xmrig | 75e3cf3ec5eb6937b920b3c5385fce9f52a21dac4362ea0786a5ad027b6d24bf

Analysis

max time kernel
94s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
Size

1.0MB
MD5

013bafef8bef879a32490c699794ec36
SHA1

76319fe86083cf913f3d713d8347c814daaa9329
SHA256

75e3cf3ec5eb6937b920b3c5385fce9f52a21dac4362ea0786a5ad027b6d24bf
SHA512

e9e280dc168d9158170b38b1e916e33685a0eee904d4e50b0dced189b309b4000574b7a0db136ca3fc522fb02abd1397fc1e4c440ba31357ba67975afcfdb47c
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcmC3f/DFNkTwHlZM:knw9oUUEEDl37jcmWH/h8

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/2220-361-0x00007FF6268D0000-0x00007FF626CC1000-memory.dmp	xmrig
behavioral2/memory/3944-371-0x00007FF6EE5D0000-0x00007FF6EE9C1000-memory.dmp	xmrig
behavioral2/memory/4176-399-0x00007FF6E5B50000-0x00007FF6E5F41000-memory.dmp	xmrig
behavioral2/memory/5104-415-0x00007FF612930000-0x00007FF612D21000-memory.dmp	xmrig
behavioral2/memory/5084-413-0x00007FF74F0B0000-0x00007FF74F4A1000-memory.dmp	xmrig
behavioral2/memory/4064-427-0x00007FF61E6B0000-0x00007FF61EAA1000-memory.dmp	xmrig
behavioral2/memory/3432-408-0x00007FF78E9C0000-0x00007FF78EDB1000-memory.dmp	xmrig
behavioral2/memory/3204-396-0x00007FF6106C0000-0x00007FF610AB1000-memory.dmp	xmrig
behavioral2/memory/3504-386-0x00007FF7A2D30000-0x00007FF7A3121000-memory.dmp	xmrig
behavioral2/memory/3364-370-0x00007FF662B40000-0x00007FF662F31000-memory.dmp	xmrig
behavioral2/memory/3328-437-0x00007FF72D770000-0x00007FF72DB61000-memory.dmp	xmrig
behavioral2/memory/4104-439-0x00007FF76F040000-0x00007FF76F431000-memory.dmp	xmrig
behavioral2/memory/2208-441-0x00007FF7C87C0000-0x00007FF7C8BB1000-memory.dmp	xmrig
behavioral2/memory/2448-455-0x00007FF7A62F0000-0x00007FF7A66E1000-memory.dmp	xmrig
behavioral2/memory/4516-461-0x00007FF77F740000-0x00007FF77FB31000-memory.dmp	xmrig
behavioral2/memory/1600-478-0x00007FF6E3DE0000-0x00007FF6E41D1000-memory.dmp	xmrig
behavioral2/memory/3556-472-0x00007FF7D3050000-0x00007FF7D3441000-memory.dmp	xmrig
behavioral2/memory/2392-471-0x00007FF7549A0000-0x00007FF754D91000-memory.dmp	xmrig
behavioral2/memory/2124-466-0x00007FF751480000-0x00007FF751871000-memory.dmp	xmrig
behavioral2/memory/1840-463-0x00007FF76A0E0000-0x00007FF76A4D1000-memory.dmp	xmrig
behavioral2/memory/780-1970-0x00007FF7578E0000-0x00007FF757CD1000-memory.dmp	xmrig
behavioral2/memory/2368-1971-0x00007FF752D40000-0x00007FF753131000-memory.dmp	xmrig
behavioral2/memory/972-1973-0x00007FF7F3DE0000-0x00007FF7F41D1000-memory.dmp	xmrig
behavioral2/memory/2884-2005-0x00007FF64F6E0000-0x00007FF64FAD1000-memory.dmp	xmrig
behavioral2/memory/780-2011-0x00007FF7578E0000-0x00007FF757CD1000-memory.dmp	xmrig
behavioral2/memory/972-2013-0x00007FF7F3DE0000-0x00007FF7F41D1000-memory.dmp	xmrig
behavioral2/memory/2012-2016-0x00007FF616F20000-0x00007FF617311000-memory.dmp	xmrig
behavioral2/memory/2884-2017-0x00007FF64F6E0000-0x00007FF64FAD1000-memory.dmp	xmrig
behavioral2/memory/2220-2020-0x00007FF6268D0000-0x00007FF626CC1000-memory.dmp	xmrig
behavioral2/memory/3556-2025-0x00007FF7D3050000-0x00007FF7D3441000-memory.dmp	xmrig
behavioral2/memory/3944-2027-0x00007FF6EE5D0000-0x00007FF6EE9C1000-memory.dmp	xmrig
behavioral2/memory/3504-2029-0x00007FF7A2D30000-0x00007FF7A3121000-memory.dmp	xmrig
behavioral2/memory/1600-2024-0x00007FF6E3DE0000-0x00007FF6E41D1000-memory.dmp	xmrig
behavioral2/memory/3364-2021-0x00007FF662B40000-0x00007FF662F31000-memory.dmp	xmrig
behavioral2/memory/2392-2037-0x00007FF7549A0000-0x00007FF754D91000-memory.dmp	xmrig
behavioral2/memory/3204-2034-0x00007FF6106C0000-0x00007FF610AB1000-memory.dmp	xmrig
behavioral2/memory/5104-2064-0x00007FF612930000-0x00007FF612D21000-memory.dmp	xmrig
behavioral2/memory/3328-2061-0x00007FF72D770000-0x00007FF72DB61000-memory.dmp	xmrig
behavioral2/memory/4104-2059-0x00007FF76F040000-0x00007FF76F431000-memory.dmp	xmrig
behavioral2/memory/2448-2056-0x00007FF7A62F0000-0x00007FF7A66E1000-memory.dmp	xmrig
behavioral2/memory/4516-2052-0x00007FF77F740000-0x00007FF77FB31000-memory.dmp	xmrig
behavioral2/memory/3432-2043-0x00007FF78E9C0000-0x00007FF78EDB1000-memory.dmp	xmrig
behavioral2/memory/5084-2041-0x00007FF74F0B0000-0x00007FF74F4A1000-memory.dmp	xmrig
behavioral2/memory/4064-2063-0x00007FF61E6B0000-0x00007FF61EAA1000-memory.dmp	xmrig
behavioral2/memory/2124-2038-0x00007FF751480000-0x00007FF751871000-memory.dmp	xmrig
behavioral2/memory/2208-2055-0x00007FF7C87C0000-0x00007FF7C8BB1000-memory.dmp	xmrig
behavioral2/memory/1840-2050-0x00007FF76A0E0000-0x00007FF76A4D1000-memory.dmp	xmrig
behavioral2/memory/4176-2032-0x00007FF6E5B50000-0x00007FF6E5F41000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
780	Iurcxxg.exe
972	gFDeRbA.exe
2012	sPPNsbY.exe
2884	RHnlNqh.exe
3556	JYkrYPv.exe
1600	ApwNpna.exe
2220	VlJoNrd.exe
3364	JOPReFI.exe
3944	WCnHfzc.exe
3504	XIiLLvY.exe
3204	fOryflT.exe
4176	cZJduaV.exe
3432	RKszrJQ.exe
5084	neCupoc.exe
5104	uiRUkSH.exe
4064	tTISsPW.exe
3328	wFanfoL.exe
4104	hmZsWvR.exe
2208	GKpYZTk.exe
2448	KWVpyDW.exe
4516	gJJjGIV.exe
1840	gPddjVl.exe
2124	UvJJLqy.exe
2392	jZdHYjp.exe
4512	hkVCGGE.exe
4572	dRpaNpB.exe
1816	LtkncPE.exe
2656	cAuJCvq.exe
3656	iwPczgK.exe
3304	FTiNviF.exe
4072	MueMQRf.exe
1140	lHxyiCQ.exe
688	OZPvJdy.exe
4068	HBIKMYw.exe
4244	PDPuTkV.exe
3952	thzCLhc.exe
1612	EhsJsgs.exe
1552	xxrZlwe.exe
3584	HVBptzN.exe
4008	MJfwLsj.exe
3088	bNnjqys.exe
2596	BbkJTks.exe
4216	sVtffXi.exe
3896	nagNrYu.exe
1908	spwfFRj.exe
3108	eIiCevG.exe
4936	SKjfaue.exe
3068	AOAWPoU.exe
2040	prZtbRK.exe
4460	EvzZdAI.exe
3808	xPHydGy.exe
1184	GidWgMX.exe
3984	JrQYbVj.exe
4716	lhKojuv.exe
4956	QgzROQy.exe
1148	hBWPSGT.exe
2868	dGIqqYd.exe
4612	Afpudpt.exe
4564	AjYilzv.exe
1952	KFYVWVs.exe
2668	xMEcZsh.exe
4484	xUMcWXo.exe
2972	vDvplTQ.exe
816	pifCjvi.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2368-0-0x00007FF752D40000-0x00007FF753131000-memory.dmp	upx
behavioral2/files/0x000f000000023b5f-5.dat	upx
behavioral2/files/0x000a000000023b73-10.dat	upx
behavioral2/files/0x000a000000023b74-16.dat	upx
behavioral2/files/0x000a000000023b76-27.dat	upx
behavioral2/memory/2012-29-0x00007FF616F20000-0x00007FF617311000-memory.dmp	upx
behavioral2/files/0x000a000000023b77-33.dat	upx
behavioral2/files/0x000a000000023b78-40.dat	upx
behavioral2/files/0x000a000000023b79-43.dat	upx
behavioral2/files/0x000a000000023b7b-55.dat	upx
behavioral2/files/0x000a000000023b7c-60.dat	upx
behavioral2/files/0x000a000000023b81-83.dat	upx
behavioral2/files/0x000a000000023b85-103.dat	upx
behavioral2/files/0x000a000000023b87-116.dat	upx
behavioral2/files/0x000a000000023b8a-128.dat	upx
behavioral2/files/0x000a000000023b91-165.dat	upx
behavioral2/memory/2220-361-0x00007FF6268D0000-0x00007FF626CC1000-memory.dmp	upx
behavioral2/memory/3944-371-0x00007FF6EE5D0000-0x00007FF6EE9C1000-memory.dmp	upx
behavioral2/memory/4176-399-0x00007FF6E5B50000-0x00007FF6E5F41000-memory.dmp	upx
behavioral2/memory/5104-415-0x00007FF612930000-0x00007FF612D21000-memory.dmp	upx
behavioral2/memory/5084-413-0x00007FF74F0B0000-0x00007FF74F4A1000-memory.dmp	upx
behavioral2/memory/4064-427-0x00007FF61E6B0000-0x00007FF61EAA1000-memory.dmp	upx
behavioral2/memory/3432-408-0x00007FF78E9C0000-0x00007FF78EDB1000-memory.dmp	upx
behavioral2/memory/3204-396-0x00007FF6106C0000-0x00007FF610AB1000-memory.dmp	upx
behavioral2/memory/3504-386-0x00007FF7A2D30000-0x00007FF7A3121000-memory.dmp	upx
behavioral2/memory/3364-370-0x00007FF662B40000-0x00007FF662F31000-memory.dmp	upx
behavioral2/files/0x000a000000023b90-160.dat	upx
behavioral2/files/0x000a000000023b8f-156.dat	upx
behavioral2/files/0x000a000000023b8e-150.dat	upx
behavioral2/files/0x000a000000023b8d-146.dat	upx
behavioral2/files/0x000a000000023b8c-140.dat	upx
behavioral2/files/0x000a000000023b8b-135.dat	upx
behavioral2/files/0x000a000000023b89-125.dat	upx
behavioral2/files/0x000a000000023b88-120.dat	upx
behavioral2/files/0x000a000000023b86-110.dat	upx
behavioral2/files/0x000a000000023b84-100.dat	upx
behavioral2/files/0x000a000000023b83-96.dat	upx
behavioral2/files/0x000a000000023b82-90.dat	upx
behavioral2/files/0x000a000000023b80-80.dat	upx
behavioral2/files/0x000a000000023b7f-75.dat	upx
behavioral2/files/0x000a000000023b7e-71.dat	upx
behavioral2/files/0x000a000000023b7d-65.dat	upx
behavioral2/files/0x000a000000023b7a-50.dat	upx
behavioral2/files/0x000a000000023b75-23.dat	upx
behavioral2/memory/2884-22-0x00007FF64F6E0000-0x00007FF64FAD1000-memory.dmp	upx
behavioral2/memory/972-18-0x00007FF7F3DE0000-0x00007FF7F41D1000-memory.dmp	upx
behavioral2/memory/780-11-0x00007FF7578E0000-0x00007FF757CD1000-memory.dmp	upx
behavioral2/memory/3328-437-0x00007FF72D770000-0x00007FF72DB61000-memory.dmp	upx
behavioral2/memory/4104-439-0x00007FF76F040000-0x00007FF76F431000-memory.dmp	upx
behavioral2/memory/2208-441-0x00007FF7C87C0000-0x00007FF7C8BB1000-memory.dmp	upx
behavioral2/memory/2448-455-0x00007FF7A62F0000-0x00007FF7A66E1000-memory.dmp	upx
behavioral2/memory/4516-461-0x00007FF77F740000-0x00007FF77FB31000-memory.dmp	upx
behavioral2/memory/1600-478-0x00007FF6E3DE0000-0x00007FF6E41D1000-memory.dmp	upx
behavioral2/memory/3556-472-0x00007FF7D3050000-0x00007FF7D3441000-memory.dmp	upx
behavioral2/memory/2392-471-0x00007FF7549A0000-0x00007FF754D91000-memory.dmp	upx
behavioral2/memory/2124-466-0x00007FF751480000-0x00007FF751871000-memory.dmp	upx
behavioral2/memory/1840-463-0x00007FF76A0E0000-0x00007FF76A4D1000-memory.dmp	upx
behavioral2/memory/780-1970-0x00007FF7578E0000-0x00007FF757CD1000-memory.dmp	upx
behavioral2/memory/2368-1971-0x00007FF752D40000-0x00007FF753131000-memory.dmp	upx
behavioral2/memory/972-1973-0x00007FF7F3DE0000-0x00007FF7F41D1000-memory.dmp	upx
behavioral2/memory/2884-2005-0x00007FF64F6E0000-0x00007FF64FAD1000-memory.dmp	upx
behavioral2/memory/780-2011-0x00007FF7578E0000-0x00007FF757CD1000-memory.dmp	upx
behavioral2/memory/972-2013-0x00007FF7F3DE0000-0x00007FF7F41D1000-memory.dmp	upx
behavioral2/memory/2012-2016-0x00007FF616F20000-0x00007FF617311000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\ZGsmzbM.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\HzMheeO.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\lGUGZoD.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\VuIrxkU.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\tILOHCw.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\XyDOXvg.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\TeYHdex.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\vflLFzw.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\ZOstMvL.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\EqEJkPL.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\JXfvPyO.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\GEFrIre.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\oxGSmXT.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\jezNVhi.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\AOAWPoU.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\mNPypIB.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\wxEmMPU.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\rVsQpIf.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\cDeVcHE.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\vsEjJIC.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\KXWCwAE.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\HBIKMYw.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\HYufaYT.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\hiXskNj.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\cHYuhvP.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\UvJJLqy.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\DuPzSFT.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\kgSCTIc.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\YqvgXFj.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\nqUxQvR.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\iDVdkDn.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\RSkGGxa.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\CAWOskO.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\yBHDyan.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\PxUAmjx.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\PEemDJb.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\ChZZLiL.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\AjxCqHn.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\blUWmUH.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\gCRaOhj.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\VzdAMwN.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\wNtYSIJ.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\RSMCnGP.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\cujdJik.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\NgDRGvj.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\OZPvJdy.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\JrQYbVj.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\DsJPoLo.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\aJfEKSq.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\MKmBlqM.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\NMbZWAi.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\PxJjfcC.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\hkVCGGE.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\ettQsTj.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\iYhooZL.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\NXkBfZS.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\EbNscMa.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\jbmJojG.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\kUakkKT.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\tugCqJS.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\mKXFQhX.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\QJYHCDs.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\hIdMBUI.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
File created	C:\Windows\System32\WlbBalj.exe	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 780	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	84
PID 2368 wrote to memory of 780	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	84
PID 2368 wrote to memory of 972	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	85
PID 2368 wrote to memory of 972	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	85
PID 2368 wrote to memory of 2012	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	86
PID 2368 wrote to memory of 2012	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	86
PID 2368 wrote to memory of 2884	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	87
PID 2368 wrote to memory of 2884	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	87
PID 2368 wrote to memory of 3556	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	88
PID 2368 wrote to memory of 3556	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	88
PID 2368 wrote to memory of 1600	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	89
PID 2368 wrote to memory of 1600	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	89
PID 2368 wrote to memory of 2220	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	90
PID 2368 wrote to memory of 2220	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	90
PID 2368 wrote to memory of 3364	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	91
PID 2368 wrote to memory of 3364	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	91
PID 2368 wrote to memory of 3944	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	92
PID 2368 wrote to memory of 3944	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	92
PID 2368 wrote to memory of 3504	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	93
PID 2368 wrote to memory of 3504	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	93
PID 2368 wrote to memory of 3204	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	94
PID 2368 wrote to memory of 3204	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	94
PID 2368 wrote to memory of 4176	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	95
PID 2368 wrote to memory of 4176	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	95
PID 2368 wrote to memory of 3432	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	96
PID 2368 wrote to memory of 3432	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	96
PID 2368 wrote to memory of 5084	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	97
PID 2368 wrote to memory of 5084	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	97
PID 2368 wrote to memory of 5104	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	98
PID 2368 wrote to memory of 5104	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	98
PID 2368 wrote to memory of 4064	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	99
PID 2368 wrote to memory of 4064	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	99
PID 2368 wrote to memory of 3328	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	100
PID 2368 wrote to memory of 3328	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	100
PID 2368 wrote to memory of 4104	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	101
PID 2368 wrote to memory of 4104	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	101
PID 2368 wrote to memory of 2208	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	102
PID 2368 wrote to memory of 2208	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	102
PID 2368 wrote to memory of 2448	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	103
PID 2368 wrote to memory of 2448	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	103
PID 2368 wrote to memory of 4516	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	104
PID 2368 wrote to memory of 4516	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	104
PID 2368 wrote to memory of 1840	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	105
PID 2368 wrote to memory of 1840	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	105
PID 2368 wrote to memory of 2124	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	106
PID 2368 wrote to memory of 2124	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	106
PID 2368 wrote to memory of 2392	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	107
PID 2368 wrote to memory of 2392	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	107
PID 2368 wrote to memory of 4512	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	108
PID 2368 wrote to memory of 4512	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	108
PID 2368 wrote to memory of 4572	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	109
PID 2368 wrote to memory of 4572	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	109
PID 2368 wrote to memory of 1816	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	110
PID 2368 wrote to memory of 1816	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	110
PID 2368 wrote to memory of 2656	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	111
PID 2368 wrote to memory of 2656	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	111
PID 2368 wrote to memory of 3656	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	112
PID 2368 wrote to memory of 3656	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	112
PID 2368 wrote to memory of 3304	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	113
PID 2368 wrote to memory of 3304	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	113
PID 2368 wrote to memory of 4072	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	114
PID 2368 wrote to memory of 4072	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	114
PID 2368 wrote to memory of 1140	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	115
PID 2368 wrote to memory of 1140	2368	013bafef8bef879a32490c699794ec36_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\013bafef8bef879a32490c699794ec36_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\013bafef8bef879a32490c699794ec36_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\System32\Iurcxxg.exe
  C:\Windows\System32\Iurcxxg.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System32\gFDeRbA.exe
  C:\Windows\System32\gFDeRbA.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System32\sPPNsbY.exe
  C:\Windows\System32\sPPNsbY.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System32\RHnlNqh.exe
  C:\Windows\System32\RHnlNqh.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System32\JYkrYPv.exe
  C:\Windows\System32\JYkrYPv.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System32\ApwNpna.exe
  C:\Windows\System32\ApwNpna.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System32\VlJoNrd.exe
  C:\Windows\System32\VlJoNrd.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System32\JOPReFI.exe
  C:\Windows\System32\JOPReFI.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System32\WCnHfzc.exe
  C:\Windows\System32\WCnHfzc.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System32\XIiLLvY.exe
  C:\Windows\System32\XIiLLvY.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System32\fOryflT.exe
  C:\Windows\System32\fOryflT.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System32\cZJduaV.exe
  C:\Windows\System32\cZJduaV.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System32\RKszrJQ.exe
  C:\Windows\System32\RKszrJQ.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System32\neCupoc.exe
  C:\Windows\System32\neCupoc.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System32\uiRUkSH.exe
  C:\Windows\System32\uiRUkSH.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System32\tTISsPW.exe
  C:\Windows\System32\tTISsPW.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System32\wFanfoL.exe
  C:\Windows\System32\wFanfoL.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System32\hmZsWvR.exe
  C:\Windows\System32\hmZsWvR.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System32\GKpYZTk.exe
  C:\Windows\System32\GKpYZTk.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System32\KWVpyDW.exe
  C:\Windows\System32\KWVpyDW.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System32\gJJjGIV.exe
  C:\Windows\System32\gJJjGIV.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System32\gPddjVl.exe
  C:\Windows\System32\gPddjVl.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System32\UvJJLqy.exe
  C:\Windows\System32\UvJJLqy.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System32\jZdHYjp.exe
  C:\Windows\System32\jZdHYjp.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System32\hkVCGGE.exe
  C:\Windows\System32\hkVCGGE.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System32\dRpaNpB.exe
  C:\Windows\System32\dRpaNpB.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System32\LtkncPE.exe
  C:\Windows\System32\LtkncPE.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System32\cAuJCvq.exe
  C:\Windows\System32\cAuJCvq.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System32\iwPczgK.exe
  C:\Windows\System32\iwPczgK.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System32\FTiNviF.exe
  C:\Windows\System32\FTiNviF.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System32\MueMQRf.exe
  C:\Windows\System32\MueMQRf.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System32\lHxyiCQ.exe
  C:\Windows\System32\lHxyiCQ.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System32\OZPvJdy.exe
  C:\Windows\System32\OZPvJdy.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System32\HBIKMYw.exe
  C:\Windows\System32\HBIKMYw.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System32\PDPuTkV.exe
  C:\Windows\System32\PDPuTkV.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System32\thzCLhc.exe
  C:\Windows\System32\thzCLhc.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System32\EhsJsgs.exe
  C:\Windows\System32\EhsJsgs.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System32\xxrZlwe.exe
  C:\Windows\System32\xxrZlwe.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System32\HVBptzN.exe
  C:\Windows\System32\HVBptzN.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System32\MJfwLsj.exe
  C:\Windows\System32\MJfwLsj.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System32\bNnjqys.exe
  C:\Windows\System32\bNnjqys.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System32\BbkJTks.exe
  C:\Windows\System32\BbkJTks.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System32\sVtffXi.exe
  C:\Windows\System32\sVtffXi.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System32\nagNrYu.exe
  C:\Windows\System32\nagNrYu.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System32\spwfFRj.exe
  C:\Windows\System32\spwfFRj.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System32\eIiCevG.exe
  C:\Windows\System32\eIiCevG.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System32\SKjfaue.exe
  C:\Windows\System32\SKjfaue.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System32\AOAWPoU.exe
  C:\Windows\System32\AOAWPoU.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System32\prZtbRK.exe
  C:\Windows\System32\prZtbRK.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System32\EvzZdAI.exe
  C:\Windows\System32\EvzZdAI.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System32\xPHydGy.exe
  C:\Windows\System32\xPHydGy.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System32\GidWgMX.exe
  C:\Windows\System32\GidWgMX.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System32\JrQYbVj.exe
  C:\Windows\System32\JrQYbVj.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System32\lhKojuv.exe
  C:\Windows\System32\lhKojuv.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System32\QgzROQy.exe
  C:\Windows\System32\QgzROQy.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System32\hBWPSGT.exe
  C:\Windows\System32\hBWPSGT.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System32\dGIqqYd.exe
  C:\Windows\System32\dGIqqYd.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System32\Afpudpt.exe
  C:\Windows\System32\Afpudpt.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System32\AjYilzv.exe
  C:\Windows\System32\AjYilzv.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System32\KFYVWVs.exe
  C:\Windows\System32\KFYVWVs.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System32\xMEcZsh.exe
  C:\Windows\System32\xMEcZsh.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System32\xUMcWXo.exe
  C:\Windows\System32\xUMcWXo.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System32\vDvplTQ.exe
  C:\Windows\System32\vDvplTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System32\pifCjvi.exe
  C:\Windows\System32\pifCjvi.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System32\jSSEesE.exe
  C:\Windows\System32\jSSEesE.exe
  2⤵
  PID:4692
- C:\Windows\System32\ettQsTj.exe
  C:\Windows\System32\ettQsTj.exe
  2⤵
  PID:1300
- C:\Windows\System32\KZWlrHn.exe
  C:\Windows\System32\KZWlrHn.exe
  2⤵
  PID:744
- C:\Windows\System32\MCnBMoe.exe
  C:\Windows\System32\MCnBMoe.exe
  2⤵
  PID:2556
- C:\Windows\System32\nQzvIls.exe
  C:\Windows\System32\nQzvIls.exe
  2⤵
  PID:4156
- C:\Windows\System32\PxUAmjx.exe
  C:\Windows\System32\PxUAmjx.exe
  2⤵
  PID:1948
- C:\Windows\System32\NjjbJSs.exe
  C:\Windows\System32\NjjbJSs.exe
  2⤵
  PID:4336
- C:\Windows\System32\hJkqTjX.exe
  C:\Windows\System32\hJkqTjX.exe
  2⤵
  PID:1440
- C:\Windows\System32\AVfuvkg.exe
  C:\Windows\System32\AVfuvkg.exe
  2⤵
  PID:1856
- C:\Windows\System32\pmzgtQg.exe
  C:\Windows\System32\pmzgtQg.exe
  2⤵
  PID:4052
- C:\Windows\System32\VReIvlx.exe
  C:\Windows\System32\VReIvlx.exe
  2⤵
  PID:4800
- C:\Windows\System32\MqUWyJG.exe
  C:\Windows\System32\MqUWyJG.exe
  2⤵
  PID:4804
- C:\Windows\System32\caXEnfj.exe
  C:\Windows\System32\caXEnfj.exe
  2⤵
  PID:2340
- C:\Windows\System32\hUaeUFS.exe
  C:\Windows\System32\hUaeUFS.exe
  2⤵
  PID:5108
- C:\Windows\System32\HYufaYT.exe
  C:\Windows\System32\HYufaYT.exe
  2⤵
  PID:5096
- C:\Windows\System32\EdIcJbm.exe
  C:\Windows\System32\EdIcJbm.exe
  2⤵
  PID:3148
- C:\Windows\System32\vflLFzw.exe
  C:\Windows\System32\vflLFzw.exe
  2⤵
  PID:1540
- C:\Windows\System32\ZSHYXsx.exe
  C:\Windows\System32\ZSHYXsx.exe
  2⤵
  PID:4400
- C:\Windows\System32\OxXcYrL.exe
  C:\Windows\System32\OxXcYrL.exe
  2⤵
  PID:5088
- C:\Windows\System32\UsDiZzp.exe
  C:\Windows\System32\UsDiZzp.exe
  2⤵
  PID:4828
- C:\Windows\System32\gwzsOPe.exe
  C:\Windows\System32\gwzsOPe.exe
  2⤵
  PID:3272
- C:\Windows\System32\otxnydS.exe
  C:\Windows\System32\otxnydS.exe
  2⤵
  PID:3964
- C:\Windows\System32\JzoxWuW.exe
  C:\Windows\System32\JzoxWuW.exe
  2⤵
  PID:1124
- C:\Windows\System32\gkOrofZ.exe
  C:\Windows\System32\gkOrofZ.exe
  2⤵
  PID:1744
- C:\Windows\System32\lwpdwsZ.exe
  C:\Windows\System32\lwpdwsZ.exe
  2⤵
  PID:5032
- C:\Windows\System32\KTAqaJE.exe
  C:\Windows\System32\KTAqaJE.exe
  2⤵
  PID:1576
- C:\Windows\System32\PVNkLCE.exe
  C:\Windows\System32\PVNkLCE.exe
  2⤵
  PID:4960
- C:\Windows\System32\ZsJqoLQ.exe
  C:\Windows\System32\ZsJqoLQ.exe
  2⤵
  PID:4580
- C:\Windows\System32\WESnxwe.exe
  C:\Windows\System32\WESnxwe.exe
  2⤵
  PID:5072
- C:\Windows\System32\BvbFAQl.exe
  C:\Windows\System32\BvbFAQl.exe
  2⤵
  PID:4368
- C:\Windows\System32\KFreHrY.exe
  C:\Windows\System32\KFreHrY.exe
  2⤵
  PID:4164
- C:\Windows\System32\xMcVgcI.exe
  C:\Windows\System32\xMcVgcI.exe
  2⤵
  PID:4964
- C:\Windows\System32\MusNXaW.exe
  C:\Windows\System32\MusNXaW.exe
  2⤵
  PID:2744
- C:\Windows\System32\GblTYST.exe
  C:\Windows\System32\GblTYST.exe
  2⤵
  PID:3824
- C:\Windows\System32\BtZEzrZ.exe
  C:\Windows\System32\BtZEzrZ.exe
  2⤵
  PID:2964
- C:\Windows\System32\PEemDJb.exe
  C:\Windows\System32\PEemDJb.exe
  2⤵
  PID:4556
- C:\Windows\System32\ChZZLiL.exe
  C:\Windows\System32\ChZZLiL.exe
  2⤵
  PID:2748
- C:\Windows\System32\ZaFRjuJ.exe
  C:\Windows\System32\ZaFRjuJ.exe
  2⤵
  PID:2328
- C:\Windows\System32\dlTTpSp.exe
  C:\Windows\System32\dlTTpSp.exe
  2⤵
  PID:2920
- C:\Windows\System32\BVzLPBC.exe
  C:\Windows\System32\BVzLPBC.exe
  2⤵
  PID:3764
- C:\Windows\System32\yyDwZeY.exe
  C:\Windows\System32\yyDwZeY.exe
  2⤵
  PID:5140
- C:\Windows\System32\ygSSxpS.exe
  C:\Windows\System32\ygSSxpS.exe
  2⤵
  PID:5160
- C:\Windows\System32\liCtzkD.exe
  C:\Windows\System32\liCtzkD.exe
  2⤵
  PID:5180
- C:\Windows\System32\EeugejU.exe
  C:\Windows\System32\EeugejU.exe
  2⤵
  PID:5200
- C:\Windows\System32\IjaqCFG.exe
  C:\Windows\System32\IjaqCFG.exe
  2⤵
  PID:5216
- C:\Windows\System32\ZBTVcPh.exe
  C:\Windows\System32\ZBTVcPh.exe
  2⤵
  PID:5236
- C:\Windows\System32\SkObJGV.exe
  C:\Windows\System32\SkObJGV.exe
  2⤵
  PID:5260
- C:\Windows\System32\yMQfctm.exe
  C:\Windows\System32\yMQfctm.exe
  2⤵
  PID:5344
- C:\Windows\System32\cZyapiX.exe
  C:\Windows\System32\cZyapiX.exe
  2⤵
  PID:5368
- C:\Windows\System32\hVFfHYo.exe
  C:\Windows\System32\hVFfHYo.exe
  2⤵
  PID:5432
- C:\Windows\System32\egQAeox.exe
  C:\Windows\System32\egQAeox.exe
  2⤵
  PID:5516
- C:\Windows\System32\PxaggCt.exe
  C:\Windows\System32\PxaggCt.exe
  2⤵
  PID:5532
- C:\Windows\System32\LFIlrML.exe
  C:\Windows\System32\LFIlrML.exe
  2⤵
  PID:5568
- C:\Windows\System32\NDJbPYS.exe
  C:\Windows\System32\NDJbPYS.exe
  2⤵
  PID:5596
- C:\Windows\System32\LbGskXT.exe
  C:\Windows\System32\LbGskXT.exe
  2⤵
  PID:5616
- C:\Windows\System32\QGyALNf.exe
  C:\Windows\System32\QGyALNf.exe
  2⤵
  PID:5668
- C:\Windows\System32\zSxELxM.exe
  C:\Windows\System32\zSxELxM.exe
  2⤵
  PID:5692
- C:\Windows\System32\blteiZm.exe
  C:\Windows\System32\blteiZm.exe
  2⤵
  PID:5732
- C:\Windows\System32\werLPHC.exe
  C:\Windows\System32\werLPHC.exe
  2⤵
  PID:5748
- C:\Windows\System32\hvrBAgo.exe
  C:\Windows\System32\hvrBAgo.exe
  2⤵
  PID:5776
- C:\Windows\System32\WJuxcCR.exe
  C:\Windows\System32\WJuxcCR.exe
  2⤵
  PID:5804
- C:\Windows\System32\veJTewI.exe
  C:\Windows\System32\veJTewI.exe
  2⤵
  PID:5840
- C:\Windows\System32\krShuWb.exe
  C:\Windows\System32\krShuWb.exe
  2⤵
  PID:5856
- C:\Windows\System32\LDwkppM.exe
  C:\Windows\System32\LDwkppM.exe
  2⤵
  PID:5876
- C:\Windows\System32\ajpvwLg.exe
  C:\Windows\System32\ajpvwLg.exe
  2⤵
  PID:5904
- C:\Windows\System32\DYNaaXr.exe
  C:\Windows\System32\DYNaaXr.exe
  2⤵
  PID:5920
- C:\Windows\System32\ghUhVoT.exe
  C:\Windows\System32\ghUhVoT.exe
  2⤵
  PID:5960
- C:\Windows\System32\GngaNpA.exe
  C:\Windows\System32\GngaNpA.exe
  2⤵
  PID:6008
- C:\Windows\System32\MbFzrEd.exe
  C:\Windows\System32\MbFzrEd.exe
  2⤵
  PID:6028
- C:\Windows\System32\vvZItfY.exe
  C:\Windows\System32\vvZItfY.exe
  2⤵
  PID:6044
- C:\Windows\System32\gqVVHzp.exe
  C:\Windows\System32\gqVVHzp.exe
  2⤵
  PID:6076
- C:\Windows\System32\zrAHpGD.exe
  C:\Windows\System32\zrAHpGD.exe
  2⤵
  PID:3676
- C:\Windows\System32\ucjGgMy.exe
  C:\Windows\System32\ucjGgMy.exe
  2⤵
  PID:5136
- C:\Windows\System32\InDGHJG.exe
  C:\Windows\System32\InDGHJG.exe
  2⤵
  PID:5176
- C:\Windows\System32\ZGsmzbM.exe
  C:\Windows\System32\ZGsmzbM.exe
  2⤵
  PID:5228
- C:\Windows\System32\fUTEIDV.exe
  C:\Windows\System32\fUTEIDV.exe
  2⤵
  PID:5168
- C:\Windows\System32\cqYJPZO.exe
  C:\Windows\System32\cqYJPZO.exe
  2⤵
  PID:5296
- C:\Windows\System32\nDHXRZu.exe
  C:\Windows\System32\nDHXRZu.exe
  2⤵
  PID:5424
- C:\Windows\System32\XDLImJN.exe
  C:\Windows\System32\XDLImJN.exe
  2⤵
  PID:5540
- C:\Windows\System32\dWSdVlX.exe
  C:\Windows\System32\dWSdVlX.exe
  2⤵
  PID:5588
- C:\Windows\System32\DpsJMtj.exe
  C:\Windows\System32\DpsJMtj.exe
  2⤵
  PID:1168
- C:\Windows\System32\ncIhrDW.exe
  C:\Windows\System32\ncIhrDW.exe
  2⤵
  PID:2336
- C:\Windows\System32\gXDELUC.exe
  C:\Windows\System32\gXDELUC.exe
  2⤵
  PID:5708
- C:\Windows\System32\RgiVJlT.exe
  C:\Windows\System32\RgiVJlT.exe
  2⤵
  PID:4644
- C:\Windows\System32\pKBNWwY.exe
  C:\Windows\System32\pKBNWwY.exe
  2⤵
  PID:2888
- C:\Windows\System32\tnuQCMx.exe
  C:\Windows\System32\tnuQCMx.exe
  2⤵
  PID:5388
- C:\Windows\System32\aEYvnwR.exe
  C:\Windows\System32\aEYvnwR.exe
  2⤵
  PID:5848
- C:\Windows\System32\fuGSTxu.exe
  C:\Windows\System32\fuGSTxu.exe
  2⤵
  PID:6036
- C:\Windows\System32\MKOBwRN.exe
  C:\Windows\System32\MKOBwRN.exe
  2⤵
  PID:6020
- C:\Windows\System32\UlBuHyP.exe
  C:\Windows\System32\UlBuHyP.exe
  2⤵
  PID:6116
- C:\Windows\System32\JzhNyOJ.exe
  C:\Windows\System32\JzhNyOJ.exe
  2⤵
  PID:5884
- C:\Windows\System32\SkmRlaN.exe
  C:\Windows\System32\SkmRlaN.exe
  2⤵
  PID:5128
- C:\Windows\System32\sLICeoi.exe
  C:\Windows\System32\sLICeoi.exe
  2⤵
  PID:5352
- C:\Windows\System32\spxvMOD.exe
  C:\Windows\System32\spxvMOD.exe
  2⤵
  PID:5340
- C:\Windows\System32\bVEKMAn.exe
  C:\Windows\System32\bVEKMAn.exe
  2⤵
  PID:5380
- C:\Windows\System32\mEmQBLI.exe
  C:\Windows\System32\mEmQBLI.exe
  2⤵
  PID:5648
- C:\Windows\System32\vsKwxWx.exe
  C:\Windows\System32\vsKwxWx.exe
  2⤵
  PID:5724
- C:\Windows\System32\nHdHEtP.exe
  C:\Windows\System32\nHdHEtP.exe
  2⤵
  PID:1244
- C:\Windows\System32\ITamYqi.exe
  C:\Windows\System32\ITamYqi.exe
  2⤵
  PID:5312
- C:\Windows\System32\VZZRUPd.exe
  C:\Windows\System32\VZZRUPd.exe
  2⤵
  PID:5932
- C:\Windows\System32\djwJCCv.exe
  C:\Windows\System32\djwJCCv.exe
  2⤵
  PID:732
- C:\Windows\System32\EgwHzPC.exe
  C:\Windows\System32\EgwHzPC.exe
  2⤵
  PID:5360
- C:\Windows\System32\quWEqjv.exe
  C:\Windows\System32\quWEqjv.exe
  2⤵
  PID:5500
- C:\Windows\System32\wVSGePi.exe
  C:\Windows\System32\wVSGePi.exe
  2⤵
  PID:5812
- C:\Windows\System32\GULTVWo.exe
  C:\Windows\System32\GULTVWo.exe
  2⤵
  PID:6148
- C:\Windows\System32\AdDjjrm.exe
  C:\Windows\System32\AdDjjrm.exe
  2⤵
  PID:6180
- C:\Windows\System32\kklPqWs.exe
  C:\Windows\System32\kklPqWs.exe
  2⤵
  PID:6220
- C:\Windows\System32\lOVKiYd.exe
  C:\Windows\System32\lOVKiYd.exe
  2⤵
  PID:6240
