xmrig | 3ec5877724dd5194969690273e6c4d138dccf64e71b450e2c956301c550790f8

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
Size 1.5MB
Sample240430-dgbcpsbc31
SHA256 3ec5877724dd5194969690273e6c4d138dccf64e71b450e2c956301c550790f8
MD5 08de224998c1409222adcd7c95ff55fe
SHA1 213bc21d98b05a292541a867cd197071ef377a19
SHA512 df1289c08043d727904ad7729fa9c8e0bb5269c0a7dd5d3a732196ba5439ac5d18eee607850dc4f643bf1148a5c4ccb5b9ad3908b984045e326872a8e3d31897
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIi:knw9oUUEEDl37jcquVoVJ38lCIi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/4400-370-0x00007FF645360000-0x00007FF645751000-memory.dmp	xmrig
behavioral2/memory/1644-376-0x00007FF777210000-0x00007FF777601000-memory.dmp	xmrig
behavioral2/memory/1364-387-0x00007FF672BD0000-0x00007FF672FC1000-memory.dmp	xmrig
behavioral2/memory/1860-382-0x00007FF673FF0000-0x00007FF6743E1000-memory.dmp	xmrig
behavioral2/memory/4872-405-0x00007FF750D80000-0x00007FF751171000-memory.dmp	xmrig
behavioral2/memory/1548-407-0x00007FF6855D0000-0x00007FF6859C1000-memory.dmp	xmrig
behavioral2/memory/1592-414-0x00007FF76BEF0000-0x00007FF76C2E1000-memory.dmp	xmrig
behavioral2/memory/872-419-0x00007FF7FA9B0000-0x00007FF7FADA1000-memory.dmp	xmrig
behavioral2/memory/624-418-0x00007FF6907F0000-0x00007FF690BE1000-memory.dmp	xmrig
behavioral2/memory/1952-393-0x00007FF6C9540000-0x00007FF6C9931000-memory.dmp	xmrig
behavioral2/memory/2880-428-0x00007FF6B57D0000-0x00007FF6B5BC1000-memory.dmp	xmrig
behavioral2/memory/4516-431-0x00007FF6126C0000-0x00007FF612AB1000-memory.dmp	xmrig
behavioral2/memory/1604-427-0x00007FF681DC0000-0x00007FF6821B1000-memory.dmp	xmrig
behavioral2/memory/2388-438-0x00007FF6D4610000-0x00007FF6D4A01000-memory.dmp	xmrig
behavioral2/memory/4504-441-0x00007FF7F3CF0000-0x00007FF7F40E1000-memory.dmp	xmrig
behavioral2/memory/4588-445-0x00007FF775980000-0x00007FF775D71000-memory.dmp	xmrig
behavioral2/memory/1092-447-0x00007FF763FB0000-0x00007FF7643A1000-memory.dmp	xmrig
behavioral2/memory/1112-442-0x00007FF6F0DA0000-0x00007FF6F1191000-memory.dmp	xmrig
behavioral2/memory/2348-450-0x00007FF63D590000-0x00007FF63D981000-memory.dmp	xmrig
behavioral2/memory/1512-456-0x00007FF7C6050000-0x00007FF7C6441000-memory.dmp	xmrig
behavioral2/memory/4444-455-0x00007FF637B40000-0x00007FF637F31000-memory.dmp	xmrig
behavioral2/memory/2744-19-0x00007FF790000000-0x00007FF7903F1000-memory.dmp	xmrig
behavioral2/memory/4868-13-0x00007FF749780000-0x00007FF749B71000-memory.dmp	xmrig
behavioral2/memory/1044-1973-0x00007FF7802B0000-0x00007FF7806A1000-memory.dmp	xmrig
behavioral2/memory/3348-1975-0x00007FF7D3A50000-0x00007FF7D3E41000-memory.dmp	xmrig
behavioral2/memory/4868-2012-0x00007FF749780000-0x00007FF749B71000-memory.dmp	xmrig
behavioral2/memory/2744-2014-0x00007FF790000000-0x00007FF7903F1000-memory.dmp	xmrig
behavioral2/memory/2348-2016-0x00007FF63D590000-0x00007FF63D981000-memory.dmp	xmrig
behavioral2/memory/3348-2019-0x00007FF7D3A50000-0x00007FF7D3E41000-memory.dmp	xmrig
behavioral2/memory/4444-2020-0x00007FF637B40000-0x00007FF637F31000-memory.dmp	xmrig
behavioral2/memory/1512-2022-0x00007FF7C6050000-0x00007FF7C6441000-memory.dmp	xmrig
behavioral2/memory/4400-2024-0x00007FF645360000-0x00007FF645751000-memory.dmp	xmrig
behavioral2/memory/1364-2029-0x00007FF672BD0000-0x00007FF672FC1000-memory.dmp	xmrig
behavioral2/memory/4516-2051-0x00007FF6126C0000-0x00007FF612AB1000-memory.dmp	xmrig
behavioral2/memory/4588-2060-0x00007FF775980000-0x00007FF775D71000-memory.dmp	xmrig
behavioral2/memory/1112-2059-0x00007FF6F0DA0000-0x00007FF6F1191000-memory.dmp	xmrig
behavioral2/memory/1092-2054-0x00007FF763FB0000-0x00007FF7643A1000-memory.dmp	xmrig
behavioral2/memory/2388-2052-0x00007FF6D4610000-0x00007FF6D4A01000-memory.dmp	xmrig
behavioral2/memory/4504-2049-0x00007FF7F3CF0000-0x00007FF7F40E1000-memory.dmp	xmrig
behavioral2/memory/1952-2044-0x00007FF6C9540000-0x00007FF6C9931000-memory.dmp	xmrig
behavioral2/memory/4872-2043-0x00007FF750D80000-0x00007FF751171000-memory.dmp	xmrig
behavioral2/memory/1592-2040-0x00007FF76BEF0000-0x00007FF76C2E1000-memory.dmp	xmrig
behavioral2/memory/1548-2039-0x00007FF6855D0000-0x00007FF6859C1000-memory.dmp	xmrig
behavioral2/memory/1604-2033-0x00007FF681DC0000-0x00007FF6821B1000-memory.dmp	xmrig
behavioral2/memory/1860-2031-0x00007FF673FF0000-0x00007FF6743E1000-memory.dmp	xmrig
behavioral2/memory/1644-2046-0x00007FF777210000-0x00007FF777601000-memory.dmp	xmrig
behavioral2/memory/2880-2027-0x00007FF6B57D0000-0x00007FF6B5BC1000-memory.dmp	xmrig
behavioral2/memory/872-2036-0x00007FF7FA9B0000-0x00007FF7FADA1000-memory.dmp	xmrig
behavioral2/memory/624-2035-0x00007FF6907F0000-0x00007FF690BE1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4868	NQvyjKI.exe
2744	mtFsxTx.exe
2348	IoiVnKn.exe
4444	ahpPede.exe
3348	BnzNZGs.exe
1512	eLmHDOJ.exe
4400	nlkCgta.exe
1644	VyZNtNU.exe
1860	uMJMkOy.exe
1364	BOHgQzZ.exe
1952	aWRciOx.exe
4872	sMvOnQi.exe
1548	NRiuOwQ.exe
1592	jQjsxfs.exe
624	SuRzMqE.exe
872	MlRCsHn.exe
1604	fJLQqlE.exe
2880	eHNZVYC.exe
4516	CgioZoR.exe
2388	XASWohP.exe
4504	DYpRkdj.exe
1112	dsswpNP.exe
4588	hqIhbUI.exe
1092	ycdvobi.exe
3088	EBubWBW.exe
1208	UxXqLRN.exe
4076	grkGrSM.exe
1532	BijMSCy.exe
1608	dQWdCwG.exe
4800	aEIElKI.exe
2064	qxWYsge.exe
2204	JxMUynx.exe
2992	mMycOsn.exe
2288	OGBQnlM.exe
4468	Sfxhsqk.exe
676	zDuXiIq.exe
2136	aUSziXz.exe
1096	cKxbdoX.exe
3840	hSWaTZZ.exe
2832	FQTJIUo.exe
4236	NYBoPlm.exe
2464	pxfNRxo.exe
3544	ZIURUWm.exe
3892	hFyKEXl.exe
3560	TNaUnef.exe
1412	VfZTQjv.exe
3908	UFvvlpt.exe
4332	uZsZpHX.exe
2956	kxqXEsc.exe
4736	NmDKUIG.exe
1960	PxMycgZ.exe
2448	xjphYdl.exe
3036	fNrgXnx.exe
2212	vfoitNB.exe
2756	dWOjDqD.exe
4968	kQAloWm.exe
3252	MPzYkHn.exe
2600	zndSsAS.exe
3272	OJVbean.exe
1676	TlWsKHP.exe
2660	etahgVn.exe
3424	uImBVbm.exe
2068	DsxWyEQ.exe
2968	jyiboEs.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1044-0-0x00007FF7802B0000-0x00007FF7806A1000-memory.dmp	upx
behavioral2/files/0x0008000000023400-6.dat	upx
behavioral2/files/0x0008000000023403-10.dat	upx
behavioral2/files/0x0007000000023404-8.dat	upx
behavioral2/files/0x0007000000023405-22.dat	upx
behavioral2/files/0x0007000000023406-28.dat	upx
behavioral2/files/0x0007000000023407-33.dat	upx
behavioral2/files/0x0007000000023408-38.dat	upx
behavioral2/files/0x0007000000023409-41.dat	upx
behavioral2/files/0x000700000002340a-46.dat	upx
behavioral2/files/0x000700000002340b-51.dat	upx
behavioral2/files/0x000700000002340c-58.dat	upx
behavioral2/files/0x000700000002340d-63.dat	upx
behavioral2/files/0x000700000002340e-68.dat	upx
behavioral2/files/0x0007000000023411-81.dat	upx
behavioral2/files/0x0007000000023416-108.dat	upx
behavioral2/files/0x000700000002341a-128.dat	upx
behavioral2/files/0x000700000002341d-141.dat	upx
behavioral2/memory/4400-370-0x00007FF645360000-0x00007FF645751000-memory.dmp	upx
behavioral2/memory/1644-376-0x00007FF777210000-0x00007FF777601000-memory.dmp	upx
behavioral2/memory/1364-387-0x00007FF672BD0000-0x00007FF672FC1000-memory.dmp	upx
behavioral2/memory/1860-382-0x00007FF673FF0000-0x00007FF6743E1000-memory.dmp	upx
behavioral2/memory/4872-405-0x00007FF750D80000-0x00007FF751171000-memory.dmp	upx
behavioral2/memory/1548-407-0x00007FF6855D0000-0x00007FF6859C1000-memory.dmp	upx
behavioral2/memory/1592-414-0x00007FF76BEF0000-0x00007FF76C2E1000-memory.dmp	upx
behavioral2/memory/872-419-0x00007FF7FA9B0000-0x00007FF7FADA1000-memory.dmp	upx
behavioral2/memory/624-418-0x00007FF6907F0000-0x00007FF690BE1000-memory.dmp	upx
behavioral2/memory/1952-393-0x00007FF6C9540000-0x00007FF6C9931000-memory.dmp	upx
behavioral2/memory/2880-428-0x00007FF6B57D0000-0x00007FF6B5BC1000-memory.dmp	upx
behavioral2/memory/4516-431-0x00007FF6126C0000-0x00007FF612AB1000-memory.dmp	upx
behavioral2/memory/1604-427-0x00007FF681DC0000-0x00007FF6821B1000-memory.dmp	upx
behavioral2/memory/3348-362-0x00007FF7D3A50000-0x00007FF7D3E41000-memory.dmp	upx
behavioral2/memory/2388-438-0x00007FF6D4610000-0x00007FF6D4A01000-memory.dmp	upx
behavioral2/memory/4504-441-0x00007FF7F3CF0000-0x00007FF7F40E1000-memory.dmp	upx
behavioral2/memory/4588-445-0x00007FF775980000-0x00007FF775D71000-memory.dmp	upx
behavioral2/memory/1092-447-0x00007FF763FB0000-0x00007FF7643A1000-memory.dmp	upx
behavioral2/memory/1112-442-0x00007FF6F0DA0000-0x00007FF6F1191000-memory.dmp	upx
behavioral2/memory/2348-450-0x00007FF63D590000-0x00007FF63D981000-memory.dmp	upx
behavioral2/memory/1512-456-0x00007FF7C6050000-0x00007FF7C6441000-memory.dmp	upx
behavioral2/memory/4444-455-0x00007FF637B40000-0x00007FF637F31000-memory.dmp	upx
behavioral2/files/0x0007000000023421-163.dat	upx
behavioral2/files/0x0007000000023420-158.dat	upx
behavioral2/files/0x000700000002341f-153.dat	upx
behavioral2/files/0x000700000002341e-148.dat	upx
behavioral2/files/0x000700000002341c-138.dat	upx
behavioral2/files/0x000700000002341b-133.dat	upx
behavioral2/files/0x0007000000023419-123.dat	upx
behavioral2/files/0x0007000000023418-118.dat	upx
behavioral2/files/0x0007000000023417-113.dat	upx
behavioral2/files/0x0007000000023415-103.dat	upx
behavioral2/files/0x0007000000023414-98.dat	upx
behavioral2/files/0x0007000000023413-93.dat	upx
behavioral2/files/0x0007000000023412-88.dat	upx
behavioral2/files/0x0007000000023410-78.dat	upx
behavioral2/files/0x000700000002340f-73.dat	upx
behavioral2/memory/2744-19-0x00007FF790000000-0x00007FF7903F1000-memory.dmp	upx
behavioral2/memory/4868-13-0x00007FF749780000-0x00007FF749B71000-memory.dmp	upx
behavioral2/memory/1044-1973-0x00007FF7802B0000-0x00007FF7806A1000-memory.dmp	upx
behavioral2/memory/3348-1975-0x00007FF7D3A50000-0x00007FF7D3E41000-memory.dmp	upx
behavioral2/memory/4868-2012-0x00007FF749780000-0x00007FF749B71000-memory.dmp	upx
behavioral2/memory/2744-2014-0x00007FF790000000-0x00007FF7903F1000-memory.dmp	upx
behavioral2/memory/2348-2016-0x00007FF63D590000-0x00007FF63D981000-memory.dmp	upx
behavioral2/memory/3348-2019-0x00007FF7D3A50000-0x00007FF7D3E41000-memory.dmp	upx
behavioral2/memory/4444-2020-0x00007FF637B40000-0x00007FF637F31000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\uImBVbm.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\rKbEisT.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\yGzgtBz.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\JrNEybo.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\zndSsAS.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\kLCouTP.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\qAJlTya.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\siXecmU.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\ikEyopr.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\PeBQISc.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\rBfFomk.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\CgioZoR.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\NQaRqnT.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\NnRDLbW.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\XHhdBMj.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\mmCsUyF.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\NPIdboc.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\oBeDPLw.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\ENZrxDp.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\JppUUqN.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\vvlSFhs.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\CmyjGBq.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\BkxhLdr.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\NiCEDru.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\qYjZTVF.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\oUdciVj.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\RFfIOUU.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\kQAloWm.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\jyiboEs.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\JwVilXk.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\WmUCUTl.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\QzjbKyL.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\xDfhkRS.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\grkGrSM.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\jqpUnul.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\NBceNWy.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\XGwXAAr.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\dfdgnFD.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\AUWElCg.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\nRgUogg.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\vLiXfMr.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\IQBkltm.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\uZsZpHX.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\PmuZqbr.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\whzMhRh.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\RoVeVNg.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\MwdlGJN.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\eTWBVkl.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\TNaUnef.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\KrmhHgQ.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\SaIplyP.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\RTWpjDk.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\qvRULYh.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\JbdOHgN.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\tjPORJR.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\ahpPede.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\DOhuBWp.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\ewMtvcZ.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\sMWFmBg.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\ylkgfIN.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\wCVcRIK.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\WIVBACB.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\DdLSRlk.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
File created	C:\Windows\System32\eLmHDOJ.exe	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 4868	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	83
PID 1044 wrote to memory of 4868	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	83
PID 1044 wrote to memory of 2744	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	84
PID 1044 wrote to memory of 2744	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	84
PID 1044 wrote to memory of 2348	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	85
PID 1044 wrote to memory of 2348	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	85
PID 1044 wrote to memory of 4444	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	86
PID 1044 wrote to memory of 4444	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	86
PID 1044 wrote to memory of 3348	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	87
PID 1044 wrote to memory of 3348	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	87
PID 1044 wrote to memory of 1512	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	88
PID 1044 wrote to memory of 1512	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	88
PID 1044 wrote to memory of 4400	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	89
PID 1044 wrote to memory of 4400	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	89
PID 1044 wrote to memory of 1644	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	90
PID 1044 wrote to memory of 1644	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	90
PID 1044 wrote to memory of 1860	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	91
PID 1044 wrote to memory of 1860	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	91
PID 1044 wrote to memory of 1364	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	92
PID 1044 wrote to memory of 1364	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	92
PID 1044 wrote to memory of 1952	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	93
PID 1044 wrote to memory of 1952	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	93
PID 1044 wrote to memory of 4872	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	94
PID 1044 wrote to memory of 4872	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	94
PID 1044 wrote to memory of 1548	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	95
PID 1044 wrote to memory of 1548	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	95
PID 1044 wrote to memory of 1592	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	96
PID 1044 wrote to memory of 1592	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	96
PID 1044 wrote to memory of 624	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	97
PID 1044 wrote to memory of 624	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	97
PID 1044 wrote to memory of 872	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	98
PID 1044 wrote to memory of 872	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	98
PID 1044 wrote to memory of 1604	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	99
PID 1044 wrote to memory of 1604	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	99
PID 1044 wrote to memory of 2880	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	100
PID 1044 wrote to memory of 2880	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	100
PID 1044 wrote to memory of 4516	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	101
PID 1044 wrote to memory of 4516	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	101
PID 1044 wrote to memory of 2388	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	102
PID 1044 wrote to memory of 2388	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	102
PID 1044 wrote to memory of 4504	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	103
PID 1044 wrote to memory of 4504	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	103
PID 1044 wrote to memory of 1112	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	104
PID 1044 wrote to memory of 1112	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	104
PID 1044 wrote to memory of 4588	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	105
PID 1044 wrote to memory of 4588	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	105
PID 1044 wrote to memory of 1092	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	106
PID 1044 wrote to memory of 1092	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	106
PID 1044 wrote to memory of 3088	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	107
PID 1044 wrote to memory of 3088	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	107
PID 1044 wrote to memory of 1208	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	108
PID 1044 wrote to memory of 1208	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	108
PID 1044 wrote to memory of 4076	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	109
PID 1044 wrote to memory of 4076	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	109
PID 1044 wrote to memory of 1532	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	110
PID 1044 wrote to memory of 1532	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	110
PID 1044 wrote to memory of 1608	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	111
PID 1044 wrote to memory of 1608	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	111
PID 1044 wrote to memory of 4800	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	112
PID 1044 wrote to memory of 4800	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	112
PID 1044 wrote to memory of 2064	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	113
PID 1044 wrote to memory of 2064	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	113
PID 1044 wrote to memory of 2204	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	114
PID 1044 wrote to memory of 2204	1044	08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08de224998c1409222adcd7c95ff55fe_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\System32\NQvyjKI.exe
  C:\Windows\System32\NQvyjKI.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System32\mtFsxTx.exe
  C:\Windows\System32\mtFsxTx.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System32\IoiVnKn.exe
  C:\Windows\System32\IoiVnKn.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System32\ahpPede.exe
  C:\Windows\System32\ahpPede.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System32\BnzNZGs.exe
  C:\Windows\System32\BnzNZGs.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System32\eLmHDOJ.exe
  C:\Windows\System32\eLmHDOJ.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System32\nlkCgta.exe
  C:\Windows\System32\nlkCgta.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System32\VyZNtNU.exe
  C:\Windows\System32\VyZNtNU.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System32\uMJMkOy.exe
  C:\Windows\System32\uMJMkOy.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System32\BOHgQzZ.exe
  C:\Windows\System32\BOHgQzZ.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System32\aWRciOx.exe
  C:\Windows\System32\aWRciOx.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System32\sMvOnQi.exe
  C:\Windows\System32\sMvOnQi.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System32\NRiuOwQ.exe
  C:\Windows\System32\NRiuOwQ.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System32\jQjsxfs.exe
  C:\Windows\System32\jQjsxfs.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System32\SuRzMqE.exe
  C:\Windows\System32\SuRzMqE.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System32\MlRCsHn.exe
  C:\Windows\System32\MlRCsHn.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System32\fJLQqlE.exe
  C:\Windows\System32\fJLQqlE.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System32\eHNZVYC.exe
  C:\Windows\System32\eHNZVYC.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System32\CgioZoR.exe
  C:\Windows\System32\CgioZoR.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System32\XASWohP.exe
  C:\Windows\System32\XASWohP.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System32\DYpRkdj.exe
  C:\Windows\System32\DYpRkdj.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System32\dsswpNP.exe
  C:\Windows\System32\dsswpNP.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System32\hqIhbUI.exe
  C:\Windows\System32\hqIhbUI.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System32\ycdvobi.exe
  C:\Windows\System32\ycdvobi.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System32\EBubWBW.exe
  C:\Windows\System32\EBubWBW.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System32\UxXqLRN.exe
  C:\Windows\System32\UxXqLRN.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System32\grkGrSM.exe
  C:\Windows\System32\grkGrSM.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System32\BijMSCy.exe
  C:\Windows\System32\BijMSCy.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System32\dQWdCwG.exe
  C:\Windows\System32\dQWdCwG.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System32\aEIElKI.exe
  C:\Windows\System32\aEIElKI.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System32\qxWYsge.exe
  C:\Windows\System32\qxWYsge.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System32\JxMUynx.exe
  C:\Windows\System32\JxMUynx.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System32\mMycOsn.exe
  C:\Windows\System32\mMycOsn.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System32\OGBQnlM.exe
  C:\Windows\System32\OGBQnlM.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System32\Sfxhsqk.exe
  C:\Windows\System32\Sfxhsqk.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System32\zDuXiIq.exe
  C:\Windows\System32\zDuXiIq.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System32\aUSziXz.exe
  C:\Windows\System32\aUSziXz.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System32\cKxbdoX.exe
  C:\Windows\System32\cKxbdoX.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System32\hSWaTZZ.exe
  C:\Windows\System32\hSWaTZZ.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System32\FQTJIUo.exe
  C:\Windows\System32\FQTJIUo.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System32\NYBoPlm.exe
  C:\Windows\System32\NYBoPlm.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System32\pxfNRxo.exe
  C:\Windows\System32\pxfNRxo.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System32\ZIURUWm.exe
  C:\Windows\System32\ZIURUWm.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System32\hFyKEXl.exe
  C:\Windows\System32\hFyKEXl.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System32\TNaUnef.exe
  C:\Windows\System32\TNaUnef.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System32\VfZTQjv.exe
  C:\Windows\System32\VfZTQjv.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System32\UFvvlpt.exe
  C:\Windows\System32\UFvvlpt.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System32\uZsZpHX.exe
  C:\Windows\System32\uZsZpHX.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System32\kxqXEsc.exe
  C:\Windows\System32\kxqXEsc.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System32\NmDKUIG.exe
  C:\Windows\System32\NmDKUIG.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System32\PxMycgZ.exe
  C:\Windows\System32\PxMycgZ.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System32\xjphYdl.exe
  C:\Windows\System32\xjphYdl.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System32\fNrgXnx.exe
  C:\Windows\System32\fNrgXnx.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System32\vfoitNB.exe
  C:\Windows\System32\vfoitNB.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System32\dWOjDqD.exe
  C:\Windows\System32\dWOjDqD.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System32\kQAloWm.exe
  C:\Windows\System32\kQAloWm.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System32\MPzYkHn.exe
  C:\Windows\System32\MPzYkHn.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System32\zndSsAS.exe
  C:\Windows\System32\zndSsAS.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System32\OJVbean.exe
  C:\Windows\System32\OJVbean.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System32\TlWsKHP.exe
  C:\Windows\System32\TlWsKHP.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System32\etahgVn.exe
  C:\Windows\System32\etahgVn.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System32\uImBVbm.exe
  C:\Windows\System32\uImBVbm.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System32\DsxWyEQ.exe
  C:\Windows\System32\DsxWyEQ.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System32\jyiboEs.exe
  C:\Windows\System32\jyiboEs.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System32\QkSuulS.exe
  C:\Windows\System32\QkSuulS.exe
  2⤵
  PID:4696
- C:\Windows\System32\dfdgnFD.exe
  C:\Windows\System32\dfdgnFD.exe
  2⤵
  PID:5056
- C:\Windows\System32\ylkgfIN.exe
  C:\Windows\System32\ylkgfIN.exe
  2⤵
  PID:3624
- C:\Windows\System32\GmJgLdZ.exe
  C:\Windows\System32\GmJgLdZ.exe
  2⤵
  PID:1780
- C:\Windows\System32\XTrwTkx.exe
  C:\Windows\System32\XTrwTkx.exe
  2⤵
  PID:2364
- C:\Windows\System32\SGHsEKX.exe
  C:\Windows\System32\SGHsEKX.exe
  2⤵
  PID:3360
- C:\Windows\System32\WeyRmjF.exe
  C:\Windows\System32\WeyRmjF.exe
  2⤵
  PID:2632
- C:\Windows\System32\MQOjsAk.exe
  C:\Windows\System32\MQOjsAk.exe
  2⤵
  PID:4712
- C:\Windows\System32\PCZmAEl.exe
  C:\Windows\System32\PCZmAEl.exe
  2⤵
  PID:1572
- C:\Windows\System32\sgXOMdb.exe
  C:\Windows\System32\sgXOMdb.exe
  2⤵
  PID:3408
- C:\Windows\System32\RlxhfuN.exe
  C:\Windows\System32\RlxhfuN.exe
  2⤵
  PID:5048
- C:\Windows\System32\PmuZqbr.exe
  C:\Windows\System32\PmuZqbr.exe
  2⤵
  PID:2072
- C:\Windows\System32\vTwhLOi.exe
  C:\Windows\System32\vTwhLOi.exe
  2⤵
  PID:2224
- C:\Windows\System32\wADzRax.exe
  C:\Windows\System32\wADzRax.exe
  2⤵
  PID:3600
- C:\Windows\System32\QDGWFeO.exe
  C:\Windows\System32\QDGWFeO.exe
  2⤵
  PID:3208
- C:\Windows\System32\XZfwEFf.exe
  C:\Windows\System32\XZfwEFf.exe
  2⤵
  PID:3776
- C:\Windows\System32\wTdBwAm.exe
  C:\Windows\System32\wTdBwAm.exe
  2⤵
  PID:1976
- C:\Windows\System32\oBdRGYg.exe
  C:\Windows\System32\oBdRGYg.exe
  2⤵
  PID:972
- C:\Windows\System32\oySyXfG.exe
  C:\Windows\System32\oySyXfG.exe
  2⤵
  PID:4608
- C:\Windows\System32\rcYfCmU.exe
  C:\Windows\System32\rcYfCmU.exe
  2⤵
  PID:2652
- C:\Windows\System32\OHETIQb.exe
  C:\Windows\System32\OHETIQb.exe
  2⤵
  PID:3256
- C:\Windows\System32\rlwjANY.exe
  C:\Windows\System32\rlwjANY.exe
  2⤵
  PID:1620
- C:\Windows\System32\PdXexgx.exe
  C:\Windows\System32\PdXexgx.exe
  2⤵
  PID:1564
- C:\Windows\System32\XzeyyRC.exe
  C:\Windows\System32\XzeyyRC.exe
  2⤵
  PID:5104
- C:\Windows\System32\wCVcRIK.exe
  C:\Windows\System32\wCVcRIK.exe
  2⤵
  PID:5132
- C:\Windows\System32\bsVRbLh.exe
  C:\Windows\System32\bsVRbLh.exe
  2⤵
  PID:5160
- C:\Windows\System32\rgFEcsC.exe
  C:\Windows\System32\rgFEcsC.exe
  2⤵
  PID:5188
- C:\Windows\System32\bPKSFhQ.exe
  C:\Windows\System32\bPKSFhQ.exe
  2⤵
  PID:5216
- C:\Windows\System32\yuYRGsd.exe
  C:\Windows\System32\yuYRGsd.exe
  2⤵
  PID:5244
- C:\Windows\System32\HjFGZOy.exe
  C:\Windows\System32\HjFGZOy.exe
  2⤵
  PID:5276
- C:\Windows\System32\KrmhHgQ.exe
  C:\Windows\System32\KrmhHgQ.exe
  2⤵
  PID:5304
- C:\Windows\System32\WIVBACB.exe
  C:\Windows\System32\WIVBACB.exe
  2⤵
  PID:5328
- C:\Windows\System32\nhVdsNT.exe
  C:\Windows\System32\nhVdsNT.exe
  2⤵
  PID:5360
- C:\Windows\System32\NyTLFSp.exe
  C:\Windows\System32\NyTLFSp.exe
  2⤵
  PID:5388
- C:\Windows\System32\DlBLFIF.exe
  C:\Windows\System32\DlBLFIF.exe
  2⤵
  PID:5432
- C:\Windows\System32\FNPWqpL.exe
  C:\Windows\System32\FNPWqpL.exe
  2⤵
  PID:5460
- C:\Windows\System32\hLijmGZ.exe
  C:\Windows\System32\hLijmGZ.exe
  2⤵
  PID:5476
- C:\Windows\System32\umzGVaa.exe
  C:\Windows\System32\umzGVaa.exe
  2⤵
  PID:5496
- C:\Windows\System32\IpnkWUM.exe
  C:\Windows\System32\IpnkWUM.exe
  2⤵
  PID:5516
- C:\Windows\System32\LZvqPjK.exe
  C:\Windows\System32\LZvqPjK.exe
  2⤵
  PID:5544
- C:\Windows\System32\KWXWTsc.exe
  C:\Windows\System32\KWXWTsc.exe
  2⤵
  PID:5568
- C:\Windows\System32\OLPvfoP.exe
  C:\Windows\System32\OLPvfoP.exe
  2⤵
  PID:5600
- C:\Windows\System32\aojavWz.exe
  C:\Windows\System32\aojavWz.exe
  2⤵
  PID:5620
- C:\Windows\System32\FuTRwhb.exe
  C:\Windows\System32\FuTRwhb.exe
  2⤵
  PID:5636
- C:\Windows\System32\JwVilXk.exe
  C:\Windows\System32\JwVilXk.exe
  2⤵
  PID:5664
- C:\Windows\System32\ePoRVVg.exe
  C:\Windows\System32\ePoRVVg.exe
  2⤵
  PID:5684
- C:\Windows\System32\MHlsggh.exe
  C:\Windows\System32\MHlsggh.exe
  2⤵
  PID:5704
- C:\Windows\System32\mBSXfpU.exe
  C:\Windows\System32\mBSXfpU.exe
  2⤵
  PID:5724
- C:\Windows\System32\vvlSFhs.exe
  C:\Windows\System32\vvlSFhs.exe
  2⤵
  PID:5740
- C:\Windows\System32\euEZxff.exe
  C:\Windows\System32\euEZxff.exe
  2⤵
  PID:5760
- C:\Windows\System32\MlhKqSY.exe
  C:\Windows\System32\MlhKqSY.exe
  2⤵
  PID:5844
- C:\Windows\System32\LkUUZoQ.exe
  C:\Windows\System32\LkUUZoQ.exe
  2⤵
  PID:5936
- C:\Windows\System32\kgKSJIC.exe
  C:\Windows\System32\kgKSJIC.exe
  2⤵
  PID:5992
- C:\Windows\System32\rBpHgnE.exe
  C:\Windows\System32\rBpHgnE.exe
  2⤵
  PID:6020
- C:\Windows\System32\zgDwyNP.exe
  C:\Windows\System32\zgDwyNP.exe
  2⤵
  PID:6044
- C:\Windows\System32\kFjqWaN.exe
  C:\Windows\System32\kFjqWaN.exe
  2⤵
  PID:6108
- C:\Windows\System32\QvlFoPj.exe
  C:\Windows\System32\QvlFoPj.exe
  2⤵
  PID:6128
- C:\Windows\System32\bqqijTn.exe
  C:\Windows\System32\bqqijTn.exe
  2⤵
  PID:4984
- C:\Windows\System32\ySZuRCe.exe
  C:\Windows\System32\ySZuRCe.exe
  2⤵
  PID:1836
- C:\Windows\System32\xdAqyzF.exe
  C:\Windows\System32\xdAqyzF.exe
  2⤵
  PID:864
- C:\Windows\System32\icafcol.exe
  C:\Windows\System32\icafcol.exe
  2⤵
  PID:5184
- C:\Windows\System32\vORjGbf.exe
  C:\Windows\System32\vORjGbf.exe
  2⤵
  PID:5212
- C:\Windows\System32\KfdFEDA.exe
  C:\Windows\System32\KfdFEDA.exe
  2⤵
  PID:1712
- C:\Windows\System32\pUOBhAc.exe
  C:\Windows\System32\pUOBhAc.exe
  2⤵
  PID:4572
- C:\Windows\System32\jWHxAYT.exe
  C:\Windows\System32\jWHxAYT.exe
  2⤵
  PID:580
- C:\Windows\System32\vVQNFoG.exe
  C:\Windows\System32\vVQNFoG.exe
  2⤵
  PID:5340
- C:\Windows\System32\yhxcIdF.exe
  C:\Windows\System32\yhxcIdF.exe
  2⤵
  PID:3404
- C:\Windows\System32\eQkoLMk.exe
  C:\Windows\System32\eQkoLMk.exe
  2⤵
  PID:4644
- C:\Windows\System32\rKbEisT.exe
  C:\Windows\System32\rKbEisT.exe
  2⤵
  PID:5012
- C:\Windows\System32\nTZFcSI.exe
  C:\Windows\System32\nTZFcSI.exe
  2⤵
  PID:1680
- C:\Windows\System32\GUmrfWh.exe
  C:\Windows\System32\GUmrfWh.exe
  2⤵
  PID:5504
- C:\Windows\System32\GHwqrRd.exe
  C:\Windows\System32\GHwqrRd.exe
  2⤵
  PID:5444
- C:\Windows\System32\kLCouTP.exe
  C:\Windows\System32\kLCouTP.exe
  2⤵
  PID:5456
- C:\Windows\System32\SaIplyP.exe
  C:\Windows\System32\SaIplyP.exe
  2⤵
  PID:5632
- C:\Windows\System32\nNUywDI.exe
  C:\Windows\System32\nNUywDI.exe
  2⤵
  PID:5768
- C:\Windows\System32\WKeAAuN.exe
  C:\Windows\System32\WKeAAuN.exe
  2⤵
  PID:5732
- C:\Windows\System32\YVViFhG.exe
  C:\Windows\System32\YVViFhG.exe
  2⤵
  PID:5960
- C:\Windows\System32\KnMZQZi.exe
  C:\Windows\System32\KnMZQZi.exe
  2⤵
  PID:6036
- C:\Windows\System32\sGgxnCg.exe
  C:\Windows\System32\sGgxnCg.exe
  2⤵
  PID:3384
- C:\Windows\System32\YFZjOZF.exe
  C:\Windows\System32\YFZjOZF.exe
  2⤵
  PID:5908
- C:\Windows\System32\KmBaxvf.exe
  C:\Windows\System32\KmBaxvf.exe
  2⤵
  PID:2216
- C:\Windows\System32\UfFyYan.exe
  C:\Windows\System32\UfFyYan.exe
  2⤵
  PID:5492
- C:\Windows\System32\NtVQNtE.exe
  C:\Windows\System32\NtVQNtE.exe
  2⤵
  PID:5608
- C:\Windows\System32\vCgzDQd.exe
  C:\Windows\System32\vCgzDQd.exe
  2⤵
  PID:5556
- C:\Windows\System32\QJXSZCV.exe
  C:\Windows\System32\QJXSZCV.exe
  2⤵
  PID:5856
- C:\Windows\System32\yniFXKt.exe
  C:\Windows\System32\yniFXKt.exe
  2⤵
  PID:6032
- C:\Windows\System32\WlHzNXh.exe
  C:\Windows\System32\WlHzNXh.exe
  2⤵
  PID:3092
- C:\Windows\System32\DJwdRVX.exe
  C:\Windows\System32\DJwdRVX.exe
  2⤵
  PID:5644
- C:\Windows\System32\ktLprIl.exe
  C:\Windows\System32\ktLprIl.exe
  2⤵
  PID:5964
- C:\Windows\System32\UXuZQDP.exe
  C:\Windows\System32\UXuZQDP.exe
  2⤵
  PID:4828
- C:\Windows\System32\IQBkltm.exe
  C:\Windows\System32\IQBkltm.exe
  2⤵
  PID:6004
- C:\Windows\System32\CmyjGBq.exe
  C:\Windows\System32\CmyjGBq.exe
  2⤵
  PID:6120
- C:\Windows\System32\qAJlTya.exe
  C:\Windows\System32\qAJlTya.exe
  2⤵
  PID:4348
- C:\Windows\System32\PoTHker.exe
  C:\Windows\System32\PoTHker.exe
  2⤵
  PID:5808
- C:\Windows\System32\AkfWcIq.exe
  C:\Windows\System32\AkfWcIq.exe
  2⤵
  PID:5408
- C:\Windows\System32\ojevkbm.exe
  C:\Windows\System32\ojevkbm.exe
  2⤵
  PID:4820
- C:\Windows\System32\Vovddav.exe
  C:\Windows\System32\Vovddav.exe
  2⤵
  PID:6140
- C:\Windows\System32\yWIuYwy.exe
  C:\Windows\System32\yWIuYwy.exe
  2⤵
  PID:4132
- C:\Windows\System32\OQQeaYk.exe
  C:\Windows\System32\OQQeaYk.exe
  2⤵
  PID:6156
- C:\Windows\System32\okPwqjc.exe
  C:\Windows\System32\okPwqjc.exe
  2⤵
  PID:6180
- C:\Windows\System32\fLGHzzU.exe
  C:\Windows\System32\fLGHzzU.exe
  2⤵
  PID:6196
- C:\Windows\System32\FcqYItN.exe
  C:\Windows\System32\FcqYItN.exe
  2⤵
  PID:6236
- C:\Windows\System32\ECBWYOf.exe
  C:\Windows\System32\ECBWYOf.exe
  2⤵
  PID:6252
- C:\Windows\System32\ICWsjfC.exe
  C:\Windows\System32\ICWsjfC.exe
  2⤵
  PID:6280
- C:\Windows\System32\Ydbbami.exe
  C:\Windows\System32\Ydbbami.exe
  2⤵
  PID:6340
- C:\Windows\System32\FJUjbqg.exe
  C:\Windows\System32\FJUjbqg.exe
  2⤵
  PID:6364
- C:\Windows\System32\xczNOMK.exe
  C:\Windows\System32\xczNOMK.exe
  2⤵
  PID:6380
- C:\Windows\System32\FqOjHQI.exe
  C:\Windows\System32\FqOjHQI.exe
  2⤵
  PID:6400
- C:\Windows\System32\BkxhLdr.exe
  C:\Windows\System32\BkxhLdr.exe
  2⤵
  PID:6420
- C:\Windows\System32\MBgXBUE.exe
  C:\Windows\System32\MBgXBUE.exe
  2⤵
  PID:6460
- C:\Windows\System32\inHBGOl.exe
  C:\Windows\System32\inHBGOl.exe
  2⤵
  PID:6476
- C:\Windows\System32\phYXDWe.exe
  C:\Windows\System32\phYXDWe.exe
  2⤵
  PID:6500
- C:\Windows\System32\HgiIJqU.exe
  C:\Windows\System32\HgiIJqU.exe
  2⤵
  PID:6520
- C:\Windows\System32\SiGtzkB.exe
  C:\Windows\System32\SiGtzkB.exe
  2⤵
  PID:6572
- C:\Windows\System32\ouiMVnZ.exe
  C:\Windows\System32\ouiMVnZ.exe
  2⤵
  PID:6620
- C:\Windows\System32\aiNelsv.exe
  C:\Windows\System32\aiNelsv.exe
  2⤵
  PID:6648
- C:\Windows\System32\DOhuBWp.exe
  C:\Windows\System32\DOhuBWp.exe
  2⤵
  PID:6676
- C:\Windows\System32\BUEnxpH.exe
  C:\Windows\System32\BUEnxpH.exe
  2⤵
  PID:6696
- C:\Windows\System32\CAGUUBr.exe
  C:\Windows\System32\CAGUUBr.exe
  2⤵
  PID:6720
- C:\Windows\System32\whzMhRh.exe
  C:\Windows\System32\whzMhRh.exe
  2⤵
  PID:6760
- C:\Windows\System32\NiCEDru.exe
  C:\Windows\System32\NiCEDru.exe
  2⤵
  PID:6776
- C:\Windows\System32\mJrfLoR.exe
  C:\Windows\System32\mJrfLoR.exe
  2⤵
  PID:6804
- C:\Windows\System32\JraiIQa.exe
  C:\Windows\System32\JraiIQa.exe
  2⤵
  PID:6832
- C:\Windows\System32\sjMzNrP.exe
  C:\Windows\System32\sjMzNrP.exe
  2⤵
  PID:6880
- C:\Windows\System32\RoVeVNg.exe
  C:\Windows\System32\RoVeVNg.exe
  2⤵
  PID:6900
- C:\Windows\System32\EyGbObl.exe
  C:\Windows\System32\EyGbObl.exe
  2⤵
  PID:6920
- C:\Windows\System32\mVoPtNH.exe
  C:\Windows\System32\mVoPtNH.exe
  2⤵
  PID:6940
- C:\Windows\System32\lELvfPi.exe
  C:\Windows\System32\lELvfPi.exe
  2⤵
  PID:6964
- C:\Windows\System32\cSRXVzp.exe
  C:\Windows\System32\cSRXVzp.exe
  2⤵
  PID:7000
- C:\Windows\System32\bHzjxWS.exe
  C:\Windows\System32\bHzjxWS.exe
  2⤵
  PID:7024
- C:\Windows\System32\EGmeKoy.exe
  C:\Windows\System32\EGmeKoy.exe
  2⤵
  PID:7052
- C:\Windows\System32\jtEYOsj.exe
  C:\Windows\System32\jtEYOsj.exe
  2⤵
  PID:7088
- C:\Windows\System32\yiTdKmU.exe
  C:\Windows\System32\yiTdKmU.exe
  2⤵
  PID:7112
- C:\Windows\System32\RypEyug.exe
  C:\Windows\System32\RypEyug.exe
  2⤵
  PID:7140
- C:\Windows\System32\KUTYaIz.exe
  C:\Windows\System32\KUTYaIz.exe
  2⤵
  PID:7160
- C:\Windows\System32\iGBvTZc.exe
  C:\Windows\System32\iGBvTZc.exe
  2⤵
  PID:6192
- C:\Windows\System32\KlABGOt.exe
  C:\Windows\System32\KlABGOt.exe
  2⤵
  PID:6244
- C:\Windows\System32\qYjZTVF.exe
  C:\Windows\System32\qYjZTVF.exe
  2⤵
  PID:6320
- C:\Windows\System32\nJjxFGn.exe
  C:\Windows\System32\nJjxFGn.exe
  2⤵
  PID:6356
- C:\Windows\System32\bBIWcZO.exe
  C:\Windows\System32\bBIWcZO.exe
  2⤵
  PID:6472
- C:\Windows\System32\TaivHXA.exe
  C:\Windows\System32\TaivHXA.exe
  2⤵
  PID:6540
- C:\Windows\System32\YscHRcm.exe
  C:\Windows\System32\YscHRcm.exe
  2⤵
  PID:6584
- C:\Windows\System32\YDTDRHS.exe
  C:\Windows\System32\YDTDRHS.exe
  2⤵
  PID:6636
- C:\Windows\System32\oBeDPLw.exe
  C:\Windows\System32\oBeDPLw.exe
  2⤵
  PID:6692
- C:\Windows\System32\swTmUqt.exe
  C:\Windows\System32\swTmUqt.exe
  2⤵
  PID:6744
- C:\Windows\System32\PNEJbCl.exe
  C:\Windows\System32\PNEJbCl.exe
  2⤵
  PID:6840
- C:\Windows\System32\crscwwI.exe
  C:\Windows\System32\crscwwI.exe
  2⤵
  PID:6956
- C:\Windows\System32\QCBnOBG.exe
  C:\Windows\System32\QCBnOBG.exe
  2⤵
  PID:6952
- C:\Windows\System32\FwGWrJl.exe
  C:\Windows\System32\FwGWrJl.exe
  2⤵
  PID:6996
- C:\Windows\System32\eQyjwuy.exe
  C:\Windows\System32\eQyjwuy.exe
  2⤵
  PID:7036
- C:\Windows\System32\VYQfAPg.exe
  C:\Windows\System32\VYQfAPg.exe
  2⤵
  PID:7136
- C:\Windows\System32\moUewXD.exe
  C:\Windows\System32\moUewXD.exe
  2⤵
  PID:6228
- C:\Windows\System32\qKKgTco.exe
  C:\Windows\System32\qKKgTco.exe
  2⤵
  PID:6440
- C:\Windows\System32\UGvCWtW.exe
  C:\Windows\System32\UGvCWtW.exe
  2⤵
  PID:6632
- C:\Windows\System32\QZCIDQD.exe
  C:\Windows\System32\QZCIDQD.exe
  2⤵
  PID:6736
- C:\Windows\System32\hDZMCRs.exe
  C:\Windows\System32\hDZMCRs.exe
  2⤵
  PID:6816
- C:\Windows\System32\wZKLETk.exe
  C:\Windows\System32\wZKLETk.exe
  2⤵
  PID:6992
- C:\Windows\System32\tgzXluo.exe
  C:\Windows\System32\tgzXluo.exe
  2⤵
  PID:7124
- C:\Windows\System32\yaKNgJn.exe
  C:\Windows\System32\yaKNgJn.exe
  2⤵
  PID:6188
- C:\Windows\System32\umumEfV.exe
  C:\Windows\System32\umumEfV.exe
  2⤵
  PID:6660
- C:\Windows\System32\HhShRfq.exe
  C:\Windows\System32\HhShRfq.exe
  2⤵
  PID:6928
- C:\Windows\System32\ymJDgJO.exe
  C:\Windows\System32\ymJDgJO.exe
  2⤵
  PID:6564
- C:\Windows\System32\siXecmU.exe
  C:\Windows\System32\siXecmU.exe
  2⤵
  PID:6800
- C:\Windows\System32\beHVcQB.exe
  C:\Windows\System32\beHVcQB.exe
  2⤵
  PID:7208
- C:\Windows\System32\PjONtKx.exe
  C:\Windows\System32\PjONtKx.exe
  2⤵
  PID:7236
- C:\Windows\System32\NQaRqnT.exe
  C:\Windows\System32\NQaRqnT.exe
  2⤵
  PID:7252
- C:\Windows\System32\cWFCJNO.exe
  C:\Windows\System32\cWFCJNO.exe
  2⤵
  PID:7280
- C:\Windows\System32\IjJTrKc.exe
  C:\Windows\System32\IjJTrKc.exe
  2⤵
  PID:7312
- C:\Windows\System32\aTJgYZE.exe
  C:\Windows\System32\aTJgYZE.exe
  2⤵
  PID:7332
- C:\Windows\System32\PzjjvSS.exe
  C:\Windows\System32\PzjjvSS.exe
  2⤵
  PID:7376
- C:\Windows\System32\GoyQCFP.exe
  C:\Windows\System32\GoyQCFP.exe
  2⤵
  PID:7404
- C:\Windows\System32\pcXUpXt.exe
  C:\Windows\System32\pcXUpXt.exe
  2⤵
  PID:7428
- C:\Windows\System32\cwvZtWU.exe
  C:\Windows\System32\cwvZtWU.exe
  2⤵
  PID:7448
- C:\Windows\System32\akTYIYQ.exe
  C:\Windows\System32\akTYIYQ.exe
  2⤵
  PID:7476
- C:\Windows\System32\UtsADYI.exe
  C:\Windows\System32\UtsADYI.exe
  2⤵
  PID:7516
- C:\Windows\System32\SVRrziL.exe
  C:\Windows\System32\SVRrziL.exe
  2⤵
  PID:7540
- C:\Windows\System32\IvEGnTL.exe
  C:\Windows\System32\IvEGnTL.exe
  2⤵
  PID:7584
- C:\Windows\System32\QKHuCvt.exe
  C:\Windows\System32\QKHuCvt.exe
  2⤵
  PID:7600
- C:\Windows\System32\nKnqgBA.exe
  C:\Windows\System32\nKnqgBA.exe
  2⤵
  PID:7616
- C:\Windows\System32\msPnHom.exe
  C:\Windows\System32\msPnHom.exe
  2⤵
  PID:7640
- C:\Windows\System32\pRDzkrB.exe
  C:\Windows\System32\pRDzkrB.exe
  2⤵
  PID:7684
- C:\Windows\System32\fmwSKQZ.exe
  C:\Windows\System32\fmwSKQZ.exe
  2⤵
  PID:7712
- C:\Windows\System32\OqqIEJW.exe
  C:\Windows\System32\OqqIEJW.exe
  2⤵
  PID:7740
- C:\Windows\System32\CylnRSs.exe
  C:\Windows\System32\CylnRSs.exe
  2⤵
  PID:7768
- C:\Windows\System32\qiXrILU.exe
  C:\Windows\System32\qiXrILU.exe
  2⤵
  PID:7784
- C:\Windows\System32\zccgTvZ.exe
  C:\Windows\System32\zccgTvZ.exe
  2⤵
  PID:7804
- C:\Windows\System32\WARucgw.exe
  C:\Windows\System32\WARucgw.exe
  2⤵
  PID:7840
- C:\Windows\System32\MfpvqDN.exe
  C:\Windows\System32\MfpvqDN.exe
  2⤵
  PID:7860
- C:\Windows\System32\bEseDkR.exe
  C:\Windows\System32\bEseDkR.exe
  2⤵
  PID:7884
- C:\Windows\System32\mFNnwHO.exe
  C:\Windows\System32\mFNnwHO.exe
  2⤵
  PID:7908
- C:\Windows\System32\yonspLe.exe
  C:\Windows\System32\yonspLe.exe
  2⤵
  PID:7964
- C:\Windows\System32\UHrbJQa.exe
  C:\Windows\System32\UHrbJQa.exe
  2⤵
  PID:7984
- C:\Windows\System32\ABtMEWi.exe
  C:\Windows\System32\ABtMEWi.exe
  2⤵
  PID:8012
- C:\Windows\System32\uFiitmh.exe
  C:\Windows\System32\uFiitmh.exe
  2⤵
  PID:8036
- C:\Windows\System32\GaGtRht.exe
  C:\Windows\System32\GaGtRht.exe
  2⤵
  PID:8056
- C:\Windows\System32\NnRDLbW.exe
  C:\Windows\System32\NnRDLbW.exe
  2⤵
  PID:8092
- C:\Windows\System32\QpzTKaB.exe
  C:\Windows\System32\QpzTKaB.exe
  2⤵
  PID:8120
- C:\Windows\System32\LzKzLLN.exe
  C:\Windows\System32\LzKzLLN.exe
  2⤵
  PID:8140
- C:\Windows\System32\GjdocTa.exe
  C:\Windows\System32\GjdocTa.exe
  2⤵
  PID:6768
- C:\Windows\System32\JppUUqN.exe
  C:\Windows\System32\JppUUqN.exe
  2⤵
  PID:7220
- C:\Windows\System32\pawIpVj.exe
  C:\Windows\System32\pawIpVj.exe
  2⤵
  PID:7264
- C:\Windows\System32\yinSxds.exe
  C:\Windows\System32\yinSxds.exe
  2⤵
  PID:7356
- C:\Windows\System32\KhKBowR.exe
  C:\Windows\System32\KhKBowR.exe
  2⤵
  PID:7392
- C:\Windows\System32\giknrsa.exe
  C:\Windows\System32\giknrsa.exe
  2⤵
  PID:7444
- C:\Windows\System32\CMHyKfD.exe
  C:\Windows\System32\CMHyKfD.exe
  2⤵
  PID:7472
- C:\Windows\System32\TPVbyjO.exe
  C:\Windows\System32\TPVbyjO.exe
  2⤵
  PID:7572
- C:\Windows\System32\gahwpzj.exe
  C:\Windows\System32\gahwpzj.exe
  2⤵
  PID:7596
- C:\Windows\System32\idfEqnN.exe
  C:\Windows\System32\idfEqnN.exe
  2⤵
  PID:7628
- C:\Windows\System32\rQesOVi.exe
  C:\Windows\System32\rQesOVi.exe
  2⤵
  PID:7708
- C:\Windows\System32\lEKUSUn.exe
  C:\Windows\System32\lEKUSUn.exe
  2⤵
  PID:7764
- C:\Windows\System32\WOPBwCd.exe
  C:\Windows\System32\WOPBwCd.exe
  2⤵
  PID:7948
- C:\Windows\System32\WQYZEru.exe
  C:\Windows\System32\WQYZEru.exe
  2⤵
  PID:7996
- C:\Windows\System32\kSocxbW.exe
  C:\Windows\System32\kSocxbW.exe
  2⤵
  PID:8088
- C:\Windows\System32\KvCgbmu.exe
  C:\Windows\System32\KvCgbmu.exe
  2⤵
  PID:8104
- C:\Windows\System32\ViniqmY.exe
  C:\Windows\System32\ViniqmY.exe
  2⤵
  PID:8160
- C:\Windows\System32\IfdgwTI.exe
  C:\Windows\System32\IfdgwTI.exe
  2⤵
  PID:7192
- C:\Windows\System32\LpiHWAv.exe
  C:\Windows\System32\LpiHWAv.exe
  2⤵
  PID:7348
- C:\Windows\System32\LtnJtdW.exe
  C:\Windows\System32\LtnJtdW.exe
  2⤵
  PID:7400
- C:\Windows\System32\jyVVxmm.exe
  C:\Windows\System32\jyVVxmm.exe
  2⤵
  PID:7672
- C:\Windows\System32\lOBTpZi.exe
  C:\Windows\System32\lOBTpZi.exe
  2⤵
  PID:7664
- C:\Windows\System32\lvGKqNf.exe
  C:\Windows\System32\lvGKqNf.exe
  2⤵
  PID:7828
- C:\Windows\System32\HNoSgCp.exe
  C:\Windows\System32\HNoSgCp.exe
  2⤵
  PID:8028
- C:\Windows\System32\obHcPhs.exe
  C:\Windows\System32\obHcPhs.exe
  2⤵
  PID:7468
- C:\Windows\System32\KdpyQZp.exe
  C:\Windows\System32\KdpyQZp.exe
  2⤵
  PID:7276
- C:\Windows\System32\OlCsMIh.exe
  C:\Windows\System32\OlCsMIh.exe
  2⤵
  PID:7244
- C:\Windows\System32\oPGxQUT.exe
  C:\Windows\System32\oPGxQUT.exe
  2⤵
  PID:8156
- C:\Windows\System32\RtNzHiK.exe
  C:\Windows\System32\RtNzHiK.exe
  2⤵
  PID:8200
- C:\Windows\System32\DJCBESN.exe
  C:\Windows\System32\DJCBESN.exe
  2⤵
  PID:8220
- C:\Windows\System32\WWpnTvc.exe
  C:\Windows\System32\WWpnTvc.exe
  2⤵
  PID:8248
- C:\Windows\System32\mztyyBl.exe
  C:\Windows\System32\mztyyBl.exe
  2⤵
  PID:8276
- C:\Windows\System32\ZPTeIIg.exe
  C:\Windows\System32\ZPTeIIg.exe
  2⤵
  PID:8296
- C:\Windows\System32\GgTvMnL.exe
  C:\Windows\System32\GgTvMnL.exe
  2⤵
  PID:8356
- C:\Windows\System32\VLUbZkC.exe
  C:\Windows\System32\VLUbZkC.exe
  2⤵
  PID:8372
- C:\Windows\System32\bhGRXPC.exe
  C:\Windows\System32\bhGRXPC.exe
  2⤵
  PID:8388
- C:\Windows\System32\ewMtvcZ.exe
  C:\Windows\System32\ewMtvcZ.exe
  2⤵
  PID:8448
- C:\Windows\System32\SruhVWp.exe
  C:\Windows\System32\SruhVWp.exe
  2⤵
  PID:8508
- C:\Windows\System32\RcqalBa.exe
  C:\Windows\System32\RcqalBa.exe
  2⤵
  PID:8524
- C:\Windows\System32\iOOYeHA.exe
  C:\Windows\System32\iOOYeHA.exe
  2⤵
  PID:8540
- C:\Windows\System32\XNqCWHL.exe
  C:\Windows\System32\XNqCWHL.exe
  2⤵
  PID:8556
- C:\Windows\System32\yVlNgvl.exe
  C:\Windows\System32\yVlNgvl.exe
  2⤵
  PID:8572
- C:\Windows\System32\BbkGMox.exe
  C:\Windows\System32\BbkGMox.exe
  2⤵
  PID:8588
- C:\Windows\System32\yGzgtBz.exe
  C:\Windows\System32\yGzgtBz.exe
  2⤵
  PID:8604
- C:\Windows\System32\sPPaYmw.exe
  C:\Windows\System32\sPPaYmw.exe
  2⤵
  PID:8620
- C:\Windows\System32\OnjHpvw.exe
  C:\Windows\System32\OnjHpvw.exe
  2⤵
  PID:8636
- C:\Windows\System32\KANthqf.exe
  C:\Windows\System32\KANthqf.exe
  2⤵
  PID:8664
- C:\Windows\System32\ZWKMtyH.exe
  C:\Windows\System32\ZWKMtyH.exe
  2⤵
  PID:8684
- C:\Windows\System32\WSgWvYN.exe
  C:\Windows\System32\WSgWvYN.exe
  2⤵
  PID:8704
- C:\Windows\System32\TDgkRmj.exe
  C:\Windows\System32\TDgkRmj.exe
  2⤵
  PID:8724
- C:\Windows\System32\osDOsrv.exe
  C:\Windows\System32\osDOsrv.exe
  2⤵
  PID:8744
- C:\Windows\System32\cvMPgoS.exe
  C:\Windows\System32\cvMPgoS.exe
  2⤵
  PID:8916
- C:\Windows\System32\qBtwFOA.exe
  C:\Windows\System32\qBtwFOA.exe
  2⤵
  PID:8940
- C:\Windows\System32\laYeuXf.exe
  C:\Windows\System32\laYeuXf.exe
  2⤵
  PID:8956
- C:\Windows\System32\DQubBNb.exe
  C:\Windows\System32\DQubBNb.exe
  2⤵
  PID:8980
- C:\Windows\System32\gRVqFDC.exe
  C:\Windows\System32\gRVqFDC.exe
  2⤵
  PID:9008
- C:\Windows\System32\jqpUnul.exe
  C:\Windows\System32\jqpUnul.exe
  2⤵
  PID:9068
- C:\Windows\System32\RmioQqH.exe
  C:\Windows\System32\RmioQqH.exe
  2⤵
  PID:9096
- C:\Windows\System32\mxWYJJW.exe
  C:\Windows\System32\mxWYJJW.exe
  2⤵
  PID:9124
- C:\Windows\System32\ovQmhPt.exe
  C:\Windows\System32\ovQmhPt.exe
  2⤵
  PID:9140
- C:\Windows\System32\qrHVIhS.exe
  C:\Windows\System32\qrHVIhS.exe
  2⤵
  PID:9160
- C:\Windows\System32\HAJhbvQ.exe
  C:\Windows\System32\HAJhbvQ.exe
  2⤵
  PID:9188
- C:\Windows\System32\UlOeOZJ.exe
  C:\Windows\System32\UlOeOZJ.exe
  2⤵
  PID:7824
- C:\Windows\System32\RTWpjDk.exe
  C:\Windows\System32\RTWpjDk.exe
  2⤵
  PID:8308
- C:\Windows\System32\AUWElCg.exe
  C:\Windows\System32\AUWElCg.exe
  2⤵
  PID:8328
- C:\Windows\System32\vkGbRWr.exe
  C:\Windows\System32\vkGbRWr.exe
  2⤵
  PID:8380
- C:\Windows\System32\YFmnXYE.exe
  C:\Windows\System32\YFmnXYE.exe
  2⤵
  PID:8484
- C:\Windows\System32\fsSIUYl.exe
  C:\Windows\System32\fsSIUYl.exe
  2⤵
  PID:8428
- C:\Windows\System32\vNxvTcc.exe
  C:\Windows\System32\vNxvTcc.exe
  2⤵
  PID:8612
- C:\Windows\System32\NsxHcnr.exe
  C:\Windows\System32\NsxHcnr.exe
  2⤵
  PID:8488
- C:\Windows\System32\SSXpNJU.exe
  C:\Windows\System32\SSXpNJU.exe
  2⤵
  PID:8596
- C:\Windows\System32\XQIDQzu.exe
  C:\Windows\System32\XQIDQzu.exe
  2⤵
  PID:8532
- C:\Windows\System32\VfnAnQU.exe
  C:\Windows\System32\VfnAnQU.exe
  2⤵
  PID:8740
- C:\Windows\System32\DdLSRlk.exe
  C:\Windows\System32\DdLSRlk.exe
  2⤵
  PID:8840
- C:\Windows\System32\SuDeCwu.exe
  C:\Windows\System32\SuDeCwu.exe
  2⤵
  PID:8848
- C:\Windows\System32\SCVRJpA.exe
  C:\Windows\System32\SCVRJpA.exe
  2⤵
  PID:8996
- C:\Windows\System32\aZlLEKE.exe
  C:\Windows\System32\aZlLEKE.exe
  2⤵
  PID:9048
- C:\Windows\System32\hEhDlFy.exe
  C:\Windows\System32\hEhDlFy.exe
  2⤵
  PID:9120
- C:\Windows\System32\iheaYrt.exe
  C:\Windows\System32\iheaYrt.exe
  2⤵
  PID:9184
- C:\Windows\System32\zwdHGTh.exe
  C:\Windows\System32\zwdHGTh.exe
  2⤵
  PID:9212
- C:\Windows\System32\JJckmWj.exe
  C:\Windows\System32\JJckmWj.exe
  2⤵
  PID:8364
- C:\Windows\System32\kidvsWa.exe
  C:\Windows\System32\kidvsWa.exe
  2⤵
  PID:8432
- C:\Windows\System32\qvRULYh.exe
  C:\Windows\System32\qvRULYh.exe
  2⤵
  PID:8500
- C:\Windows\System32\FkPEIUE.exe
  C:\Windows\System32\FkPEIUE.exe
  2⤵
  PID:8720
- C:\Windows\System32\IDdgEpj.exe
  C:\Windows\System32\IDdgEpj.exe
  2⤵
  PID:8580
- C:\Windows\System32\yHyymZT.exe
  C:\Windows\System32\yHyymZT.exe
  2⤵
  PID:8928
- C:\Windows\System32\EqTGhNY.exe
  C:\Windows\System32\EqTGhNY.exe
  2⤵
  PID:9092
- C:\Windows\System32\RcXpjfe.exe
  C:\Windows\System32\RcXpjfe.exe
  2⤵
  PID:8268
- C:\Windows\System32\oSNioGR.exe
  C:\Windows\System32\oSNioGR.exe
  2⤵
  PID:8976
- C:\Windows\System32\FFNQNpP.exe
  C:\Windows\System32\FFNQNpP.exe
  2⤵
  PID:9200
- C:\Windows\System32\eKlFhuX.exe
  C:\Windows\System32\eKlFhuX.exe
  2⤵
  PID:9168
- C:\Windows\System32\xnWrtJe.exe
  C:\Windows\System32\xnWrtJe.exe
  2⤵
  PID:9232
- C:\Windows\System32\csDdeBd.exe
  C:\Windows\System32\csDdeBd.exe
  2⤵
  PID:9248
- C:\Windows\System32\kTCFAAx.exe
  C:\Windows\System32\kTCFAAx.exe
  2⤵
  PID:9276
- C:\Windows\System32\TqsvmPA.exe
  C:\Windows\System32\TqsvmPA.exe
  2⤵
  PID:9320
- C:\Windows\System32\XHhdBMj.exe
  C:\Windows\System32\XHhdBMj.exe
  2⤵
  PID:9344
- C:\Windows\System32\WnCtGiu.exe
  C:\Windows\System32\WnCtGiu.exe
  2⤵
  PID:9372
- C:\Windows\System32\LdtUuVg.exe
  C:\Windows\System32\LdtUuVg.exe
  2⤵
  PID:9400
- C:\Windows\System32\VFkZMHz.exe
  C:\Windows\System32\VFkZMHz.exe
  2⤵
  PID:9420
- C:\Windows\System32\qLVMkDs.exe
  C:\Windows\System32\qLVMkDs.exe
  2⤵
  PID:9444
- C:\Windows\System32\RgTfENN.exe
  C:\Windows\System32\RgTfENN.exe
  2⤵
  PID:9480
- C:\Windows\System32\sVpUINq.exe
  C:\Windows\System32\sVpUINq.exe
  2⤵
  PID:9524
- C:\Windows\System32\hoccECJ.exe
  C:\Windows\System32\hoccECJ.exe
  2⤵
  PID:9540
- C:\Windows\System32\iecjySr.exe
  C:\Windows\System32\iecjySr.exe
  2⤵
  PID:9568
- C:\Windows\System32\OvZsomh.exe
  C:\Windows\System32\OvZsomh.exe
  2⤵
  PID:9596
- C:\Windows\System32\kmOXNqc.exe
  C:\Windows\System32\kmOXNqc.exe
  2⤵
  PID:9616
- C:\Windows\System32\PKWqIGQ.exe
  C:\Windows\System32\PKWqIGQ.exe
  2⤵
  PID:9640
- C:\Windows\System32\dLDLlMy.exe
  C:\Windows\System32\dLDLlMy.exe
  2⤵
  PID:9672
- C:\Windows\System32\oUfGEJy.exe
  C:\Windows\System32\oUfGEJy.exe
  2⤵
  PID:9712
- C:\Windows\System32\yYEqdPi.exe
  C:\Windows\System32\yYEqdPi.exe
  2⤵
  PID:9736
- C:\Windows\System32\FDPASrH.exe
  C:\Windows\System32\FDPASrH.exe
  2⤵
  PID:9764
- C:\Windows\System32\MwdlGJN.exe
  C:\Windows\System32\MwdlGJN.exe
  2⤵
  PID:9788
- C:\Windows\System32\nRgUogg.exe
  C:\Windows\System32\nRgUogg.exe
  2⤵
  PID:9816
- C:\Windows\System32\LpOxtXt.exe
  C:\Windows\System32\LpOxtXt.exe
  2⤵
  PID:9832
- C:\Windows\System32\bNIHTzJ.exe
  C:\Windows\System32\bNIHTzJ.exe
  2⤵
  PID:9856
- C:\Windows\System32\eesrtkB.exe
  C:\Windows\System32\eesrtkB.exe
  2⤵
  PID:9880
- C:\Windows\System32\dakvPaq.exe
  C:\Windows\System32\dakvPaq.exe
  2⤵
  PID:9920
- C:\Windows\System32\CuEEAvX.exe
  C:\Windows\System32\CuEEAvX.exe
  2⤵
  PID:9948
- C:\Windows\System32\ikEyopr.exe
  C:\Windows\System32\ikEyopr.exe
  2⤵
  PID:9968
- C:\Windows\System32\fPHEtMT.exe
  C:\Windows\System32\fPHEtMT.exe
  2⤵
  PID:9988
- C:\Windows\System32\tiwMnNE.exe
  C:\Windows\System32\tiwMnNE.exe
  2⤵
  PID:10004
- C:\Windows\System32\VltaYvq.exe
  C:\Windows\System32\VltaYvq.exe
  2⤵
  PID:10032
- C:\Windows\System32\oUdciVj.exe
  C:\Windows\System32\oUdciVj.exe
  2⤵
  PID:10056
- C:\Windows\System32\IauIOfu.exe
  C:\Windows\System32\IauIOfu.exe
  2⤵
  PID:10120
- C:\Windows\System32\gcjNHKM.exe
  C:\Windows\System32\gcjNHKM.exe
  2⤵
  PID:10148
- C:\Windows\System32\qbhOqzh.exe
  C:\Windows\System32\qbhOqzh.exe
  2⤵
  PID:10176
- C:\Windows\System32\PJgLYZq.exe
  C:\Windows\System32\PJgLYZq.exe
  2⤵
  PID:10196
- C:\Windows\System32\BwWeJok.exe
  C:\Windows\System32\BwWeJok.exe
  2⤵
  PID:10224
- C:\Windows\System32\NCQaEVZ.exe
  C:\Windows\System32\NCQaEVZ.exe
  2⤵
  PID:9228
- C:\Windows\System32\vLiXfMr.exe
  C:\Windows\System32\vLiXfMr.exe
  2⤵
  PID:9340
- C:\Windows\System32\sGOJgLx.exe
  C:\Windows\System32\sGOJgLx.exe
  2⤵
  PID:9388
- C:\Windows\System32\YylcIdH.exe
  C:\Windows\System32\YylcIdH.exe
  2⤵
  PID:9416
- C:\Windows\System32\gFjpKmZ.exe
  C:\Windows\System32\gFjpKmZ.exe
  2⤵
  PID:9468
- C:\Windows\System32\gxEWAeu.exe
  C:\Windows\System32\gxEWAeu.exe
  2⤵
  PID:9584
- C:\Windows\System32\qNbSWFa.exe
  C:\Windows\System32\qNbSWFa.exe
  2⤵
  PID:9652
- C:\Windows\System32\HTwVimB.exe
  C:\Windows\System32\HTwVimB.exe
  2⤵
  PID:9704
- C:\Windows\System32\HSknFQc.exe
  C:\Windows\System32\HSknFQc.exe
  2⤵
  PID:9780
- C:\Windows\System32\nKYVNWI.exe
  C:\Windows\System32\nKYVNWI.exe
  2⤵
  PID:9840
- C:\Windows\System32\zCVwREa.exe
  C:\Windows\System32\zCVwREa.exe
  2⤵
  PID:9176
- C:\Windows\System32\NBLuyXV.exe
  C:\Windows\System32\NBLuyXV.exe
  2⤵
  PID:9940
- C:\Windows\System32\OovWVcp.exe
  C:\Windows\System32\OovWVcp.exe
  2⤵
  PID:10016
- C:\Windows\System32\wbnoIfq.exe
  C:\Windows\System32\wbnoIfq.exe
  2⤵
  PID:10076
- C:\Windows\System32\qgkOEdZ.exe
  C:\Windows\System32\qgkOEdZ.exe
  2⤵
  PID:10040
- C:\Windows\System32\JbdOHgN.exe
  C:\Windows\System32\JbdOHgN.exe
  2⤵
  PID:10168
- C:\Windows\System32\uiHdFmJ.exe
  C:\Windows\System32\uiHdFmJ.exe
  2⤵
  PID:10212
- C:\Windows\System32\PqJDxaD.exe
  C:\Windows\System32\PqJDxaD.exe
  2⤵
  PID:9516
- C:\Windows\System32\ZyFJAwf.exe
  C:\Windows\System32\ZyFJAwf.exe
  2⤵
  PID:9608
- C:\Windows\System32\FLjlbcw.exe
  C:\Windows\System32\FLjlbcw.exe
  2⤵
  PID:9760
- C:\Windows\System32\IMQXciV.exe
  C:\Windows\System32\IMQXciV.exe
  2⤵
  PID:9824
- C:\Windows\System32\bTFMtxs.exe
  C:\Windows\System32\bTFMtxs.exe
  2⤵
  PID:10132
- C:\Windows\System32\SAeDIYH.exe
  C:\Windows\System32\SAeDIYH.exe
  2⤵
  PID:9412
- C:\Windows\System32\pucyQPa.exe
  C:\Windows\System32\pucyQPa.exe
  2⤵
  PID:9552
- C:\Windows\System32\PztWcad.exe
  C:\Windows\System32\PztWcad.exe
  2⤵
  PID:9876
- C:\Windows\System32\yUYujez.exe
  C:\Windows\System32\yUYujez.exe
  2⤵
  PID:10044
- C:\Windows\System32\WmUCUTl.exe
  C:\Windows\System32\WmUCUTl.exe
  2⤵
  PID:9748
- C:\Windows\System32\VganeIy.exe
  C:\Windows\System32\VganeIy.exe
  2⤵
  PID:10248
- C:\Windows\System32\uHNJaVC.exe
  C:\Windows\System32\uHNJaVC.exe
  2⤵
  PID:10296
- C:\Windows\System32\lfnXNWh.exe
  C:\Windows\System32\lfnXNWh.exe
  2⤵
  PID:10344
- C:\Windows\System32\wSDguIi.exe
  C:\Windows\System32\wSDguIi.exe
  2⤵
  PID:10360
- C:\Windows\System32\YauQPPg.exe
  C:\Windows\System32\YauQPPg.exe
  2⤵
  PID:10380
- C:\Windows\System32\tFDrDmH.exe
  C:\Windows\System32\tFDrDmH.exe
  2⤵
  PID:10396
- C:\Windows\System32\ymrTACD.exe
  C:\Windows\System32\ymrTACD.exe
  2⤵
  PID:10416
- C:\Windows\System32\tFLvmHE.exe
  C:\Windows\System32\tFLvmHE.exe
  2⤵
  PID:10452
- C:\Windows\System32\cpIsCBz.exe
  C:\Windows\System32\cpIsCBz.exe
  2⤵
  PID:10484
- C:\Windows\System32\fMgGycr.exe
  C:\Windows\System32\fMgGycr.exe
  2⤵
  PID:10528
- C:\Windows\System32\bVzbJIx.exe
  C:\Windows\System32\bVzbJIx.exe
  2⤵
  PID:10544
- C:\Windows\System32\skKvhhT.exe
  C:\Windows\System32\skKvhhT.exe
  2⤵
  PID:10600
- C:\Windows\System32\OsPNEyS.exe
  C:\Windows\System32\OsPNEyS.exe
  2⤵
  PID:10628
- C:\Windows\System32\mMfUxwT.exe
  C:\Windows\System32\mMfUxwT.exe
  2⤵
  PID:10652
- C:\Windows\System32\tOhnvkF.exe
  C:\Windows\System32\tOhnvkF.exe
  2⤵
  PID:10688
- C:\Windows\System32\hUtMSzq.exe
  C:\Windows\System32\hUtMSzq.exe
  2⤵
  PID:10712
- C:\Windows\System32\QzjbKyL.exe
  C:\Windows\System32\QzjbKyL.exe
  2⤵
  PID:10740
- C:\Windows\System32\vRfASaC.exe
  C:\Windows\System32\vRfASaC.exe
  2⤵
  PID:10764
- C:\Windows\System32\kkfsTzj.exe
  C:\Windows\System32\kkfsTzj.exe
  2⤵
  PID:10808
- C:\Windows\System32\PeBQISc.exe
  C:\Windows\System32\PeBQISc.exe
  2⤵
  PID:10828
- C:\Windows\System32\gkuCDki.exe
  C:\Windows\System32\gkuCDki.exe
  2⤵
  PID:10856
- C:\Windows\System32\cpVlwAq.exe
  C:\Windows\System32\cpVlwAq.exe
  2⤵
  PID:10884
- C:\Windows\System32\pyPEfbs.exe
  C:\Windows\System32\pyPEfbs.exe
  2⤵
  PID:10908
- C:\Windows\System32\ufXbNDq.exe
  C:\Windows\System32\ufXbNDq.exe
  2⤵
  PID:10944
- C:\Windows\System32\UKDtPFS.exe
  C:\Windows\System32\UKDtPFS.exe
  2⤵
  PID:10960
- C:\Windows\System32\mvbDFdh.exe
  C:\Windows\System32\mvbDFdh.exe
  2⤵
  PID:10996
- C:\Windows\System32\fxiGJvM.exe
  C:\Windows\System32\fxiGJvM.exe
  2⤵
  PID:11028
- C:\Windows\System32\DwGhYyB.exe
  C:\Windows\System32\DwGhYyB.exe
  2⤵
  PID:11048
- C:\Windows\System32\zIOpDMz.exe
  C:\Windows\System32\zIOpDMz.exe
  2⤵
  PID:11072
- C:\Windows\System32\XINmWHm.exe
  C:\Windows\System32\XINmWHm.exe
  2⤵
  PID:11100
- C:\Windows\System32\oFoZQSS.exe
  C:\Windows\System32\oFoZQSS.exe
  2⤵
  PID:11120
- C:\Windows\System32\iAKeFke.exe
  C:\Windows\System32\iAKeFke.exe
  2⤵
  PID:11148
- C:\Windows\System32\bcMicCZ.exe
  C:\Windows\System32\bcMicCZ.exe
  2⤵
  PID:11180
- C:\Windows\System32\BNmDoWo.exe
  C:\Windows\System32\BNmDoWo.exe
  2⤵
  PID:11204
- C:\Windows\System32\lYECPbf.exe
  C:\Windows\System32\lYECPbf.exe
  2⤵
  PID:11240
- C:\Windows\System32\RFfIOUU.exe
  C:\Windows\System32\RFfIOUU.exe
  2⤵
  PID:11260
- C:\Windows\System32\lchGadX.exe
  C:\Windows\System32\lchGadX.exe
  2⤵
  PID:10204
- C:\Windows\System32\kfIsSEX.exe
  C:\Windows\System32\kfIsSEX.exe
  2⤵
  PID:10284
- C:\Windows\System32\RetMdQJ.exe
  C:\Windows\System32\RetMdQJ.exe
  2⤵
  PID:10356
- C:\Windows\System32\UNTqnuO.exe
  C:\Windows\System32\UNTqnuO.exe
  2⤵
  PID:10500
- C:\Windows\System32\LFzYcgr.exe
  C:\Windows\System32\LFzYcgr.exe
  2⤵
  PID:10560
- C:\Windows\System32\qdcYWKb.exe
  C:\Windows\System32\qdcYWKb.exe
  2⤵
  PID:10640
- C:\Windows\System32\ykIgjFa.exe
  C:\Windows\System32\ykIgjFa.exe
  2⤵
  PID:10708
- C:\Windows\System32\EbvgqrG.exe
  C:\Windows\System32\EbvgqrG.exe
  2⤵
  PID:10756
- C:\Windows\System32\rgeXGyY.exe
  C:\Windows\System32\rgeXGyY.exe
  2⤵
  PID:10820
- C:\Windows\System32\dcSlERo.exe
  C:\Windows\System32\dcSlERo.exe
  2⤵
  PID:10840
- C:\Windows\System32\BGvtRIu.exe
  C:\Windows\System32\BGvtRIu.exe
  2⤵
  PID:10972
- C:\Windows\System32\rYxMLfK.exe
  C:\Windows\System32\rYxMLfK.exe
  2⤵
  PID:11024
- C:\Windows\System32\qfUVHEp.exe
  C:\Windows\System32\qfUVHEp.exe
  2⤵
  PID:11040
- C:\Windows\System32\HLEvesA.exe
  C:\Windows\System32\HLEvesA.exe
  2⤵
  PID:11116
- C:\Windows\System32\fjnXWdF.exe
  C:\Windows\System32\fjnXWdF.exe
  2⤵
  PID:11160
- C:\Windows\System32\arBDQlb.exe
  C:\Windows\System32\arBDQlb.exe
  2⤵
  PID:10088
- C:\Windows\System32\vUTsGBc.exe
  C:\Windows\System32\vUTsGBc.exe
  2⤵
  PID:10308
- C:\Windows\System32\AiPmaeL.exe
  C:\Windows\System32\AiPmaeL.exe
  2⤵
  PID:10388
- C:\Windows\System32\odIITdJ.exe
  C:\Windows\System32\odIITdJ.exe
  2⤵
  PID:10696
- C:\Windows\System32\sMWFmBg.exe
  C:\Windows\System32\sMWFmBg.exe
  2⤵
  PID:10844
- C:\Windows\System32\HKOTsTO.exe
  C:\Windows\System32\HKOTsTO.exe
  2⤵
  PID:10980
- C:\Windows\System32\mmCsUyF.exe
  C:\Windows\System32\mmCsUyF.exe
  2⤵
  PID:11164
- C:\Windows\System32\tcuVEeY.exe
  C:\Windows\System32\tcuVEeY.exe
  2⤵
  PID:10256
- C:\Windows\System32\nWiJwYI.exe
  C:\Windows\System32\nWiJwYI.exe
  2⤵
  PID:10432
- C:\Windows\System32\VSePwYF.exe
  C:\Windows\System32\VSePwYF.exe
  2⤵
  PID:10956
- C:\Windows\System32\cijCyPp.exe
  C:\Windows\System32\cijCyPp.exe
  2⤵
  PID:11212
- C:\Windows\System32\yMGGSbI.exe
  C:\Windows\System32\yMGGSbI.exe
  2⤵
  PID:11272
- C:\Windows\System32\bLeGrtH.exe
  C:\Windows\System32\bLeGrtH.exe
  2⤵
  PID:11312
- C:\Windows\System32\jYZxwBs.exe
  C:\Windows\System32\jYZxwBs.exe
  2⤵
  PID:11332
- C:\Windows\System32\muGtDEF.exe
  C:\Windows\System32\muGtDEF.exe
  2⤵
  PID:11360
- C:\Windows\System32\LFbxKAE.exe
  C:\Windows\System32\LFbxKAE.exe
  2⤵
  PID:11452
- C:\Windows\System32\SuJiiMF.exe
  C:\Windows\System32\SuJiiMF.exe
  2⤵
  PID:11488
- C:\Windows\System32\GHySPax.exe
  C:\Windows\System32\GHySPax.exe
  2⤵
  PID:11508
- C:\Windows\System32\XtpEapo.exe
  C:\Windows\System32\XtpEapo.exe
  2⤵
  PID:11564
- C:\Windows\System32\QUkGTZz.exe
  C:\Windows\System32\QUkGTZz.exe
  2⤵
  PID:11580
- C:\Windows\System32\GDDIWWk.exe
  C:\Windows\System32\GDDIWWk.exe
  2⤵
  PID:11608
- C:\Windows\System32\MoulJKo.exe
  C:\Windows\System32\MoulJKo.exe
  2⤵
  PID:11632
- C:\Windows\System32\LQOCYJa.exe
  C:\Windows\System32\LQOCYJa.exe
  2⤵
  PID:11664
- C:\Windows\System32\eTWBVkl.exe
  C:\Windows\System32\eTWBVkl.exe
  2⤵
  PID:11684
- C:\Windows\System32\FpXsiCx.exe
  C:\Windows\System32\FpXsiCx.exe
  2⤵
  PID:11712
- C:\Windows\System32\TlcDSpx.exe
  C:\Windows\System32\TlcDSpx.exe
  2⤵
  PID:11732
- C:\Windows\System32\ziOsszt.exe
  C:\Windows\System32\ziOsszt.exe
  2⤵
  PID:11760
- C:\Windows\System32\JrNEybo.exe
  C:\Windows\System32\JrNEybo.exe
  2⤵
  PID:11792
- C:\Windows\System32\NfeePJv.exe
  C:\Windows\System32\NfeePJv.exe
  2⤵
  PID:11856
- C:\Windows\System32\gAWZDJJ.exe
  C:\Windows\System32\gAWZDJJ.exe
  2⤵
  PID:11872
- C:\Windows\System32\YGWXnhr.exe
  C:\Windows\System32\YGWXnhr.exe
  2⤵
  PID:11888
- C:\Windows\System32\KlUugcw.exe
  C:\Windows\System32\KlUugcw.exe
  2⤵
  PID:11928
- C:\Windows\System32\TtOxCbn.exe
  C:\Windows\System32\TtOxCbn.exe
  2⤵
  PID:11948
- C:\Windows\System32\IydViaL.exe
  C:\Windows\System32\IydViaL.exe
  2⤵
  PID:11968
- C:\Windows\System32\KcIIHMk.exe
  C:\Windows\System32\KcIIHMk.exe
  2⤵
  PID:12016
- C:\Windows\System32\BzosxYF.exe
  C:\Windows\System32\BzosxYF.exe
  2⤵
  PID:12052
- C:\Windows\System32\CYHDZMU.exe
  C:\Windows\System32\CYHDZMU.exe
  2⤵
  PID:12072
- C:\Windows\System32\sFqLRNM.exe
  C:\Windows\System32\sFqLRNM.exe
  2⤵
  PID:12092
- C:\Windows\System32\Voptjyx.exe
  C:\Windows\System32\Voptjyx.exe
  2⤵
  PID:12116
- C:\Windows\System32\GVqmlcs.exe
  C:\Windows\System32\GVqmlcs.exe
  2⤵
  PID:12156
- C:\Windows\System32\XNzGoiA.exe
  C:\Windows\System32\XNzGoiA.exe
  2⤵
  PID:12184
- C:\Windows\System32\XPvZQFK.exe
  C:\Windows\System32\XPvZQFK.exe
  2⤵
  PID:12200
- C:\Windows\System32\GETIgKD.exe
  C:\Windows\System32\GETIgKD.exe
  2⤵
  PID:12236
- C:\Windows\System32\BlPVxfp.exe
  C:\Windows\System32\BlPVxfp.exe
  2⤵
  PID:12264
- C:\Windows\System32\GPQkKUq.exe
  C:\Windows\System32\GPQkKUq.exe
  2⤵
  PID:11200
- C:\Windows\System32\lXxyGqC.exe
  C:\Windows\System32\lXxyGqC.exe
  2⤵
  PID:10520
- C:\Windows\System32\RKxjBja.exe
  C:\Windows\System32\RKxjBja.exe
  2⤵
  PID:11340
- C:\Windows\System32\NPIdboc.exe
  C:\Windows\System32\NPIdboc.exe
  2⤵
  PID:11396
- C:\Windows\System32\ZxRPIBk.exe
  C:\Windows\System32\ZxRPIBk.exe
  2⤵
  PID:11404
- C:\Windows\System32\VatySiC.exe
  C:\Windows\System32\VatySiC.exe
  2⤵
  PID:11424
- C:\Windows\System32\PaJIGDP.exe
  C:\Windows\System32\PaJIGDP.exe
  2⤵
  PID:11376
- C:\Windows\System32\DuceMOk.exe
  C:\Windows\System32\DuceMOk.exe
  2⤵
  PID:11552
- C:\Windows\System32\hjyfIqy.exe
  C:\Windows\System32\hjyfIqy.exe
  2⤵
  PID:11660
- C:\Windows\System32\ELxKlmV.exe
  C:\Windows\System32\ELxKlmV.exe
  2⤵
  PID:11720
- C:\Windows\System32\wZupLYf.exe
  C:\Windows\System32\wZupLYf.exe
  2⤵
  PID:11788
- C:\Windows\System32\GiGVYNp.exe
  C:\Windows\System32\GiGVYNp.exe
  2⤵
  PID:11832
- C:\Windows\System32\NxOLYHk.exe
  C:\Windows\System32\NxOLYHk.exe
  2⤵
  PID:11900
- C:\Windows\System32\tXFYgtS.exe
  C:\Windows\System32\tXFYgtS.exe
  2⤵
  PID:12000
- C:\Windows\System32\kfiGPCb.exe
  C:\Windows\System32\kfiGPCb.exe
  2⤵
  PID:12060
- C:\Windows\System32\yLbzGxe.exe
  C:\Windows\System32\yLbzGxe.exe
  2⤵
  PID:12108
- C:\Windows\System32\NEDDTvZ.exe
  C:\Windows\System32\NEDDTvZ.exe
  2⤵
  PID:12172
- C:\Windows\System32\ymJtgjG.exe
  C:\Windows\System32\ymJtgjG.exe
  2⤵
  PID:12192
- C:\Windows\System32\YmtUYuf.exe
  C:\Windows\System32\YmtUYuf.exe
  2⤵
  PID:12244
- C:\Windows\System32\PmhzOPM.exe
  C:\Windows\System32\PmhzOPM.exe
  2⤵
  PID:11344
- C:\Windows\System32\HGyZYnT.exe
  C:\Windows\System32\HGyZYnT.exe
  2⤵
  PID:11400
- C:\Windows\System32\xDfhkRS.exe
  C:\Windows\System32\xDfhkRS.exe
  2⤵
  PID:11576
- C:\Windows\System32\KjIxPXl.exe
  C:\Windows\System32\KjIxPXl.exe
  2⤵
  PID:11800
- C:\Windows\System32\shvTxJA.exe
  C:\Windows\System32\shvTxJA.exe
  2⤵
  PID:11960
- C:\Windows\System32\ZcREQFF.exe
  C:\Windows\System32\ZcREQFF.exe
  2⤵
  PID:12136
- C:\Windows\System32\RCFVskR.exe
  C:\Windows\System32\RCFVskR.exe
  2⤵
  PID:12280
- C:\Windows\System32\bfYytYO.exe
  C:\Windows\System32\bfYytYO.exe
  2⤵
  PID:11612
- C:\Windows\System32\gMttxqU.exe
  C:\Windows\System32\gMttxqU.exe
  2⤵
  PID:11704
- C:\Windows\System32\bZtUBnO.exe
  C:\Windows\System32\bZtUBnO.exe
  2⤵
  PID:11268
- C:\Windows\System32\JwyviYh.exe
  C:\Windows\System32\JwyviYh.exe
  2⤵
  PID:11388
- C:\Windows\System32\lPiVwkF.exe
  C:\Windows\System32\lPiVwkF.exe
  2⤵
  PID:12140
- C:\Windows\System32\xExjxJj.exe
  C:\Windows\System32\xExjxJj.exe
  2⤵
  PID:12308
- C:\Windows\System32\lrNyMzM.exe
  C:\Windows\System32\lrNyMzM.exe
  2⤵
  PID:12340
- C:\Windows\System32\kxoHnIA.exe
  C:\Windows\System32\kxoHnIA.exe
  2⤵
  PID:12372
- C:\Windows\System32\SFnXUcG.exe
  C:\Windows\System32\SFnXUcG.exe
  2⤵
  PID:12392
- C:\Windows\System32\NBceNWy.exe
  C:\Windows\System32\NBceNWy.exe
  2⤵
  PID:12416
- C:\Windows\System32\oyfifaO.exe
  C:\Windows\System32\oyfifaO.exe
  2⤵
  PID:12444
- C:\Windows\System32\paOPuNB.exe
  C:\Windows\System32\paOPuNB.exe
  2⤵
  PID:12480
- C:\Windows\System32\bHCIXUd.exe
  C:\Windows\System32\bHCIXUd.exe
  2⤵
  PID:12504
- C:\Windows\System32\lNdvOPZ.exe
  C:\Windows\System32\lNdvOPZ.exe
  2⤵
  PID:12528
- C:\Windows\System32\fvozpmQ.exe
  C:\Windows\System32\fvozpmQ.exe
  2⤵
  PID:12548
- C:\Windows\System32\XGwXAAr.exe
  C:\Windows\System32\XGwXAAr.exe
  2⤵
  PID:12576
- C:\Windows\System32\NtfvjED.exe
  C:\Windows\System32\NtfvjED.exe
  2⤵
  PID:12600
- C:\Windows\System32\KXjGonD.exe
  C:\Windows\System32\KXjGonD.exe
  2⤵
  PID:12620
- C:\Windows\System32\VxAhcFS.exe
  C:\Windows\System32\VxAhcFS.exe
  2⤵
  PID:12640
- C:\Windows\System32\lXGjKZz.exe
  C:\Windows\System32\lXGjKZz.exe
  2⤵
  PID:12684
- C:\Windows\System32\UTKziCv.exe
  C:\Windows\System32\UTKziCv.exe
  2⤵
  PID:12712
- C:\Windows\System32\rAUytRU.exe
  C:\Windows\System32\rAUytRU.exe
  2⤵
  PID:12764
- C:\Windows\System32\ssxfPzg.exe
  C:\Windows\System32\ssxfPzg.exe
  2⤵
  PID:12788
- C:\Windows\System32\ENZrxDp.exe
  C:\Windows\System32\ENZrxDp.exe
  2⤵
  PID:12820
- C:\Windows\System32\kDtrKii.exe
  C:\Windows\System32\kDtrKii.exe
  2⤵
  PID:12844
- C:\Windows\System32\MFWyAsx.exe
  C:\Windows\System32\MFWyAsx.exe
  2⤵
  PID:12864
- C:\Windows\System32\KcSsOif.exe
  C:\Windows\System32\KcSsOif.exe
  2⤵
  PID:12904
- C:\Windows\System32\JrFkjCP.exe
  C:\Windows\System32\JrFkjCP.exe
  2⤵
  PID:12928
- C:\Windows\System32\VEgjZRO.exe
  C:\Windows\System32\VEgjZRO.exe
  2⤵
  PID:12948
- C:\Windows\System32\xlVpzIj.exe
  C:\Windows\System32\xlVpzIj.exe
  2⤵
  PID:12976
- C:\Windows\System32\PPlJTMx.exe
  C:\Windows\System32\PPlJTMx.exe
  2⤵
  PID:12996
- C:\Windows\System32\mdRGBjM.exe
  C:\Windows\System32\mdRGBjM.exe
  2⤵
  PID:13020
- C:\Windows\System32\UavXCIn.exe
  C:\Windows\System32\UavXCIn.exe
  2⤵
  PID:13072
- C:\Windows\System32\VYzuTYY.exe
  C:\Windows\System32\VYzuTYY.exe
  2⤵
  PID:13100
- C:\Windows\System32\ilYsJEZ.exe
  C:\Windows\System32\ilYsJEZ.exe
  2⤵
  PID:13120
- C:\Windows\System32\YwegQuJ.exe
  C:\Windows\System32\YwegQuJ.exe
  2⤵
  PID:13144
- C:\Windows\System32\BCTQxBt.exe
  C:\Windows\System32\BCTQxBt.exe
  2⤵
  PID:13184
- C:\Windows\System32\NxRnyXc.exe
  C:\Windows\System32\NxRnyXc.exe
  2⤵
  PID:13212
- C:\Windows\System32\NoYkboB.exe
  C:\Windows\System32\NoYkboB.exe
  2⤵
  PID:13240
- C:\Windows\System32\timfaEt.exe
  C:\Windows\System32\timfaEt.exe
  2⤵
  PID:13264
- C:\Windows\System32\knAXCjZ.exe
  C:\Windows\System32\knAXCjZ.exe
  2⤵
  PID:13284
- C:\Windows\System32\ikyvBQM.exe
  C:\Windows\System32\ikyvBQM.exe
  2⤵
  PID:13308
- C:\Windows\System32\jSWLfwq.exe
  C:\Windows\System32\jSWLfwq.exe
  2⤵
  PID:12320
- C:\Windows\System32\mWLwQLs.exe
  C:\Windows\System32\mWLwQLs.exe
  2⤵
  PID:2372
- C:\Windows\System32\rYAAFno.exe
  C:\Windows\System32\rYAAFno.exe
  2⤵
  PID:12352
- C:\Windows\System32\rBfFomk.exe
  C:\Windows\System32\rBfFomk.exe
  2⤵
  PID:3744
- C:\Windows\System32\HmSeFRa.exe
  C:\Windows\System32\HmSeFRa.exe
  2⤵
  PID:12468
- C:\Windows\System32\hKXAGlN.exe
  C:\Windows\System32\hKXAGlN.exe
  2⤵
  PID:12500
- C:\Windows\System32\ACTHUsF.exe
  C:\Windows\System32\ACTHUsF.exe
  2⤵
  PID:12652
- C:\Windows\System32\OlGKgII.exe
  C:\Windows\System32\OlGKgII.exe
  2⤵
  PID:12628
- C:\Windows\System32\gQhjeZj.exe
  C:\Windows\System32\gQhjeZj.exe
  2⤵
  PID:12808
- C:\Windows\System32\HhKMtpA.exe
  C:\Windows\System32\HhKMtpA.exe
  2⤵
  PID:12852
- C:\Windows\System32\QNLHsrf.exe
  C:\Windows\System32\QNLHsrf.exe
  2⤵
  PID:12900
- C:\Windows\System32\iAaCPnT.exe
  C:\Windows\System32\iAaCPnT.exe
  2⤵
  PID:13016
- C:\Windows\System32\zfiyaXs.exe
  C:\Windows\System32\zfiyaXs.exe
  2⤵
  PID:13060
- C:\Windows\System32\hhuSmrt.exe
  C:\Windows\System32\hhuSmrt.exe
  2⤵
  PID:13140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BOHgQzZ.exe

Path C:\Windows\System32\BOHgQzZ.exe
Size 1.5MB
SHA256 b45704d024551694021ec8bc3844ccf22bedc02cf183d55f986dc6a338712600
MD5 ae3fd6d503e5a54e6ed324ee1454bb77
SHA1 7a4d1f29a75290d1f158e8660e1e592cca6f6f53
SHA512 06f281d87c21518bb97e06044da24eb7c430ada9025480a2b6833594232c031b282d12730e5a37a37dfefa4ba58148368f502c339d2ebc5ddf06b1b605f5d036
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIQ:knw9oUUEEDl37jcquVoVJ38lCIQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

BijMSCy.exe

Path C:\Windows\System32\BijMSCy.exe
Size 1.5MB
SHA256 3bacfc2deec40382382bd5ae9e46234b5403285c5fa37994b191d10ecee41c06
MD5 f67aaada4cad2d826ba6971bab7dcbd4
SHA1 8f30c4b05ca6e7db82f6c5aa1fd47d4bb5700b1d
SHA512 1e60cc2fe466a965c321291a044717acd896bec0564925f12d5f7c6553d224d291d789dc94a72b60d341e55a57c47cef365f4fccdc78c2b4e60932b14c07c14b
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIBcV:knw9oUUEEDl37jcquVoVJ38lCIi
MD5 SHA1 SHA512 SSDEEP

Submit Download

BnzNZGs.exe

Path C:\Windows\System32\BnzNZGs.exe
Size 1.5MB
SHA256 c1bc03680eb29c427b257b2a2d9684827536a191ac1df8076d8f8c4c11b0714b
MD5 0e281bd0dbbc32d4c44284724cadfa5e
SHA1 c4d7dd4364d13a12b24b0abb70006e700101c922
SHA512 cde7068afcc02d1400764f8e08360be36d241700733b398dbdbbe877c567068fc788897fb795282f57652d4137b71c5d51918160a92afe0647b1b5defb7e8be0
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIk:knw9oUUEEDl37jcquVoVJ38lCIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

CgioZoR.exe

Path C:\Windows\System32\CgioZoR.exe
Size 1.5MB
SHA256 a7cf9bab290dacd1ffe33bed39c3e625e52598db9957a5c2d23d2ce0bea3a3ec
MD5 425da81580623c75cb542c6a97a318c7
SHA1 1a0b5a3d8d97ec6844895dddfa98839355f28a63
SHA512 94f4c30bb567c732ff559123cae8da22da651a778883c4503f11bbbdcfde9029abecb034ff003847aabc8a454a27686bdfab6058691d860c3bf776155df4fef5
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIU:knw9oUUEEDl37jcquVoVJ38lCIU
MD5 SHA1 SHA512 SSDEEP

Submit Download

DYpRkdj.exe

Path C:\Windows\System32\DYpRkdj.exe
Size 1.5MB
SHA256 9c3ed5fae68235f98e7d6aaaad16903f3fdc6673a491c1ed1923ce499c918244
MD5 5522ccc4ee3402c25714f219217234d7
SHA1 cd96f9446e3b141eead6cf8d80d65d5fdea91445
SHA512 f143b0f1ea9047f8ec9072d7f9afd3f403725aca91cb200d4c3af30a048b9f8f195440cbb6a52897e811bd38ba1c66ee6abc971d98e0798d5be8eb7dd66aebf6
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIH:knw9oUUEEDl37jcquVoVJ38lCIH
MD5 SHA1 SHA512 SSDEEP

Submit Download

EBubWBW.exe

Path C:\Windows\System32\EBubWBW.exe
Size 1.5MB
SHA256 4757f138ad081d7b363d730dcd1d9dc57e63d9facd4084ac9cd33727024d9e8a
MD5 f6ea38dba5d0126b91fd6d5358f0fc90
SHA1 30c52c0a2bcda30f20d67eb67ee6e425cec10a94
SHA512 93cba9b87f19db6383ec40d211f4ccae56aa13a622a99f2662e05b1e450363882338fd0c1c458032acc16ec6522777f0cf24bb840c73483e57a8a4b115b90613
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIgNd:knw9oUUEEDl37jcquVoVJ38lCI4
MD5 SHA1 SHA512 SSDEEP

Submit Download

IoiVnKn.exe

Path C:\Windows\System32\IoiVnKn.exe
Size 1.5MB
SHA256 56f1e72aa5d160d4dba285c37583f5e44959522ece31c8cba3e5b2b04aea12c7
MD5 7dd18004538ae344dfe438ed97db844c
SHA1 62b63806dea3f35d4d231746d76452155cb90fe9
SHA512 f9932baf1bdf63825a12cdaf9c5ad66d1f257b6dd662894e381bf4c186d2b3c8a2cdd29b746207e959008cb2ffca85c92518a40a02a384408c728449ba2bef57
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIo:knw9oUUEEDl37jcquVoVJ38lCIo
MD5 SHA1 SHA512 SSDEEP

Submit Download

JxMUynx.exe

Path C:\Windows\System32\JxMUynx.exe
Size 1.5MB
SHA256 b70b562541d4f5d1858df91b1828e2321fd96c83bf571b8ef9dc659df3265556
MD5 9ff4086a342fb30d465a296067af3150
SHA1 ce2470870d5b4c5f4ee15b7fb15034aae51702fc
SHA512 3935a00a572caa85f84b887dbce34882ef70ff3cc2d569f404836ec4bfd98a22b1f7e2dc942e8ca79c990c0ffa11cacdacb434484e1c1a15a8e3860bcef8fa2a
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fI1:knw9oUUEEDl37jcquVoVJ38lCI1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MlRCsHn.exe

Path C:\Windows\System32\MlRCsHn.exe
Size 1.5MB
SHA256 894dce561853a96b61bf68f4ce627513b4169da6334a1f8a32fa67074a6a8103
MD5 9af353e5ccaddeadf0abb8a72aca0c3c
SHA1 b242af09b5e55f70e19a8f7705ec90be4e641f5b
SHA512 dc6c311eeb129ec5decf18b52df206555ae4a8e6604ef41c1a202a394f24e7a4623a9784ee3e667e7082951ebb875534259f1c05728b7e76faf993dfeb33f829
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIM:knw9oUUEEDl37jcquVoVJ38lCIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

NQvyjKI.exe

Path C:\Windows\System32\NQvyjKI.exe
Size 1.5MB
SHA256 161b640507d0abb0e2d66fc373f79382a2b672a8528e006fe370c59c32b06a6a
MD5 c1a843787704a61d401f046bed5600d9
SHA1 fe9dbf26d4509f4e91b345c6451e3811949de947
SHA512 267824eaf71df0c623efef98be5b3144cf674e8a81e8498d16bb2ed7d6a784e25e23690ff8d5f96253f7aa7453da800d1c0efdc2d0609d9e2688c04c63baadde
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIs:knw9oUUEEDl37jcquVoVJ38lCIs
MD5 SHA1 SHA512 SSDEEP

Submit Download

NRiuOwQ.exe

Path C:\Windows\System32\NRiuOwQ.exe
Size 1.5MB
SHA256 0004ebb48988a3fc7989954f1d8bcf24397c66b8282c63d592840e1bd83b1e85
MD5 277b576f6aee78b322b6b2bef20549ff
SHA1 726dc809e2deb181d2670020645b6056eba85c96
SHA512 7c47735ad7fb41ce7af4eda41a0304c06ad9e50c3a01e0c20271d2e23290837ebfa43030744a533639114dfc575cd3e8f9f43f42bc6e62f86864181f6850266f
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIr:knw9oUUEEDl37jcquVoVJ38lCIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SuRzMqE.exe

Path C:\Windows\System32\SuRzMqE.exe
Size 1.5MB
SHA256 82e353d84185700cd3bafa8a73c06f45d46d2484eb621311d40dd2b5878df92a
MD5 6d7d1da4a2b42f4da25f160ae368db11
SHA1 40ab13d0727630b65775da25818ae8c9be19c907
SHA512 628cfa200d74b1b56ebd5721c87b16515b10018749ebfb83852ef693b075442ddfd3d6a517bf32a3a570f68dfc32011a29d12031774f4a5c5637b3e931bb8c1a
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIh:knw9oUUEEDl37jcquVoVJ38lCIh
MD5 SHA1 SHA512 SSDEEP

Submit Download

UxXqLRN.exe

Path C:\Windows\System32\UxXqLRN.exe
Size 1.5MB
SHA256 8c61ce4bf4db5a9711e6b82c3f1cf54c5712776e01811e0f1520d94910b37c2e
MD5 bcb67511295c0be3f336087ebd54159e
SHA1 be0e932a83e31b72e5ba76b6bfb708826acd9738
SHA512 3a2193d818397f20334332983197ba29427d4a310a6714e596a67dd697bafcee13ad165c16ddbb080c072d6f7bf67882288d717eed0691c2236b33d84a65c4a0
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIg:knw9oUUEEDl37jcquVoVJ38lCIg
MD5 SHA1 SHA512 SSDEEP

Submit Download

VyZNtNU.exe

Path C:\Windows\System32\VyZNtNU.exe
Size 1.5MB
SHA256 43cb2c6baa49d34b871674bbf70d1f1673d02a040ef3d09add49074c544ba7f1
MD5 5694387576aeda9032fb934cacb0aeff
SHA1 a87f2ec37c7461babb0797f004726d2e61d1e673
SHA512 d93b77dd342aa58ff8b561e9021f982fd16653c84930244fed1ac3e50fca50bb1fef811963ca566b5a20775dc7169869833d9285303fae7597fef3f4102d206f
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIo:knw9oUUEEDl37jcquVoVJ38lCIo
MD5 SHA1 SHA512 SSDEEP

Submit Download

XASWohP.exe

Path C:\Windows\System32\XASWohP.exe
Size 1.5MB
SHA256 0dea617558fe8e67da0cdbc2d8b91c7a8cc19ba1c6820cde4c7177c8ecd2e513
MD5 7e05f3c9e6e11e279867e8c9fcf7d57a
SHA1 60018f4c46ba06b62c174355ef7b7306adb5ec17
SHA512 4f7767cfe74e8b747f6610b0ba2554dc50d591507ac8a98db91fb56cdc82ccd959a43bd151b97e9c6d4499ee494aef753211ce550403b1095261aea49c28c17e
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fI7:knw9oUUEEDl37jcquVoVJ38lCI7
MD5 SHA1 SHA512 SSDEEP

Submit Download

aEIElKI.exe

Path C:\Windows\System32\aEIElKI.exe
Size 1.5MB
SHA256 719d088a556fbabf6d8d2fca354093f03b77fd5a2d4a66f6bc6c5545049060c0
MD5 68cd749d7484d04dfb4dcaa1ff472904
SHA1 40bf9f31f1488dc8e6ac0f1e23144efa25f06c47
SHA512 1ae54242ca96f50b57d4ab799597a437319ae56c6642c24483802f88c2e8c92ba8627358a5cc8ef7195fff0405d896e7329bc0a04e8e1d0eb6268f8b872ee006
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIn:knw9oUUEEDl37jcquVoVJ38lCIn
MD5 SHA1 SHA512 SSDEEP

Submit Download

aWRciOx.exe

Path C:\Windows\System32\aWRciOx.exe
Size 1.5MB
SHA256 b8defeb733c612ffbe3e7ba6b3c8a7e4941201d34dcc653e41aa46da3d8a6be8
MD5 eb5d4ed32902d2fa501abbc2856a53b3
SHA1 e295c4273750a6a3991d89374d6f133390f1cbf1
SHA512 fe78cf76c048b4b15d6ed42036d7e96c5d6a84a7c7c0f3131c2e58d8677d40a9e0636b1bf1c9337c981dd60eb181671076560fe4bf6cd58fcd75dd59ea92ba9f
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fI3:knw9oUUEEDl37jcquVoVJ38lCI3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ahpPede.exe

Path C:\Windows\System32\ahpPede.exe
Size 1.5MB
SHA256 f4b2d6c4a1803128865720932c07c687196b7bba926668afe8cf0e329cfce774
MD5 38090bae6fcade60868aa36d141b2bc3
SHA1 4ae67a3e34ba7b49bcdac366d262cc8b9fcc4285
SHA512 c9fae5f45fe165d136ecd15395519fc6c21bcda7d609987295fa3a4d8b30b20bce6fc4cc83a8c42c8e0fb6edca0eeb19272d720b257c1b1f530c4db7327efbe3
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIQ:knw9oUUEEDl37jcquVoVJ38lCIQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

dQWdCwG.exe

Path C:\Windows\System32\dQWdCwG.exe
Size 1.5MB
SHA256 fc82983f4ec1da9d61ca8474e83ae4f6b4d3ae5e9632d84ac0a051cdc079dd99
MD5 17ac7a65bce2342906ed36932633e22a
SHA1 3e39421724e2ba52f1aab1f28d1b856fc27063ed
SHA512 923c52c0f36b2f72efb3bd42b9f70e10c210011641f4366689d30923dc7bcf448468976631233fd93f12ee2f8e93ea323ddd7eab257d08d9fc4375bb81e943ff
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fI/:knw9oUUEEDl37jcquVoVJ38lCI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsswpNP.exe

Path C:\Windows\System32\dsswpNP.exe
Size 1.5MB
SHA256 a1763ca06122b78f8f543a51ef0a4cc75ed910d56975dead86b0baab8bdeca49
MD5 5811c984a95513e9a802943ce0b6b991
SHA1 9047a4caa14ba8d0958a1132a3fba81cf51a382d
SHA512 2618d8257dab1346a4c0ee1c8c0ccb8a5b77a4ab0e64492a3ebb21072755ea8884decbb5dcafe200d2d36a724132ed70952d312ed13d0927d80da80fb96a7f13
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIb:knw9oUUEEDl37jcquVoVJ38lCIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

eHNZVYC.exe

Path C:\Windows\System32\eHNZVYC.exe
Size 1.5MB
SHA256 c87f94bf1517da94ebd4f0f969ef463c62dd9d2c835641abf248ba94a8c55ec2
MD5 337388bf0d6b1176cef30f06a2c1d3fe
SHA1 6e2ac73b742d5d9e1675499fee70d9a25d91678c
SHA512 3ad9d5983c6885f9af8be90384e127a11fcd7d7bde36c83136bc638fdb7c4c8569216aef7f85f97f0cc4faa24b3177f4c7bfef1634820006a04f8e13bab9186e
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIb:knw9oUUEEDl37jcquVoVJ38lCIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

eLmHDOJ.exe

Path C:\Windows\System32\eLmHDOJ.exe
Size 1.5MB
SHA256 159464ac5440d862001fecba2cc28a98ab71b38e91964aab24ea22209d5bb532
MD5 d2e4d24fc9ab0b8e3a63a6020e020342
SHA1 7473489203a9a9baab4256a8f214a7f23df4bb1b
SHA512 6c28b0b55c0f73e69045d7a8a5541291d87eedf306cdeed572db3c7c941e6e05bcd7ed276674b09f38d6569f4be8815376f5cb50384c6caab22d2e1d9bc37631
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIl:knw9oUUEEDl37jcquVoVJ38lCIl
MD5 SHA1 SHA512 SSDEEP

Submit Download

fJLQqlE.exe

Path C:\Windows\System32\fJLQqlE.exe
Size 1.5MB
SHA256 73600df012b4c2de19f8fd3e7432b9192d35d534d34129b1af65f307163ae4b1
MD5 52a97e23018b11b8da743a9eb60574f0
SHA1 de1b1174032decbd69586056b1c17e73dd9e5d5c
SHA512 59e24dacc147bfd395d449265722c110ad3ea1cb8b5b9a4d0d04542271720fd5a643d5a029b36dd6e13a03ce052cc7e197a26ba75c9b7a35180323b7d5050cda
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIyM:knw9oUUEEDl37jcquVoVJ38lCIZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

grkGrSM.exe

Path C:\Windows\System32\grkGrSM.exe
Size 1.5MB
SHA256 6bd9184dc0ee2e08cf6630376231f7718f052dc4af9f0da93996c1f2afbae859
MD5 6662c17389ff4fd9e4eaec9ea81e62c8
SHA1 cba8faef14ec15a72c85b76f4f20164b28b69a40
SHA512 df670dcdb00810c49cf8db21f7569e1d94f542d1e7e8e53074d557e01c3976f7e011fd781e4bbb6ef423a00c20ff34ba49a136c7122a61fb4753b929c4272eaa
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIJ:knw9oUUEEDl37jcquVoVJ38lCIJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hqIhbUI.exe

Path C:\Windows\System32\hqIhbUI.exe
Size 1.5MB
SHA256 50a003188da782ab0405e8a2d7f9dc4005c5e39b4c276ee6a93b96c71175cb41
MD5 b6ecc57943df0950f0566397cc0d0076
SHA1 d15f4b01f5ccd8ae70b78962b7718d96a96b3dce
SHA512 52c90a3f7646bd66505ea904a7f371485e0d397a90213d3cd9f3fd05e06d216ef168986a29f2f90dc282427f93ad244101d8c774781a032e368bd68da60ca01a
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIR:knw9oUUEEDl37jcquVoVJ38lCIR
MD5 SHA1 SHA512 SSDEEP

Submit Download

jQjsxfs.exe

Path C:\Windows\System32\jQjsxfs.exe
Size 1.5MB
SHA256 c04b7add708eda638a6a55917e0f8b09e92ffe0f5e3ec1e9e0d3e4550403a084
MD5 b862f15353b70c3f84671eb3c2912c3e
SHA1 83f00a9e6c171b603a021455cac8ff504285851d
SHA512 3945212ea6ba0c2e0620f8385afbfa2ee2681c5c650ba0e83dd43ce0749629bbf09f7ad08dc47eaa2852c05ea86c05040dd0ed04358d98d7ac5be6acb60982db
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fII:knw9oUUEEDl37jcquVoVJ38lCII
MD5 SHA1 SHA512 SSDEEP

Submit Download

mtFsxTx.exe

Path C:\Windows\System32\mtFsxTx.exe
Size 1.5MB
SHA256 52935ce3fc8dee4b2b01969f49ce3ddcb24e442c6ad312102c9f4ee611d967bc
MD5 1ecf7d8838ed9dba80bbc89c7a7d8ea8
SHA1 0c13fef0e443f11fbbbc55a368929f9fd65046e5
SHA512 2602a3bb8f836ae78509db04416565fe716a4a002dbccf1c6458c390ecb5d1b1b48b2d4cdacdb4d31d85ae09ba696970b64cad80041551192020395a4abca497
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIM:knw9oUUEEDl37jcquVoVJ38lCIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

nlkCgta.exe

Path C:\Windows\System32\nlkCgta.exe
Size 1.5MB
SHA256 c0e796b26acc015e6792c8c2163e95d14a7a5305d3f028506667e54ee589c1b6
MD5 043ab2aeb43eaa046b97cb0f7af0cae0
SHA1 07868645bc0aa65be01f0b064cbb093e3d20cf8f
SHA512 6487e60d9913a31ab2a1dbab8a578f8f5960608055d2727da9332888670e7e5aabea466309c7fa34dfb5ecb74f5167ec1f426f671293f04459ed33cedbe21631
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIj:knw9oUUEEDl37jcquVoVJ38lCIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

qxWYsge.exe

Path C:\Windows\System32\qxWYsge.exe
Size 1.5MB
SHA256 8edbd34e637a084b1cdc065d04adf1c0487825e6741b7c91b058733ab3a5fd4f
MD5 b28cc520e9f71dadf7a01ae4fb15e7c8
SHA1 4404d695d2345049cae3330f57a10e1e5eb24490
SHA512 1e374a44f97a18f72a5457cb6c12106c740eb0541ae035a1e5dd6b12e1a7e7ecb7ccd82f73841ae307e14ffee3830e3b14802d58104c93bb1025af5cd4236ae4
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIqd:knw9oUUEEDl37jcquVoVJ38lCI8
MD5 SHA1 SHA512 SSDEEP

Submit Download

sMvOnQi.exe

Path C:\Windows\System32\sMvOnQi.exe
Size 1.5MB
SHA256 b6a627b9445fde4cec8f6056c09458d7bc9b88211c2d3208a77e9cae548496e7
MD5 f06266329e4d3daacb88142f25698958
SHA1 723710f02189712eaf762c86d9f437730cffb2ea
SHA512 c836233a07eda713e62cdf42336de0d494e3a90dade7d8ee5eea7ab453e6698014585d80147b8cedb5fcc7899e58bde9244d446bc1e52d771a19ec18819eb36b
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIW:knw9oUUEEDl37jcquVoVJ38lCIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

uMJMkOy.exe

Path C:\Windows\System32\uMJMkOy.exe
Size 1.5MB
SHA256 344cec986f67582de340ded2ffbd06551251e83c2486c5704e1dd71ad5f3d4ee
MD5 58497127cde7c5a530498c734cd59a4c
SHA1 5fd81d0078f7af6ec6c77811a46010d488ac153b
SHA512 72efc2c851bca1271f22cf1286cee34a513722cfc16b3816693d48ee16f6a8ccce76cd8b83ce5b8fd1afbe82394109a3f365971769fa5f139250ffcd3b7ef4d6
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIB:knw9oUUEEDl37jcquVoVJ38lCIB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ycdvobi.exe

Path C:\Windows\System32\ycdvobi.exe
Size 1.5MB
SHA256 5b8d78f7a0a012368813409463173ae3cd4e8ea51fa49c502e13db769e33fd2b
MD5 020d85e0272b26641d9f2b46ee15d3ec
SHA1 864a7237e723741b50395c19a788b3ad5414c67b
SHA512 99a01e8b99b90d9a8563bae0aa84a69c5be224139e0fe47e599a9c12a36aab5c811fc6b4314a10bafd6dab246e39504f929b862799f71947ea3f0fe1513973f0
SSDEEP 24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcquVoVbvVkNQaWdZzGuMN5J6fIb:knw9oUUEEDl37jcquVoVJ38lCIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/624-2035-0x00007FF6907F0000-0x00007FF690BE1000-memory.dmp

Download

memory/624-418-0x00007FF6907F0000-0x00007FF690BE1000-memory.dmp

Download

memory/872-2036-0x00007FF7FA9B0000-0x00007FF7FADA1000-memory.dmp

Download

memory/872-419-0x00007FF7FA9B0000-0x00007FF7FADA1000-memory.dmp

Download

memory/1044-1-0x0000023356140000-0x0000023356150000-memory.dmp

Download

memory/1044-1973-0x00007FF7802B0000-0x00007FF7806A1000-memory.dmp

Download

memory/1044-0-0x00007FF7802B0000-0x00007FF7806A1000-memory.dmp

Download

memory/1092-2054-0x00007FF763FB0000-0x00007FF7643A1000-memory.dmp

Download

memory/1092-447-0x00007FF763FB0000-0x00007FF7643A1000-memory.dmp

Download

memory/1112-2059-0x00007FF6F0DA0000-0x00007FF6F1191000-memory.dmp

Download

memory/1112-442-0x00007FF6F0DA0000-0x00007FF6F1191000-memory.dmp

Download

memory/1364-387-0x00007FF672BD0000-0x00007FF672FC1000-memory.dmp

Download

memory/1364-2029-0x00007FF672BD0000-0x00007FF672FC1000-memory.dmp

Download

memory/1512-456-0x00007FF7C6050000-0x00007FF7C6441000-memory.dmp

Download

memory/1512-2022-0x00007FF7C6050000-0x00007FF7C6441000-memory.dmp

Download

memory/1548-407-0x00007FF6855D0000-0x00007FF6859C1000-memory.dmp

Download

memory/1548-2039-0x00007FF6855D0000-0x00007FF6859C1000-memory.dmp

Download

memory/1592-414-0x00007FF76BEF0000-0x00007FF76C2E1000-memory.dmp

Download

memory/1592-2040-0x00007FF76BEF0000-0x00007FF76C2E1000-memory.dmp

Download

memory/1604-2033-0x00007FF681DC0000-0x00007FF6821B1000-memory.dmp

Download

memory/1604-427-0x00007FF681DC0000-0x00007FF6821B1000-memory.dmp

Download

memory/1644-376-0x00007FF777210000-0x00007FF777601000-memory.dmp

Download

memory/1644-2046-0x00007FF777210000-0x00007FF777601000-memory.dmp

Download

memory/1860-382-0x00007FF673FF0000-0x00007FF6743E1000-memory.dmp

Download

memory/1860-2031-0x00007FF673FF0000-0x00007FF6743E1000-memory.dmp

Download

memory/1952-2044-0x00007FF6C9540000-0x00007FF6C9931000-memory.dmp

Download

memory/1952-393-0x00007FF6C9540000-0x00007FF6C9931000-memory.dmp

Download

memory/2348-2016-0x00007FF63D590000-0x00007FF63D981000-memory.dmp

Download

memory/2348-450-0x00007FF63D590000-0x00007FF63D981000-memory.dmp

Download

memory/2388-438-0x00007FF6D4610000-0x00007FF6D4A01000-memory.dmp

Download

memory/2388-2052-0x00007FF6D4610000-0x00007FF6D4A01000-memory.dmp

Download

memory/2744-2014-0x00007FF790000000-0x00007FF7903F1000-memory.dmp

Download

memory/2744-19-0x00007FF790000000-0x00007FF7903F1000-memory.dmp

Download

memory/2880-428-0x00007FF6B57D0000-0x00007FF6B5BC1000-memory.dmp

Download

memory/2880-2027-0x00007FF6B57D0000-0x00007FF6B5BC1000-memory.dmp

Download

memory/3348-1975-0x00007FF7D3A50000-0x00007FF7D3E41000-memory.dmp

Download

memory/3348-362-0x00007FF7D3A50000-0x00007FF7D3E41000-memory.dmp

Download

memory/3348-2019-0x00007FF7D3A50000-0x00007FF7D3E41000-memory.dmp

Download

memory/4400-2024-0x00007FF645360000-0x00007FF645751000-memory.dmp

Download

memory/4400-370-0x00007FF645360000-0x00007FF645751000-memory.dmp

Download

memory/4444-455-0x00007FF637B40000-0x00007FF637F31000-memory.dmp

Download

memory/4444-2020-0x00007FF637B40000-0x00007FF637F31000-memory.dmp

Download

memory/4504-441-0x00007FF7F3CF0000-0x00007FF7F40E1000-memory.dmp

Download

memory/4504-2049-0x00007FF7F3CF0000-0x00007FF7F40E1000-memory.dmp

Download

memory/4516-2051-0x00007FF6126C0000-0x00007FF612AB1000-memory.dmp

Download

memory/4516-431-0x00007FF6126C0000-0x00007FF612AB1000-memory.dmp

Download

memory/4588-2060-0x00007FF775980000-0x00007FF775D71000-memory.dmp

Download

memory/4588-445-0x00007FF775980000-0x00007FF775D71000-memory.dmp

Download

memory/4868-2012-0x00007FF749780000-0x00007FF749B71000-memory.dmp

Download

memory/4868-13-0x00007FF749780000-0x00007FF749B71000-memory.dmp

Download

memory/4872-2043-0x00007FF750D80000-0x00007FF751171000-memory.dmp

Download

memory/4872-405-0x00007FF750D80000-0x00007FF751171000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads