xmrig | 42cf72a51d1163b0c899072e8b3524530383087995096a8d3df6a5ecf48077ca

Analysis

max time kernel
60s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
Size

977KB
MD5

079c2fa8491ef7cb524e4debc988a264
SHA1

794a3bc07f21c162fcaf1578c57b32e82610bbfc
SHA256

42cf72a51d1163b0c899072e8b3524530383087995096a8d3df6a5ecf48077ca
SHA512

d3c9c192bc8e1b7d3273a86b13cd8943fc5594709f488211f3ef08016d3568ef038be15697d991ac46718918154c989ea74f5a740fbdef45b24e86e21964ee78
SSDEEP

24576:JanwhSe11QSONCpGJCjETPl+Me7bPMS8YkgcWBNi:knw9oUUEEDl+xTMS8Tgv8

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/2940-360-0x00007FF602750000-0x00007FF602B41000-memory.dmp	xmrig
behavioral2/memory/4988-372-0x00007FF7AC690000-0x00007FF7ACA81000-memory.dmp	xmrig
behavioral2/memory/1828-376-0x00007FF75E0C0000-0x00007FF75E4B1000-memory.dmp	xmrig
behavioral2/memory/3372-367-0x00007FF660900000-0x00007FF660CF1000-memory.dmp	xmrig
behavioral2/memory/2716-365-0x00007FF698BB0000-0x00007FF698FA1000-memory.dmp	xmrig
behavioral2/memory/608-364-0x00007FF63BB70000-0x00007FF63BF61000-memory.dmp	xmrig
behavioral2/memory/2220-378-0x00007FF64D620000-0x00007FF64DA11000-memory.dmp	xmrig
behavioral2/memory/2228-380-0x00007FF736740000-0x00007FF736B31000-memory.dmp	xmrig
behavioral2/memory/3356-387-0x00007FF7A9490000-0x00007FF7A9881000-memory.dmp	xmrig
behavioral2/memory/3220-397-0x00007FF729620000-0x00007FF729A11000-memory.dmp	xmrig
behavioral2/memory/3208-412-0x00007FF7C9520000-0x00007FF7C9911000-memory.dmp	xmrig
behavioral2/memory/4424-418-0x00007FF746C60000-0x00007FF747051000-memory.dmp	xmrig
behavioral2/memory/4392-422-0x00007FF781860000-0x00007FF781C51000-memory.dmp	xmrig
behavioral2/memory/3184-425-0x00007FF68B990000-0x00007FF68BD81000-memory.dmp	xmrig
behavioral2/memory/4824-430-0x00007FF61F1B0000-0x00007FF61F5A1000-memory.dmp	xmrig
behavioral2/memory/4148-431-0x00007FF62E2F0000-0x00007FF62E6E1000-memory.dmp	xmrig
behavioral2/memory/2508-432-0x00007FF7A5F90000-0x00007FF7A6381000-memory.dmp	xmrig
behavioral2/memory/436-407-0x00007FF66D7D0000-0x00007FF66DBC1000-memory.dmp	xmrig
behavioral2/memory/2524-1986-0x00007FF76AFC0000-0x00007FF76B3B1000-memory.dmp	xmrig
behavioral2/memory/712-1987-0x00007FF742B70000-0x00007FF742F61000-memory.dmp	xmrig
behavioral2/memory/4912-1988-0x00007FF794580000-0x00007FF794971000-memory.dmp	xmrig
behavioral2/memory/224-1989-0x00007FF6B0830000-0x00007FF6B0C21000-memory.dmp	xmrig
behavioral2/memory/2420-2022-0x00007FF76EA90000-0x00007FF76EE81000-memory.dmp	xmrig
behavioral2/memory/980-2028-0x00007FF687D40000-0x00007FF688131000-memory.dmp	xmrig
behavioral2/memory/2524-2031-0x00007FF76AFC0000-0x00007FF76B3B1000-memory.dmp	xmrig
behavioral2/memory/4912-2032-0x00007FF794580000-0x00007FF794971000-memory.dmp	xmrig
behavioral2/memory/712-2034-0x00007FF742B70000-0x00007FF742F61000-memory.dmp	xmrig
behavioral2/memory/2508-2041-0x00007FF7A5F90000-0x00007FF7A6381000-memory.dmp	xmrig
behavioral2/memory/2420-2044-0x00007FF76EA90000-0x00007FF76EE81000-memory.dmp	xmrig
behavioral2/memory/3372-2048-0x00007FF660900000-0x00007FF660CF1000-memory.dmp	xmrig
behavioral2/memory/2220-2054-0x00007FF64D620000-0x00007FF64DA11000-memory.dmp	xmrig
behavioral2/memory/2228-2056-0x00007FF736740000-0x00007FF736B31000-memory.dmp	xmrig
behavioral2/memory/1828-2052-0x00007FF75E0C0000-0x00007FF75E4B1000-memory.dmp	xmrig
behavioral2/memory/4988-2050-0x00007FF7AC690000-0x00007FF7ACA81000-memory.dmp	xmrig
behavioral2/memory/2716-2046-0x00007FF698BB0000-0x00007FF698FA1000-memory.dmp	xmrig
behavioral2/memory/2940-2039-0x00007FF602750000-0x00007FF602B41000-memory.dmp	xmrig
behavioral2/memory/224-2043-0x00007FF6B0830000-0x00007FF6B0C21000-memory.dmp	xmrig
behavioral2/memory/608-2037-0x00007FF63BB70000-0x00007FF63BF61000-memory.dmp	xmrig
behavioral2/memory/4824-2060-0x00007FF61F1B0000-0x00007FF61F5A1000-memory.dmp	xmrig
behavioral2/memory/3208-2068-0x00007FF7C9520000-0x00007FF7C9911000-memory.dmp	xmrig
behavioral2/memory/4148-2089-0x00007FF62E2F0000-0x00007FF62E6E1000-memory.dmp	xmrig
behavioral2/memory/3184-2099-0x00007FF68B990000-0x00007FF68BD81000-memory.dmp	xmrig
behavioral2/memory/4392-2098-0x00007FF781860000-0x00007FF781C51000-memory.dmp	xmrig
behavioral2/memory/3356-2075-0x00007FF7A9490000-0x00007FF7A9881000-memory.dmp	xmrig
behavioral2/memory/3220-2072-0x00007FF729620000-0x00007FF729A11000-memory.dmp	xmrig
behavioral2/memory/436-2070-0x00007FF66D7D0000-0x00007FF66DBC1000-memory.dmp	xmrig
behavioral2/memory/4424-2066-0x00007FF746C60000-0x00007FF747051000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
980	XPwAQCi.exe
4912	PVcsTEN.exe
2524	YSjtkhq.exe
712	fFQfVJR.exe
224	MjmCDja.exe
2420	tVWcipw.exe
2508	IRUrfrE.exe
2940	EActfUm.exe
608	rInMBpX.exe
2716	bQVQCjm.exe
3372	DavzZaX.exe
4988	vVMURgz.exe
1828	JSYlSwk.exe
2220	dTdpmld.exe
2228	wwENcdz.exe
3356	rNtykRk.exe
3220	tpjLmid.exe
436	lAhDjiK.exe
3208	eQfZgyC.exe
4424	toteLKv.exe
4392	QxfXrMJ.exe
3184	IiuDMrX.exe
4824	tQLfhbo.exe
4148	ttLkpAY.exe
4836	AysjLJj.exe
5016	CswyMvH.exe
3924	AXknPfg.exe
2364	ZyCiSha.exe
624	vsJfLmr.exe
1644	dFtleoS.exe
1808	sjxNVme.exe
680	HaMdxds.exe
5088	iiLEMQC.exe
4388	TLpYgUE.exe
444	nIoDHLK.exe
1120	qjPrwSz.exe
2724	naIyrzr.exe
4468	JsHprCl.exe
4372	ROkXEKo.exe
4400	ZXvfYbk.exe
1104	YnKXgkk.exe
460	TbvCmYL.exe
1980	BmrCDOG.exe
4936	nPGGYfz.exe
716	cBdpqNo.exe
620	cVEaByQ.exe
1568	UGgfqHC.exe
3640	JjjLanW.exe
5020	lLjIyXh.exe
3172	SBqCoXf.exe
4460	rhhPsjZ.exe
4292	GTHtIrK.exe
2288	JqujlzG.exe
4680	kgVbeyI.exe
1076	hIANtRL.exe
1296	zTVdrec.exe
4180	ROaArus.exe
2452	WseAFtW.exe
3808	cwocevi.exe
4816	uinZKJT.exe
2372	OyhHwZK.exe
544	iLhRoRD.exe
4696	khCNgHp.exe
2896	nWzEBRt.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4356-0-0x00007FF78B8F0000-0x00007FF78BCE1000-memory.dmp	upx
behavioral2/files/0x000b000000023bb4-6.dat	upx
behavioral2/files/0x000a000000023bb5-14.dat	upx
behavioral2/memory/2524-20-0x00007FF76AFC0000-0x00007FF76B3B1000-memory.dmp	upx
behavioral2/files/0x000a000000023bb7-16.dat	upx
behavioral2/memory/4912-31-0x00007FF794580000-0x00007FF794971000-memory.dmp	upx
behavioral2/files/0x000a000000023bb9-33.dat	upx
behavioral2/files/0x000a000000023bba-41.dat	upx
behavioral2/files/0x0031000000023bbe-61.dat	upx
behavioral2/files/0x000a000000023bc3-86.dat	upx
behavioral2/files/0x000a000000023bc5-96.dat	upx
behavioral2/files/0x000a000000023bc8-109.dat	upx
behavioral2/files/0x000a000000023bca-121.dat	upx
behavioral2/files/0x000a000000023bcf-146.dat	upx
behavioral2/files/0x000a000000023bd2-161.dat	upx
behavioral2/memory/2420-354-0x00007FF76EA90000-0x00007FF76EE81000-memory.dmp	upx
behavioral2/memory/2940-360-0x00007FF602750000-0x00007FF602B41000-memory.dmp	upx
behavioral2/memory/4988-372-0x00007FF7AC690000-0x00007FF7ACA81000-memory.dmp	upx
behavioral2/memory/1828-376-0x00007FF75E0C0000-0x00007FF75E4B1000-memory.dmp	upx
behavioral2/memory/3372-367-0x00007FF660900000-0x00007FF660CF1000-memory.dmp	upx
behavioral2/memory/2716-365-0x00007FF698BB0000-0x00007FF698FA1000-memory.dmp	upx
behavioral2/memory/608-364-0x00007FF63BB70000-0x00007FF63BF61000-memory.dmp	upx
behavioral2/files/0x000a000000023bd3-166.dat	upx
behavioral2/files/0x000a000000023bd1-156.dat	upx
behavioral2/files/0x000a000000023bd0-151.dat	upx
behavioral2/files/0x000a000000023bce-141.dat	upx
behavioral2/files/0x000a000000023bcd-136.dat	upx
behavioral2/files/0x000a000000023bcc-131.dat	upx
behavioral2/files/0x000a000000023bcb-126.dat	upx
behavioral2/files/0x000a000000023bc9-116.dat	upx
behavioral2/files/0x000a000000023bc7-106.dat	upx
behavioral2/files/0x000a000000023bc6-101.dat	upx
behavioral2/files/0x000a000000023bc4-91.dat	upx
behavioral2/files/0x000a000000023bc2-81.dat	upx
behavioral2/files/0x000a000000023bc1-76.dat	upx
behavioral2/files/0x000a000000023bc0-71.dat	upx
behavioral2/files/0x000a000000023bbf-66.dat	upx
behavioral2/files/0x0031000000023bbd-56.dat	upx
behavioral2/files/0x0031000000023bbc-51.dat	upx
behavioral2/files/0x000a000000023bbb-46.dat	upx
behavioral2/files/0x000a000000023bb8-34.dat	upx
behavioral2/memory/224-32-0x00007FF6B0830000-0x00007FF6B0C21000-memory.dmp	upx
behavioral2/files/0x000a000000023bb6-24.dat	upx
behavioral2/memory/712-21-0x00007FF742B70000-0x00007FF742F61000-memory.dmp	upx
behavioral2/memory/980-13-0x00007FF687D40000-0x00007FF688131000-memory.dmp	upx
behavioral2/memory/2220-378-0x00007FF64D620000-0x00007FF64DA11000-memory.dmp	upx
behavioral2/memory/2228-380-0x00007FF736740000-0x00007FF736B31000-memory.dmp	upx
behavioral2/memory/3356-387-0x00007FF7A9490000-0x00007FF7A9881000-memory.dmp	upx
behavioral2/memory/3220-397-0x00007FF729620000-0x00007FF729A11000-memory.dmp	upx
behavioral2/memory/3208-412-0x00007FF7C9520000-0x00007FF7C9911000-memory.dmp	upx
behavioral2/memory/4424-418-0x00007FF746C60000-0x00007FF747051000-memory.dmp	upx
behavioral2/memory/4392-422-0x00007FF781860000-0x00007FF781C51000-memory.dmp	upx
behavioral2/memory/3184-425-0x00007FF68B990000-0x00007FF68BD81000-memory.dmp	upx
behavioral2/memory/4824-430-0x00007FF61F1B0000-0x00007FF61F5A1000-memory.dmp	upx
behavioral2/memory/4148-431-0x00007FF62E2F0000-0x00007FF62E6E1000-memory.dmp	upx
behavioral2/memory/2508-432-0x00007FF7A5F90000-0x00007FF7A6381000-memory.dmp	upx
behavioral2/memory/436-407-0x00007FF66D7D0000-0x00007FF66DBC1000-memory.dmp	upx
behavioral2/memory/2524-1986-0x00007FF76AFC0000-0x00007FF76B3B1000-memory.dmp	upx
behavioral2/memory/712-1987-0x00007FF742B70000-0x00007FF742F61000-memory.dmp	upx
behavioral2/memory/4912-1988-0x00007FF794580000-0x00007FF794971000-memory.dmp	upx
behavioral2/memory/224-1989-0x00007FF6B0830000-0x00007FF6B0C21000-memory.dmp	upx
behavioral2/memory/2420-2022-0x00007FF76EA90000-0x00007FF76EE81000-memory.dmp	upx
behavioral2/memory/980-2028-0x00007FF687D40000-0x00007FF688131000-memory.dmp	upx
behavioral2/memory/2524-2031-0x00007FF76AFC0000-0x00007FF76B3B1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\TqKsKdY.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\NWYnClD.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\cYHtnsM.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\vXOlnFE.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\rvxMdNJ.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\uinZKJT.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\WTpMHZH.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\WCsyRtQ.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\tgauzAV.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\lkiUEzo.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\QxfXrMJ.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\uDRtJIc.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\HryWfId.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\fsdDkyg.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\oVrGQWm.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\YFgJGrO.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\WnfLeiY.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\otuHPNZ.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\KoyFHxX.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\LhAkopu.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\hUQQaSI.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\AUGbnyS.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\vbJFuFM.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\KxHykvW.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\WCYKzon.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\SWWzhlq.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\pHuvJSQ.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\amqRlxZ.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\OopIQuE.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\gEBIjPj.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\oHjIyLu.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\TShANHj.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\gCGZXlJ.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\QZtOXIh.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\gLpfoUf.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\BVqEdza.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\feObaxP.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\qFftWqj.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\skGzSmz.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\UGgfqHC.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\tiqoMpX.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\PnJbFtM.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\vXZJYbz.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\zSSMIgW.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\cACSQml.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\XGjKMik.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\PIeZyFM.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\ZXvfYbk.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\ZUdmRSk.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\ufetFYU.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\HzwBxqo.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\WLBLswQ.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\BcmnMQx.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\wwENcdz.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\PdYbMMI.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\gyftdTy.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\TLdMRrm.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\POmgOAW.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\aEypXyw.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\JnEGhvJ.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\dZppdol.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\JqujlzG.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\ypRMUwL.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
File created	C:\Windows\System32\oRFPODH.exe	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 980	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	85
PID 4356 wrote to memory of 980	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	85
PID 4356 wrote to memory of 4912	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	86
PID 4356 wrote to memory of 4912	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	86
PID 4356 wrote to memory of 2524	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	87
PID 4356 wrote to memory of 2524	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	87
PID 4356 wrote to memory of 712	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	88
PID 4356 wrote to memory of 712	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	88
PID 4356 wrote to memory of 224	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	89
PID 4356 wrote to memory of 224	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	89
PID 4356 wrote to memory of 2420	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	90
PID 4356 wrote to memory of 2420	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	90
PID 4356 wrote to memory of 2508	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	91
PID 4356 wrote to memory of 2508	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	91
PID 4356 wrote to memory of 2940	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	92
PID 4356 wrote to memory of 2940	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	92
PID 4356 wrote to memory of 608	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	93
PID 4356 wrote to memory of 608	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	93
PID 4356 wrote to memory of 2716	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	94
PID 4356 wrote to memory of 2716	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	94
PID 4356 wrote to memory of 3372	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	95
PID 4356 wrote to memory of 3372	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	95
PID 4356 wrote to memory of 4988	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	96
PID 4356 wrote to memory of 4988	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	96
PID 4356 wrote to memory of 1828	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	97
PID 4356 wrote to memory of 1828	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	97
PID 4356 wrote to memory of 2220	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	98
PID 4356 wrote to memory of 2220	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	98
PID 4356 wrote to memory of 2228	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	99
PID 4356 wrote to memory of 2228	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	99
PID 4356 wrote to memory of 3356	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	100
PID 4356 wrote to memory of 3356	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	100
PID 4356 wrote to memory of 3220	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	101
PID 4356 wrote to memory of 3220	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	101
PID 4356 wrote to memory of 436	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	102
PID 4356 wrote to memory of 436	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	102
PID 4356 wrote to memory of 3208	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	103
PID 4356 wrote to memory of 3208	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	103
PID 4356 wrote to memory of 4424	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	104
PID 4356 wrote to memory of 4424	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	104
PID 4356 wrote to memory of 4392	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	105
PID 4356 wrote to memory of 4392	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	105
PID 4356 wrote to memory of 3184	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	106
PID 4356 wrote to memory of 3184	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	106
PID 4356 wrote to memory of 4824	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	107
PID 4356 wrote to memory of 4824	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	107
PID 4356 wrote to memory of 4148	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	108
PID 4356 wrote to memory of 4148	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	108
PID 4356 wrote to memory of 4836	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	109
PID 4356 wrote to memory of 4836	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	109
PID 4356 wrote to memory of 5016	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	110
PID 4356 wrote to memory of 5016	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	110
PID 4356 wrote to memory of 3924	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	111
PID 4356 wrote to memory of 3924	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	111
PID 4356 wrote to memory of 2364	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	112
PID 4356 wrote to memory of 2364	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	112
PID 4356 wrote to memory of 624	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	113
PID 4356 wrote to memory of 624	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	113
PID 4356 wrote to memory of 1644	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	114
PID 4356 wrote to memory of 1644	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	114
PID 4356 wrote to memory of 1808	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	115
PID 4356 wrote to memory of 1808	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	115
PID 4356 wrote to memory of 680	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	116
PID 4356 wrote to memory of 680	4356	079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\079c2fa8491ef7cb524e4debc988a264_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\System32\XPwAQCi.exe
  C:\Windows\System32\XPwAQCi.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System32\PVcsTEN.exe
  C:\Windows\System32\PVcsTEN.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System32\YSjtkhq.exe
  C:\Windows\System32\YSjtkhq.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System32\fFQfVJR.exe
  C:\Windows\System32\fFQfVJR.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System32\MjmCDja.exe
  C:\Windows\System32\MjmCDja.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System32\tVWcipw.exe
  C:\Windows\System32\tVWcipw.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System32\IRUrfrE.exe
  C:\Windows\System32\IRUrfrE.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System32\EActfUm.exe
  C:\Windows\System32\EActfUm.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System32\rInMBpX.exe
  C:\Windows\System32\rInMBpX.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System32\bQVQCjm.exe
  C:\Windows\System32\bQVQCjm.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System32\DavzZaX.exe
  C:\Windows\System32\DavzZaX.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System32\vVMURgz.exe
  C:\Windows\System32\vVMURgz.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System32\JSYlSwk.exe
  C:\Windows\System32\JSYlSwk.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System32\dTdpmld.exe
  C:\Windows\System32\dTdpmld.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System32\wwENcdz.exe
  C:\Windows\System32\wwENcdz.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System32\rNtykRk.exe
  C:\Windows\System32\rNtykRk.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System32\tpjLmid.exe
  C:\Windows\System32\tpjLmid.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System32\lAhDjiK.exe
  C:\Windows\System32\lAhDjiK.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System32\eQfZgyC.exe
  C:\Windows\System32\eQfZgyC.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System32\toteLKv.exe
  C:\Windows\System32\toteLKv.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System32\QxfXrMJ.exe
  C:\Windows\System32\QxfXrMJ.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System32\IiuDMrX.exe
  C:\Windows\System32\IiuDMrX.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System32\tQLfhbo.exe
  C:\Windows\System32\tQLfhbo.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System32\ttLkpAY.exe
  C:\Windows\System32\ttLkpAY.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System32\AysjLJj.exe
  C:\Windows\System32\AysjLJj.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System32\CswyMvH.exe
  C:\Windows\System32\CswyMvH.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System32\AXknPfg.exe
  C:\Windows\System32\AXknPfg.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System32\ZyCiSha.exe
  C:\Windows\System32\ZyCiSha.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System32\vsJfLmr.exe
  C:\Windows\System32\vsJfLmr.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System32\dFtleoS.exe
  C:\Windows\System32\dFtleoS.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System32\sjxNVme.exe
  C:\Windows\System32\sjxNVme.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System32\HaMdxds.exe
  C:\Windows\System32\HaMdxds.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System32\iiLEMQC.exe
  C:\Windows\System32\iiLEMQC.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System32\TLpYgUE.exe
  C:\Windows\System32\TLpYgUE.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System32\nIoDHLK.exe
  C:\Windows\System32\nIoDHLK.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System32\qjPrwSz.exe
  C:\Windows\System32\qjPrwSz.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System32\naIyrzr.exe
  C:\Windows\System32\naIyrzr.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System32\JsHprCl.exe
  C:\Windows\System32\JsHprCl.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System32\ROkXEKo.exe
  C:\Windows\System32\ROkXEKo.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System32\ZXvfYbk.exe
  C:\Windows\System32\ZXvfYbk.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System32\YnKXgkk.exe
  C:\Windows\System32\YnKXgkk.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System32\TbvCmYL.exe
  C:\Windows\System32\TbvCmYL.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System32\BmrCDOG.exe
  C:\Windows\System32\BmrCDOG.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System32\nPGGYfz.exe
  C:\Windows\System32\nPGGYfz.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System32\cBdpqNo.exe
  C:\Windows\System32\cBdpqNo.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System32\cVEaByQ.exe
  C:\Windows\System32\cVEaByQ.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System32\UGgfqHC.exe
  C:\Windows\System32\UGgfqHC.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System32\JjjLanW.exe
  C:\Windows\System32\JjjLanW.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System32\lLjIyXh.exe
  C:\Windows\System32\lLjIyXh.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System32\SBqCoXf.exe
  C:\Windows\System32\SBqCoXf.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System32\rhhPsjZ.exe
  C:\Windows\System32\rhhPsjZ.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System32\GTHtIrK.exe
  C:\Windows\System32\GTHtIrK.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System32\JqujlzG.exe
  C:\Windows\System32\JqujlzG.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System32\kgVbeyI.exe
  C:\Windows\System32\kgVbeyI.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System32\hIANtRL.exe
  C:\Windows\System32\hIANtRL.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System32\zTVdrec.exe
  C:\Windows\System32\zTVdrec.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System32\ROaArus.exe
  C:\Windows\System32\ROaArus.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System32\WseAFtW.exe
  C:\Windows\System32\WseAFtW.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System32\cwocevi.exe
  C:\Windows\System32\cwocevi.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System32\uinZKJT.exe
  C:\Windows\System32\uinZKJT.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System32\OyhHwZK.exe
  C:\Windows\System32\OyhHwZK.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System32\iLhRoRD.exe
  C:\Windows\System32\iLhRoRD.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System32\khCNgHp.exe
  C:\Windows\System32\khCNgHp.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System32\nWzEBRt.exe
  C:\Windows\System32\nWzEBRt.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System32\zVCJppH.exe
  C:\Windows\System32\zVCJppH.exe
  2⤵
  PID:2736
- C:\Windows\System32\lzPhjtF.exe
  C:\Windows\System32\lzPhjtF.exe
  2⤵
  PID:1472
- C:\Windows\System32\EUOZoGT.exe
  C:\Windows\System32\EUOZoGT.exe
  2⤵
  PID:1956
- C:\Windows\System32\TkTMiNq.exe
  C:\Windows\System32\TkTMiNq.exe
  2⤵
  PID:940
- C:\Windows\System32\jjiCgMt.exe
  C:\Windows\System32\jjiCgMt.exe
  2⤵
  PID:2260
- C:\Windows\System32\WTpMHZH.exe
  C:\Windows\System32\WTpMHZH.exe
  2⤵
  PID:4028
- C:\Windows\System32\alwvOOw.exe
  C:\Windows\System32\alwvOOw.exe
  2⤵
  PID:4568
- C:\Windows\System32\bDdQmyN.exe
  C:\Windows\System32\bDdQmyN.exe
  2⤵
  PID:1412
- C:\Windows\System32\PWziGXa.exe
  C:\Windows\System32\PWziGXa.exe
  2⤵
  PID:4920
- C:\Windows\System32\ltjjaai.exe
  C:\Windows\System32\ltjjaai.exe
  2⤵
  PID:2512
- C:\Windows\System32\gCGZXlJ.exe
  C:\Windows\System32\gCGZXlJ.exe
  2⤵
  PID:2388
- C:\Windows\System32\gggOwPD.exe
  C:\Windows\System32\gggOwPD.exe
  2⤵
  PID:4528
- C:\Windows\System32\trrSMzj.exe
  C:\Windows\System32\trrSMzj.exe
  2⤵
  PID:4120
- C:\Windows\System32\cYqhXrs.exe
  C:\Windows\System32\cYqhXrs.exe
  2⤵
  PID:4472
- C:\Windows\System32\AeClhJz.exe
  C:\Windows\System32\AeClhJz.exe
  2⤵
  PID:1584
- C:\Windows\System32\qQOAbfm.exe
  C:\Windows\System32\qQOAbfm.exe
  2⤵
  PID:1396
- C:\Windows\System32\PbyGqgk.exe
  C:\Windows\System32\PbyGqgk.exe
  2⤵
  PID:2860
- C:\Windows\System32\WivRiwo.exe
  C:\Windows\System32\WivRiwo.exe
  2⤵
  PID:1692
- C:\Windows\System32\LrmkNuX.exe
  C:\Windows\System32\LrmkNuX.exe
  2⤵
  PID:4784
- C:\Windows\System32\OXMkpoc.exe
  C:\Windows\System32\OXMkpoc.exe
  2⤵
  PID:2604
- C:\Windows\System32\ZTQoGnp.exe
  C:\Windows\System32\ZTQoGnp.exe
  2⤵
  PID:1048
- C:\Windows\System32\DVXmcWE.exe
  C:\Windows\System32\DVXmcWE.exe
  2⤵
  PID:912
- C:\Windows\System32\jxGfIao.exe
  C:\Windows\System32\jxGfIao.exe
  2⤵
  PID:3892
- C:\Windows\System32\DsRLfJR.exe
  C:\Windows\System32\DsRLfJR.exe
  2⤵
  PID:4032
- C:\Windows\System32\jKMdMQV.exe
  C:\Windows\System32\jKMdMQV.exe
  2⤵
  PID:5048
- C:\Windows\System32\rSQsEZu.exe
  C:\Windows\System32\rSQsEZu.exe
  2⤵
  PID:3916
- C:\Windows\System32\GEGPBIi.exe
  C:\Windows\System32\GEGPBIi.exe
  2⤵
  PID:4952
- C:\Windows\System32\aaeoVhe.exe
  C:\Windows\System32\aaeoVhe.exe
  2⤵
  PID:944
- C:\Windows\System32\ZUdmRSk.exe
  C:\Windows\System32\ZUdmRSk.exe
  2⤵
  PID:2912
- C:\Windows\System32\jMceWqg.exe
  C:\Windows\System32\jMceWqg.exe
  2⤵
  PID:2280
- C:\Windows\System32\SeUnRGN.exe
  C:\Windows\System32\SeUnRGN.exe
  2⤵
  PID:4948
- C:\Windows\System32\IgbEGYk.exe
  C:\Windows\System32\IgbEGYk.exe
  2⤵
  PID:1268
- C:\Windows\System32\xPlcEYe.exe
  C:\Windows\System32\xPlcEYe.exe
  2⤵
  PID:1188
- C:\Windows\System32\lVjCUiv.exe
  C:\Windows\System32\lVjCUiv.exe
  2⤵
  PID:3976
- C:\Windows\System32\uOSbsta.exe
  C:\Windows\System32\uOSbsta.exe
  2⤵
  PID:316
- C:\Windows\System32\xxckRnu.exe
  C:\Windows\System32\xxckRnu.exe
  2⤵
  PID:836
- C:\Windows\System32\UFAevkD.exe
  C:\Windows\System32\UFAevkD.exe
  2⤵
  PID:540
- C:\Windows\System32\IebtEWi.exe
  C:\Windows\System32\IebtEWi.exe
  2⤵
  PID:2216
- C:\Windows\System32\zPUlNIQ.exe
  C:\Windows\System32\zPUlNIQ.exe
  2⤵
  PID:2140
- C:\Windows\System32\cbyeUrl.exe
  C:\Windows\System32\cbyeUrl.exe
  2⤵
  PID:4628
- C:\Windows\System32\EKObrxT.exe
  C:\Windows\System32\EKObrxT.exe
  2⤵
  PID:5128
- C:\Windows\System32\zftlpPQ.exe
  C:\Windows\System32\zftlpPQ.exe
  2⤵
  PID:5172
- C:\Windows\System32\ZMxzMAu.exe
  C:\Windows\System32\ZMxzMAu.exe
  2⤵
  PID:5204
- C:\Windows\System32\qEqTcxM.exe
  C:\Windows\System32\qEqTcxM.exe
  2⤵
  PID:5252
- C:\Windows\System32\EbiIppH.exe
  C:\Windows\System32\EbiIppH.exe
  2⤵
  PID:5272
- C:\Windows\System32\gEBIjPj.exe
  C:\Windows\System32\gEBIjPj.exe
  2⤵
  PID:5304
- C:\Windows\System32\OfDurok.exe
  C:\Windows\System32\OfDurok.exe
  2⤵
  PID:5324
- C:\Windows\System32\tZlMrxl.exe
  C:\Windows\System32\tZlMrxl.exe
  2⤵
  PID:5348
- C:\Windows\System32\hBDAtNr.exe
  C:\Windows\System32\hBDAtNr.exe
  2⤵
  PID:5368
- C:\Windows\System32\CnGOMTR.exe
  C:\Windows\System32\CnGOMTR.exe
  2⤵
  PID:5392
- C:\Windows\System32\bIuDWBu.exe
  C:\Windows\System32\bIuDWBu.exe
  2⤵
  PID:5456
- C:\Windows\System32\FAzoaRi.exe
  C:\Windows\System32\FAzoaRi.exe
  2⤵
  PID:5500
- C:\Windows\System32\sTgrjgf.exe
  C:\Windows\System32\sTgrjgf.exe
  2⤵
  PID:5540
- C:\Windows\System32\VLfuWCv.exe
  C:\Windows\System32\VLfuWCv.exe
  2⤵
  PID:5584
- C:\Windows\System32\jTObavX.exe
  C:\Windows\System32\jTObavX.exe
  2⤵
  PID:5612
- C:\Windows\System32\NCaqWAo.exe
  C:\Windows\System32\NCaqWAo.exe
  2⤵
  PID:5632
- C:\Windows\System32\dsREVnj.exe
  C:\Windows\System32\dsREVnj.exe
  2⤵
  PID:5664
- C:\Windows\System32\OBrkcyG.exe
  C:\Windows\System32\OBrkcyG.exe
  2⤵
  PID:5696
- C:\Windows\System32\vTqvwQJ.exe
  C:\Windows\System32\vTqvwQJ.exe
  2⤵
  PID:5712
- C:\Windows\System32\gwKWXTL.exe
  C:\Windows\System32\gwKWXTL.exe
  2⤵
  PID:5732
- C:\Windows\System32\VnofybT.exe
  C:\Windows\System32\VnofybT.exe
  2⤵
  PID:5772
- C:\Windows\System32\VMgnaWy.exe
  C:\Windows\System32\VMgnaWy.exe
  2⤵
  PID:5788
- C:\Windows\System32\ZDnjwwF.exe
  C:\Windows\System32\ZDnjwwF.exe
  2⤵
  PID:5832
- C:\Windows\System32\xzTetUK.exe
  C:\Windows\System32\xzTetUK.exe
  2⤵
  PID:5852
- C:\Windows\System32\UaGmdNy.exe
  C:\Windows\System32\UaGmdNy.exe
  2⤵
  PID:5892
- C:\Windows\System32\yiMsYcj.exe
  C:\Windows\System32\yiMsYcj.exe
  2⤵
  PID:5912
- C:\Windows\System32\feObaxP.exe
  C:\Windows\System32\feObaxP.exe
  2⤵
  PID:5952
- C:\Windows\System32\UvFeyWo.exe
  C:\Windows\System32\UvFeyWo.exe
  2⤵
  PID:5980
- C:\Windows\System32\mzixHJO.exe
  C:\Windows\System32\mzixHJO.exe
  2⤵
  PID:6000
- C:\Windows\System32\QpiosKi.exe
  C:\Windows\System32\QpiosKi.exe
  2⤵
  PID:6052
- C:\Windows\System32\VzbTFyh.exe
  C:\Windows\System32\VzbTFyh.exe
  2⤵
  PID:6092
- C:\Windows\System32\ZLGgmIO.exe
  C:\Windows\System32\ZLGgmIO.exe
  2⤵
  PID:6108
- C:\Windows\System32\oHjIyLu.exe
  C:\Windows\System32\oHjIyLu.exe
  2⤵
  PID:6136
- C:\Windows\System32\zIhAkxo.exe
  C:\Windows\System32\zIhAkxo.exe
  2⤵
  PID:4300
- C:\Windows\System32\uvZAqnv.exe
  C:\Windows\System32\uvZAqnv.exe
  2⤵
  PID:2648
- C:\Windows\System32\vGTYWnt.exe
  C:\Windows\System32\vGTYWnt.exe
  2⤵
  PID:5156
- C:\Windows\System32\wKGWURI.exe
  C:\Windows\System32\wKGWURI.exe
  2⤵
  PID:5268
- C:\Windows\System32\BxlOrWI.exe
  C:\Windows\System32\BxlOrWI.exe
  2⤵
  PID:5332
- C:\Windows\System32\BqbQGHQ.exe
  C:\Windows\System32\BqbQGHQ.exe
  2⤵
  PID:5380
- C:\Windows\System32\kNpFvlD.exe
  C:\Windows\System32\kNpFvlD.exe
  2⤵
  PID:5412
- C:\Windows\System32\PRTSBzp.exe
  C:\Windows\System32\PRTSBzp.exe
  2⤵
  PID:5520
- C:\Windows\System32\XMJFnGZ.exe
  C:\Windows\System32\XMJFnGZ.exe
  2⤵
  PID:4064
- C:\Windows\System32\XuGhgOY.exe
  C:\Windows\System32\XuGhgOY.exe
  2⤵
  PID:4720
- C:\Windows\System32\AUGbnyS.exe
  C:\Windows\System32\AUGbnyS.exe
  2⤵
  PID:2028
- C:\Windows\System32\aatPPUH.exe
  C:\Windows\System32\aatPPUH.exe
  2⤵
  PID:4768
- C:\Windows\System32\LLhpICO.exe
  C:\Windows\System32\LLhpICO.exe
  2⤵
  PID:5652
- C:\Windows\System32\ZxrGyLQ.exe
  C:\Windows\System32\ZxrGyLQ.exe
  2⤵
  PID:5708
- C:\Windows\System32\pjJpDcJ.exe
  C:\Windows\System32\pjJpDcJ.exe
  2⤵
  PID:5752
- C:\Windows\System32\rsOUsMw.exe
  C:\Windows\System32\rsOUsMw.exe
  2⤵
  PID:5780
- C:\Windows\System32\ZVdwqnY.exe
  C:\Windows\System32\ZVdwqnY.exe
  2⤵
  PID:5868
- C:\Windows\System32\vpgtJlj.exe
  C:\Windows\System32\vpgtJlj.exe
  2⤵
  PID:5908
- C:\Windows\System32\ROjqrRW.exe
  C:\Windows\System32\ROjqrRW.exe
  2⤵
  PID:5988
- C:\Windows\System32\QCenkSM.exe
  C:\Windows\System32\QCenkSM.exe
  2⤵
  PID:5184
- C:\Windows\System32\EWnKmGM.exe
  C:\Windows\System32\EWnKmGM.exe
  2⤵
  PID:5284
- C:\Windows\System32\ufetFYU.exe
  C:\Windows\System32\ufetFYU.exe
  2⤵
  PID:5356
- C:\Windows\System32\wLDExvG.exe
  C:\Windows\System32\wLDExvG.exe
  2⤵
  PID:5408
- C:\Windows\System32\JMDhAxi.exe
  C:\Windows\System32\JMDhAxi.exe
  2⤵
  PID:5620
- C:\Windows\System32\iZtumIZ.exe
  C:\Windows\System32\iZtumIZ.exe
  2⤵
  PID:5644
- C:\Windows\System32\FMsmeed.exe
  C:\Windows\System32\FMsmeed.exe
  2⤵
  PID:5764
- C:\Windows\System32\ZkjqyQi.exe
  C:\Windows\System32\ZkjqyQi.exe
  2⤵
  PID:6104
- C:\Windows\System32\ksZwEUJ.exe
  C:\Windows\System32\ksZwEUJ.exe
  2⤵
  PID:6012
- C:\Windows\System32\JnlBpMH.exe
  C:\Windows\System32\JnlBpMH.exe
  2⤵
  PID:3636
- C:\Windows\System32\fXajyje.exe
  C:\Windows\System32\fXajyje.exe
  2⤵
  PID:5596
- C:\Windows\System32\CIFwRSK.exe
  C:\Windows\System32\CIFwRSK.exe
  2⤵
  PID:6028
- C:\Windows\System32\itVrNbX.exe
  C:\Windows\System32\itVrNbX.exe
  2⤵
  PID:5344
- C:\Windows\System32\iwHRyhL.exe
  C:\Windows\System32\iwHRyhL.exe
  2⤵
  PID:6148
- C:\Windows\System32\YgYxWFk.exe
  C:\Windows\System32\YgYxWFk.exe
  2⤵
  PID:6172
- C:\Windows\System32\agkfJvN.exe
  C:\Windows\System32\agkfJvN.exe
  2⤵
  PID:6244
- C:\Windows\System32\HmbhRZk.exe
  C:\Windows\System32\HmbhRZk.exe
  2⤵
  PID:6260
- C:\Windows\System32\BiovlgE.exe
  C:\Windows\System32\BiovlgE.exe
  2⤵
  PID:6276
- C:\Windows\System32\vXZJYbz.exe
  C:\Windows\System32\vXZJYbz.exe
  2⤵
  PID:6296
- C:\Windows\System32\NJHHryz.exe
  C:\Windows\System32\NJHHryz.exe
  2⤵
  PID:6316
- C:\Windows\System32\gPSYEZN.exe
  C:\Windows\System32\gPSYEZN.exe
  2⤵
  PID:6332
- C:\Windows\System32\LKDTmLp.exe
  C:\Windows\System32\LKDTmLp.exe
  2⤵
  PID:6360
- C:\Windows\System32\HUtluqp.exe
  C:\Windows\System32\HUtluqp.exe
  2⤵
  PID:6432
- C:\Windows\System32\qVuKIwy.exe
  C:\Windows\System32\qVuKIwy.exe
  2⤵
  PID:6460
- C:\Windows\System32\KoyFHxX.exe
  C:\Windows\System32\KoyFHxX.exe
  2⤵
  PID:6488
- C:\Windows\System32\YdPlpuP.exe
  C:\Windows\System32\YdPlpuP.exe
  2⤵
  PID:6504
- C:\Windows\System32\qFftWqj.exe
  C:\Windows\System32\qFftWqj.exe
  2⤵
  PID:6532
- C:\Windows\System32\OGoVrNL.exe
  C:\Windows\System32\OGoVrNL.exe
  2⤵
  PID:6572
- C:\Windows\System32\eIbgPGq.exe
  C:\Windows\System32\eIbgPGq.exe
  2⤵
  PID:6592
- C:\Windows\System32\RasDdXK.exe
  C:\Windows\System32\RasDdXK.exe
  2⤵
  PID:6628
- C:\Windows\System32\ibYpesQ.exe
  C:\Windows\System32\ibYpesQ.exe
  2⤵
  PID:6652
- C:\Windows\System32\glrqfmM.exe
  C:\Windows\System32\glrqfmM.exe
  2⤵
  PID:6672
- C:\Windows\System32\bdIZugK.exe
  C:\Windows\System32\bdIZugK.exe
  2⤵
  PID:6692
- C:\Windows\System32\zwpisEp.exe
  C:\Windows\System32\zwpisEp.exe
  2⤵
  PID:6720
- C:\Windows\System32\XMulnGv.exe
  C:\Windows\System32\XMulnGv.exe
  2⤵
  PID:6760
- C:\Windows\System32\PpDqfmG.exe
  C:\Windows\System32\PpDqfmG.exe
  2⤵
  PID:6784
- C:\Windows\System32\fmcTZeY.exe
  C:\Windows\System32\fmcTZeY.exe
  2⤵
  PID:6832
- C:\Windows\System32\bmsdbnI.exe
  C:\Windows\System32\bmsdbnI.exe
  2⤵
  PID:6852
- C:\Windows\System32\upaqlkx.exe
  C:\Windows\System32\upaqlkx.exe
  2⤵
  PID:6880
- C:\Windows\System32\EEiEjxC.exe
  C:\Windows\System32\EEiEjxC.exe
  2⤵
  PID:6908
- C:\Windows\System32\ARUGvMJ.exe
  C:\Windows\System32\ARUGvMJ.exe
  2⤵
  PID:6932
- C:\Windows\System32\zSSMIgW.exe
  C:\Windows\System32\zSSMIgW.exe
  2⤵
  PID:6964
- C:\Windows\System32\GdlznQT.exe
  C:\Windows\System32\GdlznQT.exe
  2⤵
  PID:6988
- C:\Windows\System32\vQIKdIB.exe
  C:\Windows\System32\vQIKdIB.exe
  2⤵
  PID:7004
- C:\Windows\System32\XXdaarb.exe
  C:\Windows\System32\XXdaarb.exe
  2⤵
  PID:7028
- C:\Windows\System32\sPgjfGx.exe
  C:\Windows\System32\sPgjfGx.exe
  2⤵
  PID:7076
- C:\Windows\System32\WCYKzon.exe
  C:\Windows\System32\WCYKzon.exe
  2⤵
  PID:7100
- C:\Windows\System32\AcJvcNu.exe
  C:\Windows\System32\AcJvcNu.exe
  2⤵
  PID:7124
- C:\Windows\System32\Hhpkxtc.exe
  C:\Windows\System32\Hhpkxtc.exe
  2⤵
  PID:7160
- C:\Windows\System32\clgLqOl.exe
  C:\Windows\System32\clgLqOl.exe
  2⤵
  PID:5728
- C:\Windows\System32\IyOzWGG.exe
  C:\Windows\System32\IyOzWGG.exe
  2⤵
  PID:6156
- C:\Windows\System32\mgYzyOe.exe
  C:\Windows\System32\mgYzyOe.exe
  2⤵
  PID:6256
- C:\Windows\System32\oOLiLMN.exe
  C:\Windows\System32\oOLiLMN.exe
  2⤵
  PID:6372
- C:\Windows\System32\DrsrhGF.exe
  C:\Windows\System32\DrsrhGF.exe
  2⤵
  PID:6380
- C:\Windows\System32\nLSwBsn.exe
  C:\Windows\System32\nLSwBsn.exe
  2⤵
  PID:6472
- C:\Windows\System32\cACSQml.exe
  C:\Windows\System32\cACSQml.exe
  2⤵
  PID:6544
- C:\Windows\System32\GuYgSsB.exe
  C:\Windows\System32\GuYgSsB.exe
  2⤵
  PID:6584
- C:\Windows\System32\NwLxzLA.exe
  C:\Windows\System32\NwLxzLA.exe
  2⤵
  PID:6644
- C:\Windows\System32\ihLDYlU.exe
  C:\Windows\System32\ihLDYlU.exe
  2⤵
  PID:6704
- C:\Windows\System32\SYEVtWD.exe
  C:\Windows\System32\SYEVtWD.exe
  2⤵
  PID:6768
- C:\Windows\System32\auTKUlA.exe
  C:\Windows\System32\auTKUlA.exe
  2⤵
  PID:6840
- C:\Windows\System32\SVrWynw.exe
  C:\Windows\System32\SVrWynw.exe
  2⤵
  PID:6944
- C:\Windows\System32\HgTWHAj.exe
  C:\Windows\System32\HgTWHAj.exe
  2⤵
  PID:6996
- C:\Windows\System32\BZsJlXX.exe
  C:\Windows\System32\BZsJlXX.exe
  2⤵
  PID:7040
- C:\Windows\System32\GNISsUr.exe
  C:\Windows\System32\GNISsUr.exe
  2⤵
  PID:7108
- C:\Windows\System32\WkgjeCT.exe
  C:\Windows\System32\WkgjeCT.exe
  2⤵
  PID:7156
- C:\Windows\System32\PUPgkeD.exe
  C:\Windows\System32\PUPgkeD.exe
  2⤵
  PID:6312
- C:\Windows\System32\ArTnCML.exe
  C:\Windows\System32\ArTnCML.exe
  2⤵
  PID:6496
- C:\Windows\System32\abiqXuz.exe
  C:\Windows\System32\abiqXuz.exe
  2⤵
  PID:6608
- C:\Windows\System32\zaxcaIt.exe
  C:\Windows\System32\zaxcaIt.exe
  2⤵
  PID:6680
- C:\Windows\System32\skGzSmz.exe
  C:\Windows\System32\skGzSmz.exe
  2⤵
  PID:6892
- C:\Windows\System32\jRpMWXP.exe
  C:\Windows\System32\jRpMWXP.exe
  2⤵
  PID:7012
- C:\Windows\System32\UgXvzwK.exe
  C:\Windows\System32\UgXvzwK.exe
  2⤵
  PID:6184
- C:\Windows\System32\ffqpKGR.exe
  C:\Windows\System32\ffqpKGR.exe
  2⤵
  PID:6456
- C:\Windows\System32\NOPFybI.exe
  C:\Windows\System32\NOPFybI.exe
  2⤵
  PID:6412
- C:\Windows\System32\wVFfYxF.exe
  C:\Windows\System32\wVFfYxF.exe
  2⤵
  PID:6960
- C:\Windows\System32\qmHcrXE.exe
  C:\Windows\System32\qmHcrXE.exe
  2⤵
  PID:7172
- C:\Windows\System32\tSiLUOK.exe
  C:\Windows\System32\tSiLUOK.exe
  2⤵
  PID:7192
- C:\Windows\System32\GBYySuC.exe
  C:\Windows\System32\GBYySuC.exe
  2⤵
  PID:7216
- C:\Windows\System32\TShANHj.exe
  C:\Windows\System32\TShANHj.exe
  2⤵
  PID:7244
- C:\Windows\System32\yHZYHbf.exe
  C:\Windows\System32\yHZYHbf.exe
  2⤵
  PID:7272
- C:\Windows\System32\RcBxzPJ.exe
  C:\Windows\System32\RcBxzPJ.exe
  2⤵
  PID:7324
- C:\Windows\System32\ALFJQqP.exe
  C:\Windows\System32\ALFJQqP.exe
  2⤵
  PID:7344
- C:\Windows\System32\NurBsbj.exe
  C:\Windows\System32\NurBsbj.exe
  2⤵
  PID:7368
- C:\Windows\System32\UzMoTCx.exe
  C:\Windows\System32\UzMoTCx.exe
  2⤵
  PID:7412
- C:\Windows\System32\WCsyRtQ.exe
  C:\Windows\System32\WCsyRtQ.exe
  2⤵
  PID:7428
- C:\Windows\System32\XGjKMik.exe
  C:\Windows\System32\XGjKMik.exe
  2⤵
  PID:7452
- C:\Windows\System32\cloNpUb.exe
  C:\Windows\System32\cloNpUb.exe
  2⤵
  PID:7476
- C:\Windows\System32\wvcxMBp.exe
  C:\Windows\System32\wvcxMBp.exe
  2⤵
  PID:7524
- C:\Windows\System32\dWpgxEr.exe
  C:\Windows\System32\dWpgxEr.exe
  2⤵
  PID:7540
- C:\Windows\System32\vaCPGjE.exe
  C:\Windows\System32\vaCPGjE.exe
  2⤵
  PID:7568
- C:\Windows\System32\TDyWypl.exe
  C:\Windows\System32\TDyWypl.exe
  2⤵
  PID:7608
- C:\Windows\System32\tHncppW.exe
  C:\Windows\System32\tHncppW.exe
  2⤵
  PID:7632
- C:\Windows\System32\UUncQHU.exe
  C:\Windows\System32\UUncQHU.exe
  2⤵
  PID:7664
- C:\Windows\System32\gorYXDA.exe
  C:\Windows\System32\gorYXDA.exe
  2⤵
  PID:7680
- C:\Windows\System32\UyOjPKB.exe
  C:\Windows\System32\UyOjPKB.exe
  2⤵
  PID:7712
- C:\Windows\System32\MNMOHoA.exe
  C:\Windows\System32\MNMOHoA.exe
  2⤵
  PID:7740
- C:\Windows\System32\BHChxfx.exe
  C:\Windows\System32\BHChxfx.exe
  2⤵
  PID:7756
- C:\Windows\System32\UkksHNF.exe
  C:\Windows\System32\UkksHNF.exe
  2⤵
  PID:7780
- C:\Windows\System32\lcjEPPs.exe
  C:\Windows\System32\lcjEPPs.exe
  2⤵
  PID:7832
- C:\Windows\System32\XNtIoxc.exe
  C:\Windows\System32\XNtIoxc.exe
  2⤵
  PID:7852
- C:\Windows\System32\wgWQwRk.exe
  C:\Windows\System32\wgWQwRk.exe
  2⤵
  PID:7872
- C:\Windows\System32\tWzsiOm.exe
  C:\Windows\System32\tWzsiOm.exe
  2⤵
  PID:7892
- C:\Windows\System32\QZtOXIh.exe
  C:\Windows\System32\QZtOXIh.exe
  2⤵
  PID:7944
- C:\Windows\System32\eIOZtjX.exe
  C:\Windows\System32\eIOZtjX.exe
  2⤵
  PID:7972
- C:\Windows\System32\MhwZRDG.exe
  C:\Windows\System32\MhwZRDG.exe
  2⤵
  PID:7988
- C:\Windows\System32\QWVnZzt.exe
  C:\Windows\System32\QWVnZzt.exe
  2⤵
  PID:8032
- C:\Windows\System32\tjOrMwI.exe
  C:\Windows\System32\tjOrMwI.exe
  2⤵
  PID:8052
- C:\Windows\System32\TqKsKdY.exe
  C:\Windows\System32\TqKsKdY.exe
  2⤵
  PID:8068
- C:\Windows\System32\RUfNsXN.exe
  C:\Windows\System32\RUfNsXN.exe
  2⤵
  PID:8088
- C:\Windows\System32\jxdWGcZ.exe
  C:\Windows\System32\jxdWGcZ.exe
  2⤵
  PID:8136
- C:\Windows\System32\agJNCPB.exe
  C:\Windows\System32\agJNCPB.exe
  2⤵
  PID:8184
- C:\Windows\System32\mKtQABL.exe
  C:\Windows\System32\mKtQABL.exe
  2⤵
  PID:6352
- C:\Windows\System32\owNbSoq.exe
  C:\Windows\System32\owNbSoq.exe
  2⤵
  PID:7212
- C:\Windows\System32\ohfLKmI.exe
  C:\Windows\System32\ohfLKmI.exe
  2⤵
  PID:7208
- C:\Windows\System32\vrggaKo.exe
  C:\Windows\System32\vrggaKo.exe
  2⤵
  PID:7224
- C:\Windows\System32\vWOmaxH.exe
  C:\Windows\System32\vWOmaxH.exe
  2⤵
  PID:7376
- C:\Windows\System32\igkwxWH.exe
  C:\Windows\System32\igkwxWH.exe
  2⤵
  PID:7464
- C:\Windows\System32\zRniryM.exe
  C:\Windows\System32\zRniryM.exe
  2⤵
  PID:7500
- C:\Windows\System32\RchNhrI.exe
  C:\Windows\System32\RchNhrI.exe
  2⤵
  PID:7624
- C:\Windows\System32\ujrUmwl.exe
  C:\Windows\System32\ujrUmwl.exe
  2⤵
  PID:7700
- C:\Windows\System32\ptLMihC.exe
  C:\Windows\System32\ptLMihC.exe
  2⤵
  PID:7732
- C:\Windows\System32\kPKLKAa.exe
  C:\Windows\System32\kPKLKAa.exe
  2⤵
  PID:7800
- C:\Windows\System32\altDYwQ.exe
  C:\Windows\System32\altDYwQ.exe
  2⤵
  PID:7864
- C:\Windows\System32\dnSIjrA.exe
  C:\Windows\System32\dnSIjrA.exe
  2⤵
  PID:7928
- C:\Windows\System32\vyOKHiw.exe
  C:\Windows\System32\vyOKHiw.exe
  2⤵
  PID:8064
- C:\Windows\System32\UYqQeDh.exe
  C:\Windows\System32\UYqQeDh.exe
  2⤵
  PID:8080
- C:\Windows\System32\nUbUDRg.exe
  C:\Windows\System32\nUbUDRg.exe
  2⤵
  PID:8124
- C:\Windows\System32\bFWoriV.exe
  C:\Windows\System32\bFWoriV.exe
  2⤵
  PID:7184
- C:\Windows\System32\tJjYdcw.exe
  C:\Windows\System32\tJjYdcw.exe
  2⤵
  PID:7356
- C:\Windows\System32\GsCSPJP.exe
  C:\Windows\System32\GsCSPJP.exe
  2⤵
  PID:7392
- C:\Windows\System32\LhAkopu.exe
  C:\Windows\System32\LhAkopu.exe
  2⤵
  PID:7532
- C:\Windows\System32\qWZXnRN.exe
  C:\Windows\System32\qWZXnRN.exe
  2⤵
  PID:7644
- C:\Windows\System32\rgMkXUs.exe
  C:\Windows\System32\rgMkXUs.exe
  2⤵
  PID:7888
- C:\Windows\System32\jpJmQyn.exe
  C:\Windows\System32\jpJmQyn.exe
  2⤵
  PID:8024
- C:\Windows\System32\PJFqKTo.exe
  C:\Windows\System32\PJFqKTo.exe
  2⤵
  PID:8156
- C:\Windows\System32\EhZpkKq.exe
  C:\Windows\System32\EhZpkKq.exe
  2⤵
  PID:7092
- C:\Windows\System32\HbKOhmg.exe
  C:\Windows\System32\HbKOhmg.exe
  2⤵
  PID:7420
- C:\Windows\System32\YwmjdQO.exe
  C:\Windows\System32\YwmjdQO.exe
  2⤵
  PID:8076
- C:\Windows\System32\mYyhFii.exe
  C:\Windows\System32\mYyhFii.exe
  2⤵
  PID:8204
- C:\Windows\System32\bHrQMTe.exe
  C:\Windows\System32\bHrQMTe.exe
  2⤵
  PID:8228
- C:\Windows\System32\gpaQgSf.exe
  C:\Windows\System32\gpaQgSf.exe
  2⤵
  PID:8268
- C:\Windows\System32\EHJZoRR.exe
  C:\Windows\System32\EHJZoRR.exe
  2⤵
  PID:8360
- C:\Windows\System32\yExoUoO.exe
  C:\Windows\System32\yExoUoO.exe
  2⤵
  PID:8432
- C:\Windows\System32\EMnIDot.exe
  C:\Windows\System32\EMnIDot.exe
  2⤵
  PID:8448
- C:\Windows\System32\ucOMgXm.exe
  C:\Windows\System32\ucOMgXm.exe
  2⤵
  PID:8464
- C:\Windows\System32\UtMwsrn.exe
  C:\Windows\System32\UtMwsrn.exe
  2⤵
  PID:8480
- C:\Windows\System32\YjjYfKz.exe
  C:\Windows\System32\YjjYfKz.exe
  2⤵
  PID:8496
- C:\Windows\System32\iGkENVg.exe
  C:\Windows\System32\iGkENVg.exe
  2⤵
  PID:8512
- C:\Windows\System32\ebOgRCd.exe
  C:\Windows\System32\ebOgRCd.exe
  2⤵
  PID:8528
- C:\Windows\System32\mszkDNs.exe
  C:\Windows\System32\mszkDNs.exe
  2⤵
  PID:8544
- C:\Windows\System32\hUQQaSI.exe
  C:\Windows\System32\hUQQaSI.exe
  2⤵
  PID:8560
- C:\Windows\System32\aaMAYAj.exe
  C:\Windows\System32\aaMAYAj.exe
  2⤵
  PID:8576
- C:\Windows\System32\wqbIHXs.exe
  C:\Windows\System32\wqbIHXs.exe
  2⤵
  PID:8592
- C:\Windows\System32\yKElule.exe
  C:\Windows\System32\yKElule.exe
  2⤵
  PID:8608
- C:\Windows\System32\fFdZSYZ.exe
  C:\Windows\System32\fFdZSYZ.exe
  2⤵
  PID:8636
- C:\Windows\System32\GWBFyqz.exe
  C:\Windows\System32\GWBFyqz.exe
  2⤵
  PID:8788
- C:\Windows\System32\fsdDkyg.exe
  C:\Windows\System32\fsdDkyg.exe
  2⤵
  PID:8816
- C:\Windows\System32\uKPdhdA.exe
  C:\Windows\System32\uKPdhdA.exe
  2⤵
  PID:8844
- C:\Windows\System32\nuJjSfq.exe
  C:\Windows\System32\nuJjSfq.exe
  2⤵
  PID:8864
- C:\Windows\System32\yNsMynR.exe
  C:\Windows\System32\yNsMynR.exe
  2⤵
  PID:8892
- C:\Windows\System32\eZErafu.exe
  C:\Windows\System32\eZErafu.exe
  2⤵
  PID:8956
- C:\Windows\System32\tXJCloL.exe
  C:\Windows\System32\tXJCloL.exe
  2⤵
  PID:8976
- C:\Windows\System32\yAEcQDt.exe
  C:\Windows\System32\yAEcQDt.exe
  2⤵
  PID:9016
- C:\Windows\System32\JvNpbIY.exe
  C:\Windows\System32\JvNpbIY.exe
  2⤵
  PID:9032
- C:\Windows\System32\gCgNGqO.exe
  C:\Windows\System32\gCgNGqO.exe
  2⤵
  PID:9060
- C:\Windows\System32\TLdMRrm.exe
  C:\Windows\System32\TLdMRrm.exe
  2⤵
  PID:9132
- C:\Windows\System32\XZbQuZB.exe
  C:\Windows\System32\XZbQuZB.exe
  2⤵
  PID:9160
- C:\Windows\System32\HAAGVxQ.exe
  C:\Windows\System32\HAAGVxQ.exe
  2⤵
  PID:9184
- C:\Windows\System32\bAlRUjT.exe
  C:\Windows\System32\bAlRUjT.exe
  2⤵
  PID:9208
- C:\Windows\System32\NmjcjHA.exe
  C:\Windows\System32\NmjcjHA.exe
  2⤵
  PID:7340
- C:\Windows\System32\CqBNaTY.exe
  C:\Windows\System32\CqBNaTY.exe
  2⤵
  PID:7772
- C:\Windows\System32\JFFjdAW.exe
  C:\Windows\System32\JFFjdAW.exe
  2⤵
  PID:8220
- C:\Windows\System32\qSnAPHT.exe
  C:\Windows\System32\qSnAPHT.exe
  2⤵
  PID:8368
- C:\Windows\System32\fKVEXzG.exe
  C:\Windows\System32\fKVEXzG.exe
  2⤵
  PID:8276
- C:\Windows\System32\ykkILXM.exe
  C:\Windows\System32\ykkILXM.exe
  2⤵
  PID:8624
- C:\Windows\System32\cgemhcZ.exe
  C:\Windows\System32\cgemhcZ.exe
  2⤵
  PID:8404
- C:\Windows\System32\qOYcJec.exe
  C:\Windows\System32\qOYcJec.exe
  2⤵
  PID:8424
- C:\Windows\System32\mLsyuoO.exe
  C:\Windows\System32\mLsyuoO.exe
  2⤵
  PID:8552
- C:\Windows\System32\UXweTpY.exe
  C:\Windows\System32\UXweTpY.exe
  2⤵
  PID:8664
- C:\Windows\System32\btwCgYZ.exe
  C:\Windows\System32\btwCgYZ.exe
  2⤵
  PID:8600
- C:\Windows\System32\NWYnClD.exe
  C:\Windows\System32\NWYnClD.exe
  2⤵
  PID:8568
- C:\Windows\System32\WchBvPI.exe
  C:\Windows\System32\WchBvPI.exe
  2⤵
  PID:8440
- C:\Windows\System32\wCKMmts.exe
  C:\Windows\System32\wCKMmts.exe
  2⤵
  PID:8828
- C:\Windows\System32\BFntMqX.exe
  C:\Windows\System32\BFntMqX.exe
  2⤵
  PID:8760
- C:\Windows\System32\OoZAxRd.exe
  C:\Windows\System32\OoZAxRd.exe
  2⤵
  PID:8908
- C:\Windows\System32\PdYbMMI.exe
  C:\Windows\System32\PdYbMMI.exe
  2⤵
  PID:8928
- C:\Windows\System32\aEaXZJw.exe
  C:\Windows\System32\aEaXZJw.exe
  2⤵
  PID:8996
- C:\Windows\System32\bMsTqah.exe
  C:\Windows\System32\bMsTqah.exe
  2⤵
  PID:9052
- C:\Windows\System32\cEtcuJR.exe
  C:\Windows\System32\cEtcuJR.exe
  2⤵
  PID:9148
- C:\Windows\System32\LEGEfNO.exe
  C:\Windows\System32\LEGEfNO.exe
  2⤵
  PID:8244
- C:\Windows\System32\StoaUFH.exe
  C:\Windows\System32\StoaUFH.exe
  2⤵
  PID:8556
- C:\Windows\System32\wCxLmTV.exe
  C:\Windows\System32\wCxLmTV.exe
  2⤵
  PID:8644
- C:\Windows\System32\HopMonp.exe
  C:\Windows\System32\HopMonp.exe
  2⤵
  PID:8504
- C:\Windows\System32\CuIluuQ.exe
  C:\Windows\System32\CuIluuQ.exe
  2⤵
  PID:8488
- C:\Windows\System32\usNwkFQ.exe
  C:\Windows\System32\usNwkFQ.exe
  2⤵
  PID:8796
- C:\Windows\System32\ycmdxFD.exe
  C:\Windows\System32\ycmdxFD.exe
  2⤵
  PID:9024
- C:\Windows\System32\zTJaOuZ.exe
  C:\Windows\System32\zTJaOuZ.exe
  2⤵
  PID:9088
- C:\Windows\System32\lEVnzEC.exe
  C:\Windows\System32\lEVnzEC.exe
  2⤵
  PID:8540
- C:\Windows\System32\QNhYpRu.exe
  C:\Windows\System32\QNhYpRu.exe
  2⤵
  PID:8628
- C:\Windows\System32\LgUBfvg.exe
  C:\Windows\System32\LgUBfvg.exe
  2⤵
  PID:8968
- C:\Windows\System32\BRoeFSj.exe
  C:\Windows\System32\BRoeFSj.exe
  2⤵
  PID:7640
- C:\Windows\System32\ZmwhxXO.exe
  C:\Windows\System32\ZmwhxXO.exe
  2⤵
  PID:9224
- C:\Windows\System32\rELdjKi.exe
  C:\Windows\System32\rELdjKi.exe
  2⤵
  PID:9264
- C:\Windows\System32\uDRtJIc.exe
  C:\Windows\System32\uDRtJIc.exe
  2⤵
  PID:9292
- C:\Windows\System32\SWWzhlq.exe
  C:\Windows\System32\SWWzhlq.exe
  2⤵
  PID:9316
- C:\Windows\System32\CuiGTcg.exe
  C:\Windows\System32\CuiGTcg.exe
  2⤵
  PID:9336
- C:\Windows\System32\XxLpfGV.exe
  C:\Windows\System32\XxLpfGV.exe
  2⤵
  PID:9360
- C:\Windows\System32\SSeAUZW.exe
  C:\Windows\System32\SSeAUZW.exe
  2⤵
  PID:9392
- C:\Windows\System32\xAcnJAI.exe
  C:\Windows\System32\xAcnJAI.exe
  2⤵
  PID:9420
- C:\Windows\System32\ZnGMcpo.exe
  C:\Windows\System32\ZnGMcpo.exe
  2⤵
  PID:9440
- C:\Windows\System32\fWHyTdc.exe
  C:\Windows\System32\fWHyTdc.exe
  2⤵
  PID:9476
- C:\Windows\System32\FtCAGkF.exe
  C:\Windows\System32\FtCAGkF.exe
  2⤵
  PID:9504
- C:\Windows\System32\FhxsUXl.exe
  C:\Windows\System32\FhxsUXl.exe
  2⤵
  PID:9520
- C:\Windows\System32\xPnZvHI.exe
  C:\Windows\System32\xPnZvHI.exe
  2⤵
  PID:9560
- C:\Windows\System32\yODzukK.exe
  C:\Windows\System32\yODzukK.exe
  2⤵
  PID:9596
- C:\Windows\System32\zzEUAyO.exe
  C:\Windows\System32\zzEUAyO.exe
  2⤵
  PID:9612
- C:\Windows\System32\MNvcSPe.exe
  C:\Windows\System32\MNvcSPe.exe
  2⤵
  PID:9636
- C:\Windows\System32\bFxEBzI.exe
  C:\Windows\System32\bFxEBzI.exe
  2⤵
  PID:9660
- C:\Windows\System32\TFUSzeA.exe
  C:\Windows\System32\TFUSzeA.exe
  2⤵
  PID:9680
- C:\Windows\System32\cYHtnsM.exe
  C:\Windows\System32\cYHtnsM.exe
  2⤵
  PID:9716
- C:\Windows\System32\VlFAeUj.exe
  C:\Windows\System32\VlFAeUj.exe
  2⤵
  PID:9744
- C:\Windows\System32\gyftdTy.exe
  C:\Windows\System32\gyftdTy.exe
  2⤵
  PID:9764
- C:\Windows\System32\PVBIJWt.exe
  C:\Windows\System32\PVBIJWt.exe
  2⤵
  PID:9816
- C:\Windows\System32\vXOlnFE.exe
  C:\Windows\System32\vXOlnFE.exe
  2⤵
  PID:9836
- C:\Windows\System32\QeKiLks.exe
  C:\Windows\System32\QeKiLks.exe
  2⤵
  PID:9876
- C:\Windows\System32\dyEtkCO.exe
  C:\Windows\System32\dyEtkCO.exe
  2⤵
  PID:9896
- C:\Windows\System32\vdiLSis.exe
  C:\Windows\System32\vdiLSis.exe
  2⤵
  PID:9924
- C:\Windows\System32\lcIuOFc.exe
  C:\Windows\System32\lcIuOFc.exe
  2⤵
  PID:9956
- C:\Windows\System32\AaTMBje.exe
  C:\Windows\System32\AaTMBje.exe
  2⤵
  PID:9980
- C:\Windows\System32\tKnCRDA.exe
  C:\Windows\System32\tKnCRDA.exe
  2⤵
  PID:10004
- C:\Windows\System32\Psbmibx.exe
  C:\Windows\System32\Psbmibx.exe
  2⤵
  PID:10056
- C:\Windows\System32\dBjhuyE.exe
  C:\Windows\System32\dBjhuyE.exe
  2⤵
  PID:10084
- C:\Windows\System32\IaguoUl.exe
  C:\Windows\System32\IaguoUl.exe
  2⤵
  PID:10116
- C:\Windows\System32\ypRMUwL.exe
  C:\Windows\System32\ypRMUwL.exe
  2⤵
  PID:10140
- C:\Windows\System32\zDhWJxk.exe
  C:\Windows\System32\zDhWJxk.exe
  2⤵
  PID:10160
- C:\Windows\System32\BOfhAwM.exe
  C:\Windows\System32\BOfhAwM.exe
  2⤵
  PID:10180
- C:\Windows\System32\yBfOTKM.exe
  C:\Windows\System32\yBfOTKM.exe
  2⤵
  PID:10224
- C:\Windows\System32\eTbYFxq.exe
  C:\Windows\System32\eTbYFxq.exe
  2⤵
  PID:3760
- C:\Windows\System32\oShzYXH.exe
  C:\Windows\System32\oShzYXH.exe
  2⤵
  PID:9236
- C:\Windows\System32\mvUyLiR.exe
  C:\Windows\System32\mvUyLiR.exe
  2⤵
  PID:9328
- C:\Windows\System32\tLKxDef.exe
  C:\Windows\System32\tLKxDef.exe
  2⤵
  PID:9404
- C:\Windows\System32\WojahOy.exe
  C:\Windows\System32\WojahOy.exe
  2⤵
  PID:9460
- C:\Windows\System32\phpbujn.exe
  C:\Windows\System32\phpbujn.exe
  2⤵
  PID:9500
- C:\Windows\System32\mTczNUM.exe
  C:\Windows\System32\mTczNUM.exe
  2⤵
  PID:9540
- C:\Windows\System32\oRFPODH.exe
  C:\Windows\System32\oRFPODH.exe
  2⤵
  PID:9604
- C:\Windows\System32\ZAHfQnf.exe
  C:\Windows\System32\ZAHfQnf.exe
  2⤵
  PID:9656
- C:\Windows\System32\cYqbiQE.exe
  C:\Windows\System32\cYqbiQE.exe
  2⤵
  PID:9712
- C:\Windows\System32\kJvVUIQ.exe
  C:\Windows\System32\kJvVUIQ.exe
  2⤵
  PID:9736
- C:\Windows\System32\tfzUXdB.exe
  C:\Windows\System32\tfzUXdB.exe
  2⤵
  PID:9892
- C:\Windows\System32\YiYAxCj.exe
  C:\Windows\System32\YiYAxCj.exe
  2⤵
  PID:9992
- C:\Windows\System32\mMcWswG.exe
  C:\Windows\System32\mMcWswG.exe
  2⤵
  PID:9976
- C:\Windows\System32\afhRFCn.exe
  C:\Windows\System32\afhRFCn.exe
  2⤵
  PID:10128
- C:\Windows\System32\cHJwTjq.exe
  C:\Windows\System32\cHJwTjq.exe
  2⤵
  PID:10156
- C:\Windows\System32\nqzDlSN.exe
  C:\Windows\System32\nqzDlSN.exe
  2⤵
  PID:10236
- C:\Windows\System32\flIFxGV.exe
  C:\Windows\System32\flIFxGV.exe
  2⤵
  PID:9308
- C:\Windows\System32\BsppErU.exe
  C:\Windows\System32\BsppErU.exe
  2⤵
  PID:9304
- C:\Windows\System32\uHuFjba.exe
  C:\Windows\System32\uHuFjba.exe
  2⤵
  PID:9128
- C:\Windows\System32\gMJsAIq.exe
  C:\Windows\System32\gMJsAIq.exe
  2⤵
  PID:9760
- C:\Windows\System32\gQXdqQB.exe
  C:\Windows\System32\gQXdqQB.exe
  2⤵
  PID:9944
- C:\Windows\System32\ZxOSADC.exe
  C:\Windows\System32\ZxOSADC.exe
  2⤵
  PID:10080
- C:\Windows\System32\HryWfId.exe
  C:\Windows\System32\HryWfId.exe
  2⤵
  PID:10188
- C:\Windows\System32\nHiWUar.exe
  C:\Windows\System32\nHiWUar.exe
  2⤵
  PID:9376
- C:\Windows\System32\rTCuQLt.exe
  C:\Windows\System32\rTCuQLt.exe
  2⤵
  PID:10000
- C:\Windows\System32\KQjkbcE.exe
  C:\Windows\System32\KQjkbcE.exe
  2⤵
  PID:9248
- C:\Windows\System32\gLpfoUf.exe
  C:\Windows\System32\gLpfoUf.exe
  2⤵
  PID:9788
- C:\Windows\System32\UGdgMeB.exe
  C:\Windows\System32\UGdgMeB.exe
  2⤵
  PID:10248
- C:\Windows\System32\cyZKnSF.exe
  C:\Windows\System32\cyZKnSF.exe
  2⤵
  PID:10268
- C:\Windows\System32\iKHlWbb.exe
  C:\Windows\System32\iKHlWbb.exe
  2⤵
  PID:10296
- C:\Windows\System32\YLTvcIo.exe
  C:\Windows\System32\YLTvcIo.exe
  2⤵
  PID:10336
- C:\Windows\System32\fesWYOJ.exe
  C:\Windows\System32\fesWYOJ.exe
  2⤵
  PID:10372
- C:\Windows\System32\yeUOGRx.exe
  C:\Windows\System32\yeUOGRx.exe
  2⤵
  PID:10388
- C:\Windows\System32\EmOtDRt.exe
  C:\Windows\System32\EmOtDRt.exe
  2⤵
  PID:10408
- C:\Windows\System32\daSuRKD.exe
  C:\Windows\System32\daSuRKD.exe
  2⤵
  PID:10428
- C:\Windows\System32\vYmwTwK.exe
  C:\Windows\System32\vYmwTwK.exe
  2⤵
  PID:10448
- C:\Windows\System32\JnEGhvJ.exe
  C:\Windows\System32\JnEGhvJ.exe
  2⤵
  PID:10520
- C:\Windows\System32\afEdoMu.exe
  C:\Windows\System32\afEdoMu.exe
  2⤵
  PID:10536
- C:\Windows\System32\ccwyQaY.exe
  C:\Windows\System32\ccwyQaY.exe
  2⤵
  PID:10556
- C:\Windows\System32\goHcOxm.exe
  C:\Windows\System32\goHcOxm.exe
  2⤵
  PID:10604
- C:\Windows\System32\aUQaqgN.exe
  C:\Windows\System32\aUQaqgN.exe
  2⤵
  PID:10624
- C:\Windows\System32\QxsPHQN.exe
  C:\Windows\System32\QxsPHQN.exe
  2⤵
  PID:10640
- C:\Windows\System32\WLBLswQ.exe
  C:\Windows\System32\WLBLswQ.exe
  2⤵
  PID:10664
- C:\Windows\System32\NgQCUbn.exe
  C:\Windows\System32\NgQCUbn.exe
  2⤵
  PID:10684
- C:\Windows\System32\TNcqnjN.exe
  C:\Windows\System32\TNcqnjN.exe
  2⤵
  PID:10704
- C:\Windows\System32\oVrGQWm.exe
  C:\Windows\System32\oVrGQWm.exe
  2⤵
  PID:10740
- C:\Windows\System32\rvxMdNJ.exe
  C:\Windows\System32\rvxMdNJ.exe
  2⤵
  PID:10780
- C:\Windows\System32\NCknaHX.exe
  C:\Windows\System32\NCknaHX.exe
  2⤵
  PID:10804
- C:\Windows\System32\tHNtEZs.exe
  C:\Windows\System32\tHNtEZs.exe
  2⤵
  PID:10828
- C:\Windows\System32\vGMkRXm.exe
  C:\Windows\System32\vGMkRXm.exe
  2⤵
  PID:10848
- C:\Windows\System32\grGBfPq.exe
  C:\Windows\System32\grGBfPq.exe
  2⤵
  PID:10908
- C:\Windows\System32\ezWwewy.exe
  C:\Windows\System32\ezWwewy.exe
  2⤵
  PID:10932
- C:\Windows\System32\LrALfpK.exe
  C:\Windows\System32\LrALfpK.exe
  2⤵
  PID:10952
- C:\Windows\System32\uJZIsfu.exe
  C:\Windows\System32\uJZIsfu.exe
  2⤵
  PID:10968
- C:\Windows\System32\oaCRjSS.exe
  C:\Windows\System32\oaCRjSS.exe
  2⤵
  PID:11020
- C:\Windows\System32\uCGjKCh.exe
  C:\Windows\System32\uCGjKCh.exe
  2⤵
  PID:11048
- C:\Windows\System32\hayUFhq.exe
  C:\Windows\System32\hayUFhq.exe
  2⤵
  PID:11068
- C:\Windows\System32\xfnqhCu.exe
  C:\Windows\System32\xfnqhCu.exe
  2⤵
  PID:11092
- C:\Windows\System32\ObbPDfX.exe
  C:\Windows\System32\ObbPDfX.exe
  2⤵
  PID:11140
- C:\Windows\System32\WrNtteU.exe
  C:\Windows\System32\WrNtteU.exe
  2⤵
  PID:11168
- C:\Windows\System32\QZVhmeW.exe
  C:\Windows\System32\QZVhmeW.exe
  2⤵
  PID:11184
- C:\Windows\System32\OLIUqpT.exe
  C:\Windows\System32\OLIUqpT.exe
  2⤵
  PID:11216
- C:\Windows\System32\mxJyhQD.exe
  C:\Windows\System32\mxJyhQD.exe
  2⤵
  PID:11236
- C:\Windows\System32\RSVmlis.exe
  C:\Windows\System32\RSVmlis.exe
  2⤵
  PID:10288
- C:\Windows\System32\TgOCBdb.exe
  C:\Windows\System32\TgOCBdb.exe
  2⤵
  PID:10344
- C:\Windows\System32\XbWAukj.exe
  C:\Windows\System32\XbWAukj.exe
  2⤵
  PID:10360
- C:\Windows\System32\DjzOSLK.exe
  C:\Windows\System32\DjzOSLK.exe
  2⤵
  PID:10416
- C:\Windows\System32\UZcOwim.exe
  C:\Windows\System32\UZcOwim.exe
  2⤵
  PID:10472
- C:\Windows\System32\tgauzAV.exe
  C:\Windows\System32\tgauzAV.exe
  2⤵
  PID:10564
- C:\Windows\System32\xkyjqdD.exe
  C:\Windows\System32\xkyjqdD.exe
  2⤵
  PID:10612
- C:\Windows\System32\LpDuigh.exe
  C:\Windows\System32\LpDuigh.exe
  2⤵
  PID:10696
- C:\Windows\System32\PpGTMiZ.exe
  C:\Windows\System32\PpGTMiZ.exe
  2⤵
  PID:10728
- C:\Windows\System32\TtBqugp.exe
  C:\Windows\System32\TtBqugp.exe
  2⤵
  PID:10788
- C:\Windows\System32\TpsHVJY.exe
  C:\Windows\System32\TpsHVJY.exe
  2⤵
  PID:10844
- C:\Windows\System32\uBCHRPy.exe
  C:\Windows\System32\uBCHRPy.exe
  2⤵
  PID:10864
- C:\Windows\System32\POmgOAW.exe
  C:\Windows\System32\POmgOAW.exe
  2⤵
  PID:10960
- C:\Windows\System32\ChmKEDb.exe
  C:\Windows\System32\ChmKEDb.exe
  2⤵
  PID:10948
- C:\Windows\System32\PJYAbMF.exe
  C:\Windows\System32\PJYAbMF.exe
  2⤵
  PID:11120
- C:\Windows\System32\jvJPhfF.exe
  C:\Windows\System32\jvJPhfF.exe
  2⤵
  PID:11232
- C:\Windows\System32\Gdccuir.exe
  C:\Windows\System32\Gdccuir.exe
  2⤵
  PID:9860
- C:\Windows\System32\OlbomQd.exe
  C:\Windows\System32\OlbomQd.exe
  2⤵
  PID:10384
- C:\Windows\System32\xUFlLqV.exe
  C:\Windows\System32\xUFlLqV.exe
  2⤵
  PID:10632
- C:\Windows\System32\ixyjlQl.exe
  C:\Windows\System32\ixyjlQl.exe
  2⤵
  PID:10648
- C:\Windows\System32\MuwGKKU.exe
  C:\Windows\System32\MuwGKKU.exe
  2⤵
  PID:10772
- C:\Windows\System32\jwqINKo.exe
  C:\Windows\System32\jwqINKo.exe
  2⤵
  PID:10716
- C:\Windows\System32\BNorClO.exe
  C:\Windows\System32\BNorClO.exe
  2⤵
  PID:1560
- C:\Windows\System32\vAcNhlk.exe
  C:\Windows\System32\vAcNhlk.exe
  2⤵
  PID:11248
- C:\Windows\System32\EIPXvrA.exe
  C:\Windows\System32\EIPXvrA.exe
  2⤵
  PID:10552
- C:\Windows\System32\odHUvqo.exe
  C:\Windows\System32\odHUvqo.exe
  2⤵
  PID:10816
- C:\Windows\System32\FdfMgoo.exe
  C:\Windows\System32\FdfMgoo.exe
  2⤵
  PID:10444
- C:\Windows\System32\BflMPvE.exe
  C:\Windows\System32\BflMPvE.exe
  2⤵
  PID:3084
- C:\Windows\System32\EiEnWnm.exe
  C:\Windows\System32\EiEnWnm.exe
  2⤵
  PID:336
- C:\Windows\System32\QkwydRT.exe
  C:\Windows\System32\QkwydRT.exe
  2⤵
  PID:3592
- C:\Windows\System32\IkqeGrm.exe
  C:\Windows\System32\IkqeGrm.exe
  2⤵
  PID:11296
- C:\Windows\System32\OOEyBFl.exe
  C:\Windows\System32\OOEyBFl.exe
  2⤵
  PID:11340
- C:\Windows\System32\ILinWbk.exe
  C:\Windows\System32\ILinWbk.exe
  2⤵
  PID:11368
- C:\Windows\System32\exHfcWm.exe
  C:\Windows\System32\exHfcWm.exe
  2⤵
  PID:11400
- C:\Windows\System32\lTLAAEL.exe
  C:\Windows\System32\lTLAAEL.exe
  2⤵
  PID:11428
- C:\Windows\System32\rAWdRmb.exe
  C:\Windows\System32\rAWdRmb.exe
  2⤵
  PID:11448
- C:\Windows\System32\zvBMiwM.exe
  C:\Windows\System32\zvBMiwM.exe
  2⤵
  PID:11468
- C:\Windows\System32\bIuMYfA.exe
  C:\Windows\System32\bIuMYfA.exe
  2⤵
  PID:11492
- C:\Windows\System32\kPsRlKU.exe
  C:\Windows\System32\kPsRlKU.exe
  2⤵
  PID:11520
- C:\Windows\System32\uRMOlVJ.exe
  C:\Windows\System32\uRMOlVJ.exe
  2⤵
  PID:11544
- C:\Windows\System32\iWAAapP.exe
  C:\Windows\System32\iWAAapP.exe
  2⤵
  PID:11564
- C:\Windows\System32\LUkSJkM.exe
  C:\Windows\System32\LUkSJkM.exe
  2⤵
  PID:11600
- C:\Windows\System32\IoVsrEO.exe
  C:\Windows\System32\IoVsrEO.exe
  2⤵
  PID:11636
- C:\Windows\System32\tJuDyuz.exe
  C:\Windows\System32\tJuDyuz.exe
  2⤵
  PID:11676
- C:\Windows\System32\UVOJGQn.exe
  C:\Windows\System32\UVOJGQn.exe
  2⤵
  PID:11692
- C:\Windows\System32\WPZHcwZ.exe
  C:\Windows\System32\WPZHcwZ.exe
  2⤵
  PID:11740
- C:\Windows\System32\qtZrIyt.exe
  C:\Windows\System32\qtZrIyt.exe
  2⤵
  PID:11760
- C:\Windows\System32\JBBtaiV.exe
  C:\Windows\System32\JBBtaiV.exe
  2⤵
  PID:11776
- C:\Windows\System32\iEinNby.exe
  C:\Windows\System32\iEinNby.exe
  2⤵
  PID:11796
- C:\Windows\System32\NszGSGM.exe
  C:\Windows\System32\NszGSGM.exe
  2⤵
  PID:11832
- C:\Windows\System32\XamAtPH.exe
  C:\Windows\System32\XamAtPH.exe
  2⤵
  PID:11876
- C:\Windows\System32\RupxLSs.exe
  C:\Windows\System32\RupxLSs.exe
  2⤵
  PID:11896
- C:\Windows\System32\kgabErP.exe
  C:\Windows\System32\kgabErP.exe
  2⤵
  PID:11912
- C:\Windows\System32\DDHNhuT.exe
  C:\Windows\System32\DDHNhuT.exe
  2⤵
  PID:11936
- C:\Windows\System32\VBItuBj.exe
  C:\Windows\System32\VBItuBj.exe
  2⤵
  PID:11952
- C:\Windows\System32\PIeZyFM.exe
  C:\Windows\System32\PIeZyFM.exe
  2⤵
  PID:11996
- C:\Windows\System32\vbJFuFM.exe
  C:\Windows\System32\vbJFuFM.exe
  2⤵
  PID:12016
- C:\Windows\System32\wTkSfZz.exe
  C:\Windows\System32\wTkSfZz.exe
  2⤵
  PID:12060
- C:\Windows\System32\OnvFhpr.exe
  C:\Windows\System32\OnvFhpr.exe
  2⤵
  PID:12100
- C:\Windows\System32\CvQURqq.exe
  C:\Windows\System32\CvQURqq.exe
  2⤵
  PID:12116
- C:\Windows\System32\jwnVBBY.exe
  C:\Windows\System32\jwnVBBY.exe
  2⤵
  PID:12140
- C:\Windows\System32\YMSaYOr.exe
  C:\Windows\System32\YMSaYOr.exe
  2⤵
  PID:12160
- C:\Windows\System32\dnbPADX.exe
  C:\Windows\System32\dnbPADX.exe
  2⤵
  PID:12188
- C:\Windows\System32\FCqQcdZ.exe
  C:\Windows\System32\FCqQcdZ.exe
  2⤵
  PID:12208
- C:\Windows\System32\wqErODp.exe
  C:\Windows\System32\wqErODp.exe
  2⤵
  PID:12268
- C:\Windows\System32\wpElJkg.exe
  C:\Windows\System32\wpElJkg.exe
  2⤵
  PID:11276
- C:\Windows\System32\gQwBssZ.exe
  C:\Windows\System32\gQwBssZ.exe
  2⤵
  PID:11320
- C:\Windows\System32\VmPjnMu.exe
  C:\Windows\System32\VmPjnMu.exe
  2⤵
  PID:11356
- C:\Windows\System32\rQsWXCC.exe
  C:\Windows\System32\rQsWXCC.exe
  2⤵
  PID:11436
- C:\Windows\System32\JTEjdVF.exe
  C:\Windows\System32\JTEjdVF.exe
  2⤵
  PID:11480
- C:\Windows\System32\vJkMDzj.exe
  C:\Windows\System32\vJkMDzj.exe
  2⤵
  PID:11540
- C:\Windows\System32\BipzdlR.exe
  C:\Windows\System32\BipzdlR.exe
  2⤵
  PID:11580
- C:\Windows\System32\FrWxwsV.exe
  C:\Windows\System32\FrWxwsV.exe
  2⤵
  PID:11704
- C:\Windows\System32\KtilVFL.exe
  C:\Windows\System32\KtilVFL.exe
  2⤵
  PID:11752
- C:\Windows\System32\ZjJvYte.exe
  C:\Windows\System32\ZjJvYte.exe
  2⤵
  PID:4272
- C:\Windows\System32\QmJLDmz.exe
  C:\Windows\System32\QmJLDmz.exe
  2⤵
  PID:11848
- C:\Windows\System32\YFgJGrO.exe
  C:\Windows\System32\YFgJGrO.exe
  2⤵
  PID:11920
- C:\Windows\System32\tTNRuRG.exe
  C:\Windows\System32\tTNRuRG.exe
  2⤵
  PID:12008
- C:\Windows\System32\pHuvJSQ.exe
  C:\Windows\System32\pHuvJSQ.exe
  2⤵
  PID:12084
- C:\Windows\System32\PdOzBbL.exe
  C:\Windows\System32\PdOzBbL.exe
  2⤵
  PID:12156
- C:\Windows\System32\lWKPHes.exe
  C:\Windows\System32\lWKPHes.exe
  2⤵
  PID:12176
- C:\Windows\System32\mgtDeXx.exe
  C:\Windows\System32\mgtDeXx.exe
  2⤵
  PID:12256
- C:\Windows\System32\BcmnMQx.exe
  C:\Windows\System32\BcmnMQx.exe
  2⤵
  PID:12264
- C:\Windows\System32\suggSCo.exe
  C:\Windows\System32\suggSCo.exe
  2⤵
  PID:11420
- C:\Windows\System32\yGyZPev.exe
  C:\Windows\System32\yGyZPev.exe
  2⤵
  PID:11508
- C:\Windows\System32\MfxmqvC.exe
  C:\Windows\System32\MfxmqvC.exe
  2⤵
  PID:11812
- C:\Windows\System32\zotpYgO.exe
  C:\Windows\System32\zotpYgO.exe
  2⤵
  PID:5064
- C:\Windows\System32\amqRlxZ.exe
  C:\Windows\System32\amqRlxZ.exe
  2⤵
  PID:12036
- C:\Windows\System32\ZxkjLTS.exe
  C:\Windows\System32\ZxkjLTS.exe
  2⤵
  PID:12228
- C:\Windows\System32\GaqadDY.exe
  C:\Windows\System32\GaqadDY.exe
  2⤵
  PID:12252
- C:\Windows\System32\DigObvW.exe
  C:\Windows\System32\DigObvW.exe
  2⤵
  PID:11672
- C:\Windows\System32\QnfpevB.exe
  C:\Windows\System32\QnfpevB.exe
  2⤵
  PID:11908
- C:\Windows\System32\SdSNVNz.exe
  C:\Windows\System32\SdSNVNz.exe
  2⤵
  PID:10676
- C:\Windows\System32\wzTUwnb.exe
  C:\Windows\System32\wzTUwnb.exe
  2⤵
  PID:1712
- C:\Windows\System32\gyZLiXK.exe
  C:\Windows\System32\gyZLiXK.exe
  2⤵
  PID:11748
- C:\Windows\System32\zCvnHyU.exe
  C:\Windows\System32\zCvnHyU.exe
  2⤵
  PID:12296
- C:\Windows\System32\BelyXjT.exe
  C:\Windows\System32\BelyXjT.exe
  2⤵
  PID:12316
- C:\Windows\System32\vLBkCDT.exe
  C:\Windows\System32\vLBkCDT.exe
  2⤵
  PID:12332
- C:\Windows\System32\aYoBmNc.exe
  C:\Windows\System32\aYoBmNc.exe
  2⤵
  PID:12364
- C:\Windows\System32\ilxwlOj.exe
  C:\Windows\System32\ilxwlOj.exe
  2⤵
  PID:12396
- C:\Windows\System32\tiqoMpX.exe
  C:\Windows\System32\tiqoMpX.exe
  2⤵
  PID:12440
- C:\Windows\System32\xOtoyjl.exe
  C:\Windows\System32\xOtoyjl.exe
  2⤵
  PID:12464
- C:\Windows\System32\MLuChdu.exe
  C:\Windows\System32\MLuChdu.exe
  2⤵
  PID:12504
- C:\Windows\System32\UXhkJrd.exe
  C:\Windows\System32\UXhkJrd.exe
  2⤵
  PID:12552
- C:\Windows\System32\YpCjfxa.exe
  C:\Windows\System32\YpCjfxa.exe
  2⤵
  PID:12568
- C:\Windows\System32\hQHdxqc.exe
  C:\Windows\System32\hQHdxqc.exe
  2⤵
  PID:12588
- C:\Windows\System32\VhHLwku.exe
  C:\Windows\System32\VhHLwku.exe
  2⤵
  PID:12604
- C:\Windows\System32\aZWfzFW.exe
  C:\Windows\System32\aZWfzFW.exe
  2⤵
  PID:12652
- C:\Windows\System32\aajEwiD.exe
  C:\Windows\System32\aajEwiD.exe
  2⤵
  PID:12680
- C:\Windows\System32\JyKjOTY.exe
  C:\Windows\System32\JyKjOTY.exe
  2⤵
  PID:12700
- C:\Windows\System32\lkiUEzo.exe
  C:\Windows\System32\lkiUEzo.exe
  2⤵
  PID:12716
- C:\Windows\System32\qyjVlRs.exe
  C:\Windows\System32\qyjVlRs.exe
  2⤵
  PID:12732
- C:\Windows\System32\HzwBxqo.exe
  C:\Windows\System32\HzwBxqo.exe
  2⤵
  PID:12764
- C:\Windows\System32\CIcjUsQ.exe
  C:\Windows\System32\CIcjUsQ.exe
  2⤵
  PID:12812
- C:\Windows\System32\zDBbHrC.exe
  C:\Windows\System32\zDBbHrC.exe
  2⤵
  PID:12840
- C:\Windows\System32\cZaEPXr.exe
  C:\Windows\System32\cZaEPXr.exe
  2⤵
  PID:12868
- C:\Windows\System32\hMuuVQQ.exe
  C:\Windows\System32\hMuuVQQ.exe
  2⤵
  PID:12888
- C:\Windows\System32\DcnKULK.exe
  C:\Windows\System32\DcnKULK.exe
  2⤵
  PID:12912
- C:\Windows\System32\CfCHbxq.exe
  C:\Windows\System32\CfCHbxq.exe
  2⤵
  PID:12928
- C:\Windows\System32\WnfLeiY.exe
  C:\Windows\System32\WnfLeiY.exe
  2⤵
  PID:12992
- C:\Windows\System32\IxBZXKW.exe
  C:\Windows\System32\IxBZXKW.exe
  2⤵
  PID:13016
- C:\Windows\System32\BwkRZbZ.exe
  C:\Windows\System32\BwkRZbZ.exe
  2⤵
  PID:13036
- C:\Windows\System32\OTUzrMi.exe
  C:\Windows\System32\OTUzrMi.exe
  2⤵
  PID:13056
- C:\Windows\System32\PjbNEvy.exe
  C:\Windows\System32\PjbNEvy.exe
  2⤵
  PID:13080
- C:\Windows\System32\axhqZFC.exe
  C:\Windows\System32\axhqZFC.exe
  2⤵
  PID:13136
- C:\Windows\System32\cUjRwyW.exe
  C:\Windows\System32\cUjRwyW.exe
  2⤵
  PID:13164
- C:\Windows\System32\CVFaaLb.exe
  C:\Windows\System32\CVFaaLb.exe
  2⤵
  PID:13196
- C:\Windows\System32\UJFABNm.exe
  C:\Windows\System32\UJFABNm.exe
  2⤵
  PID:13224
- C:\Windows\System32\LbvhNqp.exe
  C:\Windows\System32\LbvhNqp.exe
  2⤵
  PID:13244
- C:\Windows\System32\bBOshgO.exe
  C:\Windows\System32\bBOshgO.exe
  2⤵
  PID:13268
- C:\Windows\System32\hXkbjsV.exe
  C:\Windows\System32\hXkbjsV.exe
  2⤵
  PID:13288
- C:\Windows\System32\exZJRnG.exe
  C:\Windows\System32\exZJRnG.exe
  2⤵
  PID:4732
- C:\Windows\System32\rDnSRQz.exe
  C:\Windows\System32\rDnSRQz.exe
  2⤵
  PID:1160
- C:\Windows\System32\UsvaBMU.exe
  C:\Windows\System32\UsvaBMU.exe
  2⤵
  PID:12416
- C:\Windows\System32\icQokrc.exe
  C:\Windows\System32\icQokrc.exe
  2⤵
  PID:12456
- C:\Windows\System32\DIfjtEd.exe
  C:\Windows\System32\DIfjtEd.exe
  2⤵
  PID:12496
- C:\Windows\System32\nPCFXVH.exe
  C:\Windows\System32\nPCFXVH.exe
  2⤵
  PID:12536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\AXknPfg.exe

Filesize
984KB

MD5
3c3981d41cca86618508588ebf2c9ec3

SHA1
926b285998f3e11fbe8f70034cc44563c0900266

SHA256
dfc107912c08462bdde5516600c9f77b01ffb64ae5ace08699488d2434e4dbcc

SHA512
7e6ff27d17cb191d53547e6c7e77184c4e668fb04fd530b3a86bd51a3b18a7e01384e1c0899d56ad7c54bdc17684b5d69252d5a70b80fc9b60cebfc9d71a3965

Download Submit
C:\Windows\System32\AysjLJj.exe

Filesize
983KB

MD5
80a521258151c2bd536638467cc3d7a2

SHA1
2fdba7e7c633c23c2b51fe724e9e673a01af0a93

SHA256
f85c295e8e2b9847ac16a4a0e3cd0a2414d2ccbe54c67e8b7b2e3d9d5589e107

SHA512
f554bc40e6e94288060e78ceaa4405607b24f2fe0879f6c19fc25be04f3b4a4ca9b7f4db6744db868d01cdd053652a63857d13db5c969acc4ecddd57f2021b08

Download Submit
C:\Windows\System32\CswyMvH.exe

Filesize
983KB

MD5
b9742fbcf3a1b6d133f22a4faa58233e

SHA1
8e4303ee52bbfb30cdd00588bb5291470bfd8500

SHA256
85c77c573979ede1ca1f9da88348b3615c88600e330c43f490baf6767474ce1d

SHA512
a40745a871f0643e6d3d4a7e494e35db2ff3fadea6163a2b740fb54bf8c2011e2fa626c96cc7d345b1c239d3c9e08dadc49fbae688f4ea6f89d5bdc7662a1fe4

Download Submit
C:\Windows\System32\DavzZaX.exe

Filesize
980KB

MD5
88e9c14057d26f4816704c49754611db

SHA1
6138ae8136bdba2e005b20115b2a9d47599b6a77

SHA256
66b8db243de2b30e9e1c24233671d32ec4e83300369b4f4e053665db3f3a5a7a

SHA512
25bb637fbb9e4463fb1dea5b2ae3525a6fc7839d72cc871279be48438854b823e80f63e4964d149d69acb44a4fc17dbe84cada0c65b83d4fd8ac9043f8b0e4a9

Download Submit
C:\Windows\System32\EActfUm.exe

Filesize
979KB

MD5
21728f5398353d1f4cdf16ddb13a9b37

SHA1
38e2e623eb68e995790bcc16649b9d53e8c3c90c

SHA256
ede9f2689743d079680d6f08d2ca1b75d166573c10c75d194240a27e1d36fad9

SHA512
3b410bd060f67cddbe05223f9b21e3dcb794fda01b7a454f1724a8b54d2bc0cbd2fa5b2573634637e0e9f416adc1ce6f608db91ba1d90dc4a800bea7ed06fd42

Download Submit
C:\Windows\System32\HaMdxds.exe

Filesize
985KB

MD5
0cc534e6a394e4aab312ae8f0fd7327f

SHA1
0a5b955edb5c69d067a0dbc242181608217c9a7e

SHA256
b9984743f36beac2769d3a5fae49c3a5ff31b44f4fa45767034c1c2cd6657e56

SHA512
54159998d36110119aabbab198c854eb393e48a15b643d8a83136b5f2bdd6155fc563b95660ac1cf282c59a20a16029969573727e63236914bf154441b8950ab

Download Submit
C:\Windows\System32\IRUrfrE.exe

Filesize
979KB

MD5
febd2803496dd0e4932daa343956f6fd

SHA1
efb909e9487135ba15580d49994d13ca85547590

SHA256
c704876a7fd579610bd463374aa721502b1c601c7c552542e7b217e3123c72c6

SHA512
14d7a00e74ff4d56aee7f4a39912add86d1865ed280c430b989ab26aac5d4384c1dcd14b29da1a8b4a4ef1cb5d25eaf87c47569399f3e74681ebba4f5210e016

Download Submit
C:\Windows\System32\IiuDMrX.exe

Filesize
982KB

MD5
07469e25975c9160b65dacbf5ed85ed6

SHA1
d7e78a5e1a28676d2a78bdbc5ef5b044825ffa7b

SHA256
fcfc6e34254e64bfd70ef6d597d195d85d0e8429a0c6bef8b9a2f9604b22e07a

SHA512
5f09b9d8921045fb624f66d73911369df6876b0725dcb4da12a3ce059829af16e321c349b52f8285955d9fcaeec0e87a2a9912460ffe151f5b79f9fadc644f05

Download Submit
C:\Windows\System32\JSYlSwk.exe

Filesize
980KB

MD5
589a9e62dfd0436e07085f30b65524e7

SHA1
06fe1018bb7fe68b5db5464d0aff737c0a7158e7

SHA256
4f38a86d4966946a16a639bd4dfb7baccc9c0f7401dfa38f90fd3637bfce9a0f

SHA512
77014e0c83d7fc6cb8aa153beb1b327506f3619d5cf26425fc60a92f4a5e740c68875b72db8124ca9a2129e6b0e9e616a72685aa8e1dd017a07968c063b08c79

Download Submit
C:\Windows\System32\MjmCDja.exe

Filesize
978KB

MD5
b314384c9a68b42e64b5b46797004426

SHA1
23f199ad2364dff6b403065afde4cd8d53a95d9f

SHA256
2676f4052d003213746b05875099522a019a28accb619f2792806a6f4a1a99e5

SHA512
ec86b466374a0cd7dd410d00af544d298b4f32aed01f35e15ad2ce150f27260eb01ca2b5f3f3f47e3dbc19cfee1f089911fcb7ed101b8a929de074848624cf5b

Download Submit
C:\Windows\System32\PVcsTEN.exe

Filesize
977KB

MD5
340b45713fd5456a007557099076e2b4

SHA1
af0eea682030a5dafaab536141f5fdc4f3f9fd1f

SHA256
903f4265087d3d3148f5ea12e0498dfc3e06545ea8b830e6f6d47d3085042071

SHA512
a943d97e50d3a60fd81945171bdff22ea84deaec9744ce6084a84cdf5fe785714a7a55c219c14b8902febb49759ce31e3f5f294153fc20741cca1497979650ce

Download Submit
C:\Windows\System32\QxfXrMJ.exe

Filesize
982KB

MD5
4a5fd23abee51493cd02afa1d6f067c6

SHA1
6d9f87fea245883fc7f50e6a5892161a88b95168

SHA256
9556b4b2a0e8f4ec9644d61223e8179fc1254498df10e868aadd98fbdeb43f6a

SHA512
9db963e51d5ceee40d44a55ffeb7cfc4320584c4b6eeeb6cd62b4be7550ca476bbf0e6bdaef91f630dee0113b2139161181155c539ef170279542ffc77dd50fd

Download Submit
C:\Windows\System32\XPwAQCi.exe

Filesize
977KB

MD5
a0a08563d10761e00420e5ccb8d060b6

SHA1
ed8eb498c02950a49c189069145c8ee62efc9177

SHA256
4757f80f35746d42b1bcb6d28411cdaaf123bf83935a92e63362300c9abd07b6

SHA512
68ad0251bffd81446c2751d25222f29e47cb0421570f3990dfb8068e078dcbc09ae83ee597e75f0274ace4cdda61689e6297f874cd17679181d11b6c3faef0ec

Download Submit
C:\Windows\System32\YSjtkhq.exe

Filesize
978KB

MD5
e473fee00c1c505f21e94f7f407770ce

SHA1
ed30bb26a29c33ee29f0baa08d81b8ff1e676f11

SHA256
fa595959150c0b65fbe5d17cdd1400001d2d13986181078e03822b305df3dca5

SHA512
5a27f4365738cdc08b7e01904271f3ba880f4f06f678463e43b925d9dd15670549973fd8813d06ac231d9cf5020d04575b5716d220d4a6466d1e6016edd14067

Download Submit
C:\Windows\System32\ZyCiSha.exe

Filesize
984KB

MD5
28f887d60f6eb924068619982f7da8c8

SHA1
97f053baa0e9862d5b13ded2f2a338acc6613808

SHA256
9d556401e5ea06d546e373f8462aee082dee7915585ea3493380f4bf3907aa55

SHA512
eec1cb0b9286e855daf5d5ff0d0eb8ab94a072c3574708ba531bb644ab0337689eb1a119876abf86917d1606c0b9fd0cbdf778b737e182519b0e60285c0c0b97

Download Submit
C:\Windows\System32\bQVQCjm.exe

Filesize
979KB

MD5
c4fc5c87078defbd52a9085704cdc7c7

SHA1
3d5bfb1ccfcd5991016df8e7991dfc646ee13940

SHA256
5bd2960e5076a8416e38af31a3706f84029f41b43eefd0ec0c3bd0de5cafd4fc

SHA512
ce54ba51da1e9ed92cb88ac57b283ad72538a3cb64541b8820de62f63cc84d3169080edd36041b22551d0613d9296f80bc05954b2063c3c8bb719fc51dccbf90

Download Submit
C:\Windows\System32\dFtleoS.exe

Filesize
984KB

MD5
b9619d64113799bfdf42a2cc89ab5569

SHA1
44b44770b11297e6919ebd649bcb2ab895ed6ac3

SHA256
8be5499bee481363256f92ddd2a2d5626cea5e38f09ab9ac01862990f7631c2e

SHA512
603027102eb34890a44af30c4a31c69f15d2c86407d8dafb2f90268b2924c8da1688b1a1c6f314d39865d0600fc315687edf148fc152299795a89c260dd8ba09

Download Submit
C:\Windows\System32\dTdpmld.exe

Filesize
980KB

MD5
c3f2dd8a8ea14ceb4bd9ffd3956c9cb5

SHA1
fa92419f13207f6ddd2afede4345612577b188cb

SHA256
4636c738e038f5537f1141d612b098feee6193c0f381b6f959f3e1b6b2cdde6d

SHA512
b8af548bc08c61155fd19e83aa813680b0e7c5067fdb6647117d1823b59e1b59db23618443939b168a25e282f5bc18cad52be971d874b14c9567fc571815259d

Download Submit
C:\Windows\System32\eQfZgyC.exe

Filesize
982KB

MD5
7f368c103666963ddcc85891f00ee5d6

SHA1
917caf495c823d778e4878747f28d592816487f4

SHA256
efb5efaeb93d8944ffa37fe12a59e693a0f32b12b382477c5669e44358d7304b

SHA512
39673894ef1f9aa1cd3f7b3d4b8a2bab9c0b7c6f14d5ab32502bab9692ace5d68ac18f310336f25d4cee4947c173d01a8e49894388be693c7ac17c396d6789a5

Download Submit
C:\Windows\System32\fFQfVJR.exe

Filesize
978KB

MD5
633cb121870a4f6f4b36ad37a8c73abc

SHA1
ade0a93279d7e0213481248932d70e2f78566dbd

SHA256
76bfc21e8e86c649a3f1b6bd9f042cbe99439278ea21b40ca9fe8e5c1c513872

SHA512
07270e8b71ad01e53a045b37d83b18fa51bd4a69e601f71c27bec9f6bcf996f13e3a34027c6683c8e7ccdbba4d9188fa18cd6be56ed88b5d6f718476ad4e3149

Download Submit
C:\Windows\System32\lAhDjiK.exe

Filesize
981KB

MD5
ed1704a9bad0aac59b8089d61be8afd0

SHA1
3438c5a059816c6d68eff6edf6f8321dc0db570b

SHA256
a161c84dba181c3e6dbc131a495a4a40ff63a229ff766d3ca6dac37365c26326

SHA512
251e44647a08aa9594026288544a5c599fbf7b6cdabbf24891e6dca021c85b2515853d72c0ebc61cc8ff299c42c65653b9d1dadae6ca3fed04cd061a9c284e78

Download Submit
C:\Windows\System32\rInMBpX.exe

Filesize
979KB

MD5
ccc4306c39e98045d30185145520cd7c

SHA1
9da32c9945916abafa34d3e7914f264c04c1f40b

SHA256
7375c6e809cefe82b9ed47d349ef1f4c01d7a4d85802c1448cc40995fcaaa6c7

SHA512
1fe0d9cff9011ca23aaf328f9031c1e41e1ac9550520fc92948abc2a05659b43a23cc6101aa22df24739e15a30fe1e7042847d2290577a83b509f2bcb5659a46

Download Submit
C:\Windows\System32\rNtykRk.exe

Filesize
981KB

MD5
fbff0d9e5c76d225732561cfc4b5b17b

SHA1
f60b580701a05dec50b4a8a27f67b27921016a50

SHA256
fe8e8763297a337c2084b605434203a0a11ee7317f6949ba3faf20d691fd8cf5

SHA512
78bf98c631a060b369ffc7bc8db4da77f570324f46a441e2ed90fba85371435cd72c9ddf53b17c67c29db50d98fd15c38b354a486a7e3ad11acc697d5453c368

Download Submit
C:\Windows\System32\sjxNVme.exe

Filesize
984KB

MD5
3f69f87f050624330f7c8cc7d4589490

SHA1
2b43545daf2f4638834d911bc4b3032601b13bd9

SHA256
5ff18b4022d8654badf5633adf6f192e3f9641facaf288e3967d4063e477af0a

SHA512
21b78bc109862e9c569f267a7730b47739f414032762320d2ba14e3588a68417d5628ef73fc19fd16a167a82df67f81ae564f31ba45215ee8288bac1b8b28ec6

Download Submit
C:\Windows\System32\tQLfhbo.exe

Filesize
983KB

MD5
d471b5940ca683e00e2b39f8b75e8a79

SHA1
747daf423ba32080f79dc936a7b933d99112c14e

SHA256
8f59ccb94b3eb3246301956e5bbf2972bc7a59f8adeb6b126d650e8c3094c324

SHA512
bf434078342574b2c63f6e3e70800857d7462d29c7fa4528837b2e26ed4b9ce69140a394234e09de8725f4123ef9af0128c93abc7c61af5c1a2e0b98a7f0877d

Download Submit
C:\Windows\System32\tVWcipw.exe

Filesize
978KB

MD5
a0ac5c7b095c3fc90b0c29607bd24da6

SHA1
a64237fd0ecc713a88117e14ae7450d5fca08ade

SHA256
2c73ff3785d69a6c6142429f6a2563b6242e00c33d699ef8c9a3ac758750ec50

SHA512
48977751fff5f4a54b6efe68e25efa29f1dd359479517f2fe3e99fbba691e0bc5492c4a4b4671ba8e9ca51321e02577e479153432720299a37a4b17a36c35cbf

Download Submit
C:\Windows\System32\toteLKv.exe

Filesize
982KB

MD5
750d7e8e2353f1a03fb0d4ea5ce22d81

SHA1
8724ec07176719865840ef20fa35eff67d4b8022

SHA256
6e8b2dd76ef7df2fd9f984d4fa920f2e9ab34fcb7182c4a47b158a281020e58d

SHA512
e3b969857eb9bda970cc9421be757d289413bd365061e6ff003a710196a80a479b04f9b46a59466eae9a3957b3d95ebd399a4c9079ce626cb523b1dde6fd26d3

Download Submit
C:\Windows\System32\tpjLmid.exe

Filesize
981KB

MD5
ee080e2da09bfc9902b0e56d8ac7ab86

SHA1
a8aafd7c197a10a54f2bc79c13ba960b8d9efc81

SHA256
079c2cd2b73a944104521f074581b2a2fbfc88b44c7d593270d91bbc6753d506

SHA512
607f560634ee561a95ea64539ee37a2e9cac77a25bbe95454e266dba4f2b1310584d643b290b53f796f519f62d414a4e19f5046d842eb10b1c30712080104eed

Download Submit
C:\Windows\System32\ttLkpAY.exe

Filesize
983KB

MD5
3c6d7f42b5c6487dec87d07f450d159d

SHA1
fccdd61758f03ff8cf9fa53e26f18e1fb38c1369

SHA256
692becc454c2efdd8ee61ccf8d89d7a5e47251b6aee7ae048658436cc969398c

SHA512
4184029f8a590cf56893c91653e3a1f95201b8e2431fe033b11a94e595f2d410a1c4a72bb1dcc6a8e31a8695ea091c8c9331776a24da4da32d3a8e74711034a9

Download Submit
C:\Windows\System32\vVMURgz.exe

Filesize
980KB

MD5
d2845dccbabda31920c2fb3ee5d5dc6b

SHA1
5089c5783c2efb2b1770c86e9b2aca5896174e38

SHA256
2c687abcb8b31726071bbcc3b44e683f8bcc0c07ab817138714ff8f5f4483938

SHA512
4dff04482c4e081b11a163f355a9c7381166607ba0bab373b757fc01612e617b18e2c1967273f6296f1f172a7c79f7b3514fc6d9b0e24da878638398df331df2

Download Submit
C:\Windows\System32\vsJfLmr.exe

Filesize
984KB

MD5
5fc3a80e760495c15337ed54d3adb5a9

SHA1
d7aefbdda2940a4566cc287d5c30cb2767e6ca77

SHA256
0cdc7807a57d5d3622a8f38711bd880643b93c05c6a5ae836190c411d67c9a43

SHA512
ea848862658ee8a322d99ea1ad6dcb94708c3b350ee2eb0c4deffc2e8dafffce35596556f06c435db16177ca07761349f1d42c213d84dc572a94ffa815037390

Download Submit
C:\Windows\System32\wwENcdz.exe

Filesize
981KB

MD5
eac4023f6c02b0e7aca52c81da4843af

SHA1
59f137fb7dfaca9f773d8bda1efd6994e72172c1

SHA256
4ab5585fc64bcfe2c6da429c4123049e9452db3994c48134f2ae013611efe2ea

SHA512
2961d6071794e637c1fe5dd748c27403831171d1d54340511f934a7a7ee475d98925e7f55f6fcdc95e0f09ae1bbfd4d36791c14f78c8587527f37a446033e36b

Download Submit
memory/224-1989-0x00007FF6B0830000-0x00007FF6B0C21000-memory.dmp

Filesize
3.9MB

Download
memory/224-32-0x00007FF6B0830000-0x00007FF6B0C21000-memory.dmp

Filesize
3.9MB

Download
memory/224-2043-0x00007FF6B0830000-0x00007FF6B0C21000-memory.dmp

Filesize
3.9MB

Download
memory/436-2070-0x00007FF66D7D0000-0x00007FF66DBC1000-memory.dmp

Filesize
3.9MB

Download
memory/436-407-0x00007FF66D7D0000-0x00007FF66DBC1000-memory.dmp

Filesize
3.9MB

Download
memory/608-2037-0x00007FF63BB70000-0x00007FF63BF61000-memory.dmp

Filesize
3.9MB

Download
memory/608-364-0x00007FF63BB70000-0x00007FF63BF61000-memory.dmp

Filesize
3.9MB

Download
memory/712-21-0x00007FF742B70000-0x00007FF742F61000-memory.dmp

Filesize
3.9MB

Download
memory/712-2034-0x00007FF742B70000-0x00007FF742F61000-memory.dmp

Filesize
3.9MB

Download
memory/712-1987-0x00007FF742B70000-0x00007FF742F61000-memory.dmp

Filesize
3.9MB

Download
memory/980-2028-0x00007FF687D40000-0x00007FF688131000-memory.dmp

Filesize
3.9MB

Download
memory/980-13-0x00007FF687D40000-0x00007FF688131000-memory.dmp

Filesize
3.9MB

Download
memory/1828-376-0x00007FF75E0C0000-0x00007FF75E4B1000-memory.dmp

Filesize
3.9MB

Download
memory/1828-2052-0x00007FF75E0C0000-0x00007FF75E4B1000-memory.dmp

Filesize
3.9MB

Download
memory/2220-2054-0x00007FF64D620000-0x00007FF64DA11000-memory.dmp

Filesize
3.9MB

Download
memory/2220-378-0x00007FF64D620000-0x00007FF64DA11000-memory.dmp

Filesize
3.9MB

Download
memory/2228-380-0x00007FF736740000-0x00007FF736B31000-memory.dmp

Filesize
3.9MB

Download
memory/2228-2056-0x00007FF736740000-0x00007FF736B31000-memory.dmp

Filesize
3.9MB

Download
memory/2420-2022-0x00007FF76EA90000-0x00007FF76EE81000-memory.dmp

Filesize
3.9MB

Download
memory/2420-354-0x00007FF76EA90000-0x00007FF76EE81000-memory.dmp

Filesize
3.9MB

Download
memory/2420-2044-0x00007FF76EA90000-0x00007FF76EE81000-memory.dmp

Filesize
3.9MB

Download
memory/2508-432-0x00007FF7A5F90000-0x00007FF7A6381000-memory.dmp

Filesize
3.9MB

Download
memory/2508-2041-0x00007FF7A5F90000-0x00007FF7A6381000-memory.dmp

Filesize
3.9MB

Download
memory/2524-1986-0x00007FF76AFC0000-0x00007FF76B3B1000-memory.dmp

Filesize
3.9MB

Download
memory/2524-20-0x00007FF76AFC0000-0x00007FF76B3B1000-memory.dmp

Filesize
3.9MB

Download
memory/2524-2031-0x00007FF76AFC0000-0x00007FF76B3B1000-memory.dmp

Filesize
3.9MB

Download
memory/2716-365-0x00007FF698BB0000-0x00007FF698FA1000-memory.dmp

Filesize
3.9MB

Download
memory/2716-2046-0x00007FF698BB0000-0x00007FF698FA1000-memory.dmp

Filesize
3.9MB

Download
memory/2940-2039-0x00007FF602750000-0x00007FF602B41000-memory.dmp

Filesize
3.9MB

Download
memory/2940-360-0x00007FF602750000-0x00007FF602B41000-memory.dmp

Filesize
3.9MB

Download
memory/3184-425-0x00007FF68B990000-0x00007FF68BD81000-memory.dmp

Filesize
3.9MB

Download
memory/3184-2099-0x00007FF68B990000-0x00007FF68BD81000-memory.dmp

Filesize
3.9MB

Download
memory/3208-2068-0x00007FF7C9520000-0x00007FF7C9911000-memory.dmp

Filesize
3.9MB

Download
memory/3208-412-0x00007FF7C9520000-0x00007FF7C9911000-memory.dmp

Filesize
3.9MB

Download
memory/3220-397-0x00007FF729620000-0x00007FF729A11000-memory.dmp

Filesize
3.9MB

Download
memory/3220-2072-0x00007FF729620000-0x00007FF729A11000-memory.dmp

Filesize
3.9MB

Download
memory/3356-387-0x00007FF7A9490000-0x00007FF7A9881000-memory.dmp

Filesize
3.9MB

Download
memory/3356-2075-0x00007FF7A9490000-0x00007FF7A9881000-memory.dmp

Filesize
3.9MB

Download
memory/3372-367-0x00007FF660900000-0x00007FF660CF1000-memory.dmp

Filesize
3.9MB

Download
memory/3372-2048-0x00007FF660900000-0x00007FF660CF1000-memory.dmp

Filesize
3.9MB

Download
memory/4148-431-0x00007FF62E2F0000-0x00007FF62E6E1000-memory.dmp

Filesize
3.9MB

Download
memory/4148-2089-0x00007FF62E2F0000-0x00007FF62E6E1000-memory.dmp

Filesize
3.9MB

Download
memory/4356-1-0x00000182C77E0000-0x00000182C77F0000-memory.dmp

Filesize
64KB

Download
memory/4356-0-0x00007FF78B8F0000-0x00007FF78BCE1000-memory.dmp

Filesize
3.9MB

Download
memory/4392-2098-0x00007FF781860000-0x00007FF781C51000-memory.dmp

Filesize
3.9MB

Download
memory/4392-422-0x00007FF781860000-0x00007FF781C51000-memory.dmp

Filesize
3.9MB

Download
memory/4424-418-0x00007FF746C60000-0x00007FF747051000-memory.dmp

Filesize
3.9MB

Download
memory/4424-2066-0x00007FF746C60000-0x00007FF747051000-memory.dmp

Filesize
3.9MB

Download
memory/4824-2060-0x00007FF61F1B0000-0x00007FF61F5A1000-memory.dmp

Filesize
3.9MB

Download
memory/4824-430-0x00007FF61F1B0000-0x00007FF61F5A1000-memory.dmp

Filesize
3.9MB

Download
memory/4912-31-0x00007FF794580000-0x00007FF794971000-memory.dmp

Filesize
3.9MB

Download
memory/4912-2032-0x00007FF794580000-0x00007FF794971000-memory.dmp

Filesize
3.9MB

Download
memory/4912-1988-0x00007FF794580000-0x00007FF794971000-memory.dmp

Filesize
3.9MB

Download
memory/4988-2050-0x00007FF7AC690000-0x00007FF7ACA81000-memory.dmp

Filesize
3.9MB

Download
memory/4988-372-0x00007FF7AC690000-0x00007FF7ACA81000-memory.dmp

Filesize
3.9MB

Download