI.exe
  2⤵
  PID:4240
- C:\Windows\System\MhbHFXS.exe
  C:\Windows\System\MhbHFXS.exe
  2⤵
  PID:4256
- C:\Windows\System\deVoqyY.exe
  C:\Windows\System\deVoqyY.exe
  2⤵
  PID:4272
- C:\Windows\System\fTOCElu.exe
  C:\Windows\System\fTOCElu.exe
  2⤵
  PID:4288
- C:\Windows\System\upipgxf.exe
  C:\Windows\System\upipgxf.exe
  2⤵
  PID:4308
- C:\Windows\System\VlKMPOj.exe
  C:\Windows\System\VlKMPOj.exe
  2⤵
  PID:4328
- C:\Windows\System\JDhhaDO.exe
  C:\Windows\System\JDhhaDO.exe
  2⤵
  PID:4400
- C:\Windows\System\wsEgXjY.exe
  C:\Windows\System\wsEgXjY.exe
  2⤵
  PID:4416
- C:\Windows\System\MXwmCFe.exe
  C:\Windows\System\MXwmCFe.exe
  2⤵
  PID:4432
- C:\Windows\System\sAYKDkw.exe
  C:\Windows\System\sAYKDkw.exe
  2⤵
  PID:4448
- C:\Windows\System\MzImMrd.exe
  C:\Windows\System\MzImMrd.exe
  2⤵
  PID:4464
- C:\Windows\System\mWKMSNR.exe
  C:\Windows\System\mWKMSNR.exe
  2⤵
  PID:4480
- C:\Windows\System\ncafamh.exe
  C:\Windows\System\ncafamh.exe
  2⤵
  PID:4496
- C:\Windows\System\qinllBK.exe
  C:\Windows\System\qinllBK.exe
  2⤵
  PID:4512
- C:\Windows\System\RprLYew.exe
  C:\Windows\System\RprLYew.exe
  2⤵
  PID:4528
- C:\Windows\System\XMnPkHK.exe
  C:\Windows\System\XMnPkHK.exe
  2⤵
  PID:4544
- C:\Windows\System\eoDTmat.exe
  C:\Windows\System\eoDTmat.exe
  2⤵
  PID:4560
- C:\Windows\System\eTHfCNf.exe
  C:\Windows\System\eTHfCNf.exe
  2⤵
  PID:4576
- C:\Windows\System\MRinWTt.exe
  C:\Windows\System\MRinWTt.exe
  2⤵
  PID:4592
- C:\Windows\System\BeQWOqi.exe
  C:\Windows\System\BeQWOqi.exe
  2⤵
  PID:4608
- C:\Windows\System\QPSGKly.exe
  C:\Windows\System\QPSGKly.exe
  2⤵
  PID:4624
- C:\Windows\System\XRRwGxp.exe
  C:\Windows\System\XRRwGxp.exe
  2⤵
  PID:4640
- C:\Windows\System\AgxJVJl.exe
  C:\Windows\System\AgxJVJl.exe
  2⤵
  PID:4656
- C:\Windows\System\jjEnDRs.exe
  C:\Windows\System\jjEnDRs.exe
  2⤵
  PID:4672
- C:\Windows\System\fkFhtkB.exe
  C:\Windows\System\fkFhtkB.exe
  2⤵
  PID:4688
- C:\Windows\System\eBlnWde.exe
  C:\Windows\System\eBlnWde.exe
  2⤵
  PID:4704
- C:\Windows\System\QFlxjSp.exe
  C:\Windows\System\QFlxjSp.exe
  2⤵
  PID:4720
- C:\Windows\System\qqvwXgQ.exe
  C:\Windows\System\qqvwXgQ.exe
  2⤵
  PID:4736
- C:\Windows\System\LOASihU.exe
  C:\Windows\System\LOASihU.exe
  2⤵
  PID:4752
- C:\Windows\System\zKXleYu.exe
  C:\Windows\System\zKXleYu.exe
  2⤵
  PID:4768
- C:\Windows\System\YQVMfjk.exe
  C:\Windows\System\YQVMfjk.exe
  2⤵
  PID:4784
- C:\Windows\System\tUXfYyI.exe
  C:\Windows\System\tUXfYyI.exe
  2⤵
  PID:4800
- C:\Windows\System\fHMDLTD.exe
  C:\Windows\System\fHMDLTD.exe
  2⤵
  PID:4816
- C:\Windows\System\vTWszHp.exe