- C:\Windows\System32\lLqZwqi.exe
  C:\Windows\System32\lLqZwqi.exe
  2⤵
  PID:6296
- C:\Windows\System32\ZOstMvL.exe
  C:\Windows\System32\ZOstMvL.exe
  2⤵
  PID:6344
- C:\Windows\System32\TgtZxxr.exe
  C:\Windows\System32\TgtZxxr.exe
  2⤵
  PID:6360
- C:\Windows\System32\ZNYJgLZ.exe
  C:\Windows\System32\ZNYJgLZ.exe
  2⤵
  PID:6384
- C:\Windows\System32\HzMheeO.exe
  C:\Windows\System32\HzMheeO.exe
  2⤵
  PID:6404
- C:\Windows\System32\rtFGBCC.exe
  C:\Windows\System32\rtFGBCC.exe
  2⤵
  PID:6428
- C:\Windows\System32\donGuoF.exe
  C:\Windows\System32\donGuoF.exe
  2⤵
  PID:6452
- C:\Windows\System32\FRLUxOe.exe
  C:\Windows\System32\FRLUxOe.exe
  2⤵
  PID:6500
- C:\Windows\System32\bmmazdb.exe
  C:\Windows\System32\bmmazdb.exe
  2⤵
  PID:6516
- C:\Windows\System32\mmkxrJl.exe
  C:\Windows\System32\mmkxrJl.exe
  2⤵
  PID:6560
- C:\Windows\System32\iSulXFP.exe
  C:\Windows\System32\iSulXFP.exe
  2⤵
  PID:6588
- C:\Windows\System32\ApORgdI.exe
  C:\Windows\System32\ApORgdI.exe
  2⤵
  PID:6608
- C:\Windows\System32\VCqEpeB.exe
  C:\Windows\System32\VCqEpeB.exe
  2⤵
  PID:6632
- C:\Windows\System32\cikSzDM.exe
  C:\Windows\System32\cikSzDM.exe
  2⤵
  PID:6652
- C:\Windows\System32\loQtqIu.exe
  C:\Windows\System32\loQtqIu.exe
  2⤵
  PID:6672
- C:\Windows\System32\gSgIHjX.exe
  C:\Windows\System32\gSgIHjX.exe
  2⤵
  PID:6692
- C:\Windows\System32\wVzPThq.exe
  C:\Windows\System32\wVzPThq.exe
  2⤵
  PID:6724
- C:\Windows\System32\ISrMtNo.exe
  C:\Windows\System32\ISrMtNo.exe
  2⤵
  PID:6752
- C:\Windows\System32\uwFCjRO.exe
  C:\Windows\System32\uwFCjRO.exe
  2⤵
  PID:6812
- C:\Windows\System32\DuPzSFT.exe
  C:\Windows\System32\DuPzSFT.exe
  2⤵
  PID:6860
- C:\Windows\System32\UtFgTcp.exe
  C:\Windows\System32\UtFgTcp.exe
  2⤵
  PID:6876
- C:\Windows\System32\MiwxwNP.exe
  C:\Windows\System32\MiwxwNP.exe
  2⤵
  PID:6920
- C:\Windows\System32\lIIhvak.exe
  C:\Windows\System32\lIIhvak.exe
  2⤵
  PID:6936
- C:\Windows\System32\sYZSMVG.exe
  C:\Windows\System32\sYZSMVG.exe
  2⤵
  PID:6956
- C:\Windows\System32\yRhbOEg.exe
  C:\Windows\System32\yRhbOEg.exe
  2⤵
  PID:6976
- C:\Windows\System32\dFzkxKw.exe
  C:\Windows\System32\dFzkxKw.exe
  2⤵
  PID:6992
- C:\Windows\System32\fyQgPEF.exe
  C:\Windows\System32\fyQgPEF.exe
  2⤵
  PID:7020
- C:\Windows\System32\zUCluXf.exe
  C:\Windows\System32\zUCluXf.exe
  2⤵
  PID:7036
- C:\Windows\System32\jhjczED.exe
  C:\Windows\System32\jhjczED.exe
  2⤵
  PID:7060
- C:\Windows\System32\FWBLlQz.exe
  C:\Windows\System32\FWBLlQz.exe
  2⤵
  PID:7104
- C:\Windows\System32\inZlCdA.exe
  C:\Windows\System32\inZlCdA.exe
  2⤵
  PID:7120
- C:\Windows\System32\aUmNMsb.exe
  C:\Windows\System32\aUmNMsb.exe
  2⤵
  PID:7164
- C:\Windows\System32\ikkqOVi.exe
  C:\Windows\System32\ikkqOVi.exe
  2⤵
  PID:5476
- C:\Windows\System32\YDMPoZN.exe
  C:\Windows\System32\YDMPoZN.exe
  2⤵
  PID:5972
- C:\Windows\System32\krhbHCC.exe
  C:\Windows\System32\krhbHCC.exe
  2⤵
  PID:6272
- C:\Windows\System32\HrqrtwE.exe
  C:\Windows\System32\HrqrtwE.exe
  2⤵
  PID:6208
- C:\Windows\System32\GIYKhrW.exe
  C:\Windows\System32\GIYKhrW.exe
  2⤵
  PID:6356
- C:\Windows\System32\eWgdrrD.exe
  C:\Windows\System32\eWgdrrD.exe
  2⤵
  PID:6328
- C:\Windows\System32\IZiAtjG.exe
  C:\Windows\System32\IZiAtjG.exe
  2⤵
  PID:6448
- C:\Windows\System32\qpdzrDb.exe
  C:\Windows\System32\qpdzrDb.exe
  2⤵
  PID:6440
- C:\Windows\System32\TPIWWZW.exe
  C:\Windows\System32\TPIWWZW.exe
  2⤵
  PID:6472
- C:\Windows\System32\IzUeXDu.exe
  C:\Windows\System32\IzUeXDu.exe
  2⤵
  PID:6600
- C:\Windows\System32\vmATVqm.exe
  C:\Windows\System32\vmATVqm.exe
  2⤵
  PID:6704
- C:\Windows\System32\AjxCqHn.exe
  C:\Windows\System32\AjxCqHn.exe
  2⤵
  PID:6768
- C:\Windows\System32\EhcUWNs.exe
  C:\Windows\System32\EhcUWNs.exe
  2⤵
  PID:6788
- C:\Windows\System32\jZtaLsz.exe
  C:\Windows\System32\jZtaLsz.exe
  2⤵
  PID:6872
- C:\Windows\System32\FsLHEgD.exe
  C:\Windows\System32\FsLHEgD.exe
  2⤵
  PID:6932
- C:\Windows\System32\beWGaIx.exe
  C:\Windows\System32\beWGaIx.exe
  2⤵
  PID:7008
- C:\Windows\System32\XVIOnmb.exe
  C:\Windows\System32\XVIOnmb.exe
  2⤵
  PID:7032
- C:\Windows\System32\jvMTFeX.exe
  C:\Windows\System32\jvMTFeX.exe
  2⤵
  PID:7112
- C:\Windows\System32\ALmtPho.exe
  C:\Windows\System32\ALmtPho.exe
  2⤵
  PID:5952
- C:\Windows\System32\pfCaevd.exe
  C:\Windows\System32\pfCaevd.exe
  2⤵
  PID:5468
- C:\Windows\System32\RSkGGxa.exe
  C:\Windows\System32\RSkGGxa.exe
  2⤵
  PID:6488
- C:\Windows\System32\abXMsmk.exe
  C:\Windows\System32\abXMsmk.exe
  2⤵
  PID:6700
- C:\Windows\System32\xwikwqX.exe
  C:\Windows\System32\xwikwqX.exe
  2⤵
  PID:6904
- C:\Windows\System32\TvIBshi.exe
  C:\Windows\System32\TvIBshi.exe
  2⤵
  PID:7068
- C:\Windows\System32\KdJxhfT.exe
  C:\Windows\System32\KdJxhfT.exe
  2⤵
  PID:6168
- C:\Windows\System32\bnwjQLu.exe
  C:\Windows\System32\bnwjQLu.exe
  2⤵
  PID:6416
- C:\Windows\System32\Lsduofk.exe
  C:\Windows\System32\Lsduofk.exe
  2⤵
  PID:6660
- C:\Windows\System32\gXfCJaH.exe
  C:\Windows\System32\gXfCJaH.exe
  2⤵
  PID:6892
- C:\Windows\System32\NXkBfZS.exe
  C:\Windows\System32\NXkBfZS.exe
  2⤵
  PID:6212
- C:\Windows\System32\AQXBhXq.exe
  C:\Windows\System32\AQXBhXq.exe
  2⤵
  PID:7192
- C:\Windows\System32\wcXimEO.exe
  C:\Windows\System32\wcXimEO.exe
  2⤵
  PID:7220
- C:\Windows\System32\BARqYVY.exe
  C:\Windows\System32\BARqYVY.exe
  2⤵
  PID:7236
- C:\Windows\System32\EbNscMa.exe
  C:\Windows\System32\EbNscMa.exe
  2⤵
  PID:7256
- C:\Windows\System32\shtIFez.exe
  C:\Windows\System32\shtIFez.exe
  2⤵
  PID:7280
- C:\Windows\System32\uZlxbHr.exe
  C:\Windows\System32\uZlxbHr.exe
  2⤵
  PID:7300
- C:\Windows\System32\DsJPoLo.exe
  C:\Windows\System32\DsJPoLo.exe
  2⤵
  PID:7320
- C:\Windows\System32\iIGfQlr.exe
  C:\Windows\System32\iIGfQlr.exe
  2⤵
  PID:7364
- C:\Windows\System32\bpIwnMD.exe
  C:\Windows\System32\bpIwnMD.exe
  2⤵
  PID:7388
- C:\Windows\System32\GuxJyBp.exe
  C:\Windows\System32\GuxJyBp.exe
  2⤵
  PID:7408
- C:\Windows\System32\VPUCvhJ.exe
  C:\Windows\System32\VPUCvhJ.exe
  2⤵
  PID:7468
- C:\Windows\System32\gXjXnPf.exe
  C:\Windows\System32\gXjXnPf.exe
  2⤵
  PID:7508
- C:\Windows\System32\VzYwyuO.exe
  C:\Windows\System32\VzYwyuO.exe
  2⤵
  PID:7524
- C:\Windows\System32\xLicoyK.exe
  C:\Windows\System32\xLicoyK.exe
  2⤵
  PID:7544
- C:\Windows\System32\hPUHVLm.exe
  C:\Windows\System32\hPUHVLm.exe
  2⤵
  PID:7564
- C:\Windows\System32\SzcaStV.exe
  C:\Windows\System32\SzcaStV.exe
  2⤵
  PID:7588
- C:\Windows\System32\WCxWbVO.exe
  C:\Windows\System32\WCxWbVO.exe
  2⤵
  PID:7604
- C:\Windows\System32\TtHeEqC.exe
  C:\Windows\System32\TtHeEqC.exe
  2⤵
  PID:7636
- C:\Windows\System32\LGpgrYP.exe
  C:\Windows\System32\LGpgrYP.exe
  2⤵
  PID:7664
- C:\Windows\System32\dpnkyur.exe
  C:\Windows\System32\dpnkyur.exe
  2⤵
  PID:7684
- C:\Windows\System32\lTqfhhG.exe
  C:\Windows\System32\lTqfhhG.exe
  2⤵
  PID:7732
- C:\Windows\System32\KWqqLnG.exe
  C:\Windows\System32\KWqqLnG.exe
  2⤵
  PID:7748
- C:\Windows\System32\JRYyHpD.exe
  C:\Windows\System32\JRYyHpD.exe
  2⤵
  PID:7780
- C:\Windows\System32\JUyLllu.exe
  C:\Windows\System32\JUyLllu.exe
  2⤵
  PID:7820
- C:\Windows\System32\sPmTRwE.exe
  C:\Windows\System32\sPmTRwE.exe
  2⤵
  PID:7840
- C:\Windows\System32\vrPpNVe.exe
  C:\Windows\System32\vrPpNVe.exe
  2⤵
  PID:7860
- C:\Windows\System32\COjkQQy.exe
  C:\Windows\System32\COjkQQy.exe
  2⤵
  PID:7880
- C:\Windows\System32\GuQrkBu.exe
  C:\Windows\System32\GuQrkBu.exe
  2⤵
  PID:7900
- C:\Windows\System32\YBBBfYM.exe
  C:\Windows\System32\YBBBfYM.exe
  2⤵
  PID:7924
- C:\Windows\System32\lGUGZoD.exe
  C:\Windows\System32\lGUGZoD.exe
  2⤵
  PID:7980
- C:\Windows\System32\kgSCTIc.exe
  C:\Windows\System32\kgSCTIc.exe
  2⤵
  PID:7996
- C:\Windows\System32\UrZZgSO.exe
  C:\Windows\System32\UrZZgSO.exe
  2⤵
  PID:8020
- C:\Windows\System32\wNtYSIJ.exe
  C:\Windows\System32\wNtYSIJ.exe
  2⤵
  PID:8040
- C:\Windows\System32\VuIrxkU.exe
  C:\Windows\System32\VuIrxkU.exe
  2⤵
  PID:8108
- C:\Windows\System32\QMvcZEU.exe
  C:\Windows\System32\QMvcZEU.exe
  2⤵
  PID:8156
- C:\Windows\System32\GVObMZv.exe
  C:\Windows\System32\GVObMZv.exe
  2⤵
  PID:8176
- C:\Windows\System32\cQawkEP.exe
  C:\Windows\System32\cQawkEP.exe
  2⤵
  PID:6840
- C:\Windows\System32\DhfciCC.exe
  C:\Windows\System32\DhfciCC.exe
  2⤵
  PID:7228
- C:\Windows\System32\XKBVJkV.exe
  C:\Windows\System32\XKBVJkV.exe
  2⤵
  PID:7264
- C:\Windows\System32\YhlwQbD.exe
  C:\Windows\System32\YhlwQbD.exe
  2⤵
  PID:7372
- C:\Windows\System32\bfqmOIR.exe
  C:\Windows\System32\bfqmOIR.exe
  2⤵
  PID:7420
- C:\Windows\System32\aJfEKSq.exe
  C:\Windows\System32\aJfEKSq.exe
  2⤵
  PID:7492
- C:\Windows\System32\TzNKCoV.exe
  C:\Windows\System32\TzNKCoV.exe
  2⤵
  PID:7520
- C:\Windows\System32\DffXdoF.exe
  C:\Windows\System32\DffXdoF.exe
  2⤵
  PID:7556
- C:\Windows\System32\MsSTLdy.exe
  C:\Windows\System32\MsSTLdy.exe
  2⤵
  PID:7692
- C:\Windows\System32\YVhBpbK.exe
  C:\Windows\System32\YVhBpbK.exe
  2⤵
  PID:7740
- C:\Windows\System32\PfOlVfR.exe
  C:\Windows\System32\PfOlVfR.exe
  2⤵
  PID:7808
- C:\Windows\System32\mNPypIB.exe
  C:\Windows\System32\mNPypIB.exe
  2⤵
  PID:7912
- C:\Windows\System32\FVnLYHz.exe
  C:\Windows\System32\FVnLYHz.exe
  2⤵
  PID:8016
- C:\Windows\System32\rNMwqbG.exe
  C:\Windows\System32\rNMwqbG.exe
  2⤵
  PID:8004
- C:\Windows\System32\PwchWFX.exe
  C:\Windows\System32\PwchWFX.exe
  2⤵
  PID:8140
- C:\Windows\System32\cabVMVZ.exe
  C:\Windows\System32\cabVMVZ.exe
  2⤵
  PID:7204
- C:\Windows\System32\mKXFQhX.exe
  C:\Windows\System32\mKXFQhX.exe
  2⤵
  PID:7180
- C:\Windows\System32\dWhmHgY.exe
  C:\Windows\System32\dWhmHgY.exe
  2⤵
  PID:7456
- C:\Windows\System32\NhFRHoH.exe
  C:\Windows\System32\NhFRHoH.exe
  2⤵
  PID:7572
- C:\Windows\System32\GevDUkx.exe
  C:\Windows\System32\GevDUkx.exe
  2⤵
  PID:7720
- C:\Windows\System32\CKsggTx.exe
  C:\Windows\System32\CKsggTx.exe
  2⤵
  PID:7812
- C:\Windows\System32\EcszLUd.exe
  C:\Windows\System32\EcszLUd.exe
  2⤵
  PID:7992
- C:\Windows\System32\Bmxsxyp.exe
  C:\Windows\System32\Bmxsxyp.exe
  2⤵
  PID:7384
- C:\Windows\System32\dixlHwt.exe
  C:\Windows\System32\dixlHwt.exe
  2⤵
  PID:7644
- C:\Windows\System32\xrJFCnd.exe
  C:\Windows\System32\xrJFCnd.exe
  2⤵
  PID:8012
- C:\Windows\System32\vspTdnA.exe
  C:\Windows\System32\vspTdnA.exe
  2⤵
  PID:7852
- C:\Windows\System32\WFDSDGQ.exe
  C:\Windows\System32\WFDSDGQ.exe
  2⤵
  PID:8216
- C:\Windows\System32\ETtpPTv.exe
  C:\Windows\System32\ETtpPTv.exe
  2⤵
  PID:8244
- C:\Windows\System32\KyBCynO.exe
  C:\Windows\System32\KyBCynO.exe
  2⤵
  PID:8264
- C:\Windows\System32\RHMcMot.exe
  C:\Windows\System32\RHMcMot.exe
  2⤵
  PID:8280
- C:\Windows\System32\yrysEBa.exe
  C:\Windows\System32\yrysEBa.exe
  2⤵
  PID:8304
- C:\Windows\System32\cynXxTX.exe
  C:\Windows\System32\cynXxTX.exe
  2⤵
  PID:8332
- C:\Windows\System32\OxXlsZq.exe
  C:\Windows\System32\OxXlsZq.exe
  2⤵
  PID:8352
- C:\Windows\System32\KXOInpu.exe
  C:\Windows\System32\KXOInpu.exe
  2⤵
  PID:8384
- C:\Windows\System32\NnSpQHQ.exe
  C:\Windows\System32\NnSpQHQ.exe
  2⤵
  PID:8432
- C:\Windows\System32\ldZDjjI.exe
  C:\Windows\System32\ldZDjjI.exe
  2⤵
  PID:8456
- C:\Windows\System32\RPiHwUK.exe
  C:\Windows\System32\RPiHwUK.exe
  2⤵
  PID:8476
- C:\Windows\System32\MIqfuqq.exe
  C:\Windows\System32\MIqfuqq.exe
  2⤵
  PID:8500
- C:\Windows\System32\mdLyAsf.exe
  C:\Windows\System32\mdLyAsf.exe
  2⤵
  PID:8520
- C:\Windows\System32\Dqzkiit.exe
  C:\Windows\System32\Dqzkiit.exe
  2⤵
  PID:8544
- C:\Windows\System32\swFOOBp.exe
  C:\Windows\System32\swFOOBp.exe
  2⤵
  PID:8564
- C:\Windows\System32\bZHqvTP.exe
  C:\Windows\System32\bZHqvTP.exe
  2⤵
  PID:8588
- C:\Windows\System32\RZAVJxs.exe
  C:\Windows\System32\RZAVJxs.exe
  2⤵
  PID:8604
- C:\Windows\System32\uWTOssP.exe
  C:\Windows\System32\uWTOssP.exe
  2⤵
  PID:8664
- C:\Windows\System32\ySITrBo.exe
  C:\Windows\System32\ySITrBo.exe
  2⤵
  PID:8680
- C:\Windows\System32\bVWsmhb.exe
  C:\Windows\System32\bVWsmhb.exe
  2⤵
  PID:8696
- C:\Windows\System32\dArKGxX.exe
  C:\Windows\System32\dArKGxX.exe
  2⤵
  PID:8724
- C:\Windows\System32\LQpdEfN.exe
  C:\Windows\System32\LQpdEfN.exe
  2⤵
  PID:8768
- C:\Windows\System32\WphlOoO.exe
  C:\Windows\System32\WphlOoO.exe
  2⤵
  PID:8788
- C:\Windows\System32\XlrYoAS.exe
  C:\Windows\System32\XlrYoAS.exe
  2⤵
  PID:8804
- C:\Windows\System32\AvwlDzj.exe
  C:\Windows\System32\AvwlDzj.exe
  2⤵
  PID:8828
- C:\Windows\System32\PNnREFx.exe
  C:\Windows\System32\PNnREFx.exe
  2⤵
  PID:8844
- C:\Windows\System32\FEKKnsm.exe
  C:\Windows\System32\FEKKnsm.exe
  2⤵
  PID:8908
- C:\Windows\System32\OxQRPZU.exe
  C:\Windows\System32\OxQRPZU.exe
  2⤵
  PID:8928
- C:\Windows\System32\HWFUmSh.exe
  C:\Windows\System32\HWFUmSh.exe
  2⤵
  PID:9000
- C:\Windows\System32\rrhDiIm.exe
  C:\Windows\System32\rrhDiIm.exe
  2⤵
  PID:9028
- C:\Windows\System32\KKwIOty.exe
  C:\Windows\System32\KKwIOty.exe
  2⤵
  PID:9044
- C:\Windows\System32\wxEmMPU.exe
  C:\Windows\System32\wxEmMPU.exe
  2⤵
  PID:9064
- C:\Windows\System32\aTBcDPe.exe
  C:\Windows\System32\aTBcDPe.exe
  2⤵
  PID:9088
- C:\Windows\System32\MpDQSTI.exe
  C:\Windows\System32\MpDQSTI.exe
  2⤵
  PID:9112
- C:\Windows\System32\BTZKPcg.exe
  C:\Windows\System32\BTZKPcg.exe
  2⤵
  PID:9140
- C:\Windows\System32\NNmCoJl.exe
  C:\Windows\System32\NNmCoJl.exe
  2⤵
  PID:9156
- C:\Windows\System32\SOTRHIj.exe
  C:\Windows\System32\SOTRHIj.exe
  2⤵
  PID:9200
- C:\Windows\System32\zyvdiPQ.exe
  C:\Windows\System32\zyvdiPQ.exe
  2⤵
  PID:8080
- C:\Windows\System32\xCpgylL.exe
  C:\Windows\System32\xCpgylL.exe
  2⤵
  PID:8296
- C:\Windows\System32\zfiQeQQ.exe
  C:\Windows\System32\zfiQeQQ.exe
  2⤵
  PID:8368
- C:\Windows\System32\VFTLlhg.exe
  C:\Windows\System32\VFTLlhg.exe
  2⤵
  PID:8452
- C:\Windows\System32\jbmJojG.exe
  C:\Windows\System32\jbmJojG.exe
  2⤵
  PID:8440
- C:\Windows\System32\NgjHNXE.exe
  C:\Windows\System32\NgjHNXE.exe
  2⤵
  PID:8528
- C:\Windows\System32\BwfBwCw.exe
  C:\Windows\System32\BwfBwCw.exe
  2⤵
  PID:8596
- C:\Windows\System32\TpuzkIL.exe
  C:\Windows\System32\TpuzkIL.exe
  2⤵
  PID:8748
- C:\Windows\System32\lyIcgDp.exe
  C:\Windows\System32\lyIcgDp.exe
  2⤵
  PID:8896
- C:\Windows\System32\LHFqcyV.exe
  C:\Windows\System32\LHFqcyV.exe
  2⤵
  PID:8824
- C:\Windows\System32\kVqaPbZ.exe
  C:\Windows\System32\kVqaPbZ.exe
  2⤵
  PID:8924
- C:\Windows\System32\nyuNnok.exe
  C:\Windows\System32\nyuNnok.exe
  2⤵
  PID:8972
- C:\Windows\System32\lCGpqCs.exe
  C:\Windows\System32\lCGpqCs.exe
  2⤵
  PID:8988
- C:\Windows\System32\sEMjXHt.exe
  C:\Windows\System32\sEMjXHt.exe
  2⤵
  PID:9060
- C:\Windows\System32\FQoyQSl.exe
  C:\Windows\System32\FQoyQSl.exe
  2⤵
  PID:9168
- C:\Windows\System32\rEWHfNA.exe
  C:\Windows\System32\rEWHfNA.exe
  2⤵
  PID:9192
- C:\Windows\System32\HehAgRD.exe
  C:\Windows\System32\HehAgRD.exe
  2⤵
  PID:8292
- C:\Windows\System32\YveeEot.exe
  C:\Windows\System32\YveeEot.exe
  2⤵
  PID:8464
- C:\Windows\System32\FBcRBbj.exe
  C:\Windows\System32\FBcRBbj.exe
  2⤵
  PID:8640
- C:\Windows\System32\fqmYkSu.exe
  C:\Windows\System32\fqmYkSu.exe
  2⤵
  PID:8636
- C:\Windows\System32\PbqlYNT.exe
  C:\Windows\System32\PbqlYNT.exe
  2⤵
  PID:8872
- C:\Windows\System32\cccxzGD.exe
  C:\Windows\System32\cccxzGD.exe
  2⤵
  PID:9080
- C:\Windows\System32\JccZjPL.exe
  C:\Windows\System32\JccZjPL.exe
  2⤵
  PID:8376
- C:\Windows\System32\OmBlDlP.exe
  C:\Windows\System32\OmBlDlP.exe
  2⤵
  PID:9280
- C:\Windows\System32\pOIlZDe.exe
  C:\Windows\System32\pOIlZDe.exe
  2⤵
  PID:9296
- C:\Windows\System32\bxyyCWf.exe
  C:\Windows\System32\bxyyCWf.exe
  2⤵
  PID:9312
- C:\Windows\System32\LVZyzCC.exe
  C:\Windows\System32\LVZyzCC.exe
  2⤵
  PID:9328
- C:\Windows\System32\FKGVVje.exe
  C:\Windows\System32\FKGVVje.exe
  2⤵
  PID:9344
- C:\Windows\System32\ixsaEoq.exe
  C:\Windows\System32\ixsaEoq.exe
  2⤵
  PID:9360
- C:\Windows\System32\FgxUWIA.exe
  C:\Windows\System32\FgxUWIA.exe
  2⤵
  PID:9376
- C:\Windows\System32\FZnTjuA.exe
  C:\Windows\System32\FZnTjuA.exe
  2⤵
  PID:9396
- C:\Windows\System32\xHvAacb.exe
  C:\Windows\System32\xHvAacb.exe
  2⤵
  PID:9412
- C:\Windows\System32\XQfLNkR.exe
  C:\Windows\System32\XQfLNkR.exe
  2⤵
  PID:9428
- C:\Windows\System32\oqKcZKA.exe
  C:\Windows\System32\oqKcZKA.exe
  2⤵
  PID:9444
- C:\Windows\System32\hiXskNj.exe
  C:\Windows\System32\hiXskNj.exe
  2⤵
  PID:9460
- C:\Windows\System32\utZrTpt.exe
  C:\Windows\System32\utZrTpt.exe
  2⤵
  PID:9476
- C:\Windows\System32\rrNAowH.exe
  C:\Windows\System32\rrNAowH.exe
  2⤵
  PID:9492
- C:\Windows\System32\gxGOphV.exe
  C:\Windows\System32\gxGOphV.exe
  2⤵
  PID:9508
- C:\Windows\System32\AZilhBL.exe
  C:\Windows\System32\AZilhBL.exe
  2⤵
  PID:9524
- C:\Windows\System32\KYWJmNk.exe
  C:\Windows\System32\KYWJmNk.exe
  2⤵
  PID:9540
- C:\Windows\System32\IlmFtOu.exe
  C:\Windows\System32\IlmFtOu.exe
  2⤵
  PID:9556
- C:\Windows\System32\nrqiMTX.exe
  C:\Windows\System32\nrqiMTX.exe
  2⤵
  PID:9572
- C:\Windows\System32\NkFBDmX.exe
  C:\Windows\System32\NkFBDmX.exe
  2⤵
  PID:9588
- C:\Windows\System32\BOjidZz.exe
  C:\Windows\System32\BOjidZz.exe
  2⤵
  PID:9604
- C:\Windows\System32\bGjZzmM.exe
  C:\Windows\System32\bGjZzmM.exe
  2⤵
  PID:9620
- C:\Windows\System32\koXQndU.exe
  C:\Windows\System32\koXQndU.exe
  2⤵
  PID:9636
- C:\Windows\System32\tILOHCw.exe
  C:\Windows\System32\tILOHCw.exe
  2⤵
  PID:9784
- C:\Windows\System32\SSZnuJV.exe
  C:\Windows\System32\SSZnuJV.exe
  2⤵
  PID:9972
- C:\Windows\System32\maWvqCY.exe
  C:\Windows\System32\maWvqCY.exe
  2⤵
  PID:10000
- C:\Windows\System32\OUZgJya.exe
  C:\Windows\System32\OUZgJya.exe
  2⤵
  PID:10028
- C:\Windows\System32\bqQUHcU.exe
  C:\Windows\System32\bqQUHcU.exe
  2⤵
  PID:10044
- C:\Windows\System32\tQbAkKA.exe
  C:\Windows\System32\tQbAkKA.exe
  2⤵
  PID:10088
- C:\Windows\System32\IGEIAEy.exe
  C:\Windows\System32\IGEIAEy.exe
  2⤵
  PID:10112
- C:\Windows\System32\Untxbxo.exe
  C:\Windows\System32\Untxbxo.exe
  2⤵
  PID:10132
- C:\Windows\System32\PloGEea.exe
  C:\Windows\System32\PloGEea.exe
  2⤵
  PID:10160
- C:\Windows\System32\krtmVvq.exe
  C:\Windows\System32\krtmVvq.exe
  2⤵
  PID:10180
- C:\Windows\System32\CGFLQXi.exe
  C:\Windows\System32\CGFLQXi.exe
  2⤵
  PID:10212
- C:\Windows\System32\gcbKXJr.exe
  C:\Windows\System32\gcbKXJr.exe
  2⤵
  PID:10228
- C:\Windows\System32\dIpQNeM.exe
  C:\Windows\System32\dIpQNeM.exe
  2⤵
  PID:8516
- C:\Windows\System32\XyDOXvg.exe
  C:\Windows\System32\XyDOXvg.exe
  2⤵
  PID:9272
- C:\Windows\System32\RlJQeAl.exe
  C:\Windows\System32\RlJQeAl.exe
  2⤵
  PID:3900
- C:\Windows\System32\jJrzsWo.exe
  C:\Windows\System32\jJrzsWo.exe
  2⤵
  PID:9224
- C:\Windows\System32\kXftSfW.exe
  C:\Windows\System32\kXftSfW.exe
  2⤵
  PID:9504
- C:\Windows\System32\wQlMYWl.exe
  C:\Windows\System32\wQlMYWl.exe
  2⤵
  PID:9248
- C:\Windows\System32\yljqIqO.exe
  C:\Windows\System32\yljqIqO.exe
  2⤵
  PID:9584
- C:\Windows\System32\lGYOVCe.exe
  C:\Windows\System32\lGYOVCe.exe
  2⤵
  PID:9424
- C:\Windows\System32\aDeNViA.exe
  C:\Windows\System32\aDeNViA.exe
  2⤵
  PID:9352
- C:\Windows\System32\EqEJkPL.exe
  C:\Windows\System32\EqEJkPL.exe
  2⤵
  PID:9516
- C:\Windows\System32\BWgwyah.exe
  C:\Windows\System32\BWgwyah.exe
  2⤵
  PID:9612
- C:\Windows\System32\trTkYOg.exe
  C:\Windows\System32\trTkYOg.exe
  2⤵
  PID:9692
- C:\Windows\System32\JrCZZkB.exe
  C:\Windows\System32\JrCZZkB.exe
  2⤵
  PID:9452
- C:\Windows\System32\HWLnqrj.exe
  C:\Windows\System32\HWLnqrj.exe
  2⤵
  PID:9840
- C:\Windows\System32\YgoZbIt.exe
  C:\Windows\System32\YgoZbIt.exe
  2⤵
  PID:9832
- C:\Windows\System32\amEfqGb.exe
  C:\Windows\System32\amEfqGb.exe
  2⤵
  PID:9932
- C:\Windows\System32\LjwUiey.exe
  C:\Windows\System32\LjwUiey.exe
  2⤵
  PID:10040
- C:\Windows\System32\RQhJpmX.exe
  C:\Windows\System32\RQhJpmX.exe
  2⤵
  PID:10020
- C:\Windows\System32\HciuYPD.exe
  C:\Windows\System32\HciuYPD.exe
  2⤵
  PID:10144
- C:\Windows\System32\oycUnMW.exe
  C:\Windows\System32\oycUnMW.exe
  2⤵
  PID:10128
- C:\Windows\System32\WnuXpLo.exe
  C:\Windows\System32\WnuXpLo.exe
  2⤵
  PID:9324
- C:\Windows\System32\blUWmUH.exe
  C:\Windows\System32\blUWmUH.exe
  2⤵
  PID:9388
- C:\Windows\System32\ISVgQiT.exe
  C:\Windows\System32\ISVgQiT.exe
  2⤵
  PID:9568
- C:\Windows\System32\GtPIixp.exe
  C:\Windows\System32\GtPIixp.exe
  2⤵
  PID:9404
- C:\Windows\System32\FCQVZsI.exe
  C:\Windows\System32\FCQVZsI.exe
  2⤵
  PID:9808
- C:\Windows\System32\fjioAiJ.exe
  C:\Windows\System32\fjioAiJ.exe
  2⤵
  PID:10076
- C:\Windows\System32\MKmBlqM.exe
  C:\Windows\System32\MKmBlqM.exe
  2⤵
  PID:9984
- C:\Windows\System32\DBiyRRF.exe
  C:\Windows\System32\DBiyRRF.exe
  2⤵
  PID:9252
- C:\Windows\System32\Dqwjari.exe
  C:\Windows\System32\Dqwjari.exe
  2⤵
  PID:9336
- C:\Windows\System32\WsrgjUE.exe
  C:\Windows\System32\WsrgjUE.exe
  2⤵
  PID:9716
- C:\Windows\System32\zhNlnPl.exe
  C:\Windows\System32\zhNlnPl.exe
  2⤵
  PID:8496
- C:\Windows\System32\dvTAMTj.exe
  C:\Windows\System32\dvTAMTj.exe
  2⤵
  PID:9320
- C:\Windows\System32\HiLHOAL.exe
  C:\Windows\System32\HiLHOAL.exe
  2⤵
  PID:10272
- C:\Windows\System32\eyzZjps.exe
  C:\Windows\System32\eyzZjps.exe
  2⤵
  PID:10288
- C:\Windows\System32\QnfqHsk.exe
  C:\Windows\System32\QnfqHsk.exe
  2⤵
  PID:10304
- C:\Windows\System32\axppnXZ.exe
  C:\Windows\System32\axppnXZ.exe
  2⤵
  PID:10324
- C:\Windows\System32\qPNSNUg.exe
  C:\Windows\System32\qPNSNUg.exe
  2⤵
  PID:10352
- C:\Windows\System32\dkFKVaq.exe
  C:\Windows\System32\dkFKVaq.exe
  2⤵
  PID:10388
- C:\Windows\System32\ixabllb.exe
  C:\Windows\System32\ixabllb.exe
  2⤵
  PID:10416
- C:\Windows\System32\CIaRbig.exe
  C:\Windows\System32\CIaRbig.exe
  2⤵
  PID:10468
- C:\Windows\System32\IuNTLUj.exe
  C:\Windows\System32\IuNTLUj.exe
  2⤵
  PID:10484
- C:\Windows\System32\gDLFmPe.exe
  C:\Windows\System32\gDLFmPe.exe
  2⤵
  PID:10512
- C:\Windows\System32\cGJkTos.exe
  C:\Windows\System32\cGJkTos.exe
  2⤵
  PID:10528
- C:\Windows\System32\tipRiTs.exe
  C:\Windows\System32\tipRiTs.exe
  2⤵
  PID:10548
- C:\Windows\System32\FaooYei.exe
  C:\Windows\System32\FaooYei.exe
  2⤵
  PID:10576
- C:\Windows\System32\dhFtlWH.exe
  C:\Windows\System32\dhFtlWH.exe
  2⤵
  PID:10596
- C:\Windows\System32\SPzbLUR.exe
  C:\Windows\System32\SPzbLUR.exe
  2⤵
  PID:10612
- C:\Windows\System32\ynwIztk.exe
  C:\Windows\System32\ynwIztk.exe
  2⤵
  PID:10636
- C:\Windows\System32\GITOJZm.exe
  C:\Windows\System32\GITOJZm.exe
  2⤵
  PID:10664
- C:\Windows\System32\gaJwpdX.exe
  C:\Windows\System32\gaJwpdX.exe
  2⤵
  PID:10716
- C:\Windows\System32\uqPtULw.exe
  C:\Windows\System32\uqPtULw.exe
  2⤵
  PID:10736
- C:\Windows\System32\nePUKPc.exe
  C:\Windows\System32\nePUKPc.exe
  2⤵
  PID:10764
- C:\Windows\System32\ImmLMnO.exe
  C:\Windows\System32\ImmLMnO.exe
  2⤵
  PID:10804
- C:\Windows\System32\kGsdXfC.exe
  C:\Windows\System32\kGsdXfC.exe
  2⤵
  PID:10844
- C:\Windows\System32\zbCEceL.exe
  C:\Windows\System32\zbCEceL.exe
  2⤵
  PID:10880
- C:\Windows\System32\yxmaWjb.exe
  C:\Windows\System32\yxmaWjb.exe
  2⤵
  PID:10912
- C:\Windows\System32\vHiuXXR.exe
  C:\Windows\System32\vHiuXXR.exe
  2⤵
  PID:10928
- C:\Windows\System32\AwJfjCR.exe
  C:\Windows\System32\AwJfjCR.exe
  2⤵
  PID:10956
- C:\Windows\System32\EJPJOCy.exe
  C:\Windows\System32\EJPJOCy.exe
  2⤵
  PID:10976
- C:\Windows\System32\QizgUTf.exe
  C:\Windows\System32\QizgUTf.exe
  2⤵
  PID:10992
- C:\Windows\System32\uNDyIQC.exe
  C:\Windows\System32\uNDyIQC.exe
  2⤵
  PID:11016
- C:\Windows\System32\FFoyiEi.exe
  C:\Windows\System32\FFoyiEi.exe
  2⤵
  PID:11032
- C:\Windows\System32\rVsQpIf.exe
  C:\Windows\System32\rVsQpIf.exe
  2⤵
  PID:11064
- C:\Windows\System32\BTXdWhG.exe
  C:\Windows\System32\BTXdWhG.exe
  2⤵
  PID:11096
- C:\Windows\System32\PsGQvPi.exe
  C:\Windows\System32\PsGQvPi.exe
  2⤵
  PID:11128
- C:\Windows\System32\ZwQYyjP.exe
  C:\Windows\System32\ZwQYyjP.exe
  2⤵
  PID:11168
- C:\Windows\System32\QyofwME.exe
  C:\Windows\System32\QyofwME.exe
  2⤵
  PID:11200
- C:\Windows\System32\rNXxMWM.exe
  C:\Windows\System32\rNXxMWM.exe
  2⤵
  PID:11216
- C:\Windows\System32\DoOzQxU.exe
  C:\Windows\System32\DoOzQxU.exe
  2⤵
  PID:11252
- C:\Windows\System32\NMbZWAi.exe
  C:\Windows\System32\NMbZWAi.exe
  2⤵
  PID:10340
- C:\Windows\System32\DMdUiyI.exe
  C:\Windows\System32\DMdUiyI.exe
  2⤵
  PID:10360
- C:\Windows\System32\RSMCnGP.exe
  C:\Windows\System32\RSMCnGP.exe
  2⤵
  PID:10448
- C:\Windows\System32\cDeVcHE.exe
  C:\Windows\System32\cDeVcHE.exe
  2⤵
  PID:10564
- C:\Windows\System32\JXfvPyO.exe
  C:\Windows\System32\JXfvPyO.exe
  2⤵
  PID:10644
- C:\Windows\System32\SaPZKMd.exe
  C:\Windows\System32\SaPZKMd.exe
  2⤵
  PID:10608
- C:\Windows\System32\TtJZajo.exe
  C:\Windows\System32\TtJZajo.exe
  2⤵
  PID:10660
- C:\Windows\System32\LtHqNjM.exe
  C:\Windows\System32\LtHqNjM.exe
  2⤵
  PID:10692
- C:\Windows\System32\iHZFDyB.exe
  C:\Windows\System32\iHZFDyB.exe
  2⤵
  PID:10760
- C:\Windows\System32\VNmLxey.exe
  C:\Windows\System32\VNmLxey.exe
  2⤵
  PID:10872
- C:\Windows\System32\gCRaOhj.exe
  C:\Windows\System32\gCRaOhj.exe
  2⤵
  PID:10972
- C:\Windows\System32\HerVywO.exe
  C:\Windows\System32\HerVywO.exe
  2⤵
  PID:11028
- C:\Windows\System32\UqKJehH.exe
  C:\Windows\System32\UqKJehH.exe
  2⤵
  PID:11144
- C:\Windows\System32\VoqCYAP.exe
  C:\Windows\System32\VoqCYAP.exe
  2⤵
  PID:11140
- C:\Windows\System32\iXuZiSF.exe
  C:\Windows\System32\iXuZiSF.exe
  2⤵
  PID:11212
- C:\Windows\System32\khbZyVV.exe
  C:\Windows\System32\khbZyVV.exe
  2⤵
  PID:10300
- C:\Windows\System32\qrYoCHu.exe
  C:\Windows\System32\qrYoCHu.exe
  2⤵
  PID:10344
- C:\Windows\System32\qMswrwi.exe
  C:\Windows\System32\qMswrwi.exe
  2⤵
  PID:10540
- C:\Windows\System32\sEUFFGM.exe
  C:\Windows\System32\sEUFFGM.exe
  2⤵
  PID:10708
- C:\Windows\System32\IwURCxY.exe
  C:\Windows\System32\IwURCxY.exe
  2⤵
  PID:10908
- C:\Windows\System32\YiRvzmx.exe
  C:\Windows\System32\YiRvzmx.exe
  2⤵
  PID:11012
- C:\Windows\System32\kNfAYpM.exe
  C:\Windows\System32\kNfAYpM.exe
  2⤵
  PID:11104
- C:\Windows\System32\hZjnzyp.exe
  C:\Windows\System32\hZjnzyp.exe
  2⤵
  PID:10312
- C:\Windows\System32\CAWOskO.exe
  C:\Windows\System32\CAWOskO.exe
  2⤵
  PID:10412
- C:\Windows\System32\TqBCpOD.exe
  C:\Windows\System32\TqBCpOD.exe
  2⤵
  PID:10988
- C:\Windows\System32\avpqYIw.exe
  C:\Windows\System32\avpqYIw.exe
  2⤵
  PID:11008
- C:\Windows\System32\CnOlIwu.exe
  C:\Windows\System32\CnOlIwu.exe
  2⤵
  PID:11288
- C:\Windows\System32\SFIWzRP.exe
  C:\Windows\System32\SFIWzRP.exe
  2⤵
  PID:11304
- C:\Windows\System32\FGjRolz.exe
  C:\Windows\System32\FGjRolz.exe
  2⤵
  PID:11324
- C:\Windows\System32\ufGUjXd.exe
  C:\Windows\System32\ufGUjXd.exe
  2⤵
  PID:11340
- C:\Windows\System32\hpSLbvQ.exe
  C:\Windows\System32\hpSLbvQ.exe
  2⤵
  PID:11388
- C:\Windows\System32\YYGpHHg.exe
  C:\Windows\System32\YYGpHHg.exe
  2⤵
  PID:11404
- C:\Windows\System32\APLGmrs.exe
  C:\Windows\System32\APLGmrs.exe
  2⤵
  PID:11428
- C:\Windows\System32\gKMyUEq.exe
  C:\Windows\System32\gKMyUEq.exe
  2⤵
  PID:11444
- C:\Windows\System32\oDqkbGr.exe
  C:\Windows\System32\oDqkbGr.exe
  2⤵
  PID:11460
- C:\Windows\System32\qDQDUjO.exe
  C:\Windows\System32\qDQDUjO.exe
  2⤵
  PID:11476
- C:\Windows\System32\QvjHRPY.exe
  C:\Windows\System32\QvjHRPY.exe
  2⤵
  PID:11528
- C:\Windows\System32\KviOXcc.exe
  C:\Windows\System32\KviOXcc.exe
  2⤵
  PID:11576
- C:\Windows\System32\PeCgeCN.exe
  C:\Windows\System32\PeCgeCN.exe
  2⤵
  PID:11604
- C:\Windows\System32\QJYHCDs.exe
  C:\Windows\System32\QJYHCDs.exe
  2⤵
  PID:11656
- C:\Windows\System32\pvSwXeN.exe
  C:\Windows\System32\pvSwXeN.exe
  2⤵
  PID:11688
- C:\Windows\System32\WEWEhGM.exe
  C:\Windows\System32\WEWEhGM.exe
  2⤵
  PID:11712
- C:\Windows\System32\kUakkKT.exe
  C:\Windows\System32\kUakkKT.exe
  2⤵
  PID:11752
- C:\Windows\System32\AJWuJjz.exe
  C:\Windows\System32\AJWuJjz.exe
  2⤵
  PID:11768
- C:\Windows\System32\shqPEnX.exe
  C:\Windows\System32\shqPEnX.exe
  2⤵
  PID:11784
- C:\Windows\System32\GAjcbbK.exe
  C:\Windows\System32\GAjcbbK.exe
  2⤵
  PID:11820
- C:\Windows\System32\cujdJik.exe
  C:\Windows\System32\cujdJik.exe
  2⤵
  PID:11852
- C:\Windows\System32\ZkYFxiM.exe
  C:\Windows\System32\ZkYFxiM.exe
  2⤵
  PID:11868
- C:\Windows\System32\tugCqJS.exe
  C:\Windows\System32\tugCqJS.exe
  2⤵
  PID:11888
- C:\Windows\System32\GXUiFGT.exe
  C:\Windows\System32\GXUiFGT.exe
  2⤵
  PID:11904
- C:\Windows\System32\tqbKEjY.exe
  C:\Windows\System32\tqbKEjY.exe
  2⤵
  PID:11924
- C:\Windows\System32\CKlOBGY.exe
  C:\Windows\System32\CKlOBGY.exe
  2⤵
  PID:11940
- C:\Windows\System32\gPRzTLn.exe
  C:\Windows\System32\gPRzTLn.exe
  2⤵
  PID:11968
- C:\Windows\System32\YxOpaLV.exe
  C:\Windows\System32\YxOpaLV.exe
  2⤵
  PID:12036
- C:\Windows\System32\eQfrMie.exe
  C:\Windows\System32\eQfrMie.exe
  2⤵
  PID:12072
- C:\Windows\System32\vsEjJIC.exe
  C:\Windows\System32\vsEjJIC.exe
  2⤵
  PID:12108
- C:\Windows\System32\hIdMBUI.exe
  C:\Windows\System32\hIdMBUI.exe
  2⤵
  PID:12140
- C:\Windows\System32\dLNsCFI.exe
  C:\Windows\System32\dLNsCFI.exe
  2⤵
  PID:12156
- C:\Windows\System32\PjffKnU.exe
  C:\Windows\System32\PjffKnU.exe
  2⤵
  PID:12180
- C:\Windows\System32\IuIKfgr.exe
  C:\Windows\System32\IuIKfgr.exe
  2⤵
  PID:12200
- C:\Windows\System32\MsjCBVG.exe
  C:\Windows\System32\MsjCBVG.exe
  2⤵
  PID:12224
- C:\Windows\System32\wNMJbvC.exe
  C:\Windows\System32\wNMJbvC.exe
  2⤵
  PID:12252
- C:\Windows\System32\YECHgSZ.exe
  C:\Windows\System32\YECHgSZ.exe
  2⤵
  PID:12284
- C:\Windows\System32\VxAeJZf.exe
  C:\Windows\System32\VxAeJZf.exe
  2⤵
  PID:11276
- C:\Windows\System32\yBGwlNN.exe
  C:\Windows\System32\yBGwlNN.exe
  2⤵
  PID:11336
- C:\Windows\System32\tOeSbfH.exe
  C:\Windows\System32\tOeSbfH.exe
  2⤵
  PID:11400
- C:\Windows\System32\MEIZJZf.exe
  C:\Windows\System32\MEIZJZf.exe
  2⤵
  PID:11472
- C:\Windows\System32\SlryKzC.exe
  C:\Windows\System32\SlryKzC.exe
  2⤵
  PID:11568
- C:\Windows\System32\cHYuhvP.exe
  C:\Windows\System32\cHYuhvP.exe
  2⤵
  PID:11684
- C:\Windows\System32\DDOUzxl.exe
  C:\Windows\System32\DDOUzxl.exe
  2⤵
  PID:11740
- C:\Windows\System32\KXWCwAE.exe
  C:\Windows\System32\KXWCwAE.exe
  2⤵
  PID:11764
- C:\Windows\System32\PmHXeSj.exe
  C:\Windows\System32\PmHXeSj.exe
  2⤵
  PID:11792
- C:\Windows\System32\RNUUVzT.exe
  C:\Windows\System32\RNUUVzT.exe
  2⤵
  PID:11936
- C:\Windows\System32\YqvgXFj.exe
  C:\Windows\System32\YqvgXFj.exe
  2⤵
  PID:11900
- C:\Windows\System32\GEFrIre.exe
  C:\Windows\System32\GEFrIre.exe
  2⤵
  PID:11952
- C:\Windows\System32\SpePBNZ.exe
  C:\Windows\System32\SpePBNZ.exe
  2⤵
  PID:12028
- C:\Windows\System32\ZSRhHWs.exe
  C:\Windows\System32\ZSRhHWs.exe
  2⤵
  PID:12080
- C:\Windows\System32\WwHvmsD.exe
  C:\Windows\System32\WwHvmsD.exe
  2⤵
  PID:12132
- C:\Windows\System32\KfLCcqL.exe
  C:\Windows\System32\KfLCcqL.exe
  2⤵
  PID:12152
- C:\Windows\System32\oOWDehi.exe
  C:\Windows\System32\oOWDehi.exe
  2⤵
  PID:12196
- C:\Windows\System32\BOcAAMi.exe
  C:\Windows\System32\BOcAAMi.exe
  2⤵
  PID:10784
- C:\Windows\System32\ZqaHCsq.exe
  C:\Windows\System32\ZqaHCsq.exe
  2⤵
  PID:11808
- C:\Windows\System32\dARUTKy.exe
  C:\Windows\System32\dARUTKy.exe
  2⤵
  PID:11832
- C:\Windows\System32\ffReZNL.exe
  C:\Windows\System32\ffReZNL.exe
  2⤵
  PID:12016
- C:\Windows\System32\ftLeKoJ.exe
  C:\Windows\System32\ftLeKoJ.exe
  2⤵
  PID:12168
- C:\Windows\System32\sVQEAEm.exe
  C:\Windows\System32\sVQEAEm.exe
  2⤵
  PID:11396
- C:\Windows\System32\PJeAZQQ.exe
  C:\Windows\System32\PJeAZQQ.exe
  2⤵
  PID:11668
- C:\Windows\System32\cEChaqq.exe
  C:\Windows\System32\cEChaqq.exe
  2⤵
  PID:2008
- C:\Windows\System32\HOohZcN.exe
  C:\Windows\System32\HOohZcN.exe
  2⤵
  PID:4976
- C:\Windows\System32\nAAeYzX.exe
  C:\Windows\System32\nAAeYzX.exe
  2⤵
  PID:12212
- C:\Windows\System32\jwNYdAn.exe
  C:\Windows\System32\jwNYdAn.exe
  2⤵
  PID:11584
- C:\Windows\System32\lJnfSRh.exe
  C:\Windows\System32\lJnfSRh.exe
  2⤵
  PID:12300
- C:\Windows\System32\acBCxdb.exe
  C:\Windows\System32\acBCxdb.exe
  2⤵
  PID:12324
- C:\Windows\System32\fwKUZOg.exe
  C:\Windows\System32\fwKUZOg.exe
  2⤵
  PID:12340
- C:\Windows\System32\NgDRGvj.exe
  C:\Windows\System32\NgDRGvj.exe
  2⤵
  PID:12368
- C:\Windows\System32\VzdAMwN.exe
  C:\Windows\System32\VzdAMwN.exe
  2⤵
  PID:12384
- C:\Windows\System32\XqyEgok.exe
  C:\Windows\System32\XqyEgok.exe
  2⤵
  PID:12432
- C:\Windows\System32\jVcijzR.exe
  C:\Windows\System32\jVcijzR.exe
  2⤵
  PID:12460
- C:\Windows\System32\RLTxJEs.exe
  C:\Windows\System32\RLTxJEs.exe
  2⤵
  PID:12476
- C:\Windows\System32\cuXSOVf.exe
  C:\Windows\System32\cuXSOVf.exe
  2⤵
  PID:12496
- C:\Windows\System32\prOajQG.exe
  C:\Windows\System32\prOajQG.exe
  2⤵
  PID:12520
- C:\Windows\System32\vBTaFuD.exe
  C:\Windows\System32\vBTaFuD.exe
  2⤵
  PID:12556
- C:\Windows\System32\DdzfeyO.exe
  C:\Windows\System32\DdzfeyO.exe
  2⤵
  PID:12592
- C:\Windows\System32\JvfaIRI.exe
  C:\Windows\System32\JvfaIRI.exe
  2⤵
  PID:12628
- C:\Windows\System32\jezNVhi.exe
  C:\Windows\System32\jezNVhi.exe
  2⤵
  PID:12664
- C:\Windows\System32\wwpKDWk.exe
  C:\Windows\System32\wwpKDWk.exe
  2⤵
  PID:12680
- C:\Windows\System32\SedziBh.exe
  C:\Windows\System32\SedziBh.exe
  2⤵
  PID:12704
- C:\Windows\System32\kriciQr.exe
  C:\Windows\System32\kriciQr.exe
  2⤵
  PID:12732
- C:\Windows\System32\KLpVfSw.exe
  C:\Windows\System32\KLpVfSw.exe
  2⤵
  PID:12780
- C:\Windows\System32\pPJgomr.exe
  C:\Windows\System32\pPJgomr.exe
  2⤵
  PID:12800
- C:\Windows\System32\LWZmQaS.exe
  C:\Windows\System32\LWZmQaS.exe
  2⤵
  PID:12816
- C:\Windows\System32\YMJDlGA.exe
  C:\Windows\System32\YMJDlGA.exe
  2⤵
  PID:12844
- C:\Windows\System32\dgghDDw.exe
  C:\Windows\System32\dgghDDw.exe
  2⤵
  PID:12892
- C:\Windows\System32\vGxcawg.exe
  C:\Windows\System32\vGxcawg.exe
  2⤵
  PID:12908
- C:\Windows\System32\cVpXETf.exe
  C:\Windows\System32\cVpXETf.exe
  2⤵
  PID:12928
- C:\Windows\System32\NtVYtvW.exe
  C:\Windows\System32\NtVYtvW.exe
  2⤵
  PID:12944
- C:\Windows\System32\dRruCBa.exe
  C:\Windows\System32\dRruCBa.exe
  2⤵
  PID:12972
- C:\Windows\System32\EGVzvcT.exe
  C:\Windows\System32\EGVzvcT.exe
  2⤵
  PID:13028
- C:\Windows\System32\RhFDgnz.exe
  C:\Windows\System32\RhFDgnz.exe
  2⤵
  PID:13056
- C:\Windows\System32\FLwAZpe.exe
  C:\Windows\System32\FLwAZpe.exe
  2⤵
  PID:13072
- C:\Windows\System32\BYqYdmW.exe
  C:\Windows\System32\BYqYdmW.exe
  2⤵
  PID:13088
- C:\Windows\System32\VzFdrwu.exe
  C:\Windows\System32\VzFdrwu.exe
  2⤵
  PID:13148
- C:\Windows\System32\DFhLwdZ.exe
  C:\Windows\System32\DFhLwdZ.exe
  2⤵
  PID:13172
- C:\Windows\System32\owLSljq.exe
  C:\Windows\System32\owLSljq.exe
  2⤵
  PID:13196
- C:\Windows\System32\ZchoAxS.exe
  C:\Windows\System32\ZchoAxS.exe
  2⤵
  PID:13224
- C:\Windows\System32\DwMowdi.exe
  C:\Windows\System32\DwMowdi.exe
  2⤵
  PID:13272
- C:\Windows\System32\bvANfXi.exe
  C:\Windows\System32\bvANfXi.exe
  2⤵
  PID:13288
- C:\Windows\System32\gcsOPGu.exe
  C:\Windows\System32\gcsOPGu.exe
  2⤵
  PID:13304
- C:\Windows\System32\SLlqegu.exe
  C:\Windows\System32\SLlqegu.exe
  2⤵
  PID:12308
- C:\Windows\System32\tjqIYZL.exe
  C:\Windows\System32\tjqIYZL.exe
  2⤵
  PID:12352
- C:\Windows\System32\vLhJWIO.exe
  C:\Windows\System32\vLhJWIO.exe
  2⤵
  PID:12452
- C:\Windows\System32\UkleRDi.exe
  C:\Windows\System32\UkleRDi.exe
  2⤵
  PID:12544
- C:\Windows\System32\giNsTEf.exe
  C:\Windows\System32\giNsTEf.exe
  2⤵
  PID:12620
- C:\Windows\System32\wxdFWtr.exe
  C:\Windows\System32\wxdFWtr.exe
  2⤵
  PID:12640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\ApwNpna.exe

Filesize
1.0MB

MD5
f2e9dccc93301ae8a2c86e89f0e618d5

SHA1
a47767e37b6b4d9f332715bb12cfdb4ee1622d8e

SHA256
8da32ce5733ba0b9d375360785620682453176d8ac4a6fb19fc1d1b9173519c1

SHA512
9b6ed93be1b867239c55a44ecc10fdc38ff5c644b1b26a0d57d01169d37b6952ff2ec130b1cf08864e1bce471ace4d9a8b43ea858b85e05ef73b0e58ff991b1f

Download Submit
C:\Windows\System32\FTiNviF.exe

Filesize
1.0MB

MD5
4ee34b77984b36b48f67f2f32db2c9a9

SHA1
f113bf17a5f57457398c2593c5a086a641128c00

SHA256
7f18cd426d615e8e2014300927d0935b8da54746fabcc0d9b8ca1a7def7ae4de

SHA512
934790ebc866f1949cd70df94f8650e0a24f16c376e9045618ef08f3ab76c3ca98e0b568690548cb557fd12696e04610aaed61a41ff31c215f58476f057270d7

Download Submit
C:\Windows\System32\GKpYZTk.exe

Filesize
1.0MB

MD5
f6740db43b659c9076a3238869c3bba7

SHA1
e24a642f1bf6bad5df2f3282c22c82389c577c95

SHA256
541c1e0f498031025d02e2f719a96abf90240645316825468c036ba4c1610da6

SHA512
5914da5fbd8d642e15ccde16149aa92b71534231d7304c5ecf2193ff8d24a3cdf14f4283f067832664a9ad94f3f4a788e70d954dfe0f4a4d04eddf959956ab6d

Download Submit
C:\Windows\System32\Iurcxxg.exe

Filesize
1.0MB

MD5
5f5816bf5aeb3128df0a674362bcf8f1

SHA1
04e29cf64dab3ae5056f6e86959e46269325a49d

SHA256
9aef2e6ca545e814bb8530b8f773de9c9716ef2a8518768efc43f53384c84324

SHA512
b6e7c286123245c04145088898a76b186df9ff39f8b9534798cbd35877254f129b26376612128c93f7755120fae7cc174ec730e0bbed58662a1b80908a94d748

Download Submit
C:\Windows\System32\JOPReFI.exe

Filesize
1.0MB

MD5
9e6a247873c50dfec115b831821a7d9d

SHA1
de8ad7b543df70a2c7481c1bb3aae251ea6164bc

SHA256
5e224f97773138daa108653492ef4a97536b70da08f52ee444ee4538813a67b1

SHA512
4360ff9bed5ddc9d6e1a7f701405616dd3c84291620ac2d87c6fe20a95e8760a7c559c7a29de0cec206ea4eead697fdc1bac40d3e4b15ee356900a4ab02ad6e6

Download Submit
C:\Windows\System32\JYkrYPv.exe

Filesize
1.0MB

MD5
5e5e6d59bc6abaf0fddaa6ad995bf4d2

SHA1
bd6c8fda78f42b03f9885a9ac5e754d0bc8f926e

SHA256
46594f30a009232595ca66a8c4c00df82d034b60990332adc74aba9963600dee

SHA512
50d9f278c5220c586eabfbdfe0e63f2ba86f0e4e7470f23cec1452ef3a122a8b730e06522b89346d197b9c1f38ff1be8c3314822e1e9eeb6c417512954a9324e

Download Submit
C:\Windows\System32\KWVpyDW.exe

Filesize
1.0MB

MD5
d8b9012187968495790e81dc0aea899c

SHA1
be8739cda1dd0e6b4176092ed4533b01bfebdb81

SHA256
be61bc99999358d107150e6bf5eaad5641dae69e5fef9e959c5b0ce5fbd078bc

SHA512
7ea7b60507e399fd2f0559766c98a1ef5dff77405c1b8728704ea0e981ac417e0361d765bc30dd3c664feb2c4fb4f03c3af2046f1407560c754e5f2e6cf5ae8c

Download Submit
C:\Windows\System32\LtkncPE.exe

Filesize
1.0MB

MD5
f51b7cee9f641b14618d9f6583fcc58b

SHA1
082efe64ccf625556a6f203d947a31320ca279fc

SHA256
9677ec32111d50533b0cec5531e0fec1d35b6aadf69762c65c650ff23dfcd0d3

SHA512
87ccf2bde2284894f2a27b5b6b8ff3e0d7c74252a3880420ac15666cf09dbec5fbdb094eea25672f9e7c342e3425bc9a1875a405063db7ad1a866fbf999a3d01

Download Submit
C:\Windows\System32\MueMQRf.exe

Filesize
1.0MB

MD5
5cb8d8d19f48b67ae339c52f54c5681e

SHA1
6e6267ca61bb6d41c049f6dba36bb1e2e865a266

SHA256
67e7d1e73b989d668886d242a01d83075e7554e30aaa0dc1809522406fad8986

SHA512
92114f529d3ce3ea47a07c36e0146c9bf1cd17c45e1eb95e54d29bc7d04a988a002c004639bf5a111593277223eb65c25c3a577a5b2a1e631c205ee7f2439196

Download Submit
C:\Windows\System32\RHnlNqh.exe

Filesize
1.0MB

MD5
d8588c77c8b0421ce19e53725378a36d

SHA1
5b016dd6f3dcaf405f2245523a29fd94c7cd48ad

SHA256
93f88aec3dedb1387069225852cf7fd894fea3504df506c633d43fa4c63fc058

SHA512
25d4861934aa09f04e328715d5f79dfecbfea056d312c52361bbebc46d43bdb0ecf18400bf983e874c86f8cd0a9787e1444c0a1396967dea7600d61946fc8d18

Download Submit
C:\Windows\System32\RKszrJQ.exe

Filesize
1.0MB

MD5
0c200c82bf76e9c3fc8989ec496d9e0a

SHA1
3a32a2b2de5045de39555503d4f561b7f17980b0

SHA256
ffcc730e908a9c685e97a41b1d9b3e212d30deb1ad89da8e948cf4d3ceb47f7b

SHA512
126ef50c290128feb598476ff2ab2db7ed0cf62695c3bd52b14fa843a0e641d2987df43257bfe521d995e98385684f681994f95ce5dcc3e7cdfe7ecff7067036

Download Submit
C:\Windows\System32\UvJJLqy.exe

Filesize
1.0MB

MD5
861cb5e92394257887b222fca77ca50d

SHA1
72ea6d4d7d35657f293c16da76b9e34f7283d5fd

SHA256
de003159ad6ad55fb46a8ea6edc24ff52d955796a534e8d27aee29a4cab5cfa6

SHA512
5825a8c7ee05faef79560d6fd85424c9c765ec84a65c2a0a728ac7097ffb2c82854da198e6c20272b054818b45f55ea8153e5835f6113a519e00c235850187d9

Download Submit
C:\Windows\System32\VlJoNrd.exe

Filesize
1.0MB

MD5
34a46361643dd7d3265e1a94e38d2fb4

SHA1
f5c50ee625a447238075c9b48cc91d5ec88c2ec7

SHA256
be51538ff3bd2ce58b3611a95ec4feaab9dd65abcdc5aa116e6ed25cb67db205

SHA512
0851180307ad22b382bdc10d33544db46267a3b0045421eb4e738933a4d2e5093e92faed9912dd10f22e07ba0418d1617ceda21b4caa70ba6e8b311a3bf83f5c

Download Submit
C:\Windows\System32\WCnHfzc.exe

Filesize
1.0MB

MD5
a67448857040f8d279b1c2aca06f83b8

SHA1
78d686ea56edfbc7b1f44d1918c9beb6fee89bf6

SHA256
647ed058b9cec2c1bcab7b032a86bf88c4875383e9a0796ccbc2e9e364b89693

SHA512
22a61a779d889335bbe9fae84aa5542400d15bfd0de04f63339c7963fd8d33ce18b00ef4afc4c5f996aa817cdea3fed2e38d9a3db5b930f2de6695441f63f2dc

Download Submit
C:\Windows\System32\XIiLLvY.exe

Filesize
1.0MB

MD5
18fe1e91f58c0fc51bd5429496cfa4d5

SHA1
6498712ff4bf71362e3f6c654efd97198a9eb635

SHA256
41ad4b7a4ab059e9c03b1efa954a334fc1fd991f47003b8a8bfa8c0fa32afa56

SHA512
e1863aab0e0d330c7fa219a8dacc504a0666332c5051590410b0c4707e6410129b40989b3545300e638a3684f5ebefdcf34ed54b428d60b6029e052d5d76403f

Download Submit
C:\Windows\System32\cAuJCvq.exe

Filesize
1.0MB

MD5
a3cb61eb5854cfeda04fedc56d6fb5f2

SHA1
8dc79954427186c48155092d6e8091bb3db399b5

SHA256
eda62cd662f0870177724df78ee852569e18560eb3a690a8308c6633bf4bc7e5

SHA512
921dcefc910f3c30f71df3e6ff90835972af4336f41e58d40a4e03c57be1fb7910f9c8098d69513ab187eceafc6c666014253b0a6216ac18facb5d91a8192332

Download Submit
C:\Windows\System32\cZJduaV.exe

Filesize
1.0MB

MD5
a8143e1e1d6c08e9151cd93c197262c8

SHA1
572cf17bf457cafa6b4ceabdccac5f279f6cdbd7

SHA256
d62f82f0edc4b215e26b86497dd5e8e124b443d9aed36377053492be59364902

SHA512
ae0c6599981793fe3962d9cdb4b799534ce2983c17e83109ecab4daf41b71a2430aaec54e7a81972c1acac81c53a3a470c153e68a514f4e745b2c8b419d3ef02

Download Submit
C:\Windows\System32\dRpaNpB.exe

Filesize
1.0MB

MD5
3fbd78cb895566f4f924813958e1ca47

SHA1
b93f488a737da6859b68fb0749fb6667750fbbd3

SHA256
c0153b4444b932b3bdd494e26be6712493c7c5195f9f4d00b7d514dd4ff488f6

SHA512
8645c31a27b86b6e841d137be99e18e4d7f0dae59750c7db9c6a0748c52d5f3b74cbbacbc15c50649742f7fc27666bca6d193152a3217dbdcb1351538423deff

Download Submit
C:\Windows\System32\fOryflT.exe

Filesize
1.0MB

MD5
a16ca8d864813274037d5606c7be859c

SHA1
7a9a63d619ab2fb70afcd649b4618fdefc023b1f

SHA256
bd29169613386b7d3e1ba9fb1f9713db097b98c93182392156bd22ad7028df43

SHA512
045370fcd4b705d636cdf1cf7bda07eec9e7dc914e9b121e63f88b1c791bb24e07b5ae3618e3d206c052e317d14ea8d534c278d7c763db970fb78d9dc30ad2a0

Download Submit
C:\Windows\System32\gFDeRbA.exe

Filesize
1.0MB

MD5
a0694e086e4cc54b6612dc5fae10fdbb

SHA1
df9a52ef36197a8f698aebb1f97d3c0857c590a9

SHA256
67afab720ce6b3ab5e3eeb473b65565e739dbdc88af37aaa60ab3829cbc26daf

SHA512
867165dc26e5e8305253a449c839009d7c1ea42dc057cdb4a606225b9b1710ce56a0f175878c263fe6108a13afef12b6791b13a527cfd7d7c2e847ec68e2e477

Download Submit
C:\Windows\System32\gJJjGIV.exe

Filesize
1.0MB

MD5
94e8762ea1c18bd32553133f74cac408

SHA1
09782e47e403e4e5f47e28e0607751fdb5175667

SHA256
51a508c9a88c88ca0abebb9696d54ace43caa982b034c4118d9ea0c869a64016

SHA512
7815fd6e9eb0562234c771bcef0075392ceacea20aac65d043d8ad8457a0ff0ee56b82960eb3550d8264ca3a7a6da25ce1c6648b84ca8ccd2bc05dddef223f44

Download Submit
C:\Windows\System32\gPddjVl.exe

Filesize
1.0MB

MD5
db450760a203877818dab28066a695af

SHA1
26b5bb958a89bd0b40f7fab5648c5b3da3542809

SHA256
7b5f80758fb48a3bbd4ca4ec2565e1c34216dd8e75769bf51a7a30e0adaea4be

SHA512
c3ee96726b1ab0cb50a554c8cc0434f617b64e0c607e6af1d3e67554628b66573242d92ba10714af31ea5e9388c9d7758b6851cc841cbfd6f1f3e47eb6551f7d

Download Submit
C:\Windows\System32\hkVCGGE.exe

Filesize
1.0MB

MD5
1d3153d778f8781f880732363839dda7

SHA1
48f3a133109f4b2babdc8602491fa0a2186a0620

SHA256
f4a32ad234b1fe4772b17841b551ec4bdb5fc7534f011afe636b1e9a03888f39

SHA512
4e9532bd4b2b2c2fe03d64a4b3e981b250002c2279243670ad2fe3576a14270d965ca62f636e31fabfc0b284b263385b475d03dfacf19a0c390fb66f5c1c511d

Download Submit
C:\Windows\System32\hmZsWvR.exe

Filesize
1.0MB

MD5
bd94c2a763b5aabe454b8aa24ab34b93

SHA1
102500c548ca5a53cc6ba7ee3dfc94ae8f13891e

SHA256
b92f17a87171f79aaad0671608f655d4a2098f54be5f6083c04a8d1d51c0f99c

SHA512
6a7bba8d4584319cf28301b050a1ccb73ea4fbf491456fc0e2e0ba50227d113f50f8c4597804809341249f84e14dcb02769b9c367f5c8860662515bfb68ec130

Download Submit
C:\Windows\System32\iwPczgK.exe

Filesize
1.0MB

MD5
83450fb24f85766c0458b00f3660c17f

SHA1
e3d9201397dcf51fb7fd043b2ee9450b82811f98

SHA256
9be547090f4bac72fa76c74f9fec2e86fb915264733c28dc6e3efac7f82376ac

SHA512
9aa1628ee9311b1ca5d6a71e3f9cfc53bdc8883e239290cf821e47a59ec1eba5fab1ea106683d7b55f8a3b7614a00e61f02557facc1a6090cb58838783cba296

Download Submit
C:\Windows\System32\jZdHYjp.exe

Filesize
1.0MB

MD5
e7e314ebdd20c22b5ded2e4821dd3f6e

SHA1
5850ad8221d158ab183681701ea24715821a9a54

SHA256
569a05bc064038cda0ab23fbb06f9126f0e8bfb4e122f93ed96ed5ad78c2026d

SHA512
b5758b909b32bd22ca25a5566621e728ca04148c2a0ebb08ba84a9499412137273fb8acfe276f4e7a3f31aaf6840db368fc1b48be753e5bdaf60ebd9e509b105

Download Submit
C:\Windows\System32\lHxyiCQ.exe

Filesize
1.0MB

MD5
a3b8a58c42370e57525e77d9dfe8e49d

SHA1
362c6a24ab81e3230bf2eb13aa145cce23072cfe

SHA256
673e0525f03f405b8b7f553ffd3b045f63d69c19862b8c8dbbbf7ddb5cc6e17d

SHA512
0a54e585bf94fe1323134030aba6dbc434778f5be941568f53357b56555372d1f779ff63267cd359976274a5b42c837b697271ff0a424fbcbb251746076b70fa

Download Submit
C:\Windows\System32\neCupoc.exe

Filesize
1.0MB

MD5
967ee99ddc571431150a0f2707937a9e

SHA1
6374828c04bd31dba9c45aa6aa0081737a73a83c

SHA256
d6cc5b57f33f6949b44b47e52468e66080a37ea617653422c466a6b2897317f5

SHA512
dc19d399c09d8a7172ad4bad59c5a510b97fdd2617566547705627a6bd6fc0b17b7dc3027f359981adb4f55ab1a3f42889263c2cfea68ced186eaba213590bf8

Download Submit
C:\Windows\System32\sPPNsbY.exe

Filesize
1.0MB

MD5
86047558997ef8e24a30ca7c7c24fbe3

SHA1
9b817067c47331af1e5ae0c68cb2625d51e2f597

SHA256
40fe2abbdee3543d23cb43a15dd4abaae9301f7ac7510c271c75b42528a1654e

SHA512
838d08b590b15342efba8d943d4c8db2ff241a5ac1243356d218e1776c943e6303e299f431e841e9b6da2dc30b15a35c71dda5a9e00eb45cb1538229399fcd81

Download Submit
C:\Windows\System32\tTISsPW.exe

Filesize
1.0MB

MD5
99d13e6c0ff7ec152aa83008e335efa4

SHA1
5ab4b44c5e570281f877328871c9d0ad521778dd

SHA256
83d962d95dde900bc110777e7bcfac48935b488eea48328e2bced4e4b72ffb79

SHA512
92103bc865005489cfc2faf304d4caad50a3a32edb304e157bea2a0e6494134b3e79dc70f62d8fb4798715c43d7be6570d05f206d88d0c98c643a744b892bacd

Download Submit
C:\Windows\System32\uiRUkSH.exe

Filesize
1.0MB

MD5
6aa8a4c869a074c966fb63c4f4f6bd23

SHA1
9bdd4502997b23ae2b6aa7db3b4becce10087a1c

SHA256
191ee6ffd6d495a6c297419aa97fdc780da2e4074d661d946c500024e65123c5

SHA512
a209961a2453dd98dc16a1bb13c2fdc8886d3928a5ddf3407cc6a22300a475883b19f496253bd97deb049d29caca41c131fc6813000862e961b22deeb43f24b6

Download Submit
C:\Windows\System32\wFanfoL.exe

Filesize
1.0MB

MD5
6f0756c2ec71231208e0dbfbd0ddd535

SHA1
56d724cb6715138ec4ff75461753cfc73dac4406

SHA256
bd5baa8bdd75583f02461600e7eae3863404cc29d17bbabacf2b6b3b294d6c3d

SHA512
43a0c1287681311ed7b973647b5ea69e9835eb1bac312f56fafc4072de20a209b472857e58e9423580f5600f0b4423fed8a38153a1d4bad4c7d80dd16546a4ed

Download Submit
memory/780-11-0x00007FF7578E0000-0x00007FF757CD1000-memory.dmp

Filesize
3.9MB

Download
memory/780-1970-0x00007FF7578E0000-0x00007FF757CD1000-memory.dmp

Filesize
3.9MB

Download
memory/780-2011-0x00007FF7578E0000-0x00007FF757CD1000-memory.dmp

Filesize
3.9MB

Download
memory/972-2013-0x00007FF7F3DE0000-0x00007FF7F41D1000-memory.dmp

Filesize
3.9MB

Download
memory/972-1973-0x00007FF7F3DE0000-0x00007FF7F41D1000-memory.dmp

Filesize
3.9MB

Download
memory/972-18-0x00007FF7F3DE0000-0x00007FF7F41D1000-memory.dmp

Filesize
3.9MB

Download
memory/1600-2024-0x00007FF6E3DE0000-0x00007FF6E41D1000-memory.dmp

Filesize
3.9MB

Download
memory/1600-478-0x00007FF6E3DE0000-0x00007FF6E41D1000-memory.dmp

Filesize
3.9MB

Download
memory/1840-2050-0x00007FF76A0E0000-0x00007FF76A4D1000-memory.dmp

Filesize
3.9MB

Download
memory/1840-463-0x00007FF76A0E0000-0x00007FF76A4D1000-memory.dmp

Filesize
3.9MB

Download
memory/2012-2016-0x00007FF616F20000-0x00007FF617311000-memory.dmp

Filesize
3.9MB

Download
memory/2012-29-0x00007FF616F20000-0x00007FF617311000-memory.dmp

Filesize
3.9MB

Download
memory/2124-2038-0x00007FF751480000-0x00007FF751871000-memory.dmp

Filesize
3.9MB

Download
memory/2124-466-0x00007FF751480000-0x00007FF751871000-memory.dmp

Filesize
3.9MB

Download
memory/2208-2055-0x00007FF7C87C0000-0x00007FF7C8BB1000-memory.dmp

Filesize
3.9MB

Download
memory/2208-441-0x00007FF7C87C0000-0x00007FF7C8BB1000-memory.dmp

Filesize
3.9MB

Download
memory/2220-361-0x00007FF6268D0000-0x00007FF626CC1000-memory.dmp

Filesize
3.9MB

Download
memory/2220-2020-0x00007FF6268D0000-0x00007FF626CC1000-memory.dmp

Filesize
3.9MB

Download
memory/2368-1971-0x00007FF752D40000-0x00007FF753131000-memory.dmp

Filesize
3.9MB

Download
memory/2368-0-0x00007FF752D40000-0x00007FF753131000-memory.dmp

Filesize
3.9MB

Download
memory/2368-1-0x000001C399920000-0x000001C399930000-memory.dmp

Filesize
64KB

Download
memory/2392-471-0x00007FF7549A0000-0x00007FF754D91000-memory.dmp

Filesize
3.9MB

Download
memory/2392-2037-0x00007FF7549A0000-0x00007FF754D91000-memory.dmp

Filesize
3.9MB

Download
memory/2448-455-0x00007FF7A62F0000-0x00007FF7A66E1000-memory.dmp

Filesize
3.9MB

Download
memory/2448-2056-0x00007FF7A62F0000-0x00007FF7A66E1000-memory.dmp

Filesize
3.9MB

Download
memory/2884-2005-0x00007FF64F6E0000-0x00007FF64FAD1000-memory.dmp

Filesize
3.9MB

Download
memory/2884-22-0x00007FF64F6E0000-0x00007FF64FAD1000-memory.dmp

Filesize
3.9MB

Download
memory/2884-2017-0x00007FF64F6E0000-0x00007FF64FAD1000-memory.dmp

Filesize
3.9MB

Download
memory/3204-2034-0x00007FF6106C0000-0x00007FF610AB1000-memory.dmp

Filesize
3.9MB

Download
memory/3204-396-0x00007FF6106C0000-0x00007FF610AB1000-memory.dmp

Filesize
3.9MB

Download
memory/3328-2061-0x00007FF72D770000-0x00007FF72DB61000-memory.dmp

Filesize
3.9MB

Download
memory/3328-437-0x00007FF72D770000-0x00007FF72DB61000-memory.dmp

Filesize
3.9MB

Download
memory/3364-2021-0x00007FF662B40000-0x00007FF662F31000-memory.dmp

Filesize
3.9MB

Download
memory/3364-370-0x00007FF662B40000-0x00007FF662F31000-memory.dmp

Filesize
3.9MB

Download
memory/3432-2043-0x00007FF78E9C0000-0x00007FF78EDB1000-memory.dmp

Filesize
3.9MB

Download
memory/3432-408-0x00007FF78E9C0000-0x00007FF78EDB1000-memory.dmp

Filesize
3.9MB

Download
memory/3504-2029-0x00007FF7A2D30000-0x00007FF7A3121000-memory.dmp

Filesize
3.9MB

Download
memory/3504-386-0x00007FF7A2D30000-0x00007FF7A3121000-memory.dmp

Filesize
3.9MB

Download
memory/3556-472-0x00007FF7D3050000-0x00007FF7D3441000-memory.dmp

Filesize
3.9MB

Download
memory/3556-2025-0x00007FF7D3050000-0x00007FF7D3441000-memory.dmp

Filesize
3.9MB

Download
memory/3944-2027-0x00007FF6EE5D0000-0x00007FF6EE9C1000-memory.dmp

Filesize
3.9MB

Download
memory/3944-371-0x00007FF6EE5D0000-0x00007FF6EE9C1000-memory.dmp

Filesize
3.9MB

Download
memory/4064-427-0x00007FF61E6B0000-0x00007FF61EAA1000-memory.dmp

Filesize
3.9MB

Download
memory/4064-2063-0x00007FF61E6B0000-0x00007FF61EAA1000-memory.dmp

Filesize
3.9MB

Download
memory/4104-439-0x00007FF76F040000-0x00007FF76F431000-memory.dmp

Filesize
3.9MB

Download
memory/4104-2059-0x00007FF76F040000-0x00007FF76F431000-memory.dmp

Filesize
3.9MB

Download
memory/4176-399-0x00007FF6E5B50000-0x00007FF6E5F41000-memory.dmp

Filesize
3.9MB

Download
memory/4176-2032-0x00007FF6E5B50000-0x00007FF6E5F41000-memory.dmp

Filesize
3.9MB

Download
memory/4516-2052-0x00007FF77F740000-0x00007FF77FB31000-memory.dmp

Filesize
3.9MB

Download
memory/4516-461-0x00007FF77F740000-0x00007FF77FB31000-memory.dmp

Filesize
3.9MB

Download
memory/5084-2041-0x00007FF74F0B0000-0x00007FF74F4A1000-memory.dmp

Filesize
3.9MB

Download
memory/5084-413-0x00007FF74F0B0000-0x00007FF74F4A1000-memory.dmp

Filesize
3.9MB

Download
memory/5104-2064-0x00007FF612930000-0x00007FF612D21000-memory.dmp

Filesize
3.9MB

Download
memory/5104-415-0x00007FF612930000-0x00007FF612D21000-memory.dmp

Filesize
3.9MB

Download