xmrig | ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
Size

1.3MB
MD5

35ac71ebd545880e22c50e5b9f4649f4
SHA1

bd2aed102b499001a2d17879e692f3f83f397096
SHA256

ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd
SHA512

832b2b7ad3af9c1e4b77812ecc43f5d67279e075d26891651707118530e6d2e5a68ef54723f733bc2354dc0a92edde2f345a534078e871ef8f4620689e3375b9
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6Pb5x8r8:GezaTF8FcNkNdfE0pZ9ozttwIRx3T2zI

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023c35-3.dat	xmrig
behavioral2/files/0x0008000000023c4f-9.dat	xmrig
behavioral2/files/0x0008000000023c50-8.dat	xmrig
behavioral2/files/0x0008000000023c81-61.dat	xmrig
behavioral2/files/0x0008000000023c82-74.dat	xmrig
behavioral2/files/0x0008000000023c84-84.dat	xmrig
behavioral2/files/0x0008000000023c89-101.dat	xmrig
behavioral2/files/0x0007000000023c94-124.dat	xmrig
behavioral2/files/0x0007000000023c9d-161.dat	xmrig
behavioral2/files/0x0007000000023c9b-159.dat	xmrig
behavioral2/files/0x0007000000023c9c-156.dat	xmrig
behavioral2/files/0x0007000000023c9a-154.dat	xmrig
behavioral2/files/0x0007000000023c99-149.dat	xmrig
behavioral2/files/0x0007000000023c98-144.dat	xmrig
behavioral2/files/0x0007000000023c97-139.dat	xmrig
behavioral2/files/0x0007000000023c96-134.dat	xmrig
behavioral2/files/0x0007000000023c95-129.dat	xmrig
behavioral2/files/0x0007000000023c93-119.dat	xmrig
behavioral2/files/0x0008000000023c8a-114.dat	xmrig
behavioral2/files/0x0008000000023c88-104.dat	xmrig
behavioral2/files/0x0008000000023c87-99.dat	xmrig
behavioral2/files/0x0008000000023c86-94.dat	xmrig
behavioral2/files/0x0008000000023c85-89.dat	xmrig
behavioral2/files/0x0008000000023c83-79.dat	xmrig
behavioral2/files/0x0008000000023c80-64.dat	xmrig
behavioral2/files/0x0008000000023c74-59.dat	xmrig
behavioral2/files/0x0008000000023c70-54.dat	xmrig
behavioral2/files/0x0016000000023c6a-49.dat	xmrig
behavioral2/files/0x000b000000023c69-41.dat	xmrig
behavioral2/files/0x0008000000023c54-37.dat	xmrig
behavioral2/files/0x0008000000023c53-31.dat	xmrig
behavioral2/files/0x0008000000023c52-26.dat	xmrig
behavioral2/files/0x0008000000023c51-21.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4324	lrQhupN.exe
2612	PajUHMi.exe
4304	sYWDrAR.exe
116	oWHrSHl.exe
2444	RDfCxqC.exe
1236	zKOdGoX.exe
1716	blxTVfF.exe
4700	JVXGYbl.exe
4464	tCtAujq.exe
4560	iUZcfYR.exe
2908	EBuKfIC.exe
2264	FTHpSXg.exe
1268	MjZZukz.exe
632	llyWiLo.exe
1900	oHKsSEs.exe
4968	whMJuEC.exe
4008	SosptYb.exe
2832	VwpAHlP.exe
4104	CabqLlS.exe
1256	QymCrpK.exe
1648	LnnURIN.exe
5040	NHkBhna.exe
4852	THLMbXe.exe
2436	KlpriEo.exe
3652	deJZsMf.exe
3736	ShmsVht.exe
4456	xIhvpFu.exe
4140	YnvBmSj.exe
3232	wISlieE.exe
2880	OkdDrwM.exe
3720	pjoWMjA.exe
3604	pOtRalA.exe
4164	WEliDYz.exe
3492	RdpkDQQ.exe
2900	NKkgirk.exe
1068	GSVMocL.exe
4596	QYIXfne.exe
4804	BJuERfS.exe
1628	DHFSoMk.exe
1952	BFtigBd.exe
4072	KTumdlx.exe
3956	iORuUmp.exe
3256	UNSmsIu.exe
2416	ZJtXarY.exe
1820	LJtDmUS.exe
3860	ZvHtsRi.exe
904	OiQqhLP.exe
4036	IANGlwR.exe
3816	SFdUFnW.exe
1860	BMURYne.exe
3540	OWXJsbz.exe
3772	nnWCnYi.exe
3504	eRjlpeM.exe
4420	ThwFGfi.exe
4428	lOmawiJ.exe
440	IuZpPQJ.exe
4044	ycTrdGw.exe
4540	kKIJTHe.exe
8	IDmjvVw.exe
4384	RPOwRlR.exe
2660	dHyAHYs.exe
1448	YxGBRQO.exe
2560	OiuCVnU.exe
2980	gmYmPPu.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AtwMwop.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\nDRHleX.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\ZcShOsn.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\PmowgNv.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\MJtIbJu.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\FXWGvMy.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\SzOkGxF.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\LPSglGv.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\vBzcxia.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\EzhFfqX.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\kxuGpVJ.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\LqXGtJT.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\bAiNfLb.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\THLMbXe.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\LhggIqS.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\xdeYeqE.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\nEekcMV.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\IsBtZIJ.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\RaEPRee.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\GrAeBqD.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\DLqISFV.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\lgZxhif.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\WCHCQcQ.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\ttQQEol.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\BJuERfS.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\YxGBRQO.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\emQNIsS.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\ivcznSx.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\GlGQoZK.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\QvKPTDk.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\pgsXPMh.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\iZnmIXm.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\CbLsunY.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\DgrsDrp.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\uVLngKt.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\xQcouHX.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\WMlpjzt.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\ppwRSsd.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\TjtGpmu.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\kTfiRRJ.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\vHfCdNJ.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\oJatEzZ.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\rXjwRvD.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\UoUPsJe.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\fuLpLYz.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\losiTTl.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\OLjehur.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\yraZMHu.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\TemZgQw.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\IuPnWnz.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\QpGBRpH.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\qYGHJyj.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\gdtbVrD.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\zaLwfaM.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\AYGLFJo.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\sNDtpfw.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\YTyfbOF.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\HeXQPPA.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\eQqMYnf.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\mGchEyA.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\EPgtTlt.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\HisuMDm.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\GcoELmB.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