  C:\Windows\System\vTWszHp.exe
  2⤵
  PID:4832
- C:\Windows\System\RVYClZF.exe
  C:\Windows\System\RVYClZF.exe
  2⤵
  PID:4876
- C:\Windows\System\MlupOyI.exe
  C:\Windows\System\MlupOyI.exe
  2⤵
  PID:4892
- C:\Windows\System\rLBgSSr.exe
  C:\Windows\System\rLBgSSr.exe
  2⤵
  PID:4908
- C:\Windows\System\McksyfS.exe
  C:\Windows\System\McksyfS.exe
  2⤵
  PID:4924
- C:\Windows\System\ryhtyOD.exe
  C:\Windows\System\ryhtyOD.exe
  2⤵
  PID:4940
- C:\Windows\System\sKTSZYP.exe
  C:\Windows\System\sKTSZYP.exe
  2⤵
  PID:4956
- C:\Windows\System\tEIWJXL.exe
  C:\Windows\System\tEIWJXL.exe
  2⤵
  PID:4972
- C:\Windows\System\ShJeLQx.exe
  C:\Windows\System\ShJeLQx.exe
  2⤵
  PID:4988
- C:\Windows\System\CaDqLMc.exe
  C:\Windows\System\CaDqLMc.exe
  2⤵
  PID:5008
- C:\Windows\System\aFMLhkt.exe
  C:\Windows\System\aFMLhkt.exe
  2⤵
  PID:5024
- C:\Windows\System\APSATgJ.exe
  C:\Windows\System\APSATgJ.exe
  2⤵
  PID:5040
- C:\Windows\System\jMEDcOG.exe
  C:\Windows\System\jMEDcOG.exe
  2⤵
  PID:5056
- C:\Windows\System\YjNwkPI.exe
  C:\Windows\System\YjNwkPI.exe
  2⤵
  PID:5072
- C:\Windows\System\ecIxyYA.exe
  C:\Windows\System\ecIxyYA.exe
  2⤵
  PID:5088
- C:\Windows\System\WPAYxsZ.exe
  C:\Windows\System\WPAYxsZ.exe
  2⤵
  PID:5104
- C:\Windows\System\eYqmGwy.exe
  C:\Windows\System\eYqmGwy.exe
  2⤵
  PID:3476
- C:\Windows\System\hvJKtCY.exe
  C:\Windows\System\hvJKtCY.exe
  2⤵
  PID:4124
- C:\Windows\System\hvAjHOn.exe
  C:\Windows\System\hvAjHOn.exe
  2⤵
  PID:4192
- C:\Windows\System\IMooYBA.exe
  C:\Windows\System\IMooYBA.exe
  2⤵
  PID:2292
- C:\Windows\System\DLbocAv.exe
  C:\Windows\System\DLbocAv.exe
  2⤵
  PID:3608
- C:\Windows\System\SxtkLya.exe
  C:\Windows\System\SxtkLya.exe
  2⤵
  PID:2908
- C:\Windows\System\mSFfjvo.exe
  C:\Windows\System\mSFfjvo.exe
  2⤵
  PID:1800
- C:\Windows\System\PXzRkpz.exe
  C:\Windows\System\PXzRkpz.exe
  2⤵
  PID:4140
- C:\Windows\System\gihunIj.exe
  C:\Windows\System\gihunIj.exe
  2⤵
  PID:4204
- C:\Windows\System\SDDOLXV.exe
  C:\Windows\System\SDDOLXV.exe
  2⤵
  PID:4252
- C:\Windows\System\gBfClXl.exe
  C:\Windows\System\gBfClXl.exe
  2⤵
  PID:4320
- C:\Windows\System\BEoFQCk.exe
  C:\Windows\System\BEoFQCk.exe
  2⤵
  PID:4236
- C:\Windows\System\sianOgq.exe
  C:\Windows\System\sianOgq.exe
  2⤵
  PID:4344
- C:\Windows\System\JDUuhij.exe
  C:\Windows\System\JDUuhij.exe
  2⤵
  PID:4304
- C:\Windows\System\sUJGIbQ.exe
  C:\Windows\System\sUJGIbQ.exe
  2⤵
  PID:4372
- C:\Windows\System\mKWhqRk.exe
  C:\Windows\System\mKWhqRk.exe
  2⤵
  PID:4264
- C:\Windows\System\CZdowsn.exe
  C:\Windows\System\CZdowsn.exe
  2⤵
  PID:4368
- C:\Windows\System\xKjuzwY.exe
  C:\Windows\System\xKjuzwY.exe
  2⤵
  PID:4424
- C:\Windows\System\sWKtIOc.exe
  C:\Windows\System\sWKtIOc.exe
  2⤵
  PID:4488
- C:\Windows\System\aTWkgUG.exe
  C:\Windows\System\aTWkgUG.exe
  2⤵
  PID:4392
- C:\Windows\System\FgJTPQK.exe
  C:\Windows\System\FgJTPQK.exe
  2⤵
  PID:4588
- C:\Windows\System\fHrgCGN.exe
  C:\Windows\System\fHrgCGN.exe
  2⤵
  PID:4652
- C:\Windows\System\EDPZHcZ.exe
  C:\Windows\System\EDPZHcZ.exe
  2⤵
  PID:4408
- C:\Windows\System\fUmRwBI.exe
  C:\Windows\System\fUmRwBI.exe
  2⤵
  PID:4504
- C:\Windows\System\aJkrYuE.exe
  C:\Windows\System\aJkrYuE.exe
  2⤵
  PID:4540
- C:\Windows\System\GMVMtiv.exe
  C:\Windows\System\GMVMtiv.exe
  2⤵
  PID:4600
- C:\Windows\System\XZjBfgJ.exe
  C:\Windows\System\XZjBfgJ.exe
  2⤵
  PID:4668
- C:\Windows\System\KmyEKrQ.exe
  C:\Windows\System\KmyEKrQ.exe
  2⤵
  PID:4732
- C:\Windows\System\eWDEnvy.exe
  C:\Windows\System\eWDEnvy.exe
  2⤵
  PID:4764
- C:\Windows\System\DEzfBoB.exe
  C:\Windows\System\DEzfBoB.exe
  2⤵
  PID:4716
- C:\Windows\System\iEWKwuy.exe
  C:\Windows\System\iEWKwuy.exe
  2⤵
  PID:4812
- C:\Windows\System\jgzaLNw.exe
  C:\Windows\System\jgzaLNw.exe
  2⤵
  PID:4844
- C:\Windows\System\DiYaKJy.exe
  C:\Windows\System\DiYaKJy.exe
  2⤵
  PID:4864
- C:\Windows\System\pZfgsyB.exe
  C:\Windows\System\pZfgsyB.exe
  2⤵
  PID:4900
- C:\Windows\System\GVQoIUA.exe
  C:\Windows\System\GVQoIUA.exe
  2⤵
  PID:4916
- C:\Windows\System\IgCQMNg.exe
  C:\Windows\System\IgCQMNg.exe
  2⤵
  PID:4980
- C:\Windows\System\wEFKOiY.exe
  C:\Windows\System\wEFKOiY.exe
  2⤵
  PID:4968
- C:\Windows\System\tHxqfXO.exe
  C:\Windows\System\tHxqfXO.exe
  2⤵
  PID:5032
- C:\Windows\System\sVYKzKR.exe
  C:\Windows\System\sVYKzKR.exe
  2⤵
  PID:5096
- C:\Windows\System\fbMOCDT.exe
  C:\Windows\System\fbMOCDT.exe
  2⤵
  PID:3336
- C:\Windows\System\PAHNXOD.exe
  C:\Windows\System\PAHNXOD.exe
  2⤵
  PID:5048
- C:\Windows\System\QftbNPY.exe
  C:\Windows\System\QftbNPY.exe
  2⤵
  PID:5116
- C:\Windows\System\YGCFYYP.exe
  C:\Windows\System\YGCFYYP.exe
  2⤵
  PID:3284
- C:\Windows\System\tQDunFR.exe
  C:\Windows\System\tQDunFR.exe
  2⤵
  PID:4212
- C:\Windows\System\QUgGIip.exe
  C:\Windows\System\QUgGIip.exe
  2⤵
  PID:4156
- C:\Windows\System\KLhffGP.exe
  C:\Windows\System\KLhffGP.exe
  2⤵
  PID:4384
- C:\Windows\System\fBAVaxp.exe
  C:\Windows\System\fBAVaxp.exe
  2⤵
  PID:4524
- C:\Windows\System\fVEmqYl.exe
  C:\Windows\System\fVEmqYl.exe
  2⤵
  PID:4472
- C:\Windows\System\KGAgPhc.exe
  C:\Windows\System\KGAgPhc.exe
  2⤵
  PID:4604
- C:\Windows\System\ZisIkSv.exe
  C:\Windows\System\ZisIkSv.exe
  2⤵
  PID:4728
- C:\Windows\System\HmkPRya.exe
  C:\Windows\System\HmkPRya.exe
  2⤵
  PID:4840
- C:\Windows\System\evIbhoK.exe
  C:\Windows\System\evIbhoK.exe
  2⤵
  PID:4952
- C:\Windows\System\gIUWQuQ.exe
  C:\Windows\System\gIUWQuQ.exe
  2⤵
  PID:5052
- C:\Windows\System\ZdbjjWM.exe
  C:\Windows\System\ZdbjjWM.exe
  2⤵
  PID:4340
- C:\Windows\System\Zazmjza.exe
  C:\Windows\System\Zazmjza.exe
  2⤵
  PID:4364
- C:\Windows\System\XberEyu.exe
  C:\Windows\System\XberEyu.exe
  2⤵
  PID:4584
- C:\Windows\System\qEHzvFN.exe
  C:\Windows\System\qEHzvFN.exe
  2⤵
  PID:4444
- C:\Windows\System\DqIhogD.exe
  C:\Windows\System\DqIhogD.exe
  2⤵
  PID:5000
- C:\Windows\System\nsGaHsr.exe
  C:\Windows\System\nsGaHsr.exe
  2⤵
  PID:4856
- C:\Windows\System\HiDMbZC.exe
  C:\Windows\System\HiDMbZC.exe
  2⤵
  PID:4936
- C:\Windows\System\zvXruwO.exe
  C:\Windows\System\zvXruwO.exe
  2⤵
  PID:2344
- C:\Windows\System\dkccwQg.exe
  C:\Windows\System\dkccwQg.exe
  2⤵
  PID:3700
- C:\Windows\System\AQaBbPU.exe
  C:\Windows\System\AQaBbPU.exe
  2⤵
  PID:3824
- C:\Windows\System\cAidoNz.exe
  C:\Windows\System\cAidoNz.exe
  2⤵
  PID:4536
- C:\Windows\System\rWPIXtD.exe
  C:\Windows\System\rWPIXtD.exe
  2⤵
  PID:4316
- C:\Windows\System\HkDmcnX.exe
  C:\Windows\System\HkDmcnX.exe
  2⤵
  PID:4460
- C:\Windows\System\ITatdvo.exe
  C:\Windows\System\ITatdvo.exe
  2⤵
  PID:5080
- C:\Windows\System\fTXuKXW.exe
  C:\Windows\System\fTXuKXW.exe
  2⤵
  PID:4348
- C:\Windows\System\BPNRGHF.exe
  C:\Windows\System\BPNRGHF.exe
  2⤵
  PID:4700
- C:\Windows\System\TEGvdRB.exe
  C:\Windows\System\TEGvdRB.exe
  2⤵
  PID:4120
- C:\Windows\System\QtnmNyf.exe
  C:\Windows\System\QtnmNyf.exe
  2⤵
  PID:4520
- C:\Windows\System\iheDCDu.exe
  C:\Windows\System\iheDCDu.exe
  2⤵
  PID:4828
- C:\Windows\System\frGkcAD.exe
  C:\Windows\System\frGkcAD.exe
  2⤵
  PID:4932
- C:\Windows\System\CIfZBYZ.exe
  C:\Windows\System\CIfZBYZ.exe
  2⤵
  PID:3588
- C:\Windows\System\VxutTQa.exe
  C:\Windows\System\VxutTQa.exe
  2⤵
  PID:5128
- C:\Windows\System\LpYgKGm.exe
  C:\Windows\System\LpYgKGm.exe
  2⤵
  PID:5144
- C:\Windows\System\cXVJfhK.exe
  C:\Windows\System\cXVJfhK.exe
  2⤵
  PID:5160
- C:\Windows\System\NcGRUcv.exe
  C:\Windows\System\NcGRUcv.exe
  2⤵
  PID:5180
- C:\Windows\System\hMWxCSR.exe
  C:\Windows\System\hMWxCSR.exe
  2⤵
  PID:5196
- C:\Windows\System\bYETfMs.exe
  C:\Windows\System\bYETfMs.exe
  2⤵
  PID:5212
- C:\Windows\System\lkjupKE.exe
  C:\Windows\System\lkjupKE.exe
  2⤵
  PID:5228
- C:\Windows\System\qlVgYXi.exe
  C:\Windows\System\qlVgYXi.exe
  2⤵
  PID:5244
- C:\Windows\System\twCUiha.exe
  C:\Windows\System\twCUiha.exe
  2⤵
  PID:5260
- C:\Windows\System\iUfvOJF.exe
  C:\Windows\System\iUfvOJF.exe
  2⤵
  PID:5276
- C:\Windows\System\aRagXZD.exe
  C:\Windows\System\aRagXZD.exe
  2⤵
  PID:5292
- C:\Windows\System\KeZDQPL.exe
  C:\Windows\System\KeZDQPL.exe
  2⤵
  PID:5308
- C:\Windows\System\CLdVjsy.exe
  C:\Windows\System\CLdVjsy.exe
  2⤵
  PID:5324
- C:\Windows\System\BWgrXok.exe
  C:\Windows\System\BWgrXok.exe
  2⤵
  PID:5340
- C:\Windows\System\xeqZLvz.exe
  C:\Windows\System\xeqZLvz.exe
  2⤵
  PID:5356
- C:\Windows\System\pDBlaxP.exe
  C:\Windows\System\pDBlaxP.exe
  2⤵
  PID:5372
- C:\Windows\System\fsmayUL.exe
  C:\Windows\System\fsmayUL.exe
  2⤵
  PID:5388
- C:\Windows\System\UtADPVm.exe
  C:\Windows\System\UtADPVm.exe
  2⤵
  PID:5404
- C:\Windows\System\JfWtqaj.exe
  C:\Windows\System\JfWtqaj.exe
  2⤵
  PID:5420
- C:\Windows\System\GLQjZcx.exe
  C:\Windows\System\GLQjZcx.exe
  2⤵
  PID:5436
- C:\Windows\System\vOTaVIG.exe
  C:\Windows\System\vOTaVIG.exe
  2⤵
  PID:5452
- C:\Windows\System\mKGPIAN.exe
  C:\Windows\System\mKGPIAN.exe
  2⤵
  PID:5468
- C:\Windows\System\oUhHFnJ.exe
  C:\Windows\System\oUhHFnJ.exe
  2⤵
  PID:5484
- C:\Windows\System\YDusFkf.exe
  C:\Windows\System\YDusFkf.exe
  2⤵
  PID:5500
- C:\Windows\System\fLpmtQM.exe
  C:\Windows\System\fLpmtQM.exe
  2⤵
  PID:5516
- C:\Windows\System\kdHnpuq.exe
  C:\Windows\System\kdHnpuq.exe
  2⤵
  PID:5532
- C:\Windows\System\jYxtmzx.exe
  C:\Windows\System\jYxtmzx.exe
  2⤵
  PID:5548
- C:\Windows\System\ytjrOki.exe
  C:\Windows\System\ytjrOki.exe
  2⤵
  PID:5564
- C:\Windows\System\bZQFAPO.exe
  C:\Windows\System\bZQFAPO.exe
  2⤵
  PID:5580
- C:\Windows\System\tUzNspy.exe
  C:\Windows\System\tUzNspy.exe
  2⤵
  PID:5596
- C:\Windows\System\MeXsTUb.exe
  C:\Windows\System\MeXsTUb.exe
  2⤵
  PID:5612
- C:\Windows\System\vGQAYvk.exe
  C:\Windows\System\vGQAYvk.exe
  2⤵
  PID:5628
- C:\Windows\System\NydvSmW.exe
  C:\Windows\System\NydvSmW.exe
  2⤵
  PID:5644
- C:\Windows\System\blsOOep.exe
  C:\Windows\System\blsOOep.exe
  2⤵
  PID:5660
- C:\Windows\System\gQjddbp.exe
  C:\Windows\System\gQjddbp.exe
  2⤵
  PID:5676
- C:\Windows\System\BhOTpvG.exe
  C:\Windows\System\BhOTpvG.exe
  2⤵
  PID:5692
- C:\Windows\System\ekQOgRT.exe
  C:\Windows\System\ekQOgRT.exe
  2⤵
  PID:5708
- C:\Windows\System\SILgBkE.exe
  C:\Windows\System\SILgBkE.exe
  2⤵
  PID:5724
- C:\Windows\System\EVHkpkT.exe
  C:\Windows\System\EVHkpkT.exe
  2⤵
  PID:5740
- C:\Windows\System\MxrVLWv.exe
  C:\Windows\System\MxrVLWv.exe
  2⤵
  PID:5756
- C:\Windows\System\aukjmcf.exe
  C:\Windows\System\aukjmcf.exe
  2⤵
  PID:5780
- C:\Windows\System\cmDTabo.exe
  C:\Windows\System\cmDTabo.exe
