xmrig | b70ba47b4e7220bb8cddacfd1a4caa0adb8629b58aa2b2338eda6ed76f525483

Analysis

max time kernel
61s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
Size

1.2MB
MD5

02c41cea18c8c263974a58630e1b6547
SHA1

df57f16e85a1f74b08a6f99bafd368af91f5ebe1
SHA256

b70ba47b4e7220bb8cddacfd1a4caa0adb8629b58aa2b2338eda6ed76f525483
SHA512

17983d57f9037c6a85c2a5b3d8aa92f08fd2e7766a02be431aa3be192a6d1fae1712626600d082cbfb08e443c8a233293d5453a65b57280e32380694c820588a
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcmC3f/DFNkTF8X550q/zj:knw9oUUEEDl37jcmWH/HTR

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/1916-8-0x00007FF63A570000-0x00007FF63A961000-memory.dmp	xmrig
behavioral2/memory/2472-41-0x00007FF7FF8F0000-0x00007FF7FFCE1000-memory.dmp	xmrig
behavioral2/memory/4476-384-0x00007FF608950000-0x00007FF608D41000-memory.dmp	xmrig
behavioral2/memory/4944-374-0x00007FF742A80000-0x00007FF742E71000-memory.dmp	xmrig
behavioral2/memory/2604-406-0x00007FF6ACAD0000-0x00007FF6ACEC1000-memory.dmp	xmrig
behavioral2/memory/3036-410-0x00007FF6F52D0000-0x00007FF6F56C1000-memory.dmp	xmrig
behavioral2/memory/2948-420-0x00007FF744D30000-0x00007FF745121000-memory.dmp	xmrig
behavioral2/memory/4084-432-0x00007FF769B10000-0x00007FF769F01000-memory.dmp	xmrig
behavioral2/memory/316-446-0x00007FF60D940000-0x00007FF60DD31000-memory.dmp	xmrig
behavioral2/memory/4860-453-0x00007FF7BA590000-0x00007FF7BA981000-memory.dmp	xmrig
behavioral2/memory/2384-462-0x00007FF716310000-0x00007FF716701000-memory.dmp	xmrig
behavioral2/memory/4248-465-0x00007FF6DF250000-0x00007FF6DF641000-memory.dmp	xmrig
behavioral2/memory/4672-475-0x00007FF678170000-0x00007FF678561000-memory.dmp	xmrig
behavioral2/memory/1872-472-0x00007FF7DFD90000-0x00007FF7E0181000-memory.dmp	xmrig
behavioral2/memory/2412-461-0x00007FF7DC7D0000-0x00007FF7DCBC1000-memory.dmp	xmrig
behavioral2/memory/4936-459-0x00007FF739210000-0x00007FF739601000-memory.dmp	xmrig
behavioral2/memory/2964-440-0x00007FF724770000-0x00007FF724B61000-memory.dmp	xmrig
behavioral2/memory/4544-428-0x00007FF6C8570000-0x00007FF6C8961000-memory.dmp	xmrig
behavioral2/memory/2356-425-0x00007FF64A240000-0x00007FF64A631000-memory.dmp	xmrig
behavioral2/memory/4468-400-0x00007FF756770000-0x00007FF756B61000-memory.dmp	xmrig
behavioral2/memory/4428-388-0x00007FF70E7B0000-0x00007FF70EBA1000-memory.dmp	xmrig
behavioral2/memory/3320-45-0x00007FF7E1AC0000-0x00007FF7E1EB1000-memory.dmp	xmrig
behavioral2/memory/2480-33-0x00007FF7EF4E0000-0x00007FF7EF8D1000-memory.dmp	xmrig
behavioral2/memory/844-28-0x00007FF61FB90000-0x00007FF61FF81000-memory.dmp	xmrig
behavioral2/memory/844-1954-0x00007FF61FB90000-0x00007FF61FF81000-memory.dmp	xmrig
behavioral2/memory/1916-1989-0x00007FF63A570000-0x00007FF63A961000-memory.dmp	xmrig
behavioral2/memory/844-1991-0x00007FF61FB90000-0x00007FF61FF81000-memory.dmp	xmrig
behavioral2/memory/3320-1993-0x00007FF7E1AC0000-0x00007FF7E1EB1000-memory.dmp	xmrig
behavioral2/memory/2480-1995-0x00007FF7EF4E0000-0x00007FF7EF8D1000-memory.dmp	xmrig
behavioral2/memory/4944-2001-0x00007FF742A80000-0x00007FF742E71000-memory.dmp	xmrig
behavioral2/memory/2472-2000-0x00007FF7FF8F0000-0x00007FF7FFCE1000-memory.dmp	xmrig
behavioral2/memory/4672-2003-0x00007FF678170000-0x00007FF678561000-memory.dmp	xmrig
behavioral2/memory/4476-1999-0x00007FF608950000-0x00007FF608D41000-memory.dmp	xmrig
behavioral2/memory/2964-2023-0x00007FF724770000-0x00007FF724B61000-memory.dmp	xmrig
behavioral2/memory/4248-2036-0x00007FF6DF250000-0x00007FF6DF641000-memory.dmp	xmrig
behavioral2/memory/4428-2033-0x00007FF70E7B0000-0x00007FF70EBA1000-memory.dmp	xmrig
behavioral2/memory/2948-2030-0x00007FF744D30000-0x00007FF745121000-memory.dmp	xmrig
behavioral2/memory/3036-2028-0x00007FF6F52D0000-0x00007FF6F56C1000-memory.dmp	xmrig
behavioral2/memory/2356-2026-0x00007FF64A240000-0x00007FF64A631000-memory.dmp	xmrig
behavioral2/memory/316-2022-0x00007FF60D940000-0x00007FF60DD31000-memory.dmp	xmrig
behavioral2/memory/4860-2020-0x00007FF7BA590000-0x00007FF7BA981000-memory.dmp	xmrig
behavioral2/memory/4936-2018-0x00007FF739210000-0x00007FF739601000-memory.dmp	xmrig
behavioral2/memory/2384-2016-0x00007FF716310000-0x00007FF716701000-memory.dmp	xmrig
behavioral2/memory/2412-2014-0x00007FF7DC7D0000-0x00007FF7DCBC1000-memory.dmp	xmrig
behavioral2/memory/1872-2011-0x00007FF7DFD90000-0x00007FF7E0181000-memory.dmp	xmrig
behavioral2/memory/2604-2010-0x00007FF6ACAD0000-0x00007FF6ACEC1000-memory.dmp	xmrig
behavioral2/memory/4468-2032-0x00007FF756770000-0x00007FF756B61000-memory.dmp	xmrig
behavioral2/memory/4084-2006-0x00007FF769B10000-0x00007FF769F01000-memory.dmp	xmrig
behavioral2/memory/4544-2007-0x00007FF6C8570000-0x00007FF6C8961000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1916	hwRXDWC.exe
844	OfSIQJQ.exe
3320	nEswdPI.exe
2480	dQYzkCC.exe
2472	JKvROkU.exe
4944	JWuzWPD.exe
4476	DmvTtSf.exe
1872	yxXTpvH.exe
4672	xnHwpVh.exe
4428	JbeSkTc.exe
4468	EgyhVgL.exe
2604	COlETFR.exe
3036	JWoGuzE.exe
2948	npXcsEb.exe
2356	OGlqmIs.exe
4544	TuOvbov.exe
4084	CyAvcBk.exe
2964	FoRjEHv.exe
316	cRojvmr.exe
4860	GKoKoxD.exe
4936	gzidifZ.exe
2412	nNYBufb.exe
2384	MLxKcav.exe
4248	UWiVDuR.exe
3016	mFOvggM.exe
4332	frrcvFW.exe
1192	ftjcbdI.exe
756	LurphuY.exe
384	axCFWnv.exe
3268	mdhAUrL.exe
2468	HRGQwpg.exe
3600	qzyJQZb.exe
3824	KaPawMv.exe
5064	PECmIcl.exe
5016	XEIVhGG.exe
1032	RawSiSm.exe
3616	mOCpDmM.exe
1168	PWCoHxH.exe
2696	XrBeahS.exe
928	qeLOfbA.exe
3844	pcbBSUe.exe
1784	AhHGNsS.exe
4208	uwxknTl.exe
3412	VMSFrPc.exe
5076	WFtVgSH.exe
3344	MNMVTwu.exe
840	nnKppWx.exe
1036	uHGSbFy.exe
2056	loEkvZo.exe
4372	pPanFxc.exe
4456	rzUvWyz.exe
60	xpbMZXg.exe
4116	buYoByd.exe
1264	AsSYuSa.exe
1880	POhmkxl.exe
4412	Oohiuub.exe
3984	HGWnyVr.exe
8	HfOzEiD.exe
712	uCIWpUx.exe
5044	oMMhxfl.exe
4416	FOKihVO.exe
2788	LmQhZAW.exe
4488	bNZiWBQ.exe
920	nyFkxjC.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3636-0-0x00007FF63CB80000-0x00007FF63CF71000-memory.dmp	upx
behavioral2/files/0x000e000000023b57-5.dat	upx
behavioral2/memory/1916-8-0x00007FF63A570000-0x00007FF63A961000-memory.dmp	upx
behavioral2/files/0x000b000000023b61-12.dat	upx
behavioral2/files/0x000a000000023b65-16.dat	upx
behavioral2/files/0x000a000000023b66-22.dat	upx
behavioral2/files/0x000a000000023b67-25.dat	upx
behavioral2/files/0x000a000000023b68-37.dat	upx
behavioral2/memory/2472-41-0x00007FF7FF8F0000-0x00007FF7FFCE1000-memory.dmp	upx
behavioral2/files/0x000b000000023b62-61.dat	upx
behavioral2/files/0x000a000000023b6d-66.dat	upx
behavioral2/files/0x000a000000023b6f-74.dat	upx
behavioral2/files/0x000a000000023b74-101.dat	upx
behavioral2/files/0x000a000000023b76-111.dat	upx
behavioral2/files/0x000a000000023b78-121.dat	upx
behavioral2/files/0x000a000000023b80-161.dat	upx
behavioral2/memory/4476-384-0x00007FF608950000-0x00007FF608D41000-memory.dmp	upx
behavioral2/memory/4944-374-0x00007FF742A80000-0x00007FF742E71000-memory.dmp	upx
behavioral2/memory/2604-406-0x00007FF6ACAD0000-0x00007FF6ACEC1000-memory.dmp	upx
behavioral2/memory/3036-410-0x00007FF6F52D0000-0x00007FF6F56C1000-memory.dmp	upx
behavioral2/memory/2948-420-0x00007FF744D30000-0x00007FF745121000-memory.dmp	upx
behavioral2/memory/4084-432-0x00007FF769B10000-0x00007FF769F01000-memory.dmp	upx
behavioral2/memory/316-446-0x00007FF60D940000-0x00007FF60DD31000-memory.dmp	upx
behavioral2/memory/4860-453-0x00007FF7BA590000-0x00007FF7BA981000-memory.dmp	upx
behavioral2/memory/2384-462-0x00007FF716310000-0x00007FF716701000-memory.dmp	upx
behavioral2/memory/4248-465-0x00007FF6DF250000-0x00007FF6DF641000-memory.dmp	upx
behavioral2/memory/4672-475-0x00007FF678170000-0x00007FF678561000-memory.dmp	upx
behavioral2/memory/1872-472-0x00007FF7DFD90000-0x00007FF7E0181000-memory.dmp	upx
behavioral2/memory/2412-461-0x00007FF7DC7D0000-0x00007FF7DCBC1000-memory.dmp	upx
behavioral2/memory/4936-459-0x00007FF739210000-0x00007FF739601000-memory.dmp	upx
behavioral2/memory/2964-440-0x00007FF724770000-0x00007FF724B61000-memory.dmp	upx
behavioral2/memory/4544-428-0x00007FF6C8570000-0x00007FF6C8961000-memory.dmp	upx
behavioral2/memory/2356-425-0x00007FF64A240000-0x00007FF64A631000-memory.dmp	upx
behavioral2/memory/4468-400-0x00007FF756770000-0x00007FF756B61000-memory.dmp	upx
behavioral2/memory/4428-388-0x00007FF70E7B0000-0x00007FF70EBA1000-memory.dmp	upx
behavioral2/files/0x000a000000023b81-166.dat	upx
behavioral2/files/0x000a000000023b7f-156.dat	upx
behavioral2/files/0x000a000000023b7e-151.dat	upx
behavioral2/files/0x000a000000023b7d-146.dat	upx
behavioral2/files/0x000a000000023b7c-141.dat	upx
behavioral2/files/0x000a000000023b7b-136.dat	upx
behavioral2/files/0x000a000000023b7a-131.dat	upx
behavioral2/files/0x000a000000023b79-126.dat	upx
behavioral2/files/0x000a000000023b77-116.dat	upx
behavioral2/files/0x000a000000023b75-106.dat	upx
behavioral2/files/0x000a000000023b73-96.dat	upx
behavioral2/files/0x000a000000023b72-91.dat	upx
behavioral2/files/0x000a000000023b71-86.dat	upx
behavioral2/files/0x000a000000023b70-81.dat	upx
behavioral2/files/0x000a000000023b6e-71.dat	upx
behavioral2/files/0x000a000000023b6c-56.dat	upx
behavioral2/files/0x000a000000023b6a-51.dat	upx
behavioral2/files/0x000a000000023b6b-49.dat	upx
behavioral2/memory/3320-45-0x00007FF7E1AC0000-0x00007FF7E1EB1000-memory.dmp	upx
behavioral2/files/0x000a000000023b69-39.dat	upx
behavioral2/memory/2480-33-0x00007FF7EF4E0000-0x00007FF7EF8D1000-memory.dmp	upx
behavioral2/memory/844-28-0x00007FF61FB90000-0x00007FF61FF81000-memory.dmp	upx
behavioral2/memory/844-1954-0x00007FF61FB90000-0x00007FF61FF81000-memory.dmp	upx
behavioral2/memory/1916-1989-0x00007FF63A570000-0x00007FF63A961000-memory.dmp	upx
behavioral2/memory/844-1991-0x00007FF61FB90000-0x00007FF61FF81000-memory.dmp	upx
behavioral2/memory/3320-1993-0x00007FF7E1AC0000-0x00007FF7E1EB1000-memory.dmp	upx
behavioral2/memory/2480-1995-0x00007FF7EF4E0000-0x00007FF7EF8D1000-memory.dmp	upx
behavioral2/memory/4944-2001-0x00007FF742A80000-0x00007FF742E71000-memory.dmp	upx
behavioral2/memory/2472-2000-0x00007FF7FF8F0000-0x00007FF7FFCE1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\JbeSkTc.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\doKwpVs.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\FBDYcBr.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\nFDxbAF.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\OEamxGn.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\rarTlFm.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\WlBGjzU.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\esAZbsW.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\Uspdmwm.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\rpfNZTQ.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\PHQLHxt.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\Oohiuub.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\uiPOIji.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\MUvcaMJ.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\mYOGiXp.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\xQZUcwX.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\LHaOgib.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\PfGQKMJ.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\oXwQwkC.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\EgyhVgL.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\KaPawMv.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\cPsgCTJ.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\RbqTMsT.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\MHPjnmy.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\QEqtaJF.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\MtXXmdU.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\PoMzotB.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\HpJbMiF.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\KDSaYeR.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\bNZiWBQ.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\KErsThc.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\rogQrDt.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\QrVMmkD.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\wdXrbzE.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\eRLJdBB.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\wDkxccR.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\oTCMHdM.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\OzHtBRL.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\dQYzkCC.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\UWiVDuR.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\qzyJQZb.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\WFtVgSH.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\SGbjQdI.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\HqxFGzb.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\EJdvGFv.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\RPCgBpD.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\BPaNidE.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\iGujxzc.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\TUFWNGj.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\LrREomC.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\nbZZutH.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\yCsmbuN.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\oytXiKs.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\DBfSiBr.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\TuOvbov.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\mdhAUrL.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\ihrfVTq.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\lgBrHBD.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\YLCGJIi.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\FVXeuuY.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\dHfHNqm.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\LPzWYaV.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\owWzSSn.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
File created	C:\Windows\System32\pcbBSUe.exe	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 1916	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	84
PID 3636 wrote to memory of 1916	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	84
PID 3636 wrote to memory of 844	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	85
PID 3636 wrote to memory of 844	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	85
PID 3636 wrote to memory of 3320	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	86
PID 3636 wrote to memory of 3320	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	86
PID 3636 wrote to memory of 2480	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	87
PID 3636 wrote to memory of 2480	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	87
PID 3636 wrote to memory of 2472	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	88
PID 3636 wrote to memory of 2472	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	88
PID 3636 wrote to memory of 4944	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	89
PID 3636 wrote to memory of 4944	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	89
PID 3636 wrote to memory of 4476	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	90
PID 3636 wrote to memory of 4476	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	90
PID 3636 wrote to memory of 1872	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	91
PID 3636 wrote to memory of 1872	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	91
PID 3636 wrote to memory of 4672	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	92
PID 3636 wrote to memory of 4672	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	92
PID 3636 wrote to memory of 4428	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	93
PID 3636 wrote to memory of 4428	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	93
PID 3636 wrote to memory of 4468	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	94
PID 3636 wrote to memory of 4468	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	94
PID 3636 wrote to memory of 2604	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	95
PID 3636 wrote to memory of 2604	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	95
PID 3636 wrote to memory of 3036	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	96
PID 3636 wrote to memory of 3036	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	96
PID 3636 wrote to memory of 2948	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	97
PID 3636 wrote to memory of 2948	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	97
PID 3636 wrote to memory of 2356	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	98
PID 3636 wrote to memory of 2356	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	98
PID 3636 wrote to memory of 4544	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	99
PID 3636 wrote to memory of 4544	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	99
PID 3636 wrote to memory of 4084	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	100
PID 3636 wrote to memory of 4084	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	100
PID 3636 wrote to memory of 2964	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	101
PID 3636 wrote to memory of 2964	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	101
PID 3636 wrote to memory of 316	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	102
PID 3636 wrote to memory of 316	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	102
PID 3636 wrote to memory of 4860	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	103
PID 3636 wrote to memory of 4860	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	103
PID 3636 wrote to memory of 4936	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	104
PID 3636 wrote to memory of 4936	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	104
PID 3636 wrote to memory of 2412	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	105
PID 3636 wrote to memory of 2412	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	105
PID 3636 wrote to memory of 2384	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	106
PID 3636 wrote to memory of 2384	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	106
PID 3636 wrote to memory of 4248	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	107
PID 3636 wrote to memory of 4248	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	107
PID 3636 wrote to memory of 3016	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	108
PID 3636 wrote to memory of 3016	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	108
PID 3636 wrote to memory of 4332	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	109
PID 3636 wrote to memory of 4332	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	109
PID 3636 wrote to memory of 1192	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	110
PID 3636 wrote to memory of 1192	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	110
PID 3636 wrote to memory of 756	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	111
PID 3636 wrote to memory of 756	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	111
PID 3636 wrote to memory of 384	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	112
PID 3636 wrote to memory of 384	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	112
PID 3636 wrote to memory of 3268	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	113
PID 3636 wrote to memory of 3268	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	113
PID 3636 wrote to memory of 2468	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	114
PID 3636 wrote to memory of 2468	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	114
PID 3636 wrote to memory of 3600	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	115
PID 3636 wrote to memory of 3600	3636	02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02c41cea18c8c263974a58630e1b6547_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\System32\hwRXDWC.exe
  C:\Windows\System32\hwRXDWC.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System32\OfSIQJQ.exe
  C:\Windows\System32\OfSIQJQ.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System32\nEswdPI.exe
  C:\Windows\System32\nEswdPI.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System32\dQYzkCC.exe
  C:\Windows\System32\dQYzkCC.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System32\JKvROkU.exe
  C:\Windows\System32\JKvROkU.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System32\JWuzWPD.exe
  C:\Windows\System32\JWuzWPD.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System32\DmvTtSf.exe
  C:\Windows\System32\DmvTtSf.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System32\yxXTpvH.exe
  C:\Windows\System32\yxXTpvH.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System32\xnHwpVh.exe
  C:\Windows\System32\xnHwpVh.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System32\JbeSkTc.exe
  C:\Windows\System32\JbeSkTc.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System32\EgyhVgL.exe
  C:\Windows\System32\EgyhVgL.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System32\COlETFR.exe
  C:\Windows\System32\COlETFR.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System32\JWoGuzE.exe
  C:\Windows\System32\JWoGuzE.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System32\npXcsEb.exe
  C:\Windows\System32\npXcsEb.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System32\OGlqmIs.exe
  C:\Windows\System32\OGlqmIs.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System32\TuOvbov.exe
  C:\Windows\System32\TuOvbov.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System32\CyAvcBk.exe
  C:\Windows\System32\CyAvcBk.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System32\FoRjEHv.exe
  C:\Windows\System32\FoRjEHv.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System32\cRojvmr.exe
  C:\Windows\System32\cRojvmr.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System32\GKoKoxD.exe
  C:\Windows\System32\GKoKoxD.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System32\gzidifZ.exe
  C:\Windows\System32\gzidifZ.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System32\nNYBufb.exe
  C:\Windows\System32\nNYBufb.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System32\MLxKcav.exe
  C:\Windows\System32\MLxKcav.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System32\UWiVDuR.exe
  C:\Windows\System32\UWiVDuR.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System32\mFOvggM.exe
  C:\Windows\System32\mFOvggM.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System32\frrcvFW.exe
  C:\Windows\System32\frrcvFW.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System32\ftjcbdI.exe
  C:\Windows\System32\ftjcbdI.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System32\LurphuY.exe
  C:\Windows\System32\LurphuY.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System32\axCFWnv.exe
  C:\Windows\System32\axCFWnv.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System32\mdhAUrL.exe
  C:\Windows\System32\mdhAUrL.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System32\HRGQwpg.exe
  C:\Windows\System32\HRGQwpg.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System32\qzyJQZb.exe
  C:\Windows\System32\qzyJQZb.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System32\KaPawMv.exe
  C:\Windows\System32\KaPawMv.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System32\PECmIcl.exe
  C:\Windows\System32\PECmIcl.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System32\XEIVhGG.exe
  C:\Windows\System32\XEIVhGG.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System32\RawSiSm.exe
  C:\Windows\System32\RawSiSm.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System32\mOCpDmM.exe
  C:\Windows\System32\mOCpDmM.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System32\PWCoHxH.exe
