xmrig | 7bbb928f16e0018fc3239efba7a1fa647d6dd2dd367fe1b3b074eddc973b81a2

Analysis

max time kernel
62s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
Size

1.6MB
MD5

0aa3d17322328cee3bc160d4ee14c6a5
SHA1

f0703748b2fd67f0d3465a0566824258acf30bfe
SHA256

7bbb928f16e0018fc3239efba7a1fa647d6dd2dd367fe1b3b074eddc973b81a2
SHA512

2164b624551e221b4df219475501566a3b7d114f3f9d80a4f488dc7efb2e5d2a3b30b13d55807549eff8c6eb8c7ea9a96873362f28f04837f3ef6b701b360913
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlGC78XIO9C1MKTbcMfHhGjw2Do+BRrCfUgqpE:knw9oUUEEDlGUjc2HhG82DiMO

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/2540-47-0x00007FF78C350000-0x00007FF78C741000-memory.dmp	xmrig
behavioral2/memory/3476-480-0x00007FF62E170000-0x00007FF62E561000-memory.dmp	xmrig
behavioral2/memory/4464-479-0x00007FF7B2D60000-0x00007FF7B3151000-memory.dmp	xmrig
behavioral2/memory/4304-481-0x00007FF624EC0000-0x00007FF6252B1000-memory.dmp	xmrig
behavioral2/memory/2788-483-0x00007FF70D920000-0x00007FF70DD11000-memory.dmp	xmrig
behavioral2/memory/3848-482-0x00007FF6EEDA0000-0x00007FF6EF191000-memory.dmp	xmrig
behavioral2/memory/4220-484-0x00007FF7C2310000-0x00007FF7C2701000-memory.dmp	xmrig
behavioral2/memory/2204-488-0x00007FF7B97C0000-0x00007FF7B9BB1000-memory.dmp	xmrig
behavioral2/memory/1332-487-0x00007FF75AEF0000-0x00007FF75B2E1000-memory.dmp	xmrig
behavioral2/memory/3516-486-0x00007FF60C580000-0x00007FF60C971000-memory.dmp	xmrig
behavioral2/memory/3056-485-0x00007FF69E040000-0x00007FF69E431000-memory.dmp	xmrig
behavioral2/memory/2188-489-0x00007FF786410000-0x00007FF786801000-memory.dmp	xmrig
behavioral2/memory/884-490-0x00007FF7B0BE0000-0x00007FF7B0FD1000-memory.dmp	xmrig
behavioral2/memory/1832-491-0x00007FF635730000-0x00007FF635B21000-memory.dmp	xmrig
behavioral2/memory/2632-493-0x00007FF7477C0000-0x00007FF747BB1000-memory.dmp	xmrig
behavioral2/memory/2444-492-0x00007FF682F60000-0x00007FF683351000-memory.dmp	xmrig
behavioral2/memory/1164-1179-0x00007FF77BA70000-0x00007FF77BE61000-memory.dmp	xmrig
behavioral2/memory/1520-1684-0x00007FF6817F0000-0x00007FF681BE1000-memory.dmp	xmrig
behavioral2/memory/1008-1977-0x00007FF6E3560000-0x00007FF6E3951000-memory.dmp	xmrig
behavioral2/memory/2944-1978-0x00007FF789C60000-0x00007FF78A051000-memory.dmp	xmrig
behavioral2/memory/5080-1980-0x00007FF735310000-0x00007FF735701000-memory.dmp	xmrig
behavioral2/memory/3124-2012-0x00007FF761280000-0x00007FF761671000-memory.dmp	xmrig
behavioral2/memory/4172-2013-0x00007FF67FDE0000-0x00007FF6801D1000-memory.dmp	xmrig
behavioral2/memory/1520-2015-0x00007FF6817F0000-0x00007FF681BE1000-memory.dmp	xmrig
behavioral2/memory/2040-2017-0x00007FF6DEDC0000-0x00007FF6DF1B1000-memory.dmp	xmrig
behavioral2/memory/1164-2021-0x00007FF77BA70000-0x00007FF77BE61000-memory.dmp	xmrig
behavioral2/memory/1008-2023-0x00007FF6E3560000-0x00007FF6E3951000-memory.dmp	xmrig
behavioral2/memory/4636-2027-0x00007FF65CC20000-0x00007FF65D011000-memory.dmp	xmrig
behavioral2/memory/5080-2026-0x00007FF735310000-0x00007FF735701000-memory.dmp	xmrig
behavioral2/memory/2944-2029-0x00007FF789C60000-0x00007FF78A051000-memory.dmp	xmrig
behavioral2/memory/3124-2031-0x00007FF761280000-0x00007FF761671000-memory.dmp	xmrig
behavioral2/memory/2540-2049-0x00007FF78C350000-0x00007FF78C741000-memory.dmp	xmrig
behavioral2/memory/1332-2053-0x00007FF75AEF0000-0x00007FF75B2E1000-memory.dmp	xmrig
behavioral2/memory/2188-2057-0x00007FF786410000-0x00007FF786801000-memory.dmp	xmrig
behavioral2/memory/884-2059-0x00007FF7B0BE0000-0x00007FF7B0FD1000-memory.dmp	xmrig
behavioral2/memory/2204-2055-0x00007FF7B97C0000-0x00007FF7B9BB1000-memory.dmp	xmrig
behavioral2/memory/3516-2051-0x00007FF60C580000-0x00007FF60C971000-memory.dmp	xmrig
behavioral2/memory/3056-2048-0x00007FF69E040000-0x00007FF69E431000-memory.dmp	xmrig
behavioral2/memory/3848-2047-0x00007FF6EEDA0000-0x00007FF6EF191000-memory.dmp	xmrig
behavioral2/memory/2788-2044-0x00007FF70D920000-0x00007FF70DD11000-memory.dmp	xmrig
behavioral2/memory/4220-2043-0x00007FF7C2310000-0x00007FF7C2701000-memory.dmp	xmrig
behavioral2/memory/4464-2040-0x00007FF7B2D60000-0x00007FF7B3151000-memory.dmp	xmrig
behavioral2/memory/2040-2036-0x00007FF6DEDC0000-0x00007FF6DF1B1000-memory.dmp	xmrig
behavioral2/memory/4304-2035-0x00007FF624EC0000-0x00007FF6252B1000-memory.dmp	xmrig
behavioral2/memory/3476-2039-0x00007FF62E170000-0x00007FF62E561000-memory.dmp	xmrig
behavioral2/memory/2632-2066-0x00007FF7477C0000-0x00007FF747BB1000-memory.dmp	xmrig
behavioral2/memory/1832-2105-0x00007FF635730000-0x00007FF635B21000-memory.dmp	xmrig
behavioral2/memory/2444-2101-0x00007FF682F60000-0x00007FF683351000-memory.dmp	xmrig
behavioral2/memory/4172-2208-0x00007FF67FDE0000-0x00007FF6801D1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1164	tFlXhGv.exe
4636	aVNxyhq.exe
1008	TqrFQaD.exe
2944	GYPTHVI.exe
5080	TZdZFNe.exe
3124	evdoEkh.exe
2540	HTGFWdh.exe
4172	VaARAHa.exe
2040	cHdLEle.exe
4464	DnwOTRo.exe
3476	YAPazwr.exe
4304	HvxNAFB.exe
3848	tyDSACu.exe
2788	ECAMdez.exe
4220	RPzaGcF.exe
3056	zjFfsqD.exe
3516	pFgZzXV.exe
1332	icBmpEk.exe
2204	yxEjrip.exe
2188	PQPmzhS.exe
884	zsWTCHK.exe
1832	oNVmXpq.exe
2444	mmWEpmC.exe
2632	eoNxdRo.exe
1236	RPzhfch.exe
1556	sMJKmTm.exe
2536	ZdxOUJU.exe
4004	ykKYKzN.exe
2956	dQAEvgf.exe
1952	blBzCVH.exe
2268	KHYvJei.exe
4756	WrgOoRn.exe
3472	klDEJnz.exe
2516	edgPDFO.exe
2168	fKaTQoV.exe
2484	yJqrPDe.exe
3156	VWtGUtd.exe
4564	sQVpqbJ.exe
212	ZlUexJA.exe
4732	zydmWaT.exe
1552	TGxpytD.exe
4268	xZkhnBH.exe
4252	YZjpDXZ.exe
760	znJzjAE.exe
3188	nasndFo.exe
5028	HVvkWfq.exe
5036	neMmtkn.exe
2520	VYQOkMo.exe
4792	RLFzGIx.exe
1364	NyvYHJo.exe
2016	uFPPMBw.exe
2496	lkCVfyA.exe
4404	JLvRsWu.exe
3132	fKpoQHu.exe
2192	kaZXxKb.exe
524	MGOLFEc.exe
1772	lWyftWe.exe
1844	ebprYZZ.exe
4048	UcxdCfP.exe
1968	MfiuJnz.exe
216	iTliZgZ.exe
2796	RHuyspg.exe
4788	NQZIymw.exe
3372	FCYpjup.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1520-0-0x00007FF6817F0000-0x00007FF681BE1000-memory.dmp	upx
behavioral2/files/0x000c000000023b9f-5.dat	upx
behavioral2/files/0x000b000000023bab-11.dat	upx
behavioral2/files/0x000a000000023bad-16.dat	upx
behavioral2/files/0x000a000000023bac-23.dat	upx
behavioral2/files/0x000a000000023bae-21.dat	upx
behavioral2/memory/1008-20-0x00007FF6E3560000-0x00007FF6E3951000-memory.dmp	upx
behavioral2/memory/4636-19-0x00007FF65CC20000-0x00007FF65D011000-memory.dmp	upx
behavioral2/memory/1164-14-0x00007FF77BA70000-0x00007FF77BE61000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-40.dat	upx
behavioral2/memory/2540-47-0x00007FF78C350000-0x00007FF78C741000-memory.dmp	upx
behavioral2/files/0x000a000000023bb3-56.dat	upx
behavioral2/files/0x000a000000023bb6-72.dat	upx
behavioral2/files/0x000a000000023bba-92.dat	upx
behavioral2/files/0x0031000000023bbf-119.dat	upx
behavioral2/files/0x000a000000023bc4-144.dat	upx
behavioral2/memory/3476-480-0x00007FF62E170000-0x00007FF62E561000-memory.dmp	upx
behavioral2/memory/4464-479-0x00007FF7B2D60000-0x00007FF7B3151000-memory.dmp	upx
behavioral2/files/0x000a000000023bc9-169.dat	upx
behavioral2/files/0x000a000000023bc8-164.dat	upx
behavioral2/files/0x000a000000023bc7-159.dat	upx
behavioral2/files/0x000a000000023bc6-155.dat	upx
behavioral2/files/0x000a000000023bc5-149.dat	upx
behavioral2/files/0x000a000000023bc3-139.dat	upx
behavioral2/files/0x000a000000023bc2-134.dat	upx
behavioral2/memory/4304-481-0x00007FF624EC0000-0x00007FF6252B1000-memory.dmp	upx
behavioral2/files/0x000a000000023bc1-129.dat	upx
behavioral2/memory/2788-483-0x00007FF70D920000-0x00007FF70DD11000-memory.dmp	upx
behavioral2/memory/3848-482-0x00007FF6EEDA0000-0x00007FF6EF191000-memory.dmp	upx
behavioral2/files/0x000a000000023bc0-124.dat	upx
behavioral2/files/0x0031000000023bbe-114.dat	upx
behavioral2/files/0x0031000000023bbd-110.dat	upx
behavioral2/files/0x000a000000023bbc-104.dat	upx
behavioral2/files/0x000a000000023bbb-99.dat	upx
behavioral2/files/0x000a000000023bb9-89.dat	upx
behavioral2/files/0x000a000000023bb8-84.dat	upx
behavioral2/files/0x000a000000023bb7-79.dat	upx
behavioral2/files/0x000a000000023bb5-69.dat	upx
behavioral2/files/0x000a000000023bb4-65.dat	upx
behavioral2/memory/4220-484-0x00007FF7C2310000-0x00007FF7C2701000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-54.dat	upx
behavioral2/memory/2040-53-0x00007FF6DEDC0000-0x00007FF6DF1B1000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-50.dat	upx
behavioral2/memory/4172-49-0x00007FF67FDE0000-0x00007FF6801D1000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-38.dat	upx
behavioral2/memory/3124-36-0x00007FF761280000-0x00007FF761671000-memory.dmp	upx
behavioral2/memory/5080-30-0x00007FF735310000-0x00007FF735701000-memory.dmp	upx
behavioral2/memory/2944-26-0x00007FF789C60000-0x00007FF78A051000-memory.dmp	upx
behavioral2/memory/2204-488-0x00007FF7B97C0000-0x00007FF7B9BB1000-memory.dmp	upx
behavioral2/memory/1332-487-0x00007FF75AEF0000-0x00007FF75B2E1000-memory.dmp	upx
behavioral2/memory/3516-486-0x00007FF60C580000-0x00007FF60C971000-memory.dmp	upx
behavioral2/memory/3056-485-0x00007FF69E040000-0x00007FF69E431000-memory.dmp	upx
behavioral2/memory/2188-489-0x00007FF786410000-0x00007FF786801000-memory.dmp	upx
behavioral2/memory/884-490-0x00007FF7B0BE0000-0x00007FF7B0FD1000-memory.dmp	upx
behavioral2/memory/1832-491-0x00007FF635730000-0x00007FF635B21000-memory.dmp	upx
behavioral2/memory/2632-493-0x00007FF7477C0000-0x00007FF747BB1000-memory.dmp	upx
behavioral2/memory/2444-492-0x00007FF682F60000-0x00007FF683351000-memory.dmp	upx
behavioral2/memory/1164-1179-0x00007FF77BA70000-0x00007FF77BE61000-memory.dmp	upx
behavioral2/memory/1520-1684-0x00007FF6817F0000-0x00007FF681BE1000-memory.dmp	upx
behavioral2/memory/1008-1977-0x00007FF6E3560000-0x00007FF6E3951000-memory.dmp	upx
behavioral2/memory/2944-1978-0x00007FF789C60000-0x00007FF78A051000-memory.dmp	upx
behavioral2/memory/5080-1980-0x00007FF735310000-0x00007FF735701000-memory.dmp	upx
behavioral2/memory/3124-2012-0x00007FF761280000-0x00007FF761671000-memory.dmp	upx
behavioral2/memory/4172-2013-0x00007FF67FDE0000-0x00007FF6801D1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\KXCTEIP.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\nzJYadk.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\zIgdjdq.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\BsVswlw.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\uOWhnRC.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\lZbfYBS.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\aFdMBaT.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\DhdUthb.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\wTIyBxl.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\ZDuZOmu.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\aRdEBzf.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\DWUWUTY.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\cItvOXQ.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\cNHvClP.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\neMmtkn.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\YNRJhHA.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\QYTaWdp.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\xnUGCHj.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\YmZPaVH.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\eoNxdRo.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\wxKiuqV.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\zIEDYoq.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\EFXRdRH.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\ftFlBwd.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\pNkkquy.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\zkjYudB.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\dQVBgDF.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\znJzjAE.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\yQTNNNz.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\eykavRj.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\wBKUHgy.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\RsgcWmC.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\KdbJQry.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\jbUSLIX.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\wxSyLiz.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\tEtXjUw.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\fCUozXg.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\lKtwrPN.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\tWCjdRK.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\FHeQGKa.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\zpxSgUW.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\qXSLCuB.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\FmAigwW.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\oUdRvMx.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\gYLeSPA.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\uaWGhpG.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\VGfQTRI.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\snbHUqT.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\ZkqRkdo.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\nGWuBpI.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\YYQFDnY.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\MGOLFEc.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\wKxWLnA.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\AVdqLPC.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\JTaRzZq.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\HTGFWdh.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\icBmpEk.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\AglSCMd.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\urMCURX.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\uaKBbki.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\SWHixHu.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\cteexen.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\dKThBJs.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
File created	C:\Windows\System32\TqvVyql.exe	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1164	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	86
PID 1520 wrote to memory of 1164	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	86
PID 1520 wrote to memory of 4636	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	87
PID 1520 wrote to memory of 4636	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	87
PID 1520 wrote to memory of 1008	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	88
PID 1520 wrote to memory of 1008	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	88
PID 1520 wrote to memory of 2944	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	89
PID 1520 wrote to memory of 2944	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	89
PID 1520 wrote to memory of 5080	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	90
PID 1520 wrote to memory of 5080	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	90
PID 1520 wrote to memory of 3124	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	91
PID 1520 wrote to memory of 3124	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	91
PID 1520 wrote to memory of 2540	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	92
PID 1520 wrote to memory of 2540	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	92
PID 1520 wrote to memory of 4172	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	93
PID 1520 wrote to memory of 4172	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	93
PID 1520 wrote to memory of 2040	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	94
PID 1520 wrote to memory of 2040	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	94
PID 1520 wrote to memory of 4464	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	95
PID 1520 wrote to memory of 4464	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	95
PID 1520 wrote to memory of 3476	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	96
PID 1520 wrote to memory of 3476	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	96
PID 1520 wrote to memory of 4304	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	97
PID 1520 wrote to memory of 4304	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	97
PID 1520 wrote to memory of 3848	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	98
PID 1520 wrote to memory of 3848	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	98
PID 1520 wrote to memory of 2788	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	99
PID 1520 wrote to memory of 2788	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	99
PID 1520 wrote to memory of 4220	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	100
PID 1520 wrote to memory of 4220	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	100
PID 1520 wrote to memory of 3056	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	101
PID 1520 wrote to memory of 3056	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	101
PID 1520 wrote to memory of 3516	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	102
PID 1520 wrote to memory of 3516	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	102
PID 1520 wrote to memory of 1332	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	103
PID 1520 wrote to memory of 1332	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	103
PID 1520 wrote to memory of 2204	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	104
PID 1520 wrote to memory of 2204	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	104
PID 1520 wrote to memory of 2188	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	105
PID 1520 wrote to memory of 2188	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	105
PID 1520 wrote to memory of 884	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	106
PID 1520 wrote to memory of 884	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	106
PID 1520 wrote to memory of 1832	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	107
PID 1520 wrote to memory of 1832	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	107
PID 1520 wrote to memory of 2444	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	108
PID 1520 wrote to memory of 2444	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	108
PID 1520 wrote to memory of 2632	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	109
PID 1520 wrote to memory of 2632	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	109
PID 1520 wrote to memory of 1236	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	110
PID 1520 wrote to memory of 1236	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	110
PID 1520 wrote to memory of 1556	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	111
PID 1520 wrote to memory of 1556	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	111
PID 1520 wrote to memory of 2536	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	112
PID 1520 wrote to memory of 2536	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	112
PID 1520 wrote to memory of 4004	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	113
PID 1520 wrote to memory of 4004	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	113
PID 1520 wrote to memory of 2956	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	114
PID 1520 wrote to memory of 2956	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	114
PID 1520 wrote to memory of 1952	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	115
PID 1520 wrote to memory of 1952	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	115
PID 1520 wrote to memory of 2268	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	116
PID 1520 wrote to memory of 2268	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	116
PID 1520 wrote to memory of 4756	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	117
PID 1520 wrote to memory of 4756	1520	0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0aa3d17322328cee3bc160d4ee14c6a5_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\System32\tFlXhGv.exe
  C:\Windows\System32\tFlXhGv.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System32\aVNxyhq.exe
  C:\Windows\System32\aVNxyhq.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System32\TqrFQaD.exe
  C:\Windows\System32\TqrFQaD.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System32\GYPTHVI.exe
  C:\Windows\System32\GYPTHVI.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System32\TZdZFNe.exe
  C:\Windows\System32\TZdZFNe.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System32\evdoEkh.exe
  C:\Windows\System32\evdoEkh.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System32\HTGFWdh.exe
  C:\Windows\System32\HTGFWdh.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System32\VaARAHa.exe
  C:\Windows\System32\VaARAHa.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System32\cHdLEle.exe
  C:\Windows\System32\cHdLEle.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System32\DnwOTRo.exe
  C:\Windows\System32\DnwOTRo.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System32\YAPazwr.exe
  C:\Windows\System32\YAPazwr.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System32\HvxNAFB.exe
  C:\Windows\System32\HvxNAFB.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System32\tyDSACu.exe
  C:\Windows\System32\tyDSACu.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System32\ECAMdez.exe
  C:\Windows\System32\ECAMdez.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System32\RPzaGcF.exe
  C:\Windows\System32\RPzaGcF.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System32\zjFfsqD.exe
  C:\Windows\System32\zjFfsqD.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System32\pFgZzXV.exe
  C:\Windows\System32\pFgZzXV.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System32\icBmpEk.exe
  C:\Windows\System32\icBmpEk.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System32\yxEjrip.exe
  C:\Windows\System32\yxEjrip.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System32\PQPmzhS.exe
  C:\Windows\System32\PQPmzhS.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System32\zsWTCHK.exe
  C:\Windows\System32\zsWTCHK.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System32\oNVmXpq.exe
  C:\Windows\System32\oNVmXpq.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System32\mmWEpmC.exe
  C:\Windows\System32\mmWEpmC.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System32\eoNxdRo.exe
  C:\Windows\System32\eoNxdRo.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System32\RPzhfch.exe
  C:\Windows\System32\RPzhfch.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System32\sMJKmTm.exe
  C:\Windows\System32\sMJKmTm.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System32\ZdxOUJU.exe
  C:\Windows\System32\ZdxOUJU.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System32\ykKYKzN.exe
  C:\Windows\System32\ykKYKzN.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System32\dQAEvgf.exe
  C:\Windows\System32\dQAEvgf.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System32\blBzCVH.exe
  C:\Windows\System32\blBzCVH.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System32\KHYvJei.exe
  C:\Windows\System32\KHYvJei.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System32\WrgOoRn.exe
  C:\Windows\System32\WrgOoRn.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System32\klDEJnz.exe
  C:\Windows\System32\klDEJnz.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System32\edgPDFO.exe
  C:\Windows\System32\edgPDFO.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System32\fKaTQoV.exe
  C:\Windows\System32\fKaTQoV.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System32\yJqrPDe.exe
  C:\Windows\System32\yJqrPDe.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System32\VWtGUtd.exe
  C:\Windows\System32\VWtGUtd.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System32\sQVpqbJ.exe
  C:\Windows\System32\sQVpqbJ.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System32\ZlUexJA.exe
  C:\Windows\System32\ZlUexJA.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System32\zydmWaT.exe
  C:\Windows\System32\zydmWaT.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System32\TGxpytD.exe
  C:\Windows\System32\TGxpytD.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System32\xZkhnBH.exe
  C:\Windows\System32\xZkhnBH.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System32\YZjpDXZ.exe
  C:\Windows\System32\YZjpDXZ.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System32\znJzjAE.exe
  C:\Windows\System32\znJzjAE.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System32\nasndFo.exe
  C:\Windows\System32\nasndFo.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System32\HVvkWfq.exe
  C:\Windows\System32\HVvkWfq.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System32\neMmtkn.exe
  C:\Windows\System32\neMmtkn.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System32\VYQOkMo.exe
  C:\Windows\System32\VYQOkMo.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System32\RLFzGIx.exe
  C:\Windows\System32\RLFzGIx.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System32\NyvYHJo.exe
  C:\Windows\System32\NyvYHJo.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System32\uFPPMBw.exe
  C:\Windows\System32\uFPPMBw.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System32\lkCVfyA.exe
  C:\Windows\System32\lkCVfyA.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System32\JLvRsWu.exe
  C:\Windows\System32\JLvRsWu.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System32\fKpoQHu.exe
  C:\Windows\System32\fKpoQHu.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System32\kaZXxKb.exe
  C:\Windows\System32\kaZXxKb.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System32\MGOLFEc.exe
  C:\Windows\System32\MGOLFEc.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System32\lWyftWe.exe
  C:\Windows\System32\lWyftWe.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System32\ebprYZZ.exe
  C:\Windows\System32\ebprYZZ.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System32\UcxdCfP.exe
  C:\Windows\System32\UcxdCfP.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System32\MfiuJnz.exe
  C:\Windows\System32\MfiuJnz.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System32\iTliZgZ.exe
  C:\Windows\System32\iTliZgZ.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System32\RHuyspg.exe
  C:\Windows\System32\RHuyspg.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System32\NQZIymw.exe
  C:\Windows\System32\NQZIymw.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System32\FCYpjup.exe
  C:\Windows\System32\FCYpjup.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System32\GsdaRcv.exe
  C:\Windows\System32\GsdaRcv.exe
  2⤵
  PID:4468
- C:\Windows\System32\ZjLLknS.exe
  C:\Windows\System32\ZjLLknS.exe
  2⤵
  PID:4652
- C:\Windows\System32\GBpgPOp.exe
  C:\Windows\System32\GBpgPOp.exe
  2⤵
  PID:3844
- C:\Windows\System32\ZnkUmLY.exe
  C:\Windows\System32\ZnkUmLY.exe
  2⤵
  PID:4180
- C:\Windows\System32\FgsdToz.exe
  C:\Windows\System32\FgsdToz.exe
  2⤵
  PID:4744
- C:\Windows\System32\lYBVCFp.exe
  C:\Windows\System32\lYBVCFp.exe
  2⤵
  PID:3220
- C:\Windows\System32\FCNyZfr.exe
  C:\Windows\System32\FCNyZfr.exe
  2⤵
  PID:5148
- C:\Windows\System32\nhUQmca.exe
  C:\Windows\System32\nhUQmca.exe
  2⤵
  PID:5172
- C:\Windows\System32\ZDBsEge.exe
  C:\Windows\System32\ZDBsEge.exe
  2⤵
  PID:5200
- C:\Windows\System32\HWRDYeg.exe
  C:\Windows\System32\HWRDYeg.exe
  2⤵
  PID:5228
- C:\Windows\System32\akGSeTq.exe
  C:\Windows\System32\akGSeTq.exe
  2⤵
  PID:5256
- C:\Windows\System32\eifEBEp.exe
  C:\Windows\System32\eifEBEp.exe
  2⤵
  PID:5284
- C:\Windows\System32\IcOjCqb.exe
  C:\Windows\System32\IcOjCqb.exe
  2⤵
  PID:5316
- C:\Windows\System32\VlXanbS.exe
  C:\Windows\System32\VlXanbS.exe
  2⤵
  PID:5340
- C:\Windows\System32\LgzkFpw.exe
  C:\Windows\System32\LgzkFpw.exe
  2⤵
  PID:5368
- C:\Windows\System32\gdIkQYm.exe
  C:\Windows\System32\gdIkQYm.exe
  2⤵
  PID:5396
- C:\Windows\System32\myNczFj.exe
  C:\Windows\System32\myNczFj.exe
  2⤵
  PID:5424
- C:\Windows\System32\NIUkboW.exe
  C:\Windows\System32\NIUkboW.exe
  2⤵
  PID:5452
- C:\Windows\System32\jBJPIrb.exe
  C:\Windows\System32\jBJPIrb.exe
  2⤵
  PID:5480
- C:\Windows\System32\MmXCENV.exe
  C:\Windows\System32\MmXCENV.exe
  2⤵
  PID:5508
- C:\Windows\System32\wKxWLnA.exe
  C:\Windows\System32\wKxWLnA.exe
  2⤵
  PID:5532
- C:\Windows\System32\DCXkmNw.exe
  C:\Windows\System32\DCXkmNw.exe
  2⤵
  PID:5564
- C:\Windows\System32\NXmbhhG.exe
  C:\Windows\System32\NXmbhhG.exe
  2⤵
  PID:5592
- C:\Windows\System32\YeXLEth.exe
  C:\Windows\System32\YeXLEth.exe
  2⤵
  PID:5620
- C:\Windows\System32\OcVchRj.exe
  C:\Windows\System32\OcVchRj.exe
  2⤵
  PID:5648
- C:\Windows\System32\SnoLMLk.exe
  C:\Windows\System32\SnoLMLk.exe
  2⤵
  PID:5676
- C:\Windows\System32\vmqHhqC.exe
  C:\Windows\System32\vmqHhqC.exe
  2⤵
  PID:5704
- C:\Windows\System32\uoKlRrD.exe
  C:\Windows\System32\uoKlRrD.exe
  2⤵
  PID:5732
- C:\Windows\System32\BawcVOf.exe
  C:\Windows\System32\BawcVOf.exe
  2⤵
  PID:5760
- C:\Windows\System32\lXmYVuk.exe
  C:\Windows\System32\lXmYVuk.exe
  2⤵
  PID:5788
- C:\Windows\System32\AVdqLPC.exe
  C:\Windows\System32\AVdqLPC.exe
  2⤵
  PID:5816
- C:\Windows\System32\jrDWMMP.exe
  C:\Windows\System32\jrDWMMP.exe
  2⤵
  PID:5840
- C:\Windows\System32\fwErTvY.exe
  C:\Windows\System32\fwErTvY.exe
  2⤵
  PID:5872
- C:\Windows\System32\wfGnolz.exe
  C:\Windows\System32\wfGnolz.exe
  2⤵
  PID:5900
- C:\Windows\System32\dmxLaKx.exe
  C:\Windows\System32\dmxLaKx.exe
  2⤵
  PID:5932
- C:\Windows\System32\TgrUsaW.exe
  C:\Windows\System32\TgrUsaW.exe
  2⤵
  PID:5952
- C:\Windows\System32\XHTmXIy.exe
  C:\Windows\System32\XHTmXIy.exe
  2⤵
  PID:5984
- C:\Windows\System32\xkueaBe.exe
  C:\Windows\System32\xkueaBe.exe
  2⤵
  PID:6016
- C:\Windows\System32\PisNtWF.exe
  C:\Windows\System32\PisNtWF.exe
  2⤵
  PID:6040
- C:\Windows\System32\rOmmrOx.exe
  C:\Windows\System32\rOmmrOx.exe
  2⤵
  PID:6072
- C:\Windows\System32\CAbgyfW.exe
  C:\Windows\System32\CAbgyfW.exe
  2⤵
  PID:6096
- C:\Windows\System32\JzgYRJS.exe
  C:\Windows\System32\JzgYRJS.exe
  2⤵
  PID:6124
- C:\Windows\System32\KwQoUqg.exe
  C:\Windows\System32\KwQoUqg.exe
  2⤵
  PID:1632
- C:\Windows\System32\eXIkVmT.exe
  C:\Windows\System32\eXIkVmT.exe
  2⤵
  PID:2172
- C:\Windows\System32\hOsxCcw.exe
  C:\Windows\System32\hOsxCcw.exe
  2⤵
  PID:3168
- C:\Windows\System32\faUpQPn.exe
  C:\Windows\System32\faUpQPn.exe
  2⤵
  PID:3940
- C:\Windows\System32\XzLQmKD.exe
  C:\Windows\System32\XzLQmKD.exe
  2⤵
  PID:5072
- C:\Windows\System32\IGOfmGe.exe
  C:\Windows\System32\IGOfmGe.exe
  2⤵
  PID:5156
- C:\Windows\System32\snbHUqT.exe
  C:\Windows\System32\snbHUqT.exe
  2⤵
  PID:5208
- C:\Windows\System32\ngDYlHz.exe
  C:\Windows\System32\ngDYlHz.exe
  2⤵
  PID:5300
- C:\Windows\System32\ZCaBJXI.exe
  C:\Windows\System32\ZCaBJXI.exe
  2⤵
  PID:5360
- C:\Windows\System32\jCuaTHg.exe
  C:\Windows\System32\jCuaTHg.exe
  2⤵
  PID:5404
- C:\Windows\System32\PDFrvqA.exe
  C:\Windows\System32\PDFrvqA.exe
  2⤵
  PID:5500
- C:\Windows\System32\UInvRIk.exe
  C:\Windows\System32\UInvRIk.exe
  2⤵
  PID:1616
- C:\Windows\System32\eFYBKnW.exe
  C:\Windows\System32\eFYBKnW.exe
  2⤵
  PID:5584
- C:\Windows\System32\XNUCPms.exe
  C:\Windows\System32\XNUCPms.exe
  2⤵
  PID:5636
- C:\Windows\System32\NuuFbZb.exe
  C:\Windows\System32\NuuFbZb.exe
  2⤵
  PID:5684
- C:\Windows\System32\ktrYoJz.exe
  C:\Windows\System32\ktrYoJz.exe
  2⤵
  PID:5776
- C:\Windows\System32\vDdtFkA.exe
  C:\Windows\System32\vDdtFkA.exe
  2⤵
  PID:5836
- C:\Windows\System32\HenRQWR.exe
  C:\Windows\System32\HenRQWR.exe
  2⤵
  PID:5880
- C:\Windows\System32\ESOLuYT.exe
  C:\Windows\System32\ESOLuYT.exe
  2⤵
  PID:3012
- C:\Windows\System32\yiBtwNv.exe
  C:\Windows\System32\yiBtwNv.exe
  2⤵
  PID:6000
- C:\Windows\System32\lKtwrPN.exe
  C:\Windows\System32\lKtwrPN.exe
  2⤵
  PID:6060
- C:\Windows\System32\OiSRAxB.exe
  C:\Windows\System32\OiSRAxB.exe
  2⤵
  PID:6104
- C:\Windows\System32\bUyZNkh.exe
  C:\Windows\System32\bUyZNkh.exe
  2⤵
  PID:4356
- C:\Windows\System32\JWuxkxx.exe
  C:\Windows\System32\JWuxkxx.exe
  2⤵
  PID:2284
- C:\Windows\System32\iSBqIvy.exe
  C:\Windows\System32\iSBqIvy.exe
  2⤵
  PID:4576
- C:\Windows\System32\rCNSmDt.exe
  C:\Windows\System32\rCNSmDt.exe
  2⤵
  PID:5248
- C:\Windows\System32\YYQFDnY.exe
  C:\Windows\System32\YYQFDnY.exe
  2⤵
  PID:5468
- C:\Windows\System32\UIyMRjL.exe
  C:\Windows\System32\UIyMRjL.exe
  2⤵
  PID:3980
- C:\Windows\System32\ydvkCSS.exe
  C:\Windows\System32\ydvkCSS.exe
  2⤵
  PID:5540
- C:\Windows\System32\ZDuZOmu.exe
  C:\Windows\System32\ZDuZOmu.exe
  2⤵
  PID:5972
- C:\Windows\System32\oSJedKT.exe
  C:\Windows\System32\oSJedKT.exe
  2⤵
  PID:5992
- C:\Windows\System32\oHAGvvL.exe
  C:\Windows\System32\oHAGvvL.exe
  2⤵
  PID:6068
- C:\Windows\System32\QKSIIJZ.exe
  C:\Windows\System32\QKSIIJZ.exe
  2⤵
  PID:4920
- C:\Windows\System32\vkwcvaz.exe
  C:\Windows\System32\vkwcvaz.exe
  2⤵
  PID:1840
- C:\Windows\System32\wxKiuqV.exe
  C:\Windows\System32\wxKiuqV.exe
  2⤵
  PID:3904
- C:\Windows\System32\RtpOqPK.exe
  C:\Windows\System32\RtpOqPK.exe
  2⤵
  PID:1480
- C:\Windows\System32\AFmCIMw.exe
  C:\Windows\System32\AFmCIMw.exe
  2⤵
  PID:1944
- C:\Windows\System32\HBBVwSR.exe
  C:\Windows\System32\HBBVwSR.exe
  2⤵
  PID:872
- C:\Windows\System32\uaKBbki.exe
  C:\Windows\System32\uaKBbki.exe
  2⤵
  PID:2352
- C:\Windows\System32\GbRpgAb.exe
  C:\Windows\System32\GbRpgAb.exe
  2⤵
  PID:4848
- C:\Windows\System32\VQcncPg.exe
  C:\Windows\System32\VQcncPg.exe
  2⤵
  PID:736
- C:\Windows\System32\TEebaeR.exe
  C:\Windows\System32\TEebaeR.exe
  2⤵
  PID:5724
- C:\Windows\System32\OlaAzLO.exe
  C:\Windows\System32\OlaAzLO.exe
  2⤵
  PID:3216
- C:\Windows\System32\ljMgdzn.exe
  C:\Windows\System32\ljMgdzn.exe
  2⤵
  PID:5920
- C:\Windows\System32\aTGMzNA.exe
  C:\Windows\System32\aTGMzNA.exe
  2⤵
  PID:1392
- C:\Windows\System32\uHGpFNz.exe
  C:\Windows\System32\uHGpFNz.exe
  2⤵
  PID:6088
- C:\Windows\System32\NuqQLjf.exe
  C:\Windows\System32\NuqQLjf.exe
  2⤵
  PID:2448
- C:\Windows\System32\EohLePa.exe
  C:\Windows\System32\EohLePa.exe
  2⤵
  PID:3356
- C:\Windows\System32\fMpXNwk.exe
  C:\Windows\System32\fMpXNwk.exe
  2⤵
  PID:4408
- C:\Windows\System32\sBNrkdU.exe
  C:\Windows\System32\sBNrkdU.exe
  2⤵
  PID:4916
- C:\Windows\System32\tWCjdRK.exe
  C:\Windows\System32\tWCjdRK.exe
  2⤵
  PID:1484
- C:\Windows\System32\RIqKtSy.exe
  C:\Windows\System32\RIqKtSy.exe
  2⤵
  PID:5768
- C:\Windows\System32\BTtOrGg.exe
  C:\Windows\System32\BTtOrGg.exe
  2⤵
  PID:5136
- C:\Windows\System32\IiFSvTu.exe
  C:\Windows\System32\IiFSvTu.exe
  2⤵
  PID:2576
- C:\Windows\System32\hHkfOUq.exe
  C:\Windows\System32\hHkfOUq.exe
  2⤵
  PID:2720
- C:\Windows\System32\SEiSwZA.exe
  C:\Windows\System32\SEiSwZA.exe
  2⤵
  PID:3228
- C:\Windows\System32\vEpLyUU.exe
  C:\Windows\System32\vEpLyUU.exe
  2⤵
  PID:6160
- C:\Windows\System32\ZvLjyPc.exe
  C:\Windows\System32\ZvLjyPc.exe
  2⤵
  PID:6184
- C:\Windows\System32\GTyxJnH.exe
  C:\Windows\System32\GTyxJnH.exe
  2⤵
  PID:6228
- C:\Windows\System32\ZkqRkdo.exe
  C:\Windows\System32\ZkqRkdo.exe
  2⤵
  PID:6280
- C:\Windows\System32\jHwCZFT.exe
  C:\Windows\System32\jHwCZFT.exe
  2⤵
  PID:6304
- C:\Windows\System32\DUApDWG.exe
  C:\Windows\System32\DUApDWG.exe
  2⤵
  PID:6336
- C:\Windows\System32\xCIdUwm.exe
  C:\Windows\System32\xCIdUwm.exe
  2⤵
  PID:6364
- C:\Windows\System32\qXSLCuB.exe
  C:\Windows\System32\qXSLCuB.exe
  2⤵
  PID:6384
- C:\Windows\System32\QlwLTVy.exe
  C:\Windows\System32\QlwLTVy.exe
  2⤵
  PID:6400
- C:\Windows\System32\TgHTYvr.exe
  C:\Windows\System32\TgHTYvr.exe
  2⤵
  PID:6420
- C:\Windows\System32\nDFiBqr.exe
  C:\Windows\System32\nDFiBqr.exe
  2⤵
  PID:6472
- C:\Windows\System32\nwsTDJq.exe
  C:\Windows\System32\nwsTDJq.exe
  2⤵
  PID:6492
- C:\Windows\System32\GkTTTPA.exe
  C:\Windows\System32\GkTTTPA.exe
  2⤵
  PID:6520
- C:\Windows\System32\qJNvWZR.exe
  C:\Windows\System32\qJNvWZR.exe
  2⤵
  PID:6536
- C:\Windows\System32\NLENDbr.exe
  C:\Windows\System32\NLENDbr.exe
  2⤵
  PID:6556
- C:\Windows\System32\FMRnhlb.exe
  C:\Windows\System32\FMRnhlb.exe
  2⤵
  PID:6580
- C:\Windows\System32\WahGlOz.exe
  C:\Windows\System32\WahGlOz.exe
  2⤵
  PID:6640
- C:\Windows\System32\zcpjrix.exe
  C:\Windows\System32\zcpjrix.exe
  2⤵
  PID:6672
- C:\Windows\System32\xKoRJaS.exe
  C:\Windows\System32\xKoRJaS.exe
  2⤵
  PID:6692
- C:\Windows\System32\vRALevY.exe
  C:\Windows\System32\vRALevY.exe
  2⤵
  PID:6712
- C:\Windows\System32\aDNocmG.exe
  C:\Windows\System32\aDNocmG.exe
  2⤵
  PID:6736
- C:\Windows\System32\ofghjkf.exe
  C:\Windows\System32\ofghjkf.exe
  2⤵
  PID:6756
- C:\Windows\System32\whRzlOS.exe
  C:\Windows\System32\whRzlOS.exe
  2⤵
  PID:6788
- C:\Windows\System32\eKncqpB.exe
  C:\Windows\System32\eKncqpB.exe
  2⤵
  PID:6808
- C:\Windows\System32\LZnoKKO.exe
  C:\Windows\System32\LZnoKKO.exe
  2⤵
  PID:6828
- C:\Windows\System32\NZESkLM.exe
  C:\Windows\System32\NZESkLM.exe
  2⤵
  PID:6852
- C:\Windows\System32\TLgwCBQ.exe
  C:\Windows\System32\TLgwCBQ.exe
  2⤵
  PID:6872
- C:\Windows\System32\uaHdIwt.exe
  C:\Windows\System32\uaHdIwt.exe
  2⤵
  PID:6896
- C:\Windows\System32\DUxAJzM.exe
  C:\Windows\System32\DUxAJzM.exe
  2⤵
  PID:6912
- C:\Windows\System32\YUfAQdM.exe
  C:\Windows\System32\YUfAQdM.exe
  2⤵
  PID:6992
- C:\Windows\System32\ejiKNGM.exe
  C:\Windows\System32\ejiKNGM.exe
  2⤵
  PID:7020
- C:\Windows\System32\egrSXHc.exe
  C:\Windows\System32\egrSXHc.exe
  2⤵
  PID:7048
- C:\Windows\System32\zdWfAbH.exe
  C:\Windows\System32\zdWfAbH.exe
  2⤵
  PID:7068
- C:\Windows\System32\bdtBiCz.exe
  C:\Windows\System32\bdtBiCz.exe
  2⤵
  PID:7084
- C:\Windows\System32\jfqvGzN.exe
  C:\Windows\System32\jfqvGzN.exe
  2⤵
  PID:7108
- C:\Windows\System32\RFeHJIe.exe
  C:\Windows\System32\RFeHJIe.exe
  2⤵
  PID:7136
- C:\Windows\System32\BQtbbYv.exe
  C:\Windows\System32\BQtbbYv.exe
  2⤵
  PID:1456
- C:\Windows\System32\zexWBpV.exe
  C:\Windows\System32\zexWBpV.exe
  2⤵
  PID:6256
- C:\Windows\System32\BuwBqmi.exe
  C:\Windows\System32\BuwBqmi.exe
  2⤵
  PID:6288
- C:\Windows\System32\ZeEsRIl.exe
  C:\Windows\System32\ZeEsRIl.exe
  2⤵
  PID:6360
- C:\Windows\System32\PacOFUf.exe
  C:\Windows\System32\PacOFUf.exe
  2⤵
  PID:6416
- C:\Windows\System32\fLZxGVv.exe
  C:\Windows\System32\fLZxGVv.exe
  2⤵
  PID:6508
- C:\Windows\System32\hAgFMDZ.exe
  C:\Windows\System32\hAgFMDZ.exe
  2⤵
  PID:6552
- C:\Windows\System32\swwmpEs.exe
  C:\Windows\System32\swwmpEs.exe
  2⤵
  PID:6600
- C:\Windows\System32\AyRSbmX.exe
  C:\Windows\System32\AyRSbmX.exe
  2⤵
  PID:6664
- C:\Windows\System32\yQTNNNz.exe
  C:\Windows\System32\yQTNNNz.exe
  2⤵
  PID:6720
- C:\Windows\System32\dTbzgyf.exe
  C:\Windows\System32\dTbzgyf.exe
  2⤵
  PID:6804
- C:\Windows\System32\WEnWgoU.exe
  C:\Windows\System32\WEnWgoU.exe
  2⤵
  PID:6824
- C:\Windows\System32\oUdRvMx.exe
  C:\Windows\System32\oUdRvMx.exe
  2⤵
  PID:6968
- C:\Windows\System32\FONSJWv.exe
  C:\Windows\System32\FONSJWv.exe
  2⤵
  PID:7004
- C:\Windows\System32\gSwSWLg.exe
  C:\Windows\System32\gSwSWLg.exe
  2⤵
  PID:7076
- C:\Windows\System32\aRdEBzf.exe
  C:\Windows\System32\aRdEBzf.exe
  2⤵
  PID:6156
- C:\Windows\System32\qgitNXX.exe
  C:\Windows\System32\qgitNXX.exe
  2⤵
  PID:6212
- C:\Windows\System32\dKThBJs.exe
  C:\Windows\System32\dKThBJs.exe
  2⤵
  PID:6324
- C:\Windows\System32\gYLeSPA.exe
  C:\Windows\System32\gYLeSPA.exe
  2⤵
  PID:6532
- C:\Windows\System32\XIYamHM.exe
  C:\Windows\System32\XIYamHM.exe
  2⤵
  PID:6604
- C:\Windows\System32\fVaNreB.exe
  C:\Windows\System32\fVaNreB.exe
  2⤵
  PID:6732
- C:\Windows\System32\FmAigwW.exe
  C:\Windows\System32\FmAigwW.exe
  2⤵
  PID:6980
- C:\Windows\System32\mtZmxDR.exe
  C:\Windows\System32\mtZmxDR.exe
  2⤵
  PID:7152
- C:\Windows\System32\cCqdKoz.exe
  C:\Windows\System32\cCqdKoz.exe
  2⤵
  PID:6456
- C:\Windows\System32\UutmmDw.exe
  C:\Windows\System32\UutmmDw.exe
  2⤵
  PID:6688
- C:\Windows\System32\rfEQUmq.exe
  C:\Windows\System32\rfEQUmq.exe
  2⤵
  PID:6948
- C:\Windows\System32\Vrwldjf.exe
  C:\Windows\System32\Vrwldjf.exe
  2⤵
  PID:7104
- C:\Windows\System32\luQAeml.exe
  C:\Windows\System32\luQAeml.exe
  2⤵
  PID:7176
- C:\Windows\System32\SsbFuXL.exe
  C:\Windows\System32\SsbFuXL.exe
  2⤵
  PID:7200
- C:\Windows\System32\fnrfRvD.exe
  C:\Windows\System32\fnrfRvD.exe
  2⤵
  PID:7216
- C:\Windows\System32\eRjruSj.exe
  C:\Windows\System32\eRjruSj.exe
  2⤵
  PID:7252
- C:\Windows\System32\rteVdaE.exe
  C:\Windows\System32\rteVdaE.exe
  2⤵
  PID:7268
- C:\Windows\System32\RsgcWmC.exe
  C:\Windows\System32\RsgcWmC.exe
  2⤵
  PID:7292
- C:\Windows\System32\RUZYdmz.exe
  C:\Windows\System32\RUZYdmz.exe
  2⤵
  PID:7308
- C:\Windows\System32\JzxOFXY.exe
  C:\Windows\System32\JzxOFXY.exe
  2⤵
  PID:7332
- C:\Windows\System32\YNRJhHA.exe
  C:\Windows\System32\YNRJhHA.exe
  2⤵
  PID:7360
- C:\Windows\System32\kURIVTU.exe
  C:\Windows\System32\kURIVTU.exe
  2⤵
  PID:7424
- C:\Windows\System32\yxKCLBu.exe
  C:\Windows\System32\yxKCLBu.exe
  2⤵
  PID:7444
- C:\Windows\System32\GTwGbph.exe
  C:\Windows\System32\GTwGbph.exe
  2⤵
  PID:7472
- C:\Windows\System32\oOMPvOX.exe
  C:\Windows\System32\oOMPvOX.exe
  2⤵
  PID:7488
- C:\Windows\System32\jFtHtpr.exe
  C:\Windows\System32\jFtHtpr.exe
  2⤵
  PID:7508
- C:\Windows\System32\imzzhjn.exe
  C:\Windows\System32\imzzhjn.exe
  2⤵
  PID:7528
- C:\Windows\System32\dUZjeKF.exe
  C:\Windows\System32\dUZjeKF.exe
  2⤵
  PID:7544
- C:\Windows\System32\VGImEXp.exe
  C:\Windows\System32\VGImEXp.exe
  2⤵
  PID:7616
- C:\Windows\System32\zcjmPQO.exe
  C:\Windows\System32\zcjmPQO.exe
  2⤵
  PID:7652
- C:\Windows\System32\DWUWUTY.exe
  C:\Windows\System32\DWUWUTY.exe
  2⤵
  PID:7692
- C:\Windows\System32\EKiqtew.exe
  C:\Windows\System32\EKiqtew.exe
  2⤵
  PID:7712
- C:\Windows\System32\FTkIMMd.exe
  C:\Windows\System32\FTkIMMd.exe
  2⤵
  PID:7768
- C:\Windows\System32\CCnIegM.exe
  C:\Windows\System32\CCnIegM.exe
  2⤵
  PID:7796
- C:\Windows\System32\FHeQGKa.exe
  C:\Windows\System32\FHeQGKa.exe
  2⤵
  PID:7816
- C:\Windows\System32\pxgHIOW.exe
  C:\Windows\System32\pxgHIOW.exe
  2⤵
  PID:7856
- C:\Windows\System32\VABOvJT.exe
  C:\Windows\System32\VABOvJT.exe
  2⤵
  PID:7876
- C:\Windows\System32\nAKONoH.exe
  C:\Windows\System32\nAKONoH.exe
  2⤵
  PID:7904
- C:\Windows\System32\pAVkkaF.exe
  C:\Windows\System32\pAVkkaF.exe
  2⤵
  PID:7920
- C:\Windows\System32\abRwpVw.exe
  C:\Windows\System32\abRwpVw.exe
  2⤵
  PID:7948
- C:\Windows\System32\QSlDxVo.exe
  C:\Windows\System32\QSlDxVo.exe
  2⤵
  PID:7972
- C:\Windows\System32\YjhlHpI.exe
  C:\Windows\System32\YjhlHpI.exe
  2⤵
  PID:7992
- C:\Windows\System32\jbUSLIX.exe
  C:\Windows\System32\jbUSLIX.exe
  2⤵
  PID:8016
- C:\Windows\System32\HLNUDzh.exe
  C:\Windows\System32\HLNUDzh.exe
  2⤵
  PID:8036
- C:\Windows\System32\vHRKFtr.exe
  C:\Windows\System32\vHRKFtr.exe
  2⤵
  PID:8100
- C:\Windows\System32\oyBPLgE.exe
  C:\Windows\System32\oyBPLgE.exe
  2⤵
  PID:8116
- C:\Windows\System32\lAtJTWE.exe
  C:\Windows\System32\lAtJTWE.exe
  2⤵
  PID:8140
- C:\Windows\System32\zwqZAat.exe
  C:\Windows\System32\zwqZAat.exe
  2⤵
  PID:8164
- C:\Windows\System32\kdiTJXj.exe
  C:\Windows\System32\kdiTJXj.exe
  2⤵
  PID:8184
- C:\Windows\System32\LjuHIcd.exe
  C:\Windows\System32\LjuHIcd.exe
  2⤵
  PID:6328
- C:\Windows\System32\DvnOLXI.exe
  C:\Windows\System32\DvnOLXI.exe
  2⤵
  PID:7208
- C:\Windows\System32\NGvptsb.exe
  C:\Windows\System32\NGvptsb.exe
  2⤵
  PID:7320
- C:\Windows\System32\LLaqapM.exe
  C:\Windows\System32\LLaqapM.exe
  2⤵
  PID:7260
- C:\Windows\System32\aMcMoHd.exe
  C:\Windows\System32\aMcMoHd.exe
  2⤵
  PID:7344
- C:\Windows\System32\mOCjFGE.exe
  C:\Windows\System32\mOCjFGE.exe
  2⤵
  PID:7452
- C:\Windows\System32\iFMqeUO.exe
  C:\Windows\System32\iFMqeUO.exe
  2⤵
  PID:7540
- C:\Windows\System32\FURIVTv.exe
  C:\Windows\System32\FURIVTv.exe
  2⤵
  PID:7592
- C:\Windows\System32\ebkzkhe.exe
  C:\Windows\System32\ebkzkhe.exe
  2⤵
  PID:7808
- C:\Windows\System32\GcEEKfB.exe
  C:\Windows\System32\GcEEKfB.exe
  2⤵
  PID:7848
- C:\Windows\System32\qfMqBKy.exe
  C:\Windows\System32\qfMqBKy.exe
  2⤵
  PID:7864
- C:\Windows\System32\QYTaWdp.exe
  C:\Windows\System32\QYTaWdp.exe
  2⤵
  PID:7960
- C:\Windows\System32\nzLfYUS.exe
  C:\Windows\System32\nzLfYUS.exe
  2⤵
  PID:7988
- C:\Windows\System32\tkspoAz.exe
  C:\Windows\System32\tkspoAz.exe
  2⤵
  PID:7984
- C:\Windows\System32\beMGYoh.exe
  C:\Windows\System32\beMGYoh.exe
  2⤵
  PID:8072
- C:\Windows\System32\xveeRii.exe
  C:\Windows\System32\xveeRii.exe
  2⤵
  PID:8088
- C:\Windows\System32\NppkEAL.exe
  C:\Windows\System32\NppkEAL.exe
  2⤵
  PID:8152
- C:\Windows\System32\NTCtnBN.exe
  C:\Windows\System32\NTCtnBN.exe
  2⤵
  PID:7224
- C:\Windows\System32\luwEZyn.exe
  C:\Windows\System32\luwEZyn.exe
  2⤵
  PID:7480
- C:\Windows\System32\aaIMAfR.exe
  C:\Windows\System32\aaIMAfR.exe
  2⤵
  PID:7560
- C:\Windows\System32\zIEDYoq.exe
  C:\Windows\System32\zIEDYoq.exe
  2⤵
  PID:7968
- C:\Windows\System32\IHWvAGZ.exe
  C:\Windows\System32\IHWvAGZ.exe
  2⤵
  PID:8064
- C:\Windows\System32\PNefryf.exe
  C:\Windows\System32\PNefryf.exe
  2⤵
  PID:8176
- C:\Windows\System32\GoOpnLk.exe
  C:\Windows\System32\GoOpnLk.exe
  2⤵
  PID:7812
- C:\Windows\System32\CIBsLqt.exe
  C:\Windows\System32\CIBsLqt.exe
  2⤵
  PID:7536
- C:\Windows\System32\VyUmseN.exe
  C:\Windows\System32\VyUmseN.exe
  2⤵
  PID:7192
- C:\Windows\System32\AnjLMZl.exe
  C:\Windows\System32\AnjLMZl.exe
  2⤵
  PID:8024
- C:\Windows\System32\VXvCHCO.exe
  C:\Windows\System32\VXvCHCO.exe
  2⤵
  PID:8224
- C:\Windows\System32\lybnUCR.exe
  C:\Windows\System32\lybnUCR.exe
  2⤵
  PID:8240
- C:\Windows\System32\XGnnMAM.exe
  C:\Windows\System32\XGnnMAM.exe
  2⤵
  PID:8264
- C:\Windows\System32\aFdMBaT.exe
  C:\Windows\System32\aFdMBaT.exe
  2⤵
  PID:8288
- C:\Windows\System32\IVhCkSi.exe
  C:\Windows\System32\IVhCkSi.exe
  2⤵
  PID:8328
- C:\Windows\System32\mFfbUFj.exe
  C:\Windows\System32\mFfbUFj.exe
  2⤵
  PID:8348
- C:\Windows\System32\SvHhmWg.exe
  C:\Windows\System32\SvHhmWg.exe
  2⤵
  PID:8372
- C:\Windows\System32\dtmRAcX.exe
  C:\Windows\System32\dtmRAcX.exe
  2⤵
  PID:8404
- C:\Windows\System32\zpxSgUW.exe
  C:\Windows\System32\zpxSgUW.exe
  2⤵
  PID:8428
- C:\Windows\System32\nqzhmKO.exe
  C:\Windows\System32\nqzhmKO.exe
  2⤵
  PID:8448
- C:\Windows\System32\gCwDalS.exe
  C:\Windows\System32\gCwDalS.exe
  2⤵
  PID:8464
- C:\Windows\System32\hpwZwQs.exe
  C:\Windows\System32\hpwZwQs.exe
  2⤵
  PID:8484
- C:\Windows\System32\lEsXPgN.exe
  C:\Windows\System32\lEsXPgN.exe
  2⤵
  PID:8520
- C:\Windows\System32\Tfcsoag.exe
  C:\Windows\System32\Tfcsoag.exe
  2⤵
  PID:8540
- C:\Windows\System32\yOuJDed.exe
  C:\Windows\System32\yOuJDed.exe
  2⤵
  PID:8560
- C:\Windows\System32\oxZbejZ.exe
  C:\Windows\System32\oxZbejZ.exe
  2⤵
  PID:8596
- C:\Windows\System32\kSQrSlY.exe
  C:\Windows\System32\kSQrSlY.exe
  2⤵
  PID:8688
- C:\Windows\System32\IjyNvzw.exe
  C:\Windows\System32\IjyNvzw.exe
  2⤵
  PID:8712
- C:\Windows\System32\wkimlCl.exe
  C:\Windows\System32\wkimlCl.exe
  2⤵
  PID:8740
- C:\Windows\System32\XdRaHbd.exe
  C:\Windows\System32\XdRaHbd.exe
  2⤵
  PID:8760
- C:\Windows\System32\GwRqDEF.exe
  C:\Windows\System32\GwRqDEF.exe
  2⤵
  PID:8776
- C:\Windows\System32\DSoFdwk.exe
  C:\Windows\System32\DSoFdwk.exe
  2⤵
  PID:8800
- C:\Windows\System32\jlKlYpE.exe
  C:\Windows\System32\jlKlYpE.exe
  2⤵
  PID:8848
- C:\Windows\System32\pFHoETU.exe
  C:\Windows\System32\pFHoETU.exe
  2⤵
  PID:8864
- C:\Windows\System32\RtkYvJk.exe
  C:\Windows\System32\RtkYvJk.exe
  2⤵
  PID:8884
- C:\Windows\System32\ciLYDOv.exe
  C:\Windows\System32\ciLYDOv.exe
  2⤵
  PID:8912
- C:\Windows\System32\gLNzRnX.exe
  C:\Windows\System32\gLNzRnX.exe
  2⤵
  PID:8932
- C:\Windows\System32\JwmzSyY.exe
  C:\Windows\System32\JwmzSyY.exe
  2⤵
  PID:8992
- C:\Windows\System32\eOCOHAI.exe
  C:\Windows\System32\eOCOHAI.exe
  2⤵
  PID:9020
- C:\Windows\System32\XtwQixK.exe
  C:\Windows\System32\XtwQixK.exe
  2⤵
  PID:9036
- C:\Windows\System32\yyYYUUW.exe
  C:\Windows\System32\yyYYUUW.exe
  2⤵
  PID:9052
- C:\Windows\System32\MKYSxRo.exe
  C:\Windows\System32\MKYSxRo.exe
  2⤵
  PID:9068
- C:\Windows\System32\BlxJpsV.exe
  C:\Windows\System32\BlxJpsV.exe
  2⤵
  PID:9088
- C:\Windows\System32\lxeWkEA.exe
  C:\Windows\System32\lxeWkEA.exe
  2⤵
  PID:9108
- C:\Windows\System32\DAUGRRJ.exe
  C:\Windows\System32\DAUGRRJ.exe
  2⤵
  PID:9152
- C:\Windows\System32\bbTRUih.exe
  C:\Windows\System32\bbTRUih.exe
  2⤵
  PID:9172
- C:\Windows\System32\HWNhOsu.exe
  C:\Windows\System32\HWNhOsu.exe
  2⤵
  PID:9204
- C:\Windows\System32\TqvVyql.exe
  C:\Windows\System32\TqvVyql.exe
  2⤵
  PID:6868
- C:\Windows\System32\jvZVHxa.exe
  C:\Windows\System32\jvZVHxa.exe
  2⤵
  PID:8320
- C:\Windows\System32\sOpCnkV.exe
  C:\Windows\System32\sOpCnkV.exe
  2⤵
  PID:8412
- C:\Windows\System32\KqGHeOm.exe
  C:\Windows\System32\KqGHeOm.exe
  2⤵
  PID:8368
- C:\Windows\System32\ChewWuz.exe
  C:\Windows\System32\ChewWuz.exe
  2⤵
  PID:8492
- C:\Windows\System32\cteexen.exe
  C:\Windows\System32\cteexen.exe
  2⤵
  PID:8624
- C:\Windows\System32\ogVXCga.exe
  C:\Windows\System32\ogVXCga.exe
  2⤵
  PID:8708
- C:\Windows\System32\FoXTeJk.exe
  C:\Windows\System32\FoXTeJk.exe
  2⤵
  PID:8720
- C:\Windows\System32\fgeglfU.exe
  C:\Windows\System32\fgeglfU.exe
  2⤵
  PID:8784
- C:\Windows\System32\ajVqhuv.exe
  C:\Windows\System32\ajVqhuv.exe
  2⤵
  PID:8828
- C:\Windows\System32\uMQeMwC.exe
  C:\Windows\System32\uMQeMwC.exe
  2⤵
  PID:8956
- C:\Windows\System32\ilgZPNF.exe
  C:\Windows\System32\ilgZPNF.exe
  2⤵
  PID:8984
- C:\Windows\System32\bgfgQdS.exe
  C:\Windows\System32\bgfgQdS.exe
  2⤵
  PID:9048
- C:\Windows\System32\ArOmIYw.exe
  C:\Windows\System32\ArOmIYw.exe
  2⤵
  PID:9116
- C:\Windows\System32\TzCqMEe.exe
  C:\Windows\System32\TzCqMEe.exe
  2⤵
  PID:8516
- C:\Windows\System32\bAmZyWm.exe
  C:\Windows\System32\bAmZyWm.exe
  2⤵
  PID:8700
- C:\Windows\System32\qPYsfjO.exe
  C:\Windows\System32\qPYsfjO.exe
  2⤵
  PID:8732
- C:\Windows\System32\lmyQYBJ.exe
  C:\Windows\System32\lmyQYBJ.exe
  2⤵
  PID:8876
- C:\Windows\System32\wskrdKE.exe
  C:\Windows\System32\wskrdKE.exe
  2⤵
  PID:9008
- C:\Windows\System32\SWHixHu.exe
  C:\Windows\System32\SWHixHu.exe
  2⤵
  PID:9032
- C:\Windows\System32\lMAcXSm.exe
  C:\Windows\System32\lMAcXSm.exe
  2⤵
  PID:9224
- C:\Windows\System32\ukEUpXX.exe
  C:\Windows\System32\ukEUpXX.exe
  2⤵
  PID:9240
- C:\Windows\System32\xENUDJd.exe
  C:\Windows\System32\xENUDJd.exe
  2⤵
  PID:9256
- C:\Windows\System32\nGWuBpI.exe
  C:\Windows\System32\nGWuBpI.exe
  2⤵
  PID:9272
- C:\Windows\System32\jqQAsPk.exe
  C:\Windows\System32\jqQAsPk.exe
  2⤵
  PID:9288
- C:\Windows\System32\xnCfrWD.exe
  C:\Windows\System32\xnCfrWD.exe
  2⤵
  PID:9304
- C:\Windows\System32\qeeOpcg.exe
  C:\Windows\System32\qeeOpcg.exe
  2⤵
  PID:9320
- C:\Windows\System32\xWMHTSC.exe
  C:\Windows\System32\xWMHTSC.exe
  2⤵
  PID:9336
- C:\Windows\System32\VjwTYQY.exe
  C:\Windows\System32\VjwTYQY.exe
  2⤵
  PID:9352
- C:\Windows\System32\uVOZIMj.exe
  C:\Windows\System32\uVOZIMj.exe
  2⤵
  PID:9368
- C:\Windows\System32\rfVNqJX.exe
  C:\Windows\System32\rfVNqJX.exe
  2⤵
  PID:9388
- C:\Windows\System32\siwErMS.exe
  C:\Windows\System32\siwErMS.exe
  2⤵
  PID:9404
- C:\Windows\System32\ySWvGqS.exe
  C:\Windows\System32\ySWvGqS.exe
  2⤵
  PID:9420
- C:\Windows\System32\kbGCyHs.exe
  C:\Windows\System32\kbGCyHs.exe
  2⤵
  PID:9524
- C:\Windows\System32\HgSxvjg.exe
  C:\Windows\System32\HgSxvjg.exe
  2⤵
  PID:9704
- C:\Windows\System32\SvcrMmk.exe
  C:\Windows\System32\SvcrMmk.exe
  2⤵
  PID:9728
- C:\Windows\System32\EFXRdRH.exe
  C:\Windows\System32\EFXRdRH.exe
  2⤵
  PID:9752
- C:\Windows\System32\tHuYbcT.exe
  C:\Windows\System32\tHuYbcT.exe
  2⤵
  PID:9780
- C:\Windows\System32\FZuAzCa.exe
  C:\Windows\System32\FZuAzCa.exe
  2⤵
  PID:9796
- C:\Windows\System32\QmzZQtd.exe
  C:\Windows\System32\QmzZQtd.exe
  2⤵
  PID:9832
- C:\Windows\System32\FIybbsO.exe
  C:\Windows\System32\FIybbsO.exe
  2⤵
  PID:9924
- C:\Windows\System32\mTGrfMe.exe
  C:\Windows\System32\mTGrfMe.exe
  2⤵
  PID:9944
- C:\Windows\System32\ZSdbOmq.exe
  C:\Windows\System32\ZSdbOmq.exe
  2⤵
  PID:9960
- C:\Windows\System32\xYHLOsa.exe
  C:\Windows\System32\xYHLOsa.exe
  2⤵
  PID:9980
- C:\Windows\System32\OxPHWea.exe
  C:\Windows\System32\OxPHWea.exe
  2⤵
  PID:10016
- C:\Windows\System32\RPsfzbf.exe
  C:\Windows\System32\RPsfzbf.exe
  2⤵
  PID:10036
- C:\Windows\System32\ftFlBwd.exe
  C:\Windows\System32\ftFlBwd.exe
  2⤵
  PID:10068
- C:\Windows\System32\tWJdKdx.exe
  C:\Windows\System32\tWJdKdx.exe
  2⤵
  PID:10088
- C:\Windows\System32\sRdzxtF.exe
  C:\Windows\System32\sRdzxtF.exe
  2⤵
  PID:10132
- C:\Windows\System32\KdbJQry.exe
  C:\Windows\System32\KdbJQry.exe
  2⤵
  PID:10164
- C:\Windows\System32\wBhGofD.exe
  C:\Windows\System32\wBhGofD.exe
  2⤵
  PID:10196
- C:\Windows\System32\JgpFiVp.exe
  C:\Windows\System32\JgpFiVp.exe
  2⤵
  PID:10216
- C:\Windows\System32\VuuoMAr.exe
  C:\Windows\System32\VuuoMAr.exe
  2⤵
  PID:10232
- C:\Windows\System32\tSlzuun.exe
  C:\Windows\System32\tSlzuun.exe
  2⤵
  PID:9136
- C:\Windows\System32\KUKFazY.exe
  C:\Windows\System32\KUKFazY.exe
  2⤵
  PID:9104
- C:\Windows\System32\BKoFhpL.exe
  C:\Windows\System32\BKoFhpL.exe
  2⤵
  PID:8300
- C:\Windows\System32\RMHIdMK.exe
  C:\Windows\System32\RMHIdMK.exe
  2⤵
  PID:8356
- C:\Windows\System32\WqFkMbw.exe
  C:\Windows\System32\WqFkMbw.exe
  2⤵
  PID:3812
- C:\Windows\System32\myjujSh.exe
  C:\Windows\System32\myjujSh.exe
  2⤵
  PID:9396
- C:\Windows\System32\AZrzcCz.exe
  C:\Windows\System32\AZrzcCz.exe
  2⤵
  PID:8576
- C:\Windows\System32\UfoMcJU.exe
  C:\Windows\System32\UfoMcJU.exe
  2⤵
  PID:9268
- C:\Windows\System32\zTTYHNp.exe
  C:\Windows\System32\zTTYHNp.exe
  2⤵
  PID:9380
- C:\Windows\System32\IYmZjJt.exe
  C:\Windows\System32\IYmZjJt.exe
  2⤵
  PID:9572
- C:\Windows\System32\Pnkgvvq.exe
  C:\Windows\System32\Pnkgvvq.exe
  2⤵
  PID:7632
- C:\Windows\System32\GlMfJTP.exe
  C:\Windows\System32\GlMfJTP.exe
  2⤵
  PID:9592
- C:\Windows\System32\TFWzaoQ.exe
  C:\Windows\System32\TFWzaoQ.exe
  2⤵
  PID:9716
- C:\Windows\System32\eizcPCR.exe
  C:\Windows\System32\eizcPCR.exe
  2⤵
  PID:9764
- C:\Windows\System32\SYjyArr.exe
  C:\Windows\System32\SYjyArr.exe
  2⤵
  PID:9828
- C:\Windows\System32\bnRjqVw.exe
  C:\Windows\System32\bnRjqVw.exe
  2⤵
  PID:9900
- C:\Windows\System32\sphKCYL.exe
  C:\Windows\System32\sphKCYL.exe
  2⤵
  PID:9480
- C:\Windows\System32\OpobAZG.exe
  C:\Windows\System32\OpobAZG.exe
  2⤵
  PID:9968
- C:\Windows\System32\rkYTjcj.exe
  C:\Windows\System32\rkYTjcj.exe
  2⤵
  PID:10032
- C:\Windows\System32\HKgHWXr.exe
  C:\Windows\System32\HKgHWXr.exe
  2⤵
  PID:10080
- C:\Windows\System32\nzJYadk.exe
  C:\Windows\System32\nzJYadk.exe
  2⤵
  PID:10120
- C:\Windows\System32\RZkvuJE.exe
  C:\Windows\System32\RZkvuJE.exe
  2⤵
  PID:10204
- C:\Windows\System32\NkwvzGR.exe
  C:\Windows\System32\NkwvzGR.exe
  2⤵
  PID:8272
- C:\Windows\System32\DHlkKyq.exe
  C:\Windows\System32\DHlkKyq.exe
  2⤵
  PID:9164
- C:\Windows\System32\eBMHgCT.exe
  C:\Windows\System32\eBMHgCT.exe
  2⤵
  PID:9220
- C:\Windows\System32\XDxwOBy.exe
  C:\Windows\System32\XDxwOBy.exe
  2⤵
  PID:9280
- C:\Windows\System32\oquRYRj.exe
  C:\Windows\System32\oquRYRj.exe
  2⤵
  PID:9604
- C:\Windows\System32\lgGwXAu.exe
  C:\Windows\System32\lgGwXAu.exe
  2⤵
  PID:9788
- C:\Windows\System32\hXouAWp.exe
  C:\Windows\System32\hXouAWp.exe
  2⤵
  PID:8584
- C:\Windows\System32\GiQYihm.exe
  C:\Windows\System32\GiQYihm.exe
  2⤵
  PID:10096
- C:\Windows\System32\CYqblMv.exe
  C:\Windows\System32\CYqblMv.exe
  2⤵
  PID:9456
- C:\Windows\System32\qTFwVMO.exe
  C:\Windows\System32\qTFwVMO.exe
  2⤵
  PID:9400
- C:\Windows\System32\vCmTTth.exe
  C:\Windows\System32\vCmTTth.exe
  2⤵
  PID:9664
- C:\Windows\System32\PYtMKkn.exe
  C:\Windows\System32\PYtMKkn.exe
  2⤵
  PID:9840
- C:\Windows\System32\CMpATSt.exe
  C:\Windows\System32\CMpATSt.exe
  2⤵
  PID:10156
- C:\Windows\System32\KlLkmHI.exe
  C:\Windows\System32\KlLkmHI.exe
  2⤵
  PID:9632
- C:\Windows\System32\xqSHMhV.exe
  C:\Windows\System32\xqSHMhV.exe
  2⤵
  PID:9808
- C:\Windows\System32\SWRTFOB.exe
  C:\Windows\System32\SWRTFOB.exe
  2⤵
  PID:10252
- C:\Windows\System32\ezHSJvu.exe
  C:\Windows\System32\ezHSJvu.exe
  2⤵
  PID:10280
- C:\Windows\System32\GhjDrnZ.exe
  C:\Windows\System32\GhjDrnZ.exe
  2⤵
  PID:10300
- C:\Windows\System32\DhdUthb.exe
  C:\Windows\System32\DhdUthb.exe
  2⤵
  PID:10340
- C:\Windows\System32\AnnMSRn.exe
  C:\Windows\System32\AnnMSRn.exe
  2⤵
  PID:10368
- C:\Windows\System32\uXDbTkz.exe
  C:\Windows\System32\uXDbTkz.exe
  2⤵
  PID:10400
- C:\Windows\System32\YHoUBNG.exe
  C:\Windows\System32\YHoUBNG.exe
  2⤵
  PID:10436
- C:\Windows\System32\nuoycXk.exe
  C:\Windows\System32\nuoycXk.exe
  2⤵
  PID:10464
- C:\Windows\System32\Quearhn.exe
  C:\Windows\System32\Quearhn.exe
  2⤵
  PID:10480
- C:\Windows\System32\tEICsLN.exe
  C:\Windows\System32\tEICsLN.exe
  2⤵
  PID:10504
- C:\Windows\System32\pvBPjsw.exe
  C:\Windows\System32\pvBPjsw.exe
  2⤵
  PID:10524
- C:\Windows\System32\kdYXkhv.exe
  C:\Windows\System32\kdYXkhv.exe
  2⤵
  PID:10580
- C:\Windows\System32\SoSZBdr.exe
  C:\Windows\System32\SoSZBdr.exe
  2⤵
  PID:10600
- C:\Windows\System32\msqDyjS.exe
  C:\Windows\System32\msqDyjS.exe
  2⤵
  PID:10640
- C:\Windows\System32\OyvGrVm.exe
  C:\Windows\System32\OyvGrVm.exe
  2⤵
  PID:10676
- C:\Windows\System32\MLxQWLr.exe
  C:\Windows\System32\MLxQWLr.exe
  2⤵
  PID:10696
- C:\Windows\System32\JHUpvDs.exe
  C:\Windows\System32\JHUpvDs.exe
  2⤵
  PID:10724
- C:\Windows\System32\utTHdHb.exe
  C:\Windows\System32\utTHdHb.exe
  2⤵
  PID:10744
- C:\Windows\System32\BRddslQ.exe
  C:\Windows\System32\BRddslQ.exe
  2⤵
  PID:10760
- C:\Windows\System32\ctmuiym.exe
  C:\Windows\System32\ctmuiym.exe
  2⤵
  PID:10776
- C:\Windows\System32\vYLLcUm.exe
  C:\Windows\System32\vYLLcUm.exe
  2⤵
  PID:10800
- C:\Windows\System32\LYFGOlw.exe
  C:\Windows\System32\LYFGOlw.exe
  2⤵
  PID:10864
- C:\Windows\System32\zwpLpFo.exe
  C:\Windows\System32\zwpLpFo.exe
  2⤵
  PID:10892
- C:\Windows\System32\ZbFFPOY.exe
  C:\Windows\System32\ZbFFPOY.exe
  2⤵
  PID:10920
- C:\Windows\System32\CmmlVBs.exe
  C:\Windows\System32\CmmlVBs.exe
  2⤵
  PID:10948
- C:\Windows\System32\ytLezql.exe
  C:\Windows\System32\ytLezql.exe
  2⤵
  PID:10976
- C:\Windows\System32\EIKEEmn.exe
  C:\Windows\System32\EIKEEmn.exe
  2⤵
  PID:10992
- C:\Windows\System32\BSUIALl.exe
  C:\Windows\System32\BSUIALl.exe
  2⤵
  PID:11028
- C:\Windows\System32\yWHvEYw.exe
  C:\Windows\System32\yWHvEYw.exe
  2⤵
  PID:11052
- C:\Windows\System32\UqlGIkX.exe
  C:\Windows\System32\UqlGIkX.exe
  2⤵
  PID:11072
- C:\Windows\System32\CKWEJgH.exe
  C:\Windows\System32\CKWEJgH.exe
  2⤵
  PID:11088
- C:\Windows\System32\mgfkDnK.exe
  C:\Windows\System32\mgfkDnK.exe
  2⤵
  PID:11116
- C:\Windows\System32\YmKHLZX.exe
  C:\Windows\System32\YmKHLZX.exe
  2⤵
  PID:11184
- C:\Windows\System32\TXvwCNB.exe
  C:\Windows\System32\TXvwCNB.exe
  2⤵
  PID:11204
- C:\Windows\System32\PCDtSOI.exe
  C:\Windows\System32\PCDtSOI.exe
  2⤵
  PID:11220
- C:\Windows\System32\CXWcCYW.exe
  C:\Windows\System32\CXWcCYW.exe
  2⤵
  PID:11240
- C:\Windows\System32\iUPYJVY.exe
  C:\Windows\System32\iUPYJVY.exe
  2⤵
  PID:9972
- C:\Windows\System32\jAuvusU.exe
  C:\Windows\System32\jAuvusU.exe
  2⤵
  PID:10308
- C:\Windows\System32\QgYbYha.exe
  C:\Windows\System32\QgYbYha.exe
  2⤵
  PID:10348
- C:\Windows\System32\FsUhUau.exe
  C:\Windows\System32\FsUhUau.exe
  2⤵
  PID:10476
- C:\Windows\System32\OaFIHGK.exe
  C:\Windows\System32\OaFIHGK.exe
  2⤵
  PID:10544
- C:\Windows\System32\mbmdEtN.exe
  C:\Windows\System32\mbmdEtN.exe
  2⤵
  PID:10536
- C:\Windows\System32\AglSCMd.exe
  C:\Windows\System32\AglSCMd.exe
  2⤵
  PID:10596
- C:\Windows\System32\rkBoDjB.exe
  C:\Windows\System32\rkBoDjB.exe
  2⤵
  PID:10772
- C:\Windows\System32\tBgadSp.exe
  C:\Windows\System32\tBgadSp.exe
  2⤵
  PID:10796
- C:\Windows\System32\khZwRGr.exe
  C:\Windows\System32\khZwRGr.exe
  2⤵
  PID:10832
- C:\Windows\System32\BsVswlw.exe
  C:\Windows\System32\BsVswlw.exe
  2⤵
  PID:10908
- C:\Windows\System32\kiWgaop.exe
  C:\Windows\System32\kiWgaop.exe
  2⤵
  PID:10960
- C:\Windows\System32\eKjuWzj.exe
  C:\Windows\System32\eKjuWzj.exe
  2⤵
  PID:11040
- C:\Windows\System32\syksNiB.exe
  C:\Windows\System32\syksNiB.exe
  2⤵
  PID:11136
- C:\Windows\System32\MIAjEfh.exe
  C:\Windows\System32\MIAjEfh.exe
  2⤵
  PID:11192
- C:\Windows\System32\iYOuxfQ.exe
  C:\Windows\System32\iYOuxfQ.exe
  2⤵
  PID:11256
- C:\Windows\System32\wxSyLiz.exe
  C:\Windows\System32\wxSyLiz.exe
  2⤵
  PID:10408
- C:\Windows\System32\bUZGqBT.exe
  C:\Windows\System32\bUZGqBT.exe
  2⤵
  PID:10500
- C:\Windows\System32\cNNeHTc.exe
  C:\Windows\System32\cNNeHTc.exe
  2⤵
  PID:10736
- C:\Windows\System32\HGDHyXI.exe
  C:\Windows\System32\HGDHyXI.exe
  2⤵
  PID:10848
- C:\Windows\System32\fkoyPSm.exe
  C:\Windows\System32\fkoyPSm.exe
  2⤵
  PID:10916
- C:\Windows\System32\LsXGjwP.exe
  C:\Windows\System32\LsXGjwP.exe
  2⤵
  PID:11068
- C:\Windows\System32\pNkkquy.exe
  C:\Windows\System32\pNkkquy.exe
  2⤵
  PID:11200
- C:\Windows\System32\jXjSude.exe
  C:\Windows\System32\jXjSude.exe
  2⤵
  PID:10292
- C:\Windows\System32\Lfzbsjg.exe
  C:\Windows\System32\Lfzbsjg.exe
  2⤵
  PID:10704
- C:\Windows\System32\UrHwqUk.exe
  C:\Windows\System32\UrHwqUk.exe
  2⤵
  PID:11252
- C:\Windows\System32\sMdFAkD.exe
  C:\Windows\System32\sMdFAkD.exe
  2⤵
  PID:10788
- C:\Windows\System32\urMCURX.exe
  C:\Windows\System32\urMCURX.exe
  2⤵
  PID:11280
- C:\Windows\System32\FaXwfqs.exe
  C:\Windows\System32\FaXwfqs.exe
  2⤵
  PID:11300
- C:\Windows\System32\TmvBakd.exe
  C:\Windows\System32\TmvBakd.exe
  2⤵
  PID:11328
- C:\Windows\System32\DuEaZyz.exe
  C:\Windows\System32\DuEaZyz.exe
  2⤵
  PID:11348
- C:\Windows\System32\zkjYudB.exe
  C:\Windows\System32\zkjYudB.exe
  2⤵
  PID:11368
- C:\Windows\System32\uaWGhpG.exe
  C:\Windows\System32\uaWGhpG.exe
  2⤵
  PID:11388
- C:\Windows\System32\LsiAvLN.exe
  C:\Windows\System32\LsiAvLN.exe
  2⤵
  PID:11460
- C:\Windows\System32\BxmqNbh.exe
  C:\Windows\System32\BxmqNbh.exe
  2⤵
  PID:11488
- C:\Windows\System32\rPzEJAX.exe
  C:\Windows\System32\rPzEJAX.exe
  2⤵
  PID:11516
- C:\Windows\System32\vIlwjsT.exe
  C:\Windows\System32\vIlwjsT.exe
  2⤵
  PID:11544
- C:\Windows\System32\ymyRWcC.exe
  C:\Windows\System32\ymyRWcC.exe
  2⤵
  PID:11564
- C:\Windows\System32\OyFBzYJ.exe
  C:\Windows\System32\OyFBzYJ.exe
  2⤵
  PID:11592
- C:\Windows\System32\GaFXNMM.exe
  C:\Windows\System32\GaFXNMM.exe
  2⤵
  PID:11612
- C:\Windows\System32\nozuNMk.exe
  C:\Windows\System32\nozuNMk.exe
  2⤵
  PID:11640
- C:\Windows\System32\WWhfAox.exe
  C:\Windows\System32\WWhfAox.exe
  2⤵
  PID:11656
- C:\Windows\System32\tEtXjUw.exe
  C:\Windows\System32\tEtXjUw.exe
  2⤵
  PID:11696
- C:\Windows\System32\lFUgLWw.exe
  C:\Windows\System32\lFUgLWw.exe
  2⤵
  PID:11760
- C:\Windows\System32\bgEwZPU.exe
  C:\Windows\System32\bgEwZPU.exe
  2⤵
  PID:11784
- C:\Windows\System32\HrshTRV.exe
  C:\Windows\System32\HrshTRV.exe
  2⤵
  PID:11804
- C:\Windows\System32\VYFClIt.exe
  C:\Windows\System32\VYFClIt.exe
  2⤵
  PID:11828
- C:\Windows\System32\tMXFaMk.exe
  C:\Windows\System32\tMXFaMk.exe
  2⤵
  PID:11852
- C:\Windows\System32\BZDsTpF.exe
  C:\Windows\System32\BZDsTpF.exe
  2⤵
  PID:11896
- C:\Windows\System32\fCUozXg.exe
  C:\Windows\System32\fCUozXg.exe
  2⤵
  PID:11924
- C:\Windows\System32\cItvOXQ.exe
  C:\Windows\System32\cItvOXQ.exe
  2⤵
  PID:11952
- C:\Windows\System32\QkGPpAq.exe
  C:\Windows\System32\QkGPpAq.exe
  2⤵
  PID:11984
- C:\Windows\System32\eykavRj.exe
  C:\Windows\System32\eykavRj.exe
  2⤵
  PID:12004
- C:\Windows\System32\bMTpOeN.exe
  C:\Windows\System32\bMTpOeN.exe
  2⤵
  PID:12024
- C:\Windows\System32\KcEfuUX.exe
  C:\Windows\System32\KcEfuUX.exe
  2⤵
  PID:12044
- C:\Windows\System32\sFPifbA.exe
  C:\Windows\System32\sFPifbA.exe
  2⤵
  PID:12060
- C:\Windows\System32\EySvaNr.exe
  C:\Windows\System32\EySvaNr.exe
  2⤵
  PID:12084
- C:\Windows\System32\dSJsPtM.exe
  C:\Windows\System32\dSJsPtM.exe
  2⤵
  PID:12100
- C:\Windows\System32\lFgGaje.exe
  C:\Windows\System32\lFgGaje.exe
  2⤵
  PID:12160
- C:\Windows\System32\fUDjATE.exe
  C:\Windows\System32\fUDjATE.exe
  2⤵
  PID:12176
- C:\Windows\System32\gaIOCuG.exe
  C:\Windows\System32\gaIOCuG.exe
  2⤵
  PID:12224
- C:\Windows\System32\vLYZGMe.exe
  C:\Windows\System32\vLYZGMe.exe
  2⤵
  PID:12264
- C:\Windows\System32\SYtKojn.exe
  C:\Windows\System32\SYtKojn.exe
  2⤵
  PID:11272
- C:\Windows\System32\XecZNJR.exe
  C:\Windows\System32\XecZNJR.exe
  2⤵
  PID:11296
- C:\Windows\System32\oBRytZb.exe
  C:\Windows\System32\oBRytZb.exe
  2⤵
  PID:11380
- C:\Windows\System32\hBBIAQD.exe
  C:\Windows\System32\hBBIAQD.exe
  2⤵
  PID:11364
- C:\Windows\System32\MswMoSz.exe
  C:\Windows\System32\MswMoSz.exe
  2⤵
  PID:11432
- C:\Windows\System32\qeEZcpj.exe
  C:\Windows\System32\qeEZcpj.exe
  2⤵
  PID:11540
- C:\Windows\System32\ErytIlp.exe
  C:\Windows\System32\ErytIlp.exe
  2⤵
  PID:11572
- C:\Windows\System32\qtnTcSm.exe
  C:\Windows\System32\qtnTcSm.exe
  2⤵
  PID:11664
- C:\Windows\System32\qCYjrnN.exe
  C:\Windows\System32\qCYjrnN.exe
  2⤵
  PID:11752
- C:\Windows\System32\wTIyBxl.exe
  C:\Windows\System32\wTIyBxl.exe
  2⤵
  PID:11780
- C:\Windows\System32\RCvZlgc.exe
  C:\Windows\System32\RCvZlgc.exe
  2⤵
  PID:11836
- C:\Windows\System32\kNlroCB.exe
  C:\Windows\System32\kNlroCB.exe
  2⤵
  PID:11860
- C:\Windows\System32\uOWhnRC.exe
  C:\Windows\System32\uOWhnRC.exe
  2⤵
  PID:11940
- C:\Windows\System32\fHsstbt.exe
  C:\Windows\System32\fHsstbt.exe
  2⤵
  PID:11960
- C:\Windows\System32\hzyFqbI.exe
  C:\Windows\System32\hzyFqbI.exe
  2⤵
  PID:12116
- C:\Windows\System32\EyDwCDs.exe
  C:\Windows\System32\EyDwCDs.exe
  2⤵
  PID:12196
- C:\Windows\System32\uXRZbQc.exe
  C:\Windows\System32\uXRZbQc.exe
  2⤵
  PID:4700
- C:\Windows\System32\FLPSDJO.exe
  C:\Windows\System32\FLPSDJO.exe
  2⤵
  PID:12284
- C:\Windows\System32\txhHjTe.exe
  C:\Windows\System32\txhHjTe.exe
  2⤵
  PID:11020
- C:\Windows\System32\JiwAFIY.exe
  C:\Windows\System32\JiwAFIY.exe
  2⤵
  PID:11360
- C:\Windows\System32\JvqKIMj.exe
  C:\Windows\System32\JvqKIMj.exe
  2⤵
  PID:11620
- C:\Windows\System32\FwErzjc.exe
  C:\Windows\System32\FwErzjc.exe
  2⤵
  PID:11812
- C:\Windows\System32\iHXZhhY.exe
  C:\Windows\System32\iHXZhhY.exe
  2⤵
  PID:11976
- C:\Windows\System32\hmStcpv.exe
  C:\Windows\System32\hmStcpv.exe
  2⤵
  PID:4808
- C:\Windows\System32\UIJqylx.exe
  C:\Windows\System32\UIJqylx.exe
  2⤵
  PID:12208
- C:\Windows\System32\NcYfRwU.exe
  C:\Windows\System32\NcYfRwU.exe
  2⤵
  PID:11472
- C:\Windows\System32\uYfFByR.exe
  C:\Windows\System32\uYfFByR.exe
  2⤵
  PID:11776
- C:\Windows\System32\MxuUmkk.exe
  C:\Windows\System32\MxuUmkk.exe
  2⤵
  PID:1316
- C:\Windows\System32\VyLMfUG.exe
  C:\Windows\System32\VyLMfUG.exe
  2⤵
  PID:12168
- C:\Windows\System32\vbPNrVU.exe
  C:\Windows\System32\vbPNrVU.exe
  2⤵
  PID:11632
- C:\Windows\System32\SXNrZUl.exe
  C:\Windows\System32\SXNrZUl.exe
  2⤵
  PID:12244
- C:\Windows\System32\lPxzydE.exe
  C:\Windows\System32\lPxzydE.exe
  2⤵
  PID:11724
- C:\Windows\System32\ZlmUqJc.exe
  C:\Windows\System32\ZlmUqJc.exe
  2⤵
  PID:12296
- C:\Windows\System32\dQVBgDF.exe
  C:\Windows\System32\dQVBgDF.exe
  2⤵
  PID:12344
- C:\Windows\System32\VGfQTRI.exe
  C:\Windows\System32\VGfQTRI.exe
  2⤵
  PID:12388
- C:\Windows\System32\iZkdkDu.exe
  C:\Windows\System32\iZkdkDu.exe
  2⤵
  PID:12404
- C:\Windows\System32\pasZJCw.exe
  C:\Windows\System32\pasZJCw.exe
  2⤵
  PID:12428
- C:\Windows\System32\vuHeVFu.exe
  C:\Windows\System32\vuHeVFu.exe
  2⤵
  PID:12452
- C:\Windows\System32\FrYPcxJ.exe
  C:\Windows\System32\FrYPcxJ.exe
  2⤵
  PID:12472
- C:\Windows\System32\PPleGmL.exe
  C:\Windows\System32\PPleGmL.exe
  2⤵
  PID:12492
- C:\Windows\System32\VsSDGrR.exe
  C:\Windows\System32\VsSDGrR.exe
  2⤵
  PID:12512
- C:\Windows\System32\DAqgPRS.exe
  C:\Windows\System32\DAqgPRS.exe
  2⤵
  PID:12544
- C:\Windows\System32\pTymwYx.exe
  C:\Windows\System32\pTymwYx.exe
  2⤵
  PID:12564
- C:\Windows\System32\pdPUXfK.exe
  C:\Windows\System32\pdPUXfK.exe
  2⤵
  PID:12580
- C:\Windows\System32\IFGNYFP.exe
  C:\Windows\System32\IFGNYFP.exe
  2⤵
  PID:12604
- C:\Windows\System32\cJSzoxw.exe
  C:\Windows\System32\cJSzoxw.exe
  2⤵
  PID:12628
- C:\Windows\System32\wBKUHgy.exe
  C:\Windows\System32\wBKUHgy.exe
  2⤵
  PID:12672
- C:\Windows\System32\KswXvkW.exe
  C:\Windows\System32\KswXvkW.exe
  2⤵
  PID:12692
- C:\Windows\System32\xUzJkzK.exe
  C:\Windows\System32\xUzJkzK.exe
  2⤵
  PID:12744
- C:\Windows\System32\xnUGCHj.exe
  C:\Windows\System32\xnUGCHj.exe
  2⤵
  PID:12760
- C:\Windows\System32\mEINYmV.exe
  C:\Windows\System32\mEINYmV.exe
  2⤵
  PID:12792
- C:\Windows\System32\mcXqoLi.exe
  C:\Windows\System32\mcXqoLi.exe
  2⤵
  PID:12824
- C:\Windows\System32\lrBVHHv.exe
  C:\Windows\System32\lrBVHHv.exe
  2⤵
  PID:12864
- C:\Windows\System32\tWkttPL.exe
  C:\Windows\System32\tWkttPL.exe
  2⤵
  PID:12880
- C:\Windows\System32\QPlLRHT.exe
  C:\Windows\System32\QPlLRHT.exe
  2⤵
  PID:12912
- C:\Windows\System32\NxRvNHI.exe
  C:\Windows\System32\NxRvNHI.exe
  2⤵
  PID:12944
- C:\Windows\System32\aPcxqjm.exe
  C:\Windows\System32\aPcxqjm.exe
  2⤵
  PID:12964
- C:\Windows\System32\lNahSQx.exe
  C:\Windows\System32\lNahSQx.exe
  2⤵
  PID:12984
- C:\Windows\System32\WwufZCO.exe
  C:\Windows\System32\WwufZCO.exe
  2⤵
  PID:13008
- C:\Windows\System32\dnBoflH.exe
  C:\Windows\System32\dnBoflH.exe
  2⤵
  PID:13084
- C:\Windows\System32\HIetbrL.exe
  C:\Windows\System32\HIetbrL.exe
  2⤵
  PID:13104
- C:\Windows\System32\hjlpYLd.exe
  C:\Windows\System32\hjlpYLd.exe
  2⤵
  PID:13128
- C:\Windows\System32\vLqNvBr.exe
  C:\Windows\System32\vLqNvBr.exe
  2⤵
  PID:13144
- C:\Windows\System32\rJyAJKP.exe
  C:\Windows\System32\rJyAJKP.exe
  2⤵
  PID:13164
- C:\Windows\System32\zIgdjdq.exe
  C:\Windows\System32\zIgdjdq.exe
  2⤵
  PID:13212
- C:\Windows\System32\LGGWiIx.exe
  C:\Windows\System32\LGGWiIx.exe
  2⤵
  PID:13244
- C:\Windows\System32\DBBwAlt.exe
  C:\Windows\System32\DBBwAlt.exe
  2⤵
  PID:13268
- C:\Windows\System32\auaWEpg.exe
  C:\Windows\System32\auaWEpg.exe
  2⤵
  PID:13288
- C:\Windows\System32\HkfOhUZ.exe
  C:\Windows\System32\HkfOhUZ.exe
  2⤵
  PID:13308
- C:\Windows\System32\VaFBjoo.exe
  C:\Windows\System32\VaFBjoo.exe
  2⤵
  PID:12324
- C:\Windows\System32\CTHqRKG.exe
  C:\Windows\System32\CTHqRKG.exe
  2⤵
  PID:12356
- C:\Windows\System32\LxxliIS.exe
  C:\Windows\System32\LxxliIS.exe
  2⤵
  PID:12444
- C:\Windows\System32\lrAYsPd.exe
  C:\Windows\System32\lrAYsPd.exe
  2⤵
  PID:12576
- C:\Windows\System32\oLWekdW.exe
  C:\Windows\System32\oLWekdW.exe
  2⤵
  PID:12660
- C:\Windows\System32\NyqmzRL.exe
  C:\Windows\System32\NyqmzRL.exe
  2⤵
  PID:4168
- C:\Windows\System32\ChFWHcU.exe
  C:\Windows\System32\ChFWHcU.exe
  2⤵
  PID:11936
- C:\Windows\System32\WrrfjzC.exe
  C:\Windows\System32\WrrfjzC.exe
  2⤵
  PID:12716
- C:\Windows\System32\RGBWbqN.exe
  C:\Windows\System32\RGBWbqN.exe
  2⤵
  PID:12800
- C:\Windows\System32\YdxuaeD.exe
  C:\Windows\System32\YdxuaeD.exe
  2⤵
  PID:12920
- C:\Windows\System32\MPHjigu.exe
  C:\Windows\System32\MPHjigu.exe
  2⤵
  PID:12992
- C:\Windows\System32\cNHvClP.exe
  C:\Windows\System32\cNHvClP.exe
  2⤵
  PID:13016
- C:\Windows\System32\nNQTZSK.exe
  C:\Windows\System32\nNQTZSK.exe
  2⤵
  PID:13096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\DnwOTRo.exe

Filesize
1.6MB

MD5
ae70fdfcdaf9e01620da6ceeb3f63bb7

SHA1
724678519199cf52df7aa5358ac5a6ed7b85a64f

SHA256
a0dcdbedf9eb6a5f8dae467b3cdf6727340bedf15c546b8003c9687976c72637

SHA512
d9ad06cdec8efa4bc8cf4daab28870bc4772e4157681c691e552ec5d51c465e864da92f1e000e396165db75f152d2bc0c7ade58184bb9f56c7b30a10301a84cb

Download Submit
C:\Windows\System32\ECAMdez.exe

Filesize
1.6MB

MD5
d62307f46e2b69ad02070e85774989df

SHA1
fbc3ff9eb2cbd6dc784ded9b63788f8238a6c2fe

SHA256
92fe830d05210d544ee4a931448f9de5501271aebd995fd3f899f69e05bc0039

SHA512
64b5218dfdaee9c64b04abf003322b33f7c3d4311460d858900ffaeaeed7aaa12afb37b0fc871b86b073a12bf90f74aa46bdcd954b68944a8639fec3cc90383a

Download Submit
C:\Windows\System32\GYPTHVI.exe

Filesize
1.6MB

MD5
4b15ee12493c3be974bd609fc15720ed

SHA1
a5439d04fdb071cda525fa79d254c7b5f244b7fe

SHA256
cb8da70c6cded67ee06073f8467800c371a447ae5dbbe4ed971964c4b815534b

SHA512
02d8b44040858a7b57bf8ddbf4f267dd134717c7539c3dd96ef80a18a20033e416b3b424cacdcdbfb9e3122b79e5b1495eea335c6c1fbba7ace6263253e74bf7

Download Submit
C:\Windows\System32\HTGFWdh.exe

Filesize
1.6MB

MD5
7c30eb0719bf2772d0f6d7aea85ce5d7

SHA1
14e8d929a6ede8fdc54350f57023bda7b0bbc8df

SHA256
9675e4a27f8be1e04f43d4f3225eabd490c8928abc826aeafe1e1b6720ed0070

SHA512
62d5eb39421212c9bb8caad25aa2f181e5243df5ee3ec1d0096d5881816ecb6e987b99bffd705233364dd867cc1c82630eb75dbf008ad654fa9b05715b9fa1c5

Download Submit
C:\Windows\System32\HvxNAFB.exe

Filesize
1.6MB

MD5
c603b15d99422ecd3f8987d97e0663c6

SHA1
afca0d504fc8c5fc9f343c0fc876b4cefb2565de

SHA256
fae49f60af89e23b26eee83fec94167d86ca00816e9784ce342c2aad783ae6d0

SHA512
023e3acb7ea4cfbf1f5119a81f624c5121297bf5de29a9592fceab2d8749ae84f23d159a48ab800cf33989aef8ad3ec7365cbf10570d3c19984e60934e46ff86

Download Submit
C:\Windows\System32\KHYvJei.exe

Filesize
1.6MB

MD5
f8e65e8b0499105742ec05d57ba4515b

SHA1
eca84dd708db409a7eaba85af855aa91bab40b5f

SHA256
1e8544cd364f9afc9bf0d7ae0fdca3cc5cf89d1b1f889c9ad30a30b58b4060fa

SHA512
b047a5b1170d00ac9e771378a626fdf42cf176cee678a1917b519f8d2239487a8b703578c2f11f5794366319ce76a22406ecf2692dcd10361e81c9ad15b830ec

Download Submit
C:\Windows\System32\PQPmzhS.exe

Filesize
1.6MB

MD5
bd2dbbcb0aa6614f6f365e93692a117e

SHA1
4c08f4e9cc3c94e03d67300b9d0d7df0fb058145

SHA256
faf6865dc65049960c2307c74a08d7d3160c626a11c2a6fa94f20704641136c9

SHA512
2eef465007f157539dcb41beeefd2b58c9d7074862e883abaafcc6e8a2335af2ff3db61f307f640302577ad2b590ecd6af1a886842fdb27c90a5fd6448241080

Download Submit
C:\Windows\System32\RPzaGcF.exe

Filesize
1.6MB

MD5
41d0d7b5220c236eb5b3be8e277df131

SHA1
4e41ee99ef33a18083f337dedbf9c1379c6fc67b

SHA256
e5fd814966bbdee429a14561ac50192d68dec8cb876b33d610476e9555e2bb50

SHA512
10ced1afaeb3ec6c69a3549bb4781233042d2c5de583998d8c8ecb7a91a0c85f1094eb53ad22c99baa57ccfe901cfe3eafbc1a198516eb0ff1d7e16114f8142d

Download Submit
C:\Windows\System32\RPzhfch.exe

Filesize
1.6MB

MD5
9a89a1d328fdcd7a1a885952f09b416b

SHA1
db93b54df12eb4eb6d8073fb8ce2d03704e38b0c

SHA256
72121b176971d97fa386d0166d124c7cb55f6df4a7ce327a1b89d81aff23daa1

SHA512
c45559dae32190cb948ea2f8bd79e13117dae8343453d326e99797960cffd13b07ba926312486e5258642e530abb7895050cf9283d0dffb8ba150e4e86e930f5

Download Submit
C:\Windows\System32\TZdZFNe.exe

Filesize
1.6MB

MD5
35a6c3e61394aba18730738f8e6a9ce8

SHA1
f23353ba13f703968590f3b86380f299fb6d8954

SHA256
cbb1db93009a396f3f6a659cd8a11e29e4731acd8d4653ad9cbe527ee7ebe335

SHA512
1f982c474c36b9482fe457eef0e206f7a595c1212d5fdc827db2e9b69f81153ad37238183a7c40fa5e62bd9658fc9cbc7c6fa1c72ac33114f1576911106ed21d

Download Submit
C:\Windows\System32\TqrFQaD.exe

Filesize
1.6MB

MD5
711df55cac4f6817cf38f6abee2f0912

SHA1
0e302985303a19ccec8403678dd1d40cd5655b4a

SHA256
5ef0c7abe73a290319abf26c5cb8ee533401fc6ab8b049050d8501e2cb5f4c56

SHA512
b6833860a2d544c6dde5a8473d2e536bdf2bda78c54469a9b5d7ab5a9ded362779ae8fbae62c73e248fe663ba536fc62b3d9475c17faeb7773ae93a985cd7478

Download Submit
C:\Windows\System32\VaARAHa.exe

Filesize
1.6MB

MD5
4d1d220879789b061cc6e2be959edb8f

SHA1
668c17a4246dd049af27642afa749e996d9d85a3

SHA256
45b45861430ddd6d152be00c60493147d8ae2d884de1cc4d1d11fdda45345336

SHA512
0e80209cb9f2589611655cb5c7dce87988644cc56ee9812e114fcd267be65e99f6dc4007e8b883e2a68c91ac194a0ead5865db76af010ed39a1620b82da0cbdb

Download Submit
C:\Windows\System32\WrgOoRn.exe

Filesize
1.6MB

MD5
7925416ef236f1f66f36addc4734b8a8

SHA1
e056f09c0307aa32f76b3c5bb92c551afa4df6f1

SHA256
20d422b7782fb0b88bc01053a39769a12207db5248721b087c7a04952520e122

SHA512
87dd496b070d61f63c425e2e1253eaed40e420e50447aff2d4de14bdcbff54f2812e6764054a5fd86bb84885edc03fbc9d1f8763836db7d58139df34828b6075

Download Submit
C:\Windows\System32\YAPazwr.exe

Filesize
1.6MB

MD5
b23660f90bc4b2ca917621cc98605e6c

SHA1
5fe96d302dc35d2773a494eb7a2cdbe3560f34e5

SHA256
752db2d32f8fd397938a32b4fcaee4bdff191e7d50007001d8b4672c423258f9

SHA512
4fee02c61ffacf12cee96ab8e5b4158e1a083013ce6226d706a10ccc04bdbc2bab1af3f87c74b381dea2608f03021b090832fab7aac97b177ebcffd8f8056f66

Download Submit
C:\Windows\System32\ZdxOUJU.exe

Filesize
1.6MB

MD5
58fe35945595b9bb26363a4d9c56ba15

SHA1
3a2c4cb47dfa09467ef4f660ea13491efefb0275

SHA256
91752a41126987d6bea1c716ffea157b5afd07271d1f7e19c55e9086268fa7e7

SHA512
eb90d8dfa9b699f660ce4be0523b16d1f81532513591a4781e514d0fd40da927303c138b7270722f19f4329aa478fc4d97cd13d4bb4d854f32b5e52d2b8834ae

Download Submit
C:\Windows\System32\aVNxyhq.exe

Filesize
1.6MB

MD5
c586fec84757c2ca2ee0bd3a3c45ab31

SHA1
945e1b7523fe8a53a7df0a703f031df7405d61f0

SHA256
1d7fcef501c9f48ee9a9d2aa61e001e9cbf93ee5d4d69a10ad06f4387938b868

SHA512
aa733698eaeae1cb5fa766f749f8451e38c03bf5a156473ab86119308605e1fc6b584ff4ec249cfcea1e275fb644c87d161f8087689668d2b148001cde56acc2

Download Submit
C:\Windows\System32\blBzCVH.exe

Filesize
1.6MB

MD5
2bfcf0e4d898b211fe6dc4fb4b91f130

SHA1
f3b8fe80534cd16d1314a5798987c5e888f769d6

SHA256
9f981436d0d9fc4008a72999487ee50dbd1c456a69a86dd86f0dd2ea47cb0f00

SHA512
50548f175cb50741ae54d12705d876a3b87eb6cc2f8406429f6a9567bd2126f6b3a9992247ae98c493bbd6d18a495957bc0323b8efb99db22055da346887a0da

Download Submit
C:\Windows\System32\cHdLEle.exe

Filesize
1.6MB

MD5
f44d921ee9f050a3daf2f984dd8dc0a4

SHA1
f1c12255670d4564828f60c43635f913f4dccd11

SHA256
166ff042c2f88da2671eafde0e6eda6c2335ba4917f4a5fd63bb733ab1703cba

SHA512
4bff5cdb2017587370c5fa01de43941e0df978651d6ffbc3ef4273fe5d1fad69f7d26441c38975590551c024230cb8f75caa767cf59328639b0061117cc33130

Download Submit
C:\Windows\System32\dQAEvgf.exe

Filesize
1.6MB

MD5
51a60bfd2cceae3f2e63143839f89449

SHA1
a0feda23ed60e3815f0da2e9fa6066ca71693d4d

SHA256
04dc50677be4c4e78692b27fd5b9972f21f0033e902e5d290121c3b9c3aa2cd5

SHA512
b71a51fc683184de437248e4a976fcb97766b061e5f434828d23654b9ffcf6ca678c3ec48dfb9bedaa4cd1e8ce54103d8c550153ed4ca52b401b3926dc16261e

Download Submit
C:\Windows\System32\eoNxdRo.exe

Filesize
1.6MB

MD5
b09abdb71617467dd847787f1bb703de

SHA1
f6e2e4f7dfe21c23ed52605f5fcdb3604611d92d

SHA256
cb0a54fb6dcd917f2d642efa99c120f867f1ec973bf2876ec9f9e3fabbc48c47

SHA512
52283aff7e54b3d03bcf611f7d7a204654c96a075310b29c5d95d29d1488fb99b925994e6a2024ec0a8197d518d7961e244d60d1e953f582aeaf42e044700636

Download Submit
C:\Windows\System32\evdoEkh.exe

Filesize
1.6MB

MD5
d007557f3c0be5bc67575954c34dba04

SHA1
1c251d108a6e8ef96615ca2e9e168e0a023c4c73

SHA256
860ead409838ba314d561d08e30389aae75b56a3cf72eb78cf054ea49e16b76f

SHA512
24b715366ddab8850377c42ac3f4d24e03064c6cd1fe861a01fe9962fef36ac73911e5637f43d9257fa41de2d6b7af805af7dc15d01ca032f16ded0e9cb82da6

Download Submit
C:\Windows\System32\icBmpEk.exe

Filesize
1.6MB

MD5
42c4c1eaef00abf65d5da7779799852f

SHA1
dd07f62464315d0f2461f128d5656e52049f6682

SHA256
bb920f11ea2b21c0f7b8b60b99a6bbe2f66e960b20eb598c18909d54457cb173

SHA512
c7b5507df6523b64259549df1b2f2a2c96654ea55f8f67482b3030eaaf4cf59056884657708c58916b06e0090d15d53ebffa9c0bef7acbfb9852ab6d8171b378

Download Submit
C:\Windows\System32\mmWEpmC.exe

Filesize
1.6MB

MD5
4afa145b4db3c44de787d80729427ae2

SHA1
37bc01d76568cc1de1390de63ad89064580704d7

SHA256
3f34611954d515d3149c30ce732f3c34329613af190129138a48bc4813af6ba5

SHA512
6c31c066f9dc019629f46e549653cfe614471a4df803d91fbd206380b9d836b8f7627a610742e370fdb523bd3aacdba03afa0a2710eb1bd91deb995640be1e3f

Download Submit
C:\Windows\System32\oNVmXpq.exe

Filesize
1.6MB

MD5
169f4dac1b3a7ef23563eb343a63e209

SHA1
6431cf696fb199ef48e1a0de5d703afeec959fab

SHA256
499199286d75ed2cdaab1a72cee375fe60f8e1f1a29049a47c4be3be390ba43e

SHA512
99d3f7aaab3bebe096dcdb4ea563e7e46c8a4550db93a24d902696a672e18026b8053c690f46f4e9e3b9e15587c2c2338af85cb00c5a31e37ed8e8868ed77746

Download Submit
C:\Windows\System32\pFgZzXV.exe

Filesize
1.6MB

MD5
5e0b572274a2244924b1f346c7c8c187

SHA1
f44ac93a88198f9799ed2d9fb858750324dc0ff7

SHA256
617237cd94919fb03210883b3cbbbd7f535def9bfd3640795e127905751566e5

SHA512
d1f04ab2e4131bb83a91c8c0f23a1dda989f7392bacb606cd9ec75fb94df5c8467d2f3040b8b1ad5b0aea1a4c670c55807800330fd8faa757adfb11082cb8d61

Download Submit
C:\Windows\System32\sMJKmTm.exe

Filesize
1.6MB

MD5
213c2f7a14f07fa155971f90f38a3616

SHA1
2c687e6e66d6d16a84f6b25fc0dd21cb8248e85f

SHA256
1eea5d2d405727e8c7e48c6abce8c5aeb664231f0162f2e9d1cd135a8b49c336

SHA512
9e1dfbb6ca2128748eaf91f13a12b88a07022af09482c478240daebddd91d912224bb723839abab47fb787c66b55ad3bf494a8647a6bb75d7597b146d4a2c619

Download Submit
C:\Windows\System32\tFlXhGv.exe

Filesize
1.6MB

MD5
1abaf4e2cd33bc13f3f66e44470b722f

SHA1
4f025ed6c94f2c13a7e7909f0b744e9b6cc06a09

SHA256
331b7961db9e5a9cafe884d767ee3255cb3a562a6cf81c30499db2f1eac1a544

SHA512
42eebdb95b5af63be0e9b6f15a265893a660452e9d3369147efea102d24711e4035b1bc2f4acd7363581f5010fc8b9dd6bcca035ce02841e9e9bcbe13a9848ad

Download Submit
C:\Windows\System32\tyDSACu.exe

Filesize
1.6MB

MD5
bce0c9c91280ac8b9d280fc8fd32867c

SHA1
2297a7a0c74e4b2b47dd49bcfb35fc6df7c15c33

SHA256
42aedff46a5a08083e580648183fe37f63b8192a8c36fdc784d911ccfd2ccc9d

SHA512
86d3b527e0f4d58f44bd26f34b6e01cca0bf01b36c4360b36907f8aea84b14f346ce370298550820c366af4afbf74277c790b88f0065d9f16b98d3003b4086af

Download Submit
C:\Windows\System32\ykKYKzN.exe

Filesize
1.6MB

MD5
ff588887b2a02eb01b236b74c4ff9741

SHA1
85f7864d9e82ddd4d3c7405272ec8212aa979efd

SHA256
05840e3c88bfe58e01c7c0fc05223612bccfa6548b8dd2883633d1c584b4ceb1

SHA512
74e4b8d3c9dd29686862e6c58bd5b55d4d0d4e481656ce836e453eb80c8fc47d76a266459dec8e8db7e2f908f1d33ca67f4f1ff9ec425d5bc1ef755f5d742c00

Download Submit
C:\Windows\System32\yxEjrip.exe

Filesize
1.6MB

MD5
142a55bec5b10786b9418e50939525e8

SHA1
c08efee73ee296f7ee28dbd5cb7c8e574cf85b29

SHA256
653ad9d3a289c7581678064eceb00dc720bf80da1af328a0f0265d7ad08b09e0

SHA512
27cd3b04433fd05c72b428e8bbe62ed5b8aa70e9bbedd483b00c6f3a00629bd2d2bb242ccd554fb4874de5cbd24937ae3d6f93eece0bbd3cf81644cd9ca628d0

Download Submit
C:\Windows\System32\zjFfsqD.exe

Filesize
1.6MB

MD5
ce1671a28801896ccaff91215f908734

SHA1
6cc91bb1f9aa8b028027ee9c046a2172fe44d8a5

SHA256
71ce3bfda4afe6ecaed4feebcbce4718e744de35f76b3d72bff76df4e83d6c87

SHA512
f38c325ce158d44de1a4fcbf41d644637d1a5b75634855a4fc8b17e554ccca3f3c25a07580710d7ce9afdcdc032d86eb3188868e47db1f75c37b80a37f07a779

Download Submit
C:\Windows\System32\zsWTCHK.exe

Filesize
1.6MB

MD5
dba0e5579334dca2d3c2a512fe5d59cc

SHA1
83d2b042b79b51add5d375a5649c6b7d2b36e302

SHA256
0a7eb7b2e103edf81b92990e6c344457a4e47273daafce4184feb476caed1e20

SHA512
c615e02e1122f6dbc3ee94f487ef57ee8abf4741442f0033269cbf1d5b4dc2f8928a8d767d2363f7d5e20780753a26bdbf9ee5d57ae0931b3879c5c307bde6f7

Download Submit
memory/884-490-0x00007FF7B0BE0000-0x00007FF7B0FD1000-memory.dmp

Filesize
3.9MB

Download
memory/884-2059-0x00007FF7B0BE0000-0x00007FF7B0FD1000-memory.dmp

Filesize
3.9MB

Download
memory/1008-1977-0x00007FF6E3560000-0x00007FF6E3951000-memory.dmp

Filesize
3.9MB

Download
memory/1008-2023-0x00007FF6E3560000-0x00007FF6E3951000-memory.dmp

Filesize
3.9MB

Download
memory/1008-20-0x00007FF6E3560000-0x00007FF6E3951000-memory.dmp

Filesize
3.9MB

Download
memory/1164-1179-0x00007FF77BA70000-0x00007FF77BE61000-memory.dmp

Filesize
3.9MB

Download
memory/1164-14-0x00007FF77BA70000-0x00007FF77BE61000-memory.dmp

Filesize
3.9MB

Download
memory/1164-2021-0x00007FF77BA70000-0x00007FF77BE61000-memory.dmp

Filesize
3.9MB

Download
memory/1332-2053-0x00007FF75AEF0000-0x00007FF75B2E1000-memory.dmp

Filesize
3.9MB

Download
memory/1332-487-0x00007FF75AEF0000-0x00007FF75B2E1000-memory.dmp

Filesize
3.9MB

Download
memory/1520-2015-0x00007FF6817F0000-0x00007FF681BE1000-memory.dmp

Filesize
3.9MB

Download
memory/1520-1684-0x00007FF6817F0000-0x00007FF681BE1000-memory.dmp

Filesize
3.9MB

Download
memory/1520-1-0x00000162005F0000-0x0000016200600000-memory.dmp

Filesize
64KB

Download
memory/1520-0-0x00007FF6817F0000-0x00007FF681BE1000-memory.dmp

Filesize
3.9MB

Download
memory/1832-491-0x00007FF635730000-0x00007FF635B21000-memory.dmp

Filesize
3.9MB

Download
memory/1832-2105-0x00007FF635730000-0x00007FF635B21000-memory.dmp

Filesize
3.9MB

Download
memory/2040-53-0x00007FF6DEDC0000-0x00007FF6DF1B1000-memory.dmp

Filesize
3.9MB

Download
memory/2040-2036-0x00007FF6DEDC0000-0x00007FF6DF1B1000-memory.dmp

Filesize
3.9MB

Download
memory/2040-2017-0x00007FF6DEDC0000-0x00007FF6DF1B1000-memory.dmp

Filesize
3.9MB

Download
memory/2188-489-0x00007FF786410000-0x00007FF786801000-memory.dmp

Filesize
3.9MB

Download
memory/2188-2057-0x00007FF786410000-0x00007FF786801000-memory.dmp

Filesize
3.9MB

Download
memory/2204-2055-0x00007FF7B97C0000-0x00007FF7B9BB1000-memory.dmp

Filesize
3.9MB

Download
memory/2204-488-0x00007FF7B97C0000-0x00007FF7B9BB1000-memory.dmp

Filesize
3.9MB

Download
memory/2444-2101-0x00007FF682F60000-0x00007FF683351000-memory.dmp

Filesize
3.9MB

Download
memory/2444-492-0x00007FF682F60000-0x00007FF683351000-memory.dmp

Filesize
3.9MB

Download
memory/2540-2049-0x00007FF78C350000-0x00007FF78C741000-memory.dmp

Filesize
3.9MB

Download
memory/2540-47-0x00007FF78C350000-0x00007FF78C741000-memory.dmp

Filesize
3.9MB

Download
memory/2632-493-0x00007FF7477C0000-0x00007FF747BB1000-memory.dmp

Filesize
3.9MB

Download
memory/2632-2066-0x00007FF7477C0000-0x00007FF747BB1000-memory.dmp

Filesize
3.9MB

Download
memory/2788-483-0x00007FF70D920000-0x00007FF70DD11000-memory.dmp

Filesize
3.9MB

Download
memory/2788-2044-0x00007FF70D920000-0x00007FF70DD11000-memory.dmp

Filesize
3.9MB

Download
memory/2944-2029-0x00007FF789C60000-0x00007FF78A051000-memory.dmp

Filesize
3.9MB

Download
memory/2944-1978-0x00007FF789C60000-0x00007FF78A051000-memory.dmp

Filesize
3.9MB

Download
memory/2944-26-0x00007FF789C60000-0x00007FF78A051000-memory.dmp

Filesize
3.9MB

Download
memory/3056-485-0x00007FF69E040000-0x00007FF69E431000-memory.dmp

Filesize
3.9MB

Download
memory/3056-2048-0x00007FF69E040000-0x00007FF69E431000-memory.dmp

Filesize
3.9MB

Download
memory/3124-2012-0x00007FF761280000-0x00007FF761671000-memory.dmp

Filesize
3.9MB

Download
memory/3124-2031-0x00007FF761280000-0x00007FF761671000-memory.dmp

Filesize
3.9MB

Download
memory/3124-36-0x00007FF761280000-0x00007FF761671000-memory.dmp

Filesize
3.9MB

Download
memory/3476-2039-0x00007FF62E170000-0x00007FF62E561000-memory.dmp

Filesize
3.9MB

Download
memory/3476-480-0x00007FF62E170000-0x00007FF62E561000-memory.dmp

Filesize
3.9MB

Download
memory/3516-2051-0x00007FF60C580000-0x00007FF60C971000-memory.dmp

Filesize
3.9MB

Download
memory/3516-486-0x00007FF60C580000-0x00007FF60C971000-memory.dmp

Filesize
3.9MB

Download
memory/3848-2047-0x00007FF6EEDA0000-0x00007FF6EF191000-memory.dmp

Filesize
3.9MB

Download
memory/3848-482-0x00007FF6EEDA0000-0x00007FF6EF191000-memory.dmp

Filesize
3.9MB

Download
memory/4172-2013-0x00007FF67FDE0000-0x00007FF6801D1000-memory.dmp

Filesize
3.9MB

Download
memory/4172-2208-0x00007FF67FDE0000-0x00007FF6801D1000-memory.dmp

Filesize
3.9MB

Download
memory/4172-49-0x00007FF67FDE0000-0x00007FF6801D1000-memory.dmp

Filesize
3.9MB

Download
memory/4220-2043-0x00007FF7C2310000-0x00007FF7C2701000-memory.dmp

Filesize
3.9MB

Download
memory/4220-484-0x00007FF7C2310000-0x00007FF7C2701000-memory.dmp

Filesize
3.9MB

Download
memory/4304-481-0x00007FF624EC0000-0x00007FF6252B1000-memory.dmp

Filesize
3.9MB

Download
memory/4304-2035-0x00007FF624EC0000-0x00007FF6252B1000-memory.dmp

Filesize
3.9MB

Download
memory/4464-2040-0x00007FF7B2D60000-0x00007FF7B3151000-memory.dmp

Filesize
3.9MB

Download
memory/4464-479-0x00007FF7B2D60000-0x00007FF7B3151000-memory.dmp

Filesize
3.9MB

Download
memory/4636-19-0x00007FF65CC20000-0x00007FF65D011000-memory.dmp

Filesize
3.9MB

Download
memory/4636-2027-0x00007FF65CC20000-0x00007FF65D011000-memory.dmp

Filesize
3.9MB

Download
memory/5080-30-0x00007FF735310000-0x00007FF735701000-memory.dmp

Filesize
3.9MB

Download
memory/5080-1980-0x00007FF735310000-0x00007FF735701000-memory.dmp

Filesize
3.9MB

Download
memory/5080-2026-0x00007FF735310000-0x00007FF735701000-memory.dmp

Filesize
3.9MB

Download