xmrig | 5ca67fca26df346fbec8d77c9257697af4e838d6dd56cc298a427be7054304f0

Analysis

max time kernel
60s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
Size

1.0MB
MD5

07e646dc3b6c59e4129493cacdc13cc0
SHA1

a4ad5a4f00283122366821faf2b30010be5a6ea6
SHA256

5ca67fca26df346fbec8d77c9257697af4e838d6dd56cc298a427be7054304f0
SHA512

4899e15cf02c9edf14fbed24f573ce7def92dddf46b1e7714ccc3cf322273caf61d47c3928c045e5ae2bca968536ac6c4a707a7821c752ae02497b1465ef1917
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcmC3f/DFNkTTY:knw9oUUEEDl37jcmWH/YY

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/3320-383-0x00007FF68E310000-0x00007FF68E701000-memory.dmp	xmrig
behavioral2/memory/4112-386-0x00007FF7B6090000-0x00007FF7B6481000-memory.dmp	xmrig
behavioral2/memory/1148-392-0x00007FF7A0520000-0x00007FF7A0911000-memory.dmp	xmrig
behavioral2/memory/2136-393-0x00007FF78B970000-0x00007FF78BD61000-memory.dmp	xmrig
behavioral2/memory/3748-394-0x00007FF7E5E00000-0x00007FF7E61F1000-memory.dmp	xmrig
behavioral2/memory/5084-395-0x00007FF68F130000-0x00007FF68F521000-memory.dmp	xmrig
behavioral2/memory/5104-396-0x00007FF799D20000-0x00007FF79A111000-memory.dmp	xmrig
behavioral2/memory/4064-397-0x00007FF6499E0000-0x00007FF649DD1000-memory.dmp	xmrig
behavioral2/memory/3328-398-0x00007FF7377A0000-0x00007FF737B91000-memory.dmp	xmrig
behavioral2/memory/4104-399-0x00007FF791660000-0x00007FF791A51000-memory.dmp	xmrig
behavioral2/memory/2208-400-0x00007FF689230000-0x00007FF689621000-memory.dmp	xmrig
behavioral2/memory/4516-413-0x00007FF6054D0000-0x00007FF6058C1000-memory.dmp	xmrig
behavioral2/memory/2448-401-0x00007FF779920000-0x00007FF779D11000-memory.dmp	xmrig
behavioral2/memory/1840-417-0x00007FF7F62C0000-0x00007FF7F66B1000-memory.dmp	xmrig
behavioral2/memory/2124-425-0x00007FF770B70000-0x00007FF770F61000-memory.dmp	xmrig
behavioral2/memory/2392-430-0x00007FF78E840000-0x00007FF78EC31000-memory.dmp	xmrig
behavioral2/memory/2388-1960-0x00007FF73F0C0000-0x00007FF73F4B1000-memory.dmp	xmrig
behavioral2/memory/1944-1961-0x00007FF75B6F0000-0x00007FF75BAE1000-memory.dmp	xmrig
behavioral2/memory/2176-1962-0x00007FF749270000-0x00007FF749661000-memory.dmp	xmrig
behavioral2/memory/680-1964-0x00007FF6FEF80000-0x00007FF6FF371000-memory.dmp	xmrig
behavioral2/memory/4948-1963-0x00007FF6C8340000-0x00007FF6C8731000-memory.dmp	xmrig
behavioral2/memory/3764-1975-0x00007FF66D6F0000-0x00007FF66DAE1000-memory.dmp	xmrig
behavioral2/memory/396-1976-0x00007FF678F10000-0x00007FF679301000-memory.dmp	xmrig
behavioral2/memory/3624-1999-0x00007FF7A8AE0000-0x00007FF7A8ED1000-memory.dmp	xmrig
behavioral2/memory/3348-2002-0x00007FF63FF60000-0x00007FF640351000-memory.dmp	xmrig
behavioral2/memory/2388-2014-0x00007FF73F0C0000-0x00007FF73F4B1000-memory.dmp	xmrig
behavioral2/memory/4948-2016-0x00007FF6C8340000-0x00007FF6C8731000-memory.dmp	xmrig
behavioral2/memory/680-2018-0x00007FF6FEF80000-0x00007FF6FF371000-memory.dmp	xmrig
behavioral2/memory/2176-2020-0x00007FF749270000-0x00007FF749661000-memory.dmp	xmrig
behavioral2/memory/3764-2022-0x00007FF66D6F0000-0x00007FF66DAE1000-memory.dmp	xmrig
behavioral2/memory/4064-2029-0x00007FF6499E0000-0x00007FF649DD1000-memory.dmp	xmrig
behavioral2/memory/3320-2027-0x00007FF68E310000-0x00007FF68E701000-memory.dmp	xmrig
behavioral2/memory/4112-2046-0x00007FF7B6090000-0x00007FF7B6481000-memory.dmp	xmrig
behavioral2/memory/4104-2049-0x00007FF791660000-0x00007FF791A51000-memory.dmp	xmrig
behavioral2/memory/2208-2052-0x00007FF689230000-0x00007FF689621000-memory.dmp	xmrig
behavioral2/memory/4516-2056-0x00007FF6054D0000-0x00007FF6058C1000-memory.dmp	xmrig
behavioral2/memory/2392-2060-0x00007FF78E840000-0x00007FF78EC31000-memory.dmp	xmrig
behavioral2/memory/2124-2058-0x00007FF770B70000-0x00007FF770F61000-memory.dmp	xmrig
behavioral2/memory/1840-2054-0x00007FF7F62C0000-0x00007FF7F66B1000-memory.dmp	xmrig
behavioral2/memory/2448-2051-0x00007FF779920000-0x00007FF779D11000-memory.dmp	xmrig
behavioral2/memory/3328-2044-0x00007FF7377A0000-0x00007FF737B91000-memory.dmp	xmrig
behavioral2/memory/3348-2042-0x00007FF63FF60000-0x00007FF640351000-memory.dmp	xmrig
behavioral2/memory/3624-2041-0x00007FF7A8AE0000-0x00007FF7A8ED1000-memory.dmp	xmrig
behavioral2/memory/396-2039-0x00007FF678F10000-0x00007FF679301000-memory.dmp	xmrig
behavioral2/memory/2136-2035-0x00007FF78B970000-0x00007FF78BD61000-memory.dmp	xmrig
behavioral2/memory/5104-2031-0x00007FF799D20000-0x00007FF79A111000-memory.dmp	xmrig
behavioral2/memory/5084-2025-0x00007FF68F130000-0x00007FF68F521000-memory.dmp	xmrig
behavioral2/memory/1148-2036-0x00007FF7A0520000-0x00007FF7A0911000-memory.dmp	xmrig
behavioral2/memory/3748-2033-0x00007FF7E5E00000-0x00007FF7E61F1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2388	LQRcwFj.exe
4948	wbTKCVL.exe
680	AGuBqQv.exe
2176	vgwtxbu.exe
3624	xeHLTki.exe
3764	moqtDxR.exe
396	wcQhcyh.exe
3348	xUWitsd.exe
3320	LaGAxzk.exe
4112	YbmsKYk.exe
1148	utGbWrY.exe
2136	xMQNXDm.exe
3748	EhwEAbd.exe
5084	IwYdliS.exe
5104	wnUGUGQ.exe
4064	AeMtSnF.exe
3328	hOCQmtk.exe
4104	BLqDpYD.exe
2208	wZXHaRe.exe
2448	WlmWHxq.exe
4516	xcyGkFn.exe
1840	CzRlMgD.exe
2124	OcDeANW.exe
2392	YsqYLWo.exe
1924	ZDrzdLK.exe
4572	afiqtBI.exe
2344	rtAKSGU.exe
2656	RdUmOHn.exe
3656	jKqtwun.exe
4884	egeWKOB.exe
4072	ruhsRJv.exe
1140	DGhlEgt.exe
688	apJqSeX.exe
4068	oknVBGF.exe
4244	VHyxYIG.exe
1844	VCATXTD.exe
880	nMZphVk.exe
1552	arsYXby.exe
3584	qQNOUAe.exe
4008	FMztBcD.exe
3088	OYvUjnI.exe
2300	LuWnIrP.exe
4216	SEAijZV.exe
3896	sYnERip.exe
4344	adDgCBW.exe
3068	qgUJWZl.exe
1132	FyQWSku.exe
184	PTghujj.exe
3376	DBjIHsy.exe
4372	gGNRMqv.exe
3324	VQLPUnv.exe
1184	geArmEf.exe
736	cLkvoGc.exe
2852	gZHRPco.exe
4836	qzIBKAs.exe
3712	sGyevTL.exe
1484	QiNLuzl.exe
636	KSCnLrt.exe
4564	eNFCgUE.exe
1952	rBjBQzF.exe
2872	IURXKhh.exe
4100	ODdAhQK.exe
628	fHyWONN.exe
3688	knRfFsR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1944-0-0x00007FF75B6F0000-0x00007FF75BAE1000-memory.dmp	upx
behavioral2/files/0x000b000000023b6f-5.dat	upx
behavioral2/memory/2176-21-0x00007FF749270000-0x00007FF749661000-memory.dmp	upx
behavioral2/files/0x000a000000023b78-30.dat	upx
behavioral2/memory/3764-34-0x00007FF66D6F0000-0x00007FF66DAE1000-memory.dmp	upx
behavioral2/files/0x000a000000023b77-36.dat	upx
behavioral2/files/0x000a000000023b7a-54.dat	upx
behavioral2/files/0x000a000000023b7d-69.dat	upx
behavioral2/files/0x000a000000023b7e-75.dat	upx
behavioral2/files/0x000a000000023b82-94.dat	upx
behavioral2/files/0x000a000000023b87-120.dat	upx
behavioral2/files/0x000a000000023b8f-157.dat	upx
behavioral2/memory/3320-383-0x00007FF68E310000-0x00007FF68E701000-memory.dmp	upx
behavioral2/memory/4112-386-0x00007FF7B6090000-0x00007FF7B6481000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-169.dat	upx
behavioral2/files/0x000a000000023b90-164.dat	upx
behavioral2/files/0x000a000000023b8e-155.dat	upx
behavioral2/files/0x000a000000023b8d-150.dat	upx
behavioral2/files/0x000a000000023b8c-144.dat	upx
behavioral2/files/0x000a000000023b8b-139.dat	upx
behavioral2/files/0x000a000000023b8a-135.dat	upx
behavioral2/files/0x000a000000023b89-129.dat	upx
behavioral2/files/0x000a000000023b88-124.dat	upx
behavioral2/files/0x000a000000023b86-114.dat	upx
behavioral2/files/0x000a000000023b85-110.dat	upx
behavioral2/files/0x000a000000023b84-104.dat	upx
behavioral2/files/0x000a000000023b83-100.dat	upx
behavioral2/files/0x000a000000023b81-90.dat	upx
behavioral2/files/0x000a000000023b80-84.dat	upx
behavioral2/files/0x000a000000023b7f-79.dat	upx
behavioral2/files/0x000a000000023b7c-65.dat	upx
behavioral2/files/0x000a000000023b7b-59.dat	upx
behavioral2/files/0x000a000000023b79-50.dat	upx
behavioral2/memory/3348-49-0x00007FF63FF60000-0x00007FF640351000-memory.dmp	upx
behavioral2/memory/396-46-0x00007FF678F10000-0x00007FF679301000-memory.dmp	upx
behavioral2/memory/3624-40-0x00007FF7A8AE0000-0x00007FF7A8ED1000-memory.dmp	upx
behavioral2/files/0x000a000000023b76-44.dat	upx
behavioral2/files/0x000a000000023b75-33.dat	upx
behavioral2/memory/680-32-0x00007FF6FEF80000-0x00007FF6FF371000-memory.dmp	upx
behavioral2/files/0x000a000000023b74-29.dat	upx
behavioral2/memory/4948-27-0x00007FF6C8340000-0x00007FF6C8731000-memory.dmp	upx
behavioral2/files/0x000a000000023b73-25.dat	upx
behavioral2/memory/2388-17-0x00007FF73F0C0000-0x00007FF73F4B1000-memory.dmp	upx
behavioral2/memory/1148-392-0x00007FF7A0520000-0x00007FF7A0911000-memory.dmp	upx
behavioral2/memory/2136-393-0x00007FF78B970000-0x00007FF78BD61000-memory.dmp	upx
behavioral2/memory/3748-394-0x00007FF7E5E00000-0x00007FF7E61F1000-memory.dmp	upx
behavioral2/memory/5084-395-0x00007FF68F130000-0x00007FF68F521000-memory.dmp	upx
behavioral2/memory/5104-396-0x00007FF799D20000-0x00007FF79A111000-memory.dmp	upx
behavioral2/memory/4064-397-0x00007FF6499E0000-0x00007FF649DD1000-memory.dmp	upx
behavioral2/memory/3328-398-0x00007FF7377A0000-0x00007FF737B91000-memory.dmp	upx
behavioral2/memory/4104-399-0x00007FF791660000-0x00007FF791A51000-memory.dmp	upx
behavioral2/memory/2208-400-0x00007FF689230000-0x00007FF689621000-memory.dmp	upx
behavioral2/memory/4516-413-0x00007FF6054D0000-0x00007FF6058C1000-memory.dmp	upx
behavioral2/memory/2448-401-0x00007FF779920000-0x00007FF779D11000-memory.dmp	upx
behavioral2/memory/1840-417-0x00007FF7F62C0000-0x00007FF7F66B1000-memory.dmp	upx
behavioral2/memory/2124-425-0x00007FF770B70000-0x00007FF770F61000-memory.dmp	upx
behavioral2/memory/2392-430-0x00007FF78E840000-0x00007FF78EC31000-memory.dmp	upx
behavioral2/memory/2388-1960-0x00007FF73F0C0000-0x00007FF73F4B1000-memory.dmp	upx
behavioral2/memory/1944-1961-0x00007FF75B6F0000-0x00007FF75BAE1000-memory.dmp	upx
behavioral2/memory/2176-1962-0x00007FF749270000-0x00007FF749661000-memory.dmp	upx
behavioral2/memory/680-1964-0x00007FF6FEF80000-0x00007FF6FF371000-memory.dmp	upx
behavioral2/memory/4948-1963-0x00007FF6C8340000-0x00007FF6C8731000-memory.dmp	upx
behavioral2/memory/3764-1975-0x00007FF66D6F0000-0x00007FF66DAE1000-memory.dmp	upx
behavioral2/memory/396-1976-0x00007FF678F10000-0x00007FF679301000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\teRonyV.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\PYuoGVw.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\eqhejQD.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\ZNJCyhz.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\yAtmUmL.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\otcaKoY.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\mzsiuvJ.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\jKLMOtr.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\CvtUFWg.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\CiRtCtk.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\AlLemLF.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\wSDsSnu.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\RVFnTqB.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\drshzay.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\fUHNVrm.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\OHasYfv.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\IEDcIEt.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\NorWAtO.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\BwmLRTt.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\xowvHVX.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\BWlzZyF.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\WOlKyqq.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\qOygIbL.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\vRwFuuD.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\EhwEAbd.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\IwYdliS.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\uAPrGhe.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\AOjYmdg.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\ABMolQo.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\QAinkxo.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\PioblIr.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\PmfodBX.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\mxwRBsL.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\FQBEqMn.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\VwlTttZ.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\gmOqavG.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\eyxaMzd.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\PMZzzfj.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\jKkoNwQ.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\inFMGFi.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\oHfJEoj.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\jmOZSNh.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\NJMGgas.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\LFlhseV.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\CRulaNN.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\HpzxNzd.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\NprAoXe.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\RuqJlpE.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\wqBMWvv.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\wvFtFhx.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\fzNEDhA.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\szGihlf.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\TuuGAdF.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\PczmFmb.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\VHyxYIG.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\IURXKhh.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\NFQNURm.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\loLJuSa.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\qsXvMtT.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\vexfAzn.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\YbmsKYk.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\YsqYLWo.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\MtWUGtm.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
File created	C:\Windows\System32\tBBOYMu.exe	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2388	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	84
PID 1944 wrote to memory of 2388	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	84
PID 1944 wrote to memory of 4948	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	85
PID 1944 wrote to memory of 4948	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	85
PID 1944 wrote to memory of 680	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	86
PID 1944 wrote to memory of 680	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	86
PID 1944 wrote to memory of 2176	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	87
PID 1944 wrote to memory of 2176	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	87
PID 1944 wrote to memory of 3624	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	88
PID 1944 wrote to memory of 3624	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	88
PID 1944 wrote to memory of 3764	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	89
PID 1944 wrote to memory of 3764	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	89
PID 1944 wrote to memory of 396	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	90
PID 1944 wrote to memory of 396	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	90
PID 1944 wrote to memory of 3348	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	91
PID 1944 wrote to memory of 3348	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	91
PID 1944 wrote to memory of 3320	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	92
PID 1944 wrote to memory of 3320	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	92
PID 1944 wrote to memory of 4112	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	93
PID 1944 wrote to memory of 4112	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	93
PID 1944 wrote to memory of 1148	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	94
PID 1944 wrote to memory of 1148	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	94
PID 1944 wrote to memory of 2136	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	95
PID 1944 wrote to memory of 2136	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	95
PID 1944 wrote to memory of 3748	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	96
PID 1944 wrote to memory of 3748	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	96
PID 1944 wrote to memory of 5084	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	97
PID 1944 wrote to memory of 5084	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	97
PID 1944 wrote to memory of 5104	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	98
PID 1944 wrote to memory of 5104	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	98
PID 1944 wrote to memory of 4064	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	99
PID 1944 wrote to memory of 4064	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	99
PID 1944 wrote to memory of 3328	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	100
PID 1944 wrote to memory of 3328	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	100
PID 1944 wrote to memory of 4104	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	101
PID 1944 wrote to memory of 4104	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	101
PID 1944 wrote to memory of 2208	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	102
PID 1944 wrote to memory of 2208	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	102
PID 1944 wrote to memory of 2448	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	103
PID 1944 wrote to memory of 2448	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	103
PID 1944 wrote to memory of 4516	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	104
PID 1944 wrote to memory of 4516	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	104
PID 1944 wrote to memory of 1840	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	105
PID 1944 wrote to memory of 1840	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	105
PID 1944 wrote to memory of 2124	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	106
PID 1944 wrote to memory of 2124	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	106
PID 1944 wrote to memory of 2392	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	107
PID 1944 wrote to memory of 2392	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	107
PID 1944 wrote to memory of 1924	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	108
PID 1944 wrote to memory of 1924	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	108
PID 1944 wrote to memory of 4572	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	109
PID 1944 wrote to memory of 4572	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	109
PID 1944 wrote to memory of 2344	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	110
PID 1944 wrote to memory of 2344	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	110
PID 1944 wrote to memory of 2656	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	111
PID 1944 wrote to memory of 2656	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	111
PID 1944 wrote to memory of 3656	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	112
PID 1944 wrote to memory of 3656	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	112
PID 1944 wrote to memory of 4884	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	113
PID 1944 wrote to memory of 4884	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	113
PID 1944 wrote to memory of 4072	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	114
PID 1944 wrote to memory of 4072	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	114
PID 1944 wrote to memory of 1140	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	115
PID 1944 wrote to memory of 1140	1944	07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07e646dc3b6c59e4129493cacdc13cc0_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\System32\LQRcwFj.exe
  C:\Windows\System32\LQRcwFj.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System32\wbTKCVL.exe
  C:\Windows\System32\wbTKCVL.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System32\AGuBqQv.exe
  C:\Windows\System32\AGuBqQv.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System32\vgwtxbu.exe
  C:\Windows\System32\vgwtxbu.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System32\xeHLTki.exe
  C:\Windows\System32\xeHLTki.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System32\moqtDxR.exe
  C:\Windows\System32\moqtDxR.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System32\wcQhcyh.exe
  C:\Windows\System32\wcQhcyh.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System32\xUWitsd.exe
  C:\Windows\System32\xUWitsd.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System32\LaGAxzk.exe
  C:\Windows\System32\LaGAxzk.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System32\YbmsKYk.exe
  C:\Windows\System32\YbmsKYk.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System32\utGbWrY.exe
  C:\Windows\System32\utGbWrY.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System32\xMQNXDm.exe
  C:\Windows\System32\xMQNXDm.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System32\EhwEAbd.exe
  C:\Windows\System32\EhwEAbd.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System32\IwYdliS.exe
  C:\Windows\System32\IwYdliS.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System32\wnUGUGQ.exe
  C:\Windows\System32\wnUGUGQ.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System32\AeMtSnF.exe
  C:\Windows\System32\AeMtSnF.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System32\hOCQmtk.exe
  C:\Windows\System32\hOCQmtk.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System32\BLqDpYD.exe
  C:\Windows\System32\BLqDpYD.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System32\wZXHaRe.exe
  C:\Windows\System32\wZXHaRe.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System32\WlmWHxq.exe
  C:\Windows\System32\WlmWHxq.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System32\xcyGkFn.exe
  C:\Windows\System32\xcyGkFn.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System32\CzRlMgD.exe
  C:\Windows\System32\CzRlMgD.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System32\OcDeANW.exe
  C:\Windows\System32\OcDeANW.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System32\YsqYLWo.exe
  C:\Windows\System32\YsqYLWo.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System32\ZDrzdLK.exe
  C:\Windows\System32\ZDrzdLK.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System32\afiqtBI.exe
  C:\Windows\System32\afiqtBI.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System32\rtAKSGU.exe
  C:\Windows\System32\rtAKSGU.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System32\RdUmOHn.exe
  C:\Windows\System32\RdUmOHn.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System32\jKqtwun.exe
  C:\Windows\System32\jKqtwun.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System32\egeWKOB.exe
  C:\Windows\System32\egeWKOB.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System32\ruhsRJv.exe
  C:\Windows\System32\ruhsRJv.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System32\DGhlEgt.exe
  C:\Windows\System32\DGhlEgt.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System32\apJqSeX.exe
  C:\Windows\System32\apJqSeX.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System32\oknVBGF.exe
  C:\Windows\System32\oknVBGF.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System32\VHyxYIG.exe
  C:\Windows\System32\VHyxYIG.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System32\VCATXTD.exe
  C:\Windows\System32\VCATXTD.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System32\nMZphVk.exe
  C:\Windows\System32\nMZphVk.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System32\arsYXby.exe
  C:\Windows\System32\arsYXby.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System32\qQNOUAe.exe
  C:\Windows\System32\qQNOUAe.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System32\FMztBcD.exe
  C:\Windows\System32\FMztBcD.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System32\OYvUjnI.exe
  C:\Windows\System32\OYvUjnI.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System32\LuWnIrP.exe
  C:\Windows\System32\LuWnIrP.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System32\SEAijZV.exe
  C:\Windows\System32\SEAijZV.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System32\sYnERip.exe
  C:\Windows\System32\sYnERip.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System32\adDgCBW.exe
  C:\Windows\System32\adDgCBW.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System32\qgUJWZl.exe
  C:\Windows\System32\qgUJWZl.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System32\FyQWSku.exe
  C:\Windows\System32\FyQWSku.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System32\PTghujj.exe
  C:\Windows\System32\PTghujj.exe
  2⤵
  - Executes dropped EXE
  PID:184
- C:\Windows\System32\DBjIHsy.exe
  C:\Windows\System32\DBjIHsy.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System32\gGNRMqv.exe
  C:\Windows\System32\gGNRMqv.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System32\VQLPUnv.exe
  C:\Windows\System32\VQLPUnv.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System32\geArmEf.exe
  C:\Windows\System32\geArmEf.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System32\cLkvoGc.exe
  C:\Windows\System32\cLkvoGc.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System32\gZHRPco.exe
  C:\Windows\System32\gZHRPco.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System32\qzIBKAs.exe
  C:\Windows\System32\qzIBKAs.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System32\sGyevTL.exe
  C:\Windows\System32\sGyevTL.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System32\QiNLuzl.exe
  C:\Windows\System32\QiNLuzl.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System32\KSCnLrt.exe
  C:\Windows\System32\KSCnLrt.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System32\eNFCgUE.exe
  C:\Windows\System32\eNFCgUE.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System32\rBjBQzF.exe
  C:\Windows\System32\rBjBQzF.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System32\IURXKhh.exe
  C:\Windows\System32\IURXKhh.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System32\ODdAhQK.exe
  C:\Windows\System32\ODdAhQK.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System32\fHyWONN.exe
  C:\Windows\System32\fHyWONN.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System32\knRfFsR.exe
  C:\Windows\System32\knRfFsR.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System32\IEDcIEt.exe
  C:\Windows\System32\IEDcIEt.exe
  2⤵
  PID:2748
- C:\Windows\System32\kdajRBz.exe
  C:\Windows\System32\kdajRBz.exe
  2⤵
  PID:432
- C:\Windows\System32\xnxoHuc.exe
  C:\Windows\System32\xnxoHuc.exe
  2⤵
  PID:1976
- C:\Windows\System32\bBOKWjT.exe
  C:\Windows\System32\bBOKWjT.exe
  2⤵
  PID:8
- C:\Windows\System32\IFQtDjl.exe
  C:\Windows\System32\IFQtDjl.exe
  2⤵
  PID:3256
- C:\Windows\System32\xowvHVX.exe
  C:\Windows\System32\xowvHVX.exe
  2⤵
  PID:1284
- C:\Windows\System32\mhwyUoR.exe
  C:\Windows\System32\mhwyUoR.exe
  2⤵
  PID:2528
- C:\Windows\System32\jutpDBS.exe
  C:\Windows\System32\jutpDBS.exe
  2⤵
  PID:4308
- C:\Windows\System32\mxwRBsL.exe
  C:\Windows\System32\mxwRBsL.exe
  2⤵
  PID:4444
- C:\Windows\System32\EnbGIVT.exe
  C:\Windows\System32\EnbGIVT.exe
  2⤵
  PID:464
- C:\Windows\System32\kEbHIql.exe
  C:\Windows\System32\kEbHIql.exe
  2⤵
  PID:4720
- C:\Windows\System32\BkvuJRh.exe
  C:\Windows\System32\BkvuJRh.exe
  2⤵
  PID:2000
- C:\Windows\System32\LNGiJGf.exe
  C:\Windows\System32\LNGiJGf.exe
  2⤵
  PID:3628
- C:\Windows\System32\NOXyvDk.exe
  C:\Windows\System32\NOXyvDk.exe
  2⤵
  PID:1028
- C:\Windows\System32\vpRVxsW.exe
  C:\Windows\System32\vpRVxsW.exe
  2⤵
  PID:2624
- C:\Windows\System32\oALgznR.exe
  C:\Windows\System32\oALgznR.exe
  2⤵
  PID:4896
- C:\Windows\System32\OFgefZS.exe
  C:\Windows\System32\OFgefZS.exe
  2⤵
  PID:1792
- C:\Windows\System32\WrdwNvI.exe
  C:\Windows\System32\WrdwNvI.exe
  2⤵
  PID:2744
- C:\Windows\System32\IZQsCNq.exe
  C:\Windows\System32\IZQsCNq.exe
  2⤵
  PID:4432
- C:\Windows\System32\IbuzLhM.exe
  C:\Windows\System32\IbuzLhM.exe
  2⤵
  PID:1172
- C:\Windows\System32\kYqLVmy.exe
  C:\Windows\System32\kYqLVmy.exe
  2⤵
  PID:784
- C:\Windows\System32\JCSYdVx.exe
  C:\Windows\System32\JCSYdVx.exe
  2⤵
  PID:4460
- C:\Windows\System32\GkMdRJv.exe
  C:\Windows\System32\GkMdRJv.exe
  2⤵
  PID:5092
- C:\Windows\System32\fMNbjGd.exe
  C:\Windows\System32\fMNbjGd.exe
  2⤵
  PID:2768
- C:\Windows\System32\WOlKyqq.exe
  C:\Windows\System32\WOlKyqq.exe
  2⤵
  PID:780
- C:\Windows\System32\cBQttfs.exe
  C:\Windows\System32\cBQttfs.exe
  2⤵
  PID:3876
- C:\Windows\System32\GHnzCCX.exe
  C:\Windows\System32\GHnzCCX.exe
  2⤵
  PID:4508
- C:\Windows\System32\aoedewH.exe
  C:\Windows\System32\aoedewH.exe
  2⤵
  PID:1744
- C:\Windows\System32\zHAGSxF.exe
  C:\Windows\System32\zHAGSxF.exe
  2⤵
  PID:5140
- C:\Windows\System32\kqqRCZB.exe
  C:\Windows\System32\kqqRCZB.exe
  2⤵
  PID:5168
- C:\Windows\System32\inFMGFi.exe
  C:\Windows\System32\inFMGFi.exe
  2⤵
  PID:5200
- C:\Windows\System32\cAziaqU.exe
  C:\Windows\System32\cAziaqU.exe
  2⤵
  PID:5220
- C:\Windows\System32\NpFvySz.exe
  C:\Windows\System32\NpFvySz.exe
  2⤵
  PID:5252
- C:\Windows\System32\AXJDRql.exe
  C:\Windows\System32\AXJDRql.exe
  2⤵
  PID:5276
- C:\Windows\System32\WIDdeTO.exe
  C:\Windows\System32\WIDdeTO.exe
  2⤵
  PID:5308
- C:\Windows\System32\MabhYMi.exe
  C:\Windows\System32\MabhYMi.exe
  2⤵
  PID:5332
- C:\Windows\System32\ouOStfs.exe
  C:\Windows\System32\ouOStfs.exe
  2⤵
  PID:5364
- C:\Windows\System32\rCnCODr.exe
  C:\Windows\System32\rCnCODr.exe
  2⤵
  PID:5392
- C:\Windows\System32\hiQpmoe.exe
  C:\Windows\System32\hiQpmoe.exe
  2⤵
  PID:5416
- C:\Windows\System32\DqoCYOX.exe
  C:\Windows\System32\DqoCYOX.exe
  2⤵
  PID:5480
- C:\Windows\System32\GpEjMWv.exe
  C:\Windows\System32\GpEjMWv.exe
  2⤵
  PID:5500
- C:\Windows\System32\JhTQdfc.exe
  C:\Windows\System32\JhTQdfc.exe
  2⤵
  PID:5528
- C:\Windows\System32\yuNRgkU.exe
  C:\Windows\System32\yuNRgkU.exe
  2⤵
  PID:5600
- C:\Windows\System32\QpAPQjg.exe
  C:\Windows\System32\QpAPQjg.exe
  2⤵
  PID:5624
- C:\Windows\System32\ARIboFs.exe
  C:\Windows\System32\ARIboFs.exe
  2⤵
  PID:5644
- C:\Windows\System32\PYuoGVw.exe
  C:\Windows\System32\PYuoGVw.exe
  2⤵
  PID:5672
- C:\Windows\System32\PniCmvn.exe
  C:\Windows\System32\PniCmvn.exe
  2⤵
  PID:5704
- C:\Windows\System32\ObvrGmg.exe
  C:\Windows\System32\ObvrGmg.exe
  2⤵
  PID:5748
- C:\Windows\System32\qAPidJX.exe
  C:\Windows\System32\qAPidJX.exe
  2⤵
  PID:5768
- C:\Windows\System32\WaPXlaf.exe
  C:\Windows\System32\WaPXlaf.exe
  2⤵
  PID:5796
- C:\Windows\System32\Rtnhicu.exe
  C:\Windows\System32\Rtnhicu.exe
  2⤵
  PID:5812
- C:\Windows\System32\FQBEqMn.exe
  C:\Windows\System32\FQBEqMn.exe
  2⤵
  PID:5832
- C:\Windows\System32\QJUqXbM.exe
  C:\Windows\System32\QJUqXbM.exe
  2⤵
  PID:5860
- C:\Windows\System32\uDuoAts.exe
  C:\Windows\System32\uDuoAts.exe
  2⤵
  PID:5876
- C:\Windows\System32\vFgKJHd.exe
  C:\Windows\System32\vFgKJHd.exe
  2⤵
  PID:5920
- C:\Windows\System32\mifbXgA.exe
  C:\Windows\System32\mifbXgA.exe
  2⤵
  PID:5960
- C:\Windows\System32\efeAJhZ.exe
  C:\Windows\System32\efeAJhZ.exe
  2⤵
  PID:5988
- C:\Windows\System32\lAEdbUz.exe
  C:\Windows\System32\lAEdbUz.exe
  2⤵
  PID:6036
- C:\Windows\System32\kFQaDnM.exe
  C:\Windows\System32\kFQaDnM.exe
  2⤵
  PID:6056
- C:\Windows\System32\BWlzZyF.exe
  C:\Windows\System32\BWlzZyF.exe
  2⤵
  PID:6072
- C:\Windows\System32\oihOJZX.exe
  C:\Windows\System32\oihOJZX.exe
  2⤵
  PID:6092
- C:\Windows\System32\cWZxjuq.exe
  C:\Windows\System32\cWZxjuq.exe
  2⤵
  PID:6116
- C:\Windows\System32\KMfbTZS.exe
  C:\Windows\System32\KMfbTZS.exe
  2⤵
  PID:6132
- C:\Windows\System32\uAPrGhe.exe
  C:\Windows\System32\uAPrGhe.exe
  2⤵
  PID:876
- C:\Windows\System32\pLxRVkE.exe
  C:\Windows\System32\pLxRVkE.exe
  2⤵
  PID:1444
- C:\Windows\System32\AUmKdni.exe
  C:\Windows\System32\AUmKdni.exe
  2⤵
  PID:5148
- C:\Windows\System32\GyVNuLX.exe
  C:\Windows\System32\GyVNuLX.exe
  2⤵
  PID:1752
- C:\Windows\System32\AOjYmdg.exe
  C:\Windows\System32\AOjYmdg.exe
  2⤵
  PID:5216
- C:\Windows\System32\ClOxJZK.exe
  C:\Windows\System32\ClOxJZK.exe
  2⤵
  PID:4988
- C:\Windows\System32\hvoNqCW.exe
  C:\Windows\System32\hvoNqCW.exe
  2⤵
  PID:2184
- C:\Windows\System32\TNSrbsp.exe
  C:\Windows\System32\TNSrbsp.exe
  2⤵
  PID:5284
- C:\Windows\System32\QZYDnwS.exe
  C:\Windows\System32\QZYDnwS.exe
  2⤵
  PID:5324
- C:\Windows\System32\zAHWoir.exe
  C:\Windows\System32\zAHWoir.exe
  2⤵
  PID:5372
- C:\Windows\System32\DVISIhd.exe
  C:\Windows\System32\DVISIhd.exe
  2⤵
  PID:2368
- C:\Windows\System32\SoBpHIF.exe
  C:\Windows\System32\SoBpHIF.exe
  2⤵
  PID:852
- C:\Windows\System32\ePzbagk.exe
  C:\Windows\System32\ePzbagk.exe
  2⤵
  PID:3472
- C:\Windows\System32\VqRiHso.exe
  C:\Windows\System32\VqRiHso.exe
  2⤵
  PID:3956
- C:\Windows\System32\fgdbhdj.exe
  C:\Windows\System32\fgdbhdj.exe
  2⤵
  PID:5492
- C:\Windows\System32\Jysxhoh.exe
  C:\Windows\System32\Jysxhoh.exe
  2⤵
  PID:5552
- C:\Windows\System32\cErdalP.exe
  C:\Windows\System32\cErdalP.exe
  2⤵
  PID:5596
- C:\Windows\System32\kXdMgzB.exe
  C:\Windows\System32\kXdMgzB.exe
  2⤵
  PID:5688
- C:\Windows\System32\HfOenpT.exe
  C:\Windows\System32\HfOenpT.exe
  2⤵
  PID:5684
- C:\Windows\System32\fbiiEII.exe
  C:\Windows\System32\fbiiEII.exe
  2⤵
  PID:5760
- C:\Windows\System32\XMIbfpM.exe
  C:\Windows\System32\XMIbfpM.exe
  2⤵
  PID:5884
- C:\Windows\System32\iMrJTjL.exe
  C:\Windows\System32\iMrJTjL.exe
  2⤵
  PID:5912
- C:\Windows\System32\BwmLRTt.exe
  C:\Windows\System32\BwmLRTt.exe
  2⤵
  PID:6020
- C:\Windows\System32\wkLdKng.exe
  C:\Windows\System32\wkLdKng.exe
  2⤵
  PID:6068
- C:\Windows\System32\NFQNURm.exe
  C:\Windows\System32\NFQNURm.exe
  2⤵
  PID:6104
- C:\Windows\System32\cMZhUrb.exe
  C:\Windows\System32\cMZhUrb.exe
  2⤵
  PID:3044
- C:\Windows\System32\xNmyEbo.exe
  C:\Windows\System32\xNmyEbo.exe
  2⤵
  PID:5176
- C:\Windows\System32\qViJwFh.exe
  C:\Windows\System32\qViJwFh.exe
  2⤵
  PID:2036
- C:\Windows\System32\RzchdGj.exe
  C:\Windows\System32\RzchdGj.exe
  2⤵
  PID:5296
- C:\Windows\System32\GubiaGz.exe
  C:\Windows\System32\GubiaGz.exe
  2⤵
  PID:5328
- C:\Windows\System32\vLVASld.exe
  C:\Windows\System32\vLVASld.exe
  2⤵
  PID:2716
- C:\Windows\System32\QPANkKZ.exe
  C:\Windows\System32\QPANkKZ.exe
  2⤵
  PID:1660
- C:\Windows\System32\oQOdtvy.exe
  C:\Windows\System32\oQOdtvy.exe
  2⤵
  PID:5588
- C:\Windows\System32\ZDXDHuA.exe
  C:\Windows\System32\ZDXDHuA.exe
  2⤵
  PID:5776
- C:\Windows\System32\IebDSuK.exe
  C:\Windows\System32\IebDSuK.exe
  2⤵
  PID:5900
- C:\Windows\System32\CvtUFWg.exe
  C:\Windows\System32\CvtUFWg.exe
  2⤵
  PID:5732
- C:\Windows\System32\UKlPUSB.exe
  C:\Windows\System32\UKlPUSB.exe
  2⤵
  PID:6112
- C:\Windows\System32\gEExywn.exe
  C:\Windows\System32\gEExywn.exe
  2⤵
  PID:2660
- C:\Windows\System32\WRlUyIM.exe
  C:\Windows\System32\WRlUyIM.exe
  2⤵
  PID:5188
- C:\Windows\System32\CQiUauK.exe
  C:\Windows\System32\CQiUauK.exe
  2⤵
  PID:4616
- C:\Windows\System32\MqCJJzy.exe
  C:\Windows\System32\MqCJJzy.exe
  2⤵
  PID:4780
- C:\Windows\System32\YNTOKXb.exe
  C:\Windows\System32\YNTOKXb.exe
  2⤵
  PID:6088
- C:\Windows\System32\uJYYkTT.exe
  C:\Windows\System32\uJYYkTT.exe
  2⤵
  PID:5228
- C:\Windows\System32\FRojuaB.exe
  C:\Windows\System32\FRojuaB.exe
  2⤵
  PID:5260
- C:\Windows\System32\rmwWDpf.exe
  C:\Windows\System32\rmwWDpf.exe
  2⤵
  PID:6172
- C:\Windows\System32\fzNEDhA.exe
  C:\Windows\System32\fzNEDhA.exe
  2⤵
  PID:6200
- C:\Windows\System32\OCkrhWr.exe
  C:\Windows\System32\OCkrhWr.exe
  2⤵
  PID:6228
- C:\Windows\System32\TEWVeXQ.exe
  C:\Windows\System32\TEWVeXQ.exe
  2⤵
  PID:6252
- C:\Windows\System32\AxbmMkP.exe
  C:\Windows\System32\AxbmMkP.exe
  2⤵
  PID:6276
- C:\Windows\System32\nVVkOHU.exe
  C:\Windows\System32\nVVkOHU.exe
  2⤵
  PID:6304
- C:\Windows\System32\CfuqwSN.exe
  C:\Windows\System32\CfuqwSN.exe
  2⤵
  PID:6332
- C:\Windows\System32\oHfJEoj.exe
  C:\Windows\System32\oHfJEoj.exe
  2⤵
  PID:6348
- C:\Windows\System32\nsQRFtt.exe
  C:\Windows\System32\nsQRFtt.exe
  2⤵
  PID:6376
- C:\Windows\System32\BkZsxby.exe
  C:\Windows\System32\BkZsxby.exe
  2⤵
  PID:6396
- C:\Windows\System32\OsXnowm.exe
  C:\Windows\System32\OsXnowm.exe
  2⤵
  PID:6440
- C:\Windows\System32\ZayMEUf.exe
  C:\Windows\System32\ZayMEUf.exe
  2⤵
  PID:6460
- C:\Windows\System32\kssVqlf.exe
  C:\Windows\System32\kssVqlf.exe
  2⤵
  PID:6488
- C:\Windows\System32\NmSJZYr.exe
  C:\Windows\System32\NmSJZYr.exe
  2⤵
  PID:6540
- C:\Windows\System32\QWWVoIb.exe
  C:\Windows\System32\QWWVoIb.exe
  2⤵
  PID:6572
- C:\Windows\System32\ZeUUPSS.exe
  C:\Windows\System32\ZeUUPSS.exe
  2⤵
  PID:6596
- C:\Windows\System32\BDakiyG.exe
  C:\Windows\System32\BDakiyG.exe
  2⤵
  PID:6616
- C:\Windows\System32\PxzbBcM.exe
  C:\Windows\System32\PxzbBcM.exe
  2⤵
  PID:6640
- C:\Windows\System32\NorWAtO.exe
  C:\Windows\System32\NorWAtO.exe
  2⤵
  PID:6672
- C:\Windows\System32\qrrbwTL.exe
  C:\Windows\System32\qrrbwTL.exe
  2⤵
  PID:6692
- C:\Windows\System32\AauJQGN.exe
  C:\Windows\System32\AauJQGN.exe
  2⤵
  PID:6712
- C:\Windows\System32\RFMCYRI.exe
  C:\Windows\System32\RFMCYRI.exe
  2⤵
  PID:6756
- C:\Windows\System32\sdbHDor.exe
  C:\Windows\System32\sdbHDor.exe
  2⤵
  PID:6776
- C:\Windows\System32\qZZhyPN.exe
  C:\Windows\System32\qZZhyPN.exe
  2⤵
  PID:6796
- C:\Windows\System32\nZCFTXl.exe
  C:\Windows\System32\nZCFTXl.exe
  2⤵
  PID:6824
- C:\Windows\System32\VzszhWi.exe
  C:\Windows\System32\VzszhWi.exe
  2⤵
  PID:6876
- C:\Windows\System32\ndwPhcO.exe
  C:\Windows\System32\ndwPhcO.exe
  2⤵
  PID:6916
- C:\Windows\System32\MIHIdou.exe
  C:\Windows\System32\MIHIdou.exe
  2⤵
  PID:6940
- C:\Windows\System32\lOsHxig.exe
  C:\Windows\System32\lOsHxig.exe
  2⤵
  PID:6956
- C:\Windows\System32\NpWXnhj.exe
  C:\Windows\System32\NpWXnhj.exe
  2⤵
  PID:6972
- C:\Windows\System32\WPZBxAZ.exe
  C:\Windows\System32\WPZBxAZ.exe
  2⤵
  PID:7012
- C:\Windows\System32\rNMKslT.exe
  C:\Windows\System32\rNMKslT.exe
  2⤵
  PID:7032
- C:\Windows\System32\NxvtTZg.exe
  C:\Windows\System32\NxvtTZg.exe
  2⤵
  PID:7052
- C:\Windows\System32\kRAoPNE.exe
  C:\Windows\System32\kRAoPNE.exe
  2⤵
  PID:7068
- C:\Windows\System32\ioqgDUr.exe
  C:\Windows\System32\ioqgDUr.exe
  2⤵
  PID:7084
- C:\Windows\System32\TSqIxJt.exe
  C:\Windows\System32\TSqIxJt.exe
  2⤵
  PID:7108
- C:\Windows\System32\kwvsjXs.exe
  C:\Windows\System32\kwvsjXs.exe
  2⤵
  PID:7124
- C:\Windows\System32\cYpuJJZ.exe
  C:\Windows\System32\cYpuJJZ.exe
  2⤵
  PID:7152
- C:\Windows\System32\klfzqHF.exe
  C:\Windows\System32\klfzqHF.exe
  2⤵
  PID:6160
- C:\Windows\System32\LJRvTCU.exe
  C:\Windows\System32\LJRvTCU.exe
  2⤵
  PID:6288
- C:\Windows\System32\UAZcqzT.exe
  C:\Windows\System32\UAZcqzT.exe
  2⤵
  PID:6344
- C:\Windows\System32\EyMOwHi.exe
  C:\Windows\System32\EyMOwHi.exe
  2⤵
  PID:6452
- C:\Windows\System32\bJdWhWB.exe
  C:\Windows\System32\bJdWhWB.exe
  2⤵
  PID:6528
- C:\Windows\System32\XftsmWO.exe
  C:\Windows\System32\XftsmWO.exe
  2⤵
  PID:6580
- C:\Windows\System32\jvoEHgI.exe
  C:\Windows\System32\jvoEHgI.exe
  2⤵
  PID:6628
- C:\Windows\System32\ABMolQo.exe
  C:\Windows\System32\ABMolQo.exe
  2⤵
  PID:6624
- C:\Windows\System32\Ciglfva.exe
  C:\Windows\System32\Ciglfva.exe
  2⤵
  PID:6724
- C:\Windows\System32\RlaTgnV.exe
  C:\Windows\System32\RlaTgnV.exe
  2⤵
  PID:6788
- C:\Windows\System32\WVAgcMc.exe
  C:\Windows\System32\WVAgcMc.exe
  2⤵
  PID:6768
- C:\Windows\System32\RSXcHnT.exe
  C:\Windows\System32\RSXcHnT.exe
  2⤵
  PID:6840
- C:\Windows\System32\YPOcFTm.exe
  C:\Windows\System32\YPOcFTm.exe
  2⤵
  PID:6888
- C:\Windows\System32\nmlGQod.exe
  C:\Windows\System32\nmlGQod.exe
  2⤵
  PID:6980
- C:\Windows\System32\rkVfyfn.exe
  C:\Windows\System32\rkVfyfn.exe
  2⤵
  PID:7092
- C:\Windows\System32\ExQMWoa.exe
  C:\Windows\System32\ExQMWoa.exe
  2⤵
  PID:6360
- C:\Windows\System32\szGihlf.exe
  C:\Windows\System32\szGihlf.exe
  2⤵
  PID:6356
- C:\Windows\System32\SLYUCQK.exe
  C:\Windows\System32\SLYUCQK.exe
  2⤵
  PID:6508
- C:\Windows\System32\FRuUZRd.exe
  C:\Windows\System32\FRuUZRd.exe
  2⤵
  PID:6636
- C:\Windows\System32\QAinkxo.exe
  C:\Windows\System32\QAinkxo.exe
  2⤵
  PID:6772
- C:\Windows\System32\zPViBLe.exe
  C:\Windows\System32\zPViBLe.exe
  2⤵
  PID:6688
- C:\Windows\System32\JZSAzKf.exe
  C:\Windows\System32\JZSAzKf.exe
  2⤵
  PID:6948
- C:\Windows\System32\hjUWELQ.exe
  C:\Windows\System32\hjUWELQ.exe
  2⤵
  PID:6272
- C:\Windows\System32\rYlJCpk.exe
  C:\Windows\System32\rYlJCpk.exe
  2⤵
  PID:6532
- C:\Windows\System32\fbSmYBs.exe
  C:\Windows\System32\fbSmYBs.exe
  2⤵
  PID:6764
- C:\Windows\System32\AlLemLF.exe
  C:\Windows\System32\AlLemLF.exe
  2⤵
  PID:7132
- C:\Windows\System32\ftjmCQr.exe
  C:\Windows\System32\ftjmCQr.exe
  2⤵
  PID:7184
- C:\Windows\System32\UKTLrPj.exe
  C:\Windows\System32\UKTLrPj.exe
  2⤵
  PID:7216
- C:\Windows\System32\TkgPNAf.exe
  C:\Windows\System32\TkgPNAf.exe
  2⤵
  PID:7236
- C:\Windows\System32\xgxpShC.exe
  C:\Windows\System32\xgxpShC.exe
  2⤵
  PID:7284
- C:\Windows\System32\FoDkPlV.exe
  C:\Windows\System32\FoDkPlV.exe
  2⤵
  PID:7304
- C:\Windows\System32\SSKiOdX.exe
  C:\Windows\System32\SSKiOdX.exe
  2⤵
  PID:7320
- C:\Windows\System32\HttUwAz.exe
  C:\Windows\System32\HttUwAz.exe
  2⤵
  PID:7348
- C:\Windows\System32\PioblIr.exe
  C:\Windows\System32\PioblIr.exe
  2⤵
  PID:7364
- C:\Windows\System32\TQaaEUj.exe
  C:\Windows\System32\TQaaEUj.exe
  2⤵
  PID:7384
- C:\Windows\System32\xhjEsmX.exe
  C:\Windows\System32\xhjEsmX.exe
  2⤵
  PID:7452
- C:\Windows\System32\PpUacfI.exe
  C:\Windows\System32\PpUacfI.exe
  2⤵
  PID:7472
- C:\Windows\System32\BnPFGlx.exe
  C:\Windows\System32\BnPFGlx.exe
  2⤵
  PID:7488
- C:\Windows\System32\OajqxpV.exe
  C:\Windows\System32\OajqxpV.exe
  2⤵
  PID:7508
- C:\Windows\System32\dBxfboU.exe
  C:\Windows\System32\dBxfboU.exe
  2⤵
  PID:7540
- C:\Windows\System32\zWBHDAP.exe
  C:\Windows\System32\zWBHDAP.exe
  2⤵
  PID:7568
- C:\Windows\System32\RMsgdcg.exe
  C:\Windows\System32\RMsgdcg.exe
  2⤵
  PID:7588
- C:\Windows\System32\eqhejQD.exe
  C:\Windows\System32\eqhejQD.exe
  2⤵
  PID:7660
- C:\Windows\System32\WVwhfPA.exe
  C:\Windows\System32\WVwhfPA.exe
  2⤵
  PID:7696
- C:\Windows\System32\PmfodBX.exe
  C:\Windows\System32\PmfodBX.exe
  2⤵
  PID:7712
- C:\Windows\System32\EGaYpKd.exe
  C:\Windows\System32\EGaYpKd.exe
  2⤵
  PID:7740
- C:\Windows\System32\xWiaoyj.exe
  C:\Windows\System32\xWiaoyj.exe
  2⤵
  PID:7756
- C:\Windows\System32\ejzfALc.exe
  C:\Windows\System32\ejzfALc.exe
  2⤵
  PID:7772
- C:\Windows\System32\XSBDXtX.exe
  C:\Windows\System32\XSBDXtX.exe
  2⤵
  PID:7824
- C:\Windows\System32\OpmmXPm.exe
  C:\Windows\System32\OpmmXPm.exe
  2⤵
  PID:7848
- C:\Windows\System32\XrEbOjL.exe
  C:\Windows\System32\XrEbOjL.exe
  2⤵
  PID:7872
- C:\Windows\System32\ntfsLVB.exe
  C:\Windows\System32\ntfsLVB.exe
  2⤵
  PID:7904
- C:\Windows\System32\uupFAXC.exe
  C:\Windows\System32\uupFAXC.exe
  2⤵
  PID:7924
- C:\Windows\System32\cWnmciL.exe
  C:\Windows\System32\cWnmciL.exe
  2⤵
  PID:7972
- C:\Windows\System32\CDRVgoh.exe
  C:\Windows\System32\CDRVgoh.exe
  2⤵
  PID:7992
- C:\Windows\System32\dxrQmmA.exe
  C:\Windows\System32\dxrQmmA.exe
  2⤵
  PID:8012
- C:\Windows\System32\NzTChSM.exe
  C:\Windows\System32\NzTChSM.exe
  2⤵
  PID:8052
- C:\Windows\System32\vbnoHOY.exe
  C:\Windows\System32\vbnoHOY.exe
  2⤵
  PID:8080
- C:\Windows\System32\eyxaMzd.exe
  C:\Windows\System32\eyxaMzd.exe
  2⤵
  PID:8108
- C:\Windows\System32\ZMIRghW.exe
  C:\Windows\System32\ZMIRghW.exe
  2⤵
  PID:8132
- C:\Windows\System32\ELdmQlf.exe
  C:\Windows\System32\ELdmQlf.exe
  2⤵
  PID:8156
- C:\Windows\System32\UtqEYrF.exe
  C:\Windows\System32\UtqEYrF.exe
  2⤵
  PID:8172
- C:\Windows\System32\nakpJPT.exe
  C:\Windows\System32\nakpJPT.exe
  2⤵
  PID:6216
- C:\Windows\System32\qYjUJYp.exe
  C:\Windows\System32\qYjUJYp.exe
  2⤵
  PID:7080
- C:\Windows\System32\QjwaYfa.exe
  C:\Windows\System32\QjwaYfa.exe
  2⤵
  PID:7204
- C:\Windows\System32\FpATojH.exe
  C:\Windows\System32\FpATojH.exe
  2⤵
  PID:7300
- C:\Windows\System32\fHsxhuo.exe
  C:\Windows\System32\fHsxhuo.exe
  2⤵
  PID:7412
- C:\Windows\System32\CRulaNN.exe
  C:\Windows\System32\CRulaNN.exe
  2⤵
  PID:7520
- C:\Windows\System32\HpzxNzd.exe
  C:\Windows\System32\HpzxNzd.exe
  2⤵
  PID:7496
- C:\Windows\System32\YdpXPmA.exe
  C:\Windows\System32\YdpXPmA.exe
  2⤵
  PID:7620
- C:\Windows\System32\VedCIlS.exe
  C:\Windows\System32\VedCIlS.exe
  2⤵
  PID:7612
- C:\Windows\System32\ZWqkFbT.exe
  C:\Windows\System32\ZWqkFbT.exe
  2⤵
  PID:7796
- C:\Windows\System32\uIkDdKa.exe
  C:\Windows\System32\uIkDdKa.exe
  2⤵
  PID:7836
- C:\Windows\System32\HFmqZIE.exe
  C:\Windows\System32\HFmqZIE.exe
  2⤵
  PID:7888
- C:\Windows\System32\AyuYDcm.exe
  C:\Windows\System32\AyuYDcm.exe
  2⤵
  PID:7936
- C:\Windows\System32\wSDsSnu.exe
  C:\Windows\System32\wSDsSnu.exe
  2⤵
  PID:8008
- C:\Windows\System32\fOSnYej.exe
  C:\Windows\System32\fOSnYej.exe
  2⤵
  PID:8096
- C:\Windows\System32\UItWlrx.exe
  C:\Windows\System32\UItWlrx.exe
  2⤵
  PID:8164
- C:\Windows\System32\myNGtjO.exe
  C:\Windows\System32\myNGtjO.exe
  2⤵
  PID:6896
- C:\Windows\System32\UWUZFmN.exe
  C:\Windows\System32\UWUZFmN.exe
  2⤵
  PID:8184
- C:\Windows\System32\fBiiZDO.exe
  C:\Windows\System32\fBiiZDO.exe
  2⤵
  PID:6448
- C:\Windows\System32\mkDDRkZ.exe
  C:\Windows\System32\mkDDRkZ.exe
  2⤵
  PID:7376
- C:\Windows\System32\grxqQBh.exe
  C:\Windows\System32\grxqQBh.exe
  2⤵
  PID:7552
- C:\Windows\System32\QyBqJEU.exe
  C:\Windows\System32\QyBqJEU.exe
  2⤵
  PID:7708
- C:\Windows\System32\BHwcjLR.exe
  C:\Windows\System32\BHwcjLR.exe
  2⤵
  PID:7844
- C:\Windows\System32\RVFnTqB.exe
  C:\Windows\System32\RVFnTqB.exe
  2⤵
  PID:7912
- C:\Windows\System32\dijFUGs.exe
  C:\Windows\System32\dijFUGs.exe
  2⤵
  PID:7536
- C:\Windows\System32\kWRdPgd.exe
  C:\Windows\System32\kWRdPgd.exe
  2⤵
  PID:7764
- C:\Windows\System32\fdpyuDM.exe
  C:\Windows\System32\fdpyuDM.exe
  2⤵
  PID:7960
- C:\Windows\System32\qOygIbL.exe
  C:\Windows\System32\qOygIbL.exe
  2⤵
  PID:7484
- C:\Windows\System32\McAKNUU.exe
  C:\Windows\System32\McAKNUU.exe
  2⤵
  PID:8224
- C:\Windows\System32\CiRtCtk.exe
  C:\Windows\System32\CiRtCtk.exe
  2⤵
  PID:8240
- C:\Windows\System32\BlzWsTr.exe
  C:\Windows\System32\BlzWsTr.exe
  2⤵
  PID:8264
- C:\Windows\System32\ojPhRkt.exe
  C:\Windows\System32\ojPhRkt.exe
  2⤵
  PID:8316
- C:\Windows\System32\SkUtAlm.exe
  C:\Windows\System32\SkUtAlm.exe
  2⤵
  PID:8344
- C:\Windows\System32\yBVcOtp.exe
  C:\Windows\System32\yBVcOtp.exe
  2⤵
  PID:8364
- C:\Windows\System32\vopsOmD.exe
  C:\Windows\System32\vopsOmD.exe
  2⤵
  PID:8388
- C:\Windows\System32\aupneHB.exe
  C:\Windows\System32\aupneHB.exe
  2⤵
  PID:8412
- C:\Windows\System32\UnLzzPV.exe
  C:\Windows\System32\UnLzzPV.exe
  2⤵
  PID:8444
- C:\Windows\System32\lyJehAf.exe
  C:\Windows\System32\lyJehAf.exe
  2⤵
  PID:8484
- C:\Windows\System32\ZwWKwgT.exe
  C:\Windows\System32\ZwWKwgT.exe
  2⤵
  PID:8516
- C:\Windows\System32\XyDjcgs.exe
  C:\Windows\System32\XyDjcgs.exe
  2⤵
  PID:8536
- C:\Windows\System32\zVKoTgi.exe
  C:\Windows\System32\zVKoTgi.exe
  2⤵
  PID:8556
- C:\Windows\System32\sTCIKNT.exe
  C:\Windows\System32\sTCIKNT.exe
  2⤵
  PID:8600
- C:\Windows\System32\teRonyV.exe
  C:\Windows\System32\teRonyV.exe
  2⤵
  PID:8620
- C:\Windows\System32\CsNnVhQ.exe
  C:\Windows\System32\CsNnVhQ.exe
  2⤵
  PID:8640
- C:\Windows\System32\ZhTnfyZ.exe
  C:\Windows\System32\ZhTnfyZ.exe
  2⤵
  PID:8664
- C:\Windows\System32\gWTKDMm.exe
  C:\Windows\System32\gWTKDMm.exe
  2⤵
  PID:8680
- C:\Windows\System32\mbXRWep.exe
  C:\Windows\System32\mbXRWep.exe
  2⤵
  PID:8700
- C:\Windows\System32\fMjtpWc.exe
  C:\Windows\System32\fMjtpWc.exe
  2⤵
  PID:8724
- C:\Windows\System32\SiSBeJn.exe
  C:\Windows\System32\SiSBeJn.exe
  2⤵
  PID:8744
- C:\Windows\System32\RPwAXWB.exe
  C:\Windows\System32\RPwAXWB.exe
  2⤵
  PID:8792
- C:\Windows\System32\qwDEshx.exe
  C:\Windows\System32\qwDEshx.exe
  2⤵
  PID:8848
- C:\Windows\System32\iXwSjFR.exe
  C:\Windows\System32\iXwSjFR.exe
  2⤵
  PID:8864
- C:\Windows\System32\lZhlmEy.exe
  C:\Windows\System32\lZhlmEy.exe
  2⤵
  PID:8888
- C:\Windows\System32\YZWCORe.exe
  C:\Windows\System32\YZWCORe.exe
  2⤵
  PID:8916
- C:\Windows\System32\juacPnP.exe
  C:\Windows\System32\juacPnP.exe
  2⤵
  PID:8944
- C:\Windows\System32\VwlTttZ.exe
  C:\Windows\System32\VwlTttZ.exe
  2⤵
  PID:8960
- C:\Windows\System32\WyexFAc.exe
  C:\Windows\System32\WyexFAc.exe
  2⤵
  PID:8988
- C:\Windows\System32\PhnKYrm.exe
  C:\Windows\System32\PhnKYrm.exe
  2⤵
  PID:9016
- C:\Windows\System32\DMKZhom.exe
  C:\Windows\System32\DMKZhom.exe
  2⤵
  PID:9032
- C:\Windows\System32\IbTlPVA.exe
  C:\Windows\System32\IbTlPVA.exe
  2⤵
  PID:9188
- C:\Windows\System32\FjJkYZy.exe
  C:\Windows\System32\FjJkYZy.exe
  2⤵
  PID:7596
- C:\Windows\System32\eNRHPEf.exe
  C:\Windows\System32\eNRHPEf.exe
  2⤵
  PID:8204
- C:\Windows\System32\XWjzMqE.exe
  C:\Windows\System32\XWjzMqE.exe
  2⤵
  PID:8260
- C:\Windows\System32\WElgLya.exe
  C:\Windows\System32\WElgLya.exe
  2⤵
  PID:8308
- C:\Windows\System32\CgpMtnh.exe
  C:\Windows\System32\CgpMtnh.exe
  2⤵
  PID:8328
- C:\Windows\System32\tXEKplC.exe
  C:\Windows\System32\tXEKplC.exe
  2⤵
  PID:8384
- C:\Windows\System32\UPyjmqh.exe
  C:\Windows\System32\UPyjmqh.exe
  2⤵
  PID:8404
- C:\Windows\System32\EeUMfzB.exe
  C:\Windows\System32\EeUMfzB.exe
  2⤵
  PID:8440
- C:\Windows\System32\DazmDDw.exe
  C:\Windows\System32\DazmDDw.exe
  2⤵
  PID:3900
- C:\Windows\System32\UNoOJXl.exe
  C:\Windows\System32\UNoOJXl.exe
  2⤵
  PID:8548
- C:\Windows\System32\hELdwcW.exe
  C:\Windows\System32\hELdwcW.exe
  2⤵
  PID:8532
- C:\Windows\System32\mWknGDb.exe
  C:\Windows\System32\mWknGDb.exe
  2⤵
  PID:8612
- C:\Windows\System32\WGalyBy.exe
  C:\Windows\System32\WGalyBy.exe
  2⤵
  PID:8636
- C:\Windows\System32\MBvTdLp.exe
  C:\Windows\System32\MBvTdLp.exe
  2⤵
  PID:8672
- C:\Windows\System32\bvYaMMG.exe
  C:\Windows\System32\bvYaMMG.exe
  2⤵
  PID:8720
- C:\Windows\System32\dLrzrVh.exe
  C:\Windows\System32\dLrzrVh.exe
  2⤵
  PID:8756
- C:\Windows\System32\gWoABxA.exe
  C:\Windows\System32\gWoABxA.exe
  2⤵
  PID:8736
- C:\Windows\System32\CsEabyP.exe
  C:\Windows\System32\CsEabyP.exe
  2⤵
  PID:8808
- C:\Windows\System32\wEFvXqR.exe
  C:\Windows\System32\wEFvXqR.exe
  2⤵
  PID:8860
- C:\Windows\System32\exkLlIK.exe
  C:\Windows\System32\exkLlIK.exe
  2⤵
  PID:8896
- C:\Windows\System32\phhkpxg.exe
  C:\Windows\System32\phhkpxg.exe
  2⤵
  PID:8956
- C:\Windows\System32\BiTXUCA.exe
  C:\Windows\System32\BiTXUCA.exe
  2⤵
  PID:9012
- C:\Windows\System32\uYWcPxw.exe
  C:\Windows\System32\uYWcPxw.exe
  2⤵
  PID:8996
- C:\Windows\System32\GqDIpUw.exe
  C:\Windows\System32\GqDIpUw.exe
  2⤵
  PID:9060
- C:\Windows\System32\NprAoXe.exe
  C:\Windows\System32\NprAoXe.exe
  2⤵
  PID:9076
- C:\Windows\System32\bgtIDnW.exe
  C:\Windows\System32\bgtIDnW.exe
  2⤵
  PID:9224
- C:\Windows\System32\NHirSPc.exe
  C:\Windows\System32\NHirSPc.exe
  2⤵
  PID:9240
- C:\Windows\System32\jgzTvbf.exe
  C:\Windows\System32\jgzTvbf.exe
  2⤵
  PID:9256
- C:\Windows\System32\ZBOSZEL.exe
  C:\Windows\System32\ZBOSZEL.exe
  2⤵
  PID:9272
- C:\Windows\System32\CXooDgP.exe
  C:\Windows\System32\CXooDgP.exe
  2⤵
  PID:9296
- C:\Windows\System32\HwMwmIP.exe
  C:\Windows\System32\HwMwmIP.exe
  2⤵
  PID:9336
- C:\Windows\System32\oweITiA.exe
  C:\Windows\System32\oweITiA.exe
  2⤵
  PID:9352
- C:\Windows\System32\PKAmDKF.exe
  C:\Windows\System32\PKAmDKF.exe
  2⤵
  PID:9368
- C:\Windows\System32\fXEEJuR.exe
  C:\Windows\System32\fXEEJuR.exe
  2⤵
  PID:9384
- C:\Windows\System32\tBQyKDU.exe
  C:\Windows\System32\tBQyKDU.exe
  2⤵
  PID:9444
- C:\Windows\System32\RJXxsrM.exe
  C:\Windows\System32\RJXxsrM.exe
  2⤵
  PID:9532
- C:\Windows\System32\PuCvTtB.exe
  C:\Windows\System32\PuCvTtB.exe
  2⤵
  PID:9556
- C:\Windows\System32\kkzWmuR.exe
  C:\Windows\System32\kkzWmuR.exe
  2⤵
  PID:9892
- C:\Windows\System32\TsBCNrF.exe
  C:\Windows\System32\TsBCNrF.exe
  2⤵
  PID:9920
- C:\Windows\System32\YQLFuQi.exe
  C:\Windows\System32\YQLFuQi.exe
  2⤵
  PID:9940
- C:\Windows\System32\UFjEtQh.exe
  C:\Windows\System32\UFjEtQh.exe
  2⤵
  PID:9964
- C:\Windows\System32\wNAWrql.exe
  C:\Windows\System32\wNAWrql.exe
  2⤵
  PID:9996
- C:\Windows\System32\drshzay.exe
  C:\Windows\System32\drshzay.exe
  2⤵
  PID:10020
- C:\Windows\System32\KRtcejj.exe
  C:\Windows\System32\KRtcejj.exe
  2⤵
  PID:10040
- C:\Windows\System32\IiFliCi.exe
  C:\Windows\System32\IiFliCi.exe
  2⤵
  PID:10080
- C:\Windows\System32\vExFsEC.exe
  C:\Windows\System32\vExFsEC.exe
  2⤵
  PID:10096
- C:\Windows\System32\bwpCRsR.exe
  C:\Windows\System32\bwpCRsR.exe
  2⤵
  PID:10124
- C:\Windows\System32\acGPfwf.exe
  C:\Windows\System32\acGPfwf.exe
  2⤵
  PID:10160
- C:\Windows\System32\GOcRTOD.exe
  C:\Windows\System32\GOcRTOD.exe
  2⤵
  PID:10192
- C:\Windows\System32\aRqRAdb.exe
  C:\Windows\System32\aRqRAdb.exe
  2⤵
  PID:10208
- C:\Windows\System32\TbJbaMT.exe
  C:\Windows\System32\TbJbaMT.exe
  2⤵
  PID:10232
- C:\Windows\System32\tFvSoHj.exe
  C:\Windows\System32\tFvSoHj.exe
  2⤵
  PID:8352
- C:\Windows\System32\fUHNVrm.exe
  C:\Windows\System32\fUHNVrm.exe
  2⤵
  PID:8480
- C:\Windows\System32\tvQBauq.exe
  C:\Windows\System32\tvQBauq.exe
  2⤵
  PID:8708
- C:\Windows\System32\lsZjnvq.exe
  C:\Windows\System32\lsZjnvq.exe
  2⤵
  PID:8844
- C:\Windows\System32\tSWUATj.exe
  C:\Windows\System32\tSWUATj.exe
  2⤵
  PID:9024
- C:\Windows\System32\UGADRqx.exe
  C:\Windows\System32\UGADRqx.exe
  2⤵
  PID:9220
- C:\Windows\System32\uqKzjDC.exe
  C:\Windows\System32\uqKzjDC.exe
  2⤵
  PID:9316
- C:\Windows\System32\WKJeVEh.exe
  C:\Windows\System32\WKJeVEh.exe
  2⤵
  PID:9072
- C:\Windows\System32\AQCRfdP.exe
  C:\Windows\System32\AQCRfdP.exe
  2⤵
  PID:9416
- C:\Windows\System32\qabjQMX.exe
  C:\Windows\System32\qabjQMX.exe
  2⤵
  PID:8652
- C:\Windows\System32\msBjSCU.exe
  C:\Windows\System32\msBjSCU.exe
  2⤵
  PID:9144
- C:\Windows\System32\ZSiKUUm.exe
  C:\Windows\System32\ZSiKUUm.exe
  2⤵
  PID:9212
- C:\Windows\System32\AkMEBse.exe
  C:\Windows\System32\AkMEBse.exe
  2⤵
  PID:9248
- C:\Windows\System32\FacCApn.exe
  C:\Windows\System32\FacCApn.exe
  2⤵
  PID:9304
- C:\Windows\System32\LiGwMWe.exe
  C:\Windows\System32\LiGwMWe.exe
  2⤵
  PID:9380
- C:\Windows\System32\vXEplJN.exe
  C:\Windows\System32\vXEplJN.exe
  2⤵
  PID:9604
- C:\Windows\System32\Bqisirv.exe
  C:\Windows\System32\Bqisirv.exe
  2⤵
  PID:9636
- C:\Windows\System32\loLJuSa.exe
  C:\Windows\System32\loLJuSa.exe
  2⤵
  PID:9668
- C:\Windows\System32\JVPAdyU.exe
  C:\Windows\System32\JVPAdyU.exe
  2⤵
  PID:9716
- C:\Windows\System32\rkxaiFT.exe
  C:\Windows\System32\rkxaiFT.exe
  2⤵
  PID:9732
- C:\Windows\System32\qgALTaJ.exe
  C:\Windows\System32\qgALTaJ.exe
  2⤵
  PID:9764
- C:\Windows\System32\JvXjxAe.exe
  C:\Windows\System32\JvXjxAe.exe
  2⤵
  PID:9912
- C:\Windows\System32\NWrJKcF.exe
  C:\Windows\System32\NWrJKcF.exe
  2⤵
  PID:10016
- C:\Windows\System32\YihAXPQ.exe
  C:\Windows\System32\YihAXPQ.exe
  2⤵
  PID:10136
- C:\Windows\System32\WruTOVr.exe
  C:\Windows\System32\WruTOVr.exe
  2⤵
  PID:10184
- C:\Windows\System32\LfsrOlF.exe
  C:\Windows\System32\LfsrOlF.exe
  2⤵
  PID:10224
- C:\Windows\System32\lXyDtIp.exe
  C:\Windows\System32\lXyDtIp.exe
  2⤵
  PID:8252
- C:\Windows\System32\iQRgVdn.exe
  C:\Windows\System32\iQRgVdn.exe
  2⤵
  PID:8776
- C:\Windows\System32\vmVGgMF.exe
  C:\Windows\System32\vmVGgMF.exe
  2⤵
  PID:9252
- C:\Windows\System32\VlPUukH.exe
  C:\Windows\System32\VlPUukH.exe
  2⤵
  PID:8876
- C:\Windows\System32\oTdGJII.exe
  C:\Windows\System32\oTdGJII.exe
  2⤵
  PID:9140
- C:\Windows\System32\SWevVbT.exe
  C:\Windows\System32\SWevVbT.exe
  2⤵
  PID:8592
- C:\Windows\System32\CORIkyL.exe
  C:\Windows\System32\CORIkyL.exe
  2⤵
  PID:9528
- C:\Windows\System32\ItLsnvM.exe
  C:\Windows\System32\ItLsnvM.exe
  2⤵
  PID:9708
- C:\Windows\System32\sZkInfY.exe
  C:\Windows\System32\sZkInfY.exe
  2⤵
  PID:9684
- C:\Windows\System32\EIzpDJw.exe
  C:\Windows\System32\EIzpDJw.exe
  2⤵
  PID:10008
- C:\Windows\System32\dOEnncB.exe
  C:\Windows\System32\dOEnncB.exe
  2⤵
  PID:9932
- C:\Windows\System32\bxDbTdk.exe
  C:\Windows\System32\bxDbTdk.exe
  2⤵
  PID:10216
- C:\Windows\System32\KHxrKNg.exe
  C:\Windows\System32\KHxrKNg.exe
  2⤵
  PID:9112
- C:\Windows\System32\DOSxENE.exe
  C:\Windows\System32\DOSxENE.exe
  2⤵
  PID:8768
- C:\Windows\System32\CeTmaOO.exe
  C:\Windows\System32\CeTmaOO.exe
  2⤵
  PID:9572
- C:\Windows\System32\RuqJlpE.exe
  C:\Windows\System32\RuqJlpE.exe
  2⤵
  PID:9200
- C:\Windows\System32\GbuInqq.exe
  C:\Windows\System32\GbuInqq.exe
  2⤵
  PID:9972
- C:\Windows\System32\LRIEbMp.exe
  C:\Windows\System32\LRIEbMp.exe
  2⤵
  PID:9236
- C:\Windows\System32\eHPSnEE.exe
  C:\Windows\System32\eHPSnEE.exe
  2⤵
  PID:10260
- C:\Windows\System32\YzuuwkH.exe
  C:\Windows\System32\YzuuwkH.exe
  2⤵
  PID:10276
- C:\Windows\System32\YeEKPiH.exe
  C:\Windows\System32\YeEKPiH.exe
  2⤵
  PID:10292
- C:\Windows\System32\uAwyMgW.exe
  C:\Windows\System32\uAwyMgW.exe
  2⤵
  PID:10336
- C:\Windows\System32\fmaFuog.exe
  C:\Windows\System32\fmaFuog.exe
  2⤵
  PID:10360
- C:\Windows\System32\PMZzzfj.exe
  C:\Windows\System32\PMZzzfj.exe
  2⤵
  PID:10376
- C:\Windows\System32\sqIYGld.exe
  C:\Windows\System32\sqIYGld.exe
  2⤵
  PID:10420
- C:\Windows\System32\muiyWPW.exe
  C:\Windows\System32\muiyWPW.exe
  2⤵
  PID:10436
- C:\Windows\System32\SGWOLpG.exe
  C:\Windows\System32\SGWOLpG.exe
  2⤵
  PID:10460
- C:\Windows\System32\kOdBfiZ.exe
  C:\Windows\System32\kOdBfiZ.exe
  2⤵
  PID:10508
- C:\Windows\System32\PIzMbaa.exe
  C:\Windows\System32\PIzMbaa.exe
  2⤵
  PID:10564
- C:\Windows\System32\vRwFuuD.exe
  C:\Windows\System32\vRwFuuD.exe
  2⤵
  PID:10580
- C:\Windows\System32\vfCazAT.exe
  C:\Windows\System32\vfCazAT.exe
  2⤵
  PID:10596
- C:\Windows\System32\VARMvzM.exe
  C:\Windows\System32\VARMvzM.exe
  2⤵
  PID:10616
- C:\Windows\System32\BwIDNfS.exe
  C:\Windows\System32\BwIDNfS.exe
  2⤵
  PID:10636
- C:\Windows\System32\NTmfQRU.exe
  C:\Windows\System32\NTmfQRU.exe
  2⤵
  PID:10668
- C:\Windows\System32\utcVicI.exe
  C:\Windows\System32\utcVicI.exe
  2⤵
  PID:10708
- C:\Windows\System32\cbrPzvz.exe
  C:\Windows\System32\cbrPzvz.exe
  2⤵
  PID:10736
- C:\Windows\System32\kIKXLhi.exe
  C:\Windows\System32\kIKXLhi.exe
  2⤵
  PID:10772
- C:\Windows\System32\yeFhOcq.exe
  C:\Windows\System32\yeFhOcq.exe
  2⤵
  PID:10804
- C:\Windows\System32\zhxLINr.exe
  C:\Windows\System32\zhxLINr.exe
  2⤵
  PID:10824
- C:\Windows\System32\jKkoNwQ.exe
  C:\Windows\System32\jKkoNwQ.exe
  2⤵
  PID:10848
- C:\Windows\System32\LFaTEUY.exe
  C:\Windows\System32\LFaTEUY.exe
  2⤵
  PID:10892
- C:\Windows\System32\zlJhzxS.exe
  C:\Windows\System32\zlJhzxS.exe
  2⤵
  PID:10920
- C:\Windows\System32\wqBMWvv.exe
  C:\Windows\System32\wqBMWvv.exe
  2⤵
  PID:10948
- C:\Windows\System32\umyOUVp.exe
  C:\Windows\System32\umyOUVp.exe
  2⤵
  PID:10976
- C:\Windows\System32\GoutdIQ.exe
  C:\Windows\System32\GoutdIQ.exe
  2⤵
  PID:11004
- C:\Windows\System32\mBCteKf.exe
  C:\Windows\System32\mBCteKf.exe
  2⤵
  PID:11020
- C:\Windows\System32\AEybUev.exe
  C:\Windows\System32\AEybUev.exe
  2⤵
  PID:11040
- C:\Windows\System32\OHasYfv.exe
  C:\Windows\System32\OHasYfv.exe
  2⤵
  PID:11060
- C:\Windows\System32\TWaRoiP.exe
  C:\Windows\System32\TWaRoiP.exe
  2⤵
  PID:11084
- C:\Windows\System32\KlytkMt.exe
  C:\Windows\System32\KlytkMt.exe
  2⤵
  PID:11108
- C:\Windows\System32\rRZxRyT.exe
  C:\Windows\System32\rRZxRyT.exe
  2⤵
  PID:11128
- C:\Windows\System32\mhmgXGK.exe
  C:\Windows\System32\mhmgXGK.exe
  2⤵
  PID:11152
- C:\Windows\System32\otcaKoY.exe
  C:\Windows\System32\otcaKoY.exe
  2⤵
  PID:11172
- C:\Windows\System32\qsXvMtT.exe
  C:\Windows\System32\qsXvMtT.exe
  2⤵
  PID:11232
- C:\Windows\System32\XCSQgUh.exe
  C:\Windows\System32\XCSQgUh.exe
  2⤵
  PID:11260
- C:\Windows\System32\rhaZBEh.exe
  C:\Windows\System32\rhaZBEh.exe
  2⤵
  PID:10268
- C:\Windows\System32\wLpzMxa.exe
  C:\Windows\System32\wLpzMxa.exe
  2⤵
  PID:10348
- C:\Windows\System32\vexfAzn.exe
  C:\Windows\System32\vexfAzn.exe
  2⤵
  PID:10444
- C:\Windows\System32\wvFtFhx.exe
  C:\Windows\System32\wvFtFhx.exe
  2⤵
  PID:10548
- C:\Windows\System32\tMDYvqs.exe
  C:\Windows\System32\tMDYvqs.exe
  2⤵
  PID:10612
- C:\Windows\System32\GQTCVQv.exe
  C:\Windows\System32\GQTCVQv.exe
  2⤵
  PID:10644
- C:\Windows\System32\owbsOby.exe
  C:\Windows\System32\owbsOby.exe
  2⤵
  PID:10704
- C:\Windows\System32\QauOdxA.exe
  C:\Windows\System32\QauOdxA.exe
  2⤵
  PID:10732
- C:\Windows\System32\TlSTcAS.exe
  C:\Windows\System32\TlSTcAS.exe
  2⤵
  PID:10864
- C:\Windows\System32\fBnOhyJ.exe
  C:\Windows\System32\fBnOhyJ.exe
  2⤵
  PID:10936
- C:\Windows\System32\uNqLvSY.exe
  C:\Windows\System32\uNqLvSY.exe
  2⤵
  PID:10968
- C:\Windows\System32\tuXQqjY.exe
  C:\Windows\System32\tuXQqjY.exe
  2⤵
  PID:11036
- C:\Windows\System32\EIqYMji.exe
  C:\Windows\System32\EIqYMji.exe
  2⤵
  PID:11080
- C:\Windows\System32\JTrYouq.exe
  C:\Windows\System32\JTrYouq.exe
  2⤵
  PID:11136
- C:\Windows\System32\ZWauTxf.exe
  C:\Windows\System32\ZWauTxf.exe
  2⤵
  PID:11164
- C:\Windows\System32\kNtBcom.exe
  C:\Windows\System32\kNtBcom.exe
  2⤵
  PID:11228
- C:\Windows\System32\CCEqvor.exe
  C:\Windows\System32\CCEqvor.exe
  2⤵
  PID:10388
- C:\Windows\System32\VnrplBA.exe
  C:\Windows\System32\VnrplBA.exe
  2⤵
  PID:10516
- C:\Windows\System32\SqBYAUT.exe
  C:\Windows\System32\SqBYAUT.exe
  2⤵
  PID:10652
- C:\Windows\System32\bGBUual.exe
  C:\Windows\System32\bGBUual.exe
  2⤵
  PID:10836
- C:\Windows\System32\rEixtxe.exe
  C:\Windows\System32\rEixtxe.exe
  2⤵
  PID:10992
- C:\Windows\System32\BwexDZT.exe
  C:\Windows\System32\BwexDZT.exe
  2⤵
  PID:10988
- C:\Windows\System32\alVYpIJ.exe
  C:\Windows\System32\alVYpIJ.exe
  2⤵
  PID:11240
- C:\Windows\System32\YXCSxdm.exe
  C:\Windows\System32\YXCSxdm.exe
  2⤵
  PID:10592
- C:\Windows\System32\gTXXSas.exe
  C:\Windows\System32\gTXXSas.exe
  2⤵
  PID:10956
- C:\Windows\System32\kbGXGUJ.exe
  C:\Windows\System32\kbGXGUJ.exe
  2⤵
  PID:10312
- C:\Windows\System32\mzsiuvJ.exe
  C:\Windows\System32\mzsiuvJ.exe
  2⤵
  PID:11284
- C:\Windows\System32\HHZiWqe.exe
  C:\Windows\System32\HHZiWqe.exe
  2⤵
  PID:11316
- C:\Windows\System32\LDceCoi.exe
  C:\Windows\System32\LDceCoi.exe
  2⤵
  PID:11344
- C:\Windows\System32\IpIOSlR.exe
  C:\Windows\System32\IpIOSlR.exe
  2⤵
  PID:11372
- C:\Windows\System32\VDuCWag.exe
  C:\Windows\System32\VDuCWag.exe
  2⤵
  PID:11396
- C:\Windows\System32\LKzdZaI.exe
  C:\Windows\System32\LKzdZaI.exe
  2⤵
  PID:11420
- C:\Windows\System32\bwAiZpE.exe
  C:\Windows\System32\bwAiZpE.exe
  2⤵
  PID:11444
- C:\Windows\System32\NXnHxkF.exe
  C:\Windows\System32\NXnHxkF.exe
  2⤵
  PID:11460
- C:\Windows\System32\lIEUFbS.exe
  C:\Windows\System32\lIEUFbS.exe
  2⤵
  PID:11480
- C:\Windows\System32\UWpUWxh.exe
  C:\Windows\System32\UWpUWxh.exe
  2⤵
  PID:11500
- C:\Windows\System32\TuuGAdF.exe
  C:\Windows\System32\TuuGAdF.exe
  2⤵
  PID:11532
- C:\Windows\System32\JFTwteB.exe
  C:\Windows\System32\JFTwteB.exe
  2⤵
  PID:11552
- C:\Windows\System32\XmuBUCv.exe
  C:\Windows\System32\XmuBUCv.exe
  2⤵
  PID:11580
- C:\Windows\System32\eABwsOY.exe
  C:\Windows\System32\eABwsOY.exe
  2⤵
  PID:11596
- C:\Windows\System32\hTSVhzg.exe
  C:\Windows\System32\hTSVhzg.exe
  2⤵
  PID:11620
- C:\Windows\System32\YLkNfcq.exe
  C:\Windows\System32\YLkNfcq.exe
  2⤵
  PID:11636
- C:\Windows\System32\yjoxmpe.exe
  C:\Windows\System32\yjoxmpe.exe
  2⤵
  PID:11652
- C:\Windows\System32\VwvuLSA.exe
  C:\Windows\System32\VwvuLSA.exe
  2⤵
  PID:11720
- C:\Windows\System32\cjtliBi.exe
  C:\Windows\System32\cjtliBi.exe
  2⤵
  PID:11784
- C:\Windows\System32\txSKUPI.exe
  C:\Windows\System32\txSKUPI.exe
  2⤵
  PID:11800
- C:\Windows\System32\HsgbSFB.exe
  C:\Windows\System32\HsgbSFB.exe
  2⤵
  PID:11820
- C:\Windows\System32\IcKsXoM.exe
  C:\Windows\System32\IcKsXoM.exe
  2⤵
  PID:11844
- C:\Windows\System32\XyrhgdA.exe
  C:\Windows\System32\XyrhgdA.exe
  2⤵
  PID:11924
- C:\Windows\System32\GzLQyir.exe
  C:\Windows\System32\GzLQyir.exe
  2⤵
  PID:11944
- C:\Windows\System32\NboBtKs.exe
  C:\Windows\System32\NboBtKs.exe
  2⤵
  PID:11968
- C:\Windows\System32\fjQWezS.exe
  C:\Windows\System32\fjQWezS.exe
  2⤵
  PID:11984
- C:\Windows\System32\MtWUGtm.exe
  C:\Windows\System32\MtWUGtm.exe
  2⤵
  PID:12004
- C:\Windows\System32\zvIyNVl.exe
  C:\Windows\System32\zvIyNVl.exe
  2⤵
  PID:12020
- C:\Windows\System32\gWjHwSa.exe
  C:\Windows\System32\gWjHwSa.exe
  2⤵
  PID:12068
- C:\Windows\System32\OrYxVkf.exe
  C:\Windows\System32\OrYxVkf.exe
  2⤵
  PID:12084
- C:\Windows\System32\ZNJCyhz.exe
  C:\Windows\System32\ZNJCyhz.exe
  2⤵
  PID:12116
- C:\Windows\System32\ObpntXX.exe
  C:\Windows\System32\ObpntXX.exe
  2⤵
  PID:12156
- C:\Windows\System32\LNLGhSu.exe
  C:\Windows\System32\LNLGhSu.exe
  2⤵
  PID:12184
- C:\Windows\System32\rUXIWTr.exe
  C:\Windows\System32\rUXIWTr.exe
  2⤵
  PID:12200
- C:\Windows\System32\GmnebFx.exe
  C:\Windows\System32\GmnebFx.exe
  2⤵
  PID:12244
- C:\Windows\System32\cBPPmwR.exe
  C:\Windows\System32\cBPPmwR.exe
  2⤵
  PID:12260
- C:\Windows\System32\GQVZUOy.exe
  C:\Windows\System32\GQVZUOy.exe
  2⤵
  PID:11104
- C:\Windows\System32\tmhcyHw.exe
  C:\Windows\System32\tmhcyHw.exe
  2⤵
  PID:11280
- C:\Windows\System32\ZbVqCBb.exe
  C:\Windows\System32\ZbVqCBb.exe
  2⤵
  PID:11412
- C:\Windows\System32\gbShPVR.exe
  C:\Windows\System32\gbShPVR.exe
  2⤵
  PID:11440
- C:\Windows\System32\tBBOYMu.exe
  C:\Windows\System32\tBBOYMu.exe
  2⤵
  PID:11508
- C:\Windows\System32\xzvoJzm.exe
  C:\Windows\System32\xzvoJzm.exe
  2⤵
  PID:11528
- C:\Windows\System32\yAtmUmL.exe
  C:\Windows\System32\yAtmUmL.exe
  2⤵
  PID:11628
- C:\Windows\System32\uQUSqog.exe
  C:\Windows\System32\uQUSqog.exe
  2⤵
  PID:11740
- C:\Windows\System32\nEvPsHF.exe
  C:\Windows\System32\nEvPsHF.exe
  2⤵
  PID:11760
- C:\Windows\System32\LBdmkVJ.exe
  C:\Windows\System32\LBdmkVJ.exe
  2⤵
  PID:11840
- C:\Windows\System32\PxJBTBO.exe
  C:\Windows\System32\PxJBTBO.exe
  2⤵
  PID:11916
- C:\Windows\System32\XKTGsNe.exe
  C:\Windows\System32\XKTGsNe.exe
  2⤵
  PID:11976
- C:\Windows\System32\xEANTtT.exe
  C:\Windows\System32\xEANTtT.exe
  2⤵
  PID:12056
- C:\Windows\System32\CfybZEV.exe
  C:\Windows\System32\CfybZEV.exe
  2⤵
  PID:12140
- C:\Windows\System32\BhnUNTH.exe
  C:\Windows\System32\BhnUNTH.exe
  2⤵
  PID:12172
- C:\Windows\System32\qNCsaen.exe
  C:\Windows\System32\qNCsaen.exe
  2⤵
  PID:12212
- C:\Windows\System32\zOEGcYa.exe
  C:\Windows\System32\zOEGcYa.exe
  2⤵
  PID:12252
- C:\Windows\System32\nkHyWIt.exe
  C:\Windows\System32\nkHyWIt.exe
  2⤵
  PID:11488
- C:\Windows\System32\jRPasAg.exe
  C:\Windows\System32\jRPasAg.exe
  2⤵
  PID:11564
- C:\Windows\System32\fJuPbEF.exe
  C:\Windows\System32\fJuPbEF.exe
  2⤵
  PID:11644
- C:\Windows\System32\oADxzDh.exe
  C:\Windows\System32\oADxzDh.exe
  2⤵
  PID:11796
- C:\Windows\System32\Wkjvbjb.exe
  C:\Windows\System32\Wkjvbjb.exe
  2⤵
  PID:11904
- C:\Windows\System32\RrobXWZ.exe
  C:\Windows\System32\RrobXWZ.exe
  2⤵
  PID:12220
- C:\Windows\System32\bNQBGau.exe
  C:\Windows\System32\bNQBGau.exe
  2⤵
  PID:11324
- C:\Windows\System32\yCPXWMa.exe
  C:\Windows\System32\yCPXWMa.exe
  2⤵
  PID:11632
- C:\Windows\System32\WPTCAym.exe
  C:\Windows\System32\WPTCAym.exe
  2⤵
  PID:11980
- C:\Windows\System32\nGUzAlX.exe
  C:\Windows\System32\nGUzAlX.exe
  2⤵
  PID:12100
- C:\Windows\System32\nNFzRLF.exe
  C:\Windows\System32\nNFzRLF.exe
  2⤵
  PID:12228
- C:\Windows\System32\dqRSKtE.exe
  C:\Windows\System32\dqRSKtE.exe
  2⤵
  PID:12268
- C:\Windows\System32\QJDsuur.exe
  C:\Windows\System32\QJDsuur.exe
  2⤵
  PID:5056
- C:\Windows\System32\TGLSuFl.exe
  C:\Windows\System32\TGLSuFl.exe
  2⤵
  PID:12308
- C:\Windows\System32\IaVPHLx.exe
  C:\Windows\System32\IaVPHLx.exe
  2⤵
  PID:12328
- C:\Windows\System32\OITuLKH.exe
  C:\Windows\System32\OITuLKH.exe
  2⤵
  PID:12396
- C:\Windows\System32\tGkhWSZ.exe
  C:\Windows\System32\tGkhWSZ.exe
  2⤵
  PID:12424
- C:\Windows\System32\PczmFmb.exe
  C:\Windows\System32\PczmFmb.exe
  2⤵
  PID:12448
- C:\Windows\System32\IDxWPom.exe
  C:\Windows\System32\IDxWPom.exe
  2⤵
  PID:12464
- C:\Windows\System32\UUCFRps.exe
  C:\Windows\System32\UUCFRps.exe
  2⤵
  PID:12484
- C:\Windows\System32\NbdxypO.exe
  C:\Windows\System32\NbdxypO.exe
  2⤵
  PID:12508
- C:\Windows\System32\bepIKFW.exe
  C:\Windows\System32\bepIKFW.exe
  2⤵
  PID:12536
- C:\Windows\System32\ofgzINn.exe
  C:\Windows\System32\ofgzINn.exe
  2⤵
  PID:12564
- C:\Windows\System32\kqnEqLZ.exe
  C:\Windows\System32\kqnEqLZ.exe
  2⤵
  PID:12584
- C:\Windows\System32\iocCgBN.exe
  C:\Windows\System32\iocCgBN.exe
  2⤵
  PID:12604
- C:\Windows\System32\NnAslaQ.exe
  C:\Windows\System32\NnAslaQ.exe
  2⤵
  PID:12620
- C:\Windows\System32\VFcrcWj.exe
  C:\Windows\System32\VFcrcWj.exe
  2⤵
  PID:12644
- C:\Windows\System32\zkeSoAv.exe
  C:\Windows\System32\zkeSoAv.exe
  2⤵
  PID:12660
- C:\Windows\System32\oAGZJTi.exe
  C:\Windows\System32\oAGZJTi.exe
  2⤵
  PID:12732
- C:\Windows\System32\qaNzRAL.exe
  C:\Windows\System32\qaNzRAL.exe
  2⤵
  PID:12784
- C:\Windows\System32\eXzHmhN.exe
  C:\Windows\System32\eXzHmhN.exe
  2⤵
  PID:12800
- C:\Windows\System32\RxKNRaC.exe
  C:\Windows\System32\RxKNRaC.exe
  2⤵
  PID:12836
- C:\Windows\System32\aiyJCdl.exe
  C:\Windows\System32\aiyJCdl.exe
  2⤵
  PID:12868
- C:\Windows\System32\bPxpEEn.exe
  C:\Windows\System32\bPxpEEn.exe
  2⤵
  PID:12896
- C:\Windows\System32\MAnWcKL.exe
  C:\Windows\System32\MAnWcKL.exe
  2⤵
  PID:12932
- C:\Windows\System32\vydbpqR.exe
  C:\Windows\System32\vydbpqR.exe
  2⤵
  PID:12952
- C:\Windows\System32\NJMGgas.exe
  C:\Windows\System32\NJMGgas.exe
  2⤵
  PID:12972
- C:\Windows\System32\RDpGYXr.exe
  C:\Windows\System32\RDpGYXr.exe
  2⤵
  PID:12988
- C:\Windows\System32\jjORjsV.exe
  C:\Windows\System32\jjORjsV.exe
  2⤵
  PID:13008
- C:\Windows\System32\EXFqtLd.exe
  C:\Windows\System32\EXFqtLd.exe
  2⤵
  PID:13068
- C:\Windows\System32\hZRrBsf.exe
  C:\Windows\System32\hZRrBsf.exe
  2⤵
  PID:13096
- C:\Windows\System32\HRovpaJ.exe
  C:\Windows\System32\HRovpaJ.exe
  2⤵
  PID:13124
- C:\Windows\System32\KjARqtn.exe
  C:\Windows\System32\KjARqtn.exe
  2⤵
  PID:13140
- C:\Windows\System32\EPoWEUO.exe
  C:\Windows\System32\EPoWEUO.exe
  2⤵
  PID:13168
- C:\Windows\System32\RgFdZnN.exe
  C:\Windows\System32\RgFdZnN.exe
  2⤵
  PID:13184
- C:\Windows\System32\PHusFYs.exe
  C:\Windows\System32\PHusFYs.exe
  2⤵
  PID:13200
- C:\Windows\System32\cKGikMA.exe
  C:\Windows\System32\cKGikMA.exe
  2⤵
  PID:13260
- C:\Windows\System32\rzZLjEx.exe
  C:\Windows\System32\rzZLjEx.exe
  2⤵
  PID:13288
- C:\Windows\System32\OhvYkTv.exe
  C:\Windows\System32\OhvYkTv.exe
  2⤵
  PID:11648
- C:\Windows\System32\KqxmRKo.exe
  C:\Windows\System32\KqxmRKo.exe
  2⤵
  PID:12324
- C:\Windows\System32\tvZsGeh.exe
  C:\Windows\System32\tvZsGeh.exe
  2⤵
  PID:12368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\AGuBqQv.exe

Filesize
1.0MB

MD5
fc0493894e66c2d79a57aadac4546001

SHA1
1d3017c4de7eddd6e96df7ccd2e9288c921ffbda

SHA256
24da0385fbae459f046db37cc32007ec777c7b8bcba746d8d1a4ec7bc9076153

SHA512
3a2b84f67be0b0cb69240e0df7a482c368f646a5876bdff328b101799c0f35cab5f4c966605bc0029122f6131166b55a1d6d60f937d112423567f335e85f4394

Download Submit
C:\Windows\System32\AeMtSnF.exe

Filesize
1.0MB

MD5
97616b12dd1788d2ca261ed087f5d4d8

SHA1
1b9b0144e36e9b2917a6ef5b1f05e532a0851198

SHA256
54d91bce5592d5801325bd66ea377e83efad58e15bccf2b75693d8ae32776bc3

SHA512
ce5749a29bcb8ec30cd335f4ab28fe4624a0203e51f3804a7c745bbf4e16bd4611c1626cb56eb76adc9abbba561b2f78c46b1f3000ce473fb3c687fc53624956

Download Submit
C:\Windows\System32\BLqDpYD.exe

Filesize
1.0MB

MD5
2dd4fcbabc48f2a01947f3dd08978a92

SHA1
ac06dd0cfb2d352808749afb847f340348f88eb7

SHA256
37478e81c464ae23fcddfc99a88c0052bac8e52e4a87cb4ef9f43d440de2f68c

SHA512
cc3630f6465e5b371a2b2941271a8c1bb8462b1837edae9af40b703b964e1286c33411cd7ff1ffcf97d6bf4fbb8d66ab5e98d2d6bd988e37e7cd8738023c34ae

Download Submit
C:\Windows\System32\CzRlMgD.exe

Filesize
1.0MB

MD5
4468bf3dcd1aa055de99051ff14c995b

SHA1
ae3354c76fdd21e30f83386d8d127b575e7e492d

SHA256
c50eee3c9e1788f2c5b9b3c564580049704918c3b138adf1e3d470620c5be915

SHA512
52996d70f6e09ba3ce022e66c690dbeb5093bb0d748eba1e11fe1a7076c9c21951836085d5fd0b8211755c792ac7f5609f97e8ae75c9fafe8f2211c3faea1f6a

Download Submit
C:\Windows\System32\DGhlEgt.exe

Filesize
1.1MB

MD5
fa67203b1a464d883e394cb379dfef6d

SHA1
b9be8f0c51f67ca1cc24e2bdfbdf817b4a81e51c

SHA256
7f797f20a32c5542f6cac0c291326d7a434e03175885af37c01a99e6bfc5876f

SHA512
4527350c8d969cd9daf8fb30fc2c5bfaa8bce2aa22f865d336acddbfd1c9786374a3eef2c0f99f5bccdf360dcbf349da83035b3f6b20b98571e62b120cbca077

Download Submit
C:\Windows\System32\EhwEAbd.exe

Filesize
1.0MB

MD5
151e2e54ce9c4942ad272713edcf255a

SHA1
b5647078fd9042e520cf7fac2434b09097dd8d18

SHA256
e5a012f6ee26b7a9c19a7f06ee57dcfd83601afe71229fc563834fdc6af86e7b

SHA512
08ba0a6585d1c1177c1997adf25aee1159e3ff6b2e2e345b84766b40f169cbaf5e85191c7aa3e35692b1af4bbe55f05c672b2fa415305fd528bc5b05f12d6c73

Download Submit
C:\Windows\System32\IwYdliS.exe

Filesize
1.0MB

MD5
8aa8f04edc943e5955b4d0ecb442feb6

SHA1
e391f27b564a4876720d0516c1700b4baab2493d

SHA256
c7f1e67fc2bbdd8ea676823b9598cd108eb9b5492391c79c55d15e431a396c03

SHA512
6eb7ba57cdc068f49c410305ee0a1ebeac18dc3ab915735dd180ce9c8c229bd0a720ed23f802d1437eca43ea65a0e81172909ff02a3cd1ab1d41576e1b2fcac6

Download Submit
C:\Windows\System32\LQRcwFj.exe

Filesize
1.0MB

MD5
d9bb459fbd428b7e098b990e90e98a93

SHA1
76e1b1a1eb9816ccd9e9c9ce89fbeb96326f47f6

SHA256
75c8d065caa943efc33803b096d9ff5bbca81bf91f4eade6bb585c23f295eba6

SHA512
48a359f100bc530cf9e6dd3ccee231d62e62eec5bae09e294340b6a82777a4fa09e8d97d361970fc6a06b7b587fc4e4218bf8f6dfeaf1813d5f497d88208487e

Download Submit
C:\Windows\System32\LaGAxzk.exe

Filesize
1.0MB

MD5
38f568a8497f78d0c1483fe80902503a

SHA1
873aa7d1b1b762323f5271bd574fd2c9486c20c9

SHA256
3812086108c83935a9d04a8f8ebbf27f810fa9de8f375f9527b5bc0376ea559f

SHA512
3fb99101dc9900bff198c5f68dba602cbfc97649f2bc926136dc6c0c8105d84eb59c550c3c87da6359af2024b5141e1699316eee6cd18381f9236f6635ba90fd

Download Submit
C:\Windows\System32\OcDeANW.exe

Filesize
1.0MB

MD5
02781db84386fa517149ba872c69ae45

SHA1
973782043b6cd8b94c30c5de8d53cde1c00c3d8a

SHA256
ea3668c4492352f8a6c3474b9e6e5b105c2889cf87f66d0dd9d3c13cf514b7ee

SHA512
0cdc2590d534e642a19576c85b19b6613ada0a15476c591c1307cb90523487207aa70cd9a2be6c883e354f481e3f6127aa15afdd7ecae512e7ae6c7433870253

Download Submit
C:\Windows\System32\RdUmOHn.exe

Filesize
1.1MB

MD5
29339d6e5e1fd048e9e06f44c50f9cbc

SHA1
fc5b59ad5e3f3e16598b534b8d933ab4e827f67b

SHA256
c94ba42beda3aa1ebad3342871ec7554581fd5596c14437830a87b984e7a8171

SHA512
e11d957b8646e5308116c1c0d420a76d41d79b0fdcc7ad42c9207dbcaf3b395c0154bef94f34f57218aca86afabba77240e936741a789c91dd29e2d0629e1790

Download Submit
C:\Windows\System32\WlmWHxq.exe

Filesize
1.0MB

MD5
e2e809d318bea0bf53c007fcc7c1637b

SHA1
c132371ed5fb2ec82eb118523a8a06edb1d795f2

SHA256
2cfd91d90209610a4ccfa0a7b2764d0b623663c23b7b3c3f5293caa84ed0adce

SHA512
9981033dad8f99ff5d09750a049311b9a62278286191451d40a833c32786085f44fb176830acb34e54549f2fcea314543010309698512d856e492fd1459cc2a2

Download Submit
C:\Windows\System32\YbmsKYk.exe

Filesize
1.0MB

MD5
edba72b7ccfe98b10659328bfba63af5

SHA1
9841c08d035bb6690d27c8f38ea1fdedaed40ecc

SHA256
5444104491b1a4f151444ad2dd58b85af2ec7d3f28fdc7eb1b95a81dd7e2fdd0

SHA512
6e06bcbc1fcf0b3e49110b70fec0be76d8779c55db1fbae6b0b2285ac6e66173c5a4f18ce5ea0a13bb36d452cbdd319e8769d5bfec336b9a51f47d53de229323

Download Submit
C:\Windows\System32\YsqYLWo.exe

Filesize
1.1MB

MD5
3cf68e57d65efd63a5c4c609284ff39b

SHA1
81a7bf6f947ae3f77b769af608ec28c894388f4b

SHA256
7ab99ed5ba6c5f61f1094cf9e47250a788f097207a791f9d99f3bc492dfe3bd7

SHA512
282b9f6875ab3e9bd41bb266276ef78303771a762161c6fbc76b21de0f8130db92d78f42028e00ee2cd0b5f2741468f9f39f2493aa8e283ae31ef8bac2b21b18

Download Submit
C:\Windows\System32\ZDrzdLK.exe

Filesize
1.1MB

MD5
71c8b760c4d326b652f87bb6d357692f

SHA1
71b223009e8913e8ede916b7d1034d92d9e3ee4c

SHA256
ac63f6c0b13f72c1d23717bf947a947bb0f269019c68dbead2abd5dfc20b062b

SHA512
dd8fcd524ee07fa817a0003626fcb126c7b2906fdd723f4e0aa3e9bbda47ce2c191563e5e8793f8900c9d08d8003d4d4467747d49c7928b0d5a6fa6fc8877a98

Download Submit
C:\Windows\System32\afiqtBI.exe

Filesize
1.1MB

MD5
c0af553325c4bdaff740f656e5247e21

SHA1
54267ae2c4acdfd5e9556eedda94d116c1cbc01d

SHA256
9478e52b3a267ff9f6281aa6d933f14936a9fc0a3323c20cde99d823ca0d935a

SHA512
b737a2c34adce4c58b91c3f7af2c0cb2e60565cbd8637c3e764f16a0ca29fdc3e2d4d2bd76a2ba9d062ce2306d179ca1efef6b3f38b4ba9185271f0ca02c79e1

Download Submit
C:\Windows\System32\egeWKOB.exe

Filesize
1.1MB

MD5
72e54ee316dac3caba76e20ee468998d

SHA1
90421c7c5d8a391b454b7e1fc7b47dc2227f62b5

SHA256
4507e873d7b31c92f7e6c03debd80ec980e713242e5345ab3766bd2176a5fffb

SHA512
e2c85000049d78ad88b8fd56f98def8ab3f58bc31df18ff277acce64fd6a035289438f23abd1774f1884784dd04b7dfe3242d5491a0a35d063d48882fba3da1f

Download Submit
C:\Windows\System32\hOCQmtk.exe

Filesize
1.0MB

MD5
4e554e787efa0d6e98757950ab330dd6

SHA1
cdf6c1a2669ec2a6faa14893d329a21ed044e8ab

SHA256
69617c9181c9cf848263b788df807670c0d02d5589c6da0792ea7091edbe8dbe

SHA512
c741f4ae9029f41ba51d7a113c926ebee5d431b7fca3da0b0ae1d53fd7d9cef6d9617ae929451ccbbde4a32ae0f88ab0a4d2f851531977c1dcb2e43f07a83226

Download Submit
C:\Windows\System32\jKqtwun.exe

Filesize
1.1MB

MD5
8c1f578ebc478d5e97b8d0a53c75d296

SHA1
eb7ee45dc73303c2d14843c2a6b7893e656b07e9

SHA256
f8618063220a3d3ac2f48bf78b56d70bd12b3c43bccd062e86baa6dcdf1312d5

SHA512
1ef36640e31df5377ffcfad7f936fa3da73a175a1524e39d741e8bbf672d0d94741c3093cff8954ffb96a72f690795f21b37a3c88563d1b56f08a01eb2da10ad

Download Submit
C:\Windows\System32\moqtDxR.exe

Filesize
1.0MB

MD5
cc9de66b8dceaf7099a62fa8aaeeb6c5

SHA1
adf2403cb31e5285929e5545e2e5f7ecd6d7ec38

SHA256
622d8ff56220dde2f538e32e9c1a840323128194866d8e65eba38dc1a8e9a17a

SHA512
b531616c1d04d894a0a12f704131690ea91fea56f2c485e79ffe3a50bae24502cb26f1203f773a8de9c2a5932aeb0f6af11870d523e733a0d7a10ae284877cef

Download Submit
C:\Windows\System32\rtAKSGU.exe

Filesize
1.1MB

MD5
0704b0614d5d692f93695eb0bb188631

SHA1
12e7e6d8209d6bdf0b04611fd178fec39feaca67

SHA256
bd5535311e462da75db0a5884c1a72fcfebb7fd97973f7aac63214b00587dcc6

SHA512
a5eb4c060c22c073ed9da3ddb0590b2be847173ea015975faff8a8dfe779d93ed1dabf9b760d687dafb73749e255ce9f05ee5db10b29aed439a9db18e38b7c70

Download Submit
C:\Windows\System32\ruhsRJv.exe

Filesize
1.1MB

MD5
c17072e54dc64ef42e4da59eab6f89ba

SHA1
7926bc461c34b34dcf069e5045d325a1194b8646

SHA256
49d05794e5b40dd2b224bcc3fc901bd6cdb6b0df1b8ddbc395c7063229fed6af

SHA512
dcdc888cd1b2fb9a5ad44dee2dc98ab4c6c11b85ac925af384b20ff220ca8b24b85b32aae83a5c8029b19296ac709b7ee4ef3b05a5ea720bea7a7d331b5653e3

Download Submit
C:\Windows\System32\utGbWrY.exe

Filesize
1.0MB

MD5
4031e2907f74d9855672bfc4ec458969

SHA1
7f5384d61a16627f78af2fd1261b01a23ca8f648

SHA256
af7d1775ee3b331ec3b500c1ecb9160125e5a2526efff6385f5194e6be40c43d

SHA512
ff8f555b91bad607230ce8bdb38aa9df1c8b30016ae0769a3a4197c9c3cf9d4e71c206bd57442a5d7b546e444effb20af217f981947508f566c840b450acfd2d

Download Submit
C:\Windows\System32\vgwtxbu.exe

Filesize
1.0MB

MD5
6e253684c89bba4322373a69ad311bc6

SHA1
2f294542785645ce0602f0369e236fa3f246e1d1

SHA256
26a1cb780b17ec8a9a4ec695e6bd29ef493938f96f0ae3c96a57c596daab0283

SHA512
d931d8621f66a1af3b1e7d50293ebb8945b91d646185f51ee6d05bd537df65c7e98a6713fd362a7a469e86e6c882829eeea61ac8051a8beb8fb46e5a327f7223

Download Submit
C:\Windows\System32\wZXHaRe.exe

Filesize
1.0MB

MD5
450f003762766de8c3edfdb3bd5cce9a

SHA1
e885456ba6d6effad6f68bb083c0c82f74b1fb58

SHA256
46b1f90a5de883f17e54747d6b4e2f9fa29b5d3c8e7553b50c8a3b66e759bea6

SHA512
5908a78dfefd280d17ce3912c9120b72f56fa31f47e213d1a39b51f2aafbb66f05f6ef64a64a6cba507adeefb3155f2803181d4b68c1748454693e2df8a41822

Download Submit
C:\Windows\System32\wbTKCVL.exe

Filesize
1.0MB

MD5
e9644eea8a5c94f85a34f35cf033725f

SHA1
3300b636a9a096ba78ade35d2af55d8e51a10df9

SHA256
5c198f2f3f26ef46296d4dbaa1522ab319cd7ec1074b2401487fda539bf840ce

SHA512
7b13a72012301d37137ba0276ccc58a3bb9a3ba6a2ba6ed9091bc188dded9acb164729043309d1b173c0e890e89460b4cecdfee868ebd18e1cc9447ed76e6be8

Download Submit
C:\Windows\System32\wcQhcyh.exe

Filesize
1.0MB

MD5
929b23d58404e78230b67230d1c61c96

SHA1
a21e4e4e69f104e71f7e763a89f4cd35232b5c42

SHA256
852a1bf350e4f4591c9cf4b5b95ddc16f8ec7cc839de3e812f2280e3b9e3f540

SHA512
d6e527aee7b047bf081fc9df9378dd6b8ce59e154bf660313f6a0ccc4cfe46a219aa4817e8f6c70610d1f51210e98dabad6d2ad95d38ca5a5986f97d7cadcf9e

Download Submit
C:\Windows\System32\wnUGUGQ.exe

Filesize
1.0MB

MD5
bcd8b4cf9120bfa7350a5f31a39acf06

SHA1
d9f1373399f88901c2f8deab3a7b040062f39257

SHA256
513d8df2e9b0f06bfbf59245982495a62b0ec72c1671fa17c7952eb9248f6a76

SHA512
e36b06b8743f2e90a29a6de522c928b3c2a74279eabf20d7cbee66f5121e4209072f56ea59fafee230a050df2e26074e55bca0883cfbc8644661a20af7a4630d

Download Submit
C:\Windows\System32\xMQNXDm.exe

Filesize
1.0MB

MD5
9382d9f484edf169c1443f5a194593b3

SHA1
41db8a2751ee904d8e6833f315085380a40aaafb

SHA256
9121e41ec3c40e2aa5bdcb41ea155364348d6a83305050f440d59bed3578546a

SHA512
1e093059e0fb45642623c8bcd43639c1e825d8ea8b6a62d8f265316bb19b5375119c5e4434b0b09e197af85c5c7e57600a869d0d2285bf7e511b9828f7093327

Download Submit
C:\Windows\System32\xUWitsd.exe

Filesize
1.0MB

MD5
49169fbe28c6c4a2b4a3744e81ed3c5f

SHA1
bb795556cc99012b059ea49b85eb392ade879ed5

SHA256
8f54bf38f4e7ac2be82852b086adb47f000ae30ac0155a951eaf44d577a66b2b

SHA512
301186f8aa2a9437cdadd16343f2d00a778012bfa05dedb0ab5efe2ad4f76c1754fd81859d486007bfd86212fedd55ec33b19157dc288129b1ffccfd5a30e0bb

Download Submit
C:\Windows\System32\xcyGkFn.exe

Filesize
1.0MB

MD5
322a1871d3df523cdf28e2dd26262332

SHA1
157f5b59263019dd0c9cc71139a8c0ca81c79914

SHA256
add4f9a45df63fa1b47f47330e5f48ae01c9a23cae9c88f1d27eba3c5f218acc

SHA512
d76ec277231fdab25e692389ad2619680e86638d98777ac883c417f05bda469529ecba347a0830df998a95841bf419c759a5253a17aa9825022cfb9a2ccdd97e

Download Submit
C:\Windows\System32\xeHLTki.exe

Filesize
1.0MB

MD5
fa4c75e50ae9212f00fb4eda94e9b429

SHA1
d758a402c20e0e758c60c48d0fd3ad8a59e49457

SHA256
516fd3e1ad2c0c1cbda08eaa977d89bc4c97bf7607058d2a38eff011bde53a6a

SHA512
5460904a114ea6a2dfd350f5fc72bc5dc298bf80d7139f41dd6e47f95b2733b00a58fa122780d2393f922e5ca5356db2d8282b3652a90ba1c5dc7065eafb0853

Download Submit
memory/396-2039-0x00007FF678F10000-0x00007FF679301000-memory.dmp

Filesize
3.9MB

Download
memory/396-46-0x00007FF678F10000-0x00007FF679301000-memory.dmp

Filesize
3.9MB

Download
memory/396-1976-0x00007FF678F10000-0x00007FF679301000-memory.dmp

Filesize
3.9MB

Download
memory/680-32-0x00007FF6FEF80000-0x00007FF6FF371000-memory.dmp

Filesize
3.9MB

Download
memory/680-1964-0x00007FF6FEF80000-0x00007FF6FF371000-memory.dmp

Filesize
3.9MB

Download
memory/680-2018-0x00007FF6FEF80000-0x00007FF6FF371000-memory.dmp

Filesize
3.9MB

Download
memory/1148-2036-0x00007FF7A0520000-0x00007FF7A0911000-memory.dmp

Filesize
3.9MB

Download
memory/1148-392-0x00007FF7A0520000-0x00007FF7A0911000-memory.dmp

Filesize
3.9MB

Download
memory/1840-417-0x00007FF7F62C0000-0x00007FF7F66B1000-memory.dmp

Filesize
3.9MB

Download
memory/1840-2054-0x00007FF7F62C0000-0x00007FF7F66B1000-memory.dmp

Filesize
3.9MB

Download
memory/1944-1-0x0000020F7DB30000-0x0000020F7DB40000-memory.dmp

Filesize
64KB

Download
memory/1944-1961-0x00007FF75B6F0000-0x00007FF75BAE1000-memory.dmp

Filesize
3.9MB

Download
memory/1944-0-0x00007FF75B6F0000-0x00007FF75BAE1000-memory.dmp

Filesize
3.9MB

Download
memory/2124-2058-0x00007FF770B70000-0x00007FF770F61000-memory.dmp

Filesize
3.9MB

Download
memory/2124-425-0x00007FF770B70000-0x00007FF770F61000-memory.dmp

Filesize
3.9MB

Download
memory/2136-393-0x00007FF78B970000-0x00007FF78BD61000-memory.dmp

Filesize
3.9MB

Download
memory/2136-2035-0x00007FF78B970000-0x00007FF78BD61000-memory.dmp

Filesize
3.9MB

Download
memory/2176-21-0x00007FF749270000-0x00007FF749661000-memory.dmp

Filesize
3.9MB

Download
memory/2176-2020-0x00007FF749270000-0x00007FF749661000-memory.dmp

Filesize
3.9MB

Download
memory/2176-1962-0x00007FF749270000-0x00007FF749661000-memory.dmp

Filesize
3.9MB

Download
memory/2208-2052-0x00007FF689230000-0x00007FF689621000-memory.dmp

Filesize
3.9MB

Download
memory/2208-400-0x00007FF689230000-0x00007FF689621000-memory.dmp

Filesize
3.9MB

Download
memory/2388-1960-0x00007FF73F0C0000-0x00007FF73F4B1000-memory.dmp

Filesize
3.9MB

Download
memory/2388-2014-0x00007FF73F0C0000-0x00007FF73F4B1000-memory.dmp

Filesize
3.9MB

Download
memory/2388-17-0x00007FF73F0C0000-0x00007FF73F4B1000-memory.dmp

Filesize
3.9MB

Download
memory/2392-2060-0x00007FF78E840000-0x00007FF78EC31000-memory.dmp

Filesize
3.9MB

Download
memory/2392-430-0x00007FF78E840000-0x00007FF78EC31000-memory.dmp

Filesize
3.9MB

Download
memory/2448-2051-0x00007FF779920000-0x00007FF779D11000-memory.dmp

Filesize
3.9MB

Download
memory/2448-401-0x00007FF779920000-0x00007FF779D11000-memory.dmp

Filesize
3.9MB

Download
memory/3320-383-0x00007FF68E310000-0x00007FF68E701000-memory.dmp

Filesize
3.9MB

Download
memory/3320-2027-0x00007FF68E310000-0x00007FF68E701000-memory.dmp

Filesize
3.9MB

Download
memory/3328-398-0x00007FF7377A0000-0x00007FF737B91000-memory.dmp

Filesize
3.9MB

Download
memory/3328-2044-0x00007FF7377A0000-0x00007FF737B91000-memory.dmp

Filesize
3.9MB

Download
memory/3348-2002-0x00007FF63FF60000-0x00007FF640351000-memory.dmp

Filesize
3.9MB

Download
memory/3348-2042-0x00007FF63FF60000-0x00007FF640351000-memory.dmp

Filesize
3.9MB

Download
memory/3348-49-0x00007FF63FF60000-0x00007FF640351000-memory.dmp

Filesize
3.9MB

Download
memory/3624-40-0x00007FF7A8AE0000-0x00007FF7A8ED1000-memory.dmp

Filesize
3.9MB

Download
memory/3624-1999-0x00007FF7A8AE0000-0x00007FF7A8ED1000-memory.dmp

Filesize
3.9MB

Download
memory/3624-2041-0x00007FF7A8AE0000-0x00007FF7A8ED1000-memory.dmp

Filesize
3.9MB

Download
memory/3748-2033-0x00007FF7E5E00000-0x00007FF7E61F1000-memory.dmp

Filesize
3.9MB

Download
memory/3748-394-0x00007FF7E5E00000-0x00007FF7E61F1000-memory.dmp

Filesize
3.9MB

Download
memory/3764-2022-0x00007FF66D6F0000-0x00007FF66DAE1000-memory.dmp

Filesize
3.9MB

Download
memory/3764-1975-0x00007FF66D6F0000-0x00007FF66DAE1000-memory.dmp

Filesize
3.9MB

Download
memory/3764-34-0x00007FF66D6F0000-0x00007FF66DAE1000-memory.dmp

Filesize
3.9MB

Download
memory/4064-2029-0x00007FF6499E0000-0x00007FF649DD1000-memory.dmp

Filesize
3.9MB

Download
memory/4064-397-0x00007FF6499E0000-0x00007FF649DD1000-memory.dmp

Filesize
3.9MB

Download
memory/4104-399-0x00007FF791660000-0x00007FF791A51000-memory.dmp

Filesize
3.9MB

Download
memory/4104-2049-0x00007FF791660000-0x00007FF791A51000-memory.dmp

Filesize
3.9MB

Download
memory/4112-386-0x00007FF7B6090000-0x00007FF7B6481000-memory.dmp

Filesize
3.9MB

Download
memory/4112-2046-0x00007FF7B6090000-0x00007FF7B6481000-memory.dmp

Filesize
3.9MB

Download
memory/4516-413-0x00007FF6054D0000-0x00007FF6058C1000-memory.dmp

Filesize
3.9MB

Download
memory/4516-2056-0x00007FF6054D0000-0x00007FF6058C1000-memory.dmp

Filesize
3.9MB

Download
memory/4948-27-0x00007FF6C8340000-0x00007FF6C8731000-memory.dmp

Filesize
3.9MB

Download
memory/4948-1963-0x00007FF6C8340000-0x00007FF6C8731000-memory.dmp

Filesize
3.9MB

Download
memory/4948-2016-0x00007FF6C8340000-0x00007FF6C8731000-memory.dmp

Filesize
3.9MB

Download
memory/5084-395-0x00007FF68F130000-0x00007FF68F521000-memory.dmp

Filesize
3.9MB

Download
memory/5084-2025-0x00007FF68F130000-0x00007FF68F521000-memory.dmp

Filesize
3.9MB

Download
memory/5104-2031-0x00007FF799D20000-0x00007FF79A111000-memory.dmp

Filesize
3.9MB

Download
memory/5104-396-0x00007FF799D20000-0x00007FF79A111000-memory.dmp

Filesize
3.9MB

Download