xmrig | b3cb0ac5b43a208c852706bed3316e5de0bb5826520e1a4e999a861e28c7d059

Analysis

max time kernel
61s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
Size

1.3MB
MD5

077fed761442917050f1c2d0f67af15f
SHA1

d8408f05d137a4792a7518b388907f4ddcf72d1a
SHA256

b3cb0ac5b43a208c852706bed3316e5de0bb5826520e1a4e999a861e28c7d059
SHA512

bdedd6c13e0c6c33df4eda6ab7b310edd1bc8e1c269bab2df757b0fe5332cbcc0ec41e6e6ec7cd40404d6d13fd6792ec7acd173f7c84400d745fb70e8438ff12
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlGC78XIO6zRIhRmuSOBBW:knw9oUUEEDlGUh+hNBBW

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4908-392-0x00007FF6D9F30000-0x00007FF6DA321000-memory.dmp	xmrig
behavioral2/memory/2848-395-0x00007FF627090000-0x00007FF627481000-memory.dmp	xmrig
behavioral2/memory/1204-399-0x00007FF73F840000-0x00007FF73FC31000-memory.dmp	xmrig
behavioral2/memory/1984-410-0x00007FF71BBD0000-0x00007FF71BFC1000-memory.dmp	xmrig
behavioral2/memory/3384-404-0x00007FF76A900000-0x00007FF76ACF1000-memory.dmp	xmrig
behavioral2/memory/2824-415-0x00007FF703600000-0x00007FF7039F1000-memory.dmp	xmrig
behavioral2/memory/4276-418-0x00007FF7A5460000-0x00007FF7A5851000-memory.dmp	xmrig
behavioral2/memory/1356-13-0x00007FF7A45D0000-0x00007FF7A49C1000-memory.dmp	xmrig
behavioral2/memory/3664-430-0x00007FF6D4190000-0x00007FF6D4581000-memory.dmp	xmrig
behavioral2/memory/1964-431-0x00007FF71AF50000-0x00007FF71B341000-memory.dmp	xmrig
behavioral2/memory/2312-437-0x00007FF625C70000-0x00007FF626061000-memory.dmp	xmrig
behavioral2/memory/1464-444-0x00007FF741680000-0x00007FF741A71000-memory.dmp	xmrig
behavioral2/memory/2376-446-0x00007FF7CD940000-0x00007FF7CDD31000-memory.dmp	xmrig
behavioral2/memory/4856-448-0x00007FF756F80000-0x00007FF757371000-memory.dmp	xmrig
behavioral2/memory/876-443-0x00007FF7240D0000-0x00007FF7244C1000-memory.dmp	xmrig
behavioral2/memory/5004-440-0x00007FF6E7000000-0x00007FF6E73F1000-memory.dmp	xmrig
behavioral2/memory/4172-512-0x00007FF709B10000-0x00007FF709F01000-memory.dmp	xmrig
behavioral2/memory/4720-515-0x00007FF686480000-0x00007FF686871000-memory.dmp	xmrig
behavioral2/memory/2268-520-0x00007FF6AC090000-0x00007FF6AC481000-memory.dmp	xmrig
behavioral2/memory/2000-428-0x00007FF67C760000-0x00007FF67CB51000-memory.dmp	xmrig
behavioral2/memory/5060-424-0x00007FF73D510000-0x00007FF73D901000-memory.dmp	xmrig
behavioral2/memory/5020-526-0x00007FF79B210000-0x00007FF79B601000-memory.dmp	xmrig
behavioral2/memory/2988-532-0x00007FF61DC30000-0x00007FF61E021000-memory.dmp	xmrig
behavioral2/memory/3340-529-0x00007FF7E7FC0000-0x00007FF7E83B1000-memory.dmp	xmrig
behavioral2/memory/1356-1983-0x00007FF7A45D0000-0x00007FF7A49C1000-memory.dmp	xmrig
behavioral2/memory/2988-1986-0x00007FF61DC30000-0x00007FF61E021000-memory.dmp	xmrig
behavioral2/memory/4908-1987-0x00007FF6D9F30000-0x00007FF6DA321000-memory.dmp	xmrig
behavioral2/memory/2848-1989-0x00007FF627090000-0x00007FF627481000-memory.dmp	xmrig
behavioral2/memory/3384-2002-0x00007FF76A900000-0x00007FF76ACF1000-memory.dmp	xmrig
behavioral2/memory/1204-2003-0x00007FF73F840000-0x00007FF73FC31000-memory.dmp	xmrig
behavioral2/memory/2824-2010-0x00007FF703600000-0x00007FF7039F1000-memory.dmp	xmrig
behavioral2/memory/5004-2011-0x00007FF6E7000000-0x00007FF6E73F1000-memory.dmp	xmrig
behavioral2/memory/1464-2015-0x00007FF741680000-0x00007FF741A71000-memory.dmp	xmrig
behavioral2/memory/876-2013-0x00007FF7240D0000-0x00007FF7244C1000-memory.dmp	xmrig
behavioral2/memory/2312-2008-0x00007FF625C70000-0x00007FF626061000-memory.dmp	xmrig
behavioral2/memory/1964-2006-0x00007FF71AF50000-0x00007FF71B341000-memory.dmp	xmrig
behavioral2/memory/5060-1999-0x00007FF73D510000-0x00007FF73D901000-memory.dmp	xmrig
behavioral2/memory/3664-1996-0x00007FF6D4190000-0x00007FF6D4581000-memory.dmp	xmrig
behavioral2/memory/4276-1993-0x00007FF7A5460000-0x00007FF7A5851000-memory.dmp	xmrig
behavioral2/memory/1984-1992-0x00007FF71BBD0000-0x00007FF71BFC1000-memory.dmp	xmrig
behavioral2/memory/2000-1998-0x00007FF67C760000-0x00007FF67CB51000-memory.dmp	xmrig
behavioral2/memory/4856-2044-0x00007FF756F80000-0x00007FF757371000-memory.dmp	xmrig
behavioral2/memory/2376-2053-0x00007FF7CD940000-0x00007FF7CDD31000-memory.dmp	xmrig
behavioral2/memory/4172-2041-0x00007FF709B10000-0x00007FF709F01000-memory.dmp	xmrig
behavioral2/memory/4720-2040-0x00007FF686480000-0x00007FF686871000-memory.dmp	xmrig
behavioral2/memory/5020-2038-0x00007FF79B210000-0x00007FF79B601000-memory.dmp	xmrig
behavioral2/memory/3340-2036-0x00007FF7E7FC0000-0x00007FF7E83B1000-memory.dmp	xmrig
behavioral2/memory/2268-2020-0x00007FF6AC090000-0x00007FF6AC481000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1356	rQdzUYh.exe
4908	waudGlR.exe
2988	QzFwISY.exe
2848	SoRKxpr.exe
1204	shcUAdS.exe
3384	zQWJpZN.exe
1984	IWYxTbO.exe
2824	nQKmpeE.exe
4276	DJqhVEI.exe
5060	aeGPrtq.exe
2000	JWUzDTV.exe
3664	VsxWyiL.exe
1964	dbMaAqo.exe
2312	huqCXDC.exe
5004	zQypLeg.exe
876	sOSoLpa.exe
1464	iOlfzck.exe
2376	QccmcEl.exe
4856	fVpjFpw.exe
4172	HFBxFeK.exe
4720	helnGxD.exe
2268	FxNvPnO.exe
5020	utHjokB.exe
3340	iXiHiLc.exe
3424	IybrALI.exe
4968	GHGHBBh.exe
3568	ejhBDGS.exe
3284	AhxsHWH.exe
4852	kxpOSnJ.exe
3456	kHeypva.exe
4932	WEyWjqd.exe
1848	AwuQotO.exe
2992	SQSxiOY.exe
3988	wYvNAQH.exe
3812	qiVYmVF.exe
2212	tsgXocm.exe
3368	yirqgCu.exe
2032	oTbpByr.exe
4268	URWEfqM.exe
2080	iIZOmsl.exe
2844	vCPllFF.exe
3600	Qnxjufm.exe
4748	TIkIvJC.exe
3068	VVNCdYl.exe
1352	lYpeaNB.exe
4452	aTrYcVe.exe
2500	GBbmLWa.exe
4784	tuhTxoK.exe
2128	taEbXlg.exe
3884	RVeOZeo.exe
664	rFwHClj.exe
3852	QGfcOpw.exe
4560	EppxBDu.exe
2648	qPgIdIJ.exe
4040	zlERqFx.exe
1924	TXnOCpS.exe
720	zfhUkwh.exe
4088	TAdLNjp.exe
4364	zuNBgIe.exe
3928	CSfxmHq.exe
1728	uOQarCb.exe
2744	yyrXcvo.exe
1628	tFuohFd.exe
3504	qhPoTNv.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/116-0-0x00007FF779D10000-0x00007FF77A101000-memory.dmp	upx
behavioral2/files/0x000c000000023b77-4.dat	upx
behavioral2/files/0x000a000000023b8a-10.dat	upx
behavioral2/files/0x000a000000023b8c-22.dat	upx
behavioral2/files/0x000a000000023b8e-30.dat	upx
behavioral2/files/0x000a000000023b8f-37.dat	upx
behavioral2/files/0x000a000000023b91-47.dat	upx
behavioral2/files/0x000a000000023b92-52.dat	upx
behavioral2/files/0x000a000000023b93-57.dat	upx
behavioral2/files/0x000a000000023b96-72.dat	upx
behavioral2/files/0x000a000000023b98-80.dat	upx
behavioral2/files/0x000a000000023b9b-97.dat	upx
behavioral2/files/0x000a000000023b9e-110.dat	upx
behavioral2/files/0x000a000000023ba0-122.dat	upx
behavioral2/files/0x000a000000023ba3-135.dat	upx
behavioral2/files/0x000a000000023ba5-147.dat	upx
behavioral2/memory/4908-392-0x00007FF6D9F30000-0x00007FF6DA321000-memory.dmp	upx
behavioral2/memory/2848-395-0x00007FF627090000-0x00007FF627481000-memory.dmp	upx
behavioral2/memory/1204-399-0x00007FF73F840000-0x00007FF73FC31000-memory.dmp	upx
behavioral2/files/0x000a000000023ba8-162.dat	upx
behavioral2/files/0x000a000000023ba7-157.dat	upx
behavioral2/files/0x000a000000023ba6-152.dat	upx
behavioral2/files/0x000a000000023ba4-142.dat	upx
behavioral2/files/0x000a000000023ba2-132.dat	upx
behavioral2/files/0x000a000000023ba1-127.dat	upx
behavioral2/files/0x000a000000023b9f-117.dat	upx
behavioral2/files/0x000a000000023b9d-107.dat	upx
behavioral2/files/0x000a000000023b9c-102.dat	upx
behavioral2/files/0x000a000000023b9a-92.dat	upx
behavioral2/files/0x000a000000023b99-87.dat	upx
behavioral2/files/0x000a000000023b97-77.dat	upx
behavioral2/files/0x000a000000023b95-67.dat	upx
behavioral2/files/0x000a000000023b94-62.dat	upx
behavioral2/files/0x000a000000023b90-42.dat	upx
behavioral2/memory/1984-410-0x00007FF71BBD0000-0x00007FF71BFC1000-memory.dmp	upx
behavioral2/memory/3384-404-0x00007FF76A900000-0x00007FF76ACF1000-memory.dmp	upx
behavioral2/files/0x000a000000023b8d-27.dat	upx
behavioral2/files/0x000a000000023b8b-17.dat	upx
behavioral2/memory/2824-415-0x00007FF703600000-0x00007FF7039F1000-memory.dmp	upx
behavioral2/memory/4276-418-0x00007FF7A5460000-0x00007FF7A5851000-memory.dmp	upx
behavioral2/memory/1356-13-0x00007FF7A45D0000-0x00007FF7A49C1000-memory.dmp	upx
behavioral2/memory/3664-430-0x00007FF6D4190000-0x00007FF6D4581000-memory.dmp	upx
behavioral2/memory/1964-431-0x00007FF71AF50000-0x00007FF71B341000-memory.dmp	upx
behavioral2/memory/2312-437-0x00007FF625C70000-0x00007FF626061000-memory.dmp	upx
behavioral2/memory/1464-444-0x00007FF741680000-0x00007FF741A71000-memory.dmp	upx
behavioral2/memory/2376-446-0x00007FF7CD940000-0x00007FF7CDD31000-memory.dmp	upx
behavioral2/memory/4856-448-0x00007FF756F80000-0x00007FF757371000-memory.dmp	upx
behavioral2/memory/876-443-0x00007FF7240D0000-0x00007FF7244C1000-memory.dmp	upx
behavioral2/memory/5004-440-0x00007FF6E7000000-0x00007FF6E73F1000-memory.dmp	upx
behavioral2/memory/4172-512-0x00007FF709B10000-0x00007FF709F01000-memory.dmp	upx
behavioral2/memory/4720-515-0x00007FF686480000-0x00007FF686871000-memory.dmp	upx
behavioral2/memory/2268-520-0x00007FF6AC090000-0x00007FF6AC481000-memory.dmp	upx
behavioral2/memory/2000-428-0x00007FF67C760000-0x00007FF67CB51000-memory.dmp	upx
behavioral2/memory/5060-424-0x00007FF73D510000-0x00007FF73D901000-memory.dmp	upx
behavioral2/memory/5020-526-0x00007FF79B210000-0x00007FF79B601000-memory.dmp	upx
behavioral2/memory/2988-532-0x00007FF61DC30000-0x00007FF61E021000-memory.dmp	upx
behavioral2/memory/3340-529-0x00007FF7E7FC0000-0x00007FF7E83B1000-memory.dmp	upx
behavioral2/memory/1356-1983-0x00007FF7A45D0000-0x00007FF7A49C1000-memory.dmp	upx
behavioral2/memory/2988-1986-0x00007FF61DC30000-0x00007FF61E021000-memory.dmp	upx
behavioral2/memory/4908-1987-0x00007FF6D9F30000-0x00007FF6DA321000-memory.dmp	upx
behavioral2/memory/2848-1989-0x00007FF627090000-0x00007FF627481000-memory.dmp	upx
behavioral2/memory/3384-2002-0x00007FF76A900000-0x00007FF76ACF1000-memory.dmp	upx
behavioral2/memory/1204-2003-0x00007FF73F840000-0x00007FF73FC31000-memory.dmp	upx
behavioral2/memory/2824-2010-0x00007FF703600000-0x00007FF7039F1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\rQdzUYh.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\rFwHClj.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\HlgLFQh.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\zfBOdpG.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\bnIObIk.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\VOXGRmh.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\kEyBvpW.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\dfGBMxr.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\jMPNGro.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\sVzRgbZ.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\aqxQZYj.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\EhDKeuL.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\LSsjcmR.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\rnBEebC.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\AImHCxA.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\KucqbIW.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\zssZahW.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\DmxXZOH.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\JPaMHiv.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\jIfXQpv.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\eaDtmIx.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\GYvgmTT.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\DttetRy.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\iBCGINz.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\QCJoCSN.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\zOhChIR.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\GIinLgL.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\KDKNmli.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\tHCaLFK.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\ieZjffQ.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\CvMmmjM.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\vPkLCyD.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\NbUadcj.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\NLKgfuz.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\VMbuqfQ.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\cPCENUt.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\BXqCjOA.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\QMlKIPU.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\XHqApLA.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\GziUuzD.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\GtlOATp.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\kXtgtkS.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\zlERqFx.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\fDIBcza.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\HMFzOJY.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\wxlFqar.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\zglnyeo.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\waudGlR.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\AwuQotO.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\EppxBDu.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\JzrwKhs.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\FBhfOwa.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\etmUQWE.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\LRkapZX.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\DVRyeGH.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\RbDkcJm.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\pULbyWA.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\BZyVgHv.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\tuhTxoK.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\fHTmeax.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\YAxqVaz.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\lRwhlUL.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\nCfygCT.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
File created	C:\Windows\System32\cORqOrV.exe	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 1356	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	86
PID 116 wrote to memory of 1356	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	86
PID 116 wrote to memory of 4908	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	87
PID 116 wrote to memory of 4908	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	87
PID 116 wrote to memory of 2988	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	88
PID 116 wrote to memory of 2988	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	88
PID 116 wrote to memory of 2848	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	89
PID 116 wrote to memory of 2848	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	89
PID 116 wrote to memory of 1204	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	90
PID 116 wrote to memory of 1204	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	90
PID 116 wrote to memory of 3384	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	91
PID 116 wrote to memory of 3384	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	91
PID 116 wrote to memory of 1984	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	92
PID 116 wrote to memory of 1984	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	92
PID 116 wrote to memory of 2824	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	93
PID 116 wrote to memory of 2824	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	93
PID 116 wrote to memory of 4276	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	94
PID 116 wrote to memory of 4276	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	94
PID 116 wrote to memory of 5060	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	95
PID 116 wrote to memory of 5060	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	95
PID 116 wrote to memory of 2000	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	96
PID 116 wrote to memory of 2000	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	96
PID 116 wrote to memory of 3664	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	97
PID 116 wrote to memory of 3664	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	97
PID 116 wrote to memory of 1964	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	98
PID 116 wrote to memory of 1964	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	98
PID 116 wrote to memory of 2312	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	99
PID 116 wrote to memory of 2312	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	99
PID 116 wrote to memory of 5004	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	100
PID 116 wrote to memory of 5004	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	100
PID 116 wrote to memory of 876	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	101
PID 116 wrote to memory of 876	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	101
PID 116 wrote to memory of 1464	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	102
PID 116 wrote to memory of 1464	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	102
PID 116 wrote to memory of 2376	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	103
PID 116 wrote to memory of 2376	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	103
PID 116 wrote to memory of 4856	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	104
PID 116 wrote to memory of 4856	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	104
PID 116 wrote to memory of 4172	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	105
PID 116 wrote to memory of 4172	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	105
PID 116 wrote to memory of 4720	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	106
PID 116 wrote to memory of 4720	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	106
PID 116 wrote to memory of 2268	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	107
PID 116 wrote to memory of 2268	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	107
PID 116 wrote to memory of 5020	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	108
PID 116 wrote to memory of 5020	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	108
PID 116 wrote to memory of 3340	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	109
PID 116 wrote to memory of 3340	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	109
PID 116 wrote to memory of 3424	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	110
PID 116 wrote to memory of 3424	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	110
PID 116 wrote to memory of 4968	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	111
PID 116 wrote to memory of 4968	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	111
PID 116 wrote to memory of 3568	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	112
PID 116 wrote to memory of 3568	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	112
PID 116 wrote to memory of 3284	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	113
PID 116 wrote to memory of 3284	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	113
PID 116 wrote to memory of 4852	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	114
PID 116 wrote to memory of 4852	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	114
PID 116 wrote to memory of 3456	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	115
PID 116 wrote to memory of 3456	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	115
PID 116 wrote to memory of 4932	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	116
PID 116 wrote to memory of 4932	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	116
PID 116 wrote to memory of 1848	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	117
PID 116 wrote to memory of 1848	116	077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\077fed761442917050f1c2d0f67af15f_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\System32\rQdzUYh.exe
  C:\Windows\System32\rQdzUYh.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System32\waudGlR.exe
  C:\Windows\System32\waudGlR.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System32\QzFwISY.exe
  C:\Windows\System32\QzFwISY.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System32\SoRKxpr.exe
  C:\Windows\System32\SoRKxpr.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System32\shcUAdS.exe
  C:\Windows\System32\shcUAdS.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System32\zQWJpZN.exe
  C:\Windows\System32\zQWJpZN.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System32\IWYxTbO.exe
  C:\Windows\System32\IWYxTbO.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System32\nQKmpeE.exe
  C:\Windows\System32\nQKmpeE.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System32\DJqhVEI.exe
  C:\Windows\System32\DJqhVEI.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System32\aeGPrtq.exe
  C:\Windows\System32\aeGPrtq.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System32\JWUzDTV.exe
  C:\Windows\System32\JWUzDTV.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System32\VsxWyiL.exe
  C:\Windows\System32\VsxWyiL.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System32\dbMaAqo.exe
  C:\Windows\System32\dbMaAqo.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System32\huqCXDC.exe
  C:\Windows\System32\huqCXDC.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System32\zQypLeg.exe
  C:\Windows\System32\zQypLeg.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System32\sOSoLpa.exe
  C:\Windows\System32\sOSoLpa.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System32\iOlfzck.exe
  C:\Windows\System32\iOlfzck.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System32\QccmcEl.exe
  C:\Windows\System32\QccmcEl.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System32\fVpjFpw.exe
  C:\Windows\System32\fVpjFpw.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System32\HFBxFeK.exe
  C:\Windows\System32\HFBxFeK.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System32\helnGxD.exe
  C:\Windows\System32\helnGxD.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System32\FxNvPnO.exe
  C:\Windows\System32\FxNvPnO.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System32\utHjokB.exe
  C:\Windows\System32\utHjokB.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System32\iXiHiLc.exe
  C:\Windows\System32\iXiHiLc.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System32\IybrALI.exe
  C:\Windows\System32\IybrALI.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System32\GHGHBBh.exe
  C:\Windows\System32\GHGHBBh.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System32\ejhBDGS.exe
  C:\Windows\System32\ejhBDGS.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System32\AhxsHWH.exe
  C:\Windows\System32\AhxsHWH.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System32\kxpOSnJ.exe
  C:\Windows\System32\kxpOSnJ.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System32\kHeypva.exe
  C:\Windows\System32\kHeypva.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System32\WEyWjqd.exe
  C:\Windows\System32\WEyWjqd.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System32\AwuQotO.exe
  C:\Windows\System32\AwuQotO.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System32\SQSxiOY.exe
  C:\Windows\System32\SQSxiOY.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System32\wYvNAQH.exe
  C:\Windows\System32\wYvNAQH.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System32\qiVYmVF.exe
  C:\Windows\System32\qiVYmVF.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System32\tsgXocm.exe
  C:\Windows\System32\tsgXocm.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System32\yirqgCu.exe
  C:\Windows\System32\yirqgCu.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System32\oTbpByr.exe
  C:\Windows\System32\oTbpByr.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System32\URWEfqM.exe
  C:\Windows\System32\URWEfqM.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System32\iIZOmsl.exe
  C:\Windows\System32\iIZOmsl.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System32\vCPllFF.exe
  C:\Windows\System32\vCPllFF.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System32\Qnxjufm.exe
  C:\Windows\System32\Qnxjufm.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System32\TIkIvJC.exe
  C:\Windows\System32\TIkIvJC.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System32\VVNCdYl.exe
  C:\Windows\System32\VVNCdYl.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System32\lYpeaNB.exe
  C:\Windows\System32\lYpeaNB.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System32\aTrYcVe.exe
  C:\Windows\System32\aTrYcVe.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System32\GBbmLWa.exe
  C:\Windows\System32\GBbmLWa.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System32\tuhTxoK.exe
  C:\Windows\System32\tuhTxoK.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System32\taEbXlg.exe
  C:\Windows\System32\taEbXlg.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System32\RVeOZeo.exe
  C:\Windows\System32\RVeOZeo.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System32\rFwHClj.exe
  C:\Windows\System32\rFwHClj.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System32\QGfcOpw.exe
  C:\Windows\System32\QGfcOpw.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System32\EppxBDu.exe
  C:\Windows\System32\EppxBDu.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System32\qPgIdIJ.exe
  C:\Windows\System32\qPgIdIJ.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System32\zlERqFx.exe
  C:\Windows\System32\zlERqFx.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System32\TXnOCpS.exe
  C:\Windows\System32\TXnOCpS.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System32\zfhUkwh.exe
  C:\Windows\System32\zfhUkwh.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System32\TAdLNjp.exe
  C:\Windows\System32\TAdLNjp.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System32\zuNBgIe.exe
  C:\Windows\System32\zuNBgIe.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System32\CSfxmHq.exe
  C:\Windows\System32\CSfxmHq.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System32\uOQarCb.exe
  C:\Windows\System32\uOQarCb.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System32\yyrXcvo.exe
  C:\Windows\System32\yyrXcvo.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System32\tFuohFd.exe
  C:\Windows\System32\tFuohFd.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System32\qhPoTNv.exe
  C:\Windows\System32\qhPoTNv.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System32\rTEulgG.exe
  C:\Windows\System32\rTEulgG.exe
  2⤵
  PID:3640
- C:\Windows\System32\YFoZAbQ.exe
  C:\Windows\System32\YFoZAbQ.exe
  2⤵
  PID:4420
- C:\Windows\System32\fRqOGAq.exe
  C:\Windows\System32\fRqOGAq.exe
  2⤵
  PID:4308
- C:\Windows\System32\qYwvKXV.exe
  C:\Windows\System32\qYwvKXV.exe
  2⤵
  PID:4004
- C:\Windows\System32\KPpOCpX.exe
  C:\Windows\System32\KPpOCpX.exe
  2⤵
  PID:2244
- C:\Windows\System32\KJSsBnE.exe
  C:\Windows\System32\KJSsBnE.exe
  2⤵
  PID:1088
- C:\Windows\System32\RixQGIN.exe
  C:\Windows\System32\RixQGIN.exe
  2⤵
  PID:3396
- C:\Windows\System32\kemLUpW.exe
  C:\Windows\System32\kemLUpW.exe
  2⤵
  PID:3932
- C:\Windows\System32\qjzsCzz.exe
  C:\Windows\System32\qjzsCzz.exe
  2⤵
  PID:4164
- C:\Windows\System32\KZOsvmq.exe
  C:\Windows\System32\KZOsvmq.exe
  2⤵
  PID:4464
- C:\Windows\System32\ntLvdmx.exe
  C:\Windows\System32\ntLvdmx.exe
  2⤵
  PID:532
- C:\Windows\System32\oZGzLdH.exe
  C:\Windows\System32\oZGzLdH.exe
  2⤵
  PID:8
- C:\Windows\System32\VdulySh.exe
  C:\Windows\System32\VdulySh.exe
  2⤵
  PID:5124
- C:\Windows\System32\GBfaqUH.exe
  C:\Windows\System32\GBfaqUH.exe
  2⤵
  PID:5152
- C:\Windows\System32\JAAgtbS.exe
  C:\Windows\System32\JAAgtbS.exe
  2⤵
  PID:5184
- C:\Windows\System32\HreKOUv.exe
  C:\Windows\System32\HreKOUv.exe
  2⤵
  PID:5204
- C:\Windows\System32\wquHRFy.exe
  C:\Windows\System32\wquHRFy.exe
  2⤵
  PID:5236
- C:\Windows\System32\VMbuqfQ.exe
  C:\Windows\System32\VMbuqfQ.exe
  2⤵
  PID:5264
- C:\Windows\System32\tXKsMLo.exe
  C:\Windows\System32\tXKsMLo.exe
  2⤵
  PID:5288
- C:\Windows\System32\ckYrJrU.exe
  C:\Windows\System32\ckYrJrU.exe
  2⤵
  PID:5324
- C:\Windows\System32\nNesHSW.exe
  C:\Windows\System32\nNesHSW.exe
  2⤵
  PID:5352
- C:\Windows\System32\nCfygCT.exe
  C:\Windows\System32\nCfygCT.exe
  2⤵
  PID:5380
- C:\Windows\System32\XGEXtbG.exe
  C:\Windows\System32\XGEXtbG.exe
  2⤵
  PID:5408
- C:\Windows\System32\cCXJpTe.exe
  C:\Windows\System32\cCXJpTe.exe
  2⤵
  PID:5432
- C:\Windows\System32\KucqbIW.exe
  C:\Windows\System32\KucqbIW.exe
  2⤵
  PID:5456
- C:\Windows\System32\cMUBmJT.exe
  C:\Windows\System32\cMUBmJT.exe
  2⤵
  PID:5488
- C:\Windows\System32\GIieKXe.exe
  C:\Windows\System32\GIieKXe.exe
  2⤵
  PID:5520
- C:\Windows\System32\fHTmeax.exe
  C:\Windows\System32\fHTmeax.exe
  2⤵
  PID:5540
- C:\Windows\System32\hQNiQgu.exe
  C:\Windows\System32\hQNiQgu.exe
  2⤵
  PID:5576
- C:\Windows\System32\ckMraOZ.exe
  C:\Windows\System32\ckMraOZ.exe
  2⤵
  PID:5604
- C:\Windows\System32\eaDtmIx.exe
  C:\Windows\System32\eaDtmIx.exe
  2⤵
  PID:5632
- C:\Windows\System32\HJjFRoa.exe
  C:\Windows\System32\HJjFRoa.exe
  2⤵
  PID:5652
- C:\Windows\System32\JuzWLmJ.exe
  C:\Windows\System32\JuzWLmJ.exe
  2⤵
  PID:5688
- C:\Windows\System32\cbtIvSA.exe
  C:\Windows\System32\cbtIvSA.exe
  2⤵
  PID:5712
- C:\Windows\System32\oorEsnR.exe
  C:\Windows\System32\oorEsnR.exe
  2⤵
  PID:5736
- C:\Windows\System32\RzyNliU.exe
  C:\Windows\System32\RzyNliU.exe
  2⤵
  PID:5768
- C:\Windows\System32\tOfIWEe.exe
  C:\Windows\System32\tOfIWEe.exe
  2⤵
  PID:5800
- C:\Windows\System32\qTqpJdX.exe
  C:\Windows\System32\qTqpJdX.exe
  2⤵
  PID:5820
- C:\Windows\System32\OBpilBV.exe
  C:\Windows\System32\OBpilBV.exe
  2⤵
  PID:5852
- C:\Windows\System32\PbtGTMQ.exe
  C:\Windows\System32\PbtGTMQ.exe
  2⤵
  PID:5880
- C:\Windows\System32\jVenQaP.exe
  C:\Windows\System32\jVenQaP.exe
  2⤵
  PID:5908
- C:\Windows\System32\lXQZhCG.exe
  C:\Windows\System32\lXQZhCG.exe
  2⤵
  PID:5932
- C:\Windows\System32\fpaRhHZ.exe
  C:\Windows\System32\fpaRhHZ.exe
  2⤵
  PID:5964
- C:\Windows\System32\pTUSIIE.exe
  C:\Windows\System32\pTUSIIE.exe
  2⤵
  PID:5988
- C:\Windows\System32\BiAABKs.exe
  C:\Windows\System32\BiAABKs.exe
  2⤵
  PID:6032
- C:\Windows\System32\cPCENUt.exe
  C:\Windows\System32\cPCENUt.exe
  2⤵
  PID:6064
- C:\Windows\System32\XppXxft.exe
  C:\Windows\System32\XppXxft.exe
  2⤵
  PID:6096
- C:\Windows\System32\NhPtiFT.exe
  C:\Windows\System32\NhPtiFT.exe
  2⤵
  PID:6120
- C:\Windows\System32\iMQwFen.exe
  C:\Windows\System32\iMQwFen.exe
  2⤵
  PID:6140
- C:\Windows\System32\etmUQWE.exe
  C:\Windows\System32\etmUQWE.exe
  2⤵
  PID:1596
- C:\Windows\System32\JWSeSTx.exe
  C:\Windows\System32\JWSeSTx.exe
  2⤵
  PID:4716
- C:\Windows\System32\gPivSey.exe
  C:\Windows\System32\gPivSey.exe
  2⤵
  PID:2508
- C:\Windows\System32\zlJnRaq.exe
  C:\Windows\System32\zlJnRaq.exe
  2⤵
  PID:4944
- C:\Windows\System32\KXKQdHu.exe
  C:\Windows\System32\KXKQdHu.exe
  2⤵
  PID:1164
- C:\Windows\System32\JzrwKhs.exe
  C:\Windows\System32\JzrwKhs.exe
  2⤵
  PID:4460
- C:\Windows\System32\RikmSyZ.exe
  C:\Windows\System32\RikmSyZ.exe
  2⤵
  PID:5348
- C:\Windows\System32\CsLqSTe.exe
  C:\Windows\System32\CsLqSTe.exe
  2⤵
  PID:5396
- C:\Windows\System32\vKiqxdO.exe
  C:\Windows\System32\vKiqxdO.exe
  2⤵
  PID:5480
- C:\Windows\System32\KMhwvQB.exe
  C:\Windows\System32\KMhwvQB.exe
  2⤵
  PID:5532
- C:\Windows\System32\GhSSTSX.exe
  C:\Windows\System32\GhSSTSX.exe
  2⤵
  PID:5600
- C:\Windows\System32\HlgLFQh.exe
  C:\Windows\System32\HlgLFQh.exe
  2⤵
  PID:5664
- C:\Windows\System32\vMKjrPF.exe
  C:\Windows\System32\vMKjrPF.exe
  2⤵
  PID:4016
- C:\Windows\System32\VJetrEJ.exe
  C:\Windows\System32\VJetrEJ.exe
  2⤵
  PID:5732
- C:\Windows\System32\bsmNQyv.exe
  C:\Windows\System32\bsmNQyv.exe
  2⤵
  PID:5752
- C:\Windows\System32\FQZZGsA.exe
  C:\Windows\System32\FQZZGsA.exe
  2⤵
  PID:4348
- C:\Windows\System32\rIKSBaa.exe
  C:\Windows\System32\rIKSBaa.exe
  2⤵
  PID:5872
- C:\Windows\System32\izBdtQj.exe
  C:\Windows\System32\izBdtQj.exe
  2⤵
  PID:2428
- C:\Windows\System32\dmmucAg.exe
  C:\Windows\System32\dmmucAg.exe
  2⤵
  PID:5948
- C:\Windows\System32\rhkYznv.exe
  C:\Windows\System32\rhkYznv.exe
  2⤵
  PID:4180
- C:\Windows\System32\DMQtUOV.exe
  C:\Windows\System32\DMQtUOV.exe
  2⤵
  PID:3012
- C:\Windows\System32\MDOuGUt.exe
  C:\Windows\System32\MDOuGUt.exe
  2⤵
  PID:4920
- C:\Windows\System32\FxzBKaX.exe
  C:\Windows\System32\FxzBKaX.exe
  2⤵
  PID:3548
- C:\Windows\System32\rnoZQir.exe
  C:\Windows\System32\rnoZQir.exe
  2⤵
  PID:6056
- C:\Windows\System32\azDuOkC.exe
  C:\Windows\System32\azDuOkC.exe
  2⤵
  PID:3200
- C:\Windows\System32\GYvgmTT.exe
  C:\Windows\System32\GYvgmTT.exe
  2⤵
  PID:1180
- C:\Windows\System32\WrnWQTY.exe
  C:\Windows\System32\WrnWQTY.exe
  2⤵
  PID:4872
- C:\Windows\System32\BKBFfDJ.exe
  C:\Windows\System32\BKBFfDJ.exe
  2⤵
  PID:5168
- C:\Windows\System32\QKIBFNR.exe
  C:\Windows\System32\QKIBFNR.exe
  2⤵
  PID:5340
- C:\Windows\System32\hzhHjVr.exe
  C:\Windows\System32\hzhHjVr.exe
  2⤵
  PID:4812
- C:\Windows\System32\FkLEKHD.exe
  C:\Windows\System32\FkLEKHD.exe
  2⤵
  PID:5572
- C:\Windows\System32\kEyBvpW.exe
  C:\Windows\System32\kEyBvpW.exe
  2⤵
  PID:5628
- C:\Windows\System32\NoPIbsx.exe
  C:\Windows\System32\NoPIbsx.exe
  2⤵
  PID:624
- C:\Windows\System32\TIkNdWz.exe
  C:\Windows\System32\TIkNdWz.exe
  2⤵
  PID:868
- C:\Windows\System32\HwjQJrq.exe
  C:\Windows\System32\HwjQJrq.exe
  2⤵
  PID:2896
- C:\Windows\System32\cORqOrV.exe
  C:\Windows\System32\cORqOrV.exe
  2⤵
  PID:1792
- C:\Windows\System32\SWoqdFd.exe
  C:\Windows\System32\SWoqdFd.exe
  2⤵
  PID:6080
- C:\Windows\System32\NtElDJQ.exe
  C:\Windows\System32\NtElDJQ.exe
  2⤵
  PID:5136
- C:\Windows\System32\mKWPeyP.exe
  C:\Windows\System32\mKWPeyP.exe
  2⤵
  PID:2752
- C:\Windows\System32\uoIYjpJ.exe
  C:\Windows\System32\uoIYjpJ.exe
  2⤵
  PID:5500
- C:\Windows\System32\OkUwpKb.exe
  C:\Windows\System32\OkUwpKb.exe
  2⤵
  PID:5504
- C:\Windows\System32\flVNTSh.exe
  C:\Windows\System32\flVNTSh.exe
  2⤵
  PID:5364
- C:\Windows\System32\DvLyVql.exe
  C:\Windows\System32\DvLyVql.exe
  2⤵
  PID:5312
- C:\Windows\System32\LfaKAfC.exe
  C:\Windows\System32\LfaKAfC.exe
  2⤵
  PID:5564
- C:\Windows\System32\LOwOjoN.exe
  C:\Windows\System32\LOwOjoN.exe
  2⤵
  PID:3076
- C:\Windows\System32\JIbrlTe.exe
  C:\Windows\System32\JIbrlTe.exe
  2⤵
  PID:2748
- C:\Windows\System32\OhkPMMZ.exe
  C:\Windows\System32\OhkPMMZ.exe
  2⤵
  PID:5784
- C:\Windows\System32\qiAyshI.exe
  C:\Windows\System32\qiAyshI.exe
  2⤵
  PID:6156
- C:\Windows\System32\PGkvRej.exe
  C:\Windows\System32\PGkvRej.exe
  2⤵
  PID:6184
- C:\Windows\System32\XSSWtEo.exe
  C:\Windows\System32\XSSWtEo.exe
  2⤵
  PID:6224
- C:\Windows\System32\CEceyLk.exe
  C:\Windows\System32\CEceyLk.exe
  2⤵
  PID:6240
- C:\Windows\System32\JOAnVdS.exe
  C:\Windows\System32\JOAnVdS.exe
  2⤵
  PID:6260
- C:\Windows\System32\qdgsYrY.exe
  C:\Windows\System32\qdgsYrY.exe
  2⤵
  PID:6280
- C:\Windows\System32\izLDaPg.exe
  C:\Windows\System32\izLDaPg.exe
  2⤵
  PID:6324
- C:\Windows\System32\hknSBKP.exe
  C:\Windows\System32\hknSBKP.exe
  2⤵
  PID:6344
- C:\Windows\System32\FyUngDe.exe
  C:\Windows\System32\FyUngDe.exe
  2⤵
  PID:6368
- C:\Windows\System32\zDUPqcO.exe
  C:\Windows\System32\zDUPqcO.exe
  2⤵
  PID:6384
- C:\Windows\System32\wmFuNLT.exe
  C:\Windows\System32\wmFuNLT.exe
  2⤵
  PID:6408
- C:\Windows\System32\bKmBHUM.exe
  C:\Windows\System32\bKmBHUM.exe
  2⤵
  PID:6428
- C:\Windows\System32\RzsyHoB.exe
  C:\Windows\System32\RzsyHoB.exe
  2⤵
  PID:6448
- C:\Windows\System32\YRheWmy.exe
  C:\Windows\System32\YRheWmy.exe
  2⤵
  PID:6504
- C:\Windows\System32\imaHGYW.exe
  C:\Windows\System32\imaHGYW.exe
  2⤵
  PID:6524
- C:\Windows\System32\WEPQeDr.exe
  C:\Windows\System32\WEPQeDr.exe
  2⤵
  PID:6572
- C:\Windows\System32\ehoDryj.exe
  C:\Windows\System32\ehoDryj.exe
  2⤵
  PID:6588
- C:\Windows\System32\Kcfwmck.exe
  C:\Windows\System32\Kcfwmck.exe
  2⤵
  PID:6624
- C:\Windows\System32\fDIBcza.exe
  C:\Windows\System32\fDIBcza.exe
  2⤵
  PID:6640
- C:\Windows\System32\uiAijil.exe
  C:\Windows\System32\uiAijil.exe
  2⤵
  PID:6664
- C:\Windows\System32\DxHJTGA.exe
  C:\Windows\System32\DxHJTGA.exe
  2⤵
  PID:6708
- C:\Windows\System32\xhLGGCp.exe
  C:\Windows\System32\xhLGGCp.exe
  2⤵
  PID:6732
- C:\Windows\System32\kXAexBF.exe
  C:\Windows\System32\kXAexBF.exe
  2⤵
  PID:6776
- C:\Windows\System32\PVnvMdw.exe
  C:\Windows\System32\PVnvMdw.exe
  2⤵
  PID:6796
- C:\Windows\System32\HqdIfuH.exe
  C:\Windows\System32\HqdIfuH.exe
  2⤵
  PID:6816
- C:\Windows\System32\zssZahW.exe
  C:\Windows\System32\zssZahW.exe
  2⤵
  PID:6836
- C:\Windows\System32\BXqCjOA.exe
  C:\Windows\System32\BXqCjOA.exe
  2⤵
  PID:6892
- C:\Windows\System32\jZEVUTN.exe
  C:\Windows\System32\jZEVUTN.exe
  2⤵
  PID:6924
- C:\Windows\System32\MzRKiMj.exe
  C:\Windows\System32\MzRKiMj.exe
  2⤵
  PID:6948
- C:\Windows\System32\XLoqWUI.exe
  C:\Windows\System32\XLoqWUI.exe
  2⤵
  PID:6968
- C:\Windows\System32\CDqMmCr.exe
  C:\Windows\System32\CDqMmCr.exe
  2⤵
  PID:6984
- C:\Windows\System32\ACuHCFR.exe
  C:\Windows\System32\ACuHCFR.exe
  2⤵
  PID:7008
- C:\Windows\System32\VTFSjng.exe
  C:\Windows\System32\VTFSjng.exe
  2⤵
  PID:7064
- C:\Windows\System32\nviMQXr.exe
  C:\Windows\System32\nviMQXr.exe
  2⤵
  PID:7092
- C:\Windows\System32\BJMNThY.exe
  C:\Windows\System32\BJMNThY.exe
  2⤵
  PID:7112
- C:\Windows\System32\NpQIZtd.exe
  C:\Windows\System32\NpQIZtd.exe
  2⤵
  PID:7136
- C:\Windows\System32\dzbMdyy.exe
  C:\Windows\System32\dzbMdyy.exe
  2⤵
  PID:5256
- C:\Windows\System32\OJGBMQr.exe
  C:\Windows\System32\OJGBMQr.exe
  2⤵
  PID:6164
- C:\Windows\System32\luFGpYq.exe
  C:\Windows\System32\luFGpYq.exe
  2⤵
  PID:6236
- C:\Windows\System32\aqxQZYj.exe
  C:\Windows\System32\aqxQZYj.exe
  2⤵
  PID:6272
- C:\Windows\System32\GFTdFMt.exe
  C:\Windows\System32\GFTdFMt.exe
  2⤵
  PID:6300
- C:\Windows\System32\alOQeBt.exe
  C:\Windows\System32\alOQeBt.exe
  2⤵
  PID:6332
- C:\Windows\System32\FGtyZFZ.exe
  C:\Windows\System32\FGtyZFZ.exe
  2⤵
  PID:6392
- C:\Windows\System32\hXbBBFr.exe
  C:\Windows\System32\hXbBBFr.exe
  2⤵
  PID:6520
- C:\Windows\System32\CUGKxek.exe
  C:\Windows\System32\CUGKxek.exe
  2⤵
  PID:6656
- C:\Windows\System32\hMkzYtM.exe
  C:\Windows\System32\hMkzYtM.exe
  2⤵
  PID:6692
- C:\Windows\System32\frevYuM.exe
  C:\Windows\System32\frevYuM.exe
  2⤵
  PID:6760
- C:\Windows\System32\QYRbdFq.exe
  C:\Windows\System32\QYRbdFq.exe
  2⤵
  PID:6812
- C:\Windows\System32\zfBOdpG.exe
  C:\Windows\System32\zfBOdpG.exe
  2⤵
  PID:6876
- C:\Windows\System32\eLodpWu.exe
  C:\Windows\System32\eLodpWu.exe
  2⤵
  PID:6904
- C:\Windows\System32\VMzzoPR.exe
  C:\Windows\System32\VMzzoPR.exe
  2⤵
  PID:7016
- C:\Windows\System32\MWtUuvW.exe
  C:\Windows\System32\MWtUuvW.exe
  2⤵
  PID:7020
- C:\Windows\System32\icNgHrH.exe
  C:\Windows\System32\icNgHrH.exe
  2⤵
  PID:7164
- C:\Windows\System32\bnxiaor.exe
  C:\Windows\System32\bnxiaor.exe
  2⤵
  PID:6232
- C:\Windows\System32\epfGsDf.exe
  C:\Windows\System32\epfGsDf.exe
  2⤵
  PID:6396
- C:\Windows\System32\YAxqVaz.exe
  C:\Windows\System32\YAxqVaz.exe
  2⤵
  PID:4940
- C:\Windows\System32\BjLNiFN.exe
  C:\Windows\System32\BjLNiFN.exe
  2⤵
  PID:6580
- C:\Windows\System32\jPUgeAP.exe
  C:\Windows\System32\jPUgeAP.exe
  2⤵
  PID:6564
- C:\Windows\System32\rNxsijT.exe
  C:\Windows\System32\rNxsijT.exe
  2⤵
  PID:3116
- C:\Windows\System32\uQjEceC.exe
  C:\Windows\System32\uQjEceC.exe
  2⤵
  PID:6808
- C:\Windows\System32\MdULGTl.exe
  C:\Windows\System32\MdULGTl.exe
  2⤵
  PID:7040
- C:\Windows\System32\LuMcsiX.exe
  C:\Windows\System32\LuMcsiX.exe
  2⤵
  PID:6772
- C:\Windows\System32\pVbwfhN.exe
  C:\Windows\System32\pVbwfhN.exe
  2⤵
  PID:6360
- C:\Windows\System32\dymVFGP.exe
  C:\Windows\System32\dymVFGP.exe
  2⤵
  PID:6596
- C:\Windows\System32\lbgtOwU.exe
  C:\Windows\System32\lbgtOwU.exe
  2⤵
  PID:6648
- C:\Windows\System32\joBDBYa.exe
  C:\Windows\System32\joBDBYa.exe
  2⤵
  PID:7184
- C:\Windows\System32\evXoUWq.exe
  C:\Windows\System32\evXoUWq.exe
  2⤵
  PID:7204
- C:\Windows\System32\yWhhUct.exe
  C:\Windows\System32\yWhhUct.exe
  2⤵
  PID:7228
- C:\Windows\System32\cCqXjOE.exe
  C:\Windows\System32\cCqXjOE.exe
  2⤵
  PID:7268
- C:\Windows\System32\AAqJIcK.exe
  C:\Windows\System32\AAqJIcK.exe
  2⤵
  PID:7284
- C:\Windows\System32\cfsncpD.exe
  C:\Windows\System32\cfsncpD.exe
  2⤵
  PID:7304
- C:\Windows\System32\SSSbGVw.exe
  C:\Windows\System32\SSSbGVw.exe
  2⤵
  PID:7328
- C:\Windows\System32\pBVWLnm.exe
  C:\Windows\System32\pBVWLnm.exe
  2⤵
  PID:7372
- C:\Windows\System32\ZLhGuLQ.exe
  C:\Windows\System32\ZLhGuLQ.exe
  2⤵
  PID:7388
- C:\Windows\System32\JONhmUU.exe
  C:\Windows\System32\JONhmUU.exe
  2⤵
  PID:7412
- C:\Windows\System32\DDAeict.exe
  C:\Windows\System32\DDAeict.exe
  2⤵
  PID:7428
- C:\Windows\System32\GkxlqkK.exe
  C:\Windows\System32\GkxlqkK.exe
  2⤵
  PID:7448
- C:\Windows\System32\GIinLgL.exe
  C:\Windows\System32\GIinLgL.exe
  2⤵
  PID:7484
- C:\Windows\System32\btGtods.exe
  C:\Windows\System32\btGtods.exe
  2⤵
  PID:7552
- C:\Windows\System32\IuIDosi.exe
  C:\Windows\System32\IuIDosi.exe
  2⤵
  PID:7580
- C:\Windows\System32\PvfhxyA.exe
  C:\Windows\System32\PvfhxyA.exe
  2⤵
  PID:7608
- C:\Windows\System32\rAkwlfS.exe
  C:\Windows\System32\rAkwlfS.exe
  2⤵
  PID:7624
- C:\Windows\System32\xnTxRZp.exe
  C:\Windows\System32\xnTxRZp.exe
  2⤵
  PID:7656
- C:\Windows\System32\iniHnyF.exe
  C:\Windows\System32\iniHnyF.exe
  2⤵
  PID:7680
- C:\Windows\System32\yAxkfZZ.exe
  C:\Windows\System32\yAxkfZZ.exe
  2⤵
  PID:7708
- C:\Windows\System32\aRjbTds.exe
  C:\Windows\System32\aRjbTds.exe
  2⤵
  PID:7748
- C:\Windows\System32\WExWJdX.exe
  C:\Windows\System32\WExWJdX.exe
  2⤵
  PID:7768
- C:\Windows\System32\RXkoJSl.exe
  C:\Windows\System32\RXkoJSl.exe
  2⤵
  PID:7804
- C:\Windows\System32\jiKjwQd.exe
  C:\Windows\System32\jiKjwQd.exe
  2⤵
  PID:7832
- C:\Windows\System32\zVIFOfR.exe
  C:\Windows\System32\zVIFOfR.exe
  2⤵
  PID:7852
- C:\Windows\System32\LhMSNty.exe
  C:\Windows\System32\LhMSNty.exe
  2⤵
  PID:7884
- C:\Windows\System32\HMFzOJY.exe
  C:\Windows\System32\HMFzOJY.exe
  2⤵
  PID:7920
- C:\Windows\System32\SdAFldP.exe
  C:\Windows\System32\SdAFldP.exe
  2⤵
  PID:7944
- C:\Windows\System32\MwNglAw.exe
  C:\Windows\System32\MwNglAw.exe
  2⤵
  PID:7972
- C:\Windows\System32\GOhidwe.exe
  C:\Windows\System32\GOhidwe.exe
  2⤵
  PID:7992
- C:\Windows\System32\BMjBCSj.exe
  C:\Windows\System32\BMjBCSj.exe
  2⤵
  PID:8040
- C:\Windows\System32\nHFCURU.exe
  C:\Windows\System32\nHFCURU.exe
  2⤵
  PID:8060
- C:\Windows\System32\LRkapZX.exe
  C:\Windows\System32\LRkapZX.exe
  2⤵
  PID:8076
- C:\Windows\System32\UKBhrgv.exe
  C:\Windows\System32\UKBhrgv.exe
  2⤵
  PID:8100
- C:\Windows\System32\UqcJTOe.exe
  C:\Windows\System32\UqcJTOe.exe
  2⤵
  PID:8132
- C:\Windows\System32\jIcseXo.exe
  C:\Windows\System32\jIcseXo.exe
  2⤵
  PID:8172
- C:\Windows\System32\Prbcchx.exe
  C:\Windows\System32\Prbcchx.exe
  2⤵
  PID:6536
- C:\Windows\System32\UTolVwM.exe
  C:\Windows\System32\UTolVwM.exe
  2⤵
  PID:7224
- C:\Windows\System32\oQdHXYK.exe
  C:\Windows\System32\oQdHXYK.exe
  2⤵
  PID:7264
- C:\Windows\System32\nYKfeCU.exe
  C:\Windows\System32\nYKfeCU.exe
  2⤵
  PID:7320
- C:\Windows\System32\OqRfVWD.exe
  C:\Windows\System32\OqRfVWD.exe
  2⤵
  PID:7336
- C:\Windows\System32\jUkZuNV.exe
  C:\Windows\System32\jUkZuNV.exe
  2⤵
  PID:7424
- C:\Windows\System32\SFpFuiK.exe
  C:\Windows\System32\SFpFuiK.exe
  2⤵
  PID:7568
- C:\Windows\System32\OhIDGrn.exe
  C:\Windows\System32\OhIDGrn.exe
  2⤵
  PID:7620
- C:\Windows\System32\tkPbgJg.exe
  C:\Windows\System32\tkPbgJg.exe
  2⤵
  PID:7676
- C:\Windows\System32\LIGzmLW.exe
  C:\Windows\System32\LIGzmLW.exe
  2⤵
  PID:7740
- C:\Windows\System32\wgorOsh.exe
  C:\Windows\System32\wgorOsh.exe
  2⤵
  PID:7800
- C:\Windows\System32\rgYJLNc.exe
  C:\Windows\System32\rgYJLNc.exe
  2⤵
  PID:7868
- C:\Windows\System32\DWnYqWe.exe
  C:\Windows\System32\DWnYqWe.exe
  2⤵
  PID:7952
- C:\Windows\System32\TEHhWVq.exe
  C:\Windows\System32\TEHhWVq.exe
  2⤵
  PID:8028
- C:\Windows\System32\QVGqmuj.exe
  C:\Windows\System32\QVGqmuj.exe
  2⤵
  PID:8072
- C:\Windows\System32\cRyLWkI.exe
  C:\Windows\System32\cRyLWkI.exe
  2⤵
  PID:8108
- C:\Windows\System32\flZkLTc.exe
  C:\Windows\System32\flZkLTc.exe
  2⤵
  PID:7248
- C:\Windows\System32\ZnVSKcr.exe
  C:\Windows\System32\ZnVSKcr.exe
  2⤵
  PID:7340
- C:\Windows\System32\jWKFjPS.exe
  C:\Windows\System32\jWKFjPS.exe
  2⤵
  PID:7516
- C:\Windows\System32\eTmYGJy.exe
  C:\Windows\System32\eTmYGJy.exe
  2⤵
  PID:7648
- C:\Windows\System32\qaesFEJ.exe
  C:\Windows\System32\qaesFEJ.exe
  2⤵
  PID:7788
- C:\Windows\System32\wpGEzVd.exe
  C:\Windows\System32\wpGEzVd.exe
  2⤵
  PID:7940
- C:\Windows\System32\DztWkND.exe
  C:\Windows\System32\DztWkND.exe
  2⤵
  PID:8088
- C:\Windows\System32\Wzzoypv.exe
  C:\Windows\System32\Wzzoypv.exe
  2⤵
  PID:7300
- C:\Windows\System32\CjrFNkF.exe
  C:\Windows\System32\CjrFNkF.exe
  2⤵
  PID:7592
- C:\Windows\System32\AHBjWmI.exe
  C:\Windows\System32\AHBjWmI.exe
  2⤵
  PID:7632
- C:\Windows\System32\UmajkNY.exe
  C:\Windows\System32\UmajkNY.exe
  2⤵
  PID:8196
- C:\Windows\System32\qavefTR.exe
  C:\Windows\System32\qavefTR.exe
  2⤵
  PID:8216
- C:\Windows\System32\DGGcnjQ.exe
  C:\Windows\System32\DGGcnjQ.exe
  2⤵
  PID:8248
- C:\Windows\System32\OUMWNaf.exe
  C:\Windows\System32\OUMWNaf.exe
  2⤵
  PID:8276
- C:\Windows\System32\UKFHCIH.exe
  C:\Windows\System32\UKFHCIH.exe
  2⤵
  PID:8328
- C:\Windows\System32\UpePSWC.exe
  C:\Windows\System32\UpePSWC.exe
  2⤵
  PID:8348
- C:\Windows\System32\kBSRkKd.exe
  C:\Windows\System32\kBSRkKd.exe
  2⤵
  PID:8392
- C:\Windows\System32\xFsZRGj.exe
  C:\Windows\System32\xFsZRGj.exe
  2⤵
  PID:8436
- C:\Windows\System32\HjOlBSZ.exe
  C:\Windows\System32\HjOlBSZ.exe
  2⤵
  PID:8456
- C:\Windows\System32\HxewbOH.exe
  C:\Windows\System32\HxewbOH.exe
  2⤵
  PID:8480
- C:\Windows\System32\vGTZDrR.exe
  C:\Windows\System32\vGTZDrR.exe
  2⤵
  PID:8496
- C:\Windows\System32\pRmzGuI.exe
  C:\Windows\System32\pRmzGuI.exe
  2⤵
  PID:8544
- C:\Windows\System32\GRcWqjv.exe
  C:\Windows\System32\GRcWqjv.exe
  2⤵
  PID:8564
- C:\Windows\System32\TRLtEGS.exe
  C:\Windows\System32\TRLtEGS.exe
  2⤵
  PID:8604
- C:\Windows\System32\KtbGluy.exe
  C:\Windows\System32\KtbGluy.exe
  2⤵
  PID:8624
- C:\Windows\System32\DVRyeGH.exe
  C:\Windows\System32\DVRyeGH.exe
  2⤵
  PID:8648
- C:\Windows\System32\JwKTXRA.exe
  C:\Windows\System32\JwKTXRA.exe
  2⤵
  PID:8684
- C:\Windows\System32\ziFukKa.exe
  C:\Windows\System32\ziFukKa.exe
  2⤵
  PID:8704
- C:\Windows\System32\kTXcnLM.exe
  C:\Windows\System32\kTXcnLM.exe
  2⤵
  PID:8728
- C:\Windows\System32\bnIObIk.exe
  C:\Windows\System32\bnIObIk.exe
  2⤵
  PID:8756
- C:\Windows\System32\xNfCMFP.exe
  C:\Windows\System32\xNfCMFP.exe
  2⤵
  PID:8788
- C:\Windows\System32\OHtXtNm.exe
  C:\Windows\System32\OHtXtNm.exe
  2⤵
  PID:8804
- C:\Windows\System32\cGmusjd.exe
  C:\Windows\System32\cGmusjd.exe
  2⤵
  PID:8868
- C:\Windows\System32\Kfldpcd.exe
  C:\Windows\System32\Kfldpcd.exe
  2⤵
  PID:8884
- C:\Windows\System32\UFtVHAm.exe
  C:\Windows\System32\UFtVHAm.exe
  2⤵
  PID:8900
- C:\Windows\System32\hfyCSdh.exe
  C:\Windows\System32\hfyCSdh.exe
  2⤵
  PID:8940
- C:\Windows\System32\beEJxSH.exe
  C:\Windows\System32\beEJxSH.exe
  2⤵
  PID:8968
- C:\Windows\System32\maoyxKH.exe
  C:\Windows\System32\maoyxKH.exe
  2⤵
  PID:8992
- C:\Windows\System32\ZDFUDCI.exe
  C:\Windows\System32\ZDFUDCI.exe
  2⤵
  PID:9012
- C:\Windows\System32\jHoJLcj.exe
  C:\Windows\System32\jHoJLcj.exe
  2⤵
  PID:9052
- C:\Windows\System32\sCqoYzd.exe
  C:\Windows\System32\sCqoYzd.exe
  2⤵
  PID:9084
- C:\Windows\System32\ATfXYhz.exe
  C:\Windows\System32\ATfXYhz.exe
  2⤵
  PID:9108
- C:\Windows\System32\SONgEQs.exe
  C:\Windows\System32\SONgEQs.exe
  2⤵
  PID:9124
- C:\Windows\System32\fhoUSAJ.exe
  C:\Windows\System32\fhoUSAJ.exe
  2⤵
  PID:9144
- C:\Windows\System32\bjSFMVX.exe
  C:\Windows\System32\bjSFMVX.exe
  2⤵
  PID:9176
- C:\Windows\System32\THzuhQK.exe
  C:\Windows\System32\THzuhQK.exe
  2⤵
  PID:7220
- C:\Windows\System32\ZRjIdCZ.exe
  C:\Windows\System32\ZRjIdCZ.exe
  2⤵
  PID:7936
- C:\Windows\System32\pNeIghO.exe
  C:\Windows\System32\pNeIghO.exe
  2⤵
  PID:8388
- C:\Windows\System32\WmnlUOl.exe
  C:\Windows\System32\WmnlUOl.exe
  2⤵
  PID:8508
- C:\Windows\System32\uldrJrX.exe
  C:\Windows\System32\uldrJrX.exe
  2⤵
  PID:8612
- C:\Windows\System32\NppzjKl.exe
  C:\Windows\System32\NppzjKl.exe
  2⤵
  PID:8644
- C:\Windows\System32\mBYUcYE.exe
  C:\Windows\System32\mBYUcYE.exe
  2⤵
  PID:8692
- C:\Windows\System32\qvOjRCY.exe
  C:\Windows\System32\qvOjRCY.exe
  2⤵
  PID:8744
- C:\Windows\System32\KKrkRrV.exe
  C:\Windows\System32\KKrkRrV.exe
  2⤵
  PID:8768
- C:\Windows\System32\VEQlUzv.exe
  C:\Windows\System32\VEQlUzv.exe
  2⤵
  PID:8800
- C:\Windows\System32\LpXtItQ.exe
  C:\Windows\System32\LpXtItQ.exe
  2⤵
  PID:8828
- C:\Windows\System32\GyqWfMB.exe
  C:\Windows\System32\GyqWfMB.exe
  2⤵
  PID:8880
- C:\Windows\System32\afkhwfW.exe
  C:\Windows\System32\afkhwfW.exe
  2⤵
  PID:8952
- C:\Windows\System32\PMRTVAu.exe
  C:\Windows\System32\PMRTVAu.exe
  2⤵
  PID:9204
- C:\Windows\System32\GyRjOwX.exe
  C:\Windows\System32\GyRjOwX.exe
  2⤵
  PID:8224
- C:\Windows\System32\YBmOQjm.exe
  C:\Windows\System32\YBmOQjm.exe
  2⤵
  PID:8288
- C:\Windows\System32\ZMYshJz.exe
  C:\Windows\System32\ZMYshJz.exe
  2⤵
  PID:8164
- C:\Windows\System32\JGSjTCR.exe
  C:\Windows\System32\JGSjTCR.exe
  2⤵
  PID:8552
- C:\Windows\System32\ieZjffQ.exe
  C:\Windows\System32\ieZjffQ.exe
  2⤵
  PID:8408
- C:\Windows\System32\xtYpkNV.exe
  C:\Windows\System32\xtYpkNV.exe
  2⤵
  PID:8700
- C:\Windows\System32\qXnIMlx.exe
  C:\Windows\System32\qXnIMlx.exe
  2⤵
  PID:8832
- C:\Windows\System32\lMMFOqA.exe
  C:\Windows\System32\lMMFOqA.exe
  2⤵
  PID:9008
- C:\Windows\System32\AJDBpwA.exe
  C:\Windows\System32\AJDBpwA.exe
  2⤵
  PID:9140
- C:\Windows\System32\wxlFqar.exe
  C:\Windows\System32\wxlFqar.exe
  2⤵
  PID:8320
- C:\Windows\System32\pFYIDpR.exe
  C:\Windows\System32\pFYIDpR.exe
  2⤵
  PID:8476
- C:\Windows\System32\SwbOXAG.exe
  C:\Windows\System32\SwbOXAG.exe
  2⤵
  PID:8368
- C:\Windows\System32\HcziUZk.exe
  C:\Windows\System32\HcziUZk.exe
  2⤵
  PID:9040
- C:\Windows\System32\ijBADpZ.exe
  C:\Windows\System32\ijBADpZ.exe
  2⤵
  PID:8340
- C:\Windows\System32\BibNNYR.exe
  C:\Windows\System32\BibNNYR.exe
  2⤵
  PID:8468
- C:\Windows\System32\YJffaOx.exe
  C:\Windows\System32\YJffaOx.exe
  2⤵
  PID:8316
- C:\Windows\System32\dfGBMxr.exe
  C:\Windows\System32\dfGBMxr.exe
  2⤵
  PID:9228
- C:\Windows\System32\jbBNoEJ.exe
  C:\Windows\System32\jbBNoEJ.exe
  2⤵
  PID:9268
- C:\Windows\System32\tJydsLH.exe
  C:\Windows\System32\tJydsLH.exe
  2⤵
  PID:9300
- C:\Windows\System32\EfMUHAX.exe
  C:\Windows\System32\EfMUHAX.exe
  2⤵
  PID:9348
- C:\Windows\System32\EbCoUfb.exe
  C:\Windows\System32\EbCoUfb.exe
  2⤵
  PID:9380
- C:\Windows\System32\mTuvwny.exe
  C:\Windows\System32\mTuvwny.exe
  2⤵
  PID:9400
- C:\Windows\System32\fUzGTHR.exe
  C:\Windows\System32\fUzGTHR.exe
  2⤵
  PID:9428
- C:\Windows\System32\VcXDigN.exe
  C:\Windows\System32\VcXDigN.exe
  2⤵
  PID:9460
- C:\Windows\System32\gyVsrmW.exe
  C:\Windows\System32\gyVsrmW.exe
  2⤵
  PID:9488
- C:\Windows\System32\pFqxXOO.exe
  C:\Windows\System32\pFqxXOO.exe
  2⤵
  PID:9520
- C:\Windows\System32\WNMfQfs.exe
  C:\Windows\System32\WNMfQfs.exe
  2⤵
  PID:9540
- C:\Windows\System32\qFwtVyW.exe
  C:\Windows\System32\qFwtVyW.exe
  2⤵
  PID:9572
- C:\Windows\System32\Dlidohp.exe
  C:\Windows\System32\Dlidohp.exe
  2⤵
  PID:9608
- C:\Windows\System32\YQLAyba.exe
  C:\Windows\System32\YQLAyba.exe
  2⤵
  PID:9632
- C:\Windows\System32\EDkZQaX.exe
  C:\Windows\System32\EDkZQaX.exe
  2⤵
  PID:9668
- C:\Windows\System32\GZZTeRh.exe
  C:\Windows\System32\GZZTeRh.exe
  2⤵
  PID:9688
- C:\Windows\System32\RvGFCRZ.exe
  C:\Windows\System32\RvGFCRZ.exe
  2⤵
  PID:9716
- C:\Windows\System32\ZtXeepk.exe
  C:\Windows\System32\ZtXeepk.exe
  2⤵
  PID:9756
- C:\Windows\System32\pbePoxG.exe
  C:\Windows\System32\pbePoxG.exe
  2⤵
  PID:9784
- C:\Windows\System32\phqsRwJ.exe
  C:\Windows\System32\phqsRwJ.exe
  2⤵
  PID:9812
- C:\Windows\System32\CSKjZeO.exe
  C:\Windows\System32\CSKjZeO.exe
  2⤵
  PID:9832
- C:\Windows\System32\ZqtkBFz.exe
  C:\Windows\System32\ZqtkBFz.exe
  2⤵
  PID:9856
- C:\Windows\System32\QbkPgrB.exe
  C:\Windows\System32\QbkPgrB.exe
  2⤵
  PID:9896
- C:\Windows\System32\iDvoYwt.exe
  C:\Windows\System32\iDvoYwt.exe
  2⤵
  PID:9932
- C:\Windows\System32\EmVeIHW.exe
  C:\Windows\System32\EmVeIHW.exe
  2⤵
  PID:9960
- C:\Windows\System32\njNWdGF.exe
  C:\Windows\System32\njNWdGF.exe
  2⤵
  PID:9980
- C:\Windows\System32\ZEhicpn.exe
  C:\Windows\System32\ZEhicpn.exe
  2⤵
  PID:9996
- C:\Windows\System32\FhwDxjl.exe
  C:\Windows\System32\FhwDxjl.exe
  2⤵
  PID:10024
- C:\Windows\System32\pwsdmtS.exe
  C:\Windows\System32\pwsdmtS.exe
  2⤵
  PID:10052
- C:\Windows\System32\mulKcSb.exe
  C:\Windows\System32\mulKcSb.exe
  2⤵
  PID:10072
- C:\Windows\System32\gdMuPqA.exe
  C:\Windows\System32\gdMuPqA.exe
  2⤵
  PID:10104
- C:\Windows\System32\gQkIZQI.exe
  C:\Windows\System32\gQkIZQI.exe
  2⤵
  PID:10124
- C:\Windows\System32\hFxFLKA.exe
  C:\Windows\System32\hFxFLKA.exe
  2⤵
  PID:10144
- C:\Windows\System32\PgpoRDB.exe
  C:\Windows\System32\PgpoRDB.exe
  2⤵
  PID:10200
- C:\Windows\System32\XHqApLA.exe
  C:\Windows\System32\XHqApLA.exe
  2⤵
  PID:9096
- C:\Windows\System32\AdaCKSh.exe
  C:\Windows\System32\AdaCKSh.exe
  2⤵
  PID:8540
- C:\Windows\System32\DttetRy.exe
  C:\Windows\System32\DttetRy.exe
  2⤵
  PID:9248
- C:\Windows\System32\EQTglbq.exe
  C:\Windows\System32\EQTglbq.exe
  2⤵
  PID:9388
- C:\Windows\System32\VBerNOL.exe
  C:\Windows\System32\VBerNOL.exe
  2⤵
  PID:9412
- C:\Windows\System32\TFzAtZi.exe
  C:\Windows\System32\TFzAtZi.exe
  2⤵
  PID:9472
- C:\Windows\System32\sgNbqxp.exe
  C:\Windows\System32\sgNbqxp.exe
  2⤵
  PID:9536
- C:\Windows\System32\GbAjcHo.exe
  C:\Windows\System32\GbAjcHo.exe
  2⤵
  PID:9628
- C:\Windows\System32\ufkAiiM.exe
  C:\Windows\System32\ufkAiiM.exe
  2⤵
  PID:9700
- C:\Windows\System32\vwxrtww.exe
  C:\Windows\System32\vwxrtww.exe
  2⤵
  PID:9780
- C:\Windows\System32\UBTYllR.exe
  C:\Windows\System32\UBTYllR.exe
  2⤵
  PID:9828
- C:\Windows\System32\NWDrubs.exe
  C:\Windows\System32\NWDrubs.exe
  2⤵
  PID:9916
- C:\Windows\System32\aYyeffy.exe
  C:\Windows\System32\aYyeffy.exe
  2⤵
  PID:9972
- C:\Windows\System32\GziUuzD.exe
  C:\Windows\System32\GziUuzD.exe
  2⤵
  PID:9992
- C:\Windows\System32\fiWsQfz.exe
  C:\Windows\System32\fiWsQfz.exe
  2⤵
  PID:10088
- C:\Windows\System32\VjHaNWk.exe
  C:\Windows\System32\VjHaNWk.exe
  2⤵
  PID:10160
- C:\Windows\System32\YXGMDLf.exe
  C:\Windows\System32\YXGMDLf.exe
  2⤵
  PID:9236
- C:\Windows\System32\ZtqSwgk.exe
  C:\Windows\System32\ZtqSwgk.exe
  2⤵
  PID:8268
- C:\Windows\System32\QKMkLrj.exe
  C:\Windows\System32\QKMkLrj.exe
  2⤵
  PID:9396
- C:\Windows\System32\RnesZPT.exe
  C:\Windows\System32\RnesZPT.exe
  2⤵
  PID:9568
- C:\Windows\System32\NMHxqaj.exe
  C:\Windows\System32\NMHxqaj.exe
  2⤵
  PID:9676
- C:\Windows\System32\MivWYzB.exe
  C:\Windows\System32\MivWYzB.exe
  2⤵
  PID:9968
- C:\Windows\System32\lRwhlUL.exe
  C:\Windows\System32\lRwhlUL.exe
  2⤵
  PID:10116
- C:\Windows\System32\yoVqJyk.exe
  C:\Windows\System32\yoVqJyk.exe
  2⤵
  PID:9448
- C:\Windows\System32\qADhlPl.exe
  C:\Windows\System32\qADhlPl.exe
  2⤵
  PID:9588
- C:\Windows\System32\zaIUbuC.exe
  C:\Windows\System32\zaIUbuC.exe
  2⤵
  PID:9772
- C:\Windows\System32\pyItEDZ.exe
  C:\Windows\System32\pyItEDZ.exe
  2⤵
  PID:10208
- C:\Windows\System32\hTeWECV.exe
  C:\Windows\System32\hTeWECV.exe
  2⤵
  PID:10036
- C:\Windows\System32\YQDtNUn.exe
  C:\Windows\System32\YQDtNUn.exe
  2⤵
  PID:10256
- C:\Windows\System32\XtFHyxM.exe
  C:\Windows\System32\XtFHyxM.exe
  2⤵
  PID:10284
- C:\Windows\System32\nVzYiLm.exe
  C:\Windows\System32\nVzYiLm.exe
  2⤵
  PID:10316
- C:\Windows\System32\jZZqeKt.exe
  C:\Windows\System32\jZZqeKt.exe
  2⤵
  PID:10340
- C:\Windows\System32\UlGtZGb.exe
  C:\Windows\System32\UlGtZGb.exe
  2⤵
  PID:10356
- C:\Windows\System32\mWejZcj.exe
  C:\Windows\System32\mWejZcj.exe
  2⤵
  PID:10372
- C:\Windows\System32\sOQtomv.exe
  C:\Windows\System32\sOQtomv.exe
  2⤵
  PID:10388
- C:\Windows\System32\bMBwNTv.exe
  C:\Windows\System32\bMBwNTv.exe
  2⤵
  PID:10428
- C:\Windows\System32\kdaNhzs.exe
  C:\Windows\System32\kdaNhzs.exe
  2⤵
  PID:10452
- C:\Windows\System32\bgRVFAI.exe
  C:\Windows\System32\bgRVFAI.exe
  2⤵
  PID:10496
- C:\Windows\System32\eOkHalR.exe
  C:\Windows\System32\eOkHalR.exe
  2⤵
  PID:10524
- C:\Windows\System32\wvKtJyO.exe
  C:\Windows\System32\wvKtJyO.exe
  2⤵
  PID:10552
- C:\Windows\System32\AosfNVq.exe
  C:\Windows\System32\AosfNVq.exe
  2⤵
  PID:10592
- C:\Windows\System32\lauCFEq.exe
  C:\Windows\System32\lauCFEq.exe
  2⤵
  PID:10608
- C:\Windows\System32\EhDKeuL.exe
  C:\Windows\System32\EhDKeuL.exe
  2⤵
  PID:10628
- C:\Windows\System32\NUChsEn.exe
  C:\Windows\System32\NUChsEn.exe
  2⤵
  PID:10652
- C:\Windows\System32\MvBHXqc.exe
  C:\Windows\System32\MvBHXqc.exe
  2⤵
  PID:10688
- C:\Windows\System32\QCJoCSN.exe
  C:\Windows\System32\QCJoCSN.exe
  2⤵
  PID:10724
- C:\Windows\System32\JKqPpnW.exe
  C:\Windows\System32\JKqPpnW.exe
  2⤵
  PID:10760
- C:\Windows\System32\CjNsgps.exe
  C:\Windows\System32\CjNsgps.exe
  2⤵
  PID:10788
- C:\Windows\System32\syxpajs.exe
  C:\Windows\System32\syxpajs.exe
  2⤵
  PID:10816
- C:\Windows\System32\UDJBajx.exe
  C:\Windows\System32\UDJBajx.exe
  2⤵
  PID:10840
- C:\Windows\System32\qEIIsGl.exe
  C:\Windows\System32\qEIIsGl.exe
  2⤵
  PID:10860
- C:\Windows\System32\gSyBLSK.exe
  C:\Windows\System32\gSyBLSK.exe
  2⤵
  PID:10904
- C:\Windows\System32\UNeDwmy.exe
  C:\Windows\System32\UNeDwmy.exe
  2⤵
  PID:10924
- C:\Windows\System32\pULbyWA.exe
  C:\Windows\System32\pULbyWA.exe
  2⤵
  PID:10940
- C:\Windows\System32\CvMmmjM.exe
  C:\Windows\System32\CvMmmjM.exe
  2⤵
  PID:10972
- C:\Windows\System32\wDQwPNV.exe
  C:\Windows\System32\wDQwPNV.exe
  2⤵
  PID:11016
- C:\Windows\System32\RlOYNGP.exe
  C:\Windows\System32\RlOYNGP.exe
  2⤵
  PID:11052
- C:\Windows\System32\jMPNGro.exe
  C:\Windows\System32\jMPNGro.exe
  2⤵
  PID:11076
- C:\Windows\System32\LFWODLQ.exe
  C:\Windows\System32\LFWODLQ.exe
  2⤵
  PID:11100
- C:\Windows\System32\KjwQghf.exe
  C:\Windows\System32\KjwQghf.exe
  2⤵
  PID:11128
- C:\Windows\System32\OdszODy.exe
  C:\Windows\System32\OdszODy.exe
  2⤵
  PID:11144
- C:\Windows\System32\xVsEkdj.exe
  C:\Windows\System32\xVsEkdj.exe
  2⤵
  PID:11188
- C:\Windows\System32\KWaphLk.exe
  C:\Windows\System32\KWaphLk.exe
  2⤵
  PID:11204
- C:\Windows\System32\nFKYpuT.exe
  C:\Windows\System32\nFKYpuT.exe
  2⤵
  PID:11232
- C:\Windows\System32\arKqnvx.exe
  C:\Windows\System32\arKqnvx.exe
  2⤵
  PID:11252
- C:\Windows\System32\tzfjwyS.exe
  C:\Windows\System32\tzfjwyS.exe
  2⤵
  PID:10308
- C:\Windows\System32\xlyboXi.exe
  C:\Windows\System32\xlyboXi.exe
  2⤵
  PID:10364
- C:\Windows\System32\HvZXBUx.exe
  C:\Windows\System32\HvZXBUx.exe
  2⤵
  PID:10436
- C:\Windows\System32\bCKeRIw.exe
  C:\Windows\System32\bCKeRIw.exe
  2⤵
  PID:10520
- C:\Windows\System32\ZNyVBKn.exe
  C:\Windows\System32\ZNyVBKn.exe
  2⤵
  PID:10508
- C:\Windows\System32\nQhyAqT.exe
  C:\Windows\System32\nQhyAqT.exe
  2⤵
  PID:10604
- C:\Windows\System32\rYPEViX.exe
  C:\Windows\System32\rYPEViX.exe
  2⤵
  PID:10660
- C:\Windows\System32\ZUKgRXa.exe
  C:\Windows\System32\ZUKgRXa.exe
  2⤵
  PID:10784
- C:\Windows\System32\TfxDjsP.exe
  C:\Windows\System32\TfxDjsP.exe
  2⤵
  PID:10828
- C:\Windows\System32\xxcDUDp.exe
  C:\Windows\System32\xxcDUDp.exe
  2⤵
  PID:10856
- C:\Windows\System32\vPkLCyD.exe
  C:\Windows\System32\vPkLCyD.exe
  2⤵
  PID:10948
- C:\Windows\System32\BDXFprk.exe
  C:\Windows\System32\BDXFprk.exe
  2⤵
  PID:10996
- C:\Windows\System32\iWNJhPL.exe
  C:\Windows\System32\iWNJhPL.exe
  2⤵
  PID:11044
- C:\Windows\System32\GniLfFY.exe
  C:\Windows\System32\GniLfFY.exe
  2⤵
  PID:11168
- C:\Windows\System32\GtlOATp.exe
  C:\Windows\System32\GtlOATp.exe
  2⤵
  PID:11216
- C:\Windows\System32\WWCEmWF.exe
  C:\Windows\System32\WWCEmWF.exe
  2⤵
  PID:11244
- C:\Windows\System32\OZodlrE.exe
  C:\Windows\System32\OZodlrE.exe
  2⤵
  PID:10336
- C:\Windows\System32\imwxEBO.exe
  C:\Windows\System32\imwxEBO.exe
  2⤵
  PID:10624
- C:\Windows\System32\DXHWKAz.exe
  C:\Windows\System32\DXHWKAz.exe
  2⤵
  PID:10676
- C:\Windows\System32\ebPBsyP.exe
  C:\Windows\System32\ebPBsyP.exe
  2⤵
  PID:10804
- C:\Windows\System32\zrzXzJe.exe
  C:\Windows\System32\zrzXzJe.exe
  2⤵
  PID:11108
- C:\Windows\System32\QnkkxuH.exe
  C:\Windows\System32\QnkkxuH.exe
  2⤵
  PID:11200
- C:\Windows\System32\tWiQXbQ.exe
  C:\Windows\System32\tWiQXbQ.exe
  2⤵
  PID:10296
- C:\Windows\System32\kyDfciY.exe
  C:\Windows\System32\kyDfciY.exe
  2⤵
  PID:10812
- C:\Windows\System32\eioCTtj.exe
  C:\Windows\System32\eioCTtj.exe
  2⤵
  PID:11184
- C:\Windows\System32\nSmwfmI.exe
  C:\Windows\System32\nSmwfmI.exe
  2⤵
  PID:10444
- C:\Windows\System32\eiXXWfv.exe
  C:\Windows\System32\eiXXWfv.exe
  2⤵
  PID:11280
- C:\Windows\System32\RbDkcJm.exe
  C:\Windows\System32\RbDkcJm.exe
  2⤵
  PID:11300
- C:\Windows\System32\fngTLRb.exe
  C:\Windows\System32\fngTLRb.exe
  2⤵
  PID:11316
- C:\Windows\System32\KtQdggm.exe
  C:\Windows\System32\KtQdggm.exe
  2⤵
  PID:11332
- C:\Windows\System32\LBGJKuw.exe
  C:\Windows\System32\LBGJKuw.exe
  2⤵
  PID:11360
- C:\Windows\System32\sVzRgbZ.exe
  C:\Windows\System32\sVzRgbZ.exe
  2⤵
  PID:11380
- C:\Windows\System32\GrzFffY.exe
  C:\Windows\System32\GrzFffY.exe
  2⤵
  PID:11396
- C:\Windows\System32\EojsyDK.exe
  C:\Windows\System32\EojsyDK.exe
  2⤵
  PID:11432
- C:\Windows\System32\ZKzUVEe.exe
  C:\Windows\System32\ZKzUVEe.exe
  2⤵
  PID:11492
- C:\Windows\System32\TbnQbUs.exe
  C:\Windows\System32\TbnQbUs.exe
  2⤵
  PID:11508
- C:\Windows\System32\kUkdOKD.exe
  C:\Windows\System32\kUkdOKD.exe
  2⤵
  PID:11556
- C:\Windows\System32\mbZAWfa.exe
  C:\Windows\System32\mbZAWfa.exe
  2⤵
  PID:11576
- C:\Windows\System32\mlcbFnV.exe
  C:\Windows\System32\mlcbFnV.exe
  2⤵
  PID:11600
- C:\Windows\System32\BmYQXsQ.exe
  C:\Windows\System32\BmYQXsQ.exe
  2⤵
  PID:11616
- C:\Windows\System32\hOAutGT.exe
  C:\Windows\System32\hOAutGT.exe
  2⤵
  PID:11636
- C:\Windows\System32\NdNbCMh.exe
  C:\Windows\System32\NdNbCMh.exe
  2⤵
  PID:11664
- C:\Windows\System32\DaQYBMx.exe
  C:\Windows\System32\DaQYBMx.exe
  2⤵
  PID:11684
- C:\Windows\System32\xQGAZFa.exe
  C:\Windows\System32\xQGAZFa.exe
  2⤵
  PID:11736
- C:\Windows\System32\JrSiYFg.exe
  C:\Windows\System32\JrSiYFg.exe
  2⤵
  PID:11752
- C:\Windows\System32\vydcDqX.exe
  C:\Windows\System32\vydcDqX.exe
  2⤵
  PID:11776
- C:\Windows\System32\zVbqMfr.exe
  C:\Windows\System32\zVbqMfr.exe
  2⤵
  PID:11800
- C:\Windows\System32\mNNozrk.exe
  C:\Windows\System32\mNNozrk.exe
  2⤵
  PID:11832
- C:\Windows\System32\ZuLZrpm.exe
  C:\Windows\System32\ZuLZrpm.exe
  2⤵
  PID:11892
- C:\Windows\System32\jqfBwXO.exe
  C:\Windows\System32\jqfBwXO.exe
  2⤵
  PID:11920
- C:\Windows\System32\FMPYwAu.exe
  C:\Windows\System32\FMPYwAu.exe
  2⤵
  PID:11940
- C:\Windows\System32\qBbuhoB.exe
  C:\Windows\System32\qBbuhoB.exe
  2⤵
  PID:11964
- C:\Windows\System32\cVnSjxe.exe
  C:\Windows\System32\cVnSjxe.exe
  2⤵
  PID:11980
- C:\Windows\System32\OxhYcQy.exe
  C:\Windows\System32\OxhYcQy.exe
  2⤵
  PID:12000
- C:\Windows\System32\MfQKIFV.exe
  C:\Windows\System32\MfQKIFV.exe
  2⤵
  PID:12016
- C:\Windows\System32\MNligkF.exe
  C:\Windows\System32\MNligkF.exe
  2⤵
  PID:12068
- C:\Windows\System32\QMlKIPU.exe
  C:\Windows\System32\QMlKIPU.exe
  2⤵
  PID:12100
- C:\Windows\System32\txVMzLh.exe
  C:\Windows\System32\txVMzLh.exe
  2⤵
  PID:12120
- C:\Windows\System32\YXaUHbP.exe
  C:\Windows\System32\YXaUHbP.exe
  2⤵
  PID:12144
- C:\Windows\System32\SHowuja.exe
  C:\Windows\System32\SHowuja.exe
  2⤵
  PID:12168
- C:\Windows\System32\rRCVsQx.exe
  C:\Windows\System32\rRCVsQx.exe
  2⤵
  PID:12192
- C:\Windows\System32\gZHbzRx.exe
  C:\Windows\System32\gZHbzRx.exe
  2⤵
  PID:12256
- C:\Windows\System32\PaPZePA.exe
  C:\Windows\System32\PaPZePA.exe
  2⤵
  PID:11248
- C:\Windows\System32\WTfIHkZ.exe
  C:\Windows\System32\WTfIHkZ.exe
  2⤵
  PID:11296
- C:\Windows\System32\NzEKCZk.exe
  C:\Windows\System32\NzEKCZk.exe
  2⤵
  PID:11344
- C:\Windows\System32\XRnmZiB.exe
  C:\Windows\System32\XRnmZiB.exe
  2⤵
  PID:11412
- C:\Windows\System32\FwXoBkU.exe
  C:\Windows\System32\FwXoBkU.exe
  2⤵
  PID:11504
- C:\Windows\System32\DmxXZOH.exe
  C:\Windows\System32\DmxXZOH.exe
  2⤵
  PID:11532
- C:\Windows\System32\iBCGINz.exe
  C:\Windows\System32\iBCGINz.exe
  2⤵
  PID:11596
- C:\Windows\System32\pGEaieC.exe
  C:\Windows\System32\pGEaieC.exe
  2⤵
  PID:11632
- C:\Windows\System32\jfrBAmi.exe
  C:\Windows\System32\jfrBAmi.exe
  2⤵
  PID:11720
- C:\Windows\System32\sYhhqJP.exe
  C:\Windows\System32\sYhhqJP.exe
  2⤵
  PID:11788
- C:\Windows\System32\NbUadcj.exe
  C:\Windows\System32\NbUadcj.exe
  2⤵
  PID:11844
- C:\Windows\System32\ORmzpaY.exe
  C:\Windows\System32\ORmzpaY.exe
  2⤵
  PID:11876
- C:\Windows\System32\ahPVWII.exe
  C:\Windows\System32\ahPVWII.exe
  2⤵
  PID:11928
- C:\Windows\System32\CTUPraz.exe
  C:\Windows\System32\CTUPraz.exe
  2⤵
  PID:12116
- C:\Windows\System32\FBhfOwa.exe
  C:\Windows\System32\FBhfOwa.exe
  2⤵
  PID:12160
- C:\Windows\System32\rfohekK.exe
  C:\Windows\System32\rfohekK.exe
  2⤵
  PID:12184
- C:\Windows\System32\HrAfNNK.exe
  C:\Windows\System32\HrAfNNK.exe
  2⤵
  PID:12276
- C:\Windows\System32\BZyVgHv.exe
  C:\Windows\System32\BZyVgHv.exe
  2⤵
  PID:11456
- C:\Windows\System32\KDKNmli.exe
  C:\Windows\System32\KDKNmli.exe
  2⤵
  PID:11572
- C:\Windows\System32\sKuuENj.exe
  C:\Windows\System32\sKuuENj.exe
  2⤵
  PID:11744
- C:\Windows\System32\jIfXQpv.exe
  C:\Windows\System32\jIfXQpv.exe
  2⤵
  PID:11748
- C:\Windows\System32\xcifquY.exe
  C:\Windows\System32\xcifquY.exe
  2⤵
  PID:11976
- C:\Windows\System32\dgIVxpt.exe
  C:\Windows\System32\dgIVxpt.exe
  2⤵
  PID:12220
- C:\Windows\System32\BunStdZ.exe
  C:\Windows\System32\BunStdZ.exe
  2⤵
  PID:10752
- C:\Windows\System32\zglnyeo.exe
  C:\Windows\System32\zglnyeo.exe
  2⤵
  PID:11768
- C:\Windows\System32\tdINCnC.exe
  C:\Windows\System32\tdINCnC.exe
  2⤵
  PID:11904
- C:\Windows\System32\MbgtDmB.exe
  C:\Windows\System32\MbgtDmB.exe
  2⤵
  PID:12044
- C:\Windows\System32\NLKgfuz.exe
  C:\Windows\System32\NLKgfuz.exe
  2⤵
  PID:12300
- C:\Windows\System32\quymkTW.exe
  C:\Windows\System32\quymkTW.exe
  2⤵
  PID:12324
- C:\Windows\System32\tHCaLFK.exe
  C:\Windows\System32\tHCaLFK.exe
  2⤵
  PID:12356
- C:\Windows\System32\GCwxfHR.exe
  C:\Windows\System32\GCwxfHR.exe
  2⤵
  PID:12392
- C:\Windows\System32\sLzQORj.exe
  C:\Windows\System32\sLzQORj.exe
  2⤵
  PID:12420
- C:\Windows\System32\EKgoFEC.exe
  C:\Windows\System32\EKgoFEC.exe
  2⤵
  PID:12436
- C:\Windows\System32\HdwiRxn.exe
  C:\Windows\System32\HdwiRxn.exe
  2⤵
  PID:12476
- C:\Windows\System32\hSHdaOf.exe
  C:\Windows\System32\hSHdaOf.exe
  2⤵
  PID:12496
- C:\Windows\System32\dpTGGNR.exe
  C:\Windows\System32\dpTGGNR.exe
  2⤵
  PID:12524
- C:\Windows\System32\aFQqOsO.exe
  C:\Windows\System32\aFQqOsO.exe
  2⤵
  PID:12548
- C:\Windows\System32\LngAqHx.exe
  C:\Windows\System32\LngAqHx.exe
  2⤵
  PID:12576
- C:\Windows\System32\uYdxqek.exe
  C:\Windows\System32\uYdxqek.exe
  2⤵
  PID:12612
- C:\Windows\System32\RpOQiyU.exe
  C:\Windows\System32\RpOQiyU.exe
  2⤵
  PID:12632
- C:\Windows\System32\JPaMHiv.exe
  C:\Windows\System32\JPaMHiv.exe
  2⤵
  PID:12652
- C:\Windows\System32\CpylfmJ.exe
  C:\Windows\System32\CpylfmJ.exe
  2⤵
  PID:12668
- C:\Windows\System32\kXtgtkS.exe
  C:\Windows\System32\kXtgtkS.exe
  2⤵
  PID:12692
- C:\Windows\System32\ykrlkMd.exe
  C:\Windows\System32\ykrlkMd.exe
  2⤵
  PID:12736
- C:\Windows\System32\IdNWzcY.exe
  C:\Windows\System32\IdNWzcY.exe
  2⤵
  PID:12776
- C:\Windows\System32\hTVPkAm.exe
  C:\Windows\System32\hTVPkAm.exe
  2⤵
  PID:12800
- C:\Windows\System32\vwkhgBH.exe
  C:\Windows\System32\vwkhgBH.exe
  2⤵
  PID:12820
- C:\Windows\System32\bUTnKoe.exe
  C:\Windows\System32\bUTnKoe.exe
  2⤵
  PID:12848
- C:\Windows\System32\xumReKJ.exe
  C:\Windows\System32\xumReKJ.exe
  2⤵
  PID:12880
- C:\Windows\System32\ZPuTeFD.exe
  C:\Windows\System32\ZPuTeFD.exe
  2⤵
  PID:12932
- C:\Windows\System32\ovgfIXk.exe
  C:\Windows\System32\ovgfIXk.exe
  2⤵
  PID:12952
- C:\Windows\System32\TfHjPNQ.exe
  C:\Windows\System32\TfHjPNQ.exe
  2⤵
  PID:12980
- C:\Windows\System32\AYbiyUD.exe
  C:\Windows\System32\AYbiyUD.exe
  2⤵
  PID:13000
- C:\Windows\System32\bLjTdpo.exe
  C:\Windows\System32\bLjTdpo.exe
  2⤵
  PID:13036
- C:\Windows\System32\bOpuGGH.exe
  C:\Windows\System32\bOpuGGH.exe
  2⤵
  PID:13056
- C:\Windows\System32\hhCFiYH.exe
  C:\Windows\System32\hhCFiYH.exe
  2⤵
  PID:13088
- C:\Windows\System32\FjhBCqg.exe
  C:\Windows\System32\FjhBCqg.exe
  2⤵
  PID:13116
- C:\Windows\System32\bhRMRjf.exe
  C:\Windows\System32\bhRMRjf.exe
  2⤵
  PID:13140
- C:\Windows\System32\aeddyXA.exe
  C:\Windows\System32\aeddyXA.exe
  2⤵
  PID:13156
- C:\Windows\System32\zOhChIR.exe
  C:\Windows\System32\zOhChIR.exe
  2⤵
  PID:13184
- C:\Windows\System32\obHqnVR.exe
  C:\Windows\System32\obHqnVR.exe
  2⤵
  PID:13208
- C:\Windows\System32\FiCTxHj.exe
  C:\Windows\System32\FiCTxHj.exe
  2⤵
  PID:13252
- C:\Windows\System32\VpNaHVu.exe
  C:\Windows\System32\VpNaHVu.exe
  2⤵
  PID:13272
- C:\Windows\System32\FpaEsVH.exe
  C:\Windows\System32\FpaEsVH.exe
  2⤵
  PID:13288
- C:\Windows\System32\wemWats.exe
  C:\Windows\System32\wemWats.exe
  2⤵
  PID:11372
- C:\Windows\System32\VCSgCLQ.exe
  C:\Windows\System32\VCSgCLQ.exe
  2⤵
  PID:4396
- C:\Windows\System32\KMwvtgH.exe
  C:\Windows\System32\KMwvtgH.exe
  2⤵
  PID:2840
- C:\Windows\System32\VAhtJrK.exe
  C:\Windows\System32\VAhtJrK.exe
  2⤵
  PID:12428
- C:\Windows\System32\RGzYSXo.exe
  C:\Windows\System32\RGzYSXo.exe
  2⤵
  PID:12484
- C:\Windows\System32\RarzRUi.exe
  C:\Windows\System32\RarzRUi.exe
  2⤵
  PID:12592
- C:\Windows\System32\ABXJgVm.exe
  C:\Windows\System32\ABXJgVm.exe
  2⤵
  PID:12624
- C:\Windows\System32\gJruECa.exe
  C:\Windows\System32\gJruECa.exe
  2⤵
  PID:12640
- C:\Windows\System32\EfIsJQD.exe
  C:\Windows\System32\EfIsJQD.exe
  2⤵
  PID:12716
- C:\Windows\System32\AImHCxA.exe
  C:\Windows\System32\AImHCxA.exe
  2⤵
  PID:12744
- C:\Windows\System32\FFLcrzw.exe
  C:\Windows\System32\FFLcrzw.exe
  2⤵
  PID:12832
- C:\Windows\System32\LkNLVru.exe
  C:\Windows\System32\LkNLVru.exe
  2⤵
  PID:2616
- C:\Windows\System32\gNGnaOC.exe
  C:\Windows\System32\gNGnaOC.exe
  2⤵
  PID:12916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\AhxsHWH.exe

Filesize
1.3MB

MD5
bc4aee5c455f087630aa43ab5768170f

SHA1
303630229578e1283644397a143e865cefe5054d

SHA256
90bc7c6826078c09389293e4ffb9b719f5d66ff52322ffc3ef71f51e27e5bcaf

SHA512
b4b2293f641eccb4c908ef284f61f839b10c0d252c4f0b69f229ef3c62efe8393411c97277fb2e8a4f7c3ea0ee5e9bfde2bdf5b74921a467f0ee72756d1871ef

Download Submit
C:\Windows\System32\AwuQotO.exe

Filesize
1.3MB

MD5
8f3cf4f16a172149c1481709941a6cbc

SHA1
04bf0e12ddb94a189976bdae747de0930b64c47e

SHA256
604227529cb346c6ced0514a8848c9007c0f33611ac44c3188e27cc44da20f2e

SHA512
fae0f25293d291c0f7add42f141dae40b3c4e10cbc3fe7fa111ab5050e476f2b4f3de650c9242122c12b1e4129aad040b0a686dec71a3240fbae11857479dcc9

Download Submit
C:\Windows\System32\DJqhVEI.exe

Filesize
1.3MB

MD5
cffcf1cf62a138379c9e8be2a10b45f1

SHA1
a7a39bdb18b22e58497061c7271cd9a2fa118b37

SHA256
7492038872cda4a3045673a54701ecb65eaa61e764b1cb7cde5f240a71cdf119

SHA512
f740d4e38abde39342ad1bc437efc4a09c853609afbf66ed391534660aa0e065e4225ed421a342aeca8f10e7d2c2b2aa1feeb75f24dd819299f32e219eb03014

Download Submit
C:\Windows\System32\FxNvPnO.exe

Filesize
1.3MB

MD5
a4997258ea098543ad40943693097e4b

SHA1
77abd310b57c5c64003f578741ca7ab0f45826c4

SHA256
d709ce0269ce507a1ba82c19651a42c6ee36a36541afe5d83283c184278c17f6

SHA512
1cdc09c60ed35c1717bdc1f6b643039be431bdf151a746470cb89083709038aeac2ffa7ec933755f776b0ab0d2eee2f9ebffe76381397516146e60b7cfdcb5a9

Download Submit
C:\Windows\System32\GHGHBBh.exe

Filesize
1.3MB

MD5
5a669f80235e971ee82aa817a684c89c

SHA1
e768c1da934cadebee64ccd97652ae2f93dad2a9

SHA256
4c7d4ee4caf4ae4535eb175160d3a887ec7a6b88fdd3504691257309f26622f2

SHA512
dd7c8bad2a7cb4c61591d6210861ba546c4577f7b7de3a9e4945a63164001464ffab83511a4b02c55c8dda12ca3638ce3443fc2eb73fdfa45cdf9dea827de6da

Download Submit
C:\Windows\System32\HFBxFeK.exe

Filesize
1.3MB

MD5
3f5d50bdf8b53ef8387e5bf47ae57fdc

SHA1
c65ef0dd9c3f8d1ad40585bc933ad9a4f9005a9d

SHA256
611d00d3776e79b05fbeace2d22b389648090ddafab9740671dceb2ac8158c4a

SHA512
45199890854593e2322255f4ef767c4d42a0831d86a7e2443ea7087343a91012fa1344f769eb79327d8c4d5f4e5607294624cfac8e2b8bf841ef5e72a3f97f63

Download Submit
C:\Windows\System32\IWYxTbO.exe

Filesize
1.3MB

MD5
dee2b0ad44023bba1b6accb3d03d7b3d

SHA1
9be83944b655d7cd24b3d80ff46c259bb2ab30a3

SHA256
4a148d0f78b7a04c797f9294bdaf627b0346ffe62eb5a9ecc169feb5872424d8

SHA512
907979e4bff6720227e3966428c04c1db8e41a3b984ba708994361232d10ef8531c5be3ba0bfdf7055b271b3f6c4f1fa0d7c1ddd719ae2b8a7046cc3ada519d2

Download Submit
C:\Windows\System32\IybrALI.exe

Filesize
1.3MB

MD5
4f9fc584f02e1157c391c760e508f19d

SHA1
a11d13d24b6407670fc4f0196e199f3a8ec714be

SHA256
57c1061c58c92821fd195b71669dcc21567c5c752748cc8f03f84674e2f1b0d3

SHA512
a8604e491c272ce2434d43d6e1070d3cac57ba7349303a73b6dc3bd15ce49f8e78b9a25f685c381c78ae7e1dc3822b8a89be3a5977951ed1407ba7bfc98bdb09

Download Submit
C:\Windows\System32\JWUzDTV.exe

Filesize
1.3MB

MD5
ce483a477a5b3d81ef71fa3ecc66bc54

SHA1
534a06b51bc3edd8f422dc4615a6e6bf2f8b1b12

SHA256
fa0075364edda92ab75c8f7441e885ae83d638c8716974e03ba33c2d88a97089

SHA512
9654452eb76269fe58e219c2137a6e41321c4e7bcaa35bd973d2311565956ebb60869c82dad7e2204513080128ca842d90b0a90aa02caf63c0d2170045ad7584

Download Submit
C:\Windows\System32\QccmcEl.exe

Filesize
1.3MB

MD5
cdb55e7968ce97a244dd703814b1830f

SHA1
08587700cf64aa2c23f2525ad94c941085c8b508

SHA256
92befe1afcfdbbdb8fb8ccdb18e6d3fa0e61ca3cab0ff241fc1d0fa95ebcb05a

SHA512
2f4ab3d5bdd48ee0e92c041a2943c24b235f6af61a3d9a2fc21d6a3240e3d12a480311ee1a9756651102fd112a5ddd788da7d4306a444947e23c46559b197aa9

Download Submit
C:\Windows\System32\QzFwISY.exe

Filesize
1.3MB

MD5
51ec91436cc053095feaff8b29ab2b17

SHA1
0c271e543d356d5fd4f921e86ee3bb29d0a00509

SHA256
a947cdc692ed23302f1a0140db4096508fee00ae98ab459767f50dcea6696a53

SHA512
3a6abf858fb0aa972f5a2a8e1733edb82b6a8499f2e25f8236c66d520c29b2a929a8615233b6f6b0ba0cbd7864cc168d5d038fd403758213228f6b00881ddffb

Download Submit
C:\Windows\System32\SoRKxpr.exe

Filesize
1.3MB

MD5
754370280ff6f56c4ddf8154de7b0f11

SHA1
3b61837a3d614557b6fea7455a9a64eaf88a8107

SHA256
337b36ea836a059b984df500c703378a39c2f901cc6f79da5e3a5bd65bfbca27

SHA512
69da8140158e921c237be0810cc4483639b02057649cc9fae8036c8fe798feec11e9b71d4937b486377f7fcb316fcf5677af1dec8351ea8c8c073b69b6f05be3

Download Submit
C:\Windows\System32\VsxWyiL.exe

Filesize
1.3MB

MD5
bde851eb756a8f0bbcb7b9e4765ee6c2

SHA1
e752f8465077fab63b4d51dd949bb558a9a8fecb

SHA256
3b6bec36b0c65edf5fb07e75492911863ad7095416da75550f1e5b8f0a8a1002

SHA512
e551b695f7f7ee7d4b26fa5e8f4e937e9fa0956e62a4800c56a22b1b87925e50ca460922ad6de39cd05a691185a811f1a8e3f5389a6aa915cbf8ceec30faca70

Download Submit
C:\Windows\System32\WEyWjqd.exe

Filesize
1.3MB

MD5
5b081ee786a9fde03474cc974e6e0716

SHA1
c170a9f819ef4939481df85a9bdb9527f5760424

SHA256
f2efcc5410bdcfd3eff04617fe20edb4565286ca7b77e4f5bbc63c8268fce16e

SHA512
4c642e9216e17227fe96321aedbe3620123d0e172d1e845b17c909fd261eeb5f4a825ad5c1bb67e8270f2ed9fe9f2d505c8e7c1e2bf3a07e546507232fa59f39

Download Submit
C:\Windows\System32\aeGPrtq.exe

Filesize
1.3MB

MD5
08c84e0ee3aace6a9386676c0558c004

SHA1
f09e6639150c83fec373f007283df8644015bd2e

SHA256
304d25c2771347c934bda3d07f3faf8dc482e8b312fd790e17f51a8f4b73fb03

SHA512
e215fd08a2f271fb6eb1939c9b31932b0c0021044cac8053a49395b0b492170743b0c5917784145ff2ef10c0270292508963de159823b1924c7ec1bf86cdcfcd

Download Submit
C:\Windows\System32\dbMaAqo.exe

Filesize
1.3MB

MD5
318ee8ad85600d6a71bcbcac7432366d

SHA1
cb1c2e67f73a84132889b77c9d65cc609f5bf6b4

SHA256
af323279ab4cb28e3b32f33688c86c004f2c3316ba0a661ad24c756892b23e7b

SHA512
635f0beca0fba0a7a0bc7cc0b4a2624ba2ad372aa5eeebe29178f5c0d01c68878a6ee855786a3d988e5d8cd8993022ad70df7ee64f1b50289b9550a53637e68d

Download Submit
C:\Windows\System32\ejhBDGS.exe

Filesize
1.3MB

MD5
db3973ef93ecf41f8e0abe020d583797

SHA1
8d25ba455058d6e94183249babfaa149feec6108

SHA256
d48f04275d685f3e9e5c0883b0019b312924bce3442987be31d690a3eef09de8

SHA512
ab19c9df10c9ebb5af88bad630c60675e70dc6189ee27f7bfe35363e07b8c2411020afe651f3b4a03366f50aca3b5ecdcfe847e68b76276d00f59fa163e716fe

Download Submit
C:\Windows\System32\fVpjFpw.exe

Filesize
1.3MB

MD5
876fd7ba965ff39b83b4fc9c61660621

SHA1
1e48ec3c49a1f71113ae909aae922d82d0a560f3

SHA256
f5d0f725db20576a301b213b8a15754cffca10ef2261f3ffddb8ec59ef6b37b2

SHA512
81bc63124d8bacf5ec096005e8b170128b89b7b49543b92300440bad734720aa68bb6c98eb14ef1d12d10e69110b9f42918069a88834b38af8c548df32222926

Download Submit
C:\Windows\System32\helnGxD.exe

Filesize
1.3MB

MD5
a2903817b3e0b97b217d3f0cae6734cc

SHA1
24faae73767421f32d1e11930319dd2ea6cd51e6

SHA256
313546dffedd0631e5b3641397c27484cdecdf5f2377bbda4592578ecf46b962

SHA512
40cf4ac2338daf6dddf08e3baae529b96d7674bcc37be8bbc05c924f29dfd48c32739dcb68ba6c4f24a667fa9f93d993baddc064b0e31248c917dc1ced73560f

Download Submit
C:\Windows\System32\huqCXDC.exe

Filesize
1.3MB

MD5
3561b3b28a6076917db0e80b2b2b78c8

SHA1
9b02b1906c9c10d0a82eda43375b1b8a42cee1ef

SHA256
6fa98e8f3d632704695f15554aa6015bb53a5d718543e16b64eb019a0d28524b

SHA512
6f788550a4e0a0a4120b2d22713cf5455b41d466897646544ab21b5220e81676193a689c32e9da29c906a58950e4b61d589480c6d87094c3169339c93959fa7a

Download Submit
C:\Windows\System32\iOlfzck.exe

Filesize
1.3MB

MD5
9dd12d1da40110f645e9bb20e9a96e14

SHA1
5c123192c6df538c4f84dde1db546df5467af212

SHA256
572fbc124b7146df613a69db44ade60f187e6c9c4a998a7362fa82370f994193

SHA512
16f8d7bcd27e8250c69578fa32508c63d377be61fbad50030aa0ef79c778fdf1c862b8cea22ba883fe10a1d5bdd45fe854247d287f901ebb6c2270d76ca17690

Download Submit
C:\Windows\System32\iXiHiLc.exe

Filesize
1.3MB

MD5
51d5e252c7e3b1a714d168c0399e69c5

SHA1
67804a94d54d5f3e69497cddba8ca840eea17fde

SHA256
b02fdd3f33b6aa788a3d9e23c9ed6df48ea7d1ed26d38191a4d221abdf3e2ae1

SHA512
8a386154fd3f98533866cd1729421b96757322349431c14597daca7e178fd6f5a16395012d8dc2d61e0c552041c8e78f72aa2a2d133a69a3d9a3e13b424eaa9f

Download Submit
C:\Windows\System32\kHeypva.exe

Filesize
1.3MB

MD5
59764adb64f0f663d8104d9b196cb5c5

SHA1
0e8d4e28e44ad8deae99295cb1e7c660ddceba14

SHA256
ed5f87b338f062ec805bbf38d41a55109f6cf12e4882fd39f929f6ca2eea8875

SHA512
dd1b8bed958c7b255b4da9496ab7fb7a6ef1fb7895f5d0a7626d8a4e7006d42da0d6afd32d392ee0d76c0c2041eb45dc64e984badc47fcade3b7dbe5b500bedb

Download Submit
C:\Windows\System32\kxpOSnJ.exe

Filesize
1.3MB

MD5
b5b5e8555585705feb2c1b50d3cc456a

SHA1
abd4ede8be49d0582ffc6223fcd51cdc9e198fbb

SHA256
f890b60bddc9a320a6635cd82784224d7cfb1066d697655eaf40d55cd8e75cf5

SHA512
e97a07f09f1152e31b52beb4d58adfc782640337583c3b69cb2dd155991840dc4027c2283a2dddafb80b20602b3cdfe82b89506f4b82fc5ea14fca0089af716c

Download Submit
C:\Windows\System32\nQKmpeE.exe

Filesize
1.3MB

MD5
6fc0f8ef7b94d1e2900cfe7e9062c4d7

SHA1
9b78a5d2ef87ff75c23753ac12bf4b8e089dfef7

SHA256
730653c9f8912ebfd358887193dc8f4126382374f44a8d864e2753235077165b

SHA512
4067b7361fc70771e7c08fa32b58a4e45349a02e9d86a1a9ffe00ccfe1cf91d1153963b0a5ece97f4e99c6a724b5090c524afc5e3a9d2575cea30c6b4ae00f76

Download Submit
C:\Windows\System32\rQdzUYh.exe

Filesize
1.3MB

MD5
9aee5dfba4349eafd56573aae0a30d92

SHA1
9816ef62438d49180070768ece1ab0392181f3be

SHA256
cf7ffaaceefe78af4e0f953c6f8a490bb1ebd20bfd43d8c963ae70a703b2a586

SHA512
3a550732ca092e303eebf72795317dde1aacfa2a161792354e7d628106f1975c7a702d8e63969cd8662e34654cd7fec62f5be9a8d33d3e7b1cca2e113c2a17b6

Download Submit
C:\Windows\System32\sOSoLpa.exe

Filesize
1.3MB

MD5
e9a5a21182bf24f9ddec7013afd0084a

SHA1
28fc7bcfff89896c8297911244c8ac8191ff0cb4

SHA256
3fc3a1796336cf8d3924e439b9ffb0e267fc5c34a8f288d6f718884a471c3aa1

SHA512
4d1a6c21776a2b6ef88438ebec11defed786664de450b190605c446ab512916155f47b3c5ddf31a599061d7d589cb169230e80fbb7b6b422b1315a4ebd5def47

Download Submit
C:\Windows\System32\shcUAdS.exe

Filesize
1.3MB

MD5
d66157d67b208d861280dd58347a001c

SHA1
311be00b47de3e7d9dd53a4cdbf3568fc66e7bb5

SHA256
ddb3e6f08deca897660d639518f5575da8d46cd57673af67f174fa044fec9912

SHA512
198c2dde3ae347895c2d52371dd3c9e946ba3762ce38885480a4251437c5e7e566efbbb11cbf8340763d485039880ee5b875d64fc2aced1dbd50ad4f4120e500

Download Submit
C:\Windows\System32\utHjokB.exe

Filesize
1.3MB

MD5
78546b8ae6327e885b4ab11c8aad70ff

SHA1
902f84ed1ece8cd43c45d42d1e45e187a628592d

SHA256
654be94fb4c8e8ea1f1ab7ae18f97a01557cdc669f8d87b084122ecc2a95d6c6

SHA512
e8523f7450d7e6b6293cd748312f10a1119d3c8c285639b6337707e84b2ce1831f42c8d47267c95ea59a385ce2fad8ccefaa1b4aa386cdab8dae5da448ba0ca9

Download Submit
C:\Windows\System32\waudGlR.exe

Filesize
1.3MB

MD5
c23cbed0ac25437ba19c746e0b980ee0

SHA1
986397ba6ad2fae302929fee1dc04259f2c6354d

SHA256
22f70726198102b44810f5d1d1ffd1062bb278c6581ca496bd0954ce75ff5b6b

SHA512
4fc39eaf1fae50298c7883fe4076e2fcc66df5de6536beac9eed37c8efcaae809979f5cdb46e5814f55157c369ffb2c29b44f47792a6bf4e98d8e48f768c46df

Download Submit
C:\Windows\System32\zQWJpZN.exe

Filesize
1.3MB

MD5
504f75c7657cf2a40a619ccafec23ead

SHA1
5af3fb7fa23a43def5e92566cb88e69484ce6160

SHA256
1abd2eb35b4c2378c814d7f63bdfba3395f3e724bc1606fae8827253da3a01bc

SHA512
fabad8ae0e23c2a5056ca62c8e50b2d08daaa277e8136c1439228de499ed41880b1e164406e09993d20782f7445c0a43db0cd780636320ad703e2f8e0c469578

Download Submit
C:\Windows\System32\zQypLeg.exe

Filesize
1.3MB

MD5
1bf07266970d25ec63c5efaeeabe62a3

SHA1
ed4cd5cd50dffa525d478a2378a94e92c6c04a6c

SHA256
ff81d6372abd8789641079ef3e895e5b8b0c56212f03f16cb11d50d1e0013813

SHA512
cb79a955431665107cc1aefe3eaa09f431f67390625690b615ded5036a12889cfc8dd83bce1e542661acf670b8a74e753cff176d242971eaed69714308a948ef

Download Submit
memory/116-1-0x0000018BEBA50000-0x0000018BEBA60000-memory.dmp

Filesize
64KB

Download
memory/116-0-0x00007FF779D10000-0x00007FF77A101000-memory.dmp

Filesize
3.9MB

Download
memory/876-2013-0x00007FF7240D0000-0x00007FF7244C1000-memory.dmp

Filesize
3.9MB

Download
memory/876-443-0x00007FF7240D0000-0x00007FF7244C1000-memory.dmp

Filesize
3.9MB

Download
memory/1204-399-0x00007FF73F840000-0x00007FF73FC31000-memory.dmp

Filesize
3.9MB

Download
memory/1204-2003-0x00007FF73F840000-0x00007FF73FC31000-memory.dmp

Filesize
3.9MB

Download
memory/1356-1983-0x00007FF7A45D0000-0x00007FF7A49C1000-memory.dmp

Filesize
3.9MB

Download
memory/1356-13-0x00007FF7A45D0000-0x00007FF7A49C1000-memory.dmp

Filesize
3.9MB

Download
memory/1464-2015-0x00007FF741680000-0x00007FF741A71000-memory.dmp

Filesize
3.9MB

Download
memory/1464-444-0x00007FF741680000-0x00007FF741A71000-memory.dmp

Filesize
3.9MB

Download
memory/1964-431-0x00007FF71AF50000-0x00007FF71B341000-memory.dmp

Filesize
3.9MB

Download
memory/1964-2006-0x00007FF71AF50000-0x00007FF71B341000-memory.dmp

Filesize
3.9MB

Download
memory/1984-1992-0x00007FF71BBD0000-0x00007FF71BFC1000-memory.dmp

Filesize
3.9MB

Download
memory/1984-410-0x00007FF71BBD0000-0x00007FF71BFC1000-memory.dmp

Filesize
3.9MB

Download
memory/2000-1998-0x00007FF67C760000-0x00007FF67CB51000-memory.dmp

Filesize
3.9MB

Download
memory/2000-428-0x00007FF67C760000-0x00007FF67CB51000-memory.dmp

Filesize
3.9MB

Download
memory/2268-2020-0x00007FF6AC090000-0x00007FF6AC481000-memory.dmp

Filesize
3.9MB

Download
memory/2268-520-0x00007FF6AC090000-0x00007FF6AC481000-memory.dmp

Filesize
3.9MB

Download
memory/2312-437-0x00007FF625C70000-0x00007FF626061000-memory.dmp

Filesize
3.9MB

Download
memory/2312-2008-0x00007FF625C70000-0x00007FF626061000-memory.dmp

Filesize
3.9MB

Download
memory/2376-446-0x00007FF7CD940000-0x00007FF7CDD31000-memory.dmp

Filesize
3.9MB

Download
memory/2376-2053-0x00007FF7CD940000-0x00007FF7CDD31000-memory.dmp

Filesize
3.9MB

Download
memory/2824-415-0x00007FF703600000-0x00007FF7039F1000-memory.dmp

Filesize
3.9MB

Download
memory/2824-2010-0x00007FF703600000-0x00007FF7039F1000-memory.dmp

Filesize
3.9MB

Download
memory/2848-1989-0x00007FF627090000-0x00007FF627481000-memory.dmp

Filesize
3.9MB

Download
memory/2848-395-0x00007FF627090000-0x00007FF627481000-memory.dmp

Filesize
3.9MB

Download
memory/2988-1986-0x00007FF61DC30000-0x00007FF61E021000-memory.dmp

Filesize
3.9MB

Download
memory/2988-532-0x00007FF61DC30000-0x00007FF61E021000-memory.dmp

Filesize
3.9MB

Download
memory/3340-529-0x00007FF7E7FC0000-0x00007FF7E83B1000-memory.dmp

Filesize
3.9MB

Download
memory/3340-2036-0x00007FF7E7FC0000-0x00007FF7E83B1000-memory.dmp

Filesize
3.9MB

Download
memory/3384-2002-0x00007FF76A900000-0x00007FF76ACF1000-memory.dmp

Filesize
3.9MB

Download
memory/3384-404-0x00007FF76A900000-0x00007FF76ACF1000-memory.dmp

Filesize
3.9MB

Download
memory/3664-430-0x00007FF6D4190000-0x00007FF6D4581000-memory.dmp

Filesize
3.9MB

Download
memory/3664-1996-0x00007FF6D4190000-0x00007FF6D4581000-memory.dmp

Filesize
3.9MB

Download
memory/4172-2041-0x00007FF709B10000-0x00007FF709F01000-memory.dmp

Filesize
3.9MB

Download
memory/4172-512-0x00007FF709B10000-0x00007FF709F01000-memory.dmp

Filesize
3.9MB

Download
memory/4276-418-0x00007FF7A5460000-0x00007FF7A5851000-memory.dmp

Filesize
3.9MB

Download
memory/4276-1993-0x00007FF7A5460000-0x00007FF7A5851000-memory.dmp

Filesize
3.9MB

Download
memory/4720-2040-0x00007FF686480000-0x00007FF686871000-memory.dmp

Filesize
3.9MB

Download
memory/4720-515-0x00007FF686480000-0x00007FF686871000-memory.dmp

Filesize
3.9MB

Download
memory/4856-2044-0x00007FF756F80000-0x00007FF757371000-memory.dmp

Filesize
3.9MB

Download
memory/4856-448-0x00007FF756F80000-0x00007FF757371000-memory.dmp

Filesize
3.9MB

Download
memory/4908-1987-0x00007FF6D9F30000-0x00007FF6DA321000-memory.dmp

Filesize
3.9MB

Download
memory/4908-392-0x00007FF6D9F30000-0x00007FF6DA321000-memory.dmp

Filesize
3.9MB

Download
memory/5004-440-0x00007FF6E7000000-0x00007FF6E73F1000-memory.dmp

Filesize
3.9MB

Download
memory/5004-2011-0x00007FF6E7000000-0x00007FF6E73F1000-memory.dmp

Filesize
3.9MB

Download
memory/5020-526-0x00007FF79B210000-0x00007FF79B601000-memory.dmp

Filesize
3.9MB

Download
memory/5020-2038-0x00007FF79B210000-0x00007FF79B601000-memory.dmp

Filesize
3.9MB

Download
memory/5060-1999-0x00007FF73D510000-0x00007FF73D901000-memory.dmp

Filesize
3.9MB

Download
memory/5060-424-0x00007FF73D510000-0x00007FF73D901000-memory.dmp

Filesize
3.9MB

Download