  2⤵
  PID:5796
- C:\Windows\System\HSHWfdT.exe
  C:\Windows\System\HSHWfdT.exe
  2⤵
  PID:5812
- C:\Windows\System\MdWpSvY.exe
  C:\Windows\System\MdWpSvY.exe
  2⤵
  PID:5828
- C:\Windows\System\bnnRSha.exe
  C:\Windows\System\bnnRSha.exe
  2⤵
  PID:5844
- C:\Windows\System\olnqGFm.exe
  C:\Windows\System\olnqGFm.exe
  2⤵
  PID:5860
- C:\Windows\System\rTfJVIH.exe
  C:\Windows\System\rTfJVIH.exe
  2⤵
  PID:5876
- C:\Windows\System\qToENKT.exe
  C:\Windows\System\qToENKT.exe
  2⤵
  PID:5892
- C:\Windows\System\UjGFkRz.exe
  C:\Windows\System\UjGFkRz.exe
  2⤵
  PID:5908
- C:\Windows\System\agJYeMl.exe
  C:\Windows\System\agJYeMl.exe
  2⤵
  PID:5924
- C:\Windows\System\YjKahmL.exe
  C:\Windows\System\YjKahmL.exe
  2⤵
  PID:5940
- C:\Windows\System\SAbALrk.exe
  C:\Windows\System\SAbALrk.exe
  2⤵
  PID:5956
- C:\Windows\System\IUjzAZJ.exe
  C:\Windows\System\IUjzAZJ.exe
  2⤵
  PID:5972
- C:\Windows\System\curSsNi.exe
  C:\Windows\System\curSsNi.exe
  2⤵
  PID:5988
- C:\Windows\System\kcyaffL.exe
  C:\Windows\System\kcyaffL.exe
  2⤵
  PID:6004
- C:\Windows\System\rawBDPc.exe
  C:\Windows\System\rawBDPc.exe
  2⤵
  PID:6020
- C:\Windows\System\nzSMFCA.exe
  C:\Windows\System\nzSMFCA.exe
  2⤵
  PID:6036
- C:\Windows\System\FeDdljH.exe
  C:\Windows\System\FeDdljH.exe
  2⤵
  PID:6052
- C:\Windows\System\pnJQFuE.exe
  C:\Windows\System\pnJQFuE.exe
  2⤵
  PID:6068
- C:\Windows\System\tiwTeqS.exe
  C:\Windows\System\tiwTeqS.exe
  2⤵
  PID:6084
- C:\Windows\System\ASgDjQD.exe
  C:\Windows\System\ASgDjQD.exe
  2⤵
  PID:6100
- C:\Windows\System\DwDQQkl.exe
  C:\Windows\System\DwDQQkl.exe
  2⤵
  PID:6116
- C:\Windows\System\yDRTiGO.exe
  C:\Windows\System\yDRTiGO.exe
  2⤵
  PID:6132
- C:\Windows\System\Hyqvovm.exe
  C:\Windows\System\Hyqvovm.exe
  2⤵
  PID:4356
- C:\Windows\System\LFjpGLz.exe
  C:\Windows\System\LFjpGLz.exe
  2⤵
  PID:5168
- C:\Windows\System\ZLimWVA.exe
  C:\Windows\System\ZLimWVA.exe
  2⤵
  PID:5208
- C:\Windows\System\iOUGZOy.exe
  C:\Windows\System\iOUGZOy.exe
  2⤵
  PID:5268
- C:\Windows\System\mEmBJPh.exe
  C:\Windows\System\mEmBJPh.exe
  2⤵
  PID:5016
- C:\Windows\System\EtuDMFv.exe
  C:\Windows\System\EtuDMFv.exe
  2⤵
  PID:5068
- C:\Windows\System\rkUQpyN.exe
  C:\Windows\System\rkUQpyN.exe
  2⤵
  PID:5124
- C:\Windows\System\riXtQyo.exe
  C:\Windows\System\riXtQyo.exe
  2⤵
  PID:5336
- C:\Windows\System\WASvSNY.exe
  C:\Windows\System\WASvSNY.exe
  2⤵
  PID:5332
- C:\Windows\System\KOkgjeH.exe
  C:\Windows\System\KOkgjeH.exe
  2⤵
  PID:5460
- C:\Windows\System\zJFXuPf.exe
  
  C:\Windows\System\zJFXuPf.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes