Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 07:21
Behavioral task
behavioral1
Sample
004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
004468715ee7f5409b6fabba2527b229
-
SHA1
903381d2adc2fb700c8061fbde2bdb1e078d1720
-
SHA256
6ba64f51308a181c818fe25330175be72bedfce436c69f7b36960dfdf4d4f85e
-
SHA512
c40e06a1e3b65dce72a2681c3769b131aea338a7cebf17fdbc1f9c59df0f52ec18bbbde652718bb43c552f8c91c33104bbfcf21f68e0cff446848d520e8743d1
-
SSDEEP
24576:JanwhSe11QSONCpGJCjETPlGC78XIO6zRIhRmuSOn0cF:knw9oUUEEDlGUh+hNnF
Malware Config
Signatures
-
XMRig Miner payload 54 IoCs
resource yara_rule behavioral2/memory/2964-11-0x00007FF6A5C90000-0x00007FF6A6081000-memory.dmp xmrig behavioral2/memory/2420-17-0x00007FF7E7CE0000-0x00007FF7E80D1000-memory.dmp xmrig behavioral2/memory/1988-77-0x00007FF61DE90000-0x00007FF61E281000-memory.dmp xmrig behavioral2/memory/2832-122-0x00007FF757C70000-0x00007FF758061000-memory.dmp xmrig behavioral2/memory/848-131-0x00007FF62C6E0000-0x00007FF62CAD1000-memory.dmp xmrig behavioral2/memory/2964-144-0x00007FF6A5C90000-0x00007FF6A6081000-memory.dmp xmrig behavioral2/memory/2996-202-0x00007FF633A70000-0x00007FF633E61000-memory.dmp xmrig behavioral2/memory/1664-207-0x00007FF6550A0000-0x00007FF655491000-memory.dmp xmrig behavioral2/memory/1600-210-0x00007FF76AF90000-0x00007FF76B381000-memory.dmp xmrig behavioral2/memory/4312-215-0x00007FF65AD80000-0x00007FF65B171000-memory.dmp xmrig behavioral2/memory/3724-220-0x00007FF67B480000-0x00007FF67B871000-memory.dmp xmrig behavioral2/memory/2472-230-0x00007FF7D4750000-0x00007FF7D4B41000-memory.dmp xmrig behavioral2/memory/4976-235-0x00007FF6B0130000-0x00007FF6B0521000-memory.dmp xmrig behavioral2/memory/4064-241-0x00007FF6FBFD0000-0x00007FF6FC3C1000-memory.dmp xmrig behavioral2/memory/2788-246-0x00007FF600420000-0x00007FF600811000-memory.dmp xmrig behavioral2/memory/3868-251-0x00007FF6949D0000-0x00007FF694DC1000-memory.dmp xmrig behavioral2/memory/3732-254-0x00007FF7E1C40000-0x00007FF7E2031000-memory.dmp xmrig behavioral2/memory/4132-256-0x00007FF65D380000-0x00007FF65D771000-memory.dmp xmrig behavioral2/memory/2236-259-0x00007FF621D70000-0x00007FF622161000-memory.dmp xmrig behavioral2/memory/3192-258-0x00007FF601040000-0x00007FF601431000-memory.dmp xmrig behavioral2/memory/3056-249-0x00007FF792560000-0x00007FF792951000-memory.dmp xmrig behavioral2/memory/3212-267-0x00007FF6C70C0000-0x00007FF6C74B1000-memory.dmp xmrig behavioral2/memory/5060-271-0x00007FF600CC0000-0x00007FF6010B1000-memory.dmp xmrig behavioral2/memory/4036-269-0x00007FF7F45A0000-0x00007FF7F4991000-memory.dmp xmrig behavioral2/memory/1456-244-0x00007FF758460000-0x00007FF758851000-memory.dmp xmrig behavioral2/memory/4028-227-0x00007FF7815D0000-0x00007FF7819C1000-memory.dmp xmrig behavioral2/memory/2508-225-0x00007FF662540000-0x00007FF662931000-memory.dmp xmrig behavioral2/memory/4416-222-0x00007FF6E4CA0000-0x00007FF6E5091000-memory.dmp xmrig behavioral2/memory/2436-217-0x00007FF77B380000-0x00007FF77B771000-memory.dmp xmrig behavioral2/memory/3028-212-0x00007FF752130000-0x00007FF752521000-memory.dmp xmrig behavioral2/memory/4780-205-0x00007FF6CA610000-0x00007FF6CAA01000-memory.dmp xmrig behavioral2/memory/2616-200-0x00007FF7BFC10000-0x00007FF7C0001000-memory.dmp xmrig behavioral2/memory/2660-197-0x00007FF7508F0000-0x00007FF750CE1000-memory.dmp xmrig behavioral2/memory/3068-195-0x00007FF7399D0000-0x00007FF739DC1000-memory.dmp xmrig behavioral2/memory/4524-191-0x00007FF720750000-0x00007FF720B41000-memory.dmp xmrig behavioral2/memory/968-189-0x00007FF7CE400000-0x00007FF7CE7F1000-memory.dmp xmrig behavioral2/memory/3208-184-0x00007FF668E30000-0x00007FF669221000-memory.dmp xmrig behavioral2/memory/2420-174-0x00007FF7E7CE0000-0x00007FF7E80D1000-memory.dmp xmrig behavioral2/memory/3320-148-0x00007FF699BC0000-0x00007FF699FB1000-memory.dmp xmrig behavioral2/memory/2664-145-0x00007FF7760D0000-0x00007FF7764C1000-memory.dmp xmrig behavioral2/memory/4736-142-0x00007FF6AC370000-0x00007FF6AC761000-memory.dmp xmrig behavioral2/memory/732-137-0x00007FF6CC610000-0x00007FF6CCA01000-memory.dmp xmrig behavioral2/memory/4712-134-0x00007FF71AC70000-0x00007FF71B061000-memory.dmp xmrig behavioral2/memory/3320-277-0x00007FF699BC0000-0x00007FF699FB1000-memory.dmp xmrig behavioral2/memory/716-128-0x00007FF79F550000-0x00007FF79F941000-memory.dmp xmrig behavioral2/memory/4900-124-0x00007FF61AA60000-0x00007FF61AE51000-memory.dmp xmrig behavioral2/memory/2536-292-0x00007FF6D82D0000-0x00007FF6D86C1000-memory.dmp xmrig behavioral2/memory/5108-106-0x00007FF74D610000-0x00007FF74DA01000-memory.dmp xmrig behavioral2/memory/2636-103-0x00007FF6C70C0000-0x00007FF6C74B1000-memory.dmp xmrig behavioral2/memory/1176-99-0x00007FF7435F0000-0x00007FF7439E1000-memory.dmp xmrig behavioral2/memory/3296-94-0x00007FF607DB0000-0x00007FF6081A1000-memory.dmp xmrig behavioral2/memory/2788-69-0x00007FF600420000-0x00007FF600811000-memory.dmp xmrig behavioral2/memory/4976-38-0x00007FF6B0130000-0x00007FF6B0521000-memory.dmp xmrig behavioral2/memory/4780-23-0x00007FF6CA610000-0x00007FF6CAA01000-memory.dmp xmrig -
Executes dropped EXE 64 IoCs
pid Process 2964 obZsvPc.exe 2420 jxjhgkq.exe 4780 JaJMHFa.exe 2436 wVuTdNn.exe 4028 vcvbBAw.exe 4976 QnaKJCV.exe 4064 iDHQays.exe 3296 OYbjodX.exe 1456 BNTUEMp.exe 2788 lFWWUWh.exe 1988 ZfaTzWO.exe 1176 DddfEXL.exe 2636 VOhnIlL.exe 5108 NbOBPSN.exe 716 LpmDiYr.exe 2236 YCopCTK.exe 4132 xhcYXXy.exe 2832 nDAxHpQ.exe 4900 ByhpOYB.exe 848 obtlhtC.exe 4712 RPWqpwz.exe 4736 wnUBQfS.exe 2664 TUIZTBK.exe 3320 ecBXhff.exe 2996 ypwaGCH.exe 3208 QYyJjgy.exe 968 DQxOwtm.exe 4524 JscGuAs.exe 3068 kpSxMFE.exe 2660 ANUHYcq.exe 2616 VnRHUaL.exe 1664 sPOuJwg.exe 1600 fJraUOO.exe 3028 sBWWEcH.exe 4312 lbdElUJ.exe 3724 RnCHyxB.exe 4416 uzEBcQo.exe 2508 XZEMrgA.exe 2472 uNoeHYc.exe 2324 gWlGjsQ.exe 3712 teZlkzi.exe 3056 yjCHoMU.exe 3868 BPKRfSu.exe 3732 nThPdVE.exe 3192 NIXfKkA.exe 3212 CIqFpeq.exe 4036 Ndynsfe.exe 5060 tHYMVLf.exe 2580 flgllaT.exe 2536 OqRjjxC.exe 3236 HbHEZwH.exe 2176 ChEcMCG.exe 2548 DwMynzo.exe 4128 XCXhjBD.exe 2032 FgGWgjy.exe 4488 nqWXVCH.exe 5084 RoZcMGR.exe 2264 mHsAPvv.exe 4040 xVzNshO.exe 4692 lnXiFIP.exe 2440 ByrzWQr.exe 4800 PUclDYE.exe 4356 mdbdHsL.exe 3704 ATavSFu.exe -
resource yara_rule behavioral2/memory/732-0-0x00007FF6CC610000-0x00007FF6CCA01000-memory.dmp upx behavioral2/files/0x00080000000233fb-6.dat upx behavioral2/files/0x00070000000233ff-10.dat upx behavioral2/memory/2964-11-0x00007FF6A5C90000-0x00007FF6A6081000-memory.dmp upx behavioral2/memory/2420-17-0x00007FF7E7CE0000-0x00007FF7E80D1000-memory.dmp upx behavioral2/files/0x0007000000023402-24.dat upx behavioral2/files/0x0007000000023403-31.dat upx behavioral2/files/0x0007000000023407-54.dat upx behavioral2/files/0x0007000000023408-55.dat upx behavioral2/files/0x0007000000023409-59.dat upx behavioral2/memory/1988-77-0x00007FF61DE90000-0x00007FF61E281000-memory.dmp upx behavioral2/files/0x000700000002340c-83.dat upx behavioral2/files/0x0007000000023410-104.dat upx behavioral2/files/0x000700000002340d-107.dat upx behavioral2/memory/2832-122-0x00007FF757C70000-0x00007FF758061000-memory.dmp upx behavioral2/files/0x0007000000023413-132.dat upx behavioral2/memory/848-131-0x00007FF62C6E0000-0x00007FF62CAD1000-memory.dmp upx behavioral2/files/0x0007000000023412-135.dat upx behavioral2/memory/2964-144-0x00007FF6A5C90000-0x00007FF6A6081000-memory.dmp upx behavioral2/files/0x0007000000023414-146.dat upx behavioral2/files/0x0007000000023415-167.dat upx behavioral2/files/0x0007000000023418-178.dat upx behavioral2/files/0x000700000002341c-192.dat upx behavioral2/memory/2996-202-0x00007FF633A70000-0x00007FF633E61000-memory.dmp upx behavioral2/memory/1664-207-0x00007FF6550A0000-0x00007FF655491000-memory.dmp upx behavioral2/memory/1600-210-0x00007FF76AF90000-0x00007FF76B381000-memory.dmp upx behavioral2/memory/4312-215-0x00007FF65AD80000-0x00007FF65B171000-memory.dmp upx behavioral2/memory/3724-220-0x00007FF67B480000-0x00007FF67B871000-memory.dmp upx behavioral2/memory/2472-230-0x00007FF7D4750000-0x00007FF7D4B41000-memory.dmp upx behavioral2/memory/4976-235-0x00007FF6B0130000-0x00007FF6B0521000-memory.dmp upx behavioral2/memory/4064-241-0x00007FF6FBFD0000-0x00007FF6FC3C1000-memory.dmp upx behavioral2/memory/2788-246-0x00007FF600420000-0x00007FF600811000-memory.dmp upx behavioral2/memory/3868-251-0x00007FF6949D0000-0x00007FF694DC1000-memory.dmp upx behavioral2/memory/3732-254-0x00007FF7E1C40000-0x00007FF7E2031000-memory.dmp upx behavioral2/memory/4132-256-0x00007FF65D380000-0x00007FF65D771000-memory.dmp upx behavioral2/memory/2236-259-0x00007FF621D70000-0x00007FF622161000-memory.dmp upx behavioral2/memory/3192-258-0x00007FF601040000-0x00007FF601431000-memory.dmp upx behavioral2/memory/3056-249-0x00007FF792560000-0x00007FF792951000-memory.dmp upx behavioral2/memory/3212-267-0x00007FF6C70C0000-0x00007FF6C74B1000-memory.dmp upx behavioral2/memory/5060-271-0x00007FF600CC0000-0x00007FF6010B1000-memory.dmp upx behavioral2/memory/4036-269-0x00007FF7F45A0000-0x00007FF7F4991000-memory.dmp upx behavioral2/memory/2580-276-0x00007FF738F30000-0x00007FF739321000-memory.dmp upx behavioral2/memory/1456-244-0x00007FF758460000-0x00007FF758851000-memory.dmp upx behavioral2/memory/3712-239-0x00007FF751830000-0x00007FF751C21000-memory.dmp upx behavioral2/memory/2324-232-0x00007FF6510F0000-0x00007FF6514E1000-memory.dmp upx behavioral2/memory/4028-227-0x00007FF7815D0000-0x00007FF7819C1000-memory.dmp upx behavioral2/memory/2508-225-0x00007FF662540000-0x00007FF662931000-memory.dmp upx behavioral2/memory/4416-222-0x00007FF6E4CA0000-0x00007FF6E5091000-memory.dmp upx behavioral2/memory/2436-217-0x00007FF77B380000-0x00007FF77B771000-memory.dmp upx behavioral2/memory/3028-212-0x00007FF752130000-0x00007FF752521000-memory.dmp upx behavioral2/memory/4780-205-0x00007FF6CA610000-0x00007FF6CAA01000-memory.dmp upx behavioral2/memory/2616-200-0x00007FF7BFC10000-0x00007FF7C0001000-memory.dmp upx behavioral2/memory/2660-197-0x00007FF7508F0000-0x00007FF750CE1000-memory.dmp upx behavioral2/memory/3068-195-0x00007FF7399D0000-0x00007FF739DC1000-memory.dmp upx behavioral2/memory/4524-191-0x00007FF720750000-0x00007FF720B41000-memory.dmp upx behavioral2/memory/968-189-0x00007FF7CE400000-0x00007FF7CE7F1000-memory.dmp upx behavioral2/files/0x000700000002341b-185.dat upx behavioral2/memory/3208-184-0x00007FF668E30000-0x00007FF669221000-memory.dmp upx behavioral2/files/0x000700000002341a-181.dat upx behavioral2/files/0x0007000000023419-175.dat upx behavioral2/memory/2420-174-0x00007FF7E7CE0000-0x00007FF7E80D1000-memory.dmp upx behavioral2/files/0x0007000000023417-171.dat upx behavioral2/files/0x0007000000023416-169.dat upx behavioral2/memory/3320-148-0x00007FF699BC0000-0x00007FF699FB1000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\lcderci.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\CxgVNXs.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\THfpBxB.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\wVuTdNn.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\ovtdpdw.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\JVnMVdG.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\qEAzDUx.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\wrfTqdd.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\NvFthKN.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\rVwlNZm.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\clbyvhu.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\daJDbvx.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\eILjNPY.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\JsGPDwA.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\GUZoSOh.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\QZHksMI.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\sSZdpcT.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\nTLUqYn.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\RoZcMGR.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\BNlYonJ.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\uFdnGgV.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\LcdJBcO.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\flgllaT.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\EEaoann.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\GBMLcjM.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\ydfIAAi.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\TfIOMUt.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\gpLSlFf.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\HCbvREa.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\yjCHoMU.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\zoFJHAB.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\LBKblan.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\XWqocaQ.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\XViLPOd.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\UaSJRHM.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\OqkKQTM.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\VITNobO.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\oLpeXRY.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\CJXjxcp.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\yivtCXE.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\tWQwGAm.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\NIXfKkA.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\sPOuJwg.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\cUKOQjT.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\cZkWaoi.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\TUIZTBK.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\JnFMGuK.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\vNQTYuz.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\hasBuNc.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\AilsVdD.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\TgdaysT.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\oppIepo.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\nkCVlQE.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\ZWkJOqb.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\ZxtHGoG.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\qJxdgvR.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\zuqWjHm.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\GbmPrQC.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\AdygbMO.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\FwIZFNR.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\pFGRhSi.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\UrgQZoK.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\Cebbyuu.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe File created C:\Windows\System32\uIwnepI.exe 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeCreateGlobalPrivilege 2928 dwm.exe Token: SeChangeNotifyPrivilege 2928 dwm.exe Token: 33 2928 dwm.exe Token: SeIncBasePriorityPrivilege 2928 dwm.exe Token: SeShutdownPrivilege 2928 dwm.exe Token: SeCreatePagefilePrivilege 2928 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 732 wrote to memory of 2964 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 86 PID 732 wrote to memory of 2964 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 86 PID 732 wrote to memory of 2420 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 87 PID 732 wrote to memory of 2420 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 87 PID 732 wrote to memory of 4780 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 88 PID 732 wrote to memory of 4780 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 88 PID 732 wrote to memory of 4028 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 89 PID 732 wrote to memory of 4028 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 89 PID 732 wrote to memory of 2436 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 90 PID 732 wrote to memory of 2436 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 90 PID 732 wrote to memory of 4976 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 91 PID 732 wrote to memory of 4976 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 91 PID 732 wrote to memory of 4064 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 92 PID 732 wrote to memory of 4064 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 92 PID 732 wrote to memory of 1988 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 93 PID 732 wrote to memory of 1988 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 93 PID 732 wrote to memory of 3296 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 94 PID 732 wrote to memory of 3296 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 94 PID 732 wrote to memory of 1456 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 95 PID 732 wrote to memory of 1456 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 95 PID 732 wrote to memory of 2788 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 96 PID 732 wrote to memory of 2788 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 96 PID 732 wrote to memory of 1176 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 99 PID 732 wrote to memory of 1176 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 99 PID 732 wrote to memory of 2636 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 101 PID 732 wrote to memory of 2636 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 101 PID 732 wrote to memory of 5108 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 102 PID 732 wrote to memory of 5108 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 102 PID 732 wrote to memory of 716 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 103 PID 732 wrote to memory of 716 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 103 PID 732 wrote to memory of 2236 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 104 PID 732 wrote to memory of 2236 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 104 PID 732 wrote to memory of 4132 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 105 PID 732 wrote to memory of 4132 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 105 PID 732 wrote to memory of 2832 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 106 PID 732 wrote to memory of 2832 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 106 PID 732 wrote to memory of 4900 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 107 PID 732 wrote to memory of 4900 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 107 PID 732 wrote to memory of 848 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 108 PID 732 wrote to memory of 848 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 108 PID 732 wrote to memory of 4712 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 109 PID 732 wrote to memory of 4712 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 109 PID 732 wrote to memory of 4736 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 110 PID 732 wrote to memory of 4736 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 110 PID 732 wrote to memory of 2664 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 111 PID 732 wrote to memory of 2664 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 111 PID 732 wrote to memory of 3320 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 112 PID 732 wrote to memory of 3320 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 112 PID 732 wrote to memory of 2996 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 113 PID 732 wrote to memory of 2996 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 113 PID 732 wrote to memory of 3208 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 114 PID 732 wrote to memory of 3208 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 114 PID 732 wrote to memory of 968 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 115 PID 732 wrote to memory of 968 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 115 PID 732 wrote to memory of 4524 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 116 PID 732 wrote to memory of 4524 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 116 PID 732 wrote to memory of 3068 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 117 PID 732 wrote to memory of 3068 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 117 PID 732 wrote to memory of 2660 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 118 PID 732 wrote to memory of 2660 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 118 PID 732 wrote to memory of 2616 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 119 PID 732 wrote to memory of 2616 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 119 PID 732 wrote to memory of 1664 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 120 PID 732 wrote to memory of 1664 732 004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\004468715ee7f5409b6fabba2527b229_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\System32\obZsvPc.exeC:\Windows\System32\obZsvPc.exe2⤵
- Executes dropped EXE
PID:2964
-
-
C:\Windows\System32\jxjhgkq.exeC:\Windows\System32\jxjhgkq.exe2⤵
- Executes dropped EXE
PID:2420
-
-
C:\Windows\System32\JaJMHFa.exeC:\Windows\System32\JaJMHFa.exe2⤵
- Executes dropped EXE
PID:4780
-
-
C:\Windows\System32\vcvbBAw.exeC:\Windows\System32\vcvbBAw.exe2⤵
- Executes dropped EXE
PID:4028
-
-
C:\Windows\System32\wVuTdNn.exeC:\Windows\System32\wVuTdNn.exe2⤵
- Executes dropped EXE
PID:2436
-
-
C:\Windows\System32\QnaKJCV.exeC:\Windows\System32\QnaKJCV.exe2⤵
- Executes dropped EXE
PID:4976
-
-
C:\Windows\System32\iDHQays.exeC:\Windows\System32\iDHQays.exe2⤵
- Executes dropped EXE
PID:4064
-
-
C:\Windows\System32\ZfaTzWO.exeC:\Windows\System32\ZfaTzWO.exe2⤵
- Executes dropped EXE
PID:1988
-
-
C:\Windows\System32\OYbjodX.exeC:\Windows\System32\OYbjodX.exe2⤵
- Executes dropped EXE
PID:3296
-
-
C:\Windows\System32\BNTUEMp.exeC:\Windows\System32\BNTUEMp.exe2⤵
- Executes dropped EXE
PID:1456
-
-
C:\Windows\System32\lFWWUWh.exeC:\Windows\System32\lFWWUWh.exe2⤵
- Executes dropped EXE
PID:2788
-
-
C:\Windows\System32\DddfEXL.exeC:\Windows\System32\DddfEXL.exe2⤵
- Executes dropped EXE
PID:1176
-
-
C:\Windows\System32\VOhnIlL.exeC:\Windows\System32\VOhnIlL.exe2⤵
- Executes dropped EXE
PID:2636
-
-
C:\Windows\System32\NbOBPSN.exeC:\Windows\System32\NbOBPSN.exe2⤵
- Executes dropped EXE
PID:5108
-
-
C:\Windows\System32\LpmDiYr.exeC:\Windows\System32\LpmDiYr.exe2⤵
- Executes dropped EXE
PID:716
-
-
C:\Windows\System32\YCopCTK.exeC:\Windows\System32\YCopCTK.exe2⤵
- Executes dropped EXE
PID:2236
-
-
C:\Windows\System32\xhcYXXy.exeC:\Windows\System32\xhcYXXy.exe2⤵
- Executes dropped EXE
PID:4132
-
-
C:\Windows\System32\nDAxHpQ.exeC:\Windows\System32\nDAxHpQ.exe2⤵
- Executes dropped EXE
PID:2832
-
-
C:\Windows\System32\ByhpOYB.exeC:\Windows\System32\ByhpOYB.exe2⤵
- Executes dropped EXE
PID:4900
-
-
C:\Windows\System32\obtlhtC.exeC:\Windows\System32\obtlhtC.exe2⤵
- Executes dropped EXE
PID:848
-
-
C:\Windows\System32\RPWqpwz.exeC:\Windows\System32\RPWqpwz.exe2⤵
- Executes dropped EXE
PID:4712
-
-
C:\Windows\System32\wnUBQfS.exeC:\Windows\System32\wnUBQfS.exe2⤵
- Executes dropped EXE
PID:4736
-
-
C:\Windows\System32\TUIZTBK.exeC:\Windows\System32\TUIZTBK.exe2⤵
- Executes dropped EXE
PID:2664
-
-
C:\Windows\System32\ecBXhff.exeC:\Windows\System32\ecBXhff.exe2⤵
- Executes dropped EXE
PID:3320
-
-
C:\Windows\System32\ypwaGCH.exeC:\Windows\System32\ypwaGCH.exe2⤵
- Executes dropped EXE
PID:2996
-
-
C:\Windows\System32\QYyJjgy.exeC:\Windows\System32\QYyJjgy.exe2⤵
- Executes dropped EXE
PID:3208
-
-
C:\Windows\System32\DQxOwtm.exeC:\Windows\System32\DQxOwtm.exe2⤵
- Executes dropped EXE
PID:968
-
-
C:\Windows\System32\JscGuAs.exeC:\Windows\System32\JscGuAs.exe2⤵
- Executes dropped EXE
PID:4524
-
-
C:\Windows\System32\kpSxMFE.exeC:\Windows\System32\kpSxMFE.exe2⤵
- Executes dropped EXE
PID:3068
-
-
C:\Windows\System32\ANUHYcq.exeC:\Windows\System32\ANUHYcq.exe2⤵
- Executes dropped EXE
PID:2660
-
-
C:\Windows\System32\VnRHUaL.exeC:\Windows\System32\VnRHUaL.exe2⤵
- Executes dropped EXE
PID:2616
-
-
C:\Windows\System32\sPOuJwg.exeC:\Windows\System32\sPOuJwg.exe2⤵
- Executes dropped EXE
PID:1664
-
-
C:\Windows\System32\fJraUOO.exeC:\Windows\System32\fJraUOO.exe2⤵
- Executes dropped EXE
PID:1600
-
-
C:\Windows\System32\sBWWEcH.exeC:\Windows\System32\sBWWEcH.exe2⤵
- Executes dropped EXE
PID:3028
-
-
C:\Windows\System32\lbdElUJ.exeC:\Windows\System32\lbdElUJ.exe2⤵
- Executes dropped EXE
PID:4312
-
-
C:\Windows\System32\RnCHyxB.exeC:\Windows\System32\RnCHyxB.exe2⤵
- Executes dropped EXE
PID:3724
-
-
C:\Windows\System32\uzEBcQo.exeC:\Windows\System32\uzEBcQo.exe2⤵
- Executes dropped EXE
PID:4416
-
-
C:\Windows\System32\XZEMrgA.exeC:\Windows\System32\XZEMrgA.exe2⤵
- Executes dropped EXE
PID:2508
-
-
C:\Windows\System32\uNoeHYc.exeC:\Windows\System32\uNoeHYc.exe2⤵
- Executes dropped EXE
PID:2472
-
-
C:\Windows\System32\gWlGjsQ.exeC:\Windows\System32\gWlGjsQ.exe2⤵
- Executes dropped EXE
PID:2324
-
-
C:\Windows\System32\teZlkzi.exeC:\Windows\System32\teZlkzi.exe2⤵
- Executes dropped EXE
PID:3712
-
-
C:\Windows\System32\yjCHoMU.exeC:\Windows\System32\yjCHoMU.exe2⤵
- Executes dropped EXE
PID:3056
-
-
C:\Windows\System32\BPKRfSu.exeC:\Windows\System32\BPKRfSu.exe2⤵
- Executes dropped EXE
PID:3868
-
-
C:\Windows\System32\nThPdVE.exeC:\Windows\System32\nThPdVE.exe2⤵
- Executes dropped EXE
PID:3732
-
-
C:\Windows\System32\NIXfKkA.exeC:\Windows\System32\NIXfKkA.exe2⤵
- Executes dropped EXE
PID:3192
-
-
C:\Windows\System32\CIqFpeq.exeC:\Windows\System32\CIqFpeq.exe2⤵
- Executes dropped EXE
PID:3212
-
-
C:\Windows\System32\Ndynsfe.exeC:\Windows\System32\Ndynsfe.exe2⤵
- Executes dropped EXE
PID:4036
-
-
C:\Windows\System32\tHYMVLf.exeC:\Windows\System32\tHYMVLf.exe2⤵
- Executes dropped EXE
PID:5060
-
-
C:\Windows\System32\flgllaT.exeC:\Windows\System32\flgllaT.exe2⤵
- Executes dropped EXE
PID:2580
-
-
C:\Windows\System32\OqRjjxC.exeC:\Windows\System32\OqRjjxC.exe2⤵
- Executes dropped EXE
PID:2536
-
-
C:\Windows\System32\HbHEZwH.exeC:\Windows\System32\HbHEZwH.exe2⤵
- Executes dropped EXE
PID:3236
-
-
C:\Windows\System32\ChEcMCG.exeC:\Windows\System32\ChEcMCG.exe2⤵
- Executes dropped EXE
PID:2176
-
-
C:\Windows\System32\DwMynzo.exeC:\Windows\System32\DwMynzo.exe2⤵
- Executes dropped EXE
PID:2548
-
-
C:\Windows\System32\XCXhjBD.exeC:\Windows\System32\XCXhjBD.exe2⤵
- Executes dropped EXE
PID:4128
-
-
C:\Windows\System32\FgGWgjy.exeC:\Windows\System32\FgGWgjy.exe2⤵
- Executes dropped EXE
PID:2032
-
-
C:\Windows\System32\nqWXVCH.exeC:\Windows\System32\nqWXVCH.exe2⤵
- Executes dropped EXE
PID:4488
-
-
C:\Windows\System32\RoZcMGR.exeC:\Windows\System32\RoZcMGR.exe2⤵
- Executes dropped EXE
PID:5084
-
-
C:\Windows\System32\mHsAPvv.exeC:\Windows\System32\mHsAPvv.exe2⤵
- Executes dropped EXE
PID:2264
-
-
C:\Windows\System32\xVzNshO.exeC:\Windows\System32\xVzNshO.exe2⤵
- Executes dropped EXE
PID:4040
-
-
C:\Windows\System32\lnXiFIP.exeC:\Windows\System32\lnXiFIP.exe2⤵
- Executes dropped EXE
PID:4692
-
-
C:\Windows\System32\ByrzWQr.exeC:\Windows\System32\ByrzWQr.exe2⤵
- Executes dropped EXE
PID:2440
-
-
C:\Windows\System32\PUclDYE.exeC:\Windows\System32\PUclDYE.exe2⤵
- Executes dropped EXE
PID:4800
-
-
C:\Windows\System32\mdbdHsL.exeC:\Windows\System32\mdbdHsL.exe2⤵
- Executes dropped EXE
PID:4356
-
-
C:\Windows\System32\ATavSFu.exeC:\Windows\System32\ATavSFu.exe2⤵
- Executes dropped EXE
PID:3704
-
-
C:\Windows\System32\pFGRhSi.exeC:\Windows\System32\pFGRhSi.exe2⤵PID:2992
-
-
C:\Windows\System32\mQXPgGV.exeC:\Windows\System32\mQXPgGV.exe2⤵PID:2520
-
-
C:\Windows\System32\pkCgQNe.exeC:\Windows\System32\pkCgQNe.exe2⤵PID:3144
-
-
C:\Windows\System32\uUzlGJC.exeC:\Windows\System32\uUzlGJC.exe2⤵PID:4660
-
-
C:\Windows\System32\cUKOQjT.exeC:\Windows\System32\cUKOQjT.exe2⤵PID:3312
-
-
C:\Windows\System32\KzaLNVc.exeC:\Windows\System32\KzaLNVc.exe2⤵PID:2056
-
-
C:\Windows\System32\oLpeXRY.exeC:\Windows\System32\oLpeXRY.exe2⤵PID:396
-
-
C:\Windows\System32\Cebbyuu.exeC:\Windows\System32\Cebbyuu.exe2⤵PID:728
-
-
C:\Windows\System32\cTtoVKj.exeC:\Windows\System32\cTtoVKj.exe2⤵PID:1780
-
-
C:\Windows\System32\wFscOmm.exeC:\Windows\System32\wFscOmm.exe2⤵PID:668
-
-
C:\Windows\System32\JsGPDwA.exeC:\Windows\System32\JsGPDwA.exe2⤵PID:988
-
-
C:\Windows\System32\VZkrdxU.exeC:\Windows\System32\VZkrdxU.exe2⤵PID:5128
-
-
C:\Windows\System32\BqbPRBm.exeC:\Windows\System32\BqbPRBm.exe2⤵PID:5144
-
-
C:\Windows\System32\XCjnVvC.exeC:\Windows\System32\XCjnVvC.exe2⤵PID:5260
-
-
C:\Windows\System32\oIoSgHz.exeC:\Windows\System32\oIoSgHz.exe2⤵PID:5288
-
-
C:\Windows\System32\kYqkyDX.exeC:\Windows\System32\kYqkyDX.exe2⤵PID:5316
-
-
C:\Windows\System32\fIvomOO.exeC:\Windows\System32\fIvomOO.exe2⤵PID:5396
-
-
C:\Windows\System32\fWeXtGN.exeC:\Windows\System32\fWeXtGN.exe2⤵PID:5428
-
-
C:\Windows\System32\YmhoyBW.exeC:\Windows\System32\YmhoyBW.exe2⤵PID:5444
-
-
C:\Windows\System32\GjCPRVs.exeC:\Windows\System32\GjCPRVs.exe2⤵PID:5464
-
-
C:\Windows\System32\SOceBId.exeC:\Windows\System32\SOceBId.exe2⤵PID:5508
-
-
C:\Windows\System32\nUNYpjg.exeC:\Windows\System32\nUNYpjg.exe2⤵PID:5528
-
-
C:\Windows\System32\urxCShd.exeC:\Windows\System32\urxCShd.exe2⤵PID:5544
-
-
C:\Windows\System32\JnoTNqd.exeC:\Windows\System32\JnoTNqd.exe2⤵PID:5564
-
-
C:\Windows\System32\SvByVcH.exeC:\Windows\System32\SvByVcH.exe2⤵PID:5584
-
-
C:\Windows\System32\MtGOHKy.exeC:\Windows\System32\MtGOHKy.exe2⤵PID:5648
-
-
C:\Windows\System32\JVcJawp.exeC:\Windows\System32\JVcJawp.exe2⤵PID:5672
-
-
C:\Windows\System32\pIjFmoZ.exeC:\Windows\System32\pIjFmoZ.exe2⤵PID:5720
-
-
C:\Windows\System32\BdMfbci.exeC:\Windows\System32\BdMfbci.exe2⤵PID:5748
-
-
C:\Windows\System32\wXbUBSq.exeC:\Windows\System32\wXbUBSq.exe2⤵PID:5764
-
-
C:\Windows\System32\GUZoSOh.exeC:\Windows\System32\GUZoSOh.exe2⤵PID:5780
-
-
C:\Windows\System32\kdCJCaM.exeC:\Windows\System32\kdCJCaM.exe2⤵PID:5800
-
-
C:\Windows\System32\DtuuSgj.exeC:\Windows\System32\DtuuSgj.exe2⤵PID:5816
-
-
C:\Windows\System32\AWsAhOt.exeC:\Windows\System32\AWsAhOt.exe2⤵PID:5832
-
-
C:\Windows\System32\dtsnTIc.exeC:\Windows\System32\dtsnTIc.exe2⤵PID:5852
-
-
C:\Windows\System32\EiJPTJR.exeC:\Windows\System32\EiJPTJR.exe2⤵PID:5872
-
-
C:\Windows\System32\lcderci.exeC:\Windows\System32\lcderci.exe2⤵PID:5888
-
-
C:\Windows\System32\BepnnqG.exeC:\Windows\System32\BepnnqG.exe2⤵PID:5904
-
-
C:\Windows\System32\MZKJKJF.exeC:\Windows\System32\MZKJKJF.exe2⤵PID:5924
-
-
C:\Windows\System32\mclJXDs.exeC:\Windows\System32\mclJXDs.exe2⤵PID:5956
-
-
C:\Windows\System32\clbyvhu.exeC:\Windows\System32\clbyvhu.exe2⤵PID:6020
-
-
C:\Windows\System32\LcdJBcO.exeC:\Windows\System32\LcdJBcO.exe2⤵PID:6124
-
-
C:\Windows\System32\EEaoann.exeC:\Windows\System32\EEaoann.exe2⤵PID:3684
-
-
C:\Windows\System32\PvEDNNG.exeC:\Windows\System32\PvEDNNG.exe2⤵PID:2988
-
-
C:\Windows\System32\hLhDRMO.exeC:\Windows\System32\hLhDRMO.exe2⤵PID:3948
-
-
C:\Windows\System32\OLObewH.exeC:\Windows\System32\OLObewH.exe2⤵PID:3084
-
-
C:\Windows\System32\RutRilt.exeC:\Windows\System32\RutRilt.exe2⤵PID:5220
-
-
C:\Windows\System32\QufplVe.exeC:\Windows\System32\QufplVe.exe2⤵PID:5232
-
-
C:\Windows\System32\kDNnZwK.exeC:\Windows\System32\kDNnZwK.exe2⤵PID:5344
-
-
C:\Windows\System32\boiJaLX.exeC:\Windows\System32\boiJaLX.exe2⤵PID:4080
-
-
C:\Windows\System32\yfrFGJs.exeC:\Windows\System32\yfrFGJs.exe2⤵PID:5380
-
-
C:\Windows\System32\UYqhwlH.exeC:\Windows\System32\UYqhwlH.exe2⤵PID:1884
-
-
C:\Windows\System32\yISHKJQ.exeC:\Windows\System32\yISHKJQ.exe2⤵PID:5440
-
-
C:\Windows\System32\FmeSVfo.exeC:\Windows\System32\FmeSVfo.exe2⤵PID:5404
-
-
C:\Windows\System32\ZfzspZX.exeC:\Windows\System32\ZfzspZX.exe2⤵PID:5456
-
-
C:\Windows\System32\qEAzDUx.exeC:\Windows\System32\qEAzDUx.exe2⤵PID:4340
-
-
C:\Windows\System32\aaCUuJh.exeC:\Windows\System32\aaCUuJh.exe2⤵PID:5664
-
-
C:\Windows\System32\daJDbvx.exeC:\Windows\System32\daJDbvx.exe2⤵PID:4508
-
-
C:\Windows\System32\mfbNVKD.exeC:\Windows\System32\mfbNVKD.exe2⤵PID:2224
-
-
C:\Windows\System32\WTReLJF.exeC:\Windows\System32\WTReLJF.exe2⤵PID:5760
-
-
C:\Windows\System32\TKDUrzc.exeC:\Windows\System32\TKDUrzc.exe2⤵PID:3472
-
-
C:\Windows\System32\NfvriqZ.exeC:\Windows\System32\NfvriqZ.exe2⤵PID:5828
-
-
C:\Windows\System32\WoYFGTJ.exeC:\Windows\System32\WoYFGTJ.exe2⤵PID:5912
-
-
C:\Windows\System32\HNfDmBf.exeC:\Windows\System32\HNfDmBf.exe2⤵PID:1220
-
-
C:\Windows\System32\RXbonTd.exeC:\Windows\System32\RXbonTd.exe2⤵PID:6140
-
-
C:\Windows\System32\KYYAndK.exeC:\Windows\System32\KYYAndK.exe2⤵PID:4348
-
-
C:\Windows\System32\JAweDlZ.exeC:\Windows\System32\JAweDlZ.exe2⤵PID:5312
-
-
C:\Windows\System32\NwUnoIm.exeC:\Windows\System32\NwUnoIm.exe2⤵PID:1816
-
-
C:\Windows\System32\ZWkJOqb.exeC:\Windows\System32\ZWkJOqb.exe2⤵PID:1960
-
-
C:\Windows\System32\MSRUmmm.exeC:\Windows\System32\MSRUmmm.exe2⤵PID:3796
-
-
C:\Windows\System32\IvjxEHG.exeC:\Windows\System32\IvjxEHG.exe2⤵PID:5756
-
-
C:\Windows\System32\IHCujlJ.exeC:\Windows\System32\IHCujlJ.exe2⤵PID:5808
-
-
C:\Windows\System32\pdEVvFo.exeC:\Windows\System32\pdEVvFo.exe2⤵PID:5716
-
-
C:\Windows\System32\njPvmoK.exeC:\Windows\System32\njPvmoK.exe2⤵PID:5896
-
-
C:\Windows\System32\CuzHpzH.exeC:\Windows\System32\CuzHpzH.exe2⤵PID:5916
-
-
C:\Windows\System32\CaUQfqr.exeC:\Windows\System32\CaUQfqr.exe2⤵PID:2396
-
-
C:\Windows\System32\uIwnepI.exeC:\Windows\System32\uIwnepI.exe2⤵PID:5328
-
-
C:\Windows\System32\JhfyIhY.exeC:\Windows\System32\JhfyIhY.exe2⤵PID:5596
-
-
C:\Windows\System32\DzmSGRt.exeC:\Windows\System32\DzmSGRt.exe2⤵PID:5460
-
-
C:\Windows\System32\BMfOZDY.exeC:\Windows\System32\BMfOZDY.exe2⤵PID:996
-
-
C:\Windows\System32\nkCVlQE.exeC:\Windows\System32\nkCVlQE.exe2⤵PID:6136
-
-
C:\Windows\System32\gDZhSUN.exeC:\Windows\System32\gDZhSUN.exe2⤵PID:5844
-
-
C:\Windows\System32\rVwlNZm.exeC:\Windows\System32\rVwlNZm.exe2⤵PID:1976
-
-
C:\Windows\System32\fjumOXg.exeC:\Windows\System32\fjumOXg.exe2⤵PID:5732
-
-
C:\Windows\System32\vzTwgpf.exeC:\Windows\System32\vzTwgpf.exe2⤵PID:5884
-
-
C:\Windows\System32\pauQrtc.exeC:\Windows\System32\pauQrtc.exe2⤵PID:6164
-
-
C:\Windows\System32\kySwxkX.exeC:\Windows\System32\kySwxkX.exe2⤵PID:6184
-
-
C:\Windows\System32\kNuncED.exeC:\Windows\System32\kNuncED.exe2⤵PID:6220
-
-
C:\Windows\System32\URrXdxj.exeC:\Windows\System32\URrXdxj.exe2⤵PID:6240
-
-
C:\Windows\System32\ZxtHGoG.exeC:\Windows\System32\ZxtHGoG.exe2⤵PID:6256
-
-
C:\Windows\System32\cdZDeaw.exeC:\Windows\System32\cdZDeaw.exe2⤵PID:6280
-
-
C:\Windows\System32\wodNivj.exeC:\Windows\System32\wodNivj.exe2⤵PID:6296
-
-
C:\Windows\System32\zkGTlTP.exeC:\Windows\System32\zkGTlTP.exe2⤵PID:6412
-
-
C:\Windows\System32\PSCnKSE.exeC:\Windows\System32\PSCnKSE.exe2⤵PID:6464
-
-
C:\Windows\System32\SxpXyga.exeC:\Windows\System32\SxpXyga.exe2⤵PID:6500
-
-
C:\Windows\System32\FVIQhpD.exeC:\Windows\System32\FVIQhpD.exe2⤵PID:6520
-
-
C:\Windows\System32\GBkTxEZ.exeC:\Windows\System32\GBkTxEZ.exe2⤵PID:6536
-
-
C:\Windows\System32\oZkkeVO.exeC:\Windows\System32\oZkkeVO.exe2⤵PID:6552
-
-
C:\Windows\System32\BABBznT.exeC:\Windows\System32\BABBznT.exe2⤵PID:6568
-
-
C:\Windows\System32\pkHponI.exeC:\Windows\System32\pkHponI.exe2⤵PID:6588
-
-
C:\Windows\System32\MSzXBgQ.exeC:\Windows\System32\MSzXBgQ.exe2⤵PID:6640
-
-
C:\Windows\System32\irWvwKG.exeC:\Windows\System32\irWvwKG.exe2⤵PID:6708
-
-
C:\Windows\System32\CxgVNXs.exeC:\Windows\System32\CxgVNXs.exe2⤵PID:6728
-
-
C:\Windows\System32\tEvQCDv.exeC:\Windows\System32\tEvQCDv.exe2⤵PID:6748
-
-
C:\Windows\System32\moqkHJd.exeC:\Windows\System32\moqkHJd.exe2⤵PID:6768
-
-
C:\Windows\System32\ovYhVvQ.exeC:\Windows\System32\ovYhVvQ.exe2⤵PID:6784
-
-
C:\Windows\System32\nuxaroo.exeC:\Windows\System32\nuxaroo.exe2⤵PID:6804
-
-
C:\Windows\System32\JQIxlTl.exeC:\Windows\System32\JQIxlTl.exe2⤵PID:6824
-
-
C:\Windows\System32\ugoWXcJ.exeC:\Windows\System32\ugoWXcJ.exe2⤵PID:6840
-
-
C:\Windows\System32\xqygLzD.exeC:\Windows\System32\xqygLzD.exe2⤵PID:6900
-
-
C:\Windows\System32\jXFrpGp.exeC:\Windows\System32\jXFrpGp.exe2⤵PID:6944
-
-
C:\Windows\System32\PjRNaQN.exeC:\Windows\System32\PjRNaQN.exe2⤵PID:6984
-
-
C:\Windows\System32\wRpXMBy.exeC:\Windows\System32\wRpXMBy.exe2⤵PID:7024
-
-
C:\Windows\System32\YLomshn.exeC:\Windows\System32\YLomshn.exe2⤵PID:7052
-
-
C:\Windows\System32\iVcCemD.exeC:\Windows\System32\iVcCemD.exe2⤵PID:7068
-
-
C:\Windows\System32\caISNyV.exeC:\Windows\System32\caISNyV.exe2⤵PID:7088
-
-
C:\Windows\System32\BSCngDA.exeC:\Windows\System32\BSCngDA.exe2⤵PID:7116
-
-
C:\Windows\System32\vJBhXsb.exeC:\Windows\System32\vJBhXsb.exe2⤵PID:7132
-
-
C:\Windows\System32\wrfTqdd.exeC:\Windows\System32\wrfTqdd.exe2⤵PID:1796
-
-
C:\Windows\System32\KpEGjGX.exeC:\Windows\System32\KpEGjGX.exe2⤵PID:5932
-
-
C:\Windows\System32\VITNobO.exeC:\Windows\System32\VITNobO.exe2⤵PID:2184
-
-
C:\Windows\System32\JTYSpTz.exeC:\Windows\System32\JTYSpTz.exe2⤵PID:6176
-
-
C:\Windows\System32\EjxNNWs.exeC:\Windows\System32\EjxNNWs.exe2⤵PID:6272
-
-
C:\Windows\System32\qLgfuVY.exeC:\Windows\System32\qLgfuVY.exe2⤵PID:6248
-
-
C:\Windows\System32\JnFMGuK.exeC:\Windows\System32\JnFMGuK.exe2⤵PID:6304
-
-
C:\Windows\System32\thWzBzo.exeC:\Windows\System32\thWzBzo.exe2⤵PID:6456
-
-
C:\Windows\System32\lsWmOUc.exeC:\Windows\System32\lsWmOUc.exe2⤵PID:6532
-
-
C:\Windows\System32\bOpjYRn.exeC:\Windows\System32\bOpjYRn.exe2⤵PID:6616
-
-
C:\Windows\System32\HFTYXSW.exeC:\Windows\System32\HFTYXSW.exe2⤵PID:6580
-
-
C:\Windows\System32\ayWslfw.exeC:\Windows\System32\ayWslfw.exe2⤵PID:6528
-
-
C:\Windows\System32\uXLEMws.exeC:\Windows\System32\uXLEMws.exe2⤵PID:6660
-
-
C:\Windows\System32\GNLDCeH.exeC:\Windows\System32\GNLDCeH.exe2⤵PID:6724
-
-
C:\Windows\System32\bRHfjMW.exeC:\Windows\System32\bRHfjMW.exe2⤵PID:6800
-
-
C:\Windows\System32\cGkTHyR.exeC:\Windows\System32\cGkTHyR.exe2⤵PID:7108
-
-
C:\Windows\System32\OoIJVGC.exeC:\Windows\System32\OoIJVGC.exe2⤵PID:7128
-
-
C:\Windows\System32\zSHUDRw.exeC:\Windows\System32\zSHUDRw.exe2⤵PID:616
-
-
C:\Windows\System32\wkpIxeH.exeC:\Windows\System32\wkpIxeH.exe2⤵PID:3272
-
-
C:\Windows\System32\mAwJSmx.exeC:\Windows\System32\mAwJSmx.exe2⤵PID:5632
-
-
C:\Windows\System32\POyTVpd.exeC:\Windows\System32\POyTVpd.exe2⤵PID:6308
-
-
C:\Windows\System32\unfKeBc.exeC:\Windows\System32\unfKeBc.exe2⤵PID:6596
-
-
C:\Windows\System32\vAudgpv.exeC:\Windows\System32\vAudgpv.exe2⤵PID:6396
-
-
C:\Windows\System32\BFuPQmc.exeC:\Windows\System32\BFuPQmc.exe2⤵PID:6612
-
-
C:\Windows\System32\NyzoZdZ.exeC:\Windows\System32\NyzoZdZ.exe2⤵PID:6648
-
-
C:\Windows\System32\fnFkqTh.exeC:\Windows\System32\fnFkqTh.exe2⤵PID:5020
-
-
C:\Windows\System32\aRkfqnA.exeC:\Windows\System32\aRkfqnA.exe2⤵PID:6764
-
-
C:\Windows\System32\GiWWNqu.exeC:\Windows\System32\GiWWNqu.exe2⤵PID:6512
-
-
C:\Windows\System32\nCgBCGp.exeC:\Windows\System32\nCgBCGp.exe2⤵PID:6736
-
-
C:\Windows\System32\PkWSPfS.exeC:\Windows\System32\PkWSPfS.exe2⤵PID:7188
-
-
C:\Windows\System32\ZCgWmxI.exeC:\Windows\System32\ZCgWmxI.exe2⤵PID:7212
-
-
C:\Windows\System32\yzPZVhJ.exeC:\Windows\System32\yzPZVhJ.exe2⤵PID:7264
-
-
C:\Windows\System32\otOspqq.exeC:\Windows\System32\otOspqq.exe2⤵PID:7312
-
-
C:\Windows\System32\EwNJSDV.exeC:\Windows\System32\EwNJSDV.exe2⤵PID:7336
-
-
C:\Windows\System32\BvPNyXW.exeC:\Windows\System32\BvPNyXW.exe2⤵PID:7352
-
-
C:\Windows\System32\bvQHYKt.exeC:\Windows\System32\bvQHYKt.exe2⤵PID:7372
-
-
C:\Windows\System32\MKHQKpi.exeC:\Windows\System32\MKHQKpi.exe2⤵PID:7388
-
-
C:\Windows\System32\tETrzHP.exeC:\Windows\System32\tETrzHP.exe2⤵PID:7408
-
-
C:\Windows\System32\lVHGqCw.exeC:\Windows\System32\lVHGqCw.exe2⤵PID:7480
-
-
C:\Windows\System32\FAlvUEn.exeC:\Windows\System32\FAlvUEn.exe2⤵PID:7516
-
-
C:\Windows\System32\AzEWqQI.exeC:\Windows\System32\AzEWqQI.exe2⤵PID:7572
-
-
C:\Windows\System32\DbbVnnZ.exeC:\Windows\System32\DbbVnnZ.exe2⤵PID:7592
-
-
C:\Windows\System32\vRKqILN.exeC:\Windows\System32\vRKqILN.exe2⤵PID:7620
-
-
C:\Windows\System32\RnloRwT.exeC:\Windows\System32\RnloRwT.exe2⤵PID:7664
-
-
C:\Windows\System32\aNTSufu.exeC:\Windows\System32\aNTSufu.exe2⤵PID:7692
-
-
C:\Windows\System32\CfdXnkI.exeC:\Windows\System32\CfdXnkI.exe2⤵PID:7708
-
-
C:\Windows\System32\cPQqBht.exeC:\Windows\System32\cPQqBht.exe2⤵PID:7728
-
-
C:\Windows\System32\FFTYWNI.exeC:\Windows\System32\FFTYWNI.exe2⤵PID:7744
-
-
C:\Windows\System32\eWpOhII.exeC:\Windows\System32\eWpOhII.exe2⤵PID:7764
-
-
C:\Windows\System32\kCWtXmN.exeC:\Windows\System32\kCWtXmN.exe2⤵PID:7780
-
-
C:\Windows\System32\bvbLYEY.exeC:\Windows\System32\bvbLYEY.exe2⤵PID:7812
-
-
C:\Windows\System32\qJxdgvR.exeC:\Windows\System32\qJxdgvR.exe2⤵PID:7876
-
-
C:\Windows\System32\XDUHPMk.exeC:\Windows\System32\XDUHPMk.exe2⤵PID:7896
-
-
C:\Windows\System32\CFiImDb.exeC:\Windows\System32\CFiImDb.exe2⤵PID:7916
-
-
C:\Windows\System32\YztYvcv.exeC:\Windows\System32\YztYvcv.exe2⤵PID:7956
-
-
C:\Windows\System32\KNhlxVL.exeC:\Windows\System32\KNhlxVL.exe2⤵PID:7988
-
-
C:\Windows\System32\oUcXotk.exeC:\Windows\System32\oUcXotk.exe2⤵PID:8008
-
-
C:\Windows\System32\fvvQDGD.exeC:\Windows\System32\fvvQDGD.exe2⤵PID:8048
-
-
C:\Windows\System32\uvprdUc.exeC:\Windows\System32\uvprdUc.exe2⤵PID:8112
-
-
C:\Windows\System32\CZvzJSk.exeC:\Windows\System32\CZvzJSk.exe2⤵PID:8128
-
-
C:\Windows\System32\yYradLz.exeC:\Windows\System32\yYradLz.exe2⤵PID:8168
-
-
C:\Windows\System32\zVmdLpC.exeC:\Windows\System32\zVmdLpC.exe2⤵PID:7060
-
-
C:\Windows\System32\ZqsCRuH.exeC:\Windows\System32\ZqsCRuH.exe2⤵PID:7076
-
-
C:\Windows\System32\DNwkKYH.exeC:\Windows\System32\DNwkKYH.exe2⤵PID:6156
-
-
C:\Windows\System32\SSjnYzt.exeC:\Windows\System32\SSjnYzt.exe2⤵PID:6848
-
-
C:\Windows\System32\qvywelx.exeC:\Windows\System32\qvywelx.exe2⤵PID:7292
-
-
C:\Windows\System32\jNsUvji.exeC:\Windows\System32\jNsUvji.exe2⤵PID:7428
-
-
C:\Windows\System32\xCZzzzQ.exeC:\Windows\System32\xCZzzzQ.exe2⤵PID:7384
-
-
C:\Windows\System32\GBMLcjM.exeC:\Windows\System32\GBMLcjM.exe2⤵PID:7468
-
-
C:\Windows\System32\JmNlZuN.exeC:\Windows\System32\JmNlZuN.exe2⤵PID:7568
-
-
C:\Windows\System32\AzUyoKi.exeC:\Windows\System32\AzUyoKi.exe2⤵PID:7640
-
-
C:\Windows\System32\EHgDtXU.exeC:\Windows\System32\EHgDtXU.exe2⤵PID:7776
-
-
C:\Windows\System32\PDSMOUp.exeC:\Windows\System32\PDSMOUp.exe2⤵PID:7756
-
-
C:\Windows\System32\DyBulWA.exeC:\Windows\System32\DyBulWA.exe2⤵PID:7852
-
-
C:\Windows\System32\fDDxybJ.exeC:\Windows\System32\fDDxybJ.exe2⤵PID:7864
-
-
C:\Windows\System32\jjqnJSZ.exeC:\Windows\System32\jjqnJSZ.exe2⤵PID:7924
-
-
C:\Windows\System32\zjgxctS.exeC:\Windows\System32\zjgxctS.exe2⤵PID:8020
-
-
C:\Windows\System32\xaDIopO.exeC:\Windows\System32\xaDIopO.exe2⤵PID:6928
-
-
C:\Windows\System32\pbhAyyR.exeC:\Windows\System32\pbhAyyR.exe2⤵PID:8152
-
-
C:\Windows\System32\CJXjxcp.exeC:\Windows\System32\CJXjxcp.exe2⤵PID:6208
-
-
C:\Windows\System32\cwxSnof.exeC:\Windows\System32\cwxSnof.exe2⤵PID:7196
-
-
C:\Windows\System32\PHBBOYv.exeC:\Windows\System32\PHBBOYv.exe2⤵PID:7236
-
-
C:\Windows\System32\ivzwAlU.exeC:\Windows\System32\ivzwAlU.exe2⤵PID:7400
-
-
C:\Windows\System32\HiayPAN.exeC:\Windows\System32\HiayPAN.exe2⤵PID:7504
-
-
C:\Windows\System32\GcXtJkz.exeC:\Windows\System32\GcXtJkz.exe2⤵PID:7836
-
-
C:\Windows\System32\APmaCae.exeC:\Windows\System32\APmaCae.exe2⤵PID:7888
-
-
C:\Windows\System32\FmFjGhY.exeC:\Windows\System32\FmFjGhY.exe2⤵PID:8164
-
-
C:\Windows\System32\UMehMkp.exeC:\Windows\System32\UMehMkp.exe2⤵PID:7588
-
-
C:\Windows\System32\VBoCZWK.exeC:\Windows\System32\VBoCZWK.exe2⤵PID:8180
-
-
C:\Windows\System32\xEgIVYZ.exeC:\Windows\System32\xEgIVYZ.exe2⤵PID:7912
-
-
C:\Windows\System32\LlCnHxN.exeC:\Windows\System32\LlCnHxN.exe2⤵PID:7996
-
-
C:\Windows\System32\szAxXHm.exeC:\Windows\System32\szAxXHm.exe2⤵PID:8212
-
-
C:\Windows\System32\PRxtywg.exeC:\Windows\System32\PRxtywg.exe2⤵PID:8256
-
-
C:\Windows\System32\BhJzNlp.exeC:\Windows\System32\BhJzNlp.exe2⤵PID:8276
-
-
C:\Windows\System32\LPiriFx.exeC:\Windows\System32\LPiriFx.exe2⤵PID:8300
-
-
C:\Windows\System32\phoHQrQ.exeC:\Windows\System32\phoHQrQ.exe2⤵PID:8320
-
-
C:\Windows\System32\PBKNxFL.exeC:\Windows\System32\PBKNxFL.exe2⤵PID:8356
-
-
C:\Windows\System32\heVLmJC.exeC:\Windows\System32\heVLmJC.exe2⤵PID:8388
-
-
C:\Windows\System32\Alckbgy.exeC:\Windows\System32\Alckbgy.exe2⤵PID:8420
-
-
C:\Windows\System32\aHeCRYM.exeC:\Windows\System32\aHeCRYM.exe2⤵PID:8452
-
-
C:\Windows\System32\QZHksMI.exeC:\Windows\System32\QZHksMI.exe2⤵PID:8476
-
-
C:\Windows\System32\NvFthKN.exeC:\Windows\System32\NvFthKN.exe2⤵PID:8496
-
-
C:\Windows\System32\pTFxJth.exeC:\Windows\System32\pTFxJth.exe2⤵PID:8520
-
-
C:\Windows\System32\imHUuwQ.exeC:\Windows\System32\imHUuwQ.exe2⤵PID:8536
-
-
C:\Windows\System32\iwKHzbP.exeC:\Windows\System32\iwKHzbP.exe2⤵PID:8568
-
-
C:\Windows\System32\qvoBTtD.exeC:\Windows\System32\qvoBTtD.exe2⤵PID:8608
-
-
C:\Windows\System32\nWMBgXC.exeC:\Windows\System32\nWMBgXC.exe2⤵PID:8640
-
-
C:\Windows\System32\qKESazc.exeC:\Windows\System32\qKESazc.exe2⤵PID:8676
-
-
C:\Windows\System32\ERnfHAE.exeC:\Windows\System32\ERnfHAE.exe2⤵PID:8704
-
-
C:\Windows\System32\hpmjqel.exeC:\Windows\System32\hpmjqel.exe2⤵PID:8724
-
-
C:\Windows\System32\luKNrpG.exeC:\Windows\System32\luKNrpG.exe2⤵PID:8748
-
-
C:\Windows\System32\fLPzMyo.exeC:\Windows\System32\fLPzMyo.exe2⤵PID:8772
-
-
C:\Windows\System32\YeSwFvq.exeC:\Windows\System32\YeSwFvq.exe2⤵PID:8808
-
-
C:\Windows\System32\sGnSPCA.exeC:\Windows\System32\sGnSPCA.exe2⤵PID:8836
-
-
C:\Windows\System32\mSZrGIC.exeC:\Windows\System32\mSZrGIC.exe2⤵PID:8876
-
-
C:\Windows\System32\hkYgBEW.exeC:\Windows\System32\hkYgBEW.exe2⤵PID:8900
-
-
C:\Windows\System32\vKanqRw.exeC:\Windows\System32\vKanqRw.exe2⤵PID:8916
-
-
C:\Windows\System32\NeNYEBK.exeC:\Windows\System32\NeNYEBK.exe2⤵PID:8944
-
-
C:\Windows\System32\DprCxsQ.exeC:\Windows\System32\DprCxsQ.exe2⤵PID:8964
-
-
C:\Windows\System32\SVMHgQi.exeC:\Windows\System32\SVMHgQi.exe2⤵PID:8980
-
-
C:\Windows\System32\INWoEmQ.exeC:\Windows\System32\INWoEmQ.exe2⤵PID:8996
-
-
C:\Windows\System32\cZkWaoi.exeC:\Windows\System32\cZkWaoi.exe2⤵PID:9016
-
-
C:\Windows\System32\mOBZmUI.exeC:\Windows\System32\mOBZmUI.exe2⤵PID:9056
-
-
C:\Windows\System32\UJFuMcX.exeC:\Windows\System32\UJFuMcX.exe2⤵PID:9116
-
-
C:\Windows\System32\jiXhmkS.exeC:\Windows\System32\jiXhmkS.exe2⤵PID:9136
-
-
C:\Windows\System32\hTTVpWo.exeC:\Windows\System32\hTTVpWo.exe2⤵PID:9172
-
-
C:\Windows\System32\ydfIAAi.exeC:\Windows\System32\ydfIAAi.exe2⤵PID:9192
-
-
C:\Windows\System32\tQGlZFR.exeC:\Windows\System32\tQGlZFR.exe2⤵PID:9212
-
-
C:\Windows\System32\mCvVXru.exeC:\Windows\System32\mCvVXru.exe2⤵PID:8196
-
-
C:\Windows\System32\bIGenoK.exeC:\Windows\System32\bIGenoK.exe2⤵PID:8328
-
-
C:\Windows\System32\cAksKxq.exeC:\Windows\System32\cAksKxq.exe2⤵PID:8368
-
-
C:\Windows\System32\iPnMKLB.exeC:\Windows\System32\iPnMKLB.exe2⤵PID:8468
-
-
C:\Windows\System32\sSZdpcT.exeC:\Windows\System32\sSZdpcT.exe2⤵PID:8464
-
-
C:\Windows\System32\earEBqf.exeC:\Windows\System32\earEBqf.exe2⤵PID:8656
-
-
C:\Windows\System32\MRlBgJj.exeC:\Windows\System32\MRlBgJj.exe2⤵PID:4676
-
-
C:\Windows\System32\uWKByIJ.exeC:\Windows\System32\uWKByIJ.exe2⤵PID:8716
-
-
C:\Windows\System32\AqrzvRT.exeC:\Windows\System32\AqrzvRT.exe2⤵PID:8804
-
-
C:\Windows\System32\gzTQJKE.exeC:\Windows\System32\gzTQJKE.exe2⤵PID:8856
-
-
C:\Windows\System32\XViLPOd.exeC:\Windows\System32\XViLPOd.exe2⤵PID:8928
-
-
C:\Windows\System32\ltsBcJd.exeC:\Windows\System32\ltsBcJd.exe2⤵PID:8932
-
-
C:\Windows\System32\BKDsbVY.exeC:\Windows\System32\BKDsbVY.exe2⤵PID:9036
-
-
C:\Windows\System32\zuqWjHm.exeC:\Windows\System32\zuqWjHm.exe2⤵PID:9076
-
-
C:\Windows\System32\kbrgIJw.exeC:\Windows\System32\kbrgIJw.exe2⤵PID:9144
-
-
C:\Windows\System32\wlpccHD.exeC:\Windows\System32\wlpccHD.exe2⤵PID:9132
-
-
C:\Windows\System32\ExeJige.exeC:\Windows\System32\ExeJige.exe2⤵PID:9200
-
-
C:\Windows\System32\jOdVPUR.exeC:\Windows\System32\jOdVPUR.exe2⤵PID:8312
-
-
C:\Windows\System32\aSwFcTK.exeC:\Windows\System32\aSwFcTK.exe2⤵PID:8668
-
-
C:\Windows\System32\AXxeIOj.exeC:\Windows\System32\AXxeIOj.exe2⤵PID:8696
-
-
C:\Windows\System32\wcRrPrp.exeC:\Windows\System32\wcRrPrp.exe2⤵PID:8884
-
-
C:\Windows\System32\ZlMSOGW.exeC:\Windows\System32\ZlMSOGW.exe2⤵PID:9152
-
-
C:\Windows\System32\IneUeOe.exeC:\Windows\System32\IneUeOe.exe2⤵PID:8204
-
-
C:\Windows\System32\NwtwdRo.exeC:\Windows\System32\NwtwdRo.exe2⤵PID:8528
-
-
C:\Windows\System32\UYApVOV.exeC:\Windows\System32\UYApVOV.exe2⤵PID:8824
-
-
C:\Windows\System32\IWqkYIt.exeC:\Windows\System32\IWqkYIt.exe2⤵PID:8484
-
-
C:\Windows\System32\nxfTAxD.exeC:\Windows\System32\nxfTAxD.exe2⤵PID:9220
-
-
C:\Windows\System32\PipgQFB.exeC:\Windows\System32\PipgQFB.exe2⤵PID:9244
-
-
C:\Windows\System32\EOFMYJX.exeC:\Windows\System32\EOFMYJX.exe2⤵PID:9264
-
-
C:\Windows\System32\iBgivFe.exeC:\Windows\System32\iBgivFe.exe2⤵PID:9320
-
-
C:\Windows\System32\KnzjYyq.exeC:\Windows\System32\KnzjYyq.exe2⤵PID:9340
-
-
C:\Windows\System32\TfIOMUt.exeC:\Windows\System32\TfIOMUt.exe2⤵PID:9356
-
-
C:\Windows\System32\xVmfmGB.exeC:\Windows\System32\xVmfmGB.exe2⤵PID:9404
-
-
C:\Windows\System32\CGTYRww.exeC:\Windows\System32\CGTYRww.exe2⤵PID:9444
-
-
C:\Windows\System32\vXIoNbr.exeC:\Windows\System32\vXIoNbr.exe2⤵PID:9484
-
-
C:\Windows\System32\NxpkcCj.exeC:\Windows\System32\NxpkcCj.exe2⤵PID:9504
-
-
C:\Windows\System32\JblLMvi.exeC:\Windows\System32\JblLMvi.exe2⤵PID:9520
-
-
C:\Windows\System32\IkSJbbA.exeC:\Windows\System32\IkSJbbA.exe2⤵PID:9544
-
-
C:\Windows\System32\FAsaOtx.exeC:\Windows\System32\FAsaOtx.exe2⤵PID:9564
-
-
C:\Windows\System32\QVxyhin.exeC:\Windows\System32\QVxyhin.exe2⤵PID:9580
-
-
C:\Windows\System32\BNlYonJ.exeC:\Windows\System32\BNlYonJ.exe2⤵PID:9600
-
-
C:\Windows\System32\VpPRmsp.exeC:\Windows\System32\VpPRmsp.exe2⤵PID:9616
-
-
C:\Windows\System32\mqRuFtt.exeC:\Windows\System32\mqRuFtt.exe2⤵PID:9636
-
-
C:\Windows\System32\wYFgmSp.exeC:\Windows\System32\wYFgmSp.exe2⤵PID:9652
-
-
C:\Windows\System32\yOBiLwC.exeC:\Windows\System32\yOBiLwC.exe2⤵PID:9672
-
-
C:\Windows\System32\eILjNPY.exeC:\Windows\System32\eILjNPY.exe2⤵PID:9688
-
-
C:\Windows\System32\ubByhKz.exeC:\Windows\System32\ubByhKz.exe2⤵PID:9708
-
-
C:\Windows\System32\oxfyHAh.exeC:\Windows\System32\oxfyHAh.exe2⤵PID:9796
-
-
C:\Windows\System32\GbmPrQC.exeC:\Windows\System32\GbmPrQC.exe2⤵PID:9836
-
-
C:\Windows\System32\YAGxSuS.exeC:\Windows\System32\YAGxSuS.exe2⤵PID:9856
-
-
C:\Windows\System32\ExadEel.exeC:\Windows\System32\ExadEel.exe2⤵PID:9872
-
-
C:\Windows\System32\wyJetcH.exeC:\Windows\System32\wyJetcH.exe2⤵PID:9896
-
-
C:\Windows\System32\dLteviv.exeC:\Windows\System32\dLteviv.exe2⤵PID:9940
-
-
C:\Windows\System32\LrbxqFG.exeC:\Windows\System32\LrbxqFG.exe2⤵PID:9960
-
-
C:\Windows\System32\uADODNd.exeC:\Windows\System32\uADODNd.exe2⤵PID:10024
-
-
C:\Windows\System32\VYDCHWW.exeC:\Windows\System32\VYDCHWW.exe2⤵PID:10096
-
-
C:\Windows\System32\OPAeMVq.exeC:\Windows\System32\OPAeMVq.exe2⤵PID:10112
-
-
C:\Windows\System32\ppeHjLL.exeC:\Windows\System32\ppeHjLL.exe2⤵PID:10136
-
-
C:\Windows\System32\WgEQMrW.exeC:\Windows\System32\WgEQMrW.exe2⤵PID:10156
-
-
C:\Windows\System32\zUUNayf.exeC:\Windows\System32\zUUNayf.exe2⤵PID:10180
-
-
C:\Windows\System32\UHxsadl.exeC:\Windows\System32\UHxsadl.exe2⤵PID:10196
-
-
C:\Windows\System32\tmoWwtf.exeC:\Windows\System32\tmoWwtf.exe2⤵PID:10232
-
-
C:\Windows\System32\fVoKWDY.exeC:\Windows\System32\fVoKWDY.exe2⤵PID:8988
-
-
C:\Windows\System32\OIwrlco.exeC:\Windows\System32\OIwrlco.exe2⤵PID:2232
-
-
C:\Windows\System32\tdbXbGK.exeC:\Windows\System32\tdbXbGK.exe2⤵PID:9348
-
-
C:\Windows\System32\tLvyYXH.exeC:\Windows\System32\tLvyYXH.exe2⤵PID:9384
-
-
C:\Windows\System32\kewkPdV.exeC:\Windows\System32\kewkPdV.exe2⤵PID:9464
-
-
C:\Windows\System32\bSnsJjO.exeC:\Windows\System32\bSnsJjO.exe2⤵PID:9492
-
-
C:\Windows\System32\gpLSlFf.exeC:\Windows\System32\gpLSlFf.exe2⤵PID:9512
-
-
C:\Windows\System32\yPocyEf.exeC:\Windows\System32\yPocyEf.exe2⤵PID:4316
-
-
C:\Windows\System32\YFXiLAf.exeC:\Windows\System32\YFXiLAf.exe2⤵PID:9608
-
-
C:\Windows\System32\SkbbjbR.exeC:\Windows\System32\SkbbjbR.exe2⤵PID:9592
-
-
C:\Windows\System32\DmTLlYf.exeC:\Windows\System32\DmTLlYf.exe2⤵PID:9824
-
-
C:\Windows\System32\BuLZvfT.exeC:\Windows\System32\BuLZvfT.exe2⤵PID:9884
-
-
C:\Windows\System32\ZQtqQcf.exeC:\Windows\System32\ZQtqQcf.exe2⤵PID:9928
-
-
C:\Windows\System32\HCbvREa.exeC:\Windows\System32\HCbvREa.exe2⤵PID:9968
-
-
C:\Windows\System32\wmMgsNV.exeC:\Windows\System32\wmMgsNV.exe2⤵PID:3916
-
-
C:\Windows\System32\QPhNvrI.exeC:\Windows\System32\QPhNvrI.exe2⤵PID:10108
-
-
C:\Windows\System32\Hlgvpka.exeC:\Windows\System32\Hlgvpka.exe2⤵PID:10144
-
-
C:\Windows\System32\vVHqbtn.exeC:\Windows\System32\vVHqbtn.exe2⤵PID:9272
-
-
C:\Windows\System32\qleJeuD.exeC:\Windows\System32\qleJeuD.exe2⤵PID:9428
-
-
C:\Windows\System32\kMmMvcD.exeC:\Windows\System32\kMmMvcD.exe2⤵PID:9556
-
-
C:\Windows\System32\heRXguq.exeC:\Windows\System32\heRXguq.exe2⤵PID:9540
-
-
C:\Windows\System32\FtfmHJS.exeC:\Windows\System32\FtfmHJS.exe2⤵PID:9588
-
-
C:\Windows\System32\QOBvjGi.exeC:\Windows\System32\QOBvjGi.exe2⤵PID:9868
-
-
C:\Windows\System32\QmWYWXT.exeC:\Windows\System32\QmWYWXT.exe2⤵PID:10052
-
-
C:\Windows\System32\rNZYUOr.exeC:\Windows\System32\rNZYUOr.exe2⤵PID:9684
-
-
C:\Windows\System32\lffAToB.exeC:\Windows\System32\lffAToB.exe2⤵PID:9376
-
-
C:\Windows\System32\yswGmoZ.exeC:\Windows\System32\yswGmoZ.exe2⤵PID:4964
-
-
C:\Windows\System32\bvdDJZM.exeC:\Windows\System32\bvdDJZM.exe2⤵PID:10132
-
-
C:\Windows\System32\ymgMCPY.exeC:\Windows\System32\ymgMCPY.exe2⤵PID:10224
-
-
C:\Windows\System32\WDCSLkw.exeC:\Windows\System32\WDCSLkw.exe2⤵PID:4184
-
-
C:\Windows\System32\eBpRJSm.exeC:\Windows\System32\eBpRJSm.exe2⤵PID:9988
-
-
C:\Windows\System32\yivtCXE.exeC:\Windows\System32\yivtCXE.exe2⤵PID:4352
-
-
C:\Windows\System32\aEsWxrm.exeC:\Windows\System32\aEsWxrm.exe2⤵PID:10248
-
-
C:\Windows\System32\vNQTYuz.exeC:\Windows\System32\vNQTYuz.exe2⤵PID:10268
-
-
C:\Windows\System32\lEByEqp.exeC:\Windows\System32\lEByEqp.exe2⤵PID:10364
-
-
C:\Windows\System32\kAHIrXE.exeC:\Windows\System32\kAHIrXE.exe2⤵PID:10432
-
-
C:\Windows\System32\TlQRHcP.exeC:\Windows\System32\TlQRHcP.exe2⤵PID:10448
-
-
C:\Windows\System32\hheiple.exeC:\Windows\System32\hheiple.exe2⤵PID:10464
-
-
C:\Windows\System32\XjAOLKP.exeC:\Windows\System32\XjAOLKP.exe2⤵PID:10488
-
-
C:\Windows\System32\pwnqaaV.exeC:\Windows\System32\pwnqaaV.exe2⤵PID:10508
-
-
C:\Windows\System32\xDKfHIl.exeC:\Windows\System32\xDKfHIl.exe2⤵PID:10524
-
-
C:\Windows\System32\WUexxHn.exeC:\Windows\System32\WUexxHn.exe2⤵PID:10544
-
-
C:\Windows\System32\cTyHyyz.exeC:\Windows\System32\cTyHyyz.exe2⤵PID:10564
-
-
C:\Windows\System32\sufbYjO.exeC:\Windows\System32\sufbYjO.exe2⤵PID:10628
-
-
C:\Windows\System32\nyOvGie.exeC:\Windows\System32\nyOvGie.exe2⤵PID:10648
-
-
C:\Windows\System32\THfpBxB.exeC:\Windows\System32\THfpBxB.exe2⤵PID:10716
-
-
C:\Windows\System32\VecRWYX.exeC:\Windows\System32\VecRWYX.exe2⤵PID:10764
-
-
C:\Windows\System32\ajElVmt.exeC:\Windows\System32\ajElVmt.exe2⤵PID:10780
-
-
C:\Windows\System32\gWHLAfj.exeC:\Windows\System32\gWHLAfj.exe2⤵PID:10800
-
-
C:\Windows\System32\jWjXrBP.exeC:\Windows\System32\jWjXrBP.exe2⤵PID:10840
-
-
C:\Windows\System32\OsGPUDf.exeC:\Windows\System32\OsGPUDf.exe2⤵PID:10888
-
-
C:\Windows\System32\xVeczuf.exeC:\Windows\System32\xVeczuf.exe2⤵PID:10904
-
-
C:\Windows\System32\AgGLaDR.exeC:\Windows\System32\AgGLaDR.exe2⤵PID:10920
-
-
C:\Windows\System32\sOTnboT.exeC:\Windows\System32\sOTnboT.exe2⤵PID:10936
-
-
C:\Windows\System32\ybaETru.exeC:\Windows\System32\ybaETru.exe2⤵PID:10952
-
-
C:\Windows\System32\EIJTqrF.exeC:\Windows\System32\EIJTqrF.exe2⤵PID:10972
-
-
C:\Windows\System32\tOpBDBG.exeC:\Windows\System32\tOpBDBG.exe2⤵PID:11052
-
-
C:\Windows\System32\aolTDSL.exeC:\Windows\System32\aolTDSL.exe2⤵PID:11080
-
-
C:\Windows\System32\DgKFVGR.exeC:\Windows\System32\DgKFVGR.exe2⤵PID:11100
-
-
C:\Windows\System32\XWqocaQ.exeC:\Windows\System32\XWqocaQ.exe2⤵PID:11120
-
-
C:\Windows\System32\YzTkrpJ.exeC:\Windows\System32\YzTkrpJ.exe2⤵PID:11136
-
-
C:\Windows\System32\HgQyytu.exeC:\Windows\System32\HgQyytu.exe2⤵PID:11152
-
-
C:\Windows\System32\eJhJcjj.exeC:\Windows\System32\eJhJcjj.exe2⤵PID:11168
-
-
C:\Windows\System32\MVlYbvE.exeC:\Windows\System32\MVlYbvE.exe2⤵PID:11220
-
-
C:\Windows\System32\hMrrKGG.exeC:\Windows\System32\hMrrKGG.exe2⤵PID:9904
-
-
C:\Windows\System32\OwmieqB.exeC:\Windows\System32\OwmieqB.exe2⤵PID:10320
-
-
C:\Windows\System32\OlmmvSy.exeC:\Windows\System32\OlmmvSy.exe2⤵PID:10300
-
-
C:\Windows\System32\fodyGCP.exeC:\Windows\System32\fodyGCP.exe2⤵PID:10404
-
-
C:\Windows\System32\yQbmbbN.exeC:\Windows\System32\yQbmbbN.exe2⤵PID:10604
-
-
C:\Windows\System32\JvlGOQi.exeC:\Windows\System32\JvlGOQi.exe2⤵PID:10640
-
-
C:\Windows\System32\whEWrCe.exeC:\Windows\System32\whEWrCe.exe2⤵PID:10500
-
-
C:\Windows\System32\IzViDkV.exeC:\Windows\System32\IzViDkV.exe2⤵PID:10700
-
-
C:\Windows\System32\dPHqBcf.exeC:\Windows\System32\dPHqBcf.exe2⤵PID:10808
-
-
C:\Windows\System32\tLJHpRa.exeC:\Windows\System32\tLJHpRa.exe2⤵PID:10752
-
-
C:\Windows\System32\QVbpPGh.exeC:\Windows\System32\QVbpPGh.exe2⤵PID:10832
-
-
C:\Windows\System32\vMURMcW.exeC:\Windows\System32\vMURMcW.exe2⤵PID:10860
-
-
C:\Windows\System32\RSUOVAb.exeC:\Windows\System32\RSUOVAb.exe2⤵PID:10980
-
-
C:\Windows\System32\qNMXhDi.exeC:\Windows\System32\qNMXhDi.exe2⤵PID:10896
-
-
C:\Windows\System32\nduSwVj.exeC:\Windows\System32\nduSwVj.exe2⤵PID:11064
-
-
C:\Windows\System32\wYDeUtU.exeC:\Windows\System32\wYDeUtU.exe2⤵PID:11072
-
-
C:\Windows\System32\XRWiQbc.exeC:\Windows\System32\XRWiQbc.exe2⤵PID:11176
-
-
C:\Windows\System32\mtsFjZJ.exeC:\Windows\System32\mtsFjZJ.exe2⤵PID:11160
-
-
C:\Windows\System32\oWupeeh.exeC:\Windows\System32\oWupeeh.exe2⤵PID:11116
-
-
C:\Windows\System32\lfBGlsw.exeC:\Windows\System32\lfBGlsw.exe2⤵PID:11256
-
-
C:\Windows\System32\ztFKxcz.exeC:\Windows\System32\ztFKxcz.exe2⤵PID:4376
-
-
C:\Windows\System32\UaSJRHM.exeC:\Windows\System32\UaSJRHM.exe2⤵PID:3792
-
-
C:\Windows\System32\MSjLeSL.exeC:\Windows\System32\MSjLeSL.exe2⤵PID:10172
-
-
C:\Windows\System32\ivciYDa.exeC:\Windows\System32\ivciYDa.exe2⤵PID:10360
-
-
C:\Windows\System32\fKuvCzj.exeC:\Windows\System32\fKuvCzj.exe2⤵PID:10256
-
-
C:\Windows\System32\ovtdpdw.exeC:\Windows\System32\ovtdpdw.exe2⤵PID:4804
-
-
C:\Windows\System32\qLHbPkU.exeC:\Windows\System32\qLHbPkU.exe2⤵PID:10932
-
-
C:\Windows\System32\oONxYGL.exeC:\Windows\System32\oONxYGL.exe2⤵PID:11088
-
-
C:\Windows\System32\XSNXRLW.exeC:\Windows\System32\XSNXRLW.exe2⤵PID:10420
-
-
C:\Windows\System32\eeKQNCj.exeC:\Windows\System32\eeKQNCj.exe2⤵PID:11036
-
-
C:\Windows\System32\NaEiVkw.exeC:\Windows\System32\NaEiVkw.exe2⤵PID:10724
-
-
C:\Windows\System32\kDdKuws.exeC:\Windows\System32\kDdKuws.exe2⤵PID:10520
-
-
C:\Windows\System32\yQMYNEa.exeC:\Windows\System32\yQMYNEa.exe2⤵PID:11272
-
-
C:\Windows\System32\DDDIVDX.exeC:\Windows\System32\DDDIVDX.exe2⤵PID:11288
-
-
C:\Windows\System32\scUeyPe.exeC:\Windows\System32\scUeyPe.exe2⤵PID:11304
-
-
C:\Windows\System32\ukJnvuV.exeC:\Windows\System32\ukJnvuV.exe2⤵PID:11388
-
-
C:\Windows\System32\nTLUqYn.exeC:\Windows\System32\nTLUqYn.exe2⤵PID:11408
-
-
C:\Windows\System32\ZsoiizM.exeC:\Windows\System32\ZsoiizM.exe2⤵PID:11488
-
-
C:\Windows\System32\tRFvBZA.exeC:\Windows\System32\tRFvBZA.exe2⤵PID:11560
-
-
C:\Windows\System32\AUIUFfb.exeC:\Windows\System32\AUIUFfb.exe2⤵PID:11576
-
-
C:\Windows\System32\uFdnGgV.exeC:\Windows\System32\uFdnGgV.exe2⤵PID:11596
-
-
C:\Windows\System32\KHLmVBR.exeC:\Windows\System32\KHLmVBR.exe2⤵PID:11612
-
-
C:\Windows\System32\gJUXlWA.exeC:\Windows\System32\gJUXlWA.exe2⤵PID:11628
-
-
C:\Windows\System32\tUtRACH.exeC:\Windows\System32\tUtRACH.exe2⤵PID:11652
-
-
C:\Windows\System32\jPTSMtE.exeC:\Windows\System32\jPTSMtE.exe2⤵PID:11672
-
-
C:\Windows\System32\qZDJyIE.exeC:\Windows\System32\qZDJyIE.exe2⤵PID:11700
-
-
C:\Windows\System32\twROLVE.exeC:\Windows\System32\twROLVE.exe2⤵PID:11772
-
-
C:\Windows\System32\ZmQsCzz.exeC:\Windows\System32\ZmQsCzz.exe2⤵PID:11788
-
-
C:\Windows\System32\irxvfwD.exeC:\Windows\System32\irxvfwD.exe2⤵PID:11808
-
-
C:\Windows\System32\hNeJLQQ.exeC:\Windows\System32\hNeJLQQ.exe2⤵PID:11832
-
-
C:\Windows\System32\AdygbMO.exeC:\Windows\System32\AdygbMO.exe2⤵PID:11888
-
-
C:\Windows\System32\TjsKfqh.exeC:\Windows\System32\TjsKfqh.exe2⤵PID:11932
-
-
C:\Windows\System32\XMzjJeQ.exeC:\Windows\System32\XMzjJeQ.exe2⤵PID:11996
-
-
C:\Windows\System32\oTXrwVj.exeC:\Windows\System32\oTXrwVj.exe2⤵PID:12012
-
-
C:\Windows\System32\FwIZFNR.exeC:\Windows\System32\FwIZFNR.exe2⤵PID:12032
-
-
C:\Windows\System32\PaOSBop.exeC:\Windows\System32\PaOSBop.exe2⤵PID:12048
-
-
C:\Windows\System32\mGAIBqv.exeC:\Windows\System32\mGAIBqv.exe2⤵PID:12092
-
-
C:\Windows\System32\SYLJHcG.exeC:\Windows\System32\SYLJHcG.exe2⤵PID:12124
-
-
C:\Windows\System32\jGYBrhC.exeC:\Windows\System32\jGYBrhC.exe2⤵PID:12140
-
-
C:\Windows\System32\pLDbaFp.exeC:\Windows\System32\pLDbaFp.exe2⤵PID:12156
-
-
C:\Windows\System32\UVxNukG.exeC:\Windows\System32\UVxNukG.exe2⤵PID:12176
-
-
C:\Windows\System32\jWjvGns.exeC:\Windows\System32\jWjvGns.exe2⤵PID:12196
-
-
C:\Windows\System32\dBmhpQh.exeC:\Windows\System32\dBmhpQh.exe2⤵PID:12212
-
-
C:\Windows\System32\lUJnHKz.exeC:\Windows\System32\lUJnHKz.exe2⤵PID:12228
-
-
C:\Windows\System32\IVHyCxI.exeC:\Windows\System32\IVHyCxI.exe2⤵PID:12260
-
-
C:\Windows\System32\xsLeHVY.exeC:\Windows\System32\xsLeHVY.exe2⤵PID:12276
-
-
C:\Windows\System32\vxwvLpR.exeC:\Windows\System32\vxwvLpR.exe2⤵PID:10348
-
-
C:\Windows\System32\CvpAodU.exeC:\Windows\System32\CvpAodU.exe2⤵PID:11132
-
-
C:\Windows\System32\izXBhnH.exeC:\Windows\System32\izXBhnH.exe2⤵PID:10776
-
-
C:\Windows\System32\UrgQZoK.exeC:\Windows\System32\UrgQZoK.exe2⤵PID:11416
-
-
C:\Windows\System32\YslRUDh.exeC:\Windows\System32\YslRUDh.exe2⤵PID:11476
-
-
C:\Windows\System32\lDxUNOI.exeC:\Windows\System32\lDxUNOI.exe2⤵PID:11572
-
-
C:\Windows\System32\uvphBgO.exeC:\Windows\System32\uvphBgO.exe2⤵PID:11688
-
-
C:\Windows\System32\CqSYMcc.exeC:\Windows\System32\CqSYMcc.exe2⤵PID:11852
-
-
C:\Windows\System32\kFKrmeY.exeC:\Windows\System32\kFKrmeY.exe2⤵PID:11840
-
-
C:\Windows\System32\WDCorZF.exeC:\Windows\System32\WDCorZF.exe2⤵PID:11896
-
-
C:\Windows\System32\ZVGsnhE.exeC:\Windows\System32\ZVGsnhE.exe2⤵PID:11964
-
-
C:\Windows\System32\OCbHsvZ.exeC:\Windows\System32\OCbHsvZ.exe2⤵PID:12004
-
-
C:\Windows\System32\HCOfjuQ.exeC:\Windows\System32\HCOfjuQ.exe2⤵PID:12192
-
-
C:\Windows\System32\qNRXtRZ.exeC:\Windows\System32\qNRXtRZ.exe2⤵PID:12116
-
-
C:\Windows\System32\QflHKKy.exeC:\Windows\System32\QflHKKy.exe2⤵PID:11180
-
-
C:\Windows\System32\rdBmHjo.exeC:\Windows\System32\rdBmHjo.exe2⤵PID:12244
-
-
C:\Windows\System32\rnmrjsE.exeC:\Windows\System32\rnmrjsE.exe2⤵PID:11504
-
-
C:\Windows\System32\DlaQegV.exeC:\Windows\System32\DlaQegV.exe2⤵PID:11608
-
-
C:\Windows\System32\zgmivUm.exeC:\Windows\System32\zgmivUm.exe2⤵PID:11400
-
-
C:\Windows\System32\ORKapGe.exeC:\Windows\System32\ORKapGe.exe2⤵PID:11844
-
-
C:\Windows\System32\VtaCoJQ.exeC:\Windows\System32\VtaCoJQ.exe2⤵PID:10444
-
-
C:\Windows\System32\zkRaeUX.exeC:\Windows\System32\zkRaeUX.exe2⤵PID:12028
-
-
C:\Windows\System32\IpURSbU.exeC:\Windows\System32\IpURSbU.exe2⤵PID:12088
-
-
C:\Windows\System32\JDDDDoc.exeC:\Windows\System32\JDDDDoc.exe2⤵PID:9660
-
-
C:\Windows\System32\VLfmdjH.exeC:\Windows\System32\VLfmdjH.exe2⤵PID:11588
-
-
C:\Windows\System32\wHDOSfu.exeC:\Windows\System32\wHDOSfu.exe2⤵PID:11828
-
-
C:\Windows\System32\HTJnUyl.exeC:\Windows\System32\HTJnUyl.exe2⤵PID:11348
-
-
C:\Windows\System32\nUDQhwG.exeC:\Windows\System32\nUDQhwG.exe2⤵PID:11508
-
-
C:\Windows\System32\UiUCPVS.exeC:\Windows\System32\UiUCPVS.exe2⤵PID:12292
-
-
C:\Windows\System32\plbIyeK.exeC:\Windows\System32\plbIyeK.exe2⤵PID:12312
-
-
C:\Windows\System32\HqZpolJ.exeC:\Windows\System32\HqZpolJ.exe2⤵PID:12332
-
-
C:\Windows\System32\shiDjNM.exeC:\Windows\System32\shiDjNM.exe2⤵PID:12348
-
-
C:\Windows\System32\SEyPJPh.exeC:\Windows\System32\SEyPJPh.exe2⤵PID:12368
-
-
C:\Windows\System32\hasBuNc.exeC:\Windows\System32\hasBuNc.exe2⤵PID:12384
-
-
C:\Windows\System32\RWqfKRG.exeC:\Windows\System32\RWqfKRG.exe2⤵PID:12448
-
-
C:\Windows\System32\SoIBZOB.exeC:\Windows\System32\SoIBZOB.exe2⤵PID:12468
-
-
C:\Windows\System32\puxraHb.exeC:\Windows\System32\puxraHb.exe2⤵PID:12608
-
-
C:\Windows\System32\dEDvhyB.exeC:\Windows\System32\dEDvhyB.exe2⤵PID:12624
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5af8dacf6408e6494765a9283c5088fd4
SHA1a7ed24b6ffa39f2768378896a8f761216709dc49
SHA2569fa67d60f8b24c98b3cc43ab4645598658b5532579b74c8810b259023ebc356a
SHA5121420a91dcda726d8bce5e12c09b8a805878076591e2e5601c32c6a01d64ba8f6cb754a7e545154784260218cc44ebcfb6434f118afaad4af8ef6871448134c70
-
Filesize
1.3MB
MD57342cfed69af1fcdb1ae6142763898aa
SHA13238d0f18fc67f18bc8d1bd031b192bdd5b2d2a9
SHA256fda02db0d4a560d770cf2a163bdf3c3b19e104ce50fa3ef329c43310e05e6efc
SHA512b03ac660509decb3489b03f121c79a5b53537f738515b3bd23acda12821ae17af990dca1da19540b9908958a11dbd6caca17d05b97d1242efa081c990c066c67
-
Filesize
1.3MB
MD595d4280225d20d18a5fa7feff43add6b
SHA1734e548ccf03c4fc78fe85bd4ec14028bd13ca3c
SHA256b34724d2518c113768b91388712ecc59dc3cd793a2bd9c8ce8e256860ab7125f
SHA5125ba49fa3c4421224794f65bedaf7087827c5c0d68736a631fe90064d205b3a7f73820f8772ef23e024d7dd8aef406e7a741cae5e1088749ab7cd5e26eba5f93f
-
Filesize
1.3MB
MD550ff697f7f557cd01ac522fc49193e68
SHA15e0068f75d41fc7b48d88725d06a3123636d692a
SHA2563b6baa305d852702cf1b631f0d77bf0df79d55f410ef993fde09d73a2416fc94
SHA512bd9d18abd96435872a804674b9d06d603f045e298265a7b4b74d50f2083bde1eb8be9a0570872064f9ca4c2c1ade43b6ee70f7a334ff201bdf93442f6046e417
-
Filesize
1.3MB
MD549e2454650e39c726279a3340bf9c2c1
SHA1009d68fba111c8ab64a2785be48806663819f52b
SHA2563803e64a568fd184793f2b9e529a934bd0a8e3af3d14dfcc045acbb4e981841e
SHA51230f5567c49bb87d8075f575c306eae399fab9f45e7d51ffccb51c5f3afadfc8546f8914c7066640e0b5092640d4e675228219b8e402bb83b59201948d5e4fd9d
-
Filesize
1.3MB
MD587f2053a769224d38a93c57b4db9f5ef
SHA1c279db223ec795f9867794bd80e177d43bdb9582
SHA256454f4020382221239c8669c54e614b8ee0ecddbd751852b1c5abd1d068f5cb87
SHA5129e761c8d4d458e0964d811efa3af9dd5328d98754d61204555a0f90ec2564b5b52634d1f1d4c572a5d4d84c8033a50aa64be7936ef2d41f7505c8b112b8cbdd7
-
Filesize
1.3MB
MD5a482d308c4736ebdb0d50a3f27ce4588
SHA179f40a69d22814c002a8a17eacbfb4f890ca731a
SHA2567b1ee3f408702c7130242e983510af652e45283af5bef86ee0d6e303d49c2288
SHA512a50c5335161d112abac399f7e8a1c0ace96e82345e9561ad23c95f1a6505b392f4d825694580de53f8150d5e5c840192a98ea9fadedb1f615e5a858c49054ea6
-
Filesize
1.3MB
MD59f5c789ba93313900985f55501d3eeba
SHA1b8f4c65f2f9e8afc0c55ba13d0352fb96331632c
SHA256945eb375dfb0b73492fecc572c60507c28b22c4412d2bb09b78691a57981287d
SHA512b89605a8c48e4019d3644fe19fcc2627e41e736191aa196cc95ea63a3e20156c052b90185f46a9e360a1171991239c9e0c2390bdb3f820ea79520057ab4ccc9f
-
Filesize
1.3MB
MD55dce057b525f580551ac39648728995e
SHA13ca21f4b436ec243aa9ad6f9428e2276d7427fe1
SHA25642210aab498fd62bac52865d97d0750bbee7468b0ba682e2d254fff96c62df31
SHA512363212e173f210e5709b972996094a3dd93d6819af37fba647ae3fe74c284f32cb92b31ee94d3b80904d9392f49affc2d16b600b4a8560bfd9ca4b29c8e285a8
-
Filesize
1.3MB
MD500193ee7148ca1356a3da471acd19d7e
SHA114814aa759becc1037bcd7bc3268495c3954db79
SHA256df6c00f437c5bf0ed9bdb7f52e28e170685bebc0cc190020aa1878c5b255959b
SHA51224988b98b5793068c1b82a8487a48db555e17ff010589a969f305b11304abed32f70aef9a32ea3b45cf486695efa4e200124373c8c725a6ae13af279dc12591c
-
Filesize
1.3MB
MD50e6db0507892021662de822a002394e5
SHA1e15fd256a59f899f6afe7c82cb1364f14528a3ab
SHA2560ec230112aa6d904c9ae5b13d2a78a6bcd6bb916d17c430d09aa48874ace850c
SHA512b112dfc15b50bc5d16337ac2bb345f8a6ae04d6f0d8d99f679e24d5642c7e3396b15baf74ddbba81b2f3a33ffb3a6b511f4d88c96fa1aa3fb821625cfc4d62f5
-
Filesize
1.3MB
MD54129f6905e4e89bab45845068f1f0d9c
SHA16b115f80907ec13536c104eb29a802b4dd4d2411
SHA25655f06065b7e25292c8aaa4a0324103dcf94d1408143ce830b3eb5762741831d9
SHA512e61a043c08a692a037c6514b29d5da43e1ef23d05c5f8ac35ab3d3f5f582b27c81ca24344a141d6690b8791d9f1404d77cdad125372ba6dcb597ca39b124a02d
-
Filesize
1.3MB
MD51de9bf8b54d7de82061e85f70a2076fd
SHA10edd14400bee92969b60aacb2abe95e4dd5bbfa8
SHA2565da7ec663fbd460107ff768085e7cd33a7e678b099a0289cdfe9081b06ebbfdc
SHA512c0f87a8e8e05e677fb19ed3f9ef77e76d392cb19a6762cc901398d2ed31b0a574806668e597448e3c064ea0fed12f318d4ede557f9d6a97b7ff538b921bea83f
-
Filesize
1.3MB
MD5fdc5b061bd3d65086a31a9bf3fd674e4
SHA1100680e0f077f0385a65feb83f1870b0226b0c5e
SHA2569435c63522d8bbda595d979acaddb85e103e6238754f497185b93897ff5e8fed
SHA512f19d9f481c8fe3759b9a8ba5de06a088171d1d8bd4c18796046e07ce5ebfef5386c2702c04b9bed52c8784cd35f057d644404b83b417452f4a9173abf7877501
-
Filesize
1.3MB
MD5c253d80f238878879d21e0a26e8136ec
SHA1f1144e1cf940fd9d04651eaa750cfa122b03b2a2
SHA256f11f678dc5025654a394e05a9292b4bdfbe197b95692062f0939de860aa67bc5
SHA512af4e0676af9b331204df554df6ca1074d996512f12a0c8ab4a3bbe726322a09606f103bff45474769c551ff3bfef3fecc09e54e57f9ec20a9be4791f044526a0
-
Filesize
1.3MB
MD52e16181c994b884638288f552054b435
SHA10786e743e5d3a469a8e3ad2c1837e40c58c91ac1
SHA25625e36d7e6d215be149e8ef56b5ce44d482dae97bd42e7028911150623e7d2cd7
SHA5126cdb89d30825c5f8f8b978b7435fa8b073f7780eb4fe0c2530328de9c091227cdf881765e357891c85c2b6b1906182e718637c7cb92524abbabc44f2a3f65f70
-
Filesize
1.3MB
MD5cc88d3c3858c7c9c13f00119095983c8
SHA1cefda237cce7c552080a619622f570547caa92eb
SHA256a603f95c8e470a72b1570df274387f5cb9b0a361d3c58aff7f59568721690d21
SHA5125039c8e03889e9232c3c91d1c549a6f38ccd2c3e5d011a8b88d723f5dc7422a9337619f14b3dfe5ae16066773790ab10a0e263d1b0a705a97169b84a4146bb75
-
Filesize
1.3MB
MD570a997f2c99d4ffaeedb0e4709c2d40b
SHA16734e1757f667ec1d78c4835948c4768c315ff0d
SHA256f0e8584741d1a5729bfa070b182abb0fa222b1924e269361e00dcbcc331cfe13
SHA512ea63ca7e646b3c4fe934eacc42c146c4e29be30d21ff4e5879db00665af94ef23b17fef5c2c23b022e3bcd1197e7ecc1a453c3642d64f568128622494998f221
-
Filesize
1.3MB
MD5faa4acc533add426bb50140f4f87c75d
SHA18d7c082e2c867d18da29b45d182f9334a77a127c
SHA2562a5178b64944536ad67d9fb55689d091b608193a006cfbecb5716972634be152
SHA51217dbfb01a859cfde629bc5fb86569e0a18ecc6c7b9efadcab8c6f3e13655e009250ea6889f5304a7a07b6c735cf6fd853d2010a84304e362011da2e1ce47c773
-
Filesize
1.3MB
MD50629e32f3cf1b8f5e2f68b3388a67e8a
SHA185648356dbdd0089eaf421fc6560453975b1bf36
SHA256a745fd0df66774891076f30867b778146dae6b04f6f1835ee82c71c4be5a7cb5
SHA5127c1c86a3c5e99b0e649877d41772213cbca3d1c85ad2be3687c45dda40c783e6b2d2e65c22e743bfcf4970f72be6e85684c9cf8eeee474028538d46878ab0f4e
-
Filesize
1.3MB
MD5e6f33daef466d4f8628a80233e3a61d2
SHA1e22c23177710e68e530ce774f68a7f7671620df3
SHA256a6588f02022c88ea67f5b0cd76b2d0046c0604ea8de3c4dc8584f8e8dbdf17fe
SHA512274791e1999c24f22fd8c11155545154dec0025297725bfba91db7667275361b20801629cfb9c09dac587137159e4d8b5034714c9f02f3a0dfcd7cfcea50848c
-
Filesize
1.3MB
MD58bd1a0b4fbb79531eadf0cba9c4aeeba
SHA16613acc21cf2abe63c3d0d6277179dd4d2cfebc0
SHA2560659a1269cce41ef34296ec3a6762965890c1f21baa4760da2613b1358c1940c
SHA51226e086b9ff4ce5bb08514066ca7a27d45237f474c13e220c7549e419af0f94e1a087fe4e4edd6c6a7a59087588645bbdbc95d123306d92f6c91644605eeed61b
-
Filesize
1.3MB
MD5f50127b24715525a19086858b8331253
SHA13da4b25daae1b00a1e7fd94fd03f41610287e472
SHA256c5dcfbc01d1ee289943237cc5b9cde03114488f7d7963dc031f8cb309cbfe769
SHA51261a4867983c7ca2c6f23609840a78b0b6453df4e5f835c07801db872f661f21cb4bc42ca0068bf1a24bbbcf4d26d2ee7a2c66b4285dcdf07c6b5a1035c5f47bb
-
Filesize
1.3MB
MD516ef305a41f9e09e96efdd424dc3df6e
SHA114178a43ba6f44af960bbdb70530a63ce6b2def7
SHA2565c1afa52607d2b597be1ee72f84d0d474be33c50c995848a369eaab6d72ced01
SHA5127f5ea343fb3dbd658d4b747ef241374c57d34706ba564ac35e5b0f60e6edbe007135c0a4268de680b799c7bcd6cac730b37c3908656638e47bc6f28113073dd9
-
Filesize
1.3MB
MD5dd2430765a33803e304d09b8ef95fc6f
SHA14079180a779c4d865fefcdf1e80f1a7f10817eec
SHA2566c3d91d318cf91252fa38ebb8c051bdc7bb8f61ae47957bcfa458a1a6d95f1fb
SHA512397a36508e4cbf127185b8af3defca0e2e38ef338feb23baa1ff39fcd289e0103303a5ce8950a8e2c3c3d64f1c2bbf1345defd73d6aa4f83905e23c982d59287
-
Filesize
1.3MB
MD5f59153686e39c37645d32b00e6846a1b
SHA183609270a7121ce3421e7174156ed5b16cac4c0f
SHA256bc1214b16f03667042aa33a894ca2939ab577effc40e34820a5825aede25a125
SHA512a2865252e53467393529b307ee30d14d8a7d4ca64e91f272a2f8ace2dbe02b0e039352aa924b799c7ccb5daf0c65ad6c93edaca8998aa10e16ca850c64fdd6d6
-
Filesize
1.3MB
MD5c2026e1b148f208ce64ae3fbf52aaecf
SHA183b4b0a5f6886edff720d42db5fca1c9150f7915
SHA2566ca83f3b2b76ffd2bbd12919e835b3924030eab31672b503639d8b7ff77d98f5
SHA512c95fcd9c61d1bd34e339ab3633210a753fd09dd25f323638fe48892f828e32605989031b1c47604fa19c793c153fd0bbb9b8543118a9aaa29c5396ee09db6a2a
-
Filesize
1.3MB
MD54d400b82c9ed0389171984e5a1bcfa5b
SHA1b4fc22e305baab73f5280ed60b6f1c0f87761ccd
SHA25684715301f6554a8a56d9782cf2c26b8efa3dfd6b4aa87f6e4692241048ea6297
SHA51257085df22a75dced379dc663cf151c4dd72195703465d7e31893661fe0006e90db47069d9cb712958174e65bb6d898fbf217a32e0c83e3d0a188f0e3bfed3098
-
Filesize
1.3MB
MD591e0e5413ff13fcbf7118e70479bfa5d
SHA1898214e05108cd57a1a99bc6fd3e3d347fd82176
SHA2563e52e18054f1b85d628af2fb4ef84e8da68b970b5c37ac5964d4c47c511998da
SHA5129d9687afe85d05d4ecdedc3c215fc1baf06f9a8cf640b156bb7f0fecb8f5b306b63adcb75e4fc85ad46ab7fb5cc85663d9abccc7ce64762d3c26bb730f6d2c7d
-
Filesize
1.3MB
MD57e31179725821440f78702822e50c9d7
SHA17e02b0ac983635a42eb42d35270dfb270c551f59
SHA256e1d2182ab96eac76b8dcd8363c30ea10a3b6b6a791581fe62186154f1fe87d99
SHA51281a7fdff1cbd7029688970498140ce7490f144b0e3d1583a952208f2248186e321ce72eeb1173f44d43253ecdc30e0ff538971d9ad8d3289d618e5fc3ddd8884
-
Filesize
1.3MB
MD55359b8abc0d6c36e9f8050f8c1171c91
SHA1670228183b02adb6487b1b299ae34a481480867c
SHA256a1e5c9c8b15fe772f26c47fdbc385cd197962d6171d138b0428dcc96126231ba
SHA512770de8bd000a06ef1d20cb2c140c02bf23ee853633a1674c6089b681587d61c875a232c22c687bcb5eec9c46f276eb96136dbbbe764f0ec6811f32a0967500b8
-
Filesize
1.3MB
MD5b1878618e452358d11da3f7125bac3fd
SHA1ea15a9020220abf17cf0199e81814107470419c3
SHA2569c0fd979396cc95244c9c549c437d89d08b7d6643ffedd80e7d3da7c46545829
SHA512a729d87eec5e054a11e9e631ee923a6bea47737dd0acff30fb1259b3be60de027a50acfabba05e71346807e141851f46d9e38558e097d1144340886289c549b6