File created	C:\Windows\System\zWThtGe.exe	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17164	dwm.exe
Token: SeChangeNotifyPrivilege	17164	dwm.exe
Token: 33	17164	dwm.exe
Token: SeIncBasePriorityPrivilege	17164	dwm.exe
Token: SeShutdownPrivilege	17164	dwm.exe
Token: SeCreatePagefilePrivilege	17164	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 4324	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	85
PID 372 wrote to memory of 4324	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	85
PID 372 wrote to memory of 2612	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	86
PID 372 wrote to memory of 2612	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	86
PID 372 wrote to memory of 4304	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	87
PID 372 wrote to memory of 4304	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	87
PID 372 wrote to memory of 116	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	88
PID 372 wrote to memory of 116	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	88
PID 372 wrote to memory of 2444	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	89
PID 372 wrote to memory of 2444	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	89
PID 372 wrote to memory of 1236	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	90
PID 372 wrote to memory of 1236	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	90
PID 372 wrote to memory of 1716	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	91
PID 372 wrote to memory of 1716	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	91
PID 372 wrote to memory of 4700	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	92
PID 372 wrote to memory of 4700	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	92
PID 372 wrote to memory of 4464	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	93
PID 372 wrote to memory of 4464	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	93
PID 372 wrote to memory of 4560	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	94
PID 372 wrote to memory of 4560	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	94
PID 372 wrote to memory of 2908	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	95
PID 372 wrote to memory of 2908	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	95
PID 372 wrote to memory of 2264	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	96
PID 372 wrote to memory of 2264	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	96
PID 372 wrote to memory of 1268	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	97
PID 372 wrote to memory of 1268	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	97
PID 372 wrote to memory of 632	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	98
PID 372 wrote to memory of 632	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	98
PID 372 wrote to memory of 1900	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	99
PID 372 wrote to memory of 1900	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	99
PID 372 wrote to memory of 4968	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	100
PID 372 wrote to memory of 4968	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	100
PID 372 wrote to memory of 4008	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	101
PID 372 wrote to memory of 4008	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	101
PID 372 wrote to memory of 2832	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	102
PID 372 wrote to memory of 2832	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	102
PID 372 wrote to memory of 4104	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	103
PID 372 wrote to memory of 4104	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	103
PID 372 wrote to memory of 1256	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	104
PID 372 wrote to memory of 1256	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	104
PID 372 wrote to memory of 1648	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	105
PID 372 wrote to memory of 1648	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	105
PID 372 wrote to memory of 5040	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	106
PID 372 wrote to memory of 5040	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	106
PID 372 wrote to memory of 4852	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	107
PID 372 wrote to memory of 4852	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	107
PID 372 wrote to memory of 2436	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	108
PID 372 wrote to memory of 2436	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	108
PID 372 wrote to memory of 3652	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	109
PID 372 wrote to memory of 3652	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	109
PID 372 wrote to memory of 3736	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	110
PID 372 wrote to memory of 3736	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	110
PID 372 wrote to memory of 4456	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	111
PID 372 wrote to memory of 4456	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	111
PID 372 wrote to memory of 4140	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	112
PID 372 wrote to memory of 4140	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	112
PID 372 wrote to memory of 3232	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	113
PID 372 wrote to memory of 3232	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	113
PID 372 wrote to memory of 2880	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	114
PID 372 wrote to memory of 2880	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	114
PID 372 wrote to memory of 3720	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	115
PID 372 wrote to memory of 3720	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	115
PID 372 wrote to memory of 3604	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	116
PID 372 wrote to memory of 3604	372	ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe	116

C:\Users\Admin\AppData\Local\Temp\ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe
"C:\Users\Admin\AppData\Local\Temp\ecb46d6c4d7d51c789aeefee4ac9c9415251da0d989dfdce105038df533dfccd.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\System\lrQhupN.exe
  C:\Windows\System\lrQhupN.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\PajUHMi.exe
  C:\Windows\System\PajUHMi.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\sYWDrAR.exe
  C:\Windows\System\sYWDrAR.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\oWHrSHl.exe
  C:\Windows\System\oWHrSHl.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\RDfCxqC.exe
  C:\Windows\System\RDfCxqC.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\zKOdGoX.exe
  C:\Windows\System\zKOdGoX.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\blxTVfF.exe
  C:\Windows\System\blxTVfF.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\JVXGYbl.exe
  C:\Windows\System\JVXGYbl.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\tCtAujq.exe
  C:\Windows\System\tCtAujq.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\iUZcfYR.exe
  C:\Windows\System\iUZcfYR.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\EBuKfIC.exe
  C:\Windows\System\EBuKfIC.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\FTHpSXg.exe
  C:\Windows\System\FTHpSXg.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\MjZZukz.exe
  C:\Windows\System\MjZZukz.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\llyWiLo.exe
  C:\Windows\System\llyWiLo.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\oHKsSEs.exe
  C:\Windows\System\oHKsSEs.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\whMJuEC.exe
  C:\Windows\System\whMJuEC.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\SosptYb.exe
  C:\Windows\System\SosptYb.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\VwpAHlP.exe
  C:\Windows\System\VwpAHlP.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\CabqLlS.exe
  C:\Windows\System\CabqLlS.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\QymCrpK.exe
  C:\Windows\System\QymCrpK.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\LnnURIN.exe
  C:\Windows\System\LnnURIN.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\NHkBhna.exe
  C:\Windows\System\NHkBhna.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\THLMbXe.exe
  C:\Windows\System\THLMbXe.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\KlpriEo.exe
  C:\Windows\System\KlpriEo.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\deJZsMf.exe
  C:\Windows\System\deJZsMf.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\ShmsVht.exe
  C:\Windows\System\ShmsVht.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\xIhvpFu.exe
  C:\Windows\System\xIhvpFu.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\YnvBmSj.exe
  C:\Windows\System\YnvBmSj.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\wISlieE.exe
  C:\Windows\System\wISlieE.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\OkdDrwM.exe
  C:\Windows\System\OkdDrwM.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\pjoWMjA.exe
  C:\Windows\System\pjoWMjA.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\pOtRalA.exe
  C:\Windows\System\pOtRalA.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\WEliDYz.exe
  C:\Windows\System\WEliDYz.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\RdpkDQQ.exe
  C:\Windows\System\RdpkDQQ.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\NKkgirk.exe
  C:\Windows\System\NKkgirk.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\GSVMocL.exe
  C:\Windows\System\GSVMocL.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\QYIXfne.exe
  C:\Windows\System\QYIXfne.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\BJuERfS.exe
  C:\Windows\System\BJuERfS.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\DHFSoMk.exe
  C:\Windows\System\DHFSoMk.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\BFtigBd.exe
  C:\Windows\System\BFtigBd.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\KTumdlx.exe
  C:\Windows\System\KTumdlx.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\iORuUmp.exe
  C:\Windows\System\iORuUmp.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\UNSmsIu.exe
  C:\Windows\System\UNSmsIu.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\ZJtXarY.exe
  C:\Windows\System\ZJtXarY.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\LJtDmUS.exe
  C:\Windows\System\LJtDmUS.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\ZvHtsRi.exe
  C:\Windows\System\ZvHtsRi.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\OiQqhLP.exe
  C:\Windows\System\OiQqhLP.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\IANGlwR.exe
  C:\Windows\System\IANGlwR.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\SFdUFnW.exe
  C:\Windows\System\SFdUFnW.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\BMURYne.exe
  C:\Windows\System\BMURYne.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\OWXJsbz.exe
  C:\Windows\System\OWXJsbz.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\nnWCnYi.exe
  C:\Windows\System\nnWCnYi.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\eRjlpeM.exe
  C:\Windows\System\eRjlpeM.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\ThwFGfi.exe
  C:\Windows\System\ThwFGfi.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\lOmawiJ.exe
  C:\Windows\System\lOmawiJ.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\IuZpPQJ.exe
  C:\Windows\System\IuZpPQJ.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\ycTrdGw.exe
  C:\Windows\System\ycTrdGw.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\kKIJTHe.exe
  C:\Windows\System\kKIJTHe.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\IDmjvVw.exe
  C:\Windows\System\IDmjvVw.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\RPOwRlR.exe
  C:\Windows\System\RPOwRlR.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\dHyAHYs.exe
  C:\Windows\System\dHyAHYs.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\YxGBRQO.exe
  C:\Windows\System\YxGBRQO.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\OiuCVnU.exe
  C:\Windows\System\OiuCVnU.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\gmYmPPu.exe
  C:\Windows\System\gmYmPPu.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\rmoHyuX.exe
  C:\Windows\System\rmoHyuX.exe
  2⤵
  PID:2208
- C:\Windows\System\FSKjNht.exe
  C:\Windows\System\FSKjNht.exe
  2⤵
  PID:1372
- C:\Windows\System\PrpEHAv.exe
  C:\Windows\System\PrpEHAv.exe
  2⤵
  PID:4932
- C:\Windows\System\hvCqzBp.exe
  C:\Windows\System\hvCqzBp.exe
  2⤵
  PID:4704
- C:\Windows\System\wsQhGcx.exe
  C:\Windows\System\wsQhGcx.exe
  2⤵
  PID:4744
- C:\Windows\System\gtQnFBj.exe
  C:\Windows\System\gtQnFBj.exe
  2⤵
  PID:316
- C:\Windows\System\GxapBzd.exe
  C:\Windows\System\GxapBzd.exe
  2⤵
  PID:1980
- C:\Windows\System\UyswQjb.exe
  C:\Windows\System\UyswQjb.exe
  2⤵
  PID:1756
- C:\Windows\System\UoqVibU.exe
  C:\Windows\System\UoqVibU.exe