  C:\Windows\System32\PWCoHxH.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System32\XrBeahS.exe
  C:\Windows\System32\XrBeahS.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System32\qeLOfbA.exe
  C:\Windows\System32\qeLOfbA.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System32\pcbBSUe.exe
  C:\Windows\System32\pcbBSUe.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System32\AhHGNsS.exe
  C:\Windows\System32\AhHGNsS.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System32\uwxknTl.exe
  C:\Windows\System32\uwxknTl.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System32\VMSFrPc.exe
  C:\Windows\System32\VMSFrPc.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System32\WFtVgSH.exe
  C:\Windows\System32\WFtVgSH.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System32\MNMVTwu.exe
  C:\Windows\System32\MNMVTwu.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System32\nnKppWx.exe
  C:\Windows\System32\nnKppWx.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System32\uHGSbFy.exe
  C:\Windows\System32\uHGSbFy.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System32\loEkvZo.exe
  C:\Windows\System32\loEkvZo.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System32\pPanFxc.exe
  C:\Windows\System32\pPanFxc.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System32\rzUvWyz.exe
  C:\Windows\System32\rzUvWyz.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System32\xpbMZXg.exe
  C:\Windows\System32\xpbMZXg.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System32\buYoByd.exe
  C:\Windows\System32\buYoByd.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System32\AsSYuSa.exe
  C:\Windows\System32\AsSYuSa.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System32\POhmkxl.exe
  C:\Windows\System32\POhmkxl.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System32\Oohiuub.exe
  C:\Windows\System32\Oohiuub.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System32\HGWnyVr.exe
  C:\Windows\System32\HGWnyVr.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System32\HfOzEiD.exe
  C:\Windows\System32\HfOzEiD.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System32\uCIWpUx.exe
  C:\Windows\System32\uCIWpUx.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System32\oMMhxfl.exe
  C:\Windows\System32\oMMhxfl.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System32\FOKihVO.exe
  C:\Windows\System32\FOKihVO.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System32\LmQhZAW.exe
  C:\Windows\System32\LmQhZAW.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System32\bNZiWBQ.exe
  C:\Windows\System32\bNZiWBQ.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System32\nyFkxjC.exe
  C:\Windows\System32\nyFkxjC.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System32\sdLNlef.exe
  C:\Windows\System32\sdLNlef.exe
  2⤵
  PID:2268
- C:\Windows\System32\fVvtcWU.exe
  C:\Windows\System32\fVvtcWU.exe
  2⤵
  PID:4112
- C:\Windows\System32\lEDiamC.exe
  C:\Windows\System32\lEDiamC.exe
  2⤵
  PID:3244
- C:\Windows\System32\XEtappB.exe
  C:\Windows\System32\XEtappB.exe
  2⤵
  PID:2872
- C:\Windows\System32\oxgocwt.exe
  C:\Windows\System32\oxgocwt.exe
  2⤵
  PID:2712
- C:\Windows\System32\UxLOHey.exe
  C:\Windows\System32\UxLOHey.exe
  2⤵
  PID:4424
- C:\Windows\System32\RLqNzUj.exe
  C:\Windows\System32\RLqNzUj.exe
  2⤵
  PID:1848
- C:\Windows\System32\FEcRSSC.exe
  C:\Windows\System32\FEcRSSC.exe
  2⤵
  PID:3784
- C:\Windows\System32\wFpkWFU.exe
  C:\Windows\System32\wFpkWFU.exe
  2⤵
  PID:3604
- C:\Windows\System32\dAFhDqf.exe
  C:\Windows\System32\dAFhDqf.exe
  2⤵
  PID:4356
- C:\Windows\System32\tyvDICg.exe
  C:\Windows\System32\tyvDICg.exe
  2⤵
  PID:3820
- C:\Windows\System32\vAeyOcO.exe
  C:\Windows\System32\vAeyOcO.exe
  2⤵
  PID:5012
- C:\Windows\System32\doKwpVs.exe
  C:\Windows\System32\doKwpVs.exe
  2⤵
  PID:1320
- C:\Windows\System32\BRTYjWO.exe
  C:\Windows\System32\BRTYjWO.exe
  2⤵
  PID:3632
- C:\Windows\System32\JCHEcbA.exe
  C:\Windows\System32\JCHEcbA.exe
  2⤵
  PID:3992
- C:\Windows\System32\DNbvUAw.exe
  C:\Windows\System32\DNbvUAw.exe
  2⤵
  PID:4696
- C:\Windows\System32\ZsjHcqp.exe
  C:\Windows\System32\ZsjHcqp.exe
  2⤵
  PID:3996
- C:\Windows\System32\dHfHNqm.exe
  C:\Windows\System32\dHfHNqm.exe
  2⤵
  PID:3228
- C:\Windows\System32\qYROvtj.exe
  C:\Windows\System32\qYROvtj.exe
  2⤵
  PID:3788
- C:\Windows\System32\iFtBSzK.exe
  C:\Windows\System32\iFtBSzK.exe
  2⤵
  PID:408
- C:\Windows\System32\kmLiwLU.exe
  C:\Windows\System32\kmLiwLU.exe
  2⤵
  PID:3536
- C:\Windows\System32\ihrfVTq.exe
  C:\Windows\System32\ihrfVTq.exe
  2⤵
  PID:4796
- C:\Windows\System32\HFSvplB.exe
  C:\Windows\System32\HFSvplB.exe
  2⤵
  PID:4080
- C:\Windows\System32\NqfhJCz.exe
  C:\Windows\System32\NqfhJCz.exe
  2⤵
  PID:2040
- C:\Windows\System32\VhXSVCt.exe
  C:\Windows\System32\VhXSVCt.exe
  2⤵
  PID:4588
- C:\Windows\System32\uCUjPeN.exe
  C:\Windows\System32\uCUjPeN.exe
  2⤵
  PID:684
- C:\Windows\System32\PgBqEyJ.exe
  C:\Windows\System32\PgBqEyJ.exe
  2⤵
  PID:2740
- C:\Windows\System32\BOnHrQG.exe
  C:\Windows\System32\BOnHrQG.exe
  2⤵
  PID:3700
- C:\Windows\System32\ksExeKa.exe
  C:\Windows\System32\ksExeKa.exe
  2⤵
  PID:5132
- C:\Windows\System32\tuMbynI.exe
  C:\Windows\System32\tuMbynI.exe
  2⤵
  PID:5164
- C:\Windows\System32\WtNsVtI.exe
  C:\Windows\System32\WtNsVtI.exe
  2⤵
  PID:5192
- C:\Windows\System32\LFeaxth.exe
  C:\Windows\System32\LFeaxth.exe
  2⤵
  PID:5216
- C:\Windows\System32\aHfdoYf.exe
  C:\Windows\System32\aHfdoYf.exe
  2⤵
  PID:5248
- C:\Windows\System32\LPzWYaV.exe
  C:\Windows\System32\LPzWYaV.exe
  2⤵
  PID:5276
- C:\Windows\System32\ExWOKrI.exe
  C:\Windows\System32\ExWOKrI.exe
  2⤵
  PID:5304
- C:\Windows\System32\MtXXmdU.exe
  C:\Windows\System32\MtXXmdU.exe
  2⤵
  PID:5328
- C:\Windows\System32\RrAxzFI.exe
  C:\Windows\System32\RrAxzFI.exe
  2⤵
  PID:5360
- C:\Windows\System32\wpdqvUs.exe
  C:\Windows\System32\wpdqvUs.exe
  2⤵
  PID:5388
- C:\Windows\System32\FBDYcBr.exe
  C:\Windows\System32\FBDYcBr.exe
  2⤵
  PID:5412
- C:\Windows\System32\wdXrbzE.exe
  C:\Windows\System32\wdXrbzE.exe
  2⤵
  PID:5432
- C:\Windows\System32\LrREomC.exe
  C:\Windows\System32\LrREomC.exe
  2⤵
  PID:5448
- C:\Windows\System32\wgYCFCj.exe
  C:\Windows\System32\wgYCFCj.exe
  2⤵
  PID:5464
- C:\Windows\System32\nTbffBM.exe
  C:\Windows\System32\nTbffBM.exe
  2⤵
  PID:5516
- C:\Windows\System32\ePLwCcK.exe
  C:\Windows\System32\ePLwCcK.exe
  2⤵
  PID:5536
- C:\Windows\System32\BbOlylu.exe
  C:\Windows\System32\BbOlylu.exe
  2⤵
  PID:5552
- C:\Windows\System32\ROdNmEL.exe
  C:\Windows\System32\ROdNmEL.exe
  2⤵
  PID:5576
- C:\Windows\System32\AyuxjhQ.exe
  C:\Windows\System32\AyuxjhQ.exe
  2⤵
  PID:5640
- C:\Windows\System32\qwUGVAA.exe
  C:\Windows\System32\qwUGVAA.exe
  2⤵
  PID:5664
- C:\Windows\System32\pxaSOyI.exe
  C:\Windows\System32\pxaSOyI.exe
  2⤵
  PID:5704
- C:\Windows\System32\HmLKiZb.exe
  C:\Windows\System32\HmLKiZb.exe
  2⤵
  PID:5736
- C:\Windows\System32\MjcsqyK.exe
  C:\Windows\System32\MjcsqyK.exe
  2⤵
  PID:5752
- C:\Windows\System32\zyiVpJt.exe
  C:\Windows\System32\zyiVpJt.exe
  2⤵
  PID:5776
- C:\Windows\System32\LHaOgib.exe
  C:\Windows\System32\LHaOgib.exe
  2⤵
  PID:5812
- C:\Windows\System32\NcfsPCo.exe
  C:\Windows\System32\NcfsPCo.exe
  2⤵
  PID:5832
- C:\Windows\System32\iGujxzc.exe
  C:\Windows\System32\iGujxzc.exe
  2⤵
  PID:5848
- C:\Windows\System32\aFtOfke.exe
  C:\Windows\System32\aFtOfke.exe
  2⤵
  PID:5868
- C:\Windows\System32\GzIxfRo.exe
  C:\Windows\System32\GzIxfRo.exe
  2⤵
  PID:5900
- C:\Windows\System32\bxoaZXE.exe
  C:\Windows\System32\bxoaZXE.exe
  2⤵
  PID:5920
- C:\Windows\System32\KErsThc.exe
  C:\Windows\System32\KErsThc.exe
  2⤵
  PID:5936
- C:\Windows\System32\OdkyQrg.exe
  C:\Windows\System32\OdkyQrg.exe
  2⤵
  PID:5972
- C:\Windows\System32\eRLJdBB.exe
  C:\Windows\System32\eRLJdBB.exe
  2⤵
  PID:6064
- C:\Windows\System32\dVkQwld.exe
  C:\Windows\System32\dVkQwld.exe
  2⤵
  PID:6088
- C:\Windows\System32\ENyPqBE.exe
  C:\Windows\System32\ENyPqBE.exe
  2⤵
  PID:1456
- C:\Windows\System32\MHiavHW.exe
  C:\Windows\System32\MHiavHW.exe
  2⤵
  PID:3584
- C:\Windows\System32\roonZjG.exe
  C:\Windows\System32\roonZjG.exe
  2⤵
  PID:436
- C:\Windows\System32\ZMTUbyk.exe
  C:\Windows\System32\ZMTUbyk.exe
  2⤵
  PID:3904
- C:\Windows\System32\gGUnGIl.exe
  C:\Windows\System32\gGUnGIl.exe
  2⤵
  PID:5096
- C:\Windows\System32\IKpZrcn.exe
  C:\Windows\System32\IKpZrcn.exe
  2⤵
  PID:5264
- C:\Windows\System32\HQvFtGP.exe
  C:\Windows\System32\HQvFtGP.exe
  2⤵
  PID:5292
- C:\Windows\System32\HPIWtOb.exe
  C:\Windows\System32\HPIWtOb.exe
  2⤵
  PID:2352
- C:\Windows\System32\euhfeOV.exe
  C:\Windows\System32\euhfeOV.exe
  2⤵
  PID:5352
- C:\Windows\System32\aVYxSjC.exe
  C:\Windows\System32\aVYxSjC.exe
  2⤵
  PID:3868
- C:\Windows\System32\SGbjQdI.exe
  C:\Windows\System32\SGbjQdI.exe
  2⤵
  PID:5460
- C:\Windows\System32\uiPOIji.exe
  C:\Windows\System32\uiPOIji.exe
  2⤵
  PID:5420
- C:\Windows\System32\OshTinR.exe
  C:\Windows\System32\OshTinR.exe
  2⤵
  PID:5528
- C:\Windows\System32\nFDxbAF.exe
  C:\Windows\System32\nFDxbAF.exe
  2⤵
  PID:5656
- C:\Windows\System32\ezVgjJb.exe
  C:\Windows\System32\ezVgjJb.exe
  2⤵
  PID:5744
- C:\Windows\System32\insITsk.exe
  C:\Windows\System32\insITsk.exe
  2⤵
  PID:5732
- C:\Windows\System32\IAopsKS.exe
  C:\Windows\System32\IAopsKS.exe
  2⤵
  PID:2116
- C:\Windows\System32\ggisEaI.exe
  C:\Windows\System32\ggisEaI.exe
  2⤵
  PID:5896
- C:\Windows\System32\fEjTSYY.exe
  C:\Windows\System32\fEjTSYY.exe
  2⤵
  PID:5952
- C:\Windows\System32\RnPIdXN.exe
  C:\Windows\System32\RnPIdXN.exe
  2⤵
  PID:6004
- C:\Windows\System32\utMeiuS.exe
  C:\Windows\System32\utMeiuS.exe
  2⤵
  PID:6104
- C:\Windows\System32\QKOIshK.exe
  C:\Windows\System32\QKOIshK.exe
  2⤵
  PID:4528
- C:\Windows\System32\VZxcdWc.exe
  C:\Windows\System32\VZxcdWc.exe
  2⤵
  PID:5472
- C:\Windows\System32\oUCQBQr.exe
  C:\Windows\System32\oUCQBQr.exe
  2⤵
  PID:2076
- C:\Windows\System32\ByAgrSE.exe
  C:\Windows\System32\ByAgrSE.exe
  2⤵
  PID:5944
- C:\Windows\System32\UwTwBhe.exe
  C:\Windows\System32\UwTwBhe.exe
  2⤵
  PID:5676
- C:\Windows\System32\UbAoOUX.exe
  C:\Windows\System32\UbAoOUX.exe
  2⤵
  PID:5316
- C:\Windows\System32\birjCXk.exe
  C:\Windows\System32\birjCXk.exe
  2⤵
  PID:2996
- C:\Windows\System32\zxZJHxK.exe
  C:\Windows\System32\zxZJHxK.exe
  2⤵
  PID:5072
- C:\Windows\System32\aELITyD.exe
  C:\Windows\System32\aELITyD.exe
  2⤵
  PID:5688
- C:\Windows\System32\YdQjlkE.exe
  C:\Windows\System32\YdQjlkE.exe
  2⤵
  PID:5720
- C:\Windows\System32\XWsaiPP.exe
  C:\Windows\System32\XWsaiPP.exe
  2⤵
  PID:1740
- C:\Windows\System32\lgBrHBD.exe
  C:\Windows\System32\lgBrHBD.exe
  2⤵
  PID:5804
- C:\Windows\System32\VEVJckg.exe
  C:\Windows\System32\VEVJckg.exe
  2⤵
  PID:5948
- C:\Windows\System32\mGDhiVA.exe
  C:\Windows\System32\mGDhiVA.exe
  2⤵
  PID:6084
- C:\Windows\System32\kWOoijh.exe
  C:\Windows\System32\kWOoijh.exe
  2⤵
  PID:5268
- C:\Windows\System32\JyBZaeX.exe
  C:\Windows\System32\JyBZaeX.exe
  2⤵
  PID:5340
- C:\Windows\System32\TbRsuUd.exe
  C:\Windows\System32\TbRsuUd.exe
  2⤵
  PID:5700
- C:\Windows\System32\ykgjyKc.exe
  C:\Windows\System32\ykgjyKc.exe
  2⤵
  PID:5992
- C:\Windows\System32\MqcLzsA.exe
  C:\Windows\System32\MqcLzsA.exe
  2⤵
  PID:6016
- C:\Windows\System32\qGSOoye.exe
  C:\Windows\System32\qGSOoye.exe
  2⤵
  PID:1420
- C:\Windows\System32\vWpGLio.exe
  C:\Windows\System32\vWpGLio.exe
  2⤵
  PID:5128
- C:\Windows\System32\dBXoGsw.exe
  C:\Windows\System32\dBXoGsw.exe
  2⤵
  PID:5928
- C:\Windows\System32\ilqwUDQ.exe
  C:\Windows\System32\ilqwUDQ.exe
  2⤵
  PID:6152
- C:\Windows\System32\VomXDhb.exe
  C:\Windows\System32\VomXDhb.exe
  2⤵
  PID:6184
- C:\Windows\System32\mZsSsLu.exe
  C:\Windows\System32\mZsSsLu.exe
  2⤵
  PID:6204
- C:\Windows\System32\ZvBsQOu.exe
  C:\Windows\System32\ZvBsQOu.exe
  2⤵
  PID:6228
- C:\Windows\System32\ulVJSQO.exe
  C:\Windows\System32\ulVJSQO.exe
  2⤵
  PID:6272
- C:\Windows\System32\YAmJtJx.exe
  C:\Windows\System32\YAmJtJx.exe
  2⤵
  PID:6288
- C:\Windows\System32\vFcMjhH.exe
  C:\Windows\System32\vFcMjhH.exe
  2⤵
  PID:6308
- C:\Windows\System32\pMvrSQC.exe
  C:\Windows\System32\pMvrSQC.exe
  2⤵
  PID:6328
- C:\Windows\System32\OyaSZQC.exe
  C:\Windows\System32\OyaSZQC.exe
  2⤵
  PID:6368
- C:\Windows\System32\uAGYgdu.exe
  C:\Windows\System32\uAGYgdu.exe
  2⤵
  PID:6384
- C:\Windows\System32\XasqmLY.exe
  C:\Windows\System32\XasqmLY.exe
  2⤵
  PID:6412
- C:\Windows\System32\lpqBPYd.exe
  C:\Windows\System32\lpqBPYd.exe
  2⤵
  PID:6460
- C:\Windows\System32\IGsbiPs.exe
  C:\Windows\System32\IGsbiPs.exe
  2⤵
  PID:6484
- C:\Windows\System32\PoMzotB.exe
  C:\Windows\System32\PoMzotB.exe
  2⤵
  PID:6500
- C:\Windows\System32\sDMXkYJ.exe
  C:\Windows\System32\sDMXkYJ.exe
  2⤵
  PID:6524
- C:\Windows\System32\AihvxxA.exe
  C:\Windows\System32\AihvxxA.exe
  2⤵
  PID:6552
- C:\Windows\System32\gjZHqqi.exe
  C:\Windows\System32\gjZHqqi.exe
  2⤵
  PID:6608
- C:\Windows\System32\jOcMskT.exe
  C:\Windows\System32\jOcMskT.exe
  2⤵
  PID:6652
- C:\Windows\System32\exknAvK.exe
  C:\Windows\System32\exknAvK.exe
  2⤵
  PID:6676
- C:\Windows\System32\MSGFftI.exe
  C:\Windows\System32\MSGFftI.exe
  2⤵
  PID:6692
- C:\Windows\System32\iyvHUsR.exe
  C:\Windows\System32\iyvHUsR.exe
  2⤵
  PID:6712
- C:\Windows\System32\YLYZymW.exe
  C:\Windows\System32\YLYZymW.exe
  2⤵
  PID:6756
- C:\Windows\System32\nNFhwdr.exe
  C:\Windows\System32\nNFhwdr.exe
  2⤵
  PID:6772
- C:\Windows\System32\QvygJMy.exe
  C:\Windows\System32\QvygJMy.exe
  2⤵
  PID:6792
- C:\Windows\System32\QnYpKJU.exe
  C:\Windows\System32\QnYpKJU.exe
  2⤵
  PID:6828
- C:\Windows\System32\EPzAhdv.exe
  C:\Windows\System32\EPzAhdv.exe
  2⤵
  PID:6852
- C:\Windows\System32\wPysrsH.exe
  C:\Windows\System32\wPysrsH.exe
  2⤵
  PID:6880
- C:\Windows\System32\cPsgCTJ.exe
  C:\Windows\System32\cPsgCTJ.exe
  2⤵
  PID:6896
- C:\Windows\System32\YQpowWB.exe
  C:\Windows\System32\YQpowWB.exe
  2⤵
  PID:6924
- C:\Windows\System32\PcotmZa.exe
  C:\Windows\System32\PcotmZa.exe
  2⤵
  PID:6940
- C:\Windows\System32\vBtmJzy.exe
  C:\Windows\System32\vBtmJzy.exe
  2⤵
  PID:6964
- C:\Windows\System32\HVqOLJr.exe
  C:\Windows\System32\HVqOLJr.exe
  2⤵
  PID:7032
- C:\Windows\System32\kwSYxvR.exe
  C:\Windows\System32\kwSYxvR.exe
  2⤵
  PID:7048
- C:\Windows\System32\tntoDva.exe
  C:\Windows\System32\tntoDva.exe
  2⤵
  PID:7076
- C:\Windows\System32\igwfAtG.exe
  C:\Windows\System32\igwfAtG.exe
  2⤵
  PID:7092
- C:\Windows\System32\ZbrFcoX.exe
  C:\Windows\System32\ZbrFcoX.exe
  2⤵
  PID:7132
- C:\Windows\System32\uwtkoiQ.exe
  C:\Windows\System32\uwtkoiQ.exe
  2⤵
  PID:6176
- C:\Windows\System32\ChqzVqu.exe
  C:\Windows\System32\ChqzVqu.exe
  2⤵
  PID:6172
- C:\Windows\System32\GXbTKzd.exe
  C:\Windows\System32\GXbTKzd.exe
  2⤵
  PID:6244
- C:\Windows\System32\sXfmtDa.exe
  C:\Windows\System32\sXfmtDa.exe
  2⤵
  PID:6324
- C:\Windows\System32\jvyzIIw.exe
  C:\Windows\System32\jvyzIIw.exe
  2⤵
  PID:6392
- C:\Windows\System32\yCCMkLm.exe
  C:\Windows\System32\yCCMkLm.exe
  2⤵
  PID:6448
- C:\Windows\System32\GBmnnMg.exe
  C:\Windows\System32\GBmnnMg.exe
  2⤵
  PID:6480
- C:\Windows\System32\DVmIqLg.exe
  C:\Windows\System32\DVmIqLg.exe
  2⤵
  PID:6468
- C:\Windows\System32\lqtsapX.exe
  C:\Windows\System32\lqtsapX.exe
  2⤵
  PID:6664
- C:\Windows\System32\mqeVjeS.exe
  C:\Windows\System32\mqeVjeS.exe
  2⤵
  PID:6724
- C:\Windows\System32\MOBwtzJ.exe
  C:\Windows\System32\MOBwtzJ.exe
  2⤵
  PID:6744
- C:\Windows\System32\OEamxGn.exe
  C:\Windows\System32\OEamxGn.exe
  2⤵
  PID:6808
- C:\Windows\System32\QbhUUtI.exe
  C:\Windows\System32\QbhUUtI.exe
  2⤵
  PID:6844
- C:\Windows\System32\tZrZmAz.exe
  C:\Windows\System32\tZrZmAz.exe
  2⤵
  PID:6892
- C:\Windows\System32\GOnJYpq.exe
  C:\Windows\System32\GOnJYpq.exe
  2⤵
  PID:6960
- C:\Windows\System32\IdyLbYT.exe
  C:\Windows\System32\IdyLbYT.exe
  2⤵
  PID:7000
- C:\Windows\System32\MUvcaMJ.exe
  C:\Windows\System32\MUvcaMJ.exe
  2⤵
  PID:7068
- C:\Windows\System32\eVlnKKs.exe
  C:\Windows\System32\eVlnKKs.exe
  2⤵
  PID:6296
- C:\Windows\System32\xUtdveL.exe
  C:\Windows\System32\xUtdveL.exe
  2⤵
  PID:6492
- C:\Windows\System32\FPmkFnM.exe
  C:\Windows\System32\FPmkFnM.exe
  2⤵
  PID:6600
- C:\Windows\System32\utqvMLp.exe
  C:\Windows\System32\utqvMLp.exe
  2⤵
  PID:6636
- C:\Windows\System32\IJzFhEF.exe
  C:\Windows\System32\IJzFhEF.exe
  2⤵
  PID:6764
- C:\Windows\System32\lXgpAsc.exe
  C:\Windows\System32\lXgpAsc.exe
  2⤵
  PID:7044
- C:\Windows\System32\HyzOgLI.exe
  C:\Windows\System32\HyzOgLI.exe
  2⤵
  PID:6216
- C:\Windows\System32\rarTlFm.exe
  C:\Windows\System32\rarTlFm.exe
  2⤵
  PID:6508
- C:\Windows\System32\RNhLYvv.exe
  C:\Windows\System32\RNhLYvv.exe
  2⤵
  PID:6840
- C:\Windows\System32\vrWmSjg.exe
  C:\Windows\System32\vrWmSjg.exe
  2⤵
  PID:7040
- C:\Windows\System32\tmuiOLL.exe
  C:\Windows\System32\tmuiOLL.exe
  2⤵
  PID:6444
- C:\Windows\System32\lmzzyyC.exe
  C:\Windows\System32\lmzzyyC.exe
  2⤵
  PID:7176
- C:\Windows\System32\cFbptwu.exe
  C:\Windows\System32\cFbptwu.exe
  2⤵
  PID:7204
- C:\Windows\System32\hSxTuCV.exe
  C:\Windows\System32\hSxTuCV.exe
  2⤵
  PID:7280
- C:\Windows\System32\WbFMpqO.exe
  C:\Windows\System32\WbFMpqO.exe
  2⤵
  PID:7300
- C:\Windows\System32\WHqYoNb.exe
  C:\Windows\System32\WHqYoNb.exe
  2⤵
  PID:7316
- C:\Windows\System32\EEZAICV.exe
  C:\Windows\System32\EEZAICV.exe
  2⤵
  PID:7340
- C:\Windows\System32\CTOIXWm.exe
  C:\Windows\System32\CTOIXWm.exe
  2⤵
  PID:7360
- C:\Windows\System32\cDNMTnn.exe
  C:\Windows\System32\cDNMTnn.exe
  2⤵
  PID:7432
- C:\Windows\System32\LHDzYWp.exe
  C:\Windows\System32\LHDzYWp.exe
  2⤵
  PID:7452
- C:\Windows\System32\xBXtOfO.exe
  C:\Windows\System32\xBXtOfO.exe
  2⤵
  PID:7472
- C:\Windows\System32\PJLbwvu.exe
  C:\Windows\System32\PJLbwvu.exe
  2⤵
  PID:7488
- C:\Windows\System32\PfnOxVn.exe
  C:\Windows\System32\PfnOxVn.exe
  2⤵
  PID:7512
- C:\Windows\System32\nbZZutH.exe
  C:\Windows\System32\nbZZutH.exe
  2⤵
  PID:7548
- C:\Windows\System32\UZCsstY.exe
  C:\Windows\System32\UZCsstY.exe
  2⤵
  PID:7576
- C:\Windows\System32\WlBGjzU.exe
  C:\Windows\System32\WlBGjzU.exe
  2⤵
  PID:7612
- C:\Windows\System32\lhHdoOd.exe
  C:\Windows\System32\lhHdoOd.exe
  2⤵
  PID:7628
- C:\Windows\System32\OebKOAX.exe
  C:\Windows\System32\OebKOAX.exe
  2⤵
  PID:7652
- C:\Windows\System32\CGXJcCb.exe
  C:\Windows\System32\CGXJcCb.exe
  2⤵
  PID:7700
- C:\Windows\System32\KzJgSIq.exe
  C:\Windows\System32\KzJgSIq.exe
  2⤵
  PID:7720
- C:\Windows\System32\XrMgxTS.exe
  C:\Windows\System32\XrMgxTS.exe
  2⤵
  PID:7760
- C:\Windows\System32\nCHBsnv.exe
  C:\Windows\System32\nCHBsnv.exe
  2⤵
  PID:7776
- C:\Windows\System32\rAmpAXW.exe
  C:\Windows\System32\rAmpAXW.exe
  2⤵
  PID:7800
- C:\Windows\System32\XjvaYWo.exe
  C:\Windows\System32\XjvaYWo.exe
  2⤵
  PID:7832
- C:\Windows\System32\Rkghvyp.exe
  C:\Windows\System32\Rkghvyp.exe
  2⤵
  PID:7872
- C:\Windows\System32\JbgnzqN.exe
  C:\Windows\System32\JbgnzqN.exe
  2⤵
  PID:7896
- C:\Windows\System32\FaQwcUC.exe
  C:\Windows\System32\FaQwcUC.exe
  2⤵
  PID:7912
- C:\Windows\System32\cWzOvlR.exe
  C:\Windows\System32\cWzOvlR.exe
  2⤵
  PID:7940
- C:\Windows\System32\OocoKaT.exe
  C:\Windows\System32\OocoKaT.exe
  2⤵
  PID:7964
- C:\Windows\System32\VQWPETi.exe
  C:\Windows\System32\VQWPETi.exe
  2⤵
  PID:8004
- C:\Windows\System32\uQbCHEc.exe
  C:\Windows\System32\uQbCHEc.exe
  2⤵
  PID:8024
- C:\Windows\System32\mTIlgZS.exe
  C:\Windows\System32\mTIlgZS.exe
  2⤵
  PID:8056
- C:\Windows\System32\bnkpEqA.exe
  C:\Windows\System32\bnkpEqA.exe
  2⤵
  PID:8088
- C:\Windows\System32\UogokWd.exe
  C:\Windows\System32\UogokWd.exe
  2⤵
  PID:8116
- C:\Windows\System32\seQfnJg.exe
  C:\Windows\System32\seQfnJg.exe
  2⤵
  PID:8160
- C:\Windows\System32\FyWYLWm.exe
  C:\Windows\System32\FyWYLWm.exe
  2⤵
  PID:8176
- C:\Windows\System32\MnLYBSD.exe
  C:\Windows\System32\MnLYBSD.exe
  2⤵
  PID:7172
- C:\Windows\System32\NoFPKFK.exe
  C:\Windows\System32\NoFPKFK.exe
  2⤵
  PID:7224
- C:\Windows\System32\rogQrDt.exe
  C:\Windows\System32\rogQrDt.exe
  2⤵
  PID:7312
- C:\Windows\System32\dvqLYSe.exe
  C:\Windows\System32\dvqLYSe.exe
  2⤵
  PID:7352
- C:\Windows\System32\ccbxAGV.exe
  C:\Windows\System32\ccbxAGV.exe
  2⤵
  PID:7444
- C:\Windows\System32\SYWfmGb.exe
  C:\Windows\System32\SYWfmGb.exe
  2⤵
  PID:7496
- C:\Windows\System32\IDtExuG.exe
  C:\Windows\System32\IDtExuG.exe
  2⤵
  PID:7572
- C:\Windows\System32\wDkxccR.exe
  C:\Windows\System32\wDkxccR.exe
  2⤵
  PID:7644
- C:\Windows\System32\GCFupAI.exe
  C:\Windows\System32\GCFupAI.exe
  2⤵
  PID:7680
- C:\Windows\System32\eOYhNHA.exe
  C:\Windows\System32\eOYhNHA.exe
  2⤵
  PID:7736
- C:\Windows\System32\esAZbsW.exe
  C:\Windows\System32\esAZbsW.exe
  2⤵
  PID:7792
- C:\Windows\System32\hgNhtfk.exe
  C:\Windows\System32\hgNhtfk.exe
  2⤵
  PID:7904
- C:\Windows\System32\bYbkMKK.exe
  C:\Windows\System32\bYbkMKK.exe
  2⤵
  PID:7948
- C:\Windows\System32\zAIQKfH.exe
  C:\Windows\System32\zAIQKfH.exe
  2⤵
  PID:8020
- C:\Windows\System32\IjHAEVZ.exe
  C:\Windows\System32\IjHAEVZ.exe
  2⤵
  PID:8040
- C:\Windows\System32\JtIpyJT.exe
  C:\Windows\System32\JtIpyJT.exe
  2⤵
  PID:8136
- C:\Windows\System32\OzjYYIK.exe
  C:\Windows\System32\OzjYYIK.exe
  2⤵
  PID:7144
- C:\Windows\System32\gqPivVM.exe
  C:\Windows\System32\gqPivVM.exe
  2⤵
  PID:7248
- C:\Windows\System32\XOVdrEr.exe
  C:\Windows\System32\XOVdrEr.exe
  2⤵
  PID:7484
- C:\Windows\System32\tIzfBOm.exe
  C:\Windows\System32\tIzfBOm.exe
  2⤵
  PID:7672
- C:\Windows\System32\HLyfRRG.exe
  C:\Windows\System32\HLyfRRG.exe
  2⤵
  PID:7768
- C:\Windows\System32\ZRRMRFm.exe
  C:\Windows\System32\ZRRMRFm.exe
  2⤵
  PID:8012
- C:\Windows\System32\wDMIeFw.exe
  C:\Windows\System32\wDMIeFw.exe
  2⤵
  PID:8064
- C:\Windows\System32\GyjBLNl.exe
  C:\Windows\System32\GyjBLNl.exe
  2⤵
  PID:6192
- C:\Windows\System32\SFzjSFY.exe
  C:\Windows\System32\SFzjSFY.exe
  2⤵
  PID:7332
- C:\Windows\System32\xFCLsam.exe
  C:\Windows\System32\xFCLsam.exe
  2⤵
  PID:7712
- C:\Windows\System32\QrVMmkD.exe
  C:\Windows\System32\QrVMmkD.exe
  2⤵
  PID:8084
- C:\Windows\System32\kJoornA.exe
  C:\Windows\System32\kJoornA.exe
  2⤵
  PID:8216
- C:\Windows\System32\NRxpnvR.exe
  C:\Windows\System32\NRxpnvR.exe
  2⤵
  PID:8240
- C:\Windows\System32\lLKcfkv.exe
  C:\Windows\System32\lLKcfkv.exe
  2⤵
  PID:8264
- C:\Windows\System32\purdLmG.exe
  C:\Windows\System32\purdLmG.exe
  2⤵
  PID:8280
- C:\Windows\System32\LdWVlmd.exe
  C:\Windows\System32\LdWVlmd.exe
  2⤵
  PID:8300
- C:\Windows\System32\cfUlZNS.exe
  C:\Windows\System32\cfUlZNS.exe
  2⤵
  PID:8332
- C:\Windows\System32\hczHLfK.exe
  C:\Windows\System32\hczHLfK.exe
  2⤵
  PID:8396
- C:\Windows\System32\CDZOJXu.exe
  C:\Windows\System32\CDZOJXu.exe
  2⤵
  PID:8416
- C:\Windows\System32\SROpjxZ.exe
  C:\Windows\System32\SROpjxZ.exe
  2⤵
  PID:8432
- C:\Windows\System32\OkLthyJ.exe
  C:\Windows\System32\OkLthyJ.exe
  2⤵
  PID:8472
- C:\Windows\System32\QMKjGOh.exe
  C:\Windows\System32\QMKjGOh.exe
  2⤵
  PID:8488
- C:\Windows\System32\FPSXTbt.exe
  C:\Windows\System32\FPSXTbt.exe
  2⤵
  PID:8516
- C:\Windows\System32\VbXHjPp.exe
  C:\Windows\System32\VbXHjPp.exe
  2⤵
  PID:8556
- C:\Windows\System32\TuDEyMd.exe
  C:\Windows\System32\TuDEyMd.exe
  2⤵
  PID:8572
- C:\Windows\System32\tWerjXb.exe
  C:\Windows\System32\tWerjXb.exe
  2⤵
  PID:8600
- C:\Windows\System32\TsxEsUx.exe
  C:\Windows\System32\TsxEsUx.exe
  2⤵
  PID:8636
- C:\Windows\System32\ikcKKkz.exe
  C:\Windows\System32\ikcKKkz.exe
  2⤵
  PID:8668
- C:\Windows\System32\OiIjlIB.exe
  C:\Windows\System32\OiIjlIB.exe
  2⤵
  PID:8696
- C:\Windows\System32\lWLmFtR.exe
  C:\Windows\System32\lWLmFtR.exe
  2⤵
  PID:8712
- C:\Windows\System32\RZkwoiC.exe
  C:\Windows\System32\RZkwoiC.exe
  2⤵
  PID:8740
- C:\Windows\System32\VEdwEuM.exe
  C:\Windows\System32\VEdwEuM.exe
  2⤵
  PID:8768
- C:\Windows\System32\gNDsZfZ.exe
  C:\Windows\System32\gNDsZfZ.exe
  2⤵
  PID:8812
- C:\Windows\System32\DAvbyes.exe
  C:\Windows\System32\DAvbyes.exe
  2⤵
  PID:8836
- C:\Windows\System32\qToGfVU.exe
  C:\Windows\System32\qToGfVU.exe
  2⤵
  PID:8860
- C:\Windows\System32\ctvhoCx.exe
  C:\Windows\System32\ctvhoCx.exe
  2⤵
  PID:8884
- C:\Windows\System32\YLCGJIi.exe
  C:\Windows\System32\YLCGJIi.exe
  2⤵
  PID:8912
- C:\Windows\System32\DoaSQOB.exe
  C:\Windows\System32\DoaSQOB.exe
  2⤵
  PID:9028
- C:\Windows\System32\EVXlpqp.exe
  C:\Windows\System32\EVXlpqp.exe
  2⤵
  PID:9044
- C:\Windows\System32\uIlYoux.exe
  C:\Windows\System32\uIlYoux.exe
  2⤵
  PID:9060
- C:\Windows\System32\GhJyMMW.exe
  C:\Windows\System32\GhJyMMW.exe
  2⤵
  PID:9076
- C:\Windows\System32\NynBVcS.exe
  C:\Windows\System32\NynBVcS.exe
  2⤵
  PID:9092
- C:\Windows\System32\ocKypos.exe
  C:\Windows\System32\ocKypos.exe
  2⤵
  PID:9116
- C:\Windows\System32\eRWudLW.exe
  C:\Windows\System32\eRWudLW.exe
  2⤵
  PID:9132
- C:\Windows\System32\GcTvRgD.exe
  C:\Windows\System32\GcTvRgD.exe
  2⤵
  PID:9148
- C:\Windows\System32\EYcGHPk.exe
  C:\Windows\System32\EYcGHPk.exe
  2⤵
  PID:9164
- C:\Windows\System32\tqNvSGV.exe
  C:\Windows\System32\tqNvSGV.exe
  2⤵
  PID:9180
- C:\Windows\System32\GXjFnQb.exe
  C:\Windows\System32\GXjFnQb.exe
  2⤵
  PID:9196
- C:\Windows\System32\xEZEoqb.exe
  C:\Windows\System32\xEZEoqb.exe
  2⤵
  PID:9212
- C:\Windows\System32\MqiSNlS.exe
  C:\Windows\System32\MqiSNlS.exe
  2⤵
  PID:7752
- C:\Windows\System32\PfGQKMJ.exe
  C:\Windows\System32\PfGQKMJ.exe
  2⤵
  PID:8196
- C:\Windows\System32\lcLSRVr.exe
  C:\Windows\System32\lcLSRVr.exe
  2⤵
  PID:8260
- C:\Windows\System32\IwLEdRj.exe
  C:\Windows\System32\IwLEdRj.exe
  2⤵
  PID:8276
- C:\Windows\System32\KOAFTYq.exe
  C:\Windows\System32\KOAFTYq.exe
  2⤵
  PID:8324
- C:\Windows\System32\maTemPd.exe
  C:\Windows\System32\maTemPd.exe
  2⤵
  PID:8368
- C:\Windows\System32\kwFjiYT.exe
  C:\Windows\System32\kwFjiYT.exe
  2⤵
  PID:8480
- C:\Windows\System32\nzWNoqB.exe
  C:\Windows\System32\nzWNoqB.exe
  2⤵
  PID:8536
- C:\Windows\System32\VxTRhOs.exe
  C:\Windows\System32\VxTRhOs.exe
  2⤵
  PID:8564
- C:\Windows\System32\RpfgACQ.exe
  C:\Windows\System32\RpfgACQ.exe
  2⤵
  PID:8628
- C:\Windows\System32\LPHUveL.exe
  C:\Windows\System32\LPHUveL.exe
  2⤵
  PID:8984
- C:\Windows\System32\XCBxlqm.exe
  C:\Windows\System32\XCBxlqm.exe
  2⤵
  PID:9072
- C:\Windows\System32\HqxFGzb.exe
  C:\Windows\System32\HqxFGzb.exe
  2⤵
  PID:9176
- C:\Windows\System32\wZhThQL.exe
  C:\Windows\System32\wZhThQL.exe
  2⤵
  PID:8348
- C:\Windows\System32\sQwNNpq.exe
  C:\Windows\System32\sQwNNpq.exe
  2⤵
  PID:8428
- C:\Windows\System32\txZHgBN.exe
  C:\Windows\System32\txZHgBN.exe
  2⤵
  PID:8504
- C:\Windows\System32\POTsuPq.exe
  C:\Windows\System32\POTsuPq.exe
  2⤵
  PID:9204
- C:\Windows\System32\rMlgAXY.exe
  C:\Windows\System32\rMlgAXY.exe
  2⤵
  PID:8848
- C:\Windows\System32\XhEXiZx.exe
  C:\Windows\System32\XhEXiZx.exe
  2⤵
  PID:8728
- C:\Windows\System32\EaixegW.exe
  C:\Windows\System32\EaixegW.exe
  2⤵
  PID:8464
- C:\Windows\System32\NCiCCaW.exe
  C:\Windows\System32\NCiCCaW.exe
  2⤵
  PID:8632
- C:\Windows\System32\RbqTMsT.exe
  C:\Windows\System32\RbqTMsT.exe
  2⤵
  PID:8780
- C:\Windows\System32\WrLdDvU.exe
  C:\Windows\System32\WrLdDvU.exe
  2⤵
  PID:8588
- C:\Windows\System32\GYuyOzM.exe
  C:\Windows\System32\GYuyOzM.exe
  2⤵
  PID:8764
- C:\Windows\System32\rHprwTg.exe
  C:\Windows\System32\rHprwTg.exe
  2⤵
  PID:8500
- C:\Windows\System32\GrIVoTw.exe
  C:\Windows\System32\GrIVoTw.exe
  2⤵
  PID:9232
- C:\Windows\System32\zvBfcpY.exe
  C:\Windows\System32\zvBfcpY.exe
  2⤵
  PID:9256
- C:\Windows\System32\QDfzNHy.exe
  C:\Windows\System32\QDfzNHy.exe
  2⤵
  PID:9276
- C:\Windows\System32\ydHyvJh.exe
  C:\Windows\System32\ydHyvJh.exe
  2⤵
  PID:9304
- C:\Windows\System32\edZGgmy.exe
  C:\Windows\System32\edZGgmy.exe
  2⤵
  PID:9324
- C:\Windows\System32\wPIalqY.exe
  C:\Windows\System32\wPIalqY.exe
  2⤵
  PID:9348
- C:\Windows\System32\HoeEUXO.exe
  C:\Windows\System32\HoeEUXO.exe
  2⤵
  PID:9388
- C:\Windows\System32\HIcSaZb.exe
  C:\Windows\System32\HIcSaZb.exe
  2⤵
  PID:9404
- C:\Windows\System32\Uspdmwm.exe
  C:\Windows\System32\Uspdmwm.exe
  2⤵
  PID:9428
- C:\Windows\System32\KAMcJiw.exe
  C:\Windows\System32\KAMcJiw.exe
  2⤵
  PID:9452
- C:\Windows\System32\vPtVNGa.exe
  C:\Windows\System32\vPtVNGa.exe
  2⤵
  PID:9496
- C:\Windows\System32\KyMrvUk.exe
  C:\Windows\System32\KyMrvUk.exe
  2⤵
  PID:9532
- C:\Windows\System32\PmuDCKd.exe
  C:\Windows\System32\PmuDCKd.exe
  2⤵
  PID:9568
- C:\Windows\System32\XLGaQPr.exe
  C:\Windows\System32\XLGaQPr.exe
  2⤵
  PID:9596
- C:\Windows\System32\wtyoqeX.exe
  C:\Windows\System32\wtyoqeX.exe
  2⤵
  PID:9624
- C:\Windows\System32\GQHNdia.exe
  C:\Windows\System32\GQHNdia.exe
  2⤵
  PID:9648
- C:\Windows\System32\SODrGdM.exe
  C:\Windows\System32\SODrGdM.exe
  2⤵
  PID:9668
- C:\Windows\System32\KrFUYQu.exe
  C:\Windows\System32\KrFUYQu.exe
  2⤵
  PID:9688
- C:\Windows\System32\WhioKKW.exe
  C:\Windows\System32\WhioKKW.exe
  2⤵
  PID:9740
- C:\Windows\System32\VSKgHQO.exe
  C:\Windows\System32\VSKgHQO.exe
  2⤵
  PID:9768
- C:\Windows\System32\SmnpeBi.exe
  C:\Windows\System32\SmnpeBi.exe
  2⤵
  PID:9792
- C:\Windows\System32\LEZUcJB.exe
  C:\Windows\System32\LEZUcJB.exe
  2⤵
  PID:9824
- C:\Windows\System32\RDhlhiM.exe
  C:\Windows\System32\RDhlhiM.exe
  2⤵
  PID:9844
- C:\Windows\System32\tRPUxPn.exe
  C:\Windows\System32\tRPUxPn.exe
  2⤵
  PID:9876
- C:\Windows\System32\ztiWegA.exe
  C:\Windows\System32\ztiWegA.exe
  2⤵
  PID:9896
- C:\Windows\System32\CBMtqEe.exe
  C:\Windows\System32\CBMtqEe.exe
  2⤵
  PID:9936
- C:\Windows\System32\nJomxfB.exe
  C:\Windows\System32\nJomxfB.exe
  2⤵
  PID:9952
- C:\Windows\System32\ZBezTQF.exe
  C:\Windows\System32\ZBezTQF.exe
  2⤵
  PID:9968
- C:\Windows\System32\DVYbqbI.exe
  C:\Windows\System32\DVYbqbI.exe
  2⤵
  PID:9988
- C:\Windows\System32\oZGCXkr.exe
  C:\Windows\System32\oZGCXkr.exe
  2⤵
  PID:10004
- C:\Windows\System32\KKNOmJk.exe
  C:\Windows\System32\KKNOmJk.exe
  2⤵
  PID:10024
- C:\Windows\System32\PXkvQHz.exe
  C:\Windows\System32\PXkvQHz.exe
  2⤵
  PID:10044
- C:\Windows\System32\StKrIhr.exe
  C:\Windows\System32\StKrIhr.exe
  2⤵
  PID:10092
- C:\Windows\System32\TbuIKim.exe
  C:\Windows\System32\TbuIKim.exe
  2⤵
  PID:10148
- C:\Windows\System32\JXetgDg.exe
  C:\Windows\System32\JXetgDg.exe
  2⤵
  PID:10180
- C:\Windows\System32\ygmRZPg.exe
  C:\Windows\System32\ygmRZPg.exe
  2⤵
  PID:10220
- C:\Windows\System32\XCfdImz.exe
  C:\Windows\System32\XCfdImz.exe
  2⤵
  PID:9248
- C:\Windows\System32\DuFqoXf.exe
  C:\Windows\System32\DuFqoXf.exe
  2⤵
  PID:9244
- C:\Windows\System32\ehVqzMr.exe
  C:\Windows\System32\ehVqzMr.exe
  2⤵
  PID:9332
- C:\Windows\System32\NrjYKVo.exe
  C:\Windows\System32\NrjYKVo.exe
  2⤵
  PID:9356
- C:\Windows\System32\KXYcSms.exe
  C:\Windows\System32\KXYcSms.exe
  2⤵
  PID:9416
- C:\Windows\System32\eGOVKpg.exe
  C:\Windows\System32\eGOVKpg.exe
  2⤵
  PID:9476
- C:\Windows\System32\arXmACq.exe
  C:\Windows\System32\arXmACq.exe
  2⤵
  PID:9552
- C:\Windows\System32\vIhZMoa.exe
  C:\Windows\System32\vIhZMoa.exe
  2⤵
  PID:9656
- C:\Windows\System32\OFXNlDt.exe
  C:\Windows\System32\OFXNlDt.exe
  2⤵
  PID:9728
- C:\Windows\System32\zTalFNw.exe
  C:\Windows\System32\zTalFNw.exe
  2⤵
  PID:9776
- C:\Windows\System32\MkFWNcV.exe
  C:\Windows\System32\MkFWNcV.exe
  2⤵
  PID:9888
- C:\Windows\System32\EmSIxZG.exe
  C:\Windows\System32\EmSIxZG.exe
  2⤵
  PID:9928
- C:\Windows\System32\DUJwzlU.exe
  C:\Windows\System32\DUJwzlU.exe
  2⤵
  PID:9984
- C:\Windows\System32\SHnpATb.exe
  C:\Windows\System32\SHnpATb.exe
  2⤵
  PID:9960
- C:\Windows\System32\SffCvip.exe
  C:\Windows\System32\SffCvip.exe
  2⤵
  PID:10128
- C:\Windows\System32\EJdvGFv.exe
  C:\Windows\System32\EJdvGFv.exe
  2⤵
  PID:10112
- C:\Windows\System32\SAJNdnA.exe
  C:\Windows\System32\SAJNdnA.exe
  2⤵
  PID:9292
- C:\Windows\System32\FdNZdiz.exe
  C:\Windows\System32\FdNZdiz.exe
  2⤵
  PID:9344
- C:\Windows\System32\FXuLQaE.exe
  C:\Windows\System32\FXuLQaE.exe
  2⤵
  PID:9508
- C:\Windows\System32\NwDNNdW.exe
  C:\Windows\System32\NwDNNdW.exe
  2⤵
  PID:9556
- C:\Windows\System32\uapemir.exe
  C:\Windows\System32\uapemir.exe
  2⤵
  PID:9872
- C:\Windows\System32\NfzwSeI.exe
  C:\Windows\System32\NfzwSeI.exe
  2⤵
  PID:10072
- C:\Windows\System32\BoqDxbk.exe
  C:\Windows\System32\BoqDxbk.exe
  2⤵
  PID:10232
- C:\Windows\System32\TUFWNGj.exe
  C:\Windows\System32\TUFWNGj.exe
  2⤵
  PID:9412
- C:\Windows\System32\vvyZYWy.exe
  C:\Windows\System32\vvyZYWy.exe
  2⤵
  PID:9612
- C:\Windows\System32\RrOoctp.exe
  C:\Windows\System32\RrOoctp.exe
  2⤵
  PID:9948
- C:\Windows\System32\mYOGiXp.exe
  C:\Windows\System32\mYOGiXp.exe
  2⤵
  PID:9616
- C:\Windows\System32\HbgrJGB.exe
  C:\Windows\System32\HbgrJGB.exe
  2⤵
  PID:10252
- C:\Windows\System32\gSzhses.exe
  C:\Windows\System32\gSzhses.exe
  2⤵
  PID:10272
- C:\Windows\System32\iuIFpqF.exe
  C:\Windows\System32\iuIFpqF.exe
  2⤵
  PID:10296
- C:\Windows\System32\qwmlBoA.exe
  C:\Windows\System32\qwmlBoA.exe
  2⤵
  PID:10324
- C:\Windows\System32\AQiGfsC.exe
  C:\Windows\System32\AQiGfsC.exe
  2⤵
  PID:10340
- C:\Windows\System32\JXBxbZF.exe
  C:\Windows\System32\JXBxbZF.exe
  2⤵
  PID:10372
- C:\Windows\System32\UAdjHfR.exe
  C:\Windows\System32\UAdjHfR.exe
  2⤵
  PID:10392
- C:\Windows\System32\faZdefK.exe
  C:\Windows\System32\faZdefK.exe
  2⤵
  PID:10436
- C:\Windows\System32\cyhwHPy.exe
  C:\Windows\System32\cyhwHPy.exe
  2⤵
  PID:10460
- C:\Windows\System32\xAiTNfn.exe
  C:\Windows\System32\xAiTNfn.exe
  2⤵
  PID:10516
- C:\Windows\System32\oMcNLqX.exe
  C:\Windows\System32\oMcNLqX.exe
  2⤵
  PID:10536
- C:\Windows\System32\rpfNZTQ.exe
  C:\Windows\System32\rpfNZTQ.exe
  2⤵
  PID:10556
- C:\Windows\System32\CRMmHqg.exe
  C:\Windows\System32\CRMmHqg.exe
  2⤵
  PID:10588
- C:\Windows\System32\pdthVfp.exe
  C:\Windows\System32\pdthVfp.exe
  2⤵
  PID:10620
- C:\Windows\System32\IWFCxZL.exe
  C:\Windows\System32\IWFCxZL.exe
  2⤵
  PID:10636
- C:\Windows\System32\vxyKBfu.exe
  C:\Windows\System32\vxyKBfu.exe
  2⤵
  PID:10656
- C:\Windows\System32\Ptsytmf.exe
  C:\Windows\System32\Ptsytmf.exe
  2⤵
  PID:10708
- C:\Windows\System32\cnhiWCZ.exe
  C:\Windows\System32\cnhiWCZ.exe
  2⤵
  PID:10736
- C:\Windows\System32\QjlbFvm.exe
  C:\Windows\System32\QjlbFvm.exe
  2⤵
  PID:10768
- C:\Windows\System32\AHAMtBu.exe
  C:\Windows\System32\AHAMtBu.exe
  2⤵
  PID:10796
- C:\Windows\System32\TrbXMmw.exe
  C:\Windows\System32\TrbXMmw.exe
  2⤵
  PID:10820
- C:\Windows\System32\oHkzgqa.exe
  C:\Windows\System32\oHkzgqa.exe
  2⤵
  PID:10860
- C:\Windows\System32\gyyQtwH.exe
  C:\Windows\System32\gyyQtwH.exe
  2⤵
  PID:10876
- C:\Windows\System32\YSZQYcs.exe
  C:\Windows\System32\YSZQYcs.exe
  2⤵
  PID:10896
- C:\Windows\System32\DNneuzw.exe
  C:\Windows\System32\DNneuzw.exe
  2⤵
  PID:10932
- C:\Windows\System32\gqQuXQi.exe
  C:\Windows\System32\gqQuXQi.exe
  2⤵
  PID:10960
- C:\Windows\System32\lQobsBL.exe
  C:\Windows\System32\lQobsBL.exe
  2⤵
  PID:10984
- C:\Windows\System32\ROGOODj.exe
  C:\Windows\System32\ROGOODj.exe
  2⤵
  PID:11000
- C:\Windows\System32\VLsOalS.exe
  C:\Windows\System32\VLsOalS.exe
  2⤵
  PID:11040
- C:\Windows\System32\wJEgKif.exe
  C:\Windows\System32\wJEgKif.exe
  2⤵
  PID:11088
- C:\Windows\System32\pVvzPaX.exe
  C:\Windows\System32\pVvzPaX.exe
  2⤵
  PID:11108
- C:\Windows\System32\zRqjPoe.exe
  C:\Windows\System32\zRqjPoe.exe
  2⤵
  PID:11124
- C:\Windows\System32\hydcPlO.exe
  C:\Windows\System32\hydcPlO.exe
  2⤵
  PID:11152
- C:\Windows\System32\XqxHtKU.exe
  C:\Windows\System32\XqxHtKU.exe
  2⤵
  PID:11172
- C:\Windows\System32\VKYQlxL.exe
  C:\Windows\System32\VKYQlxL.exe
  2⤵
  PID:11196
- C:\Windows\System32\qhRPMCw.exe
  C:\Windows\System32\qhRPMCw.exe
  2⤵
  PID:11216
- C:\Windows\System32\FVXeuuY.exe
  C:\Windows\System32\FVXeuuY.exe
  2⤵
  PID:11244
- C:\Windows\System32\yQIZeMJ.exe
  C:\Windows\System32\yQIZeMJ.exe
  2⤵
  PID:10260
- C:\Windows\System32\TMifmCp.exe
  C:\Windows\System32\TMifmCp.exe
  2⤵
  PID:10368
- C:\Windows\System32\hPgGRKz.exe
  C:\Windows\System32\hPgGRKz.exe
  2⤵
  PID:10384
- C:\Windows\System32\yCsmbuN.exe
  C:\Windows\System32\yCsmbuN.exe
  2⤵
  PID:10452
- C:\Windows\System32\oTCMHdM.exe
  C:\Windows\System32\oTCMHdM.exe
  2⤵
  PID:10528
- C:\Windows\System32\ZwLXRpV.exe
  C:\Windows\System32\ZwLXRpV.exe
  2⤵
  PID:10612
- C:\Windows\System32\wdbgvqA.exe
  C:\Windows\System32\wdbgvqA.exe
  2⤵
  PID:10672
- C:\Windows\System32\FzEKPqO.exe
  C:\Windows\System32\FzEKPqO.exe
  2⤵
  PID:10760
- C:\Windows\System32\rwBNsOt.exe
  C:\Windows\System32\rwBNsOt.exe
  2⤵
  PID:10804
- C:\Windows\System32\apXCBmf.exe
  C:\Windows\System32\apXCBmf.exe
  2⤵
  PID:10892
- C:\Windows\System32\HnTdaIm.exe
  C:\Windows\System32\HnTdaIm.exe
  2⤵
  PID:10940
- C:\Windows\System32\WqmTLVC.exe
  C:\Windows\System32\WqmTLVC.exe
  2⤵
  PID:11036
- C:\Windows\System32\RSszPQO.exe
  C:\Windows\System32\RSszPQO.exe
  2⤵
  PID:11080
- C:\Windows\System32\bnCvhjC.exe
  C:\Windows\System32\bnCvhjC.exe
  2⤵
  PID:11120
- C:\Windows\System32\UOtmufS.exe
  C:\Windows\System32\UOtmufS.exe
  2⤵
  PID:11204
- C:\Windows\System32\agfIRKn.exe
  C:\Windows\System32\agfIRKn.exe
  2⤵
  PID:11256
- C:\Windows\System32\oXwQwkC.exe
  C:\Windows\System32\oXwQwkC.exe
  2⤵
  PID:10352
- C:\Windows\System32\qwhpPDj.exe
  C:\Windows\System32\qwhpPDj.exe
  2⤵
  PID:10644
- C:\Windows\System32\uehBeRD.exe
  C:\Windows\System32\uehBeRD.exe
  2⤵
  PID:10748
- C:\Windows\System32\HVDmyds.exe
  C:\Windows\System32\HVDmyds.exe
  2⤵
  PID:10972
- C:\Windows\System32\oytXiKs.exe
  C:\Windows\System32\oytXiKs.exe
  2⤵
  PID:11016
- C:\Windows\System32\ltcjVuj.exe
  C:\Windows\System32\ltcjVuj.exe
  2⤵
  PID:10356
- C:\Windows\System32\AEDxIHd.exe
  C:\Windows\System32\AEDxIHd.exe
  2⤵
  PID:11232
- C:\Windows\System32\hGPUzgD.exe
  C:\Windows\System32\hGPUzgD.exe
  2⤵
  PID:10408
- C:\Windows\System32\mglovWN.exe
  C:\Windows\System32\mglovWN.exe
  2⤵
  PID:11100
- C:\Windows\System32\LiVfCjp.exe
  C:\Windows\System32\LiVfCjp.exe
  2⤵
  PID:11164
- C:\Windows\System32\YMxkgRF.exe
  C:\Windows\System32\YMxkgRF.exe
  2⤵
  PID:11268
- C:\Windows\System32\LxwGndf.exe
  C:\Windows\System32\LxwGndf.exe
  2⤵
  PID:11292
- C:\Windows\System32\oMbNNBa.exe
  C:\Windows\System32\oMbNNBa.exe
  2⤵
  PID:11320
- C:\Windows\System32\HpJbMiF.exe
  C:\Windows\System32\HpJbMiF.exe
  2⤵
  PID:11336
- C:\Windows\System32\bLBWdpI.exe
  C:\Windows\System32\bLBWdpI.exe
  2⤵
  PID:11380
- C:\Windows\System32\fTMElig.exe
  C:\Windows\System32\fTMElig.exe
  2⤵
  PID:11412
- C:\Windows\System32\YHnGWLF.exe
  C:\Windows\System32\YHnGWLF.exe
  2⤵
  PID:11436
- C:\Windows\System32\EfLfSUw.exe
  C:\Windows\System32\EfLfSUw.exe
  2⤵
  PID:11476
- C:\Windows\System32\wsiTniq.exe
  C:\Windows\System32\wsiTniq.exe
  2⤵
  PID:11520
- C:\Windows\System32\gvamdvE.exe
  C:\Windows\System32\gvamdvE.exe
  2⤵
  PID:11540
- C:\Windows\System32\RPCgBpD.exe
  C:\Windows\System32\RPCgBpD.exe
  2⤵
  PID:11560
- C:\Windows\System32\HgPvAhG.exe
  C:\Windows\System32\HgPvAhG.exe
  2⤵
  PID:11584
- C:\Windows\System32\qWClrgZ.exe
  C:\Windows\System32\qWClrgZ.exe
  2⤵
  PID:11600
- C:\Windows\System32\TcVaCKX.exe
  C:\Windows\System32\TcVaCKX.exe
  2⤵
  PID:11628
- C:\Windows\System32\RNqtUYJ.exe
  C:\Windows\System32\RNqtUYJ.exe
  2⤵
  PID:11688
- C:\Windows\System32\AvlJgyN.exe
  C:\Windows\System32\AvlJgyN.exe
  2⤵
  PID:11708
- C:\Windows\System32\eyAywCA.exe
  C:\Windows\System32\eyAywCA.exe
  2⤵
  PID:11724
- C:\Windows\System32\mMiLROC.exe
  C:\Windows\System32\mMiLROC.exe
  2⤵
  PID:11740
- C:\Windows\System32\ZagNqEw.exe
  C:\Windows\System32\ZagNqEw.exe
  2⤵
  PID:11784
- C:\Windows\System32\bkKwBEF.exe
  C:\Windows\System32\bkKwBEF.exe
  2⤵
  PID:11816
- C:\Windows\System32\KIydstQ.exe
  C:\Windows\System32\KIydstQ.exe
  2⤵
  PID:11840
- C:\Windows\System32\iBdMQuC.exe
  C:\Windows\System32\iBdMQuC.exe
  2⤵
  PID:11860
- C:\Windows\System32\rsoLtLe.exe
  C:\Windows\System32\rsoLtLe.exe
  2⤵
  PID:11884
- C:\Windows\System32\YDXjTzH.exe
  C:\Windows\System32\YDXjTzH.exe
  2⤵
  PID:11928
- C:\Windows\System32\HJyJCoj.exe
  C:\Windows\System32\HJyJCoj.exe
  2⤵
  PID:11952
- C:\Windows\System32\UozqXJD.exe
  C:\Windows\System32\UozqXJD.exe
  2⤵
  PID:11972
- C:\Windows\System32\Mlnuysa.exe
  C:\Windows\System32\Mlnuysa.exe
  2⤵
  PID:12012
- C:\Windows\System32\ddaTkYo.exe
  C:\Windows\System32\ddaTkYo.exe
  2⤵
  PID:12044
- C:\Windows\System32\CpYRwEm.exe
  C:\Windows\System32\CpYRwEm.exe
  2⤵
  PID:12060
- C:\Windows\System32\WldncFf.exe
  C:\Windows\System32\WldncFf.exe
  2⤵
  PID:12080
- C:\Windows\System32\aGNpMvC.exe
  C:\Windows\System32\aGNpMvC.exe
  2⤵
  PID:12128
- C:\Windows\System32\MjxAzlS.exe
  C:\Windows\System32\MjxAzlS.exe
  2⤵
  PID:12160
- C:\Windows\System32\KDSaYeR.exe
  C:\Windows\System32\KDSaYeR.exe
  2⤵
  PID:12192
- C:\Windows\System32\jkblslw.exe
  C:\Windows\System32\jkblslw.exe
  2⤵
  PID:12208
- C:\Windows\System32\TdpfGEr.exe
  C:\Windows\System32\TdpfGEr.exe
  2⤵
  PID:12236
- C:\Windows\System32\geEmASD.exe
  C:\Windows\System32\geEmASD.exe
  2⤵
  PID:12276
- C:\Windows\System32\rVMARpF.exe
  C:\Windows\System32\rVMARpF.exe
  2⤵
  PID:11284
- C:\Windows\System32\FrBcabk.exe
  C:\Windows\System32\FrBcabk.exe
  2⤵
  PID:11308
- C:\Windows\System32\DBfSiBr.exe
  C:\Windows\System32\DBfSiBr.exe
  2⤵
  PID:11396
- C:\Windows\System32\iVIrZGJ.exe
  C:\Windows\System32\iVIrZGJ.exe
  2⤵
  PID:11432
- C:\Windows\System32\pWMPpSk.exe
  C:\Windows\System32\pWMPpSk.exe
  2⤵
  PID:11492
- C:\Windows\System32\eoeoqgb.exe
  C:\Windows\System32\eoeoqgb.exe
  2⤵
  PID:11532
- C:\Windows\System32\udxnmEP.exe
  C:\Windows\System32\udxnmEP.exe
  2⤵
  PID:11596
- C:\Windows\System32\wSXesHC.exe
  C:\Windows\System32\wSXesHC.exe
  2⤵
  PID:11636
- C:\Windows\System32\xNLxXYg.exe
  C:\Windows\System32\xNLxXYg.exe
  2⤵
  PID:11664
- C:\Windows\System32\wrBFacN.exe
  C:\Windows\System32\wrBFacN.exe
  2⤵
  PID:11716
- C:\Windows\System32\tgxAtUG.exe
  C:\Windows\System32\tgxAtUG.exe
  2⤵
  PID:11792
- C:\Windows\System32\XCJvexw.exe
  C:\Windows\System32\XCJvexw.exe
  2⤵
  PID:11824
- C:\Windows\System32\nCGdCGC.exe
  C:\Windows\System32\nCGdCGC.exe
  2⤵
  PID:12056
- C:\Windows\System32\vpJuitc.exe
  C:\Windows\System32\vpJuitc.exe
  2⤵
  PID:12136
- C:\Windows\System32\pHuVvoP.exe
  C:\Windows\System32\pHuVvoP.exe
  2⤵
  PID:2764
- C:\Windows\System32\owuXguO.exe
  C:\Windows\System32\owuXguO.exe
  2⤵
  PID:1436
- C:\Windows\System32\WpHbDFJ.exe
  C:\Windows\System32\WpHbDFJ.exe
  2⤵
  PID:12200
- C:\Windows\System32\JwbpfKP.exe
  C:\Windows\System32\JwbpfKP.exe
  2⤵
  PID:10608
- C:\Windows\System32\YTZlqHo.exe
  C:\Windows\System32\YTZlqHo.exe
  2⤵
  PID:1416
- C:\Windows\System32\yuykRxc.exe
  C:\Windows\System32\yuykRxc.exe
  2⤵
  PID:11464
- C:\Windows\System32\EyCBQzf.exe
  C:\Windows\System32\EyCBQzf.exe
  2⤵
  PID:11680
- C:\Windows\System32\jxwiYQk.exe
  C:\Windows\System32\jxwiYQk.exe
  2⤵
  PID:11732
- C:\Windows\System32\OBlxjWs.exe
  C:\Windows\System32\OBlxjWs.exe
  2⤵
  PID:11984
- C:\Windows\System32\qAXnbdS.exe
  C:\Windows\System32\qAXnbdS.exe
  2⤵
  PID:12144
- C:\Windows\System32\jqLSRIL.exe
  C:\Windows\System32\jqLSRIL.exe
  2⤵
  PID:12172
- C:\Windows\System32\tgWjxlA.exe
  C:\Windows\System32\tgWjxlA.exe
  2⤵
  PID:11352
- C:\Windows\System32\zBJwGZM.exe
  C:\Windows\System32\zBJwGZM.exe
  2⤵
  PID:11460
- C:\Windows\System32\grVKynW.exe
  C:\Windows\System32\grVKynW.exe
  2⤵
  PID:11780
- C:\Windows\System32\HqKYyvq.exe
  C:\Windows\System32\HqKYyvq.exe
  2⤵
  PID:12232
- C:\Windows\System32\JvzBGwQ.exe
  C:\Windows\System32\JvzBGwQ.exe
  2⤵
  PID:11420
- C:\Windows\System32\nMOIzxa.exe
  C:\Windows\System32\nMOIzxa.exe
  2⤵
  PID:4440
- C:\Windows\System32\tNwMKMO.exe
  C:\Windows\System32\tNwMKMO.exe
  2⤵
  PID:12312
- C:\Windows\System32\vURjHjL.exe
  C:\Windows\System32\vURjHjL.exe
  2⤵
  PID:12336
- C:\Windows\System32\MHPjnmy.exe
  C:\Windows\System32\MHPjnmy.exe
  2⤵
  PID:12360
- C:\Windows\System32\FTXEtXN.exe
  C:\Windows\System32\FTXEtXN.exe
  2⤵
  PID:12428
- C:\Windows\System32\GBNTFOZ.exe
  C:\Windows\System32\GBNTFOZ.exe
  2⤵
  PID:12448
- C:\Windows\System32\TDSUbXr.exe
  C:\Windows\System32\TDSUbXr.exe
  2⤵
  PID:12480
- C:\Windows\System32\DiLXATD.exe
  C:\Windows\System32\DiLXATD.exe
  2⤵
  PID:12496
- C:\Windows\System32\QEqtaJF.exe
  C:\Windows\System32\QEqtaJF.exe
  2⤵
  PID:12536
- C:\Windows\System32\IhrzYOB.exe
  C:\Windows\System32\IhrzYOB.exe
  2⤵
  PID:12560
- C:\Windows\System32\olUwWqg.exe
  C:\Windows\System32\olUwWqg.exe
  2⤵
  PID:12588
- C:\Windows\System32\xQZUcwX.exe
  C:\Windows\System32\xQZUcwX.exe
  2⤵
  PID:12604
- C:\Windows\System32\xuVSxWq.exe
  C:\Windows\System32\xuVSxWq.exe
  2⤵
  PID:12624
- C:\Windows\System32\PHQLHxt.exe
  C:\Windows\System32\PHQLHxt.exe
  2⤵
  PID:12644
- C:\Windows\System32\OnBPVAz.exe
  C:\Windows\System32\OnBPVAz.exe
  2⤵
  PID:12660
- C:\Windows\System32\tqsofLz.exe
  C:\Windows\System32\tqsofLz.exe
  2⤵
  PID:12720
- C:\Windows\System32\RcHPjCi.exe
  C:\Windows\System32\RcHPjCi.exe
  2⤵
  PID:12748
- C:\Windows\System32\fBWLcch.exe
  C:\Windows\System32\fBWLcch.exe
  2⤵
  PID:12772
- C:\Windows\System32\rcosRVg.exe
  C:\Windows\System32\rcosRVg.exe
  2⤵
  PID:12792
- C:\Windows\System32\BvSPsCI.exe
  C:\Windows\System32\BvSPsCI.exe
  2⤵
  PID:12852
- C:\Windows\System32\PLiVBly.exe
  C:\Windows\System32\PLiVBly.exe
  2⤵
  PID:12868
- C:\Windows\System32\XXgmuMu.exe
  C:\Windows\System32\XXgmuMu.exe
  2⤵
  PID:12888
- C:\Windows\System32\glaArXG.exe
  C:\Windows\System32\glaArXG.exe
  2⤵
  PID:12928
- C:\Windows\System32\EpEvFrE.exe
  C:\Windows\System32\EpEvFrE.exe
  2⤵
  PID:12948
- C:\Windows\System32\qYZVBYd.exe
  C:\Windows\System32\qYZVBYd.exe
  2⤵
  PID:12972
- C:\Windows\System32\DCigIGR.exe
  C:\Windows\System32\DCigIGR.exe
  2⤵
  PID:13012
- C:\Windows\System32\ebjYzJs.exe
  C:\Windows\System32\ebjYzJs.exe
  2⤵
  PID:13036
- C:\Windows\System32\oIndlvX.exe
  C:\Windows\System32\oIndlvX.exe
  2⤵
  PID:13056
- C:\Windows\System32\dIZJLkN.exe
  C:\Windows\System32\dIZJLkN.exe
  2⤵
  PID:13072
- C:\Windows\System32\fTWtpZq.exe
  C:\Windows\System32\fTWtpZq.exe
  2⤵
  PID:13112
- C:\Windows\System32\VvQujTA.exe
  C:\Windows\System32\VvQujTA.exe
  2⤵
  PID:13140
- C:\Windows\System32\vVZlOlj.exe
  C:\Windows\System32\vVZlOlj.exe
  2⤵
  PID:13180
- C:\Windows\System32\mOMmZqs.exe
  C:\Windows\System32\mOMmZqs.exe
  2⤵
  PID:13212
- C:\Windows\System32\BPaNidE.exe
  C:\Windows\System32\BPaNidE.exe
  2⤵
  PID:13244
- C:\Windows\System32\jczNDKF.exe
  C:\Windows\System32\jczNDKF.exe
  2⤵
  PID:13264
- C:\Windows\System32\GRpMVjE.exe
  C:\Windows\System32\GRpMVjE.exe
  2⤵
  PID:13284
- C:\Windows\System32\kUZpWIN.exe
  C:\Windows\System32\kUZpWIN.exe
  2⤵
  PID:11572
- C:\Windows\System32\owWzSSn.exe
  C:\Windows\System32\owWzSSn.exe
  2⤵
  PID:11696
- C:\Windows\System32\iZDOZZo.exe
  C:\Windows\System32\iZDOZZo.exe
  2⤵
  PID:12404
- C:\Windows\System32\xNzJRyI.exe
  C:\Windows\System32\xNzJRyI.exe
  2⤵
  PID:12440
- C:\Windows\System32\TmXKBAA.exe
  C:\Windows\System32\TmXKBAA.exe
  2⤵
  PID:12532
- C:\Windows\System32\Viselkk.exe
  C:\Windows\System32\Viselkk.exe
  2⤵
  PID:12572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\COlETFR.exe

Filesize
1.2MB

MD5
45f88b3e9fd9e230706de155e6cb9692

SHA1
0b6cf3afd0a9293ad587893f162c6f22ad665de4

SHA256
6c0896827ff675f423fd9814539f10067b61982018f2ef591a0005c508fc3063

SHA512
afffb5b26545a26b9d9cef4e36ece09e520e0d8f781d5c180661fa198ac51ec4ee39b31173011eb9f8cb676366d8fac4805436137da4b1df393ce710dfbd0b4f

Download Submit
C:\Windows\System32\CyAvcBk.exe

Filesize
1.2MB

MD5
dcb51395b8337cf04eb460d3ddee0fa4

SHA1
eb049ff9c5e8c8ba7b4fd79f53fd963a95176ef3

SHA256
d5b9a57975154fca3c0023abd4ea5c49b2ec1c496145259fb887e33ab6eb3cad

SHA512
02e985827b638b07e9781aa08a8eb4f4e9e722364d87f5b6c9c87c4667599c387be637c016e17da6e888cc3809d5fda933273126166f81cc8d2e1acdbd81d369

Download Submit
C:\Windows\System32\DmvTtSf.exe

Filesize
1.2MB

MD5
1faf14ae833c04416f69142728439b68

SHA1
98be079991479b0d55c8b2147b7fa8a94b7fc465

SHA256
008b8c0149e0521645f50991066fe82031edf6f2e0f8613c3b68b7c6c82c589a

SHA512
3e98db6668de6a8909b762c2e9589943b2324f51de9e27044591abd1205ab9d7a95f16a6e4ea7fede70bfbe14d48edfb3af71c980a7b2d7d7b5ccbd36b967139

Download Submit
C:\Windows\System32\EgyhVgL.exe

Filesize
1.2MB

MD5
0c07bfc875c0d7cc6797043a4c56200b

SHA1
63a8d71447dd2d4d8aa322a835f7582e38056957

SHA256
10532b506c446a1b8bc26d48144db657b4a4f02c51e28aa88ea6f8e886d2da73

SHA512
d7181153bfb9a8c3a6ca8a8f6e4a467fe7db3c17caef51d35f61872fb62fc9418440fc57940f5540a32858cefa82081977ce044feff30df492b85ac6d6fbb123

Download Submit
C:\Windows\System32\FoRjEHv.exe

Filesize
1.2MB

MD5
4f89398c2c570ef922d93c0bf0f30745

SHA1
b59a41e37def267857503a42d8f17c7e68c2a86b

SHA256
97288c63bc528b34a9e0907b497402feadb5b0c7a6e36428b30bfd2b78556988

SHA512
626fa23e2e9d534a4a2ef6c8a9c4eec68a1e292c21dce0923f35dc9a2f6eebddaac9effbe73459a77e88bbb2b5ec183edb513cf7325a134fb5fc5e7eb845f4d0

Download Submit
C:\Windows\System32\GKoKoxD.exe

Filesize
1.2MB

MD5
ccb4485b332b5b6a7bc7c28818bc92b2

SHA1
1e080590ed9023606a9bdf81731b8e5df0e061e7

SHA256
f800604f043418293b169b0c74ff8aee2cc1b8f7b8ba451ffd45cb2c1c252c67

SHA512
8e863e22234d07b9d76eaa9c6536ed2744d27812ad82e32010c322dc49cdb37e531cbb6b61625e3fc1645a5cbf98edb0390a508bfd51fd40e93d5b0336d73d7d

Download Submit
C:\Windows\System32\HRGQwpg.exe

Filesize
1.2MB

MD5
6a76cd501c716dd7840f761231e727f3

SHA1
af1e42e232df6ee86501892ad0723f42dd70de0e

SHA256
87cdf6e7b6a145166777a83889fe470b8f94a6ea6c0fc31af37d40dc39cc47bb

SHA512
97c101615a77a91f9c7dc61642cbd9e855e302c3bc533e58b8324404ab694d3e25e8d3188dd2d58137acc79fd77fc0079480e7ba99e5f90664c4cc98049999d4

Download Submit
C:\Windows\System32\JKvROkU.exe

Filesize
1.2MB

MD5
3cc21d30b311fd05a5992896aae26353

SHA1
fd79c5142e17a780d471c35ea2ba709723e0fc41

SHA256
d2541cd1c3b49fef2569f2b5c643430f50cbae777efb721fdcfb2f2bf3888bae

SHA512
4f150834f161d99dfba30055b3fef8de0098c0842fba67347232fa2ff76b0c921ad4f9eaec60432461f031baac1b6e496d447ec51e4fb337a2baab3d8f183911

Download Submit
C:\Windows\System32\JWoGuzE.exe

Filesize
1.2MB

MD5
81cde4c2575b9e1be42317cf793c18d3

SHA1
aab5174e19e745628a772512f7f1080102f1e8c6

SHA256
eb1a5b8e5aab8886240d1a5e9d2e88b5c2b13daaa603f0bbfed734f631632c83

SHA512
2784c411094c32985a9e403d990ab1600889dd1c28b978e47b360ebf3ed4b4d0010467cc18370ae1bceac5c7753e14f600d7f449b3f0ab81518870168d480dac

Download Submit
C:\Windows\System32\JWuzWPD.exe

Filesize
1.2MB

MD5
b142bc1673fc9cb41d1aaf52e8eadf62

SHA1
8cb524eba2d7600b3f84abbf588ce2e01e5f81a6

SHA256
b6dc2547323ae248f22736a487dbc429c7acf6cdadc9330eb0951a431c11f698

SHA512
9a1fa58ce2d9591487961a3fc45c547f52e24780a6749b14938b6be98c3a2209bd21ec467c931772502c4ef02af1d4b2fde5c05fecaed6a2f26a6d8db9abff1d

Download Submit
C:\Windows\System32\JbeSkTc.exe

Filesize
1.2MB

MD5
7e21cf0c2a849598eb09b62c50dec844

SHA1
0dd8df02158bb8857ec0fe5ec91e16873fe3c928

SHA256
d717d9a0f3dde97434984da1695b2c973ef9733ecb2977e6977c6d7147934a27

SHA512
c47b117f5855efe8f240219822abf460ac4bad60466a08005131db1fa1ebd433a5f0dbe68e876090e30b8aa5870063c4486733b0dad7f32be354c83f8ec089a5

Download Submit
C:\Windows\System32\LurphuY.exe

Filesize
1.2MB

MD5
f2509c8656e285395dac9d1cfc8153cf

SHA1
6557d1439583f919c3acce8ed54a94f24a1524c3

SHA256
1fff2859893b39f7a617b57a8aa1de00f8a13587ded1212955aad63f4fcf86eb

SHA512
3c4c4b9dab6663345fa00d60fcfaa805524bafc43288d600d97b1b41a42e83d28f5c9971459c396d41370d95f101cca2c4b45165137fd5ec0d50e849a1030caf

Download Submit
C:\Windows\System32\MLxKcav.exe

Filesize
1.2MB

MD5
7c3ef2df79abaddba5a76cbcc9dd6b88

SHA1
f9c591176ae2f0bb40b91a15871c060604dd5315

SHA256
ea9c1dbf59168b925ba500315fa75628d2f865557d2a9fb65c199daad44830fb

SHA512
d6df4db7f4a6c0465b20a772c83b09737965d2a5a0684fe3acb2da023eb3fc35213d6712a8e417a06546e7b354c0364fd044388f5f91f448f070a73d4119928f

Download Submit
C:\Windows\System32\OGlqmIs.exe

Filesize
1.2MB

MD5
be0e70d59eb94007ce3d012d84aec81c

SHA1
3c22728b43f6f0be6673153588b7260b384b68c0

SHA256
9c0d8ae5149c4cea1746520175891c8e12ef09cf51eac75c941b2f4d4c3604c8

SHA512
5fff2ef7714efa45422ba28f73be8f3b98b17521dce61238984fe06d04de5c85563aedf95e8f30c86342de7fa2cf650e83b2b9d350be1fc2e882ae1638649fda

Download Submit
C:\Windows\System32\OfSIQJQ.exe

Filesize
1.2MB

MD5
d4fa0caee5c50696a20b358e7462ec1a

SHA1
16d4dd6a2d68821593b31efc6fee484c1ea4ee3b

SHA256
fda6d2a20b073f3d71236ffeadd12413b327a97c0d842aeb058f75c5f495073c

SHA512
5e063101a0d0a373825bd5ecc0481a890d3098c7955910e22d94320674dc0e50f1061418b5fbf695496169aab148975cbd9d2b5a2ef8f01fade3b856909d1546

Download Submit
C:\Windows\System32\TuOvbov.exe

Filesize
1.2MB

MD5
4bbf22d67f57f026221cf0ac9d8b233c

SHA1
3a91f915841db442dad0e97f0c1354c54baf08a7

SHA256
aa9b2407febcacb87196893042320d14c911d3b200674f3f6279bb41531ea0bd

SHA512
440b41a534e8014154421fe10886654e15a362153189ec32c6efbfc388245e9ddfcc06e1b152585b9ee9be2563eb39aa5bc75b7114676cd9a0c6247c77c4ceb8

Download Submit
C:\Windows\System32\UWiVDuR.exe

Filesize
1.2MB

MD5
70ffbcfac3c992ad6c374e16a947c9c4

SHA1
b2fce64b7eeef4ea12ebe249ae6d6f3c73f81469

SHA256
4a9383d6f128d791ca0739789824702b1657bfa5431e67087adf3f3b1a91b7d3

SHA512
13358226657193d67861afb412ba3d811677d118af0d8fbdbc8815ac2c1dbef8424d9b09fd8fefc8d96dd00b0c00459362edf9201c63cccb021164ebb251c960

Download Submit
C:\Windows\System32\axCFWnv.exe

Filesize
1.2MB

MD5
45c6708690c2686dbf3784528753aeb3

SHA1
5e7c4fa3b0850a9203f8f0fcadb643b867e195ad

SHA256
b48dda9dd2787b3cb76ddd9b85374054c1ad334d7d0eb9ea03f5c476a80e54c0

SHA512
6b948453de2bce97e75755c48aa019b94ec9bcb5b497c94ffada51f5af39e3bcbfe9831435564f40dac0cae4c8f0f9673e8ab0ad7ecddafb69ee19ec5e2e1c9a

Download Submit
C:\Windows\System32\cRojvmr.exe

Filesize
1.2MB

MD5
525ca9d52fa96b8242eece8ed6f852f6

SHA1
c25febd6f1d701fca8cdb4a59b13adf153dbdd99

SHA256
7c61f6e03f3236907ec1a741f18bb9ac6a0a92ff4240654fb5ef859f2f90f1eb

SHA512
7eb1f9eebc4709a0a339c5827c355bd6083f604700b0e723dd6d5f0c684d85dae40fc231761621dfb152f8c7b2de3ea3363da2f1279931320c4b18b617d9273d

Download Submit
C:\Windows\System32\dQYzkCC.exe

Filesize
1.2MB

MD5
342485e5ef681c3dc637aefa7d930298

SHA1
5326d6a971f9a6a7de35efc8510c45fec082b3e1

SHA256
0a2d6ef24fbca15a17745e2e028986ab42c82af61ed39d56d5d3b1be2dfa96c9

SHA512
4670458ff762e1dfa95172331b4947384ad5046dc3faac61f80816498dfe23bed4b5c3e55f0987b2dca5f81b78ce00881fc50d87a904fce9f2fc169272646035

Download Submit
C:\Windows\System32\frrcvFW.exe

Filesize
1.2MB

MD5
c17e2a51ebc7c4b2cb1491139471d17f

SHA1
54c9cc2fad875c5eb8e83ecea0886a8112e1ef4a

SHA256
f085569fd10677e8244c6961b952d930201d43e79c7cb1ea64b8e41af4747c5c

SHA512
8fabbd28ba7edf7e1b44496636a8b0d518848cd92205b9aee03eb47c370ac9fb16fe2e4260384d59624a109734148d44fb7042a43074d7dfc58e61cb85c432a8

Download Submit
C:\Windows\System32\ftjcbdI.exe

Filesize
1.2MB

MD5
e3db0c6df83804b89192518a36818e44

SHA1
ea42a9d10bcf1f1d328cf064608e5cfd157466b5

SHA256
317b57158c78ae6232af40b9cf462b04fa637755338d0d6edcd1779d48aa7cb2

SHA512
794f34624b7d1132a7e213659d94a1b32578d969255de5de682dcc874af7e13c0fab000e30e88b6b077fd08a7927c2566376ea72f9b21fb361906c5ddf2f933c

Download Submit
C:\Windows\System32\gzidifZ.exe

Filesize
1.2MB

MD5
5ab613d2d6b3c76e5d4f2e81a3cf4b62

SHA1
38623ea3e9e87dc3fa03e0d32e52ceeb583d0dd0

SHA256
d3b877391664973decbff9c1fb385e66ff6c67ba2f8a9608ad47476b4e3ae69f

SHA512
eabdf39eecd4944956bbce70df141d6f74f3c4af56d45d7b13f2b0d6c55c1ce8bf154f4944d201e0490c4a4e63d6113010572c11066f3a38043cb2c543aa182f

Download Submit
C:\Windows\System32\hwRXDWC.exe

Filesize
1.2MB

MD5
813e593c86d6c00b98104735e174ee44

SHA1
b5151ca59cdc1b94feb54bbe7b656bf856692477

SHA256
5544cb6575219dfff8865d7b9a3069ac0d9c09b84672ab79e31f88f3e2f28a16

SHA512
42dc7b50968826cfdf7acd2e3528164fa2fa17ca9afb053bc698e1d9f62665dd8bc46a716ab42ba0560f974303cdd62c0e4d3ebe797843b9933e11ad5a127682

Download Submit
C:\Windows\System32\mFOvggM.exe

Filesize
1.2MB

MD5
9aeebe33ca3db402ac5804ea0bc45f74

SHA1
7c3682255ff5b8dddb6d3f3cec2110dcf482fa29

SHA256
71a0d7d4401d9e7ec70efd6b51ffdde45a25dc0ddbf915c37ac053b205f315ed

SHA512
86d269adc490bd54a2494f6b0062d30e177c028c0ce46c59493c3caf0502addb5685ebcf2855ec43b33da4164d4ce959022fd6cdbeb064ae623af103ff057910

Download Submit
C:\Windows\System32\mdhAUrL.exe

Filesize
1.2MB

MD5
e608c8ee2fadd8d431a36fd78fc6fb69

SHA1
17fcb43d0233c9d616e74f82bde1763406ad610f

SHA256
c5ac607c1617390656b1e7359314315e3d7cb5f9c256976dab84c0ca298da201

SHA512
897a3fe59863753321480fd87dd9d5c3095ddaebbbcbf5fec81c79b5b94d4b11730bf1f249b97b081399e942155e5a90de93e4d545661d43bfdffc85bf7752f0

Download Submit
C:\Windows\System32\nEswdPI.exe

Filesize
1.2MB

MD5
9f81a9240d36358b8120119a0cce136d

SHA1
15bf768959df524c4e0c97f5e8a8dfd6a37658df

SHA256
9941eafad11c3a729c8c9be798d2c39f9d99b84a6b94423f746cb640a6cca983

SHA512
96fed7e8a3cc634b0284f32fe5f9db1c31e984fe5a83d641d2d20dd5d840d21b30463663734980a071cbf2cf3571ea3d7c46c2d7a07534a79337b318e90942cf

Download Submit
C:\Windows\System32\nNYBufb.exe

Filesize
1.2MB

MD5
999f858849b7f80acbd86d0f5527cbe1

SHA1
e15daebd1ec18979f2dcd269dd8deebf0e40ce58

SHA256
75a1bcd62b8d9d631e62f87f0be270fb523d8f23ee7778e32f86967c3dbf812d

SHA512
23e64d26079bc35c0a8bca953d906c2d92b5c5cf9343bd34b9522b01c93b18c5f458e1691520dfe2feb6340141dc3d5147c815aa1a9d283b8f4adc68cc0f3d8f

Download Submit
C:\Windows\System32\npXcsEb.exe

Filesize
1.2MB

MD5
2c8d756169092c11bb7b8a8aeec8326e

SHA1
a296440e6538f85d09ae1ee546c5086fbec15656

SHA256
2276a5d17e68e27e5e130917153d247f1c6c5543a6c7a6fa464542a7594998f8

SHA512
c37ef1400282702f27c00ee4202357c0250450c0365096cd598b9a7b06199dffe5c1024e8394a4fc5760498c6171edc2ed05bd2d7790a3d45bec590891172b9c

Download Submit
C:\Windows\System32\qzyJQZb.exe

Filesize
1.2MB

MD5
97f50ace7c8374c13a0ba76ee9a3358e

SHA1
c57757b132602eede2ded5ba20f6b125a2bcd6f5

SHA256
b2e22fdb5b210c2bc73a72be0d50919278f83c29d6df59a87cce7a8e64d21973

SHA512
b4ab92550738fcfcb9c2bde3972e34d6315d3f1cc1acec88f3fddc61740c30a27e2808a4295d801e9349212325f0fb100fa34d8a968d7abd65e56c0be3462d2c

Download Submit
C:\Windows\System32\xnHwpVh.exe

Filesize
1.2MB

MD5
4daf402de3901fa341465f757543329a

SHA1
c7cc252b26fb932759f246dfad9fda29c9001f15

SHA256
a34001291f53467e5d6019094c0c2fc45bd57e99de63dc5b3390e278fbe6552a

SHA512
4e76a1fdbcca0d3d49a1b072dbab937329cf79fca48ade081bd8cd801acc1eda003b189dac1ff5583e7d82533651c9157e0e8452c6e68e0a55d89606a6520c25

Download Submit
C:\Windows\System32\yxXTpvH.exe

Filesize
1.2MB

MD5
07a6d004eae0bc0ca902baaf9c64c3a9

SHA1
901048c2e23d82f67fafceec3dc4b404b63d9ea8

SHA256
272cbb02d90d455c8fd1e13c33dea70e6a8901fe880bb5539df11a43ef66b93c

SHA512
84ba57329b9bcc54a37279b8cbe1ffd924d109f895f91e2137283966edf522293f15ce198687ae01269f65bd463aba0f03e233d66353e3d1c5eacf46ee69f6c4

Download Submit
memory/316-2022-0x00007FF60D940000-0x00007FF60DD31000-memory.dmp

Filesize
3.9MB

Download
memory/316-446-0x00007FF60D940000-0x00007FF60DD31000-memory.dmp

Filesize
3.9MB

Download
memory/844-1991-0x00007FF61FB90000-0x00007FF61FF81000-memory.dmp

Filesize
3.9MB

Download
memory/844-28-0x00007FF61FB90000-0x00007FF61FF81000-memory.dmp

Filesize
3.9MB

Download
memory/844-1954-0x00007FF61FB90000-0x00007FF61FF81000-memory.dmp

Filesize
3.9MB

Download
memory/1872-472-0x00007FF7DFD90000-0x00007FF7E0181000-memory.dmp

Filesize
3.9MB

Download
memory/1872-2011-0x00007FF7DFD90000-0x00007FF7E0181000-memory.dmp

Filesize
3.9MB

Download
memory/1916-1989-0x00007FF63A570000-0x00007FF63A961000-memory.dmp

Filesize
3.9MB

Download
memory/1916-8-0x00007FF63A570000-0x00007FF63A961000-memory.dmp

Filesize
3.9MB

Download
memory/2356-425-0x00007FF64A240000-0x00007FF64A631000-memory.dmp

Filesize
3.9MB

Download
memory/2356-2026-0x00007FF64A240000-0x00007FF64A631000-memory.dmp

Filesize
3.9MB

Download
memory/2384-462-0x00007FF716310000-0x00007FF716701000-memory.dmp

Filesize
3.9MB

Download
memory/2384-2016-0x00007FF716310000-0x00007FF716701000-memory.dmp

Filesize
3.9MB

Download
memory/2412-2014-0x00007FF7DC7D0000-0x00007FF7DCBC1000-memory.dmp

Filesize
3.9MB

Download
memory/2412-461-0x00007FF7DC7D0000-0x00007FF7DCBC1000-memory.dmp

Filesize
3.9MB

Download
memory/2472-2000-0x00007FF7FF8F0000-0x00007FF7FFCE1000-memory.dmp

Filesize
3.9MB

Download
memory/2472-41-0x00007FF7FF8F0000-0x00007FF7FFCE1000-memory.dmp

Filesize
3.9MB

Download
memory/2480-1995-0x00007FF7EF4E0000-0x00007FF7EF8D1000-memory.dmp

Filesize
3.9MB

Download
memory/2480-33-0x00007FF7EF4E0000-0x00007FF7EF8D1000-memory.dmp

Filesize
3.9MB

Download
memory/2604-406-0x00007FF6ACAD0000-0x00007FF6ACEC1000-memory.dmp

Filesize
3.9MB

Download
memory/2604-2010-0x00007FF6ACAD0000-0x00007FF6ACEC1000-memory.dmp

Filesize
3.9MB

Download
memory/2948-2030-0x00007FF744D30000-0x00007FF745121000-memory.dmp

Filesize
3.9MB

Download
memory/2948-420-0x00007FF744D30000-0x00007FF745121000-memory.dmp

Filesize
3.9MB

Download
memory/2964-2023-0x00007FF724770000-0x00007FF724B61000-memory.dmp

Filesize
3.9MB

Download
memory/2964-440-0x00007FF724770000-0x00007FF724B61000-memory.dmp

Filesize
3.9MB

Download
memory/3036-410-0x00007FF6F52D0000-0x00007FF6F56C1000-memory.dmp

Filesize
3.9MB

Download
memory/3036-2028-0x00007FF6F52D0000-0x00007FF6F56C1000-memory.dmp

Filesize
3.9MB

Download
memory/3320-1993-0x00007FF7E1AC0000-0x00007FF7E1EB1000-memory.dmp

Filesize
3.9MB

Download
memory/3320-45-0x00007FF7E1AC0000-0x00007FF7E1EB1000-memory.dmp

Filesize
3.9MB

Download
memory/3636-1-0x0000026D9A640000-0x0000026D9A650000-memory.dmp

Filesize
64KB

Download
memory/3636-0-0x00007FF63CB80000-0x00007FF63CF71000-memory.dmp

Filesize
3.9MB

Download
memory/4084-2006-0x00007FF769B10000-0x00007FF769F01000-memory.dmp

Filesize
3.9MB

Download
memory/4084-432-0x00007FF769B10000-0x00007FF769F01000-memory.dmp

Filesize
3.9MB

Download
memory/4248-2036-0x00007FF6DF250000-0x00007FF6DF641000-memory.dmp

Filesize
3.9MB

Download
memory/4248-465-0x00007FF6DF250000-0x00007FF6DF641000-memory.dmp

Filesize
3.9MB

Download
memory/4428-2033-0x00007FF70E7B0000-0x00007FF70EBA1000-memory.dmp

Filesize
3.9MB

Download
memory/4428-388-0x00007FF70E7B0000-0x00007FF70EBA1000-memory.dmp

Filesize
3.9MB

Download
memory/4468-400-0x00007FF756770000-0x00007FF756B61000-memory.dmp

Filesize
3.9MB

Download
memory/4468-2032-0x00007FF756770000-0x00007FF756B61000-memory.dmp

Filesize
3.9MB

Download
memory/4476-384-0x00007FF608950000-0x00007FF608D41000-memory.dmp

Filesize
3.9MB

Download
memory/4476-1999-0x00007FF608950000-0x00007FF608D41000-memory.dmp

Filesize
3.9MB

Download
memory/4544-428-0x00007FF6C8570000-0x00007FF6C8961000-memory.dmp

Filesize
3.9MB

Download
memory/4544-2007-0x00007FF6C8570000-0x00007FF6C8961000-memory.dmp

Filesize
3.9MB

Download
memory/4672-475-0x00007FF678170000-0x00007FF678561000-memory.dmp

Filesize
3.9MB

Download
memory/4672-2003-0x00007FF678170000-0x00007FF678561000-memory.dmp

Filesize
3.9MB

Download
memory/4860-2020-0x00007FF7BA590000-0x00007FF7BA981000-memory.dmp

Filesize
3.9MB

Download
memory/4860-453-0x00007FF7BA590000-0x00007FF7BA981000-memory.dmp

Filesize
3.9MB

Download
memory/4936-459-0x00007FF739210000-0x00007FF739601000-memory.dmp

Filesize
3.9MB

Download
memory/4936-2018-0x00007FF739210000-0x00007FF739601000-memory.dmp

Filesize
3.9MB

Download
memory/4944-2001-0x00007FF742A80000-0x00007FF742E71000-memory.dmp

Filesize
3.9MB

Download
memory/4944-374-0x00007FF742A80000-0x00007FF742E71000-memory.dmp

Filesize
3.9MB

Download