xmrig | 37d4575f599cca3d846579d443e0060d4f3e4c8ba82cc3edcb2574dcabdab755

Analysis

max time kernel
72s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
Size

1.2MB
MD5

05129ac00e07584bff12ac7cc7832cf0
SHA1

e563e1e0218c0b14c3fe14f45351badf282d2902
SHA256

37d4575f599cca3d846579d443e0060d4f3e4c8ba82cc3edcb2574dcabdab755
SHA512

575a07f1f4c095664e79b642ed57df5cfaa5d8a9f87d8c0321a741c596dbdee2019bafff91c1f7c40ed29bd1710280fe4dd2c162f89cc16b6a9822054d53ac8f
SSDEEP

24576:JanwhSe11QSONCpGJCjETPl+Me7bPMS8YkgcWRsnWrCM:knw9oUUEEDl+xTMS8Tgzx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3180-368-0x00007FF6BB240000-0x00007FF6BB631000-memory.dmp	xmrig
behavioral2/memory/3276-369-0x00007FF7725B0000-0x00007FF7729A1000-memory.dmp	xmrig
behavioral2/memory/4576-370-0x00007FF7C7770000-0x00007FF7C7B61000-memory.dmp	xmrig
behavioral2/memory/4848-371-0x00007FF7FDF20000-0x00007FF7FE311000-memory.dmp	xmrig
behavioral2/memory/4092-372-0x00007FF630A40000-0x00007FF630E31000-memory.dmp	xmrig
behavioral2/memory/2444-20-0x00007FF6D3C60000-0x00007FF6D4051000-memory.dmp	xmrig
behavioral2/memory/5072-373-0x00007FF683EB0000-0x00007FF6842A1000-memory.dmp	xmrig
behavioral2/memory/4048-375-0x00007FF67FB70000-0x00007FF67FF61000-memory.dmp	xmrig
behavioral2/memory/3044-374-0x00007FF6A6BE0000-0x00007FF6A6FD1000-memory.dmp	xmrig
behavioral2/memory/5116-376-0x00007FF71B1B0000-0x00007FF71B5A1000-memory.dmp	xmrig
behavioral2/memory/4776-378-0x00007FF67EF80000-0x00007FF67F371000-memory.dmp	xmrig
behavioral2/memory/1344-377-0x00007FF6D7990000-0x00007FF6D7D81000-memory.dmp	xmrig
behavioral2/memory/2960-379-0x00007FF6F8EA0000-0x00007FF6F9291000-memory.dmp	xmrig
behavioral2/memory/4640-380-0x00007FF6D3840000-0x00007FF6D3C31000-memory.dmp	xmrig
behavioral2/memory/3124-381-0x00007FF765B40000-0x00007FF765F31000-memory.dmp	xmrig
behavioral2/memory/4204-382-0x00007FF729FA0000-0x00007FF72A391000-memory.dmp	xmrig
behavioral2/memory/1600-387-0x00007FF6FAA80000-0x00007FF6FAE71000-memory.dmp	xmrig
behavioral2/memory/4516-402-0x00007FF6E1950000-0x00007FF6E1D41000-memory.dmp	xmrig
behavioral2/memory/4252-400-0x00007FF7D5050000-0x00007FF7D5441000-memory.dmp	xmrig
behavioral2/memory/2900-393-0x00007FF6B01B0000-0x00007FF6B05A1000-memory.dmp	xmrig
behavioral2/memory/4228-390-0x00007FF744270000-0x00007FF744661000-memory.dmp	xmrig
behavioral2/memory/3780-1989-0x00007FF7628A0000-0x00007FF762C91000-memory.dmp	xmrig
behavioral2/memory/1548-2022-0x00007FF63B740000-0x00007FF63BB31000-memory.dmp	xmrig
behavioral2/memory/4408-2023-0x00007FF69EA70000-0x00007FF69EE61000-memory.dmp	xmrig
behavioral2/memory/3780-2029-0x00007FF7628A0000-0x00007FF762C91000-memory.dmp	xmrig
behavioral2/memory/2444-2031-0x00007FF6D3C60000-0x00007FF6D4051000-memory.dmp	xmrig
behavioral2/memory/4408-2035-0x00007FF69EA70000-0x00007FF69EE61000-memory.dmp	xmrig
behavioral2/memory/3180-2037-0x00007FF6BB240000-0x00007FF6BB631000-memory.dmp	xmrig
behavioral2/memory/4252-2036-0x00007FF7D5050000-0x00007FF7D5441000-memory.dmp	xmrig
behavioral2/memory/1548-2039-0x00007FF63B740000-0x00007FF63BB31000-memory.dmp	xmrig
behavioral2/memory/4092-2048-0x00007FF630A40000-0x00007FF630E31000-memory.dmp	xmrig
behavioral2/memory/1344-2045-0x00007FF6D7990000-0x00007FF6D7D81000-memory.dmp	xmrig
behavioral2/memory/4848-2041-0x00007FF7FDF20000-0x00007FF7FE311000-memory.dmp	xmrig
behavioral2/memory/4640-2063-0x00007FF6D3840000-0x00007FF6D3C31000-memory.dmp	xmrig
behavioral2/memory/4048-2061-0x00007FF67FB70000-0x00007FF67FF61000-memory.dmp	xmrig
behavioral2/memory/5116-2060-0x00007FF71B1B0000-0x00007FF71B5A1000-memory.dmp	xmrig
behavioral2/memory/3044-2057-0x00007FF6A6BE0000-0x00007FF6A6FD1000-memory.dmp	xmrig
behavioral2/memory/4516-2055-0x00007FF6E1950000-0x00007FF6E1D41000-memory.dmp	xmrig
behavioral2/memory/3276-2053-0x00007FF7725B0000-0x00007FF7729A1000-memory.dmp	xmrig
behavioral2/memory/4576-2052-0x00007FF7C7770000-0x00007FF7C7B61000-memory.dmp	xmrig
behavioral2/memory/5072-2049-0x00007FF683EB0000-0x00007FF6842A1000-memory.dmp	xmrig
behavioral2/memory/4776-2044-0x00007FF67EF80000-0x00007FF67F371000-memory.dmp	xmrig
behavioral2/memory/4204-2067-0x00007FF729FA0000-0x00007FF72A391000-memory.dmp	xmrig
behavioral2/memory/1600-2071-0x00007FF6FAA80000-0x00007FF6FAE71000-memory.dmp	xmrig
behavioral2/memory/4228-2073-0x00007FF744270000-0x00007FF744661000-memory.dmp	xmrig
behavioral2/memory/2900-2075-0x00007FF6B01B0000-0x00007FF6B05A1000-memory.dmp	xmrig
behavioral2/memory/3124-2069-0x00007FF765B40000-0x00007FF765F31000-memory.dmp	xmrig
behavioral2/memory/2960-2065-0x00007FF6F8EA0000-0x00007FF6F9291000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3780	VtrhFyH.exe
2444	uUZNRyD.exe
4408	pSNnZRC.exe
1548	VuXuYsT.exe
4252	GGBAHAB.exe
3180	xAVhFlm.exe
4516	Fttofds.exe
3276	eVBztbV.exe
4576	dgqKPbz.exe
4848	ywGcQRv.exe
4092	jgOHapk.exe
5072	VWDkRws.exe
3044	ggLZmvW.exe
4048	eNwtLnk.exe
5116	WUFglnL.exe
1344	HwFIVDP.exe
4776	hxxulAV.exe
2960	kAULHlJ.exe
4640	guQlzTm.exe
3124	NaRXMxo.exe
4204	hSZYrDc.exe
1600	ZJxqmjO.exe
4228	oRWFcai.exe
2900	GfgyNoY.exe
2968	QaSjQGo.exe
3216	NxVVcqM.exe
1004	etavune.exe
3160	LRpkODp.exe
3316	uheoamd.exe
2088	irzHVOS.exe
2352	yijVpwk.exe
3696	YPBwzYA.exe
540	ZUzRcDw.exe
2020	pEUUKUY.exe
4956	HdrYaEi.exe
3832	RUkHxjA.exe
2336	nJeXpVf.exe
1940	RQCSJlz.exe
3992	IcVilqw.exe
3884	zgsAHjI.exe
3680	CZlUarT.exe
2984	NQRaZde.exe
2916	GmTSxAF.exe
4604	MFmFsLX.exe
3292	PxDCfOy.exe
1020	cGxsALZ.exe
2448	QMqXFqs.exe
4360	nXEZmAw.exe
4436	dplIkTO.exe
1628	WXDAQMi.exe
1564	FRvvOYg.exe
4376	bKiDJVd.exe
4028	ffXYPAM.exe
2504	FKosFeL.exe
1536	mfYKsmB.exe
2080	uZmIIgj.exe
3372	daZSzYQ.exe
640	bTUycYD.exe
1576	dQzqfRQ.exe
4628	uMEdIvR.exe
4980	wFSyIxZ.exe
2104	jmWMwta.exe
2604	gPsWpCt.exe
3928	wgtaTwO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/384-0-0x00007FF675770000-0x00007FF675B61000-memory.dmp	upx
behavioral2/files/0x000c000000023b3d-5.dat	upx
behavioral2/files/0x000a000000023b9c-9.dat	upx
behavioral2/files/0x000a000000023b9b-12.dat	upx
behavioral2/files/0x000a000000023b9d-19.dat	upx
behavioral2/memory/1548-24-0x00007FF63B740000-0x00007FF63BB31000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-45.dat	upx
behavioral2/files/0x000a000000023ba4-60.dat	upx
behavioral2/files/0x000a000000023ba7-75.dat	upx
behavioral2/files/0x000a000000023ba9-83.dat	upx
behavioral2/files/0x000a000000023bac-100.dat	upx
behavioral2/files/0x000a000000023bb3-135.dat	upx
behavioral2/files/0x0031000000023bb8-160.dat	upx
behavioral2/memory/3180-368-0x00007FF6BB240000-0x00007FF6BB631000-memory.dmp	upx
behavioral2/memory/3276-369-0x00007FF7725B0000-0x00007FF7729A1000-memory.dmp	upx
behavioral2/memory/4576-370-0x00007FF7C7770000-0x00007FF7C7B61000-memory.dmp	upx
behavioral2/memory/4848-371-0x00007FF7FDF20000-0x00007FF7FE311000-memory.dmp	upx
behavioral2/files/0x000a000000023bb9-165.dat	upx
behavioral2/files/0x0031000000023bb7-155.dat	upx
behavioral2/files/0x0031000000023bb6-150.dat	upx
behavioral2/files/0x000a000000023bb5-145.dat	upx
behavioral2/files/0x000a000000023bb4-140.dat	upx
behavioral2/files/0x000a000000023bb2-130.dat	upx
behavioral2/files/0x000a000000023bb1-125.dat	upx
behavioral2/files/0x000a000000023bb0-120.dat	upx
behavioral2/files/0x000a000000023baf-115.dat	upx
behavioral2/memory/4092-372-0x00007FF630A40000-0x00007FF630E31000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-110.dat	upx
behavioral2/files/0x000a000000023bad-105.dat	upx
behavioral2/files/0x000a000000023bab-95.dat	upx
behavioral2/files/0x000a000000023baa-90.dat	upx
behavioral2/files/0x000a000000023ba8-80.dat	upx
behavioral2/files/0x000a000000023ba6-70.dat	upx
behavioral2/files/0x000a000000023ba5-65.dat	upx
behavioral2/files/0x000a000000023ba3-55.dat	upx
behavioral2/files/0x000a000000023ba2-50.dat	upx
behavioral2/files/0x000a000000023ba0-40.dat	upx
behavioral2/memory/4408-34-0x00007FF69EA70000-0x00007FF69EE61000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-31.dat	upx
behavioral2/files/0x000a000000023b9e-30.dat	upx
behavioral2/memory/2444-20-0x00007FF6D3C60000-0x00007FF6D4051000-memory.dmp	upx
behavioral2/memory/3780-7-0x00007FF7628A0000-0x00007FF762C91000-memory.dmp	upx
behavioral2/memory/5072-373-0x00007FF683EB0000-0x00007FF6842A1000-memory.dmp	upx
behavioral2/memory/4048-375-0x00007FF67FB70000-0x00007FF67FF61000-memory.dmp	upx
behavioral2/memory/3044-374-0x00007FF6A6BE0000-0x00007FF6A6FD1000-memory.dmp	upx
behavioral2/memory/5116-376-0x00007FF71B1B0000-0x00007FF71B5A1000-memory.dmp	upx
behavioral2/memory/4776-378-0x00007FF67EF80000-0x00007FF67F371000-memory.dmp	upx
behavioral2/memory/1344-377-0x00007FF6D7990000-0x00007FF6D7D81000-memory.dmp	upx
behavioral2/memory/2960-379-0x00007FF6F8EA0000-0x00007FF6F9291000-memory.dmp	upx
behavioral2/memory/4640-380-0x00007FF6D3840000-0x00007FF6D3C31000-memory.dmp	upx
behavioral2/memory/3124-381-0x00007FF765B40000-0x00007FF765F31000-memory.dmp	upx
behavioral2/memory/4204-382-0x00007FF729FA0000-0x00007FF72A391000-memory.dmp	upx
behavioral2/memory/1600-387-0x00007FF6FAA80000-0x00007FF6FAE71000-memory.dmp	upx
behavioral2/memory/4516-402-0x00007FF6E1950000-0x00007FF6E1D41000-memory.dmp	upx
behavioral2/memory/4252-400-0x00007FF7D5050000-0x00007FF7D5441000-memory.dmp	upx
behavioral2/memory/2900-393-0x00007FF6B01B0000-0x00007FF6B05A1000-memory.dmp	upx
behavioral2/memory/4228-390-0x00007FF744270000-0x00007FF744661000-memory.dmp	upx
behavioral2/memory/3780-1989-0x00007FF7628A0000-0x00007FF762C91000-memory.dmp	upx
behavioral2/memory/1548-2022-0x00007FF63B740000-0x00007FF63BB31000-memory.dmp	upx
behavioral2/memory/4408-2023-0x00007FF69EA70000-0x00007FF69EE61000-memory.dmp	upx
behavioral2/memory/3780-2029-0x00007FF7628A0000-0x00007FF762C91000-memory.dmp	upx
behavioral2/memory/2444-2031-0x00007FF6D3C60000-0x00007FF6D4051000-memory.dmp	upx
behavioral2/memory/4408-2035-0x00007FF69EA70000-0x00007FF69EE61000-memory.dmp	upx
behavioral2/memory/3180-2037-0x00007FF6BB240000-0x00007FF6BB631000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\wFSyIxZ.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\hoYavvY.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\ONCGyfK.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\WmVPuzh.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\GSVgPcT.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\qJfMzRJ.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\ZUzRcDw.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\dplIkTO.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\bdPfUWr.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\mkJrOxc.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\rtsdJsc.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\fDikPoH.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\UJJvVml.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\GLaAXWJ.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\uheoamd.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\Cvzbxww.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\UYHSNZG.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\qnWaetJ.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\ZUBqMxk.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\EDGrzNg.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\gOqSiUE.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\bjTrzHt.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\qEdugYy.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\VHnwIvV.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\FPpriAy.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\BHbigGK.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\XMnqyLF.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\AiMWTRm.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\Vwbzwoz.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\PRcctUl.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\WCHIjvM.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\etavune.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\Wvsumse.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\mHoAYeb.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\FQMGAlG.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\FDrhohR.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\iKnMhbO.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\cXIESpg.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\QClDRPb.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\EYmGueb.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\LpReYQK.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\NxeUpse.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\oZmbiPg.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\cmhVOKa.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\cOHLBOt.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\goZTtLw.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\KMBgVrb.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\VJToBnu.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\WzkTqbh.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\DBUyFEH.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\DhaSoCx.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\ywGcQRv.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\ttKZXIF.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\WVJTaZJ.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\NbjEWWM.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\LkCTOjI.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\FNwPxOD.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\MjlRGEE.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\zCKUKaW.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\cwaHBOO.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\CmOhlWJ.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\PKQJDjv.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\bnDMrhp.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
File created	C:\Windows\System32\CbqAFpL.exe	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 3780	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	85
PID 384 wrote to memory of 3780	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	85
PID 384 wrote to memory of 2444	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	86
PID 384 wrote to memory of 2444	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	86
PID 384 wrote to memory of 4408	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	87
PID 384 wrote to memory of 4408	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	87
PID 384 wrote to memory of 1548	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	88
PID 384 wrote to memory of 1548	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	88
PID 384 wrote to memory of 4252	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	89
PID 384 wrote to memory of 4252	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	89
PID 384 wrote to memory of 3180	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	90
PID 384 wrote to memory of 3180	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	90
PID 384 wrote to memory of 4516	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	91
PID 384 wrote to memory of 4516	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	91
PID 384 wrote to memory of 3276	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	92
PID 384 wrote to memory of 3276	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	92
PID 384 wrote to memory of 4576	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	93
PID 384 wrote to memory of 4576	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	93
PID 384 wrote to memory of 4848	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	94
PID 384 wrote to memory of 4848	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	94
PID 384 wrote to memory of 4092	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	95
PID 384 wrote to memory of 4092	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	95
PID 384 wrote to memory of 5072	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	96
PID 384 wrote to memory of 5072	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	96
PID 384 wrote to memory of 3044	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	97
PID 384 wrote to memory of 3044	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	97
PID 384 wrote to memory of 4048	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	98
PID 384 wrote to memory of 4048	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	98
PID 384 wrote to memory of 5116	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	99
PID 384 wrote to memory of 5116	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	99
PID 384 wrote to memory of 1344	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	100
PID 384 wrote to memory of 1344	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	100
PID 384 wrote to memory of 4776	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	101
PID 384 wrote to memory of 4776	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	101
PID 384 wrote to memory of 2960	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	102
PID 384 wrote to memory of 2960	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	102
PID 384 wrote to memory of 4640	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	103
PID 384 wrote to memory of 4640	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	103
PID 384 wrote to memory of 3124	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	104
PID 384 wrote to memory of 3124	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	104
PID 384 wrote to memory of 4204	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	105
PID 384 wrote to memory of 4204	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	105
PID 384 wrote to memory of 1600	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	106
PID 384 wrote to memory of 1600	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	106
PID 384 wrote to memory of 4228	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	107
PID 384 wrote to memory of 4228	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	107
PID 384 wrote to memory of 2900	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	108
PID 384 wrote to memory of 2900	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	108
PID 384 wrote to memory of 2968	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	109
PID 384 wrote to memory of 2968	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	109
PID 384 wrote to memory of 3216	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	110
PID 384 wrote to memory of 3216	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	110
PID 384 wrote to memory of 1004	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	111
PID 384 wrote to memory of 1004	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	111
PID 384 wrote to memory of 3160	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	112
PID 384 wrote to memory of 3160	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	112
PID 384 wrote to memory of 3316	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	113
PID 384 wrote to memory of 3316	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	113
PID 384 wrote to memory of 2088	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	114
PID 384 wrote to memory of 2088	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	114
PID 384 wrote to memory of 2352	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	115
PID 384 wrote to memory of 2352	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	115
PID 384 wrote to memory of 3696	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	116
PID 384 wrote to memory of 3696	384	05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05129ac00e07584bff12ac7cc7832cf0_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\System32\VtrhFyH.exe
  C:\Windows\System32\VtrhFyH.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System32\uUZNRyD.exe
  C:\Windows\System32\uUZNRyD.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System32\pSNnZRC.exe
  C:\Windows\System32\pSNnZRC.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System32\VuXuYsT.exe
  C:\Windows\System32\VuXuYsT.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System32\GGBAHAB.exe
  C:\Windows\System32\GGBAHAB.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System32\xAVhFlm.exe
  C:\Windows\System32\xAVhFlm.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System32\Fttofds.exe
  C:\Windows\System32\Fttofds.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System32\eVBztbV.exe
  C:\Windows\System32\eVBztbV.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System32\dgqKPbz.exe
  C:\Windows\System32\dgqKPbz.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System32\ywGcQRv.exe
  C:\Windows\System32\ywGcQRv.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System32\jgOHapk.exe
  C:\Windows\System32\jgOHapk.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System32\VWDkRws.exe
  C:\Windows\System32\VWDkRws.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System32\ggLZmvW.exe
  C:\Windows\System32\ggLZmvW.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System32\eNwtLnk.exe
  C:\Windows\System32\eNwtLnk.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System32\WUFglnL.exe
  C:\Windows\System32\WUFglnL.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System32\HwFIVDP.exe
  C:\Windows\System32\HwFIVDP.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System32\hxxulAV.exe
  C:\Windows\System32\hxxulAV.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System32\kAULHlJ.exe
  C:\Windows\System32\kAULHlJ.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System32\guQlzTm.exe
  C:\Windows\System32\guQlzTm.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System32\NaRXMxo.exe
  C:\Windows\System32\NaRXMxo.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System32\hSZYrDc.exe
  C:\Windows\System32\hSZYrDc.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System32\ZJxqmjO.exe
  C:\Windows\System32\ZJxqmjO.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System32\oRWFcai.exe
  C:\Windows\System32\oRWFcai.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System32\GfgyNoY.exe
  C:\Windows\System32\GfgyNoY.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System32\QaSjQGo.exe
  C:\Windows\System32\QaSjQGo.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System32\NxVVcqM.exe
  C:\Windows\System32\NxVVcqM.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System32\etavune.exe
  C:\Windows\System32\etavune.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System32\LRpkODp.exe
  C:\Windows\System32\LRpkODp.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System32\uheoamd.exe
  C:\Windows\System32\uheoamd.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System32\irzHVOS.exe
  C:\Windows\System32\irzHVOS.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System32\yijVpwk.exe
  C:\Windows\System32\yijVpwk.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System32\YPBwzYA.exe
  C:\Windows\System32\YPBwzYA.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System32\ZUzRcDw.exe
  C:\Windows\System32\ZUzRcDw.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System32\pEUUKUY.exe
  C:\Windows\System32\pEUUKUY.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System32\HdrYaEi.exe
  C:\Windows\System32\HdrYaEi.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System32\RUkHxjA.exe
  C:\Windows\System32\RUkHxjA.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System32\nJeXpVf.exe
  C:\Windows\System32\nJeXpVf.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System32\RQCSJlz.exe
  C:\Windows\System32\RQCSJlz.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System32\IcVilqw.exe
  C:\Windows\System32\IcVilqw.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System32\zgsAHjI.exe
  C:\Windows\System32\zgsAHjI.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System32\CZlUarT.exe
  C:\Windows\System32\CZlUarT.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System32\NQRaZde.exe
  C:\Windows\System32\NQRaZde.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System32\GmTSxAF.exe
  C:\Windows\System32\GmTSxAF.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System32\MFmFsLX.exe
  C:\Windows\System32\MFmFsLX.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System32\PxDCfOy.exe
  C:\Windows\System32\PxDCfOy.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System32\cGxsALZ.exe
  C:\Windows\System32\cGxsALZ.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System32\QMqXFqs.exe
  C:\Windows\System32\QMqXFqs.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System32\nXEZmAw.exe
  C:\Windows\System32\nXEZmAw.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System32\dplIkTO.exe
  C:\Windows\System32\dplIkTO.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System32\WXDAQMi.exe
  C:\Windows\System32\WXDAQMi.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System32\FRvvOYg.exe
  C:\Windows\System32\FRvvOYg.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System32\bKiDJVd.exe
  C:\Windows\System32\bKiDJVd.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System32\ffXYPAM.exe
  C:\Windows\System32\ffXYPAM.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System32\FKosFeL.exe
  C:\Windows\System32\FKosFeL.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System32\mfYKsmB.exe
  C:\Windows\System32\mfYKsmB.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System32\uZmIIgj.exe
  C:\Windows\System32\uZmIIgj.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System32\daZSzYQ.exe
  C:\Windows\System32\daZSzYQ.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System32\bTUycYD.exe
  C:\Windows\System32\bTUycYD.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System32\dQzqfRQ.exe
  C:\Windows\System32\dQzqfRQ.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System32\uMEdIvR.exe
  C:\Windows\System32\uMEdIvR.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System32\wFSyIxZ.exe
  C:\Windows\System32\wFSyIxZ.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System32\jmWMwta.exe
  C:\Windows\System32\jmWMwta.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System32\gPsWpCt.exe
  C:\Windows\System32\gPsWpCt.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System32\wgtaTwO.exe
  C:\Windows\System32\wgtaTwO.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System32\QrPVqhR.exe
  C:\Windows\System32\QrPVqhR.exe
  2⤵
  PID:4144
- C:\Windows\System32\Wvsumse.exe
  C:\Windows\System32\Wvsumse.exe
  2⤵
  PID:3744
- C:\Windows\System32\IrJvylg.exe
  C:\Windows\System32\IrJvylg.exe
  2⤵
  PID:3924
- C:\Windows\System32\sKBhNtx.exe
  C:\Windows\System32\sKBhNtx.exe
  2⤵
  PID:1748
- C:\Windows\System32\zCKUKaW.exe
  C:\Windows\System32\zCKUKaW.exe
  2⤵
  PID:3980
- C:\Windows\System32\DtCjccw.exe
  C:\Windows\System32\DtCjccw.exe
  2⤵
  PID:1272
- C:\Windows\System32\cXIESpg.exe
  C:\Windows\System32\cXIESpg.exe
  2⤵
  PID:1992
- C:\Windows\System32\acsymeW.exe
  C:\Windows\System32\acsymeW.exe
  2⤵
  PID:2972
- C:\Windows\System32\eOxklfU.exe
  C:\Windows\System32\eOxklfU.exe
  2⤵
  PID:1756
- C:\Windows\System32\HYVMDCa.exe
  C:\Windows\System32\HYVMDCa.exe
  2⤵
  PID:3288
- C:\Windows\System32\ACXkLnD.exe
  C:\Windows\System32\ACXkLnD.exe
  2⤵
  PID:2648
- C:\Windows\System32\QGVVgiu.exe
  C:\Windows\System32\QGVVgiu.exe
  2⤵
  PID:4672
- C:\Windows\System32\mcrBMqL.exe
  C:\Windows\System32\mcrBMqL.exe
  2⤵
  PID:2580
- C:\Windows\System32\SNPJCmc.exe
  C:\Windows\System32\SNPJCmc.exe
  2⤵
  PID:1808
- C:\Windows\System32\edJkfuc.exe
  C:\Windows\System32\edJkfuc.exe
  2⤵
  PID:4396
- C:\Windows\System32\jpfFxiT.exe
  C:\Windows\System32\jpfFxiT.exe
  2⤵
  PID:3572
- C:\Windows\System32\LQWArOI.exe
  C:\Windows\System32\LQWArOI.exe
  2⤵
  PID:3340
- C:\Windows\System32\IetNkxL.exe
  C:\Windows\System32\IetNkxL.exe
  2⤵
  PID:1084
- C:\Windows\System32\IAsSGbg.exe
  C:\Windows\System32\IAsSGbg.exe
  2⤵
  PID:4620
- C:\Windows\System32\ttKZXIF.exe
  C:\Windows\System32\ttKZXIF.exe
  2⤵
  PID:4244
- C:\Windows\System32\cwaHBOO.exe
  C:\Windows\System32\cwaHBOO.exe
  2⤵
  PID:4080
- C:\Windows\System32\zSiZhVK.exe
  C:\Windows\System32\zSiZhVK.exe
  2⤵
  PID:2620
- C:\Windows\System32\cOHLBOt.exe
  C:\Windows\System32\cOHLBOt.exe
  2⤵
  PID:3604
- C:\Windows\System32\pJVcntL.exe
  C:\Windows\System32\pJVcntL.exe
  2⤵
  PID:5136
- C:\Windows\System32\JCXgors.exe
  C:\Windows\System32\JCXgors.exe
  2⤵
  PID:5160
- C:\Windows\System32\LauxCqy.exe
  C:\Windows\System32\LauxCqy.exe
  2⤵
  PID:5192
- C:\Windows\System32\UHuEIwc.exe
  C:\Windows\System32\UHuEIwc.exe
  2⤵
  PID:5224
- C:\Windows\System32\uDlvKaS.exe
  C:\Windows\System32\uDlvKaS.exe
  2⤵
  PID:5244
- C:\Windows\System32\YMkgYzE.exe
  C:\Windows\System32\YMkgYzE.exe
  2⤵
  PID:5276
- C:\Windows\System32\GggthtZ.exe
  C:\Windows\System32\GggthtZ.exe
  2⤵
  PID:5300
- C:\Windows\System32\dwQvHjv.exe
  C:\Windows\System32\dwQvHjv.exe
  2⤵
  PID:5332
- C:\Windows\System32\DrPpOoB.exe
  C:\Windows\System32\DrPpOoB.exe
  2⤵
  PID:5356
- C:\Windows\System32\dOrlwjf.exe
  C:\Windows\System32\dOrlwjf.exe
  2⤵
  PID:5388
- C:\Windows\System32\LBcjFsV.exe
  C:\Windows\System32\LBcjFsV.exe
  2⤵
  PID:5416
- C:\Windows\System32\QPwFZyO.exe
  C:\Windows\System32\QPwFZyO.exe
  2⤵
  PID:5440
- C:\Windows\System32\NwWDgtz.exe
  C:\Windows\System32\NwWDgtz.exe
  2⤵
  PID:5496
- C:\Windows\System32\goZTtLw.exe
  C:\Windows\System32\goZTtLw.exe
  2⤵
  PID:5604
- C:\Windows\System32\xFqBStZ.exe
  C:\Windows\System32\xFqBStZ.exe
  2⤵
  PID:5636
- C:\Windows\System32\DhORxZr.exe
  C:\Windows\System32\DhORxZr.exe
  2⤵
  PID:5668
- C:\Windows\System32\NnjkHom.exe
  C:\Windows\System32\NnjkHom.exe
  2⤵
  PID:5688
- C:\Windows\System32\uNuqFjW.exe
  C:\Windows\System32\uNuqFjW.exe
  2⤵
  PID:5708
- C:\Windows\System32\acSZGWN.exe
  C:\Windows\System32\acSZGWN.exe
  2⤵
  PID:5748
- C:\Windows\System32\bjTrzHt.exe
  C:\Windows\System32\bjTrzHt.exe
  2⤵
  PID:5800
- C:\Windows\System32\meSBPkx.exe
  C:\Windows\System32\meSBPkx.exe
  2⤵
  PID:5844
- C:\Windows\System32\DlQMZHN.exe
  C:\Windows\System32\DlQMZHN.exe
  2⤵
  PID:5860
- C:\Windows\System32\gYhvfpA.exe
  C:\Windows\System32\gYhvfpA.exe
  2⤵
  PID:5884
- C:\Windows\System32\pVicpSG.exe
  C:\Windows\System32\pVicpSG.exe
  2⤵
  PID:5928
- C:\Windows\System32\TrgqIzv.exe
  C:\Windows\System32\TrgqIzv.exe
  2⤵
  PID:5952
- C:\Windows\System32\gYKuUqG.exe
  C:\Windows\System32\gYKuUqG.exe
  2⤵
  PID:5988
- C:\Windows\System32\YfZDJyO.exe
  C:\Windows\System32\YfZDJyO.exe
  2⤵
  PID:6012
- C:\Windows\System32\oMMKAav.exe
  C:\Windows\System32\oMMKAav.exe
  2⤵
  PID:6036
- C:\Windows\System32\Ihrimsn.exe
  C:\Windows\System32\Ihrimsn.exe
  2⤵
  PID:6076
- C:\Windows\System32\GMuaPXR.exe
  C:\Windows\System32\GMuaPXR.exe
  2⤵
  PID:6104
- C:\Windows\System32\FoqgPZf.exe
  C:\Windows\System32\FoqgPZf.exe
  2⤵
  PID:6128
- C:\Windows\System32\VCbeRei.exe
  C:\Windows\System32\VCbeRei.exe
  2⤵
  PID:4900
- C:\Windows\System32\cYAYqjT.exe
  C:\Windows\System32\cYAYqjT.exe
  2⤵
  PID:3048
- C:\Windows\System32\qtYirwr.exe
  C:\Windows\System32\qtYirwr.exe
  2⤵
  PID:612
- C:\Windows\System32\FHoZusJ.exe
  C:\Windows\System32\FHoZusJ.exe
  2⤵
  PID:836
- C:\Windows\System32\nReDOWW.exe
  C:\Windows\System32\nReDOWW.exe
  2⤵
  PID:3432
- C:\Windows\System32\BLeKgYF.exe
  C:\Windows\System32\BLeKgYF.exe
  2⤵
  PID:5176
- C:\Windows\System32\oFgnGca.exe
  C:\Windows\System32\oFgnGca.exe
  2⤵
  PID:2416
- C:\Windows\System32\rKIVwIv.exe
  C:\Windows\System32\rKIVwIv.exe
  2⤵
  PID:5268
- C:\Windows\System32\pZRgJeR.exe
  C:\Windows\System32\pZRgJeR.exe
  2⤵
  PID:4724
- C:\Windows\System32\rjqGIIf.exe
  C:\Windows\System32\rjqGIIf.exe
  2⤵
  PID:5348
- C:\Windows\System32\wuSyhWk.exe
  C:\Windows\System32\wuSyhWk.exe
  2⤵
  PID:2408
- C:\Windows\System32\PFZLlKV.exe
  C:\Windows\System32\PFZLlKV.exe
  2⤵
  PID:3840
- C:\Windows\System32\riztMdq.exe
  C:\Windows\System32\riztMdq.exe
  2⤵
  PID:5432
- C:\Windows\System32\hmmduER.exe
  C:\Windows\System32\hmmduER.exe
  2⤵
  PID:4208
- C:\Windows\System32\IjrrGwy.exe
  C:\Windows\System32\IjrrGwy.exe
  2⤵
  PID:5456
- C:\Windows\System32\gdiXHsf.exe
  C:\Windows\System32\gdiXHsf.exe
  2⤵
  PID:5512
- C:\Windows\System32\CmOhlWJ.exe
  C:\Windows\System32\CmOhlWJ.exe
  2⤵
  PID:5568
- C:\Windows\System32\FIFkGBy.exe
  C:\Windows\System32\FIFkGBy.exe
  2⤵
  PID:1268
- C:\Windows\System32\lhQgdav.exe
  C:\Windows\System32\lhQgdav.exe
  2⤵
  PID:1152
- C:\Windows\System32\ZvNeVPh.exe
  C:\Windows\System32\ZvNeVPh.exe
  2⤵
  PID:5612
- C:\Windows\System32\NqijaeS.exe
  C:\Windows\System32\NqijaeS.exe
  2⤵
  PID:5696
- C:\Windows\System32\FynXEbr.exe
  C:\Windows\System32\FynXEbr.exe
  2⤵
  PID:5588
- C:\Windows\System32\kNJRZJU.exe
  C:\Windows\System32\kNJRZJU.exe
  2⤵
  PID:5724
- C:\Windows\System32\FAJCFzK.exe
  C:\Windows\System32\FAJCFzK.exe
  2⤵
  PID:5896
- C:\Windows\System32\VChlNzn.exe
  C:\Windows\System32\VChlNzn.exe
  2⤵
  PID:5920
- C:\Windows\System32\DkHaDGq.exe
  C:\Windows\System32\DkHaDGq.exe
  2⤵
  PID:5996
- C:\Windows\System32\DrHmqvp.exe
  C:\Windows\System32\DrHmqvp.exe
  2⤵
  PID:6092
- C:\Windows\System32\FMzdUNT.exe
  C:\Windows\System32\FMzdUNT.exe
  2⤵
  PID:6136
- C:\Windows\System32\qEdugYy.exe
  C:\Windows\System32\qEdugYy.exe
  2⤵
  PID:3576
- C:\Windows\System32\QUaUqNY.exe
  C:\Windows\System32\QUaUqNY.exe
  2⤵
  PID:2992
- C:\Windows\System32\FQIpZNz.exe
  C:\Windows\System32\FQIpZNz.exe
  2⤵
  PID:5324
- C:\Windows\System32\rbrCRZm.exe
  C:\Windows\System32\rbrCRZm.exe
  2⤵
  PID:220
- C:\Windows\System32\Cvzbxww.exe
  C:\Windows\System32\Cvzbxww.exe
  2⤵
  PID:1300
- C:\Windows\System32\JBnKQuJ.exe
  C:\Windows\System32\JBnKQuJ.exe
  2⤵
  PID:5464
- C:\Windows\System32\FCsuEKd.exe
  C:\Windows\System32\FCsuEKd.exe
  2⤵
  PID:5600
- C:\Windows\System32\uaVIGWo.exe
  C:\Windows\System32\uaVIGWo.exe
  2⤵
  PID:5760
- C:\Windows\System32\nTDBlay.exe
  C:\Windows\System32\nTDBlay.exe
  2⤵
  PID:5744
- C:\Windows\System32\wlNLjfN.exe
  C:\Windows\System32\wlNLjfN.exe
  2⤵
  PID:5856
- C:\Windows\System32\GWLjRMn.exe
  C:\Windows\System32\GWLjRMn.exe
  2⤵
  PID:6020
- C:\Windows\System32\eeAcKft.exe
  C:\Windows\System32\eeAcKft.exe
  2⤵
  PID:5172
- C:\Windows\System32\wGRBqbz.exe
  C:\Windows\System32\wGRBqbz.exe
  2⤵
  PID:2996
- C:\Windows\System32\SBblBQN.exe
  C:\Windows\System32\SBblBQN.exe
  2⤵
  PID:3200
- C:\Windows\System32\XpuPptr.exe
  C:\Windows\System32\XpuPptr.exe
  2⤵
  PID:5676
- C:\Windows\System32\ebqqkQO.exe
  C:\Windows\System32\ebqqkQO.exe
  2⤵
  PID:6004
- C:\Windows\System32\JvrBXxK.exe
  C:\Windows\System32\JvrBXxK.exe
  2⤵
  PID:5352
- C:\Windows\System32\bdPfUWr.exe
  C:\Windows\System32\bdPfUWr.exe
  2⤵
  PID:5768
- C:\Windows\System32\dwNdLlU.exe
  C:\Windows\System32\dwNdLlU.exe
  2⤵
  PID:6160
- C:\Windows\System32\DFCVInt.exe
  C:\Windows\System32\DFCVInt.exe
  2⤵
  PID:6204
- C:\Windows\System32\UCmMcJL.exe
  C:\Windows\System32\UCmMcJL.exe
  2⤵
  PID:6224
- C:\Windows\System32\flZYbho.exe
  C:\Windows\System32\flZYbho.exe
  2⤵
  PID:6252
- C:\Windows\System32\oSLwxUA.exe
  C:\Windows\System32\oSLwxUA.exe
  2⤵
  PID:6276
- C:\Windows\System32\QClDRPb.exe
  C:\Windows\System32\QClDRPb.exe
  2⤵
  PID:6292
- C:\Windows\System32\FilKEhz.exe
  C:\Windows\System32\FilKEhz.exe
  2⤵
  PID:6324
- C:\Windows\System32\CUuxjzA.exe
  C:\Windows\System32\CUuxjzA.exe
  2⤵
  PID:6344
- C:\Windows\System32\ogXFwYg.exe
  C:\Windows\System32\ogXFwYg.exe
  2⤵
  PID:6372
- C:\Windows\System32\eqxWfVd.exe
  C:\Windows\System32\eqxWfVd.exe
  2⤵
  PID:6404
- C:\Windows\System32\laxiqIW.exe
  C:\Windows\System32\laxiqIW.exe
  2⤵
  PID:6428
- C:\Windows\System32\nBPmUij.exe
  C:\Windows\System32\nBPmUij.exe
  2⤵
  PID:6452
- C:\Windows\System32\CkqNtsL.exe
  C:\Windows\System32\CkqNtsL.exe
  2⤵
  PID:6472
- C:\Windows\System32\zJgBcQY.exe
  C:\Windows\System32\zJgBcQY.exe
  2⤵
  PID:6492
- C:\Windows\System32\gdSolcL.exe
  C:\Windows\System32\gdSolcL.exe
  2⤵
  PID:6512
- C:\Windows\System32\IAOSwSf.exe
  C:\Windows\System32\IAOSwSf.exe
  2⤵
  PID:6548
- C:\Windows\System32\frfoYia.exe
  C:\Windows\System32\frfoYia.exe
  2⤵
  PID:6564
- C:\Windows\System32\zxquxeQ.exe
  C:\Windows\System32\zxquxeQ.exe
  2⤵
  PID:6604
- C:\Windows\System32\rpJcenI.exe
  C:\Windows\System32\rpJcenI.exe
  2⤵
  PID:6632
- C:\Windows\System32\GFODumH.exe
  C:\Windows\System32\GFODumH.exe
  2⤵
  PID:6648
- C:\Windows\System32\dvjGEaK.exe
  C:\Windows\System32\dvjGEaK.exe
  2⤵
  PID:6672
- C:\Windows\System32\AWJQHAW.exe
  C:\Windows\System32\AWJQHAW.exe
  2⤵
  PID:6688
- C:\Windows\System32\GdiDtsY.exe
  C:\Windows\System32\GdiDtsY.exe
  2⤵
  PID:6708
- C:\Windows\System32\WnwReoD.exe
  C:\Windows\System32\WnwReoD.exe
  2⤵
  PID:6736
- C:\Windows\System32\JnUwCrz.exe
  C:\Windows\System32\JnUwCrz.exe
  2⤵
  PID:6816
- C:\Windows\System32\qKWGpAO.exe
  C:\Windows\System32\qKWGpAO.exe
  2⤵
  PID:6848
- C:\Windows\System32\FPpriAy.exe
  C:\Windows\System32\FPpriAy.exe
  2⤵
  PID:6896
- C:\Windows\System32\LAIxIlf.exe
  C:\Windows\System32\LAIxIlf.exe
  2⤵
  PID:6924
- C:\Windows\System32\QImBUCB.exe
  C:\Windows\System32\QImBUCB.exe
  2⤵
  PID:6952
- C:\Windows\System32\wITDLsE.exe
  C:\Windows\System32\wITDLsE.exe
  2⤵
  PID:6976
- C:\Windows\System32\brHPOdH.exe
  C:\Windows\System32\brHPOdH.exe
  2⤵
  PID:6992
- C:\Windows\System32\BHbigGK.exe
  C:\Windows\System32\BHbigGK.exe
  2⤵
  PID:7036
- C:\Windows\System32\FffaaSa.exe
  C:\Windows\System32\FffaaSa.exe
  2⤵
  PID:7056
- C:\Windows\System32\sSGHozQ.exe
  C:\Windows\System32\sSGHozQ.exe
  2⤵
  PID:7076
- C:\Windows\System32\PpULeyg.exe
  C:\Windows\System32\PpULeyg.exe
  2⤵
  PID:7096
- C:\Windows\System32\KaPxFgC.exe
  C:\Windows\System32\KaPxFgC.exe
  2⤵
  PID:7124
- C:\Windows\System32\nkuRFjb.exe
  C:\Windows\System32\nkuRFjb.exe
  2⤵
  PID:5084
- C:\Windows\System32\HdzEeUL.exe
  C:\Windows\System32\HdzEeUL.exe
  2⤵
  PID:6212
- C:\Windows\System32\DojyQQt.exe
  C:\Windows\System32\DojyQQt.exe
  2⤵
  PID:6240
- C:\Windows\System32\piAuMNZ.exe
  C:\Windows\System32\piAuMNZ.exe
  2⤵
  PID:6288
- C:\Windows\System32\fxEfggU.exe
  C:\Windows\System32\fxEfggU.exe
  2⤵
  PID:6396
- C:\Windows\System32\qwXHhLB.exe
  C:\Windows\System32\qwXHhLB.exe
  2⤵
  PID:6460
- C:\Windows\System32\mHoAYeb.exe
  C:\Windows\System32\mHoAYeb.exe
  2⤵
  PID:6440
- C:\Windows\System32\QqEOxdt.exe
  C:\Windows\System32\QqEOxdt.exe
  2⤵
  PID:6532
- C:\Windows\System32\WOfqFuH.exe
  C:\Windows\System32\WOfqFuH.exe
  2⤵
  PID:6700
- C:\Windows\System32\LjPRKOA.exe
  C:\Windows\System32\LjPRKOA.exe
  2⤵
  PID:6640
- C:\Windows\System32\cvMKMsT.exe
  C:\Windows\System32\cvMKMsT.exe
  2⤵
  PID:6800
- C:\Windows\System32\FLhRzMl.exe
  C:\Windows\System32\FLhRzMl.exe
  2⤵
  PID:6892
- C:\Windows\System32\JmwiwAY.exe
  C:\Windows\System32\JmwiwAY.exe
  2⤵
  PID:6940
- C:\Windows\System32\PRcctUl.exe
  C:\Windows\System32\PRcctUl.exe
  2⤵
  PID:7000
- C:\Windows\System32\rkXfLti.exe
  C:\Windows\System32\rkXfLti.exe
  2⤵
  PID:7004
- C:\Windows\System32\SXOPADH.exe
  C:\Windows\System32\SXOPADH.exe
  2⤵
  PID:7088
- C:\Windows\System32\YzYttbA.exe
  C:\Windows\System32\YzYttbA.exe
  2⤵
  PID:6216
- C:\Windows\System32\pjFycqp.exe
  C:\Windows\System32\pjFycqp.exe
  2⤵
  PID:6312
- C:\Windows\System32\OeaQlTU.exe
  C:\Windows\System32\OeaQlTU.exe
  2⤵
  PID:6488
- C:\Windows\System32\EHcAtiO.exe
  C:\Windows\System32\EHcAtiO.exe
  2⤵
  PID:6628
- C:\Windows\System32\hxwFhuR.exe
  C:\Windows\System32\hxwFhuR.exe
  2⤵
  PID:6540
- C:\Windows\System32\HYIkXnP.exe
  C:\Windows\System32\HYIkXnP.exe
  2⤵
  PID:6656
- C:\Windows\System32\kotppKl.exe
  C:\Windows\System32\kotppKl.exe
  2⤵
  PID:6868
- C:\Windows\System32\WVJTaZJ.exe
  C:\Windows\System32\WVJTaZJ.exe
  2⤵
  PID:7048
- C:\Windows\System32\bbZWWlo.exe
  C:\Windows\System32\bbZWWlo.exe
  2⤵
  PID:7072
- C:\Windows\System32\KYVzplv.exe
  C:\Windows\System32\KYVzplv.exe
  2⤵
  PID:6968
- C:\Windows\System32\IVTMUfx.exe
  C:\Windows\System32\IVTMUfx.exe
  2⤵
  PID:6796
- C:\Windows\System32\ItzFIIp.exe
  C:\Windows\System32\ItzFIIp.exe
  2⤵
  PID:6156
- C:\Windows\System32\DbbnELU.exe
  C:\Windows\System32\DbbnELU.exe
  2⤵
  PID:7188
- C:\Windows\System32\UiFCGCD.exe
  C:\Windows\System32\UiFCGCD.exe
  2⤵
  PID:7212
- C:\Windows\System32\UjSNBst.exe
  C:\Windows\System32\UjSNBst.exe
  2⤵
  PID:7244
- C:\Windows\System32\qEIaxem.exe
  C:\Windows\System32\qEIaxem.exe
  2⤵
  PID:7268
- C:\Windows\System32\ZOTDlEr.exe
  C:\Windows\System32\ZOTDlEr.exe
  2⤵
  PID:7296
- C:\Windows\System32\OTKQUwd.exe
  C:\Windows\System32\OTKQUwd.exe
  2⤵
  PID:7328
- C:\Windows\System32\MXgYzwu.exe
  C:\Windows\System32\MXgYzwu.exe
  2⤵
  PID:7356
- C:\Windows\System32\ZWFbMRN.exe
  C:\Windows\System32\ZWFbMRN.exe
  2⤵
  PID:7380
- C:\Windows\System32\ttLZfWq.exe
  C:\Windows\System32\ttLZfWq.exe
  2⤵
  PID:7408
- C:\Windows\System32\WMFCbUD.exe
  C:\Windows\System32\WMFCbUD.exe
  2⤵
  PID:7448
- C:\Windows\System32\TXQdgRb.exe
  C:\Windows\System32\TXQdgRb.exe
  2⤵
  PID:7480
- C:\Windows\System32\UuXeyGp.exe
  C:\Windows\System32\UuXeyGp.exe
  2⤵
  PID:7496
- C:\Windows\System32\GjupSkG.exe
  C:\Windows\System32\GjupSkG.exe
  2⤵
  PID:7520
- C:\Windows\System32\bFxmuyD.exe
  C:\Windows\System32\bFxmuyD.exe
  2⤵
  PID:7540
- C:\Windows\System32\QhWRMDC.exe
  C:\Windows\System32\QhWRMDC.exe
  2⤵
  PID:7564
- C:\Windows\System32\rMajKOh.exe
  C:\Windows\System32\rMajKOh.exe
  2⤵
  PID:7588
- C:\Windows\System32\cgCsNdv.exe
  C:\Windows\System32\cgCsNdv.exe
  2⤵
  PID:7612
- C:\Windows\System32\PrnkjuE.exe
  C:\Windows\System32\PrnkjuE.exe
  2⤵
  PID:7640
- C:\Windows\System32\EPrLgOt.exe
  C:\Windows\System32\EPrLgOt.exe
  2⤵
  PID:7696
- C:\Windows\System32\NofpFmv.exe
  C:\Windows\System32\NofpFmv.exe
  2⤵
  PID:7720
- C:\Windows\System32\batENyQ.exe
  C:\Windows\System32\batENyQ.exe
  2⤵
  PID:7756
- C:\Windows\System32\kvUWDwb.exe
  C:\Windows\System32\kvUWDwb.exe
  2⤵
  PID:7784
- C:\Windows\System32\KCzSqpB.exe
  C:\Windows\System32\KCzSqpB.exe
  2⤵
  PID:7804
- C:\Windows\System32\CDxNneO.exe
  C:\Windows\System32\CDxNneO.exe
  2⤵
  PID:7844
- C:\Windows\System32\mLigNfO.exe
  C:\Windows\System32\mLigNfO.exe
  2⤵
  PID:7860
- C:\Windows\System32\PKQJDjv.exe
  C:\Windows\System32\PKQJDjv.exe
  2⤵
  PID:7884
- C:\Windows\System32\TdFUnzJ.exe
  C:\Windows\System32\TdFUnzJ.exe
  2⤵
  PID:7904
- C:\Windows\System32\ffVEKdH.exe
  C:\Windows\System32\ffVEKdH.exe
  2⤵
  PID:7924
- C:\Windows\System32\mDJgkDs.exe
  C:\Windows\System32\mDJgkDs.exe
  2⤵
  PID:7964
- C:\Windows\System32\KyXajSm.exe
  C:\Windows\System32\KyXajSm.exe
  2⤵
  PID:8012
- C:\Windows\System32\PaAAieQ.exe
  C:\Windows\System32\PaAAieQ.exe
  2⤵
  PID:8028
- C:\Windows\System32\bnDMrhp.exe
  C:\Windows\System32\bnDMrhp.exe
  2⤵
  PID:8056
- C:\Windows\System32\whcXUIS.exe
  C:\Windows\System32\whcXUIS.exe
  2⤵
  PID:8096
- C:\Windows\System32\SGZZQIn.exe
  C:\Windows\System32\SGZZQIn.exe
  2⤵
  PID:8124
- C:\Windows\System32\eMymaEt.exe
  C:\Windows\System32\eMymaEt.exe
  2⤵
  PID:8152
- C:\Windows\System32\DHnlObF.exe
  C:\Windows\System32\DHnlObF.exe
  2⤵
  PID:8176
- C:\Windows\System32\oSQnVZx.exe
  C:\Windows\System32\oSQnVZx.exe
  2⤵
  PID:6720
- C:\Windows\System32\ZYPwaxp.exe
  C:\Windows\System32\ZYPwaxp.exe
  2⤵
  PID:7252
- C:\Windows\System32\KMBgVrb.exe
  C:\Windows\System32\KMBgVrb.exe
  2⤵
  PID:7308
- C:\Windows\System32\rqRGNeF.exe
  C:\Windows\System32\rqRGNeF.exe
  2⤵
  PID:7376
- C:\Windows\System32\yXNJdYI.exe
  C:\Windows\System32\yXNJdYI.exe
  2⤵
  PID:7440
- C:\Windows\System32\mocCyYq.exe
  C:\Windows\System32\mocCyYq.exe
  2⤵
  PID:7472
- C:\Windows\System32\KsDQMIm.exe
  C:\Windows\System32\KsDQMIm.exe
  2⤵
  PID:7512
- C:\Windows\System32\hNjGpJU.exe
  C:\Windows\System32\hNjGpJU.exe
  2⤵
  PID:7576
- C:\Windows\System32\UifvpHH.exe
  C:\Windows\System32\UifvpHH.exe
  2⤵
  PID:7628
- C:\Windows\System32\BIxEjCI.exe
  C:\Windows\System32\BIxEjCI.exe
  2⤵
  PID:7732
- C:\Windows\System32\mwlZmkA.exe
  C:\Windows\System32\mwlZmkA.exe
  2⤵
  PID:7840
- C:\Windows\System32\pWVqHBb.exe
  C:\Windows\System32\pWVqHBb.exe
  2⤵
  PID:7940
- C:\Windows\System32\zOFumIM.exe
  C:\Windows\System32\zOFumIM.exe
  2⤵
  PID:7988
- C:\Windows\System32\RHsKWot.exe
  C:\Windows\System32\RHsKWot.exe
  2⤵
  PID:8040
- C:\Windows\System32\jYrkFbJ.exe
  C:\Windows\System32\jYrkFbJ.exe
  2⤵
  PID:8068
- C:\Windows\System32\nvMmOBY.exe
  C:\Windows\System32\nvMmOBY.exe
  2⤵
  PID:8164
- C:\Windows\System32\hoYavvY.exe
  C:\Windows\System32\hoYavvY.exe
  2⤵
  PID:5960
- C:\Windows\System32\pjbshPa.exe
  C:\Windows\System32\pjbshPa.exe
  2⤵
  PID:7400
- C:\Windows\System32\muWrfpp.exe
  C:\Windows\System32\muWrfpp.exe
  2⤵
  PID:7492
- C:\Windows\System32\fFHTvvM.exe
  C:\Windows\System32\fFHTvvM.exe
  2⤵
  PID:7604
- C:\Windows\System32\hCujfbT.exe
  C:\Windows\System32\hCujfbT.exe
  2⤵
  PID:7872
- C:\Windows\System32\cOTZNJS.exe
  C:\Windows\System32\cOTZNJS.exe
  2⤵
  PID:7852
- C:\Windows\System32\UKpSBvl.exe
  C:\Windows\System32\UKpSBvl.exe
  2⤵
  PID:8000
- C:\Windows\System32\OjolNSs.exe
  C:\Windows\System32\OjolNSs.exe
  2⤵
  PID:8188
- C:\Windows\System32\LKIuQjA.exe
  C:\Windows\System32\LKIuQjA.exe
  2⤵
  PID:8300
- C:\Windows\System32\CbqAFpL.exe
  C:\Windows\System32\CbqAFpL.exe
  2⤵
  PID:8316
- C:\Windows\System32\WFRGrSI.exe
  C:\Windows\System32\WFRGrSI.exe
  2⤵
  PID:8360
- C:\Windows\System32\MBzkpRp.exe
  C:\Windows\System32\MBzkpRp.exe
  2⤵
  PID:8376
- C:\Windows\System32\OwbMLtA.exe
  C:\Windows\System32\OwbMLtA.exe
  2⤵
  PID:8400
- C:\Windows\System32\zHUweIS.exe
  C:\Windows\System32\zHUweIS.exe
  2⤵
  PID:8448
- C:\Windows\System32\mkJrOxc.exe
  C:\Windows\System32\mkJrOxc.exe
  2⤵
  PID:8472
- C:\Windows\System32\VCoQqUL.exe
  C:\Windows\System32\VCoQqUL.exe
  2⤵
  PID:8500
- C:\Windows\System32\NbjEWWM.exe
  C:\Windows\System32\NbjEWWM.exe
  2⤵
  PID:8520
- C:\Windows\System32\JpgcIFX.exe
  C:\Windows\System32\JpgcIFX.exe
  2⤵
  PID:8536
- C:\Windows\System32\nmxihrA.exe
  C:\Windows\System32\nmxihrA.exe
  2⤵
  PID:8564
- C:\Windows\System32\rtsdJsc.exe
  C:\Windows\System32\rtsdJsc.exe
  2⤵
  PID:8624
- C:\Windows\System32\nElQQXn.exe
  C:\Windows\System32\nElQQXn.exe
  2⤵
  PID:8656
- C:\Windows\System32\hKJAYMf.exe
  C:\Windows\System32\hKJAYMf.exe
  2⤵
  PID:8684
- C:\Windows\System32\tsvtOPu.exe
  C:\Windows\System32\tsvtOPu.exe
  2⤵
  PID:8712
- C:\Windows\System32\OloFAeE.exe
  C:\Windows\System32\OloFAeE.exe
  2⤵
  PID:8736
- C:\Windows\System32\pnyLxGn.exe
  C:\Windows\System32\pnyLxGn.exe
  2⤵
  PID:8764
- C:\Windows\System32\YvPOyVN.exe
  C:\Windows\System32\YvPOyVN.exe
  2⤵
  PID:8796
- C:\Windows\System32\Vjbhydl.exe
  C:\Windows\System32\Vjbhydl.exe
  2⤵
  PID:8824
- C:\Windows\System32\MjlRGEE.exe
  C:\Windows\System32\MjlRGEE.exe
  2⤵
  PID:8848
- C:\Windows\System32\CUyoscI.exe
  C:\Windows\System32\CUyoscI.exe
  2⤵
  PID:8868
- C:\Windows\System32\blbXvvU.exe
  C:\Windows\System32\blbXvvU.exe
  2⤵
  PID:8900
- C:\Windows\System32\PykvaMv.exe
  C:\Windows\System32\PykvaMv.exe
  2⤵
  PID:8928
- C:\Windows\System32\MlVmalK.exe
  C:\Windows\System32\MlVmalK.exe
  2⤵
  PID:8944
- C:\Windows\System32\UNDTrBT.exe
  C:\Windows\System32\UNDTrBT.exe
  2⤵
  PID:8980
- C:\Windows\System32\EdFvyVQ.exe
  C:\Windows\System32\EdFvyVQ.exe
  2⤵
  PID:9016
- C:\Windows\System32\qCXUxTy.exe
  C:\Windows\System32\qCXUxTy.exe
  2⤵
  PID:9044
- C:\Windows\System32\EYmGueb.exe
  C:\Windows\System32\EYmGueb.exe
  2⤵
  PID:9076
- C:\Windows\System32\gaVTnvy.exe
  C:\Windows\System32\gaVTnvy.exe
  2⤵
  PID:9108
- C:\Windows\System32\LutZRgF.exe
  C:\Windows\System32\LutZRgF.exe
  2⤵
  PID:9132
- C:\Windows\System32\bjNVZJp.exe
  C:\Windows\System32\bjNVZJp.exe
  2⤵
  PID:9160
- C:\Windows\System32\wkDhjmu.exe
  C:\Windows\System32\wkDhjmu.exe
  2⤵
  PID:9184
- C:\Windows\System32\yFHlISU.exe
  C:\Windows\System32\yFHlISU.exe
  2⤵
  PID:9212
- C:\Windows\System32\ValAuJg.exe
  C:\Windows\System32\ValAuJg.exe
  2⤵
  PID:7464
- C:\Windows\System32\VHnwIvV.exe
  C:\Windows\System32\VHnwIvV.exe
  2⤵
  PID:8204
- C:\Windows\System32\IongKPV.exe
  C:\Windows\System32\IongKPV.exe
  2⤵
  PID:8284
- C:\Windows\System32\iZucpfx.exe
  C:\Windows\System32\iZucpfx.exe
  2⤵
  PID:7488
- C:\Windows\System32\LTQfiXX.exe
  C:\Windows\System32\LTQfiXX.exe
  2⤵
  PID:7792
- C:\Windows\System32\YDInUsj.exe
  C:\Windows\System32\YDInUsj.exe
  2⤵
  PID:8228
- C:\Windows\System32\MywgSTc.exe
  C:\Windows\System32\MywgSTc.exe
  2⤵
  PID:8256
- C:\Windows\System32\rhKiWWw.exe
  C:\Windows\System32\rhKiWWw.exe
  2⤵
  PID:8348
- C:\Windows\System32\VlYcEbj.exe
  C:\Windows\System32\VlYcEbj.exe
  2⤵
  PID:8436
- C:\Windows\System32\GSZxUGJ.exe
  C:\Windows\System32\GSZxUGJ.exe
  2⤵
  PID:8532
- C:\Windows\System32\QyeUfwz.exe
  C:\Windows\System32\QyeUfwz.exe
  2⤵
  PID:8620
- C:\Windows\System32\SvIGGIw.exe
  C:\Windows\System32\SvIGGIw.exe
  2⤵
  PID:8672
- C:\Windows\System32\kUCKfEh.exe
  C:\Windows\System32\kUCKfEh.exe
  2⤵
  PID:7800
- C:\Windows\System32\QOpkIHt.exe
  C:\Windows\System32\QOpkIHt.exe
  2⤵
  PID:8780
- C:\Windows\System32\jLvATxS.exe
  C:\Windows\System32\jLvATxS.exe
  2⤵
  PID:8856
- C:\Windows\System32\wWHdNad.exe
  C:\Windows\System32\wWHdNad.exe
  2⤵
  PID:8952
- C:\Windows\System32\LbAWTrU.exe
  C:\Windows\System32\LbAWTrU.exe
  2⤵
  PID:9028
- C:\Windows\System32\WaPCQhJ.exe
  C:\Windows\System32\WaPCQhJ.exe
  2⤵
  PID:9088
- C:\Windows\System32\UCENdQj.exe
  C:\Windows\System32\UCENdQj.exe
  2⤵
  PID:9148
- C:\Windows\System32\ZtomSjt.exe
  C:\Windows\System32\ZtomSjt.exe
  2⤵
  PID:9196
- C:\Windows\System32\BJEeova.exe
  C:\Windows\System32\BJEeova.exe
  2⤵
  PID:8252
- C:\Windows\System32\OiOTroa.exe
  C:\Windows\System32\OiOTroa.exe
  2⤵
  PID:8208
- C:\Windows\System32\VVyhaqd.exe
  C:\Windows\System32\VVyhaqd.exe
  2⤵
  PID:8308
- C:\Windows\System32\plsjlYq.exe
  C:\Windows\System32\plsjlYq.exe
  2⤵
  PID:8548
- C:\Windows\System32\VJToBnu.exe
  C:\Windows\System32\VJToBnu.exe
  2⤵
  PID:8728
- C:\Windows\System32\XxRFcXl.exe
  C:\Windows\System32\XxRFcXl.exe
  2⤵
  PID:8808
- C:\Windows\System32\lXGaNqc.exe
  C:\Windows\System32\lXGaNqc.exe
  2⤵
  PID:8976
- C:\Windows\System32\ZaSbcps.exe
  C:\Windows\System32\ZaSbcps.exe
  2⤵
  PID:9064
- C:\Windows\System32\fUSLbNL.exe
  C:\Windows\System32\fUSLbNL.exe
  2⤵
  PID:7768
- C:\Windows\System32\SsxYZGe.exe
  C:\Windows\System32\SsxYZGe.exe
  2⤵
  PID:8372
- C:\Windows\System32\PTNPUaT.exe
  C:\Windows\System32\PTNPUaT.exe
  2⤵
  PID:8908
- C:\Windows\System32\ZpyEbkN.exe
  C:\Windows\System32\ZpyEbkN.exe
  2⤵
  PID:8484
- C:\Windows\System32\zsNIzOf.exe
  C:\Windows\System32\zsNIzOf.exe
  2⤵
  PID:8696
- C:\Windows\System32\qodwJUu.exe
  C:\Windows\System32\qodwJUu.exe
  2⤵
  PID:9220
- C:\Windows\System32\qSPMXwy.exe
  C:\Windows\System32\qSPMXwy.exe
  2⤵
  PID:9272
- C:\Windows\System32\tjxVRsL.exe
  C:\Windows\System32\tjxVRsL.exe
  2⤵
  PID:9296
- C:\Windows\System32\OgPLVVT.exe
  C:\Windows\System32\OgPLVVT.exe
  2⤵
  PID:9320
- C:\Windows\System32\LpReYQK.exe
  C:\Windows\System32\LpReYQK.exe
  2⤵
  PID:9344
- C:\Windows\System32\FeLxlBY.exe
  C:\Windows\System32\FeLxlBY.exe
  2⤵
  PID:9368
- C:\Windows\System32\YQPybau.exe
  C:\Windows\System32\YQPybau.exe
  2⤵
  PID:9384
- C:\Windows\System32\hZwQgat.exe
  C:\Windows\System32\hZwQgat.exe
  2⤵
  PID:9408
- C:\Windows\System32\vvwrSqu.exe
  C:\Windows\System32\vvwrSqu.exe
  2⤵
  PID:9424
- C:\Windows\System32\zXbVDio.exe
  C:\Windows\System32\zXbVDio.exe
  2⤵
  PID:9444
- C:\Windows\System32\hRQqXtt.exe
  C:\Windows\System32\hRQqXtt.exe
  2⤵
  PID:9524
- C:\Windows\System32\XMnqyLF.exe
  C:\Windows\System32\XMnqyLF.exe
  2⤵
  PID:9564
- C:\Windows\System32\IlCywoP.exe
  C:\Windows\System32\IlCywoP.exe
  2⤵
  PID:9580
- C:\Windows\System32\oZIHopm.exe
  C:\Windows\System32\oZIHopm.exe
  2⤵
  PID:9596
- C:\Windows\System32\jqptzCF.exe
  C:\Windows\System32\jqptzCF.exe
  2⤵
  PID:9644
- C:\Windows\System32\RYPWVvi.exe
  C:\Windows\System32\RYPWVvi.exe
  2⤵
  PID:9664
- C:\Windows\System32\fDikPoH.exe
  C:\Windows\System32\fDikPoH.exe
  2⤵
  PID:9684
- C:\Windows\System32\QrssRld.exe
  C:\Windows\System32\QrssRld.exe
  2⤵
  PID:9708
- C:\Windows\System32\cRgrVks.exe
  C:\Windows\System32\cRgrVks.exe
  2⤵
  PID:9724
- C:\Windows\System32\QPvALfj.exe
  C:\Windows\System32\QPvALfj.exe
  2⤵
  PID:9756
- C:\Windows\System32\UCtUhTW.exe
  C:\Windows\System32\UCtUhTW.exe
  2⤵
  PID:9796
- C:\Windows\System32\gAIvORt.exe
  C:\Windows\System32\gAIvORt.exe
  2⤵
  PID:9840
- C:\Windows\System32\HsgryFk.exe
  C:\Windows\System32\HsgryFk.exe
  2⤵
  PID:9868
- C:\Windows\System32\hSgLHZA.exe
  C:\Windows\System32\hSgLHZA.exe
  2⤵
  PID:9888
- C:\Windows\System32\DcoKnlv.exe
  C:\Windows\System32\DcoKnlv.exe
  2⤵
  PID:9908
- C:\Windows\System32\FAKEZlq.exe
  C:\Windows\System32\FAKEZlq.exe
  2⤵
  PID:9924
- C:\Windows\System32\LGWZXKB.exe
  C:\Windows\System32\LGWZXKB.exe
  2⤵
  PID:9952
- C:\Windows\System32\FSuuAcZ.exe
  C:\Windows\System32\FSuuAcZ.exe
  2⤵
  PID:9968
- C:\Windows\System32\PWwQcCL.exe
  C:\Windows\System32\PWwQcCL.exe
  2⤵
  PID:10008
- C:\Windows\System32\JHqCTvh.exe
  C:\Windows\System32\JHqCTvh.exe
  2⤵
  PID:10060
- C:\Windows\System32\yMKTBMG.exe
  C:\Windows\System32\yMKTBMG.exe
  2⤵
  PID:10104
- C:\Windows\System32\EMheIwu.exe
  C:\Windows\System32\EMheIwu.exe
  2⤵
  PID:10128
- C:\Windows\System32\mrojyXN.exe
  C:\Windows\System32\mrojyXN.exe
  2⤵
  PID:10144
- C:\Windows\System32\EMTQKPL.exe
  C:\Windows\System32\EMTQKPL.exe
  2⤵
  PID:10168
- C:\Windows\System32\aTbbkVU.exe
  C:\Windows\System32\aTbbkVU.exe
  2⤵
  PID:10184
- C:\Windows\System32\fYqHEth.exe
  C:\Windows\System32\fYqHEth.exe
  2⤵
  PID:10208
- C:\Windows\System32\EaxEauT.exe
  C:\Windows\System32\EaxEauT.exe
  2⤵
  PID:10228
- C:\Windows\System32\iSPKlGP.exe
  C:\Windows\System32\iSPKlGP.exe
  2⤵
  PID:9192
- C:\Windows\System32\FQMGAlG.exe
  C:\Windows\System32\FQMGAlG.exe
  2⤵
  PID:8652
- C:\Windows\System32\FtfLMYE.exe
  C:\Windows\System32\FtfLMYE.exe
  2⤵
  PID:9292
- C:\Windows\System32\OKOquZu.exe
  C:\Windows\System32\OKOquZu.exe
  2⤵
  PID:9476
- C:\Windows\System32\QPaeJlG.exe
  C:\Windows\System32\QPaeJlG.exe
  2⤵
  PID:9560
- C:\Windows\System32\bBMdEbL.exe
  C:\Windows\System32\bBMdEbL.exe
  2⤵
  PID:9624
- C:\Windows\System32\pRmMNmx.exe
  C:\Windows\System32\pRmMNmx.exe
  2⤵
  PID:9696
- C:\Windows\System32\tHImZpT.exe
  C:\Windows\System32\tHImZpT.exe
  2⤵
  PID:9784
- C:\Windows\System32\dbxpdcc.exe
  C:\Windows\System32\dbxpdcc.exe
  2⤵
  PID:9848
- C:\Windows\System32\LxuQLnE.exe
  C:\Windows\System32\LxuQLnE.exe
  2⤵
  PID:9920
- C:\Windows\System32\vhRrhXw.exe
  C:\Windows\System32\vhRrhXw.exe
  2⤵
  PID:9964
- C:\Windows\System32\pLbvjOd.exe
  C:\Windows\System32\pLbvjOd.exe
  2⤵
  PID:10028
- C:\Windows\System32\JiCRDdJ.exe
  C:\Windows\System32\JiCRDdJ.exe
  2⤵
  PID:10072
- C:\Windows\System32\XdZIxXQ.exe
  C:\Windows\System32\XdZIxXQ.exe
  2⤵
  PID:10124
- C:\Windows\System32\MnXHuUG.exe
  C:\Windows\System32\MnXHuUG.exe
  2⤵
  PID:10200
- C:\Windows\System32\vrpfDyE.exe
  C:\Windows\System32\vrpfDyE.exe
  2⤵
  PID:9244
- C:\Windows\System32\rGjPGEN.exe
  C:\Windows\System32\rGjPGEN.exe
  2⤵
  PID:9328
- C:\Windows\System32\LmbJsIO.exe
  C:\Windows\System32\LmbJsIO.exe
  2⤵
  PID:9504
- C:\Windows\System32\LdkszXO.exe
  C:\Windows\System32\LdkszXO.exe
  2⤵
  PID:9716
- C:\Windows\System32\AiMWTRm.exe
  C:\Windows\System32\AiMWTRm.exe
  2⤵
  PID:9996
- C:\Windows\System32\VaobtPp.exe
  C:\Windows\System32\VaobtPp.exe
  2⤵
  PID:10088
- C:\Windows\System32\eDQHQXx.exe
  C:\Windows\System32\eDQHQXx.exe
  2⤵
  PID:9172
- C:\Windows\System32\lXpbOQS.exe
  C:\Windows\System32\lXpbOQS.exe
  2⤵
  PID:9452
- C:\Windows\System32\WzkTqbh.exe
  C:\Windows\System32\WzkTqbh.exe
  2⤵
  PID:9904
- C:\Windows\System32\VBnjRDO.exe
  C:\Windows\System32\VBnjRDO.exe
  2⤵
  PID:9420
- C:\Windows\System32\RbUmOfj.exe
  C:\Windows\System32\RbUmOfj.exe
  2⤵
  PID:10252
- C:\Windows\System32\ALByAri.exe
  C:\Windows\System32\ALByAri.exe
  2⤵
  PID:10268
- C:\Windows\System32\igiZqnp.exe
  C:\Windows\System32\igiZqnp.exe
  2⤵
  PID:10292
- C:\Windows\System32\HiPtNkl.exe
  C:\Windows\System32\HiPtNkl.exe
  2⤵
  PID:10324
- C:\Windows\System32\ZIgUyGB.exe
  C:\Windows\System32\ZIgUyGB.exe
  2⤵
  PID:10344
- C:\Windows\System32\GVujGfe.exe
  C:\Windows\System32\GVujGfe.exe
  2⤵
  PID:10368
- C:\Windows\System32\rCzOiCw.exe
  C:\Windows\System32\rCzOiCw.exe
  2⤵
  PID:10396
- C:\Windows\System32\RsOMbrA.exe
  C:\Windows\System32\RsOMbrA.exe
  2⤵
  PID:10436
- C:\Windows\System32\NxeUpse.exe
  C:\Windows\System32\NxeUpse.exe
  2⤵
  PID:10460
- C:\Windows\System32\pciySke.exe
  C:\Windows\System32\pciySke.exe
  2⤵
  PID:10492
- C:\Windows\System32\LzUetJb.exe
  C:\Windows\System32\LzUetJb.exe
  2⤵
  PID:10520
- C:\Windows\System32\TJduBOu.exe
  C:\Windows\System32\TJduBOu.exe
  2⤵
  PID:10548
- C:\Windows\System32\AUBgZjO.exe
  C:\Windows\System32\AUBgZjO.exe
  2⤵
  PID:10564
- C:\Windows\System32\XWqCYgs.exe
  C:\Windows\System32\XWqCYgs.exe
  2⤵
  PID:10600
- C:\Windows\System32\LPskTHB.exe
  C:\Windows\System32\LPskTHB.exe
  2⤵
  PID:10632
- C:\Windows\System32\jEQoGVo.exe
  C:\Windows\System32\jEQoGVo.exe
  2⤵
  PID:10656
- C:\Windows\System32\HuUJbol.exe
  C:\Windows\System32\HuUJbol.exe
  2⤵
  PID:10684
- C:\Windows\System32\SDBlTeU.exe
  C:\Windows\System32\SDBlTeU.exe
  2⤵
  PID:10704
- C:\Windows\System32\VQnTubR.exe
  C:\Windows\System32\VQnTubR.exe
  2⤵
  PID:10724
- C:\Windows\System32\vmKYePn.exe
  C:\Windows\System32\vmKYePn.exe
  2⤵
  PID:10772
- C:\Windows\System32\XNTdanT.exe
  C:\Windows\System32\XNTdanT.exe
  2⤵
  PID:10792
- C:\Windows\System32\tpShjFP.exe
  C:\Windows\System32\tpShjFP.exe
  2⤵
  PID:10808
- C:\Windows\System32\dhWfFlg.exe
  C:\Windows\System32\dhWfFlg.exe
  2⤵
  PID:10856
- C:\Windows\System32\pmGvdAn.exe
  C:\Windows\System32\pmGvdAn.exe
  2⤵
  PID:10880
- C:\Windows\System32\VfRIlgG.exe
  C:\Windows\System32\VfRIlgG.exe
  2⤵
  PID:10896
- C:\Windows\System32\imYbuOg.exe
  C:\Windows\System32\imYbuOg.exe
  2⤵
  PID:10928
- C:\Windows\System32\ZcSywrL.exe
  C:\Windows\System32\ZcSywrL.exe
  2⤵
  PID:10948
- C:\Windows\System32\FlLHtRa.exe
  C:\Windows\System32\FlLHtRa.exe
  2⤵
  PID:10996
- C:\Windows\System32\GFYKqGE.exe
  C:\Windows\System32\GFYKqGE.exe
  2⤵
  PID:11024
- C:\Windows\System32\euHMLFv.exe
  C:\Windows\System32\euHMLFv.exe
  2⤵
  PID:11060
- C:\Windows\System32\Vwbzwoz.exe
  C:\Windows\System32\Vwbzwoz.exe
  2⤵
  PID:11080
- C:\Windows\System32\DBUyFEH.exe
  C:\Windows\System32\DBUyFEH.exe
  2⤵
  PID:11108
- C:\Windows\System32\LHbazMB.exe
  C:\Windows\System32\LHbazMB.exe
  2⤵
  PID:11136
- C:\Windows\System32\EoKGwiP.exe
  C:\Windows\System32\EoKGwiP.exe
  2⤵
  PID:11156
- C:\Windows\System32\VwCFaIZ.exe
  C:\Windows\System32\VwCFaIZ.exe
  2⤵
  PID:11180
- C:\Windows\System32\CJmSPxz.exe
  C:\Windows\System32\CJmSPxz.exe
  2⤵
  PID:11220
- C:\Windows\System32\qbUGucD.exe
  C:\Windows\System32\qbUGucD.exe
  2⤵
  PID:11252
- C:\Windows\System32\dZpkPws.exe
  C:\Windows\System32\dZpkPws.exe
  2⤵
  PID:10280
- C:\Windows\System32\UJJvVml.exe
  C:\Windows\System32\UJJvVml.exe
  2⤵
  PID:10360
- C:\Windows\System32\pNMvqGR.exe
  C:\Windows\System32\pNMvqGR.exe
  2⤵
  PID:10428
- C:\Windows\System32\NvRgzTs.exe
  C:\Windows\System32\NvRgzTs.exe
  2⤵
  PID:10472
- C:\Windows\System32\FDrhohR.exe
  C:\Windows\System32\FDrhohR.exe
  2⤵
  PID:10536
- C:\Windows\System32\iJddLsM.exe
  C:\Windows\System32\iJddLsM.exe
  2⤵
  PID:10580
- C:\Windows\System32\THeiUEu.exe
  C:\Windows\System32\THeiUEu.exe
  2⤵
  PID:10608
- C:\Windows\System32\hZmYunJ.exe
  C:\Windows\System32\hZmYunJ.exe
  2⤵
  PID:10668
- C:\Windows\System32\dRbCPij.exe
  C:\Windows\System32\dRbCPij.exe
  2⤵
  PID:10748
- C:\Windows\System32\pRGVrJe.exe
  C:\Windows\System32\pRGVrJe.exe
  2⤵
  PID:10912
- C:\Windows\System32\dBVKAkl.exe
  C:\Windows\System32\dBVKAkl.exe
  2⤵
  PID:10980
- C:\Windows\System32\sthUoWx.exe
  C:\Windows\System32\sthUoWx.exe
  2⤵
  PID:11008
- C:\Windows\System32\PxjbCEH.exe
  C:\Windows\System32\PxjbCEH.exe
  2⤵
  PID:11076
- C:\Windows\System32\WmVPuzh.exe
  C:\Windows\System32\WmVPuzh.exe
  2⤵
  PID:11164
- C:\Windows\System32\FNMGyZk.exe
  C:\Windows\System32\FNMGyZk.exe
  2⤵
  PID:10016
- C:\Windows\System32\TAfynOE.exe
  C:\Windows\System32\TAfynOE.exe
  2⤵
  PID:11248
- C:\Windows\System32\WByuVDq.exe
  C:\Windows\System32\WByuVDq.exe
  2⤵
  PID:10416
- C:\Windows\System32\zIUcTvY.exe
  C:\Windows\System32\zIUcTvY.exe
  2⤵
  PID:10560
- C:\Windows\System32\SkZNbOK.exe
  C:\Windows\System32\SkZNbOK.exe
  2⤵
  PID:10692
- C:\Windows\System32\cjyZQpP.exe
  C:\Windows\System32\cjyZQpP.exe
  2⤵
  PID:10892
- C:\Windows\System32\MzLrUgC.exe
  C:\Windows\System32\MzLrUgC.exe
  2⤵
  PID:11056
- C:\Windows\System32\ONCGyfK.exe
  C:\Windows\System32\ONCGyfK.exe
  2⤵
  PID:11188
- C:\Windows\System32\koiJNTQ.exe
  C:\Windows\System32\koiJNTQ.exe
  2⤵
  PID:10248
- C:\Windows\System32\EbfKGxO.exe
  C:\Windows\System32\EbfKGxO.exe
  2⤵
  PID:10720
- C:\Windows\System32\llTgGgW.exe
  C:\Windows\System32\llTgGgW.exe
  2⤵
  PID:11236
- C:\Windows\System32\CZmYkbR.exe
  C:\Windows\System32\CZmYkbR.exe
  2⤵
  PID:10760
- C:\Windows\System32\vmXOgYl.exe
  C:\Windows\System32\vmXOgYl.exe
  2⤵
  PID:11272
- C:\Windows\System32\kuyiWPz.exe
  C:\Windows\System32\kuyiWPz.exe
  2⤵
  PID:11316
- C:\Windows\System32\icvUTnh.exe
  C:\Windows\System32\icvUTnh.exe
  2⤵
  PID:11332
- C:\Windows\System32\XDBQFue.exe
  C:\Windows\System32\XDBQFue.exe
  2⤵
  PID:11352
- C:\Windows\System32\LPmzALG.exe
  C:\Windows\System32\LPmzALG.exe
  2⤵
  PID:11380
- C:\Windows\System32\dflWdNw.exe
  C:\Windows\System32\dflWdNw.exe
  2⤵
  PID:11412
- C:\Windows\System32\yCwVPHy.exe
  C:\Windows\System32\yCwVPHy.exe
  2⤵
  PID:11436
- C:\Windows\System32\mfqfdlV.exe
  C:\Windows\System32\mfqfdlV.exe
  2⤵
  PID:11472
- C:\Windows\System32\GcQXXpl.exe
  C:\Windows\System32\GcQXXpl.exe
  2⤵
  PID:11492
- C:\Windows\System32\xTZwQpw.exe
  C:\Windows\System32\xTZwQpw.exe
  2⤵
  PID:11520
- C:\Windows\System32\GlVsOxO.exe
  C:\Windows\System32\GlVsOxO.exe
  2⤵
  PID:11548
- C:\Windows\System32\gkqZTAQ.exe
  C:\Windows\System32\gkqZTAQ.exe
  2⤵
  PID:11568
- C:\Windows\System32\ocPIVYm.exe
  C:\Windows\System32\ocPIVYm.exe
  2⤵
  PID:11604
- C:\Windows\System32\UlAMedq.exe
  C:\Windows\System32\UlAMedq.exe
  2⤵
  PID:11624
- C:\Windows\System32\XVwHTPw.exe
  C:\Windows\System32\XVwHTPw.exe
  2⤵
  PID:11652
- C:\Windows\System32\sQREXsN.exe
  C:\Windows\System32\sQREXsN.exe
  2⤵
  PID:11668
- C:\Windows\System32\qJfMzRJ.exe
  C:\Windows\System32\qJfMzRJ.exe
  2⤵
  PID:11692
- C:\Windows\System32\KefSzMj.exe
  C:\Windows\System32\KefSzMj.exe
  2⤵
  PID:11708
- C:\Windows\System32\gzwazZV.exe
  C:\Windows\System32\gzwazZV.exe
  2⤵
  PID:11772
- C:\Windows\System32\whJUkOL.exe
  C:\Windows\System32\whJUkOL.exe
  2⤵
  PID:11808
- C:\Windows\System32\kuIOPvD.exe
  C:\Windows\System32\kuIOPvD.exe
  2⤵
  PID:11832
- C:\Windows\System32\ynNOZjP.exe
  C:\Windows\System32\ynNOZjP.exe
  2⤵
  PID:11868
- C:\Windows\System32\EjZIQxQ.exe
  C:\Windows\System32\EjZIQxQ.exe
  2⤵
  PID:11888
- C:\Windows\System32\UYHSNZG.exe
  C:\Windows\System32\UYHSNZG.exe
  2⤵
  PID:11912
- C:\Windows\System32\mZhNOcZ.exe
  C:\Windows\System32\mZhNOcZ.exe
  2⤵
  PID:11932
- C:\Windows\System32\NmKCRlD.exe
  C:\Windows\System32\NmKCRlD.exe
  2⤵
  PID:11948
- C:\Windows\System32\ZDhtVew.exe
  C:\Windows\System32\ZDhtVew.exe
  2⤵
  PID:11972
- C:\Windows\System32\HiraQRL.exe
  C:\Windows\System32\HiraQRL.exe
  2⤵
  PID:11996
- C:\Windows\System32\jZGARwU.exe
  C:\Windows\System32\jZGARwU.exe
  2⤵
  PID:12028
- C:\Windows\System32\aiwaryf.exe
  C:\Windows\System32\aiwaryf.exe
  2⤵
  PID:12084
- C:\Windows\System32\uTvjLgi.exe
  C:\Windows\System32\uTvjLgi.exe
  2⤵
  PID:12112
- C:\Windows\System32\NnmIcQA.exe
  C:\Windows\System32\NnmIcQA.exe
  2⤵
  PID:12136
- C:\Windows\System32\ScbYepS.exe
  C:\Windows\System32\ScbYepS.exe
  2⤵
  PID:12168
- C:\Windows\System32\gOZelaS.exe
  C:\Windows\System32\gOZelaS.exe
  2⤵
  PID:12192
- C:\Windows\System32\EbUeThs.exe
  C:\Windows\System32\EbUeThs.exe
  2⤵
  PID:12252
- C:\Windows\System32\sAZewdp.exe
  C:\Windows\System32\sAZewdp.exe
  2⤵
  PID:12268
- C:\Windows\System32\HaVVURh.exe
  C:\Windows\System32\HaVVURh.exe
  2⤵
  PID:12284
- C:\Windows\System32\rRIozDZ.exe
  C:\Windows\System32\rRIozDZ.exe
  2⤵
  PID:11308
- C:\Windows\System32\qnWaetJ.exe
  C:\Windows\System32\qnWaetJ.exe
  2⤵
  PID:11344
- C:\Windows\System32\ZUBqMxk.exe
  C:\Windows\System32\ZUBqMxk.exe
  2⤵
  PID:11432
- C:\Windows\System32\ZGWIyKb.exe
  C:\Windows\System32\ZGWIyKb.exe
  2⤵
  PID:11448
- C:\Windows\System32\MvNuiWV.exe
  C:\Windows\System32\MvNuiWV.exe
  2⤵
  PID:11632
- C:\Windows\System32\beFCyjS.exe
  C:\Windows\System32\beFCyjS.exe
  2⤵
  PID:11676
- C:\Windows\System32\oZmbiPg.exe
  C:\Windows\System32\oZmbiPg.exe
  2⤵
  PID:11688
- C:\Windows\System32\XkSafNp.exe
  C:\Windows\System32\XkSafNp.exe
  2⤵
  PID:11800
- C:\Windows\System32\LkCTOjI.exe
  C:\Windows\System32\LkCTOjI.exe
  2⤵
  PID:11864
- C:\Windows\System32\gWnJHPP.exe
  C:\Windows\System32\gWnJHPP.exe
  2⤵
  PID:11896
- C:\Windows\System32\bSjtNXf.exe
  C:\Windows\System32\bSjtNXf.exe
  2⤵
  PID:11968
- C:\Windows\System32\UVSeLFG.exe
  C:\Windows\System32\UVSeLFG.exe
  2⤵
  PID:12008
- C:\Windows\System32\gNrufHn.exe
  C:\Windows\System32\gNrufHn.exe
  2⤵
  PID:12108
- C:\Windows\System32\fLDuZJZ.exe
  C:\Windows\System32\fLDuZJZ.exe
  2⤵
  PID:12160
- C:\Windows\System32\TjQiLIY.exe
  C:\Windows\System32\TjQiLIY.exe
  2⤵
  PID:12240
- C:\Windows\System32\MRykdTI.exe
  C:\Windows\System32\MRykdTI.exe
  2⤵
  PID:3960
- C:\Windows\System32\CxPHjKv.exe
  C:\Windows\System32\CxPHjKv.exe
  2⤵
  PID:5052
- C:\Windows\System32\fvVBBAp.exe
  C:\Windows\System32\fvVBBAp.exe
  2⤵
  PID:11536
- C:\Windows\System32\hleGLeq.exe
  C:\Windows\System32\hleGLeq.exe
  2⤵
  PID:11680
- C:\Windows\System32\WJJJgAp.exe
  C:\Windows\System32\WJJJgAp.exe
  2⤵
  PID:11844
- C:\Windows\System32\sQBakBu.exe
  C:\Windows\System32\sQBakBu.exe
  2⤵
  PID:11928
- C:\Windows\System32\vwjdkVa.exe
  C:\Windows\System32\vwjdkVa.exe
  2⤵
  PID:1520
- C:\Windows\System32\cmhVOKa.exe
  C:\Windows\System32\cmhVOKa.exe
  2⤵
  PID:3100
- C:\Windows\System32\SfHUFoh.exe
  C:\Windows\System32\SfHUFoh.exe
  2⤵
  PID:12224
- C:\Windows\System32\GBAIXfm.exe
  C:\Windows\System32\GBAIXfm.exe
  2⤵
  PID:11488
- C:\Windows\System32\UgptWOw.exe
  C:\Windows\System32\UgptWOw.exe
  2⤵
  PID:11820
- C:\Windows\System32\AcZlOkr.exe
  C:\Windows\System32\AcZlOkr.exe
  2⤵
  PID:12052
- C:\Windows\System32\SkpNiar.exe
  C:\Windows\System32\SkpNiar.exe
  2⤵
  PID:12120
- C:\Windows\System32\aRvOHaN.exe
  C:\Windows\System32\aRvOHaN.exe
  2⤵
  PID:11328
- C:\Windows\System32\hMKWKkI.exe
  C:\Windows\System32\hMKWKkI.exe
  2⤵
  PID:12296
- C:\Windows\System32\EDGrzNg.exe
  C:\Windows\System32\EDGrzNg.exe
  2⤵
  PID:12336
- C:\Windows\System32\RYofvVQ.exe
  C:\Windows\System32\RYofvVQ.exe
  2⤵
  PID:12372
- C:\Windows\System32\iFHUfMG.exe
  C:\Windows\System32\iFHUfMG.exe
  2⤵
  PID:12392
- C:\Windows\System32\wfZfgic.exe
  C:\Windows\System32\wfZfgic.exe
  2⤵
  PID:12420
- C:\Windows\System32\fZkFxKv.exe
  C:\Windows\System32\fZkFxKv.exe
  2⤵
  PID:12448
- C:\Windows\System32\AiLFPns.exe
  C:\Windows\System32\AiLFPns.exe
  2⤵
  PID:12476
- C:\Windows\System32\zczNnHn.exe
  C:\Windows\System32\zczNnHn.exe
  2⤵
  PID:12500
- C:\Windows\System32\nsehmfX.exe
  C:\Windows\System32\nsehmfX.exe
  2⤵
  PID:12520
- C:\Windows\System32\actLHbx.exe
  C:\Windows\System32\actLHbx.exe
  2⤵
  PID:12556
- C:\Windows\System32\UDogMoT.exe
  C:\Windows\System32\UDogMoT.exe
  2⤵
  PID:12584
- C:\Windows\System32\RwkcyjG.exe
  C:\Windows\System32\RwkcyjG.exe
  2⤵
  PID:12604
- C:\Windows\System32\srWdGYT.exe
  C:\Windows\System32\srWdGYT.exe
  2⤵
  PID:12640
- C:\Windows\System32\jqLVEuG.exe
  C:\Windows\System32\jqLVEuG.exe
  2⤵
  PID:12660
- C:\Windows\System32\mQbPzCO.exe
  C:\Windows\System32\mQbPzCO.exe
  2⤵
  PID:12680
- C:\Windows\System32\kuRgIXO.exe
  C:\Windows\System32\kuRgIXO.exe
  2⤵
  PID:12696
- C:\Windows\System32\LixXmgp.exe
  C:\Windows\System32\LixXmgp.exe
  2⤵
  PID:12720
- C:\Windows\System32\TXdxohY.exe
  C:\Windows\System32\TXdxohY.exe
  2⤵
  PID:12744
- C:\Windows\System32\IuqgUyE.exe
  C:\Windows\System32\IuqgUyE.exe
  2⤵
  PID:12776
- C:\Windows\System32\vfTLiDl.exe
  C:\Windows\System32\vfTLiDl.exe
  2⤵
  PID:12828
- C:\Windows\System32\WxXQaDA.exe
  C:\Windows\System32\WxXQaDA.exe
  2⤵
  PID:12860
- C:\Windows\System32\WwfLefr.exe
  C:\Windows\System32\WwfLefr.exe
  2⤵
  PID:12904
- C:\Windows\System32\QTlnKMz.exe
  C:\Windows\System32\QTlnKMz.exe
  2⤵
  PID:12924
- C:\Windows\System32\oWvlaow.exe
  C:\Windows\System32\oWvlaow.exe
  2⤵
  PID:12952
- C:\Windows\System32\DCdLafX.exe
  C:\Windows\System32\DCdLafX.exe
  2⤵
  PID:12976
- C:\Windows\System32\qiNFeIO.exe
  C:\Windows\System32\qiNFeIO.exe
  2⤵
  PID:12996
- C:\Windows\System32\QumRGcw.exe
  C:\Windows\System32\QumRGcw.exe
  2⤵
  PID:13028
- C:\Windows\System32\DhaSoCx.exe
  C:\Windows\System32\DhaSoCx.exe
  2⤵
  PID:13076
- C:\Windows\System32\YHqzkOW.exe
  C:\Windows\System32\YHqzkOW.exe
  2⤵
  PID:13108
- C:\Windows\System32\JigyUPb.exe
  C:\Windows\System32\JigyUPb.exe
  2⤵
  PID:13124
- C:\Windows\System32\ZyjGlev.exe
  C:\Windows\System32\ZyjGlev.exe
  2⤵
  PID:13152
- C:\Windows\System32\PBuLkFl.exe
  C:\Windows\System32\PBuLkFl.exe
  2⤵
  PID:13184
- C:\Windows\System32\RrxgYsI.exe
  C:\Windows\System32\RrxgYsI.exe
  2⤵
  PID:13204
- C:\Windows\System32\zJjnNaY.exe
  C:\Windows\System32\zJjnNaY.exe
  2⤵
  PID:13248
- C:\Windows\System32\evYBufI.exe
  C:\Windows\System32\evYBufI.exe
  2⤵
  PID:13272
- C:\Windows\System32\celBiNr.exe
  C:\Windows\System32\celBiNr.exe
  2⤵
  PID:13296
- C:\Windows\System32\VEUNKtc.exe
  C:\Windows\System32\VEUNKtc.exe
  2⤵
  PID:11664
- C:\Windows\System32\SUlnMpx.exe
  C:\Windows\System32\SUlnMpx.exe
  2⤵
  PID:12316
- C:\Windows\System32\hCeEVKY.exe
  C:\Windows\System32\hCeEVKY.exe
  2⤵
  PID:12436
- C:\Windows\System32\iqeOxnT.exe
  C:\Windows\System32\iqeOxnT.exe
  2⤵
  PID:12516
- C:\Windows\System32\cEVvWBG.exe
  C:\Windows\System32\cEVvWBG.exe
  2⤵
  PID:12576
- C:\Windows\System32\OYglbLh.exe
  C:\Windows\System32\OYglbLh.exe
  2⤵
  PID:12628
- C:\Windows\System32\DkJoIEp.exe
  C:\Windows\System32\DkJoIEp.exe
  2⤵
  PID:12668
- C:\Windows\System32\tArIVAC.exe
  C:\Windows\System32\tArIVAC.exe
  2⤵
  PID:12728
- C:\Windows\System32\gOqSiUE.exe
  C:\Windows\System32\gOqSiUE.exe
  2⤵
  PID:12800
- C:\Windows\System32\IskewPh.exe
  C:\Windows\System32\IskewPh.exe
  2⤵
  PID:12820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\Fttofds.exe

Filesize
1.2MB

MD5
674ddf400ae71d5d02188996f53cdea9

SHA1
8d01a1da4561e52c562ba71ba3b4f9e548dfacad

SHA256
a0ef12db2106177f0038875d0d61e6a270b9f881903c6df00f16d6e4c7eefce6

SHA512
b2bffc74965de9a92b2d610c627bfd90bef18eb9f4ee35598f147b57dd484cbc7d04d6bd8cb2f452376e5ae617935b317167b0e49e580f59de3293de3b71c18f

Download Submit
C:\Windows\System32\GGBAHAB.exe

Filesize
1.2MB

MD5
886b86f306b83f4237aac43cc755244c

SHA1
a7cea7df4a30d6dd5388cd06083cc9aabe0e0372

SHA256
0a478cbaff6b663fab39078ee2ad66eb358164a133c1d0012ab28f4b6e2007b2

SHA512
7d727ae154656e1e49bfeb172f123358a11a0acf7c20686c1a25a5fcba58c90ce8f2e126a6a34e311619a06a740079e0449d8cacbb90d807dd3d6d0a898b8401

Download Submit
C:\Windows\System32\GfgyNoY.exe

Filesize
1.2MB

MD5
57e6eda7b302d2bd02e22f755dcfb8f6

SHA1
09c975b24ae4cb18931d29111ee56d7f86ab9f10

SHA256
d77d19cbd0e44aa55c035287cdbc24da782fcfd5c941ea6ec46ffbeeff433bf6

SHA512
10c38df3a59a269d4812d6fa3aab6fbaa5400c6e3bca93733e1043194173adfea68b82865b047db882fa912c6170821d5bdef9a02d64f34097ae46f9a6388411

Download Submit
C:\Windows\System32\HwFIVDP.exe

Filesize
1.2MB

MD5
31a2c28cbb88e85b1a4a66f920f9d165

SHA1
4eaf30279ed79087aa1c4933830d87c13d9f9db8

SHA256
f67a5584ce51eae1e6b1baf021ba0701eb38b34f9c21e9db0c97b390fac68d24

SHA512
a7191f5a8041115d4a87740b6bdb6647146221a4cb208eec2daabd87d9c2dcc99c3066754b11c32847f37c326f0a576b5abde50b9d8f5089d4f168ecc7ae51a5

Download Submit
C:\Windows\System32\LRpkODp.exe

Filesize
1.2MB

MD5
37f5208782b570d9bd1550dd54d90fd8

SHA1
fd40f505d6112c371eef3fd58bd6a2ff8e5edc88

SHA256
384f7a6724bbc4af141d0fc3d7180523324be86eb1ce04297e10ccdd44ebb759

SHA512
be40dbdd67163f249509e080288b461ecea06215d07aebc624868c9bab049aa98f887c4ceb8eae49c2a450311d344a3fac3c774e3164b6941290f16b2c717f8a

Download Submit
C:\Windows\System32\NaRXMxo.exe

Filesize
1.2MB

MD5
cbff2ea02085eded5e15bdb9169cb0c6

SHA1
166899ee7116162775925ac759e706fc3aa0c667

SHA256
d38a8f1d41718d1ac0351847f5bcd79c42f0a81e5e58fd44871500da479ca201

SHA512
357aa6102ca877c10e4678c80920e33c2938326efc54efad97eb3e7446d11724021e4756c21299bc00122965ec2835674916d6cfa58165110b2e29fbf6c5b020

Download Submit
C:\Windows\System32\NxVVcqM.exe

Filesize
1.2MB

MD5
bdc7132453e4b2f166c889199145b1a6

SHA1
1c4122fbdb4cec3950cfece55128d33bbee0f3b2

SHA256
3dde0c2c0671fa23d280b873a5d203fd04e6682ee3aef4a99a3547a5c279f62a

SHA512
13c7be26f26a2bde1b5728e7278f9ee7817d30f80a1268509efa8ebf84e45cbb6ef24925e4c46e14411ffc1ae9e2bcf814f5d4b03cce36acf08be86b98d68ca1

Download Submit
C:\Windows\System32\QaSjQGo.exe

Filesize
1.2MB

MD5
33109d14bdc5a89e92b1c9dc99e25e0f

SHA1
568f7bac917c34c53d1ef0f5cf00c341a404542f

SHA256
a0618c968043f53f9687d8d3e01086ec7f1aa286ac84941cc557b50094eff0c5

SHA512
d90d94ac7b0b190f8c94aa983d23d5df1fb724afb8599e54865a2d2e5b740eb5f2b7ca8016c3a60c005636b69c46fee759ebe19d77b9a6104121fdafcb2338e3

Download Submit
C:\Windows\System32\VWDkRws.exe

Filesize
1.2MB

MD5
25cd360d173e83e3b241d10a92b491c7

SHA1
f75a62311c174763baba730284f5d0548dc23017

SHA256
a776b83e570098ab2ab28ea6e118acf6c85219b451a364451bcf2fefac67b2af

SHA512
8a21d21639ff0a61d7ea6987a35073ec13a796a54a911f82326f538811142eeec245ad2601ebbcd207ca2a999fb2c291ad686a43dec73f777931111d4f882ac3

Download Submit
C:\Windows\System32\VtrhFyH.exe

Filesize
1.2MB

MD5
a93aa011e3487a8b9e3a319180b13330

SHA1
59abcdcd28b153246ac72f8e7f8c87f0e0c34875

SHA256
35e22fa10130c070f9b2b87a212a9c4d9bca347a54e16ec080aade66467aa6d0

SHA512
a6427b8d3fe0cace240764a90af5d8fc33482b5c5bdfb25d387af9fd1bfb6c8028fa4a94ff67fe9e4822e03743a07d94b883755c3ff1208f69093ba36a2b3c63

Download Submit
C:\Windows\System32\VuXuYsT.exe

Filesize
1.2MB

MD5
5259d593fd6fcf6941fee7fa05c1b360

SHA1
ae1a474a76e0d244533804b0a87a4c4b3da9d137

SHA256
7c59fd3cd703574be5829ff6ce1107e1839bb64f33ff73a22c9d4cd196e303ab

SHA512
bec8c2129473defe8097ca245970f74ce8e274b248d16e52edecb552a90c12a5da5650e44b9aa939f085044b8703a3659dda1cc9ea0821e82dfadcf6c74f380e

Download Submit
C:\Windows\System32\WUFglnL.exe

Filesize
1.2MB

MD5
9be285a757dcc30de6675ab06dde135d

SHA1
cd5c5b3dbc2be58c35b56ad0f40d07be54ff6af4

SHA256
93abeb2b9c7e946477f51f796c9edb4a14b6e34e902e372dbb370b4bdd46a2b4

SHA512
a7a868c5114b746d653519f7036ac1c00665d386c1e11c917a543720bc93356266fe855fc1cea95ac20acbe8d9b7576850af1790bbfaa597bce07372e8a1b182

Download Submit
C:\Windows\System32\YPBwzYA.exe

Filesize
1.2MB

MD5
e4cf06984401f5dd5fbbdcacecae0fc1

SHA1
742eb39f376a338cae751e1a9c99838c0c51c52c

SHA256
0f8263fbc23b1ca85eb12d27d171422de3d2141dbf2ecb952e29ba9faa375339

SHA512
412156368b6ec4e67156260d53343a536cf4e26f1256f8e0f37765e4f67830a6040fb4e2704e40feb66bf6ec45e1414fc8db38dfe73b220960b21fec03ca49f9

Download Submit
C:\Windows\System32\ZJxqmjO.exe

Filesize
1.2MB

MD5
0a7ef63e60844d34131c8f6fb498054b

SHA1
b9aa3ef537fccb82a54790d03618b473795afc53

SHA256
bceb5a8172cc0241b36398a86666dd8442d7a7b4062a10372a34f67fbe2a9c8f

SHA512
9c4ac02eb840afdd10d7a314781e9ec978b77969ced19e53e4fb455e5fd5282cd267ce88bf8937c0c652f8cb8803975c9659ef9af66fafc9e8b60ba570f246a1

Download Submit
C:\Windows\System32\dgqKPbz.exe

Filesize
1.2MB

MD5
113658e3c75693a4889080d7a49fe041

SHA1
a41da3cc74308b28cf0b2a2ad72eae4f032a2274

SHA256
67ef4684af02feee200e7f7deeac05165364992b531d9e99287020ab0129a68e

SHA512
569d52852587f58e296dc8b145c240eabe2d3037d3600f2df57eae400445789ee4b2f7914407502b8b7d74952e37831b4d9bf02a868ee33b08d6ad6899d7f3d1

Download Submit
C:\Windows\System32\eNwtLnk.exe

Filesize
1.2MB

MD5
b448e2c11bc5154a464296741fad552f

SHA1
2624e6074ec91ce93fa38ecb6ca31d84924c3624

SHA256
46d06f61dc59974701e66423d2ea8f2854e16b92633e044141d75fc457be2547

SHA512
0bfeb275dd6b1890d292c551782b1c20c35dcfa4ce12c0cff525efaecffbd1e7e38145f28555fe7534e985d97cc98e7f608b5a6ecce5831b5a59bbfb5d53e2e7

Download Submit
C:\Windows\System32\eVBztbV.exe

Filesize
1.2MB

MD5
9fdf8139f3a9e46c151a046ca5a4e8f6

SHA1
96da98da603c43022e37499f84b66a7626bf31a5

SHA256
15b82fb77b15b07a4a5db5607525d50442ced99749bf2ad706edeaf80f9072e6

SHA512
f349d97d4c3c726656c318df46dadaf016b06b59883f047477217c4c6923f91afede407a509037fcda4b73d6d83000a597e40ef0b8213e753102d48bbf66bd70

Download Submit
C:\Windows\System32\etavune.exe

Filesize
1.2MB

MD5
5eeca8a1f40251fa686010e72869ead5

SHA1
a5bf8e9aa427fb158aac5a058066047e9c68cd0f

SHA256
db61c8af7a7edbc23bbb52db221d94832cc418f0d70c3758d3acfc84a8704420

SHA512
df3a926c3631c63d9baec20d191b91e5dfe65234bc09b56e30d9724d1c481122c82425b78a4999bb330a04e09301969b5dd10fd1166c279419a7206adefcb4bd

Download Submit
C:\Windows\System32\ggLZmvW.exe

Filesize
1.2MB

MD5
451b767cd7e475ba1a7398f227155853

SHA1
8eb04a7be62bc89e793c62c88d6e8e41b54a768c

SHA256
1abe3379b61fc9fcf5d5dcf45768cbf7651996f3435842d681c42a8003154271

SHA512
f154db3dfc46145386d6b4662ec56a813d7e8786edb36ebafbe9b2e523e009da46e80fe2f744a6409e2d50a7e9b1e124b66fb298439aad3ff121f21f8af507b8

Download Submit
C:\Windows\System32\guQlzTm.exe

Filesize
1.2MB

MD5
845ab5b2c6af62028da53d97844da7fe

SHA1
f913c03398b11d364f556d262f8d0b012f2a6f74

SHA256
3c068d41f7a1310c885c008d1548904773351d573e405417e3adfb7708bdafeb

SHA512
4361c8a2940850cf826d5ee41856b33d30e4c32e4869bf223b589eae3a14f8ebb13e02749e1078b73eb98c4b5f8978d4d1a904170d40332bd3f0a6041fd0d0d8

Download Submit
C:\Windows\System32\hSZYrDc.exe

Filesize
1.2MB

MD5
13c379612366c8328e4ed09a9f4266b2

SHA1
5408edb22bc17bfed8b142774044e399658a3f62

SHA256
8eaac2aa42bf9d3e1759528a1c46197cac864d753d0d3945f35b4428a5f515ac

SHA512
abbc4354d4925136ae490a87db76d4625992ed4530f7f8490d1e13e2071d56b073e36f282084e582da3844bd86e22fb94b34f0dbff29cbdd32d52e4164f97904

Download Submit
C:\Windows\System32\hxxulAV.exe

Filesize
1.2MB

MD5
f59d574b8398d49d7cf869428714316f

SHA1
613b98eb8c68cbd46a259bab6c4756cb3449e9e3

SHA256
8d93fc4aad9b201b2922d6c7418f88869a1f7ee48680dac22966ff1354ba5901

SHA512
2aff3a1136a79f50ae344255aad200c2607215c37ece0f052ca3d1818d4797e7c51c8bd8045be1d57dafd351d7eae07a84be9b44b708a7970e200c732027e1e7

Download Submit
C:\Windows\System32\irzHVOS.exe

Filesize
1.2MB

MD5
bce8d8ec0085c61cd8bd9aa3cb3d2394

SHA1
0720d83d40971bffeeba8d817bcc6c917d7d1f1e

SHA256
0ac7663fb88063c0a6f0f98d8800dc68fa88638f6689a5ccd72a17916258948c

SHA512
c29be2f91b5933983a5cb70ce265c3d1808c2356c0490a9192ac05224020111111af5bee056c7cff87bf6d19d5fc7ecf41e338004c1037d3bae937f872726466

Download Submit
C:\Windows\System32\jgOHapk.exe

Filesize
1.2MB

MD5
faaab6b428745eb3f3cc999b952a9c10

SHA1
06a7286ffa785ae445d6490de537831779bcc9c2

SHA256
b1b5dc278800d394bffd2408d2938f41d0319f8e51e6215e6a4de436f183e535

SHA512
5c593744843bef637455dbe6bb459543a4ee2bc0cd89f0a653e13868b6dca18995d43f93f2b106e3c616baffbb99fae86f0f4bcdbef8c9ebcb68dc909729457c

Download Submit
C:\Windows\System32\kAULHlJ.exe

Filesize
1.2MB

MD5
497df073a5352c191af4285ea0624576

SHA1
bc9730d01f32b3ae52ff62c33dc39be30590df54

SHA256
f54b8905786b0f888eb82725cf425b7bdd6318696ccc18705d2a881d0d5933e4

SHA512
06cc36e8654dbb3d05da9bf2c6caa8d678d9867a9ba485810751acd4d5758c564b3e86b355fbf24ca042086d3afe339232f7a38483d11d97dfbd033d309646f2

Download Submit
C:\Windows\System32\oRWFcai.exe

Filesize
1.2MB

MD5
ea86723b27eaff25a2815269149d1450

SHA1
066164b3595e220ed0fe6eb47cc458bc753df0d5

SHA256
6d298ec695d11c5fc708acbc40a507c1b05ed7621a253f5fefc7d791d816d72e

SHA512
fdc43b56d468c457f616649a0012b40acf045f488f8d11373ae6ccc6af9bbb5c8fdbccbb2b9ffb6a344e39a3fee449cb7108fff9c580588ebfd68cd094345313

Download Submit
C:\Windows\System32\pSNnZRC.exe

Filesize
1.2MB

MD5
b88004a96855bac6880fcf45fc07991c

SHA1
84ab1b29049e21b79f98c37466e3b52279b774f1

SHA256
f4fc4aece1f77194ca03363aef963e3c213a312301b9667397b1bb3ddd37475a

SHA512
aea44b97951e5b981ce331049dd5761a8dfd9e8c7f2fc8734c5c8ad79197a3670a258c01983cdc920e2470aa04867e169583ad933304231de47572c1e6fc791f

Download Submit
C:\Windows\System32\uUZNRyD.exe

Filesize
1.2MB

MD5
f64d6eed338fbfe7ab200aa7cc1ae537

SHA1
301877de73225f8a22042614fb5c3786492399ae

SHA256
ecf7468cbefbcbb454c7925f39ebbf6e9b193481385d7f986cc9c37dbcf23ec1

SHA512
96513072d882a596b91ad5d654d2eefb52a65f4b3d0f0840cf0bd943eb55ddf516168d63e3bb2b97ca98ca96d4abf58e8a09d48b3a0fc8400f63a3cd3f89290f

Download Submit
C:\Windows\System32\uheoamd.exe

Filesize
1.2MB

MD5
5c36c1ae332235198cf3761f0b2ecad6

SHA1
4575fc3bbc6e30ead22566d6c951e881c92b0b1d

SHA256
996b2d4c6fe52e8d2a0b60250c5cc1a0f62edc4982e6293d7eb6acc9688e39fd

SHA512
301fd14ff8f57def6c9f72a265f8b2144658c69c8ed85ce7038d98d3ee6e025096aa20c37e57fac878b961cb768f6128f724cd2d7a4551c3a57b556a2ef353d0

Download Submit
C:\Windows\System32\xAVhFlm.exe

Filesize
1.2MB

MD5
8ce1a209c2ca8522247964978d2b35ed

SHA1
0c338f0feae4d00a45f2a6a8dc7ec091ff534038

SHA256
caa1b6d337c2d495510dbcaca3a5fce95ce334611dfaf46cd198441592c6ba36

SHA512
dd2bd660f1f156412cc7a510515754384aa8ccf931bea8c26bb1d52774bde98918fd61b5e405401781b68959a71b0d1299eeb722b871df37a5e728e014e9a8b0

Download Submit
C:\Windows\System32\yijVpwk.exe

Filesize
1.2MB

MD5
c880134d445089901275b576622682f3

SHA1
e316972dcc65b31a42fe5c4d3cc371e8fc80cb86

SHA256
07d00213076c206cc3b9fb9f75084037532319e303320e2fb787c2fb6b292a50

SHA512
5e8e436157f942fa64d16b34e1f3f6bc2116a968ef6121bce63ac42b2711f5728a04607add65722ee5e1e7b3810a1d5c113adc669b3d4cfcedd732ad391a4c41

Download Submit
C:\Windows\System32\ywGcQRv.exe

Filesize
1.2MB

MD5
f773380ecc17aac4b1f6ea249eca4345

SHA1
a221101131421ae93d9f1ccf720e8d3d5ea0fb8d

SHA256
315f5f1ef5978bc79d046ff9e91584b3021d27a03d259ec4c23f5cf134748703

SHA512
4c0cc87a9b3b644a39e451ce5725d561d44a43c37e4f2713de577b8063b672696604aad924bc8496ed1d3d97769d1de53bfba379c52ec4f7eb5c25f98e3ca9eb

Download Submit
memory/384-0-0x00007FF675770000-0x00007FF675B61000-memory.dmp

Filesize
3.9MB

Download
memory/384-1-0x000001C89BDD0000-0x000001C89BDE0000-memory.dmp

Filesize
64KB

Download
memory/1344-377-0x00007FF6D7990000-0x00007FF6D7D81000-memory.dmp

Filesize
3.9MB

Download
memory/1344-2045-0x00007FF6D7990000-0x00007FF6D7D81000-memory.dmp

Filesize
3.9MB

Download
memory/1548-2039-0x00007FF63B740000-0x00007FF63BB31000-memory.dmp

Filesize
3.9MB

Download
memory/1548-24-0x00007FF63B740000-0x00007FF63BB31000-memory.dmp

Filesize
3.9MB

Download
memory/1548-2022-0x00007FF63B740000-0x00007FF63BB31000-memory.dmp

Filesize
3.9MB

Download
memory/1600-387-0x00007FF6FAA80000-0x00007FF6FAE71000-memory.dmp

Filesize
3.9MB

Download
memory/1600-2071-0x00007FF6FAA80000-0x00007FF6FAE71000-memory.dmp

Filesize
3.9MB

Download
memory/2444-20-0x00007FF6D3C60000-0x00007FF6D4051000-memory.dmp

Filesize
3.9MB

Download
memory/2444-2031-0x00007FF6D3C60000-0x00007FF6D4051000-memory.dmp

Filesize
3.9MB

Download
memory/2900-393-0x00007FF6B01B0000-0x00007FF6B05A1000-memory.dmp

Filesize
3.9MB

Download
memory/2900-2075-0x00007FF6B01B0000-0x00007FF6B05A1000-memory.dmp

Filesize
3.9MB

Download
memory/2960-2065-0x00007FF6F8EA0000-0x00007FF6F9291000-memory.dmp

Filesize
3.9MB

Download
memory/2960-379-0x00007FF6F8EA0000-0x00007FF6F9291000-memory.dmp

Filesize
3.9MB

Download
memory/3044-374-0x00007FF6A6BE0000-0x00007FF6A6FD1000-memory.dmp

Filesize
3.9MB

Download
memory/3044-2057-0x00007FF6A6BE0000-0x00007FF6A6FD1000-memory.dmp

Filesize
3.9MB

Download
memory/3124-2069-0x00007FF765B40000-0x00007FF765F31000-memory.dmp

Filesize
3.9MB

Download
memory/3124-381-0x00007FF765B40000-0x00007FF765F31000-memory.dmp

Filesize
3.9MB

Download
memory/3180-2037-0x00007FF6BB240000-0x00007FF6BB631000-memory.dmp

Filesize
3.9MB

Download
memory/3180-368-0x00007FF6BB240000-0x00007FF6BB631000-memory.dmp

Filesize
3.9MB

Download
memory/3276-369-0x00007FF7725B0000-0x00007FF7729A1000-memory.dmp

Filesize
3.9MB

Download
memory/3276-2053-0x00007FF7725B0000-0x00007FF7729A1000-memory.dmp

Filesize
3.9MB

Download
memory/3780-1989-0x00007FF7628A0000-0x00007FF762C91000-memory.dmp

Filesize
3.9MB

Download
memory/3780-7-0x00007FF7628A0000-0x00007FF762C91000-memory.dmp

Filesize
3.9MB

Download
memory/3780-2029-0x00007FF7628A0000-0x00007FF762C91000-memory.dmp

Filesize
3.9MB

Download
memory/4048-2061-0x00007FF67FB70000-0x00007FF67FF61000-memory.dmp

Filesize
3.9MB

Download
memory/4048-375-0x00007FF67FB70000-0x00007FF67FF61000-memory.dmp

Filesize
3.9MB

Download
memory/4092-372-0x00007FF630A40000-0x00007FF630E31000-memory.dmp

Filesize
3.9MB

Download
memory/4092-2048-0x00007FF630A40000-0x00007FF630E31000-memory.dmp

Filesize
3.9MB

Download
memory/4204-2067-0x00007FF729FA0000-0x00007FF72A391000-memory.dmp

Filesize
3.9MB

Download
memory/4204-382-0x00007FF729FA0000-0x00007FF72A391000-memory.dmp

Filesize
3.9MB

Download
memory/4228-390-0x00007FF744270000-0x00007FF744661000-memory.dmp

Filesize
3.9MB

Download
memory/4228-2073-0x00007FF744270000-0x00007FF744661000-memory.dmp

Filesize
3.9MB

Download
memory/4252-2036-0x00007FF7D5050000-0x00007FF7D5441000-memory.dmp

Filesize
3.9MB

Download
memory/4252-400-0x00007FF7D5050000-0x00007FF7D5441000-memory.dmp

Filesize
3.9MB

Download
memory/4408-34-0x00007FF69EA70000-0x00007FF69EE61000-memory.dmp

Filesize
3.9MB

Download
memory/4408-2035-0x00007FF69EA70000-0x00007FF69EE61000-memory.dmp

Filesize
3.9MB

Download
memory/4408-2023-0x00007FF69EA70000-0x00007FF69EE61000-memory.dmp

Filesize
3.9MB

Download
memory/4516-402-0x00007FF6E1950000-0x00007FF6E1D41000-memory.dmp

Filesize
3.9MB

Download
memory/4516-2055-0x00007FF6E1950000-0x00007FF6E1D41000-memory.dmp

Filesize
3.9MB

Download
memory/4576-370-0x00007FF7C7770000-0x00007FF7C7B61000-memory.dmp

Filesize
3.9MB

Download
memory/4576-2052-0x00007FF7C7770000-0x00007FF7C7B61000-memory.dmp

Filesize
3.9MB

Download
memory/4640-2063-0x00007FF6D3840000-0x00007FF6D3C31000-memory.dmp

Filesize
3.9MB

Download
memory/4640-380-0x00007FF6D3840000-0x00007FF6D3C31000-memory.dmp

Filesize
3.9MB

Download
memory/4776-378-0x00007FF67EF80000-0x00007FF67F371000-memory.dmp

Filesize
3.9MB

Download
memory/4776-2044-0x00007FF67EF80000-0x00007FF67F371000-memory.dmp

Filesize
3.9MB

Download
memory/4848-371-0x00007FF7FDF20000-0x00007FF7FE311000-memory.dmp

Filesize
3.9MB

Download
memory/4848-2041-0x00007FF7FDF20000-0x00007FF7FE311000-memory.dmp

Filesize
3.9MB

Download
memory/5072-2049-0x00007FF683EB0000-0x00007FF6842A1000-memory.dmp

Filesize
3.9MB

Download
memory/5072-373-0x00007FF683EB0000-0x00007FF6842A1000-memory.dmp

Filesize
3.9MB

Download
memory/5116-376-0x00007FF71B1B0000-0x00007FF71B5A1000-memory.dmp

Filesize
3.9MB

Download
memory/5116-2060-0x00007FF71B1B0000-0x00007FF71B5A1000-memory.dmp

Filesize
3.9MB

Download