xmrig | 947bd70d491b5db5dbaae66dafecab44182a431b62a19248b40af2eae49c01b5

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
Size

1.2MB
MD5

09a2cc4addda000904c6249c3df3f2ff
SHA1

7d0d991f082fe2ee5a04fd1cf1151e9de0cf4b02
SHA256

947bd70d491b5db5dbaae66dafecab44182a431b62a19248b40af2eae49c01b5
SHA512

961aca5e3d6f64767e08377f1c717cb539f4ccb1304e6232e86c5c12a49d072b9f94b4daf2fccae7a25c2b9b5eff68d2049915f5e0f0f9f447287e055f449f6e
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlGC78XCej5CnGJIOy:knw9oUUEEDlGUrM5Cn3

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4728-47-0x00007FF739F70000-0x00007FF73A361000-memory.dmp	xmrig
behavioral2/memory/4452-298-0x00007FF69A0C0000-0x00007FF69A4B1000-memory.dmp	xmrig
behavioral2/memory/5028-322-0x00007FF6105F0000-0x00007FF6109E1000-memory.dmp	xmrig
behavioral2/memory/4432-333-0x00007FF733560000-0x00007FF733951000-memory.dmp	xmrig
behavioral2/memory/464-346-0x00007FF6A2400000-0x00007FF6A27F1000-memory.dmp	xmrig
behavioral2/memory/3536-356-0x00007FF734110000-0x00007FF734501000-memory.dmp	xmrig
behavioral2/memory/3884-367-0x00007FF67BAC0000-0x00007FF67BEB1000-memory.dmp	xmrig
behavioral2/memory/1368-369-0x00007FF748C80000-0x00007FF749071000-memory.dmp	xmrig
behavioral2/memory/2388-352-0x00007FF6D0740000-0x00007FF6D0B31000-memory.dmp	xmrig
behavioral2/memory/1360-355-0x00007FF6D8090000-0x00007FF6D8481000-memory.dmp	xmrig
behavioral2/memory/2892-375-0x00007FF792270000-0x00007FF792661000-memory.dmp	xmrig
behavioral2/memory/2156-338-0x00007FF6484D0000-0x00007FF6488C1000-memory.dmp	xmrig
behavioral2/memory/4468-327-0x00007FF7190C0000-0x00007FF7194B1000-memory.dmp	xmrig
behavioral2/memory/1444-317-0x00007FF7F6750000-0x00007FF7F6B41000-memory.dmp	xmrig
behavioral2/memory/4252-312-0x00007FF61F690000-0x00007FF61FA81000-memory.dmp	xmrig
behavioral2/memory/2780-311-0x00007FF6F7960000-0x00007FF6F7D51000-memory.dmp	xmrig
behavioral2/memory/3396-308-0x00007FF74B740000-0x00007FF74BB31000-memory.dmp	xmrig
behavioral2/memory/3876-46-0x00007FF7241D0000-0x00007FF7245C1000-memory.dmp	xmrig
behavioral2/memory/2524-43-0x00007FF68DF70000-0x00007FF68E361000-memory.dmp	xmrig
behavioral2/memory/2920-32-0x00007FF637310000-0x00007FF637701000-memory.dmp	xmrig
behavioral2/memory/2400-1978-0x00007FF749AC0000-0x00007FF749EB1000-memory.dmp	xmrig
behavioral2/memory/3480-1979-0x00007FF761CD0000-0x00007FF7620C1000-memory.dmp	xmrig
behavioral2/memory/2524-1980-0x00007FF68DF70000-0x00007FF68E361000-memory.dmp	xmrig
behavioral2/memory/544-1981-0x00007FF79B760000-0x00007FF79BB51000-memory.dmp	xmrig
behavioral2/memory/4104-2019-0x00007FF7444B0000-0x00007FF7448A1000-memory.dmp	xmrig
behavioral2/memory/2400-2021-0x00007FF749AC0000-0x00007FF749EB1000-memory.dmp	xmrig
behavioral2/memory/3480-2023-0x00007FF761CD0000-0x00007FF7620C1000-memory.dmp	xmrig
behavioral2/memory/2920-2025-0x00007FF637310000-0x00007FF637701000-memory.dmp	xmrig
behavioral2/memory/2524-2027-0x00007FF68DF70000-0x00007FF68E361000-memory.dmp	xmrig
behavioral2/memory/4728-2031-0x00007FF739F70000-0x00007FF73A361000-memory.dmp	xmrig
behavioral2/memory/3876-2030-0x00007FF7241D0000-0x00007FF7245C1000-memory.dmp	xmrig
behavioral2/memory/544-2033-0x00007FF79B760000-0x00007FF79BB51000-memory.dmp	xmrig
behavioral2/memory/4452-2037-0x00007FF69A0C0000-0x00007FF69A4B1000-memory.dmp	xmrig
behavioral2/memory/4252-2073-0x00007FF61F690000-0x00007FF61FA81000-memory.dmp	xmrig
behavioral2/memory/4468-2079-0x00007FF7190C0000-0x00007FF7194B1000-memory.dmp	xmrig
behavioral2/memory/4432-2083-0x00007FF733560000-0x00007FF733951000-memory.dmp	xmrig
behavioral2/memory/2388-2089-0x00007FF6D0740000-0x00007FF6D0B31000-memory.dmp	xmrig
behavioral2/memory/3884-2093-0x00007FF67BAC0000-0x00007FF67BEB1000-memory.dmp	xmrig
behavioral2/memory/1368-2095-0x00007FF748C80000-0x00007FF749071000-memory.dmp	xmrig
behavioral2/memory/2892-2097-0x00007FF792270000-0x00007FF792661000-memory.dmp	xmrig
behavioral2/memory/3536-2091-0x00007FF734110000-0x00007FF734501000-memory.dmp	xmrig
behavioral2/memory/464-2087-0x00007FF6A2400000-0x00007FF6A27F1000-memory.dmp	xmrig
behavioral2/memory/1360-2085-0x00007FF6D8090000-0x00007FF6D8481000-memory.dmp	xmrig
behavioral2/memory/2156-2081-0x00007FF6484D0000-0x00007FF6488C1000-memory.dmp	xmrig
behavioral2/memory/5028-2077-0x00007FF6105F0000-0x00007FF6109E1000-memory.dmp	xmrig
behavioral2/memory/1444-2076-0x00007FF7F6750000-0x00007FF7F6B41000-memory.dmp	xmrig
behavioral2/memory/2780-2063-0x00007FF6F7960000-0x00007FF6F7D51000-memory.dmp	xmrig
behavioral2/memory/3396-2036-0x00007FF74B740000-0x00007FF74BB31000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4104	zUgcQlu.exe
2400	KtAMIhz.exe
3480	eAKhpWD.exe
2920	UsgMlYp.exe
2524	KZjSlev.exe
4728	eBPAtkY.exe
3876	juOTOIV.exe
544	jeXdOqB.exe
4452	zeizSJo.exe
3396	MdWqElg.exe
2780	mVsoXXt.exe
4252	tsPZQTe.exe
1444	RGgQrch.exe
5028	HiKBswA.exe
4468	HgrPCXZ.exe
4432	TmtJkht.exe
2156	EvNmLYk.exe
464	NGxuODK.exe
2388	YktAuTo.exe
1360	UMVPSmT.exe
3536	LjPienz.exe
3884	CLxbumd.exe
1368	iNNVhaN.exe
2892	zBzEsIF.exe
220	KYizabx.exe
1020	fFnWdij.exe
4260	QGDmpyJ.exe
4076	hGblJFI.exe
3160	zehKBiY.exe
3612	pteeYsF.exe
1136	FfGvBYu.exe
1384	wOmcaqw.exe
2536	qXfQSrc.exe
956	LjMKWnS.exe
2784	MTZvftW.exe
1356	lRiUJCG.exe
5004	zPeqIrC.exe
3892	jZbkksj.exe
4344	OQsNVHj.exe
2324	cszIgEt.exe
3420	KzrMStE.exe
5012	npxqNLH.exe
1720	AiNBsRs.exe
4832	gKYnRfK.exe
4980	pfArRtT.exe
1804	XpZMroj.exe
624	MfgHGeX.exe
436	ablBZwS.exe
4316	czRjoAW.exe
2436	spODgSR.exe
4392	JBlRBYr.exe
3360	LvFUOeK.exe
992	WXNWAOl.exe
2168	kjDIGQn.exe
4744	ovEhgFk.exe
1816	HVgiacp.exe
2072	RCPBfxE.exe
3636	PDIVQPE.exe
4908	PkjGvuO.exe
4140	EFvULCX.exe
1016	hUZQLYy.exe
2372	inunhkN.exe
4480	fmpjngs.exe
216	lxWcSIJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3624-0-0x00007FF743560000-0x00007FF743951000-memory.dmp	upx
behavioral2/files/0x0007000000023297-5.dat	upx
behavioral2/memory/4104-10-0x00007FF7444B0000-0x00007FF7448A1000-memory.dmp	upx
behavioral2/files/0x000800000002342f-8.dat	upx
behavioral2/files/0x0008000000023432-7.dat	upx
behavioral2/files/0x0007000000023434-27.dat	upx
behavioral2/files/0x0007000000023436-38.dat	upx
behavioral2/files/0x0007000000023435-36.dat	upx
behavioral2/files/0x0007000000023437-44.dat	upx
behavioral2/memory/4728-47-0x00007FF739F70000-0x00007FF73A361000-memory.dmp	upx
behavioral2/files/0x0007000000023438-52.dat	upx
behavioral2/files/0x0007000000023439-59.dat	upx
behavioral2/files/0x000700000002343c-74.dat	upx
behavioral2/files/0x0007000000023447-129.dat	upx
behavioral2/files/0x000700000002344c-154.dat	upx
behavioral2/memory/4452-298-0x00007FF69A0C0000-0x00007FF69A4B1000-memory.dmp	upx
behavioral2/memory/5028-322-0x00007FF6105F0000-0x00007FF6109E1000-memory.dmp	upx
behavioral2/memory/4432-333-0x00007FF733560000-0x00007FF733951000-memory.dmp	upx
behavioral2/memory/464-346-0x00007FF6A2400000-0x00007FF6A27F1000-memory.dmp	upx
behavioral2/memory/3536-356-0x00007FF734110000-0x00007FF734501000-memory.dmp	upx
behavioral2/memory/3884-367-0x00007FF67BAC0000-0x00007FF67BEB1000-memory.dmp	upx
behavioral2/memory/1368-369-0x00007FF748C80000-0x00007FF749071000-memory.dmp	upx
behavioral2/memory/2388-352-0x00007FF6D0740000-0x00007FF6D0B31000-memory.dmp	upx
behavioral2/memory/1360-355-0x00007FF6D8090000-0x00007FF6D8481000-memory.dmp	upx
behavioral2/memory/2892-375-0x00007FF792270000-0x00007FF792661000-memory.dmp	upx
behavioral2/memory/2156-338-0x00007FF6484D0000-0x00007FF6488C1000-memory.dmp	upx
behavioral2/memory/4468-327-0x00007FF7190C0000-0x00007FF7194B1000-memory.dmp	upx
behavioral2/memory/1444-317-0x00007FF7F6750000-0x00007FF7F6B41000-memory.dmp	upx
behavioral2/memory/4252-312-0x00007FF61F690000-0x00007FF61FA81000-memory.dmp	upx
behavioral2/memory/2780-311-0x00007FF6F7960000-0x00007FF6F7D51000-memory.dmp	upx
behavioral2/memory/3396-308-0x00007FF74B740000-0x00007FF74BB31000-memory.dmp	upx
behavioral2/files/0x000700000002344f-169.dat	upx
behavioral2/files/0x000700000002344e-164.dat	upx
behavioral2/files/0x000700000002344d-159.dat	upx
behavioral2/files/0x000700000002344b-149.dat	upx
behavioral2/files/0x000700000002344a-144.dat	upx
behavioral2/files/0x0007000000023449-139.dat	upx
behavioral2/files/0x0007000000023448-134.dat	upx
behavioral2/files/0x0007000000023446-124.dat	upx
behavioral2/files/0x0007000000023445-119.dat	upx
behavioral2/files/0x0007000000023444-114.dat	upx
behavioral2/files/0x0007000000023443-109.dat	upx
behavioral2/files/0x0007000000023442-104.dat	upx
behavioral2/files/0x0007000000023441-99.dat	upx
behavioral2/files/0x0007000000023440-94.dat	upx
behavioral2/files/0x000700000002343f-89.dat	upx
behavioral2/files/0x000700000002343e-84.dat	upx
behavioral2/files/0x000700000002343d-79.dat	upx
behavioral2/files/0x000700000002343b-69.dat	upx
behavioral2/files/0x000700000002343a-64.dat	upx
behavioral2/memory/544-48-0x00007FF79B760000-0x00007FF79BB51000-memory.dmp	upx
behavioral2/memory/3876-46-0x00007FF7241D0000-0x00007FF7245C1000-memory.dmp	upx
behavioral2/memory/2524-43-0x00007FF68DF70000-0x00007FF68E361000-memory.dmp	upx
behavioral2/memory/2920-32-0x00007FF637310000-0x00007FF637701000-memory.dmp	upx
behavioral2/files/0x0007000000023433-21.dat	upx
behavioral2/memory/3480-18-0x00007FF761CD0000-0x00007FF7620C1000-memory.dmp	upx
behavioral2/memory/2400-15-0x00007FF749AC0000-0x00007FF749EB1000-memory.dmp	upx
behavioral2/memory/2400-1978-0x00007FF749AC0000-0x00007FF749EB1000-memory.dmp	upx
behavioral2/memory/3480-1979-0x00007FF761CD0000-0x00007FF7620C1000-memory.dmp	upx
behavioral2/memory/2524-1980-0x00007FF68DF70000-0x00007FF68E361000-memory.dmp	upx
behavioral2/memory/544-1981-0x00007FF79B760000-0x00007FF79BB51000-memory.dmp	upx
behavioral2/memory/4104-2019-0x00007FF7444B0000-0x00007FF7448A1000-memory.dmp	upx
behavioral2/memory/2400-2021-0x00007FF749AC0000-0x00007FF749EB1000-memory.dmp	upx
behavioral2/memory/3480-2023-0x00007FF761CD0000-0x00007FF7620C1000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\uSgVgVq.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\eYonJAL.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\RjImRTg.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\hxKgfBX.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\wpQoMDa.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\SUsrHaw.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\GZBPbec.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\wTPWehH.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\vGTqdlP.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\vhSxnaA.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\ZihsymF.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\JGKKtVg.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\qyrFews.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\NSRfnnV.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\ScedQEY.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\nZmQkyB.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\ksFSVXs.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\ccsIdNz.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\vDjFVZa.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\KETGmYf.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\uePCilK.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\PJdAnYb.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\NGxuODK.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\fOqCotN.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\dPcgkwc.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\xbDYjMV.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\GidzpGm.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\BEdyKKs.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\WXNWAOl.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\lCYNAuK.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\XcQLCqs.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\VMgEiod.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\bxPHXEw.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\sTXntop.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\zAkHeat.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\zUgcQlu.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\iyDYWSv.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\OaQmQXS.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\GZvBreq.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\ZehNUZm.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\ovEhgFk.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\GlZVdXO.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\JOKBkEv.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\DWdoqcZ.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\AmTxpqn.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\hDwcRNv.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\RwDnBvp.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\eKDHyBN.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\qvukDUz.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\RIjsBlj.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\jJtEOIk.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\IYupyGW.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\aBploxM.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\sTvluxe.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\hzWVJUF.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\GMgYKex.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\hTlmakd.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\cTkSsMG.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\KZjSlev.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\UMVPSmT.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\FXNISux.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\opVbAmP.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\LjPienz.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
File created	C:\Windows\System32\QngUXnK.exe	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 4104	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	82
PID 3624 wrote to memory of 4104	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	82
PID 3624 wrote to memory of 2400	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	83
PID 3624 wrote to memory of 2400	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	83
PID 3624 wrote to memory of 3480	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	84
PID 3624 wrote to memory of 3480	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	84
PID 3624 wrote to memory of 2920	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	85
PID 3624 wrote to memory of 2920	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	85
PID 3624 wrote to memory of 2524	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	86
PID 3624 wrote to memory of 2524	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	86
PID 3624 wrote to memory of 3876	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	87
PID 3624 wrote to memory of 3876	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	87
PID 3624 wrote to memory of 4728	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	88
PID 3624 wrote to memory of 4728	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	88
PID 3624 wrote to memory of 544	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	89
PID 3624 wrote to memory of 544	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	89
PID 3624 wrote to memory of 4452	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	90
PID 3624 wrote to memory of 4452	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	90
PID 3624 wrote to memory of 3396	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	91
PID 3624 wrote to memory of 3396	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	91
PID 3624 wrote to memory of 2780	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	92
PID 3624 wrote to memory of 2780	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	92
PID 3624 wrote to memory of 4252	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	93
PID 3624 wrote to memory of 4252	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	93
PID 3624 wrote to memory of 1444	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	94
PID 3624 wrote to memory of 1444	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	94
PID 3624 wrote to memory of 5028	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	95
PID 3624 wrote to memory of 5028	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	95
PID 3624 wrote to memory of 4468	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	96
PID 3624 wrote to memory of 4468	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	96
PID 3624 wrote to memory of 4432	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	97
PID 3624 wrote to memory of 4432	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	97
PID 3624 wrote to memory of 2156	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	98
PID 3624 wrote to memory of 2156	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	98
PID 3624 wrote to memory of 464	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	99
PID 3624 wrote to memory of 464	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	99
PID 3624 wrote to memory of 2388	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	100
PID 3624 wrote to memory of 2388	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	100
PID 3624 wrote to memory of 1360	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	101
PID 3624 wrote to memory of 1360	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	101
PID 3624 wrote to memory of 3536	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	102
PID 3624 wrote to memory of 3536	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	102
PID 3624 wrote to memory of 3884	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	103
PID 3624 wrote to memory of 3884	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	103
PID 3624 wrote to memory of 1368	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	104
PID 3624 wrote to memory of 1368	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	104
PID 3624 wrote to memory of 2892	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	105
PID 3624 wrote to memory of 2892	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	105
PID 3624 wrote to memory of 220	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	106
PID 3624 wrote to memory of 220	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	106
PID 3624 wrote to memory of 1020	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	107
PID 3624 wrote to memory of 1020	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	107
PID 3624 wrote to memory of 4260	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	108
PID 3624 wrote to memory of 4260	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	108
PID 3624 wrote to memory of 4076	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	109
PID 3624 wrote to memory of 4076	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	109
PID 3624 wrote to memory of 3160	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	110
PID 3624 wrote to memory of 3160	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	110
PID 3624 wrote to memory of 3612	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	111
PID 3624 wrote to memory of 3612	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	111
PID 3624 wrote to memory of 1136	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	112
PID 3624 wrote to memory of 1136	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	112
PID 3624 wrote to memory of 1384	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	113
PID 3624 wrote to memory of 1384	3624	09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe	113

C:\Users\Admin\AppData\Local\Temp\09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09a2cc4addda000904c6249c3df3f2ff_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\System32\zUgcQlu.exe
  C:\Windows\System32\zUgcQlu.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System32\KtAMIhz.exe
  C:\Windows\System32\KtAMIhz.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System32\eAKhpWD.exe
  C:\Windows\System32\eAKhpWD.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System32\UsgMlYp.exe
  C:\Windows\System32\UsgMlYp.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System32\KZjSlev.exe
  C:\Windows\System32\KZjSlev.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System32\juOTOIV.exe
  C:\Windows\System32\juOTOIV.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System32\eBPAtkY.exe
  C:\Windows\System32\eBPAtkY.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System32\jeXdOqB.exe
  C:\Windows\System32\jeXdOqB.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System32\zeizSJo.exe
  C:\Windows\System32\zeizSJo.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System32\MdWqElg.exe
  C:\Windows\System32\MdWqElg.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System32\mVsoXXt.exe
  C:\Windows\System32\mVsoXXt.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System32\tsPZQTe.exe
  C:\Windows\System32\tsPZQTe.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System32\RGgQrch.exe
  C:\Windows\System32\RGgQrch.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System32\HiKBswA.exe
  C:\Windows\System32\HiKBswA.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System32\HgrPCXZ.exe
  C:\Windows\System32\HgrPCXZ.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System32\TmtJkht.exe
  C:\Windows\System32\TmtJkht.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System32\EvNmLYk.exe
  C:\Windows\System32\EvNmLYk.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System32\NGxuODK.exe
  C:\Windows\System32\NGxuODK.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System32\YktAuTo.exe
  C:\Windows\System32\YktAuTo.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System32\UMVPSmT.exe
  C:\Windows\System32\UMVPSmT.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System32\LjPienz.exe
  C:\Windows\System32\LjPienz.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System32\CLxbumd.exe
  C:\Windows\System32\CLxbumd.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System32\iNNVhaN.exe
  C:\Windows\System32\iNNVhaN.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System32\zBzEsIF.exe
  C:\Windows\System32\zBzEsIF.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System32\KYizabx.exe
  C:\Windows\System32\KYizabx.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System32\fFnWdij.exe
  C:\Windows\System32\fFnWdij.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System32\QGDmpyJ.exe
  C:\Windows\System32\QGDmpyJ.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System32\hGblJFI.exe
  C:\Windows\System32\hGblJFI.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System32\zehKBiY.exe
  C:\Windows\System32\zehKBiY.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System32\pteeYsF.exe
  C:\Windows\System32\pteeYsF.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System32\FfGvBYu.exe
  C:\Windows\System32\FfGvBYu.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System32\wOmcaqw.exe
  C:\Windows\System32\wOmcaqw.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System32\qXfQSrc.exe
  C:\Windows\System32\qXfQSrc.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System32\LjMKWnS.exe
  C:\Windows\System32\LjMKWnS.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System32\MTZvftW.exe
  C:\Windows\System32\MTZvftW.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System32\lRiUJCG.exe
  C:\Windows\System32\lRiUJCG.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System32\zPeqIrC.exe
  C:\Windows\System32\zPeqIrC.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System32\jZbkksj.exe
  C:\Windows\System32\jZbkksj.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System32\OQsNVHj.exe
  C:\Windows\System32\OQsNVHj.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System32\cszIgEt.exe
  C:\Windows\System32\cszIgEt.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System32\KzrMStE.exe
  C:\Windows\System32\KzrMStE.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System32\npxqNLH.exe
  C:\Windows\System32\npxqNLH.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System32\AiNBsRs.exe
  C:\Windows\System32\AiNBsRs.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System32\gKYnRfK.exe
  C:\Windows\System32\gKYnRfK.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System32\pfArRtT.exe
  C:\Windows\System32\pfArRtT.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System32\XpZMroj.exe
  C:\Windows\System32\XpZMroj.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System32\MfgHGeX.exe
  C:\Windows\System32\MfgHGeX.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System32\ablBZwS.exe
  C:\Windows\System32\ablBZwS.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System32\czRjoAW.exe
  C:\Windows\System32\czRjoAW.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System32\spODgSR.exe
  C:\Windows\System32\spODgSR.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System32\JBlRBYr.exe
  C:\Windows\System32\JBlRBYr.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System32\LvFUOeK.exe
  C:\Windows\System32\LvFUOeK.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System32\WXNWAOl.exe
  C:\Windows\System32\WXNWAOl.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System32\kjDIGQn.exe
  C:\Windows\System32\kjDIGQn.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System32\ovEhgFk.exe
  C:\Windows\System32\ovEhgFk.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System32\HVgiacp.exe
  C:\Windows\System32\HVgiacp.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System32\RCPBfxE.exe
  C:\Windows\System32\RCPBfxE.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System32\PDIVQPE.exe
  C:\Windows\System32\PDIVQPE.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System32\PkjGvuO.exe
  C:\Windows\System32\PkjGvuO.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System32\EFvULCX.exe
  C:\Windows\System32\EFvULCX.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System32\hUZQLYy.exe
  C:\Windows\System32\hUZQLYy.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System32\inunhkN.exe
  C:\Windows\System32\inunhkN.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System32\fmpjngs.exe
  C:\Windows\System32\fmpjngs.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System32\lxWcSIJ.exe
  C:\Windows\System32\lxWcSIJ.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System32\BRkSCpf.exe
  C:\Windows\System32\BRkSCpf.exe
  2⤵
  PID:3604
- C:\Windows\System32\NYCzQGa.exe
  C:\Windows\System32\NYCzQGa.exe
  2⤵
  PID:932
- C:\Windows\System32\jJtEOIk.exe
  C:\Windows\System32\jJtEOIk.exe
  2⤵
  PID:3208
- C:\Windows\System32\FYnpPIF.exe
  C:\Windows\System32\FYnpPIF.exe
  2⤵
  PID:4080
- C:\Windows\System32\wzREuuc.exe
  C:\Windows\System32\wzREuuc.exe
  2⤵
  PID:1752
- C:\Windows\System32\rXLHvje.exe
  C:\Windows\System32\rXLHvje.exe
  2⤵
  PID:3108
- C:\Windows\System32\NFfYewS.exe
  C:\Windows\System32\NFfYewS.exe
  2⤵
  PID:2024
- C:\Windows\System32\VMbVxpD.exe
  C:\Windows\System32\VMbVxpD.exe
  2⤵
  PID:1612
- C:\Windows\System32\ccsIdNz.exe
  C:\Windows\System32\ccsIdNz.exe
  2⤵
  PID:4868
- C:\Windows\System32\wNeFHbT.exe
  C:\Windows\System32\wNeFHbT.exe
  2⤵
  PID:2924
- C:\Windows\System32\fMDYHqm.exe
  C:\Windows\System32\fMDYHqm.exe
  2⤵
  PID:4536
- C:\Windows\System32\werSDpO.exe
  C:\Windows\System32\werSDpO.exe
  2⤵
  PID:716
- C:\Windows\System32\fOqCotN.exe
  C:\Windows\System32\fOqCotN.exe
  2⤵
  PID:1456
- C:\Windows\System32\KvUqlYp.exe
  C:\Windows\System32\KvUqlYp.exe
  2⤵
  PID:1724
- C:\Windows\System32\XrvbeOy.exe
  C:\Windows\System32\XrvbeOy.exe
  2⤵
  PID:5100
- C:\Windows\System32\EBABzNt.exe
  C:\Windows\System32\EBABzNt.exe
  2⤵
  PID:2420
- C:\Windows\System32\dsSTIoU.exe
  C:\Windows\System32\dsSTIoU.exe
  2⤵
  PID:4092
- C:\Windows\System32\vSuQvAG.exe
  C:\Windows\System32\vSuQvAG.exe
  2⤵
  PID:3484
- C:\Windows\System32\dzdwHfw.exe
  C:\Windows\System32\dzdwHfw.exe
  2⤵
  PID:4816
- C:\Windows\System32\fqOFBcg.exe
  C:\Windows\System32\fqOFBcg.exe
  2⤵
  PID:3644
- C:\Windows\System32\gcnqvXR.exe
  C:\Windows\System32\gcnqvXR.exe
  2⤵
  PID:3084
- C:\Windows\System32\eUWRlSt.exe
  C:\Windows\System32\eUWRlSt.exe
  2⤵
  PID:4408
- C:\Windows\System32\CafVZXG.exe
  C:\Windows\System32\CafVZXG.exe
  2⤵
  PID:3816
- C:\Windows\System32\AEXDUYE.exe
  C:\Windows\System32\AEXDUYE.exe
  2⤵
  PID:2392
- C:\Windows\System32\RTmrFRI.exe
  C:\Windows\System32\RTmrFRI.exe
  2⤵
  PID:2744
- C:\Windows\System32\ruOVauo.exe
  C:\Windows\System32\ruOVauo.exe
  2⤵
  PID:4088
- C:\Windows\System32\cSibHXg.exe
  C:\Windows\System32\cSibHXg.exe
  2⤵
  PID:4996
- C:\Windows\System32\iBkqPEw.exe
  C:\Windows\System32\iBkqPEw.exe
  2⤵
  PID:3004
- C:\Windows\System32\kuRwEYq.exe
  C:\Windows\System32\kuRwEYq.exe
  2⤵
  PID:4444
- C:\Windows\System32\hGMDINm.exe
  C:\Windows\System32\hGMDINm.exe
  2⤵
  PID:1552
- C:\Windows\System32\txHabTR.exe
  C:\Windows\System32\txHabTR.exe
  2⤵
  PID:4324
- C:\Windows\System32\iIzjdCY.exe
  C:\Windows\System32\iIzjdCY.exe
  2⤵
  PID:4600
- C:\Windows\System32\meFOTWd.exe
  C:\Windows\System32\meFOTWd.exe
  2⤵
  PID:4056
- C:\Windows\System32\xFaSKER.exe
  C:\Windows\System32\xFaSKER.exe
  2⤵
  PID:4804
- C:\Windows\System32\vyLvxuz.exe
  C:\Windows\System32\vyLvxuz.exe
  2⤵
  PID:5076
- C:\Windows\System32\sTvluxe.exe
  C:\Windows\System32\sTvluxe.exe
  2⤵
  PID:4492
- C:\Windows\System32\qqBjXAO.exe
  C:\Windows\System32\qqBjXAO.exe
  2⤵
  PID:5124
- C:\Windows\System32\FbGcYir.exe
  C:\Windows\System32\FbGcYir.exe
  2⤵
  PID:5156
- C:\Windows\System32\tUprfLy.exe
  C:\Windows\System32\tUprfLy.exe
  2⤵
  PID:5172
- C:\Windows\System32\pdfmQbT.exe
  C:\Windows\System32\pdfmQbT.exe
  2⤵
  PID:5188
- C:\Windows\System32\jdByuGk.exe
  C:\Windows\System32\jdByuGk.exe
  2⤵
  PID:5232
- C:\Windows\System32\oGqQGrY.exe
  C:\Windows\System32\oGqQGrY.exe
  2⤵
  PID:5248
- C:\Windows\System32\OSSphfH.exe
  C:\Windows\System32\OSSphfH.exe
  2⤵
  PID:5268
- C:\Windows\System32\HoVSZuw.exe
  C:\Windows\System32\HoVSZuw.exe
  2⤵
  PID:5288
- C:\Windows\System32\GZBPbec.exe
  C:\Windows\System32\GZBPbec.exe
  2⤵
  PID:5308
- C:\Windows\System32\mNbvNEC.exe
  C:\Windows\System32\mNbvNEC.exe
  2⤵
  PID:5340
- C:\Windows\System32\mcgPJTo.exe
  C:\Windows\System32\mcgPJTo.exe
  2⤵
  PID:5360
- C:\Windows\System32\EzWVSOl.exe
  C:\Windows\System32\EzWVSOl.exe
  2⤵
  PID:5376
- C:\Windows\System32\cKQssbK.exe
  C:\Windows\System32\cKQssbK.exe
  2⤵
  PID:5428
- C:\Windows\System32\ZEXGRHt.exe
  C:\Windows\System32\ZEXGRHt.exe
  2⤵
  PID:5484
- C:\Windows\System32\VDMXWIg.exe
  C:\Windows\System32\VDMXWIg.exe
  2⤵
  PID:5512
- C:\Windows\System32\DrBGfLa.exe
  C:\Windows\System32\DrBGfLa.exe
  2⤵
  PID:5540
- C:\Windows\System32\nOHdbQO.exe
  C:\Windows\System32\nOHdbQO.exe
  2⤵
  PID:5560
- C:\Windows\System32\aaqDsmT.exe
  C:\Windows\System32\aaqDsmT.exe
  2⤵
  PID:5592
- C:\Windows\System32\PgPTRCn.exe
  C:\Windows\System32\PgPTRCn.exe
  2⤵
  PID:5616
- C:\Windows\System32\bHXvGsY.exe
  C:\Windows\System32\bHXvGsY.exe
  2⤵
  PID:5632
- C:\Windows\System32\bxPHXEw.exe
  C:\Windows\System32\bxPHXEw.exe
  2⤵
  PID:5656
- C:\Windows\System32\gVpDjwX.exe
  C:\Windows\System32\gVpDjwX.exe
  2⤵
  PID:5704
- C:\Windows\System32\IZUrzif.exe
  C:\Windows\System32\IZUrzif.exe
  2⤵
  PID:5720
- C:\Windows\System32\IMJbWTJ.exe
  C:\Windows\System32\IMJbWTJ.exe
  2⤵
  PID:5740
- C:\Windows\System32\Fvlwyek.exe
  C:\Windows\System32\Fvlwyek.exe
  2⤵
  PID:5784
- C:\Windows\System32\mMBzHto.exe
  C:\Windows\System32\mMBzHto.exe
  2⤵
  PID:5812
- C:\Windows\System32\RzYDJqg.exe
  C:\Windows\System32\RzYDJqg.exe
  2⤵
  PID:5860
- C:\Windows\System32\ogYSnOr.exe
  C:\Windows\System32\ogYSnOr.exe
  2⤵
  PID:5876
- C:\Windows\System32\bGKESGg.exe
  C:\Windows\System32\bGKESGg.exe
  2⤵
  PID:5896
- C:\Windows\System32\nVswdWB.exe
  C:\Windows\System32\nVswdWB.exe
  2⤵
  PID:5916
- C:\Windows\System32\VHntMQW.exe
  C:\Windows\System32\VHntMQW.exe
  2⤵
  PID:5944
- C:\Windows\System32\pQrGLFg.exe
  C:\Windows\System32\pQrGLFg.exe
  2⤵
  PID:5972
- C:\Windows\System32\xPODbBf.exe
  C:\Windows\System32\xPODbBf.exe
  2⤵
  PID:5996
- C:\Windows\System32\rvVjKQq.exe
  C:\Windows\System32\rvVjKQq.exe
  2⤵
  PID:6032
- C:\Windows\System32\nZFIBBv.exe
  C:\Windows\System32\nZFIBBv.exe
  2⤵
  PID:6048
- C:\Windows\System32\xIbTRky.exe
  C:\Windows\System32\xIbTRky.exe
  2⤵
  PID:6068
- C:\Windows\System32\qyrFews.exe
  C:\Windows\System32\qyrFews.exe
  2⤵
  PID:6092
- C:\Windows\System32\XbgbFEn.exe
  C:\Windows\System32\XbgbFEn.exe
  2⤵
  PID:6108
- C:\Windows\System32\CpajnSw.exe
  C:\Windows\System32\CpajnSw.exe
  2⤵
  PID:6128
- C:\Windows\System32\EgFbrlS.exe
  C:\Windows\System32\EgFbrlS.exe
  2⤵
  PID:5140
- C:\Windows\System32\vbCHqyj.exe
  C:\Windows\System32\vbCHqyj.exe
  2⤵
  PID:5304
- C:\Windows\System32\lrivoth.exe
  C:\Windows\System32\lrivoth.exe
  2⤵
  PID:5356
- C:\Windows\System32\LdhAAqG.exe
  C:\Windows\System32\LdhAAqG.exe
  2⤵
  PID:5444
- C:\Windows\System32\jBGkuAO.exe
  C:\Windows\System32\jBGkuAO.exe
  2⤵
  PID:5456
- C:\Windows\System32\DdnBHOr.exe
  C:\Windows\System32\DdnBHOr.exe
  2⤵
  PID:5648
- C:\Windows\System32\vDjFVZa.exe
  C:\Windows\System32\vDjFVZa.exe
  2⤵
  PID:5644
- C:\Windows\System32\QUPGLGS.exe
  C:\Windows\System32\QUPGLGS.exe
  2⤵
  PID:5716
- C:\Windows\System32\NsBfFcL.exe
  C:\Windows\System32\NsBfFcL.exe
  2⤵
  PID:5748
- C:\Windows\System32\WvNhAaY.exe
  C:\Windows\System32\WvNhAaY.exe
  2⤵
  PID:5808
- C:\Windows\System32\HMMhHAs.exe
  C:\Windows\System32\HMMhHAs.exe
  2⤵
  PID:5848
- C:\Windows\System32\NanxICT.exe
  C:\Windows\System32\NanxICT.exe
  2⤵
  PID:5924
- C:\Windows\System32\zMZuhDt.exe
  C:\Windows\System32\zMZuhDt.exe
  2⤵
  PID:5956
- C:\Windows\System32\gOCxaVJ.exe
  C:\Windows\System32\gOCxaVJ.exe
  2⤵
  PID:6044
- C:\Windows\System32\GlgXXRq.exe
  C:\Windows\System32\GlgXXRq.exe
  2⤵
  PID:6120
- C:\Windows\System32\DAQSsJg.exe
  C:\Windows\System32\DAQSsJg.exe
  2⤵
  PID:5164
- C:\Windows\System32\PMnbPSE.exe
  C:\Windows\System32\PMnbPSE.exe
  2⤵
  PID:5296
- C:\Windows\System32\GMgYKex.exe
  C:\Windows\System32\GMgYKex.exe
  2⤵
  PID:5392
- C:\Windows\System32\pwsEegG.exe
  C:\Windows\System32\pwsEegG.exe
  2⤵
  PID:5472
- C:\Windows\System32\ZHtOgAM.exe
  C:\Windows\System32\ZHtOgAM.exe
  2⤵
  PID:5608
- C:\Windows\System32\XoroERW.exe
  C:\Windows\System32\XoroERW.exe
  2⤵
  PID:4956
- C:\Windows\System32\KBtdnaI.exe
  C:\Windows\System32\KBtdnaI.exe
  2⤵
  PID:904
- C:\Windows\System32\yojQHkJ.exe
  C:\Windows\System32\yojQHkJ.exe
  2⤵
  PID:5928
- C:\Windows\System32\ZrNxfre.exe
  C:\Windows\System32\ZrNxfre.exe
  2⤵
  PID:6028
- C:\Windows\System32\CACaJxM.exe
  C:\Windows\System32\CACaJxM.exe
  2⤵
  PID:5180
- C:\Windows\System32\wTPWehH.exe
  C:\Windows\System32\wTPWehH.exe
  2⤵
  PID:5368
- C:\Windows\System32\AmTxpqn.exe
  C:\Windows\System32\AmTxpqn.exe
  2⤵
  PID:5712
- C:\Windows\System32\PjsinVk.exe
  C:\Windows\System32\PjsinVk.exe
  2⤵
  PID:6152
- C:\Windows\System32\dcaKAGL.exe
  C:\Windows\System32\dcaKAGL.exe
  2⤵
  PID:6172
- C:\Windows\System32\BPNmhtz.exe
  C:\Windows\System32\BPNmhtz.exe
  2⤵
  PID:6196
- C:\Windows\System32\IYupyGW.exe
  C:\Windows\System32\IYupyGW.exe
  2⤵
  PID:6256
- C:\Windows\System32\DLyLzkE.exe
  C:\Windows\System32\DLyLzkE.exe
  2⤵
  PID:6272
- C:\Windows\System32\nKjpmSt.exe
  C:\Windows\System32\nKjpmSt.exe
  2⤵
  PID:6296
- C:\Windows\System32\GlZVdXO.exe
  C:\Windows\System32\GlZVdXO.exe
  2⤵
  PID:6312
- C:\Windows\System32\BtCTVCw.exe
  C:\Windows\System32\BtCTVCw.exe
  2⤵
  PID:6344
- C:\Windows\System32\psYZWSv.exe
  C:\Windows\System32\psYZWSv.exe
  2⤵
  PID:6360
- C:\Windows\System32\cgKHvLA.exe
  C:\Windows\System32\cgKHvLA.exe
  2⤵
  PID:6384
- C:\Windows\System32\oVkuSTk.exe
  C:\Windows\System32\oVkuSTk.exe
  2⤵
  PID:6420
- C:\Windows\System32\UQjoHMi.exe
  C:\Windows\System32\UQjoHMi.exe
  2⤵
  PID:6512
- C:\Windows\System32\DzmefjG.exe
  C:\Windows\System32\DzmefjG.exe
  2⤵
  PID:6560
- C:\Windows\System32\gKiULuV.exe
  C:\Windows\System32\gKiULuV.exe
  2⤵
  PID:6592
- C:\Windows\System32\zaDHetb.exe
  C:\Windows\System32\zaDHetb.exe
  2⤵
  PID:6616
- C:\Windows\System32\RwDnBvp.exe
  C:\Windows\System32\RwDnBvp.exe
  2⤵
  PID:6632
- C:\Windows\System32\PYTiVix.exe
  C:\Windows\System32\PYTiVix.exe
  2⤵
  PID:6660
- C:\Windows\System32\NSRfnnV.exe
  C:\Windows\System32\NSRfnnV.exe
  2⤵
  PID:6680
- C:\Windows\System32\eYonJAL.exe
  C:\Windows\System32\eYonJAL.exe
  2⤵
  PID:6716
- C:\Windows\System32\TpBNFRw.exe
  C:\Windows\System32\TpBNFRw.exe
  2⤵
  PID:6748
- C:\Windows\System32\MsvSvxi.exe
  C:\Windows\System32\MsvSvxi.exe
  2⤵
  PID:6780
- C:\Windows\System32\xHpiXFB.exe
  C:\Windows\System32\xHpiXFB.exe
  2⤵
  PID:6812
- C:\Windows\System32\XvYaVoQ.exe
  C:\Windows\System32\XvYaVoQ.exe
  2⤵
  PID:6832
- C:\Windows\System32\PlaLulh.exe
  C:\Windows\System32\PlaLulh.exe
  2⤵
  PID:6852
- C:\Windows\System32\LnBTkRe.exe
  C:\Windows\System32\LnBTkRe.exe
  2⤵
  PID:6876
- C:\Windows\System32\iZGrxfj.exe
  C:\Windows\System32\iZGrxfj.exe
  2⤵
  PID:6896
- C:\Windows\System32\hDwcRNv.exe
  C:\Windows\System32\hDwcRNv.exe
  2⤵
  PID:6932
- C:\Windows\System32\rTRjNld.exe
  C:\Windows\System32\rTRjNld.exe
  2⤵
  PID:6952
- C:\Windows\System32\ezwoKNW.exe
  C:\Windows\System32\ezwoKNW.exe
  2⤵
  PID:6968
- C:\Windows\System32\GrkwRom.exe
  C:\Windows\System32\GrkwRom.exe
  2⤵
  PID:6996
- C:\Windows\System32\ApSWQAz.exe
  C:\Windows\System32\ApSWQAz.exe
  2⤵
  PID:7040
- C:\Windows\System32\QngUXnK.exe
  C:\Windows\System32\QngUXnK.exe
  2⤵
  PID:7092
- C:\Windows\System32\tARJqUv.exe
  C:\Windows\System32\tARJqUv.exe
  2⤵
  PID:7108
- C:\Windows\System32\EBGhouG.exe
  C:\Windows\System32\EBGhouG.exe
  2⤵
  PID:7132
- C:\Windows\System32\EXfiWQh.exe
  C:\Windows\System32\EXfiWQh.exe
  2⤵
  PID:7148
- C:\Windows\System32\gWenYNb.exe
  C:\Windows\System32\gWenYNb.exe
  2⤵
  PID:4256
- C:\Windows\System32\gDDweJX.exe
  C:\Windows\System32\gDDweJX.exe
  2⤵
  PID:5856
- C:\Windows\System32\wmoMOuZ.exe
  C:\Windows\System32\wmoMOuZ.exe
  2⤵
  PID:5588
- C:\Windows\System32\GyeWIfV.exe
  C:\Windows\System32\GyeWIfV.exe
  2⤵
  PID:6304
- C:\Windows\System32\hzWVJUF.exe
  C:\Windows\System32\hzWVJUF.exe
  2⤵
  PID:6308
- C:\Windows\System32\DXcJwIJ.exe
  C:\Windows\System32\DXcJwIJ.exe
  2⤵
  PID:6368
- C:\Windows\System32\QPMBiTU.exe
  C:\Windows\System32\QPMBiTU.exe
  2⤵
  PID:6440
- C:\Windows\System32\VGeQkOx.exe
  C:\Windows\System32\VGeQkOx.exe
  2⤵
  PID:6524
- C:\Windows\System32\JGWQzZQ.exe
  C:\Windows\System32\JGWQzZQ.exe
  2⤵
  PID:6580
- C:\Windows\System32\KuZfxSQ.exe
  C:\Windows\System32\KuZfxSQ.exe
  2⤵
  PID:6648
- C:\Windows\System32\oRUWwWW.exe
  C:\Windows\System32\oRUWwWW.exe
  2⤵
  PID:6672
- C:\Windows\System32\moryxZQ.exe
  C:\Windows\System32\moryxZQ.exe
  2⤵
  PID:6768
- C:\Windows\System32\PsLhiTm.exe
  C:\Windows\System32\PsLhiTm.exe
  2⤵
  PID:6804
- C:\Windows\System32\UKPDUWi.exe
  C:\Windows\System32\UKPDUWi.exe
  2⤵
  PID:5108
- C:\Windows\System32\ACiXBfK.exe
  C:\Windows\System32\ACiXBfK.exe
  2⤵
  PID:6892
- C:\Windows\System32\uMUSRCd.exe
  C:\Windows\System32\uMUSRCd.exe
  2⤵
  PID:6924
- C:\Windows\System32\KyicXkp.exe
  C:\Windows\System32\KyicXkp.exe
  2⤵
  PID:7024
- C:\Windows\System32\QcipmmN.exe
  C:\Windows\System32\QcipmmN.exe
  2⤵
  PID:7104
- C:\Windows\System32\EGzJdZC.exe
  C:\Windows\System32\EGzJdZC.exe
  2⤵
  PID:7144
- C:\Windows\System32\sTXntop.exe
  C:\Windows\System32\sTXntop.exe
  2⤵
  PID:5580
- C:\Windows\System32\qkBrXwN.exe
  C:\Windows\System32\qkBrXwN.exe
  2⤵
  PID:6280
- C:\Windows\System32\VVoHyOa.exe
  C:\Windows\System32\VVoHyOa.exe
  2⤵
  PID:6244
- C:\Windows\System32\BFuwQQY.exe
  C:\Windows\System32\BFuwQQY.exe
  2⤵
  PID:4932
- C:\Windows\System32\ScedQEY.exe
  C:\Windows\System32\ScedQEY.exe
  2⤵
  PID:6708
- C:\Windows\System32\lpMFTLa.exe
  C:\Windows\System32\lpMFTLa.exe
  2⤵
  PID:6964
- C:\Windows\System32\ZeZepvG.exe
  C:\Windows\System32\ZeZepvG.exe
  2⤵
  PID:7128
- C:\Windows\System32\tRuMPvm.exe
  C:\Windows\System32\tRuMPvm.exe
  2⤵
  PID:6692
- C:\Windows\System32\whZjRaR.exe
  C:\Windows\System32\whZjRaR.exe
  2⤵
  PID:6404
- C:\Windows\System32\ecIiFnu.exe
  C:\Windows\System32\ecIiFnu.exe
  2⤵
  PID:6920
- C:\Windows\System32\mmwOFNO.exe
  C:\Windows\System32\mmwOFNO.exe
  2⤵
  PID:7140
- C:\Windows\System32\jUtwfoI.exe
  C:\Windows\System32\jUtwfoI.exe
  2⤵
  PID:7208
- C:\Windows\System32\SoWWtKJ.exe
  C:\Windows\System32\SoWWtKJ.exe
  2⤵
  PID:7244
- C:\Windows\System32\qExEvRS.exe
  C:\Windows\System32\qExEvRS.exe
  2⤵
  PID:7260
- C:\Windows\System32\FGpkJRl.exe
  C:\Windows\System32\FGpkJRl.exe
  2⤵
  PID:7288
- C:\Windows\System32\PnmNCVt.exe
  C:\Windows\System32\PnmNCVt.exe
  2⤵
  PID:7324
- C:\Windows\System32\bPdSLTp.exe
  C:\Windows\System32\bPdSLTp.exe
  2⤵
  PID:7364
- C:\Windows\System32\wxqPnuZ.exe
  C:\Windows\System32\wxqPnuZ.exe
  2⤵
  PID:7388
- C:\Windows\System32\XzSqJLS.exe
  C:\Windows\System32\XzSqJLS.exe
  2⤵
  PID:7412
- C:\Windows\System32\DPlPtgB.exe
  C:\Windows\System32\DPlPtgB.exe
  2⤵
  PID:7452
- C:\Windows\System32\cfVVilO.exe
  C:\Windows\System32\cfVVilO.exe
  2⤵
  PID:7468
- C:\Windows\System32\aBploxM.exe
  C:\Windows\System32\aBploxM.exe
  2⤵
  PID:7492
- C:\Windows\System32\wIIVsuF.exe
  C:\Windows\System32\wIIVsuF.exe
  2⤵
  PID:7508
- C:\Windows\System32\dZYspqb.exe
  C:\Windows\System32\dZYspqb.exe
  2⤵
  PID:7528
- C:\Windows\System32\RPmkZdm.exe
  C:\Windows\System32\RPmkZdm.exe
  2⤵
  PID:7552
- C:\Windows\System32\bupHjNr.exe
  C:\Windows\System32\bupHjNr.exe
  2⤵
  PID:7568
- C:\Windows\System32\SQIiTDy.exe
  C:\Windows\System32\SQIiTDy.exe
  2⤵
  PID:7644
- C:\Windows\System32\Bretsuf.exe
  C:\Windows\System32\Bretsuf.exe
  2⤵
  PID:7668
- C:\Windows\System32\VSWPJap.exe
  C:\Windows\System32\VSWPJap.exe
  2⤵
  PID:7684
- C:\Windows\System32\lCYNAuK.exe
  C:\Windows\System32\lCYNAuK.exe
  2⤵
  PID:7708
- C:\Windows\System32\KkabPoK.exe
  C:\Windows\System32\KkabPoK.exe
  2⤵
  PID:7748
- C:\Windows\System32\SNVKGZS.exe
  C:\Windows\System32\SNVKGZS.exe
  2⤵
  PID:7772
- C:\Windows\System32\PdWWQpw.exe
  C:\Windows\System32\PdWWQpw.exe
  2⤵
  PID:7816
- C:\Windows\System32\TeXwAtS.exe
  C:\Windows\System32\TeXwAtS.exe
  2⤵
  PID:7840
- C:\Windows\System32\iyDYWSv.exe
  C:\Windows\System32\iyDYWSv.exe
  2⤵
  PID:7868
- C:\Windows\System32\FTKmKkA.exe
  C:\Windows\System32\FTKmKkA.exe
  2⤵
  PID:7884
- C:\Windows\System32\zbPcRCi.exe
  C:\Windows\System32\zbPcRCi.exe
  2⤵
  PID:7912
- C:\Windows\System32\pjoSGpb.exe
  C:\Windows\System32\pjoSGpb.exe
  2⤵
  PID:7928
- C:\Windows\System32\lMsWYZK.exe
  C:\Windows\System32\lMsWYZK.exe
  2⤵
  PID:7956
- C:\Windows\System32\vGTqdlP.exe
  C:\Windows\System32\vGTqdlP.exe
  2⤵
  PID:7972
- C:\Windows\System32\BYBPJbj.exe
  C:\Windows\System32\BYBPJbj.exe
  2⤵
  PID:8008
- C:\Windows\System32\wPMOKTc.exe
  C:\Windows\System32\wPMOKTc.exe
  2⤵
  PID:8044
- C:\Windows\System32\YrNbNsC.exe
  C:\Windows\System32\YrNbNsC.exe
  2⤵
  PID:8076
- C:\Windows\System32\tVLBwQr.exe
  C:\Windows\System32\tVLBwQr.exe
  2⤵
  PID:8100
- C:\Windows\System32\tIJRsNN.exe
  C:\Windows\System32\tIJRsNN.exe
  2⤵
  PID:8144
- C:\Windows\System32\fTHifRB.exe
  C:\Windows\System32\fTHifRB.exe
  2⤵
  PID:8160
- C:\Windows\System32\zTEJqUL.exe
  C:\Windows\System32\zTEJqUL.exe
  2⤵
  PID:8184
- C:\Windows\System32\cDDTPSb.exe
  C:\Windows\System32\cDDTPSb.exe
  2⤵
  PID:6232
- C:\Windows\System32\ejtkmzx.exe
  C:\Windows\System32\ejtkmzx.exe
  2⤵
  PID:7272
- C:\Windows\System32\MfbgYcz.exe
  C:\Windows\System32\MfbgYcz.exe
  2⤵
  PID:7344
- C:\Windows\System32\kxxfuLL.exe
  C:\Windows\System32\kxxfuLL.exe
  2⤵
  PID:7400
- C:\Windows\System32\HDchJWP.exe
  C:\Windows\System32\HDchJWP.exe
  2⤵
  PID:7524
- C:\Windows\System32\DqmPDXj.exe
  C:\Windows\System32\DqmPDXj.exe
  2⤵
  PID:7520
- C:\Windows\System32\qGJWgSj.exe
  C:\Windows\System32\qGJWgSj.exe
  2⤵
  PID:7588
- C:\Windows\System32\VmCnidw.exe
  C:\Windows\System32\VmCnidw.exe
  2⤵
  PID:7636
- C:\Windows\System32\XaVadxo.exe
  C:\Windows\System32\XaVadxo.exe
  2⤵
  PID:7692
- C:\Windows\System32\pXMpPbd.exe
  C:\Windows\System32\pXMpPbd.exe
  2⤵
  PID:7760
- C:\Windows\System32\gcvxEAU.exe
  C:\Windows\System32\gcvxEAU.exe
  2⤵
  PID:7764
- C:\Windows\System32\gqhYDol.exe
  C:\Windows\System32\gqhYDol.exe
  2⤵
  PID:7852
- C:\Windows\System32\sCXSCyR.exe
  C:\Windows\System32\sCXSCyR.exe
  2⤵
  PID:3580
- C:\Windows\System32\Zuapyht.exe
  C:\Windows\System32\Zuapyht.exe
  2⤵
  PID:7948
- C:\Windows\System32\IonIUCN.exe
  C:\Windows\System32\IonIUCN.exe
  2⤵
  PID:7980
- C:\Windows\System32\TRqhkLs.exe
  C:\Windows\System32\TRqhkLs.exe
  2⤵
  PID:8072
- C:\Windows\System32\pBITyZs.exe
  C:\Windows\System32\pBITyZs.exe
  2⤵
  PID:8084
- C:\Windows\System32\bcMJlpu.exe
  C:\Windows\System32\bcMJlpu.exe
  2⤵
  PID:8180
- C:\Windows\System32\ypACNJM.exe
  C:\Windows\System32\ypACNJM.exe
  2⤵
  PID:8176
- C:\Windows\System32\BiZgjGr.exe
  C:\Windows\System32\BiZgjGr.exe
  2⤵
  PID:7300
- C:\Windows\System32\mIUfzvc.exe
  C:\Windows\System32\mIUfzvc.exe
  2⤵
  PID:7440
- C:\Windows\System32\mWghYvS.exe
  C:\Windows\System32\mWghYvS.exe
  2⤵
  PID:7560
- C:\Windows\System32\qIXFImY.exe
  C:\Windows\System32\qIXFImY.exe
  2⤵
  PID:7832
- C:\Windows\System32\HWxhgzm.exe
  C:\Windows\System32\HWxhgzm.exe
  2⤵
  PID:8096
- C:\Windows\System32\sCXLSDL.exe
  C:\Windows\System32\sCXLSDL.exe
  2⤵
  PID:7220
- C:\Windows\System32\nZmQkyB.exe
  C:\Windows\System32\nZmQkyB.exe
  2⤵
  PID:7680
- C:\Windows\System32\ZFDLErI.exe
  C:\Windows\System32\ZFDLErI.exe
  2⤵
  PID:8168
- C:\Windows\System32\ABEqmOK.exe
  C:\Windows\System32\ABEqmOK.exe
  2⤵
  PID:7992
- C:\Windows\System32\rCCyvKd.exe
  C:\Windows\System32\rCCyvKd.exe
  2⤵
  PID:8240
- C:\Windows\System32\QlQuIUT.exe
  C:\Windows\System32\QlQuIUT.exe
  2⤵
  PID:8260
- C:\Windows\System32\OaQmQXS.exe
  C:\Windows\System32\OaQmQXS.exe
  2⤵
  PID:8284
- C:\Windows\System32\KXoPTqA.exe
  C:\Windows\System32\KXoPTqA.exe
  2⤵
  PID:8308
- C:\Windows\System32\TYDZMxh.exe
  C:\Windows\System32\TYDZMxh.exe
  2⤵
  PID:8348
- C:\Windows\System32\rqbxdvp.exe
  C:\Windows\System32\rqbxdvp.exe
  2⤵
  PID:8372
- C:\Windows\System32\QEoQvzt.exe
  C:\Windows\System32\QEoQvzt.exe
  2⤵
  PID:8396
- C:\Windows\System32\ZnVNbpU.exe
  C:\Windows\System32\ZnVNbpU.exe
  2⤵
  PID:8424
- C:\Windows\System32\vjfrbZP.exe
  C:\Windows\System32\vjfrbZP.exe
  2⤵
  PID:8444
- C:\Windows\System32\gWTxEhn.exe
  C:\Windows\System32\gWTxEhn.exe
  2⤵
  PID:8484
- C:\Windows\System32\JMcwCJc.exe
  C:\Windows\System32\JMcwCJc.exe
  2⤵
  PID:8520
- C:\Windows\System32\KSEShdV.exe
  C:\Windows\System32\KSEShdV.exe
  2⤵
  PID:8544
- C:\Windows\System32\aUfkggB.exe
  C:\Windows\System32\aUfkggB.exe
  2⤵
  PID:8576
- C:\Windows\System32\IPJnlyu.exe
  C:\Windows\System32\IPJnlyu.exe
  2⤵
  PID:8592
- C:\Windows\System32\OrzEgEE.exe
  C:\Windows\System32\OrzEgEE.exe
  2⤵
  PID:8612
- C:\Windows\System32\azyWrWz.exe
  C:\Windows\System32\azyWrWz.exe
  2⤵
  PID:8644
- C:\Windows\System32\jRyidRr.exe
  C:\Windows\System32\jRyidRr.exe
  2⤵
  PID:8676
- C:\Windows\System32\AoFEzmC.exe
  C:\Windows\System32\AoFEzmC.exe
  2⤵
  PID:8700
- C:\Windows\System32\ExGEMmY.exe
  C:\Windows\System32\ExGEMmY.exe
  2⤵
  PID:8732
- C:\Windows\System32\SexnTeL.exe
  C:\Windows\System32\SexnTeL.exe
  2⤵
  PID:8776
- C:\Windows\System32\UDzHgGF.exe
  C:\Windows\System32\UDzHgGF.exe
  2⤵
  PID:8800
- C:\Windows\System32\GZvBreq.exe
  C:\Windows\System32\GZvBreq.exe
  2⤵
  PID:8828
- C:\Windows\System32\PCuRHMS.exe
  C:\Windows\System32\PCuRHMS.exe
  2⤵
  PID:8848
- C:\Windows\System32\gtaeOdM.exe
  C:\Windows\System32\gtaeOdM.exe
  2⤵
  PID:8876
- C:\Windows\System32\fDKoEAC.exe
  C:\Windows\System32\fDKoEAC.exe
  2⤵
  PID:8900
- C:\Windows\System32\dPcgkwc.exe
  C:\Windows\System32\dPcgkwc.exe
  2⤵
  PID:8916
- C:\Windows\System32\cBLbPgi.exe
  C:\Windows\System32\cBLbPgi.exe
  2⤵
  PID:8972
- C:\Windows\System32\jsbPjhj.exe
  C:\Windows\System32\jsbPjhj.exe
  2⤵
  PID:9004
- C:\Windows\System32\IxadocE.exe
  C:\Windows\System32\IxadocE.exe
  2⤵
  PID:9024
- C:\Windows\System32\ZRjSjBi.exe
  C:\Windows\System32\ZRjSjBi.exe
  2⤵
  PID:9060
- C:\Windows\System32\NbpcLlm.exe
  C:\Windows\System32\NbpcLlm.exe
  2⤵
  PID:9084
- C:\Windows\System32\vhSxnaA.exe
  C:\Windows\System32\vhSxnaA.exe
  2⤵
  PID:9108
- C:\Windows\System32\gVkXkqu.exe
  C:\Windows\System32\gVkXkqu.exe
  2⤵
  PID:9156
- C:\Windows\System32\LRvrbkv.exe
  C:\Windows\System32\LRvrbkv.exe
  2⤵
  PID:9172
- C:\Windows\System32\kZvfutg.exe
  C:\Windows\System32\kZvfutg.exe
  2⤵
  PID:9196
- C:\Windows\System32\RVEnKqk.exe
  C:\Windows\System32\RVEnKqk.exe
  2⤵
  PID:9212
- C:\Windows\System32\NIcdRfI.exe
  C:\Windows\System32\NIcdRfI.exe
  2⤵
  PID:8228
- C:\Windows\System32\BRzlQjS.exe
  C:\Windows\System32\BRzlQjS.exe
  2⤵
  PID:8276
- C:\Windows\System32\vuVgdWF.exe
  C:\Windows\System32\vuVgdWF.exe
  2⤵
  PID:8392
- C:\Windows\System32\IieeHoM.exe
  C:\Windows\System32\IieeHoM.exe
  2⤵
  PID:8436
- C:\Windows\System32\BowQVVQ.exe
  C:\Windows\System32\BowQVVQ.exe
  2⤵
  PID:8516
- C:\Windows\System32\VSHTgtv.exe
  C:\Windows\System32\VSHTgtv.exe
  2⤵
  PID:8588
- C:\Windows\System32\IwqLSmP.exe
  C:\Windows\System32\IwqLSmP.exe
  2⤵
  PID:8632
- C:\Windows\System32\ToyyvrF.exe
  C:\Windows\System32\ToyyvrF.exe
  2⤵
  PID:8724
- C:\Windows\System32\SzjSsWS.exe
  C:\Windows\System32\SzjSsWS.exe
  2⤵
  PID:8772
- C:\Windows\System32\ijIwENj.exe
  C:\Windows\System32\ijIwENj.exe
  2⤵
  PID:8840
- C:\Windows\System32\ZMprbyg.exe
  C:\Windows\System32\ZMprbyg.exe
  2⤵
  PID:8924
- C:\Windows\System32\oFzXcgH.exe
  C:\Windows\System32\oFzXcgH.exe
  2⤵
  PID:8992
- C:\Windows\System32\xbDYjMV.exe
  C:\Windows\System32\xbDYjMV.exe
  2⤵
  PID:9016
- C:\Windows\System32\EnSoBGg.exe
  C:\Windows\System32\EnSoBGg.exe
  2⤵
  PID:1488
- C:\Windows\System32\tMayWEP.exe
  C:\Windows\System32\tMayWEP.exe
  2⤵
  PID:8200
- C:\Windows\System32\QUShyfT.exe
  C:\Windows\System32\QUShyfT.exe
  2⤵
  PID:8216
- C:\Windows\System32\ameSMfp.exe
  C:\Windows\System32\ameSMfp.exe
  2⤵
  PID:8364
- C:\Windows\System32\kXZOsek.exe
  C:\Windows\System32\kXZOsek.exe
  2⤵
  PID:8532
- C:\Windows\System32\HJzdyhh.exe
  C:\Windows\System32\HJzdyhh.exe
  2⤵
  PID:8656
- C:\Windows\System32\eHKKCPn.exe
  C:\Windows\System32\eHKKCPn.exe
  2⤵
  PID:8808
- C:\Windows\System32\JlJQTpY.exe
  C:\Windows\System32\JlJQTpY.exe
  2⤵
  PID:8952
- C:\Windows\System32\KETGmYf.exe
  C:\Windows\System32\KETGmYf.exe
  2⤵
  PID:9148
- C:\Windows\System32\RgdHddf.exe
  C:\Windows\System32\RgdHddf.exe
  2⤵
  PID:9204
- C:\Windows\System32\XcQLCqs.exe
  C:\Windows\System32\XcQLCqs.exe
  2⤵
  PID:8984
- C:\Windows\System32\DjVinAy.exe
  C:\Windows\System32\DjVinAy.exe
  2⤵
  PID:9168
- C:\Windows\System32\rLqjset.exe
  C:\Windows\System32\rLqjset.exe
  2⤵
  PID:9092
- C:\Windows\System32\kPCOAPh.exe
  C:\Windows\System32\kPCOAPh.exe
  2⤵
  PID:9224
- C:\Windows\System32\LnCigta.exe
  C:\Windows\System32\LnCigta.exe
  2⤵
  PID:9244
- C:\Windows\System32\lmDNjEx.exe
  C:\Windows\System32\lmDNjEx.exe
  2⤵
  PID:9260
- C:\Windows\System32\eBjIJBX.exe
  C:\Windows\System32\eBjIJBX.exe
  2⤵
  PID:9284
- C:\Windows\System32\ExRzuVc.exe
  C:\Windows\System32\ExRzuVc.exe
  2⤵
  PID:9308
- C:\Windows\System32\ktBNpao.exe
  C:\Windows\System32\ktBNpao.exe
  2⤵
  PID:9332
- C:\Windows\System32\kVovorr.exe
  C:\Windows\System32\kVovorr.exe
  2⤵
  PID:9380
- C:\Windows\System32\RvcPMfD.exe
  C:\Windows\System32\RvcPMfD.exe
  2⤵
  PID:9396
- C:\Windows\System32\bPeyNNc.exe
  C:\Windows\System32\bPeyNNc.exe
  2⤵
  PID:9456
- C:\Windows\System32\YVUQSFx.exe
  C:\Windows\System32\YVUQSFx.exe
  2⤵
  PID:9472
- C:\Windows\System32\hxwkUNO.exe
  C:\Windows\System32\hxwkUNO.exe
  2⤵
  PID:9500
- C:\Windows\System32\AfbtcLj.exe
  C:\Windows\System32\AfbtcLj.exe
  2⤵
  PID:9520
- C:\Windows\System32\rBhiYEs.exe
  C:\Windows\System32\rBhiYEs.exe
  2⤵
  PID:9564
- C:\Windows\System32\PjUCnDW.exe
  C:\Windows\System32\PjUCnDW.exe
  2⤵
  PID:9584
- C:\Windows\System32\PWcgOYK.exe
  C:\Windows\System32\PWcgOYK.exe
  2⤵
  PID:9624
- C:\Windows\System32\OUegEdu.exe
  C:\Windows\System32\OUegEdu.exe
  2⤵
  PID:9640
- C:\Windows\System32\VdrKblM.exe
  C:\Windows\System32\VdrKblM.exe
  2⤵
  PID:9668
- C:\Windows\System32\GidzpGm.exe
  C:\Windows\System32\GidzpGm.exe
  2⤵
  PID:9688
- C:\Windows\System32\YNRlCfv.exe
  C:\Windows\System32\YNRlCfv.exe
  2⤵
  PID:9724
- C:\Windows\System32\PFZhkES.exe
  C:\Windows\System32\PFZhkES.exe
  2⤵
  PID:9760
- C:\Windows\System32\WuUdLGU.exe
  C:\Windows\System32\WuUdLGU.exe
  2⤵
  PID:9788
- C:\Windows\System32\tWaubEN.exe
  C:\Windows\System32\tWaubEN.exe
  2⤵
  PID:9820
- C:\Windows\System32\hxKgfBX.exe
  C:\Windows\System32\hxKgfBX.exe
  2⤵
  PID:9836
- C:\Windows\System32\COPXOjp.exe
  C:\Windows\System32\COPXOjp.exe
  2⤵
  PID:9864
- C:\Windows\System32\YSefBIR.exe
  C:\Windows\System32\YSefBIR.exe
  2⤵
  PID:9900
- C:\Windows\System32\zUmkUZo.exe
  C:\Windows\System32\zUmkUZo.exe
  2⤵
  PID:9940
- C:\Windows\System32\XBpheAO.exe
  C:\Windows\System32\XBpheAO.exe
  2⤵
  PID:9960
- C:\Windows\System32\jrKOpwU.exe
  C:\Windows\System32\jrKOpwU.exe
  2⤵
  PID:9980
- C:\Windows\System32\bcliEiF.exe
  C:\Windows\System32\bcliEiF.exe
  2⤵
  PID:10000
- C:\Windows\System32\OYCqlwC.exe
  C:\Windows\System32\OYCqlwC.exe
  2⤵
  PID:10044
- C:\Windows\System32\dXrFEsf.exe
  C:\Windows\System32\dXrFEsf.exe
  2⤵
  PID:10060
- C:\Windows\System32\qzxNsXV.exe
  C:\Windows\System32\qzxNsXV.exe
  2⤵
  PID:10144
- C:\Windows\System32\uePCilK.exe
  C:\Windows\System32\uePCilK.exe
  2⤵
  PID:10172
- C:\Windows\System32\FXNISux.exe
  C:\Windows\System32\FXNISux.exe
  2⤵
  PID:10192
- C:\Windows\System32\FclcsLN.exe
  C:\Windows\System32\FclcsLN.exe
  2⤵
  PID:10216
- C:\Windows\System32\JljXxFV.exe
  C:\Windows\System32\JljXxFV.exe
  2⤵
  PID:9252
- C:\Windows\System32\HRKrSZN.exe
  C:\Windows\System32\HRKrSZN.exe
  2⤵
  PID:9300
- C:\Windows\System32\UQPZrEf.exe
  C:\Windows\System32\UQPZrEf.exe
  2⤵
  PID:9352
- C:\Windows\System32\xwWJaVw.exe
  C:\Windows\System32\xwWJaVw.exe
  2⤵
  PID:9420
- C:\Windows\System32\axEsbiE.exe
  C:\Windows\System32\axEsbiE.exe
  2⤵
  PID:9496
- C:\Windows\System32\vFsMoNC.exe
  C:\Windows\System32\vFsMoNC.exe
  2⤵
  PID:9532
- C:\Windows\System32\NCEJxPF.exe
  C:\Windows\System32\NCEJxPF.exe
  2⤵
  PID:9600
- C:\Windows\System32\EfHVNHB.exe
  C:\Windows\System32\EfHVNHB.exe
  2⤵
  PID:9648
- C:\Windows\System32\opVbAmP.exe
  C:\Windows\System32\opVbAmP.exe
  2⤵
  PID:9696
- C:\Windows\System32\FzHGgxw.exe
  C:\Windows\System32\FzHGgxw.exe
  2⤵
  PID:9772
- C:\Windows\System32\XnFnsti.exe
  C:\Windows\System32\XnFnsti.exe
  2⤵
  PID:9816
- C:\Windows\System32\hXujdUS.exe
  C:\Windows\System32\hXujdUS.exe
  2⤵
  PID:9952
- C:\Windows\System32\dlLZWfv.exe
  C:\Windows\System32\dlLZWfv.exe
  2⤵
  PID:9996
- C:\Windows\System32\JKPVtiD.exe
  C:\Windows\System32\JKPVtiD.exe
  2⤵
  PID:10056
- C:\Windows\System32\wcLefxk.exe
  C:\Windows\System32\wcLefxk.exe
  2⤵
  PID:1264
- C:\Windows\System32\oOGJUGq.exe
  C:\Windows\System32\oOGJUGq.exe
  2⤵
  PID:10188
- C:\Windows\System32\jFToXYB.exe
  C:\Windows\System32\jFToXYB.exe
  2⤵
  PID:8296
- C:\Windows\System32\PaxrrGB.exe
  C:\Windows\System32\PaxrrGB.exe
  2⤵
  PID:9340
- C:\Windows\System32\rpBrUzo.exe
  C:\Windows\System32\rpBrUzo.exe
  2⤵
  PID:9448
- C:\Windows\System32\ksFSVXs.exe
  C:\Windows\System32\ksFSVXs.exe
  2⤵
  PID:9796
- C:\Windows\System32\XTZZXqn.exe
  C:\Windows\System32\XTZZXqn.exe
  2⤵
  PID:9916
- C:\Windows\System32\rRrlVOC.exe
  C:\Windows\System32\rRrlVOC.exe
  2⤵
  PID:10184
- C:\Windows\System32\TYZUvWm.exe
  C:\Windows\System32\TYZUvWm.exe
  2⤵
  PID:9572
- C:\Windows\System32\qjSQnbu.exe
  C:\Windows\System32\qjSQnbu.exe
  2⤵
  PID:9888
- C:\Windows\System32\zdwXufk.exe
  C:\Windows\System32\zdwXufk.exe
  2⤵
  PID:10272
- C:\Windows\System32\qCrgOvU.exe
  C:\Windows\System32\qCrgOvU.exe
  2⤵
  PID:10304
- C:\Windows\System32\uASsMFc.exe
  C:\Windows\System32\uASsMFc.exe
  2⤵
  PID:10324
- C:\Windows\System32\KPIiTfB.exe
  C:\Windows\System32\KPIiTfB.exe
  2⤵
  PID:10344
- C:\Windows\System32\ZmdMoKf.exe
  C:\Windows\System32\ZmdMoKf.exe
  2⤵
  PID:10388
- C:\Windows\System32\XMHBmSt.exe
  C:\Windows\System32\XMHBmSt.exe
  2⤵
  PID:10412
- C:\Windows\System32\iNhIhFZ.exe
  C:\Windows\System32\iNhIhFZ.exe
  2⤵
  PID:10436
- C:\Windows\System32\dPiwTdx.exe
  C:\Windows\System32\dPiwTdx.exe
  2⤵
  PID:10452
- C:\Windows\System32\gZzRIGL.exe
  C:\Windows\System32\gZzRIGL.exe
  2⤵
  PID:10480
- C:\Windows\System32\cyyTXCb.exe
  C:\Windows\System32\cyyTXCb.exe
  2⤵
  PID:10532
- C:\Windows\System32\hROKjet.exe
  C:\Windows\System32\hROKjet.exe
  2⤵
  PID:10564
- C:\Windows\System32\cZLsKul.exe
  C:\Windows\System32\cZLsKul.exe
  2⤵
  PID:10580
- C:\Windows\System32\ZihsymF.exe
  C:\Windows\System32\ZihsymF.exe
  2⤵
  PID:10608
- C:\Windows\System32\DeGUCyn.exe
  C:\Windows\System32\DeGUCyn.exe
  2⤵
  PID:10636
- C:\Windows\System32\mQdfsSV.exe
  C:\Windows\System32\mQdfsSV.exe
  2⤵
  PID:10664
- C:\Windows\System32\WtARSBa.exe
  C:\Windows\System32\WtARSBa.exe
  2⤵
  PID:10692
- C:\Windows\System32\ZkYRLWn.exe
  C:\Windows\System32\ZkYRLWn.exe
  2⤵
  PID:10712
- C:\Windows\System32\mTNemAm.exe
  C:\Windows\System32\mTNemAm.exe
  2⤵
  PID:10736
- C:\Windows\System32\KcPYUtN.exe
  C:\Windows\System32\KcPYUtN.exe
  2⤵
  PID:10752
- C:\Windows\System32\EMxZuNC.exe
  C:\Windows\System32\EMxZuNC.exe
  2⤵
  PID:10776
- C:\Windows\System32\eyzhwVo.exe
  C:\Windows\System32\eyzhwVo.exe
  2⤵
  PID:10808
- C:\Windows\System32\PJdAnYb.exe
  C:\Windows\System32\PJdAnYb.exe
  2⤵
  PID:10840
- C:\Windows\System32\GdtMpIJ.exe
  C:\Windows\System32\GdtMpIJ.exe
  2⤵
  PID:10896
- C:\Windows\System32\LnQwfNQ.exe
  C:\Windows\System32\LnQwfNQ.exe
  2⤵
  PID:10916
- C:\Windows\System32\qOzDqnG.exe
  C:\Windows\System32\qOzDqnG.exe
  2⤵
  PID:10940
- C:\Windows\System32\iQseeBx.exe
  C:\Windows\System32\iQseeBx.exe
  2⤵
  PID:10964
- C:\Windows\System32\hPeAvWE.exe
  C:\Windows\System32\hPeAvWE.exe
  2⤵
  PID:10980
- C:\Windows\System32\GGFGxeN.exe
  C:\Windows\System32\GGFGxeN.exe
  2⤵
  PID:11040
- C:\Windows\System32\kZCviXp.exe
  C:\Windows\System32\kZCviXp.exe
  2⤵
  PID:11064
- C:\Windows\System32\wVfxVST.exe
  C:\Windows\System32\wVfxVST.exe
  2⤵
  PID:11088
- C:\Windows\System32\pyXmIze.exe
  C:\Windows\System32\pyXmIze.exe
  2⤵
  PID:11116
- C:\Windows\System32\FgPwUoW.exe
  C:\Windows\System32\FgPwUoW.exe
  2⤵
  PID:11144
- C:\Windows\System32\uiJDolo.exe
  C:\Windows\System32\uiJDolo.exe
  2⤵
  PID:11176
- C:\Windows\System32\DRuwdQO.exe
  C:\Windows\System32\DRuwdQO.exe
  2⤵
  PID:11204
- C:\Windows\System32\XXrIkLq.exe
  C:\Windows\System32\XXrIkLq.exe
  2⤵
  PID:11232
- C:\Windows\System32\yJcNTBi.exe
  C:\Windows\System32\yJcNTBi.exe
  2⤵
  PID:11260
- C:\Windows\System32\hTlmakd.exe
  C:\Windows\System32\hTlmakd.exe
  2⤵
  PID:10288
- C:\Windows\System32\rISWUee.exe
  C:\Windows\System32\rISWUee.exe
  2⤵
  PID:10332
- C:\Windows\System32\wpQoMDa.exe
  C:\Windows\System32\wpQoMDa.exe
  2⤵
  PID:10384
- C:\Windows\System32\YkoIlIC.exe
  C:\Windows\System32\YkoIlIC.exe
  2⤵
  PID:10408
- C:\Windows\System32\opzjhAT.exe
  C:\Windows\System32\opzjhAT.exe
  2⤵
  PID:10448
- C:\Windows\System32\svcuxFK.exe
  C:\Windows\System32\svcuxFK.exe
  2⤵
  PID:10496
- C:\Windows\System32\qRtNDuG.exe
  C:\Windows\System32\qRtNDuG.exe
  2⤵
  PID:10588
- C:\Windows\System32\hshxaFD.exe
  C:\Windows\System32\hshxaFD.exe
  2⤵
  PID:10624
- C:\Windows\System32\diEaFNv.exe
  C:\Windows\System32\diEaFNv.exe
  2⤵
  PID:10708
- C:\Windows\System32\THoEqrC.exe
  C:\Windows\System32\THoEqrC.exe
  2⤵
  PID:10760
- C:\Windows\System32\hHAVKTN.exe
  C:\Windows\System32\hHAVKTN.exe
  2⤵
  PID:10824
- C:\Windows\System32\mXdRJYY.exe
  C:\Windows\System32\mXdRJYY.exe
  2⤵
  PID:10868
- C:\Windows\System32\ahQoVQO.exe
  C:\Windows\System32\ahQoVQO.exe
  2⤵
  PID:10936
- C:\Windows\System32\odjYiEK.exe
  C:\Windows\System32\odjYiEK.exe
  2⤵
  PID:10996
- C:\Windows\System32\xcMCivR.exe
  C:\Windows\System32\xcMCivR.exe
  2⤵
  PID:11056
- C:\Windows\System32\EfKQUwt.exe
  C:\Windows\System32\EfKQUwt.exe
  2⤵
  PID:11104
- C:\Windows\System32\yEyYLYr.exe
  C:\Windows\System32\yEyYLYr.exe
  2⤵
  PID:11152
- C:\Windows\System32\mxjXBAi.exe
  C:\Windows\System32\mxjXBAi.exe
  2⤵
  PID:11228
- C:\Windows\System32\cCoyVPh.exe
  C:\Windows\System32\cCoyVPh.exe
  2⤵
  PID:10376
- C:\Windows\System32\iLMFCYU.exe
  C:\Windows\System32\iLMFCYU.exe
  2⤵
  PID:10428
- C:\Windows\System32\iRBMqka.exe
  C:\Windows\System32\iRBMqka.exe
  2⤵
  PID:5936
- C:\Windows\System32\oRnecrB.exe
  C:\Windows\System32\oRnecrB.exe
  2⤵
  PID:10728
- C:\Windows\System32\FjGwzCi.exe
  C:\Windows\System32\FjGwzCi.exe
  2⤵
  PID:10932
- C:\Windows\System32\VpKCDBn.exe
  C:\Windows\System32\VpKCDBn.exe
  2⤵
  PID:11020
- C:\Windows\System32\JhUybSM.exe
  C:\Windows\System32\JhUybSM.exe
  2⤵
  PID:10336
- C:\Windows\System32\cotSWIN.exe
  C:\Windows\System32\cotSWIN.exe
  2⤵
  PID:10420
- C:\Windows\System32\DURTbrF.exe
  C:\Windows\System32\DURTbrF.exe
  2⤵
  PID:10724
- C:\Windows\System32\hfumDUJ.exe
  C:\Windows\System32\hfumDUJ.exe
  2⤵
  PID:11312
- C:\Windows\System32\DCRGoTT.exe
  C:\Windows\System32\DCRGoTT.exe
  2⤵
  PID:11348
- C:\Windows\System32\pCEnPZV.exe
  C:\Windows\System32\pCEnPZV.exe
  2⤵
  PID:11364
- C:\Windows\System32\ChTnTYw.exe
  C:\Windows\System32\ChTnTYw.exe
  2⤵
  PID:11380
- C:\Windows\System32\tnMvFTc.exe
  C:\Windows\System32\tnMvFTc.exe
  2⤵
  PID:11396
- C:\Windows\System32\KHnJfNO.exe
  C:\Windows\System32\KHnJfNO.exe
  2⤵
  PID:11436
- C:\Windows\System32\ioxprGB.exe
  C:\Windows\System32\ioxprGB.exe
  2⤵
  PID:11468
- C:\Windows\System32\JOKBkEv.exe
  C:\Windows\System32\JOKBkEv.exe
  2⤵
  PID:11484
- C:\Windows\System32\neBVoNe.exe
  C:\Windows\System32\neBVoNe.exe
  2⤵
  PID:11568
- C:\Windows\System32\jhsMpRF.exe
  C:\Windows\System32\jhsMpRF.exe
  2⤵
  PID:11592
- C:\Windows\System32\zJaFgAO.exe
  C:\Windows\System32\zJaFgAO.exe
  2⤵
  PID:11632
- C:\Windows\System32\sLtJeFv.exe
  C:\Windows\System32\sLtJeFv.exe
  2⤵
  PID:11676
- C:\Windows\System32\ZNSDqni.exe
  C:\Windows\System32\ZNSDqni.exe
  2⤵
  PID:11704
- C:\Windows\System32\PmhXFhd.exe
  C:\Windows\System32\PmhXFhd.exe
  2⤵
  PID:11728
- C:\Windows\System32\DobzUsc.exe
  C:\Windows\System32\DobzUsc.exe
  2⤵
  PID:11748
- C:\Windows\System32\xWXrUGQ.exe
  C:\Windows\System32\xWXrUGQ.exe
  2⤵
  PID:11800
- C:\Windows\System32\pKoYEkz.exe
  C:\Windows\System32\pKoYEkz.exe
  2⤵
  PID:11816
- C:\Windows\System32\dxZjrjh.exe
  C:\Windows\System32\dxZjrjh.exe
  2⤵
  PID:11844
- C:\Windows\System32\EDxqADU.exe
  C:\Windows\System32\EDxqADU.exe
  2⤵
  PID:11860
- C:\Windows\System32\LEUpyLk.exe
  C:\Windows\System32\LEUpyLk.exe
  2⤵
  PID:11896
- C:\Windows\System32\VisXVwd.exe
  C:\Windows\System32\VisXVwd.exe
  2⤵
  PID:11912
- C:\Windows\System32\AmHAgEQ.exe
  C:\Windows\System32\AmHAgEQ.exe
  2⤵
  PID:11936
- C:\Windows\System32\eKDHyBN.exe
  C:\Windows\System32\eKDHyBN.exe
  2⤵
  PID:11952
- C:\Windows\System32\aUXmfDb.exe
  C:\Windows\System32\aUXmfDb.exe
  2⤵
  PID:11976
- C:\Windows\System32\radownX.exe
  C:\Windows\System32\radownX.exe
  2⤵
  PID:12040
- C:\Windows\System32\ZXGKHvE.exe
  C:\Windows\System32\ZXGKHvE.exe
  2⤵
  PID:12068
- C:\Windows\System32\fgsgOUb.exe
  C:\Windows\System32\fgsgOUb.exe
  2⤵
  PID:12088
- C:\Windows\System32\DyOYTHt.exe
  C:\Windows\System32\DyOYTHt.exe
  2⤵
  PID:12108
- C:\Windows\System32\QfatBUZ.exe
  C:\Windows\System32\QfatBUZ.exe
  2⤵
  PID:12124
- C:\Windows\System32\xixuFDS.exe
  C:\Windows\System32\xixuFDS.exe
  2⤵
  PID:12144
- C:\Windows\System32\RABMXBo.exe
  C:\Windows\System32\RABMXBo.exe
  2⤵
  PID:12164
- C:\Windows\System32\cchObOc.exe
  C:\Windows\System32\cchObOc.exe
  2⤵
  PID:12212
- C:\Windows\System32\edNyKkj.exe
  C:\Windows\System32\edNyKkj.exe
  2⤵
  PID:12264
- C:\Windows\System32\YldqtwM.exe
  C:\Windows\System32\YldqtwM.exe
  2⤵
  PID:11136
- C:\Windows\System32\RbXxiKE.exe
  C:\Windows\System32\RbXxiKE.exe
  2⤵
  PID:10952
- C:\Windows\System32\jHMZWlK.exe
  C:\Windows\System32\jHMZWlK.exe
  2⤵
  PID:11288
- C:\Windows\System32\XDbeoQH.exe
  C:\Windows\System32\XDbeoQH.exe
  2⤵
  PID:11412
- C:\Windows\System32\ztRRcZi.exe
  C:\Windows\System32\ztRRcZi.exe
  2⤵
  PID:11292
- C:\Windows\System32\YHXaPVF.exe
  C:\Windows\System32\YHXaPVF.exe
  2⤵
  PID:11372
- C:\Windows\System32\LCxIMyd.exe
  C:\Windows\System32\LCxIMyd.exe
  2⤵
  PID:11420
- C:\Windows\System32\JGKKtVg.exe
  C:\Windows\System32\JGKKtVg.exe
  2⤵
  PID:11548
- C:\Windows\System32\mpFUngT.exe
  C:\Windows\System32\mpFUngT.exe
  2⤵
  PID:11584
- C:\Windows\System32\zOujhAQ.exe
  C:\Windows\System32\zOujhAQ.exe
  2⤵
  PID:11656
- C:\Windows\System32\Ofiknrv.exe
  C:\Windows\System32\Ofiknrv.exe
  2⤵
  PID:11684
- C:\Windows\System32\yQWyTLx.exe
  C:\Windows\System32\yQWyTLx.exe
  2⤵
  PID:11716
- C:\Windows\System32\yVjzMEz.exe
  C:\Windows\System32\yVjzMEz.exe
  2⤵
  PID:11768
- C:\Windows\System32\ypuClBZ.exe
  C:\Windows\System32\ypuClBZ.exe
  2⤵
  PID:11828
- C:\Windows\System32\uLAaFZn.exe
  C:\Windows\System32\uLAaFZn.exe
  2⤵
  PID:11880
- C:\Windows\System32\qWybhtE.exe
  C:\Windows\System32\qWybhtE.exe
  2⤵
  PID:11968
- C:\Windows\System32\RjImRTg.exe
  C:\Windows\System32\RjImRTg.exe
  2⤵
  PID:12052
- C:\Windows\System32\pDycdPh.exe
  C:\Windows\System32\pDycdPh.exe
  2⤵
  PID:12140
- C:\Windows\System32\ZehNUZm.exe
  C:\Windows\System32\ZehNUZm.exe
  2⤵
  PID:12160
- C:\Windows\System32\bCfCxac.exe
  C:\Windows\System32\bCfCxac.exe
  2⤵
  PID:12236
- C:\Windows\System32\hZTqFld.exe
  C:\Windows\System32\hZTqFld.exe
  2⤵
  PID:10468
- C:\Windows\System32\LXAGPvY.exe
  C:\Windows\System32\LXAGPvY.exe
  2⤵
  PID:11404
- C:\Windows\System32\YxGCYMI.exe
  C:\Windows\System32\YxGCYMI.exe
  2⤵
  PID:11332
- C:\Windows\System32\CVtLPuD.exe
  C:\Windows\System32\CVtLPuD.exe
  2⤵
  PID:11580
- C:\Windows\System32\uSgVgVq.exe
  C:\Windows\System32\uSgVgVq.exe
  2⤵
  PID:11576
- C:\Windows\System32\DWdoqcZ.exe
  C:\Windows\System32\DWdoqcZ.exe
  2⤵
  PID:11840
- C:\Windows\System32\MbMrtdB.exe
  C:\Windows\System32\MbMrtdB.exe
  2⤵
  PID:12036
- C:\Windows\System32\bdbnoAS.exe
  C:\Windows\System32\bdbnoAS.exe
  2⤵
  PID:12172
- C:\Windows\System32\ptKzuiR.exe
  C:\Windows\System32\ptKzuiR.exe
  2⤵
  PID:532
- C:\Windows\System32\dbUgplI.exe
  C:\Windows\System32\dbUgplI.exe
  2⤵
  PID:2624
- C:\Windows\System32\wcuLYxC.exe
  C:\Windows\System32\wcuLYxC.exe
  2⤵
  PID:11628
- C:\Windows\System32\zJMvnup.exe
  C:\Windows\System32\zJMvnup.exe
  2⤵
  PID:12000
- C:\Windows\System32\wbkgkVG.exe
  C:\Windows\System32\wbkgkVG.exe
  2⤵
  PID:1152
- C:\Windows\System32\nzHxFLw.exe
  C:\Windows\System32\nzHxFLw.exe
  2⤵
  PID:11444
- C:\Windows\System32\JMDlSPB.exe
  C:\Windows\System32\JMDlSPB.exe
  2⤵
  PID:12176
- C:\Windows\System32\hmukoxJ.exe
  C:\Windows\System32\hmukoxJ.exe
  2⤵
  PID:11516
- C:\Windows\System32\xposnUu.exe
  C:\Windows\System32\xposnUu.exe
  2⤵
  PID:12308
- C:\Windows\System32\RQchBXD.exe
  C:\Windows\System32\RQchBXD.exe
  2⤵
  PID:12340
- C:\Windows\System32\APfQxzA.exe
  C:\Windows\System32\APfQxzA.exe
  2⤵
  PID:12360
- C:\Windows\System32\jLfdAWw.exe
  C:\Windows\System32\jLfdAWw.exe
  2⤵
  PID:12420
- C:\Windows\System32\RAPDsSD.exe
  C:\Windows\System32\RAPDsSD.exe
  2⤵
  PID:12440
- C:\Windows\System32\PxhxKpD.exe
  C:\Windows\System32\PxhxKpD.exe
  2⤵
  PID:12460
- C:\Windows\System32\xOAjgwC.exe
  C:\Windows\System32\xOAjgwC.exe
  2⤵
  PID:12484
- C:\Windows\System32\ZdDyAtC.exe
  C:\Windows\System32\ZdDyAtC.exe
  2⤵
  PID:12504
- C:\Windows\System32\vIcRDTq.exe
  C:\Windows\System32\vIcRDTq.exe
  2⤵
  PID:12528
- C:\Windows\System32\uulnJjx.exe
  C:\Windows\System32\uulnJjx.exe
  2⤵
  PID:12548
- C:\Windows\System32\EEnQCuq.exe
  C:\Windows\System32\EEnQCuq.exe
  2⤵
  PID:12600
- C:\Windows\System32\FZSOqPx.exe
  C:\Windows\System32\FZSOqPx.exe
  2⤵
  PID:12648
- C:\Windows\System32\uyUpGBm.exe
  C:\Windows\System32\uyUpGBm.exe
  2⤵
  PID:12680
- C:\Windows\System32\wpfbndI.exe
  C:\Windows\System32\wpfbndI.exe
  2⤵
  PID:12704
- C:\Windows\System32\yFlRoUZ.exe
  C:\Windows\System32\yFlRoUZ.exe
  2⤵
  PID:12720
- C:\Windows\System32\PLLVxZX.exe
  