  2⤵
  PID:1396
- C:\Windows\System\obRxsSY.exe
  C:\Windows\System\obRxsSY.exe
  2⤵
  PID:1840
- C:\Windows\System\YHnAzoh.exe
  C:\Windows\System\YHnAzoh.exe
  2⤵
  PID:2508
- C:\Windows\System\laIuUkS.exe
  C:\Windows\System\laIuUkS.exe
  2⤵
  PID:2864
- C:\Windows\System\TWjQSxn.exe
  C:\Windows\System\TWjQSxn.exe
  2⤵
  PID:1440
- C:\Windows\System\mlDiQjA.exe
  C:\Windows\System\mlDiQjA.exe
  2⤵
  PID:4640
- C:\Windows\System\qElOwfH.exe
  C:\Windows\System\qElOwfH.exe
  2⤵
  PID:3900
- C:\Windows\System\GfyrbXY.exe
  C:\Windows\System\GfyrbXY.exe
  2⤵
  PID:4496
- C:\Windows\System\mccpcsJ.exe
  C:\Windows\System\mccpcsJ.exe
  2⤵
  PID:2604
- C:\Windows\System\dcYvRsS.exe
  C:\Windows\System\dcYvRsS.exe
  2⤵
  PID:5136
- C:\Windows\System\ajbxNBx.exe
  C:\Windows\System\ajbxNBx.exe
  2⤵
  PID:5160
- C:\Windows\System\FXuloRU.exe
  C:\Windows\System\FXuloRU.exe
  2⤵
  PID:5188
- C:\Windows\System\jXPOxXz.exe
  C:\Windows\System\jXPOxXz.exe
  2⤵
  PID:5220
- C:\Windows\System\cXNtPoa.exe
  C:\Windows\System\cXNtPoa.exe
  2⤵
  PID:5248
- C:\Windows\System\ZacdPtI.exe
  C:\Windows\System\ZacdPtI.exe
  2⤵
  PID:5276
- C:\Windows\System\zWThtGe.exe
  C:\Windows\System\zWThtGe.exe
  2⤵
  PID:5300
- C:\Windows\System\PaalHxC.exe
  C:\Windows\System\PaalHxC.exe
  2⤵
  PID:5328
- C:\Windows\System\LNnFqqy.exe
  C:\Windows\System\LNnFqqy.exe
  2⤵
  PID:5360
- C:\Windows\System\mrjSBkb.exe
  C:\Windows\System\mrjSBkb.exe
  2⤵
  PID:5384
- C:\Windows\System\LUcBwcO.exe
  C:\Windows\System\LUcBwcO.exe
  2⤵
  PID:5412
- C:\Windows\System\aXDFpFp.exe
  C:\Windows\System\aXDFpFp.exe
  2⤵
  PID:5440
- C:\Windows\System\zOHuVmB.exe
  C:\Windows\System\zOHuVmB.exe
  2⤵
  PID:5468
- C:\Windows\System\hiSfkhH.exe
  C:\Windows\System\hiSfkhH.exe
  2⤵
  PID:5496
- C:\Windows\System\IPGtiZK.exe
  C:\Windows\System\IPGtiZK.exe
  2⤵
  PID:5528
- C:\Windows\System\mEyRCWS.exe
  C:\Windows\System\mEyRCWS.exe
  2⤵
  PID:5552
- C:\Windows\System\aCaldQd.exe
  C:\Windows\System\aCaldQd.exe
  2⤵
  PID:5580
- C:\Windows\System\YWobrlY.exe
  C:\Windows\System\YWobrlY.exe
  2⤵
  PID:5608
- C:\Windows\System\BghREUN.exe
  C:\Windows\System\BghREUN.exe
  2⤵
  PID:5672
- C:\Windows\System\YRtaypW.exe
  C:\Windows\System\YRtaypW.exe
  2⤵
  PID:5688
- C:\Windows\System\gpkDIns.exe
  C:\Windows\System\gpkDIns.exe
  2⤵
  PID:5704
- C:\Windows\System\KLYMKVw.exe
  C:\Windows\System\KLYMKVw.exe
  2⤵
  PID:5728
- C:\Windows\System\GsFToIy.exe
  C:\Windows\System\GsFToIy.exe
  2⤵
  PID:5756
- C:\Windows\System\tXSSiRQ.exe
  C:\Windows\System\tXSSiRQ.exe
  2⤵
  PID:5784
- C:\Windows\System\BlZfjdN.exe
  C:\Windows\System\BlZfjdN.exe
  2⤵
  PID:5812
- C:\Windows\System\irKhbtm.exe
  C:\Windows\System\irKhbtm.exe
  2⤵
  PID:5832
- C:\Windows\System\tjRAGQC.exe
  C:\Windows\System\tjRAGQC.exe
  2⤵
  PID:5868
- C:\Windows\System\pusFHQZ.exe
  C:\Windows\System\pusFHQZ.exe
  2⤵
  PID:5888
- C:\Windows\System\GCXMzuW.exe
  C:\Windows\System\GCXMzuW.exe
  2⤵
  PID:5916
- C:\Windows\System\ecQmKMc.exe
  C:\Windows\System\ecQmKMc.exe
  2⤵
  PID:5944
- C:\Windows\System\bLvEdwY.exe
  C:\Windows\System\bLvEdwY.exe
  2⤵
  PID:5972
- C:\Windows\System\lDDxXVB.exe
  C:\Windows\System\lDDxXVB.exe
  2⤵
  PID:6000
- C:\Windows\System\RdZaRlg.exe
  C:\Windows\System\RdZaRlg.exe
  2⤵
  PID:6028
- C:\Windows\System\pBVWWqN.exe
  C:\Windows\System\pBVWWqN.exe
  2⤵
  PID:6056
- C:\Windows\System\LprCoWK.exe
  C:\Windows\System\LprCoWK.exe
  2⤵
  PID:6084
- C:\Windows\System\nZWQvWP.exe
  C:\Windows\System\nZWQvWP.exe
  2⤵
  PID:6112
- C:\Windows\System\QvKPTDk.exe
  C:\Windows\System\QvKPTDk.exe
  2⤵
  PID:6140
- C:\Windows\System\roOzREi.exe
  C:\Windows\System\roOzREi.exe
  2⤵
  PID:2788
- C:\Windows\System\IxdJOKO.exe
  C:\Windows\System\IxdJOKO.exe
  2⤵
  PID:1428
- C:\Windows\System\JoLqGjj.exe
  C:\Windows\System\JoLqGjj.exe
  2⤵
  PID:5080
- C:\Windows\System\HfcTmiY.exe
  C:\Windows\System\HfcTmiY.exe
  2⤵
  PID:4028
- C:\Windows\System\WCfSWVi.exe
  C:\Windows\System\WCfSWVi.exe
  2⤵
  PID:4756
- C:\Windows\System\QneTYzv.exe
  C:\Windows\System\QneTYzv.exe
  2⤵
  PID:2492
- C:\Windows\System\mMJvvCz.exe
  C:\Windows\System\mMJvvCz.exe
  2⤵
  PID:4492
- C:\Windows\System\tnuvJuS.exe
  C:\Windows\System\tnuvJuS.exe
  2⤵
  PID:5124
- C:\Windows\System\pSZJNHt.exe
  C:\Windows\System\pSZJNHt.exe
  2⤵
  PID:5180
- C:\Windows\System\xLNrhQh.exe
  C:\Windows\System\xLNrhQh.exe
  2⤵
  PID:5264
- C:\Windows\System\FLzgMGB.exe
  C:\Windows\System\FLzgMGB.exe
  2⤵
  PID:5316
- C:\Windows\System\xFhOsAN.exe
  C:\Windows\System\xFhOsAN.exe
  2⤵
  PID:5376
- C:\Windows\System\VNfKktF.exe
  C:\Windows\System\VNfKktF.exe
  2⤵
  PID:5452
- C:\Windows\System\jaSkSfo.exe
  C:\Windows\System\jaSkSfo.exe
  2⤵
  PID:5512
- C:\Windows\System\losiTTl.exe
  C:\Windows\System\losiTTl.exe
  2⤵
  PID:5572
- C:\Windows\System\hmvQLnf.exe
  C:\Windows\System\hmvQLnf.exe
  2⤵
  PID:5652
- C:\Windows\System\pgsXPMh.exe
  C:\Windows\System\pgsXPMh.exe
  2⤵
  PID:5700
- C:\Windows\System\EXmXAlO.exe
  C:\Windows\System\EXmXAlO.exe
  2⤵
  PID:5776
- C:\Windows\System\JstFFPX.exe
  C:\Windows\System\JstFFPX.exe
  2⤵
  PID:5844
- C:\Windows\System\obQeJGy.exe
  C:\Windows\System\obQeJGy.exe
  2⤵
  PID:5884
- C:\Windows\System\kVzHAiK.exe
  C:\Windows\System\kVzHAiK.exe
  2⤵
  PID:5956
- C:\Windows\System\OLjehur.exe
  C:\Windows\System\OLjehur.exe
  2⤵
  PID:6020
- C:\Windows\System\ppwRSsd.exe
  C:\Windows\System\ppwRSsd.exe
  2⤵
  PID:6096
- C:\Windows\System\gMywVsM.exe
  C:\Windows\System\gMywVsM.exe
  2⤵
  PID:3140
- C:\Windows\System\irGohhu.exe
  C:\Windows\System\irGohhu.exe
  2⤵
  PID:3248
- C:\Windows\System\iyEpqrY.exe
  C:\Windows\System\iyEpqrY.exe
  2⤵
  PID:4444
- C:\Windows\System\evyAdQi.exe
  C:\Windows\System\evyAdQi.exe
  2⤵
  PID:2428
- C:\Windows\System\kcDjuWP.exe
  C:\Windows\System\kcDjuWP.exe
  2⤵
  PID:220
- C:\Windows\System\JoMlbyq.exe
  C:\Windows\System\JoMlbyq.exe
  2⤵
  PID:5348
- C:\Windows\System\DxYfkJJ.exe
  C:\Windows\System\DxYfkJJ.exe
  2⤵
  PID:5484
- C:\Windows\System\aPOOcEb.exe
  C:\Windows\System\aPOOcEb.exe
  2⤵
  PID:5620
- C:\Windows\System\LhggIqS.exe
  C:\Windows\System\LhggIqS.exe
  2⤵
  PID:4788
- C:\Windows\System\ncHiZXl.exe
  C:\Windows\System\ncHiZXl.exe
  2⤵
  PID:6148
- C:\Windows\System\yfdBlrK.exe
  C:\Windows\System\yfdBlrK.exe
  2⤵
  PID:6176
- C:\Windows\System\PBpvaeZ.exe
  C:\Windows\System\PBpvaeZ.exe
  2⤵
  PID:6204
- C:\Windows\System\zaLwfaM.exe
  C:\Windows\System\zaLwfaM.exe
  2⤵
  PID:6232
- C:\Windows\System\hmoTCdF.exe
  C:\Windows\System\hmoTCdF.exe
  2⤵
  PID:6260
- C:\Windows\System\zcfAMjc.exe
  C:\Windows\System\zcfAMjc.exe
  2⤵
  PID:6288
- C:\Windows\System\GqUSNLj.exe
  C:\Windows\System\GqUSNLj.exe
  2⤵
  PID:6320
- C:\Windows\System\gLqbZnC.exe
  C:\Windows\System\gLqbZnC.exe
  2⤵
  PID:6344
- C:\Windows\System\bSrHkIi.exe
  C:\Windows\System\bSrHkIi.exe
  2⤵
  PID:6368
- C:\Windows\System\WBnLinF.exe
  C:\Windows\System\WBnLinF.exe
  2⤵
  PID:6396
- C:\Windows\System\avqEwVS.exe
  C:\Windows\System\avqEwVS.exe
  2⤵
  PID:6428
- C:\Windows\System\xMODQCs.exe
  C:\Windows\System\xMODQCs.exe
  2⤵
  PID:6456
- C:\Windows\System\RrITUGO.exe
  C:\Windows\System\RrITUGO.exe
  2⤵
  PID:6484
- C:\Windows\System\xUWheES.exe
  C:\Windows\System\xUWheES.exe
  2⤵
  PID:6512
- C:\Windows\System\vWxPGmP.exe
  C:\Windows\System\vWxPGmP.exe
  2⤵
  PID:6536
- C:\Windows\System\TjtGpmu.exe
  C:\Windows\System\TjtGpmu.exe
  2⤵
  PID:6564
- C:\Windows\System\tVRhOCM.exe
  C:\Windows\System\tVRhOCM.exe
  2⤵
  PID:6592
- C:\Windows\System\OHAIFZw.exe
  C:\Windows\System\OHAIFZw.exe
  2⤵
  PID:6620
- C:\Windows\System\WyPeLNK.exe
  C:\Windows\System\WyPeLNK.exe
  2⤵
  PID:6648
- C:\Windows\System\GUwJeuP.exe
  C:\Windows\System\GUwJeuP.exe
  2⤵
  PID:6676
- C:\Windows\System\PNfYOjg.exe
  C:\Windows\System\PNfYOjg.exe
  2⤵
  PID:6704
- C:\Windows\System\mTekkiH.exe
  C:\Windows\System\mTekkiH.exe
  2⤵
  PID:6732
- C:\Windows\System\mXzkwOp.exe
  C:\Windows\System\mXzkwOp.exe
  2⤵
  PID:6760
- C:\Windows\System\IzkWWmV.exe
  C:\Windows\System\IzkWWmV.exe
  2⤵
  PID:6788
- C:\Windows\System\QJddGgA.exe
  C:\Windows\System\QJddGgA.exe
  2⤵
  PID:6820
- C:\Windows\System\UlBjqtd.exe
  C:\Windows\System\UlBjqtd.exe
  2⤵
  PID:6848
- C:\Windows\System\vLRGQQp.exe
  C:\Windows\System\vLRGQQp.exe
  2⤵
  PID:6876
- C:\Windows\System\DHlwwqD.exe
  C:\Windows\System\DHlwwqD.exe
  2⤵
  PID:6900
- C:\Windows\System\nIHBkOh.exe
  C:\Windows\System\nIHBkOh.exe
  2⤵
  PID:6928
- C:\Windows\System\rRVmDAx.exe
  C:\Windows\System\rRVmDAx.exe
  2⤵
  PID:6956
- C:\Windows\System\XJJshQP.exe
  C:\Windows\System\XJJshQP.exe
  2⤵
  PID:6984
- C:\Windows\System\FGOznnG.exe
  C:\Windows\System\FGOznnG.exe
  2⤵
  PID:7012
- C:\Windows\System\mdzSUSP.exe
  C:\Windows\System\mdzSUSP.exe
  2⤵
  PID:7044
- C:\Windows\System\TtIXKth.exe
  C:\Windows\System\TtIXKth.exe
  2⤵
  PID:7136
- C:\Windows\System\txhsigi.exe
  C:\Windows\System\txhsigi.exe
  2⤵
  PID:7156
- C:\Windows\System\sfgblXf.exe
  C:\Windows\System\sfgblXf.exe
  2⤵
  PID:5988
- C:\Windows\System\CFxQBkd.exe
  C:\Windows\System\CFxQBkd.exe
  2⤵
  PID:6072
- C:\Windows\System\ZyAWiCx.exe
  C:\Windows\System\ZyAWiCx.exe
  2⤵
  PID:3188
- C:\Windows\System\ilYCHXA.exe
  C:\Windows\System\ilYCHXA.exe
  2⤵
  PID:2748
- C:\Windows\System\KPskDvD.exe
  C:\Windows\System\KPskDvD.exe
  2⤵
  PID:5284
- C:\Windows\System\NceWwYR.exe
  C:\Windows\System\NceWwYR.exe
  2⤵
  PID:5824
- C:\Windows\System\oJatEzZ.exe
  C:\Windows\System\oJatEzZ.exe
  2⤵
  PID:6192
- C:\Windows\System\cLftmKG.exe
  C:\Windows\System\cLftmKG.exe
  2⤵
  PID:6220
- C:\Windows\System\vxDnPBb.exe
  C:\Windows\System\vxDnPBb.exe
  2⤵
  PID:6252
- C:\Windows\System\iMBQGsC.exe
  C:\Windows\System\iMBQGsC.exe
  2⤵
  PID:6328
- C:\Windows\System\ZLUWkZj.exe
  C:\Windows\System\ZLUWkZj.exe
  2⤵
  PID:6412
- C:\Windows\System\pVjLexv.exe
  C:\Windows\System\pVjLexv.exe
  2⤵
  PID:6448
- C:\Windows\System\CNcVQNL.exe
  C:\Windows\System\CNcVQNL.exe
  2⤵
  PID:6524
- C:\Windows\System\ZZMDUhp.exe
  C:\Windows\System\ZZMDUhp.exe
  2⤵
  PID:3836
- C:\Windows\System\YFTXpVw.exe
  C:\Windows\System\YFTXpVw.exe
  2⤵
  PID:4360
- C:\Windows\System\BuZcnft.exe
  C:\Windows\System\BuZcnft.exe
  2⤵
  PID:6640
- C:\Windows\System\PSjdzgc.exe
  C:\Windows\System\PSjdzgc.exe
  2⤵
  PID:6692
- C:\Windows\System\yLYMFKN.exe
  C:\Windows\System\yLYMFKN.exe
  2⤵
  PID:6748
- C:\Windows\System\THDtAXJ.exe
  C:\Windows\System\THDtAXJ.exe
  2⤵
  PID:6784
- C:\Windows\System\xQBfPxJ.exe
  C:\Windows\System\xQBfPxJ.exe
  2⤵
  PID:2224
- C:\Windows\System\qQuKlpj.exe
  C:\Windows\System\qQuKlpj.exe
  2⤵
  PID:2260
- C:\Windows\System\BRRNgkc.exe
  C:\Windows\System\BRRNgkc.exe
  2⤵
  PID:6920
- C:\Windows\System\dtRtROy.exe
  C:\Windows\System\dtRtROy.exe
  2⤵
  PID:4320
- C:\Windows\System\sgJuxdw.exe
  C:\Windows\System\sgJuxdw.exe
  2⤵
  PID:560
- C:\Windows\System\FPNklJp.exe
  C:\Windows\System\FPNklJp.exe
  2⤵
  PID:408
- C:\Windows\System\KdHqKKF.exe
  C:\Windows\System\KdHqKKF.exe
  2⤵
  PID:1496
- C:\Windows\System\JeDsuJO.exe
  C:\Windows\System\JeDsuJO.exe
  2⤵
  PID:1920
- C:\Windows\System\cTMjhXI.exe
  C:\Windows\System\cTMjhXI.exe
  2⤵
  PID:4440
- C:\Windows\System\TpYKzYi.exe
  C:\Windows\System\TpYKzYi.exe
  2⤵
  PID:1876
- C:\Windows\System\yDnhSNR.exe
  C:\Windows\System\yDnhSNR.exe
  2⤵
  PID:2016
- C:\Windows\System\QpGBRpH.exe
  C:\Windows\System\QpGBRpH.exe
  2⤵
  PID:7004
- C:\Windows\System\jVehbzk.exe
  C:\Windows\System\jVehbzk.exe
  2⤵
  PID:7108
- C:\Windows\System\Fafsxgx.exe
  C:\Windows\System\Fafsxgx.exe
  2⤵
  PID:2360
- C:\Windows\System\nhtAEZO.exe
  C:\Windows\System\nhtAEZO.exe
  2⤵
  PID:7100
- C:\Windows\System\cxcSrVe.exe
  C:\Windows\System\cxcSrVe.exe
  2⤵
  PID:7148
- C:\Windows\System\NlVUxmj.exe
  C:\Windows\System\NlVUxmj.exe
  2⤵
  PID:7128
- C:\Windows\System\ZCLYlFe.exe
  C:\Windows\System\ZCLYlFe.exe
  2⤵
  PID:6132
- C:\Windows\System\cBISWTo.exe
  C:\Windows\System\cBISWTo.exe
  2⤵
  PID:5600
- C:\Windows\System\nTfezXe.exe
  C:\Windows\System\nTfezXe.exe
  2⤵
  PID:400
- C:\Windows\System\cjemFrB.exe
  C:\Windows\System\cjemFrB.exe
  2⤵
  PID:6420
- C:\Windows\System\rqqCMyV.exe
  C:\Windows\System\rqqCMyV.exe
  2⤵
  PID:3596
- C:\Windows\System\NEQVqMl.exe
  C:\Windows\System\NEQVqMl.exe
  2⤵
  PID:6720
- C:\Windows\System\qSprPlX.exe
  C:\Windows\System\qSprPlX.exe
  2⤵
  PID:6728
- C:\Windows\System\kTEVPYu.exe
  C:\Windows\System\kTEVPYu.exe
  2⤵
  PID:6812
- C:\Windows\System\LPSglGv.exe
  C:\Windows\System\LPSglGv.exe
  2⤵
  PID:6892
- C:\Windows\System\ZVoZUXr.exe
  C:\Windows\System\ZVoZUXr.exe
  2⤵
  PID:1784
- C:\Windows\System\FDnbKQE.exe
  C:\Windows\System\FDnbKQE.exe
  2⤵
  PID:7000
- C:\Windows\System\nHXcdRn.exe
  C:\Windows\System\nHXcdRn.exe
  2⤵
  PID:7036
- C:\Windows\System\WwOMOpy.exe
  C:\Windows\System\WwOMOpy.exe
  2⤵
  PID:1436
- C:\Windows\System\yLetKMs.exe
  C:\Windows\System\yLetKMs.exe
  2⤵
  PID:5928
- C:\Windows\System\YxxLBbE.exe
  C:\Windows\System\YxxLBbE.exe
  2⤵
  PID:5296
- C:\Windows\System\WkWkBCX.exe
  C:\Windows\System\WkWkBCX.exe
  2⤵
  PID:6416
- C:\Windows\System\bWksnbV.exe
  C:\Windows\System\bWksnbV.exe
  2⤵
  PID:6588
- C:\Windows\System\uXVYpxZ.exe
  C:\Windows\System\uXVYpxZ.exe
  2⤵
  PID:5000
- C:\Windows\System\YIOjTNH.exe
  C:\Windows\System\YIOjTNH.exe
  2⤵
  PID:4452
- C:\Windows\System\TtRlLmT.exe
  C:\Windows\System\TtRlLmT.exe
  2⤵
  PID:3724
- C:\Windows\System\PtFoDFA.exe
  C:\Windows\System\PtFoDFA.exe
  2⤵
  PID:1560
- C:\Windows\System\sbZxkBb.exe
  C:\Windows\System\sbZxkBb.exe
  2⤵
  PID:1556
- C:\Windows\System\DGqktvU.exe
  C:\Windows\System\DGqktvU.exe
  2⤵
  PID:2392
- C:\Windows\System\uxrlogV.exe
  C:\Windows\System\uxrlogV.exe
  2⤵
  PID:6724
- C:\Windows\System\bDvrKfH.exe
  C:\Windows\System\bDvrKfH.exe
  2⤵
  PID:4040
- C:\Windows\System\pTTlewL.exe
  C:\Windows\System\pTTlewL.exe
  2⤵
  PID:7196
- C:\Windows\System\UsTKDDt.exe
  C:\Windows\System\UsTKDDt.exe
  2⤵
  PID:7220
- C:\Windows\System\NBpywJp.exe
  C:\Windows\System\NBpywJp.exe
  2⤵
  PID:7240
- C:\Windows\System\bUMbmZk.exe
  C:\Windows\System\bUMbmZk.exe
  2⤵
  PID:7268
- C:\Windows\System\iZlGBEW.exe
  C:\Windows\System\iZlGBEW.exe
  2⤵
  PID:7320
- C:\Windows\System\SGHYiEj.exe
  C:\Windows\System\SGHYiEj.exe
  2⤵
  PID:7336
- C:\Windows\System\UmDTAFD.exe
  C:\Windows\System\UmDTAFD.exe
  2⤵
  PID:7356
- C:\Windows\System\EsoITJv.exe
  C:\Windows\System\EsoITJv.exe
  2⤵
  PID:7384
- C:\Windows\System\tHFKVht.exe
  C:\Windows\System\tHFKVht.exe
  2⤵
  PID:7420
- C:\Windows\System\WPGVjgf.exe
  C:\Windows\System\WPGVjgf.exe
  2⤵
  PID:7448
- C:\Windows\System\EEkYuTH.exe
  C:\Windows\System\EEkYuTH.exe
  2⤵
  PID:7488
- C:\Windows\System\ExtBbhy.exe
  C:\Windows\System\ExtBbhy.exe
  2⤵
  PID:7504
- C:\Windows\System\JHaJcCM.exe
  C:\Windows\System\JHaJcCM.exe
  2⤵
  PID:7532
- C:\Windows\System\HisuMDm.exe
  C:\Windows\System\HisuMDm.exe
  2⤵
  PID:7560
- C:\Windows\System\DevyBAL.exe
  C:\Windows\System\DevyBAL.exe
  2⤵
  PID:7584
- C:\Windows\System\QxrYzjq.exe
  C:\Windows\System\QxrYzjq.exe
  2⤵
  PID:7612
- C:\Windows\System\SIevYSk.exe
  C:\Windows\System\SIevYSk.exe
  2⤵
  PID:7640
- C:\Windows\System\KyUwzTW.exe
  C:\Windows\System\KyUwzTW.exe
  2⤵
  PID:7676
- C:\Windows\System\HOsuzTi.exe
  C:\Windows\System\HOsuzTi.exe
  2⤵
  PID:7716
- C:\Windows\System\oyGsRJZ.exe
  C:\Windows\System\oyGsRJZ.exe
  2⤵
  PID:7740
- C:\Windows\System\zNnFAUl.exe
  C:\Windows\System\zNnFAUl.exe
  2⤵
  PID:7764
- C:\Windows\System\pUEYyhZ.exe
  C:\Windows\System\pUEYyhZ.exe
  2⤵
  PID:7792
- C:\Windows\System\ArehFgy.exe
  C:\Windows\System\ArehFgy.exe
  2⤵
  PID:7816
- C:\Windows\System\NGYrLim.exe
  C:\Windows\System\NGYrLim.exe
  2⤵
  PID:7860
- C:\Windows\System\GIFeWfC.exe
  C:\Windows\System\GIFeWfC.exe
  2⤵
  PID:7888
- C:\Windows\System\TASFwLp.exe
  C:\Windows\System\TASFwLp.exe
  2⤵
  PID:7904
- C:\Windows\System\BjiLYBE.exe
  C:\Windows\System\BjiLYBE.exe
  2⤵
  PID:7924
- C:\Windows\System\ZrTeYDh.exe
  C:\Windows\System\ZrTeYDh.exe
  2⤵
  PID:7952
- C:\Windows\System\KGnsZYJ.exe
  C:\Windows\System\KGnsZYJ.exe
  2⤵
  PID:7980
- C:\Windows\System\MJtIbJu.exe
  C:\Windows\System\MJtIbJu.exe
  2⤵
  PID:8008
- C:\Windows\System\szjAmgL.exe
  C:\Windows\System\szjAmgL.exe
  2⤵
  PID:8028
- C:\Windows\System\bMKXJWB.exe
  C:\Windows\System\bMKXJWB.exe
  2⤵
  PID:8080
- C:\Windows\System\qRlzVPp.exe
  C:\Windows\System\qRlzVPp.exe
  2⤵
  PID:8104
- C:\Windows\System\NaeHuqP.exe
  C:\Windows\System\NaeHuqP.exe
  2⤵
  PID:8144
- C:\Windows\System\ngpmfZH.exe
  C:\Windows\System\ngpmfZH.exe
  2⤵
  PID:8168
- C:\Windows\System\GXzJPUK.exe
  C:\Windows\System\GXzJPUK.exe
  2⤵
  PID:8188
- C:\Windows\System\rwGnKKD.exe
  C:\Windows\System\rwGnKKD.exe
  2⤵
  PID:3208
- C:\Windows\System\hBuzREs.exe
  C:\Windows\System\hBuzREs.exe
  2⤵
  PID:7264
- C:\Windows\System\DRKTuwA.exe
  C:\Windows\System\DRKTuwA.exe
  2⤵
  PID:7376
- C:\Windows\System\bXagjbG.exe
  C:\Windows\System\bXagjbG.exe
  2⤵
  PID:7460
- C:\Windows\System\jWwcuqO.exe
  C:\Windows\System\jWwcuqO.exe
  2⤵
  PID:7516
- C:\Windows\System\GxbyhKF.exe
  C:\Windows\System\GxbyhKF.exe
  2⤵
  PID:7600
- C:\Windows\System\uSVboiT.exe
  C:\Windows\System\uSVboiT.exe
  2⤵
  PID:7540
- C:\Windows\System\QoqTsdD.exe
  C:\Windows\System\QoqTsdD.exe
  2⤵
  PID:7684
- C:\Windows\System\HhXDNZK.exe
  C:\Windows\System\HhXDNZK.exe
  2⤵
  PID:7736
- C:\Windows\System\baNpzFb.exe
  C:\Windows\System\baNpzFb.exe
  2⤵
  PID:7788
- C:\Windows\System\QwfwoRC.exe
  C:\Windows\System\QwfwoRC.exe
  2⤵
  PID:7868
- C:\Windows\System\ntOFrLE.exe
  C:\Windows\System\ntOFrLE.exe
  2⤵
  PID:7964
- C:\Windows\System\SPdQtga.exe
  C:\Windows\System\SPdQtga.exe
  2⤵
  PID:7944
- C:\Windows\System\KrWzMBS.exe
  C:\Windows\System\KrWzMBS.exe
  2⤵
  PID:8068
- C:\Windows\System\djwWXSJ.exe
  C:\Windows\System\djwWXSJ.exe
  2⤵
  PID:8132
- C:\Windows\System\UMphvjH.exe
  C:\Windows\System\UMphvjH.exe
  2⤵
  PID:8180
- C:\Windows\System\oVSLafZ.exe
  C:\Windows\System\oVSLafZ.exe
  2⤵
  PID:7276
- C:\Windows\System\TGpdQtl.exe
  C:\Windows\System\TGpdQtl.exe
  2⤵
  PID:7316
- C:\Windows\System\gJcaLEf.exe
  C:\Windows\System\gJcaLEf.exe
  2⤵
  PID:7520
- C:\Windows\System\eYRlSET.exe
  C:\Windows\System\eYRlSET.exe
  2⤵
  PID:7804
- C:\Windows\System\UUaSmaM.exe
  C:\Windows\System\UUaSmaM.exe
  2⤵
  PID:7912
- C:\Windows\System\rXjwRvD.exe
  C:\Windows\System\rXjwRvD.exe
  2⤵
  PID:8016
- C:\Windows\System\XNLAthe.exe
  C:\Windows\System\XNLAthe.exe
  2⤵
  PID:7176
- C:\Windows\System\qbVdWqv.exe
  C:\Windows\System\qbVdWqv.exe
  2⤵
  PID:7440
- C:\Windows\System\zuilfzq.exe
  C:\Windows\System\zuilfzq.exe
  2⤵
  PID:7760
- C:\Windows\System\cWUuBBi.exe
  C:\Windows\System\cWUuBBi.exe
  2⤵
  PID:7476
- C:\Windows\System\sRqYnWN.exe
  C:\Windows\System\sRqYnWN.exe
  2⤵
  PID:8100
- C:\Windows\System\iXWGbDE.exe
  C:\Windows\System\iXWGbDE.exe
  2⤵
  PID:8228
- C:\Windows\System\BEjbzqP.exe
  C:\Windows\System\BEjbzqP.exe
  2⤵
  PID:8248
- C:\Windows\System\UwlyEXL.exe
  C:\Windows\System\UwlyEXL.exe
  2⤵
  PID:8280
- C:\Windows\System\uTKaRTL.exe
  C:\Windows\System\uTKaRTL.exe
  2⤵
  PID:8304
- C:\Windows\System\KUHdGOT.exe
  C:\Windows\System\KUHdGOT.exe
  2⤵
  PID:8340
- C:\Windows\System\HcixOfx.exe
  C:\Windows\System\HcixOfx.exe
  2⤵
  PID:8360
- C:\Windows\System\DFgUhHN.exe
  C:\Windows\System\DFgUhHN.exe
  2⤵
  PID:8388
- C:\Windows\System\lgZxhif.exe
  C:\Windows\System\lgZxhif.exe
  2⤵
  PID:8416
- C:\Windows\System\vRpUDrz.exe
  C:\Windows\System\vRpUDrz.exe
  2⤵
  PID:8440
- C:\Windows\System\OaxaBGV.exe
  C:\Windows\System\OaxaBGV.exe
  2⤵
  PID:8464
- C:\Windows\System\yNRtnIO.exe
  C:\Windows\System\yNRtnIO.exe
  2⤵
  PID:8488
- C:\Windows\System\EowfgAr.exe
  C:\Windows\System\EowfgAr.exe
  2⤵
  PID:8528
- C:\Windows\System\cJiUoOP.exe
  C:\Windows\System\cJiUoOP.exe
  2⤵
  PID:8568
- C:\Windows\System\HSnyrdf.exe
  C:\Windows\System\HSnyrdf.exe
  2⤵
  PID:8588
- C:\Windows\System\LbhmHqs.exe
  C:\Windows\System\LbhmHqs.exe
  2⤵
  PID:8612
- C:\Windows\System\skCdQKo.exe
  C:\Windows\System\skCdQKo.exe
  2⤵
  PID:8636
- C:\Windows\System\XNLHxNl.exe
  C:\Windows\System\XNLHxNl.exe
  2⤵
  PID:8668
- C:\Windows\System\rBpRbnb.exe
  C:\Windows\System\rBpRbnb.exe
  2⤵
  PID:8684
- C:\Windows\System\SAsjVTz.exe
  C:\Windows\System\SAsjVTz.exe
  2⤵
  PID:8728
- C:\Windows\System\FIzzpED.exe
  C:\Windows\System\FIzzpED.exe
  2⤵
  PID:8756
- C:\Windows\System\cWcRgvb.exe
  C:\Windows\System\cWcRgvb.exe
  2⤵
  PID:8780
- C:\Windows\System\isfIyEj.exe
  C:\Windows\System\isfIyEj.exe
  2⤵
  PID:8808
- C:\Windows\System\QHoCKfK.exe
  C:\Windows\System\QHoCKfK.exe
  2⤵
  PID:8836
- C:\Windows\System\aLqxnlY.exe
  C:\Windows\System\aLqxnlY.exe
  2⤵
  PID:8860
- C:\Windows\System\VjgUkyx.exe
  C:\Windows\System\VjgUkyx.exe
  2⤵
  PID:8892
- C:\Windows\System\buDVaWc.exe
  C:\Windows\System\buDVaWc.exe
  2⤵
  PID:8916
- C:\Windows\System\jnjrQSp.exe
  C:\Windows\System\jnjrQSp.exe
  2⤵
  PID:8944
- C:\Windows\System\stdItWJ.exe
  C:\Windows\System\stdItWJ.exe
  2⤵
  PID:8992
- C:\Windows\System\IPghUfa.exe
  C:\Windows\System\IPghUfa.exe
  2⤵
  PID:9020
- C:\Windows\System\IzGANIf.exe
  C:\Windows\System\IzGANIf.exe
  2⤵
  PID:9036
- C:\Windows\System\YiDDzWi.exe
  C:\Windows\System\YiDDzWi.exe
  2⤵
  PID:9064
- C:\Windows\System\uvsnwzQ.exe
  C:\Windows\System\uvsnwzQ.exe
  2⤵
  PID:9092
- C:\Windows\System\wASDBoU.exe
  C:\Windows\System\wASDBoU.exe
  2⤵
  PID:9120
- C:\Windows\System\WoRNflJ.exe
  C:\Windows\System\WoRNflJ.exe
  2⤵
  PID:9148
- C:\Windows\System\sQbpIhn.exe
  C:\Windows\System\sQbpIhn.exe
  2⤵
  PID:9176
- C:\Windows\System\BpVWFeZ.exe
  C:\Windows\System\BpVWFeZ.exe
  2⤵
  PID:9200
- C:\Windows\System\CESDjaW.exe
  C:\Windows\System\CESDjaW.exe
  2⤵
  PID:8240
- C:\Windows\System\qYGHJyj.exe
  C:\Windows\System\qYGHJyj.exe
  2⤵
  PID:8276
- C:\Windows\System\TLdIZKR.exe
  C:\Windows\System\TLdIZKR.exe
  2⤵
  PID:8380
- C:\Windows\System\fguDggb.exe
  C:\Windows\System\fguDggb.exe
  2⤵
  PID:8432
- C:\Windows\System\WeyLrlq.exe
  C:\Windows\System\WeyLrlq.exe
  2⤵
  PID:8424
- C:\Windows\System\CdxFRlT.exe
  C:\Windows\System\CdxFRlT.exe
  2⤵
  PID:8512
- C:\Windows\System\YTyfbOF.exe
  C:\Windows\System\YTyfbOF.exe
  2⤵
  PID:8552
- C:\Windows\System\YvNzOYy.exe
  C:\Windows\System\YvNzOYy.exe
  2⤵
  PID:8596
- C:\Windows\System\LWhwpBf.exe
  C:\Windows\System\LWhwpBf.exe
  2⤵
  PID:8724
- C:\Windows\System\UHOjsjc.exe
  C:\Windows\System\UHOjsjc.exe
  2⤵
  PID:8796
- C:\Windows\System\ExXSlRz.exe
  C:\Windows\System\ExXSlRz.exe
  2⤵
  PID:8848
- C:\Windows\System\eNGsWMU.exe
  C:\Windows\System\eNGsWMU.exe
  2⤵
  PID:8912
- C:\Windows\System\gRPdYHV.exe
  C:\Windows\System\gRPdYHV.exe
  2⤵
  PID:8972
- C:\Windows\System\kTfiRRJ.exe
  C:\Windows\System\kTfiRRJ.exe
  2⤵
  PID:9008
- C:\Windows\System\OKUcfJx.exe
  C:\Windows\System\OKUcfJx.exe
  2⤵
  PID:9084
- C:\Windows\System\LAKDzqC.exe
  C:\Windows\System\LAKDzqC.exe
  2⤵
  PID:9136
- C:\Windows\System\KUvmoCu.exe
  C:\Windows\System\KUvmoCu.exe
  2⤵
  PID:8212
- C:\Windows\System\xIxujJM.exe
  C:\Windows\System\xIxujJM.exe
  2⤵
  PID:8356
- C:\Windows\System\WMDqyCV.exe
  C:\Windows\System\WMDqyCV.exe
  2⤵
  PID:8456
- C:\Windows\System\RnWMKkJ.exe
  C:\Windows\System\RnWMKkJ.exe
  2⤵
  PID:8648
- C:\Windows\System\GcTIUha.exe
  C:\Windows\System\GcTIUha.exe
  2⤵
  PID:8744
- C:\Windows\System\IaMzmzw.exe
  C:\Windows\System\IaMzmzw.exe
  2⤵
  PID:8940
- C:\Windows\System\xuzKTjQ.exe
  C:\Windows\System\xuzKTjQ.exe
  2⤵
  PID:9140
- C:\Windows\System\Qjbaxss.exe
  C:\Windows\System\Qjbaxss.exe
  2⤵
  PID:8300
- C:\Windows\System\kpYKGZj.exe
  C:\Windows\System\kpYKGZj.exe
  2⤵
  PID:9188
- C:\Windows\System\VlDPQiX.exe
  C:\Windows\System\VlDPQiX.exe
  2⤵
  PID:9132
- C:\Windows\System\qkjvswk.exe
  C:\Windows\System\qkjvswk.exe
  2⤵
  PID:9224
- C:\Windows\System\otvPHqn.exe
  C:\Windows\System\otvPHqn.exe
  2⤵
  PID:9284
- C:\Windows\System\xQPUTHd.exe
  C:\Windows\System\xQPUTHd.exe
  2⤵
  PID:9316
- C:\Windows\System\SmOILcT.exe
  C:\Windows\System\SmOILcT.exe
  2⤵
  PID:9348
- C:\Windows\System\uIvESdn.exe
  C:\Windows\System\uIvESdn.exe
  2⤵
  PID:9364
- C:\Windows\System\PGhClwJ.exe
  C:\Windows\System\PGhClwJ.exe
  2⤵
  PID:9392
- C:\Windows\System\adWPsdH.exe
  C:\Windows\System\adWPsdH.exe
  2⤵
  PID:9408
- C:\Windows\System\QPuBfsl.exe
  C:\Windows\System\QPuBfsl.exe
  2⤵
  PID:9440
- C:\Windows\System\xayQHiC.exe
  C:\Windows\System\xayQHiC.exe
  2⤵
  PID:9468
- C:\Windows\System\ZRfLzNV.exe
  C:\Windows\System\ZRfLzNV.exe
  2⤵
  PID:9492
- C:\Windows\System\yvECIla.exe
  C:\Windows\System\yvECIla.exe
  2⤵
  PID:9520
- C:\Windows\System\HeXQPPA.exe
  C:\Windows\System\HeXQPPA.exe
  2⤵
  PID:9560
- C:\Windows\System\aXVjYdf.exe
  C:\Windows\System\aXVjYdf.exe
  2⤵
  PID:9588
- C:\Windows\System\pKFtmkr.exe
  C:\Windows\System\pKFtmkr.exe
  2⤵
  PID:9608
- C:\Windows\System\vBzcxia.exe
  C:\Windows\System\vBzcxia.exe
  2⤵
  PID:9636
- C:\Windows\System\jmMoHHk.exe
  C:\Windows\System\jmMoHHk.exe
  2⤵
  PID:9672
- C:\Windows\System\bPccNEB.exe
  C:\Windows\System\bPccNEB.exe
  2⤵
  PID:9712
- C:\Windows\System\UNwSVGL.exe
  C:\Windows\System\UNwSVGL.exe
  2⤵
  PID:9740
- C:\Windows\System\Xmtphfo.exe
  C:\Windows\System\Xmtphfo.exe
  2⤵
  PID:9768
- C:\Windows\System\pYiLkhx.exe
  C:\Windows\System\pYiLkhx.exe
  2⤵
  PID:9784
- C:\Windows\System\NGYCQut.exe
  C:\Windows\System\NGYCQut.exe
  2⤵
  PID:9820
- C:\Windows\System\AplsboA.exe
  C:\Windows\System\AplsboA.exe
  2⤵
  PID:9844
- C:\Windows\System\eFivgEe.exe
  C:\Windows\System\eFivgEe.exe
  2⤵
  PID:9864
- C:\Windows\System\ceFHeKn.exe
  C:\Windows\System\ceFHeKn.exe
  2⤵
  PID:9884
- C:\Windows\System\nNoiyUK.exe
  C:\Windows\System\nNoiyUK.exe
  2⤵
  PID:9900
- C:\Windows\System\KaFTGRl.exe
  C:\Windows\System\KaFTGRl.exe
  2⤵
  PID:9924
- C:\Windows\System\tCyHzkD.exe
  C:\Windows\System\tCyHzkD.exe
  2⤵
  PID:9960
- C:\Windows\System\otqDhph.exe
  C:\Windows\System\otqDhph.exe
  2⤵
  PID:9988
- C:\Windows\System\qijGpbo.exe
  C:\Windows\System\qijGpbo.exe
  2⤵
  PID:10012
- C:\Windows\System\XUpzNvF.exe
  C:\Windows\System\XUpzNvF.exe
  2⤵
  PID:10040
- C:\Windows\System\hPJVJit.exe
  C:\Windows\System\hPJVJit.exe
  2⤵
  PID:10076
- C:\Windows\System\xQcouHX.exe
  C:\Windows\System\xQcouHX.exe
  2⤵
  PID:10104
- C:\Windows\System\ElgWZLe.exe
  C:\Windows\System\ElgWZLe.exe
  2⤵
  PID:10132
- C:\Windows\System\kHuHKQq.exe
  C:\Windows\System\kHuHKQq.exe
  2⤵
  PID:10172
- C:\Windows\System\FbzTgzD.exe
  C:\Windows\System\FbzTgzD.exe
  2⤵
  PID:10204
- C:\Windows\System\TemZgQw.exe
  C:\Windows\System\TemZgQw.exe
  2⤵
  PID:10228
- C:\Windows\System\OWvRmeK.exe
  C:\Windows\System\OWvRmeK.exe
  2⤵
  PID:9244
- C:\Windows\System\aczNCoy.exe
  C:\Windows\System\aczNCoy.exe
  2⤵
  PID:9028
- C:\Windows\System\URgmCyP.exe
  C:\Windows\System\URgmCyP.exe
  2⤵
  PID:9300
- C:\Windows\System\ITWUxgY.exe
  C:\Windows\System\ITWUxgY.exe
  2⤵
  PID:9356
- C:\Windows\System\WfDnkxG.exe
  C:\Windows\System\WfDnkxG.exe
  2⤵
  PID:9432
- C:\Windows\System\ioJBCmM.exe
  C:\Windows\System\ioJBCmM.exe
  2⤵
  PID:9480
- C:\Windows\System\xnoFyLh.exe
  C:\Windows\System\xnoFyLh.exe
  2⤵
  PID:9576
- C:\Windows\System\eHoFPUk.exe
  C:\Windows\System\eHoFPUk.exe
  2⤵
  PID:9604
- C:\Windows\System\UxdBOBj.exe
  C:\Windows\System\UxdBOBj.exe
  2⤵
  PID:9692
- C:\Windows\System\XGjDnvr.exe
  C:\Windows\System\XGjDnvr.exe
  2⤵
  PID:9764
- C:\Windows\System\EMsDHoA.exe
  C:\Windows\System\EMsDHoA.exe
  2⤵
  PID:9828
- C:\Windows\System\EgtQIgI.exe
  C:\Windows\System\EgtQIgI.exe
  2⤵
  PID:9852
- C:\Windows\System\Lhbvuyf.exe
  C:\Windows\System\Lhbvuyf.exe
  2⤵
  PID:9984
- C:\Windows\System\vzcOYRU.exe
  C:\Windows\System\vzcOYRU.exe
  2⤵
  PID:10084
- C:\Windows\System\yraZMHu.exe
  C:\Windows\System\yraZMHu.exe
  2⤵
  PID:10116
- C:\Windows\System\iZaUnCP.exe
  C:\Windows\System\iZaUnCP.exe
  2⤵
  PID:10160
- C:\Windows\System\EyKOKOe.exe
  C:\Windows\System\EyKOKOe.exe
  2⤵
  PID:10216
- C:\Windows\System\SrSXpTO.exe
  C:\Windows\System\SrSXpTO.exe
  2⤵
  PID:9272
- C:\Windows\System\yLVBeEn.exe
  C:\Windows\System\yLVBeEn.exe
  2⤵
  PID:9456
- C:\Windows\System\saMDxoB.exe
  C:\Windows\System\saMDxoB.exe
  2⤵
  PID:9512
- C:\Windows\System\VJviqcp.exe
  C:\Windows\System\VJviqcp.exe
  2⤵
  PID:9540
- C:\Windows\System\VhocJTU.exe
  C:\Windows\System\VhocJTU.exe
  2⤵
  PID:9876
- C:\Windows\System\TZPbNqE.exe
  C:\Windows\System\TZPbNqE.exe
  2⤵
  PID:9896
- C:\Windows\System\UfQLYwj.exe
  C:\Windows\System\UfQLYwj.exe
  2⤵
  PID:10088
- C:\Windows\System\pxjuKdk.exe
  C:\Windows\System\pxjuKdk.exe
  2⤵
  PID:9632
- C:\Windows\System\FwIHNzK.exe
  C:\Windows\System\FwIHNzK.exe
  2⤵
  PID:9756
- C:\Windows\System\dLndrGR.exe
  C:\Windows\System\dLndrGR.exe
  2⤵
  PID:9996
- C:\Windows\System\BMXrtDB.exe
  C:\Windows\System\BMXrtDB.exe
  2⤵
  PID:9856
- C:\Windows\System\VAADiud.exe
  C:\Windows\System\VAADiud.exe
  2⤵
  PID:10256
- C:\Windows\System\CpAYIdO.exe
  C:\Windows\System\CpAYIdO.exe
  2⤵
  PID:10284
- C:\Windows\System\ZgRlVvJ.exe
  C:\Windows\System\ZgRlVvJ.exe
  2⤵
  PID:10300
- C:\Windows\System\XHOQtvy.exe
  C:\Windows\System\XHOQtvy.exe
  2⤵
  PID:10328
- C:\Windows\System\soVmAhY.exe
  C:\Windows\System\soVmAhY.exe
  2⤵
  PID:10352
- C:\Windows\System\GAWpvee.exe
  C:\Windows\System\GAWpvee.exe
  2⤵
  PID:10380
- C:\Windows\System\CylziXh.exe
  C:\Windows\System\CylziXh.exe
  2⤵
  PID:10400
- C:\Windows\System\nDRHleX.exe
  C:\Windows\System\nDRHleX.exe
  2⤵
  PID:10432
- C:\Windows\System\wJHALhO.exe
  C:\Windows\System\wJHALhO.exe
  2⤵
  PID:10464
- C:\Windows\System\DnlPpat.exe
  C:\Windows\System\DnlPpat.exe
  2⤵
  PID:10512
- C:\Windows\System\JbhARnV.exe
  C:\Windows\System\JbhARnV.exe
  2⤵
  PID:10536
- C:\Windows\System\RYDOdcH.exe
  C:\Windows\System\RYDOdcH.exe
  2⤵
  PID:10564
- C:\Windows\System\HNgGlZa.exe
  C:\Windows\System\HNgGlZa.exe
  2⤵
  PID:10584
- C:\Windows\System\LqXGtJT.exe
  C:\Windows\System\LqXGtJT.exe
  2⤵
  PID:10616
- C:\Windows\System\EZIVrAq.exe
  C:\Windows\System\EZIVrAq.exe
  2⤵
  PID:10640
- C:\Windows\System\iVIHPbz.exe
  C:\Windows\System\iVIHPbz.exe
  2⤵
  PID:10656
- C:\Windows\System\DRFqhvz.exe
  C:\Windows\System\DRFqhvz.exe
  2⤵
  PID:10692
- C:\Windows\System\nSnsxwY.exe
  C:\Windows\System\nSnsxwY.exe
  2⤵
  PID:10724
- C:\Windows\System\zNxxIuq.exe
  C:\Windows\System\zNxxIuq.exe
  2⤵
  PID:10744
- C:\Windows\System\bxYsTGT.exe
  C:\Windows\System\bxYsTGT.exe
  2⤵
  PID:10780
- C:\Windows\System\fworALI.exe
  C:\Windows\System\fworALI.exe
  2⤵
  PID:10816
- C:\Windows\System\DrQPnRg.exe
  C:\Windows\System\DrQPnRg.exe
  2⤵
  PID:10836
- C:\Windows\System\TtvmcvI.exe
  C:\Windows\System\TtvmcvI.exe
  2⤵
  PID:10876
- C:\Windows\System\VxAEiSs.exe
  C:\Windows\System\VxAEiSs.exe
  2⤵
  PID:10900
- C:\Windows\System\rADKkux.exe
  C:\Windows\System\rADKkux.exe
  2⤵
  PID:10932
- C:\Windows\System\VWRBqqz.exe
  C:\Windows\System\VWRBqqz.exe
  2⤵
  PID:10948
- C:\Windows\System\qjxVWNB.exe
  C:\Windows\System\qjxVWNB.exe
  2⤵
  PID:10972
- C:\Windows\System\aXrRHcS.exe
  C:\Windows\System\aXrRHcS.exe
  2⤵
  PID:10992
- C:\Windows\System\PFjGjmI.exe
  C:\Windows\System\PFjGjmI.exe
  2⤵
  PID:11016
- C:\Windows\System\WCHCQcQ.exe
  C:\Windows\System\WCHCQcQ.exe
  2⤵
  PID:11044
- C:\Windows\System\owOruaG.exe
  C:\Windows\System\owOruaG.exe
  2⤵
  PID:11092
- C:\Windows\System\lOzGgTM.exe
  C:\Windows\System\lOzGgTM.exe
  2⤵
  PID:11112
- C:\Windows\System\pGqXezB.exe
  C:\Windows\System\pGqXezB.exe
  2⤵
  PID:11136
- C:\Windows\System\YQHBlUG.exe
  C:\Windows\System\YQHBlUG.exe
  2⤵
  PID:11164
- C:\Windows\System\kwSFyJJ.exe
  C:\Windows\System\kwSFyJJ.exe
  2⤵
  PID:11188
- C:\Windows\System\xqFtoiz.exe
  C:\Windows\System\xqFtoiz.exe
  2⤵
  PID:11212
- C:\Windows\System\DESCZxa.exe
  C:\Windows\System\DESCZxa.exe
  2⤵
  PID:11240
- C:\Windows\System\xdeYeqE.exe
  C:\Windows\System\xdeYeqE.exe
  2⤵
  PID:10268
- C:\Windows\System\lebyXEl.exe
  C:\Windows\System\lebyXEl.exe
  2⤵
  PID:10348
- C:\Windows\System\QzhqFsz.exe
  C:\Windows\System\QzhqFsz.exe
  2⤵
  PID:10368
- C:\Windows\System\pRueZUz.exe
  C:\Windows\System\pRueZUz.exe
  2⤵
  PID:10444
- C:\Windows\System\MftrZie.exe
  C:\Windows\System\MftrZie.exe
  2⤵
  PID:10488
- C:\Windows\System\iCvGoho.exe
  C:\Windows\System\iCvGoho.exe
  2⤵
  PID:10600
- C:\Windows\System\qmockbB.exe
  C:\Windows\System\qmockbB.exe
  2⤵
  PID:10652
- C:\Windows\System\vzcAulC.exe
  C:\Windows\System\vzcAulC.exe
  2⤵
  PID:10732
- C:\Windows\System\rjuNyGJ.exe
  C:\Windows\System\rjuNyGJ.exe
  2⤵
  PID:10800
- C:\Windows\System\xeTnZZf.exe
  C:\Windows\System\xeTnZZf.exe
  2⤵
  PID:10856
- C:\Windows\System\iZnmIXm.exe
  C:\Windows\System\iZnmIXm.exe
  2⤵
  PID:10916
- C:\Windows\System\iUJiKfi.exe
  C:\Windows\System\iUJiKfi.exe
  2⤵
  PID:11004
- C:\Windows\System\nEekcMV.exe
  C:\Windows\System\nEekcMV.exe
  2⤵
  PID:11060
- C:\Windows\System\cTqfyIK.exe
  C:\Windows\System\cTqfyIK.exe
  2⤵
  PID:11108
- C:\Windows\System\AtwMwop.exe
  C:\Windows\System\AtwMwop.exe
  2⤵
  PID:11176
- C:\Windows\System\emrBSmc.exe
  C:\Windows\System\emrBSmc.exe
  2⤵
  PID:10244
- C:\Windows\System\GhQGbUX.exe
  C:\Windows\System\GhQGbUX.exe
  2⤵
  PID:10576
- C:\Windows\System\kgWoZUR.exe
  C:\Windows\System\kgWoZUR.exe
  2⤵
  PID:10704
- C:\Windows\System\GNqcYNb.exe
  C:\Windows\System\GNqcYNb.exe
  2⤵
  PID:10708
- C:\Windows\System\WjsKJCk.exe
  C:\Windows\System\WjsKJCk.exe
  2⤵
  PID:10772
- C:\Windows\System\PKtdxLh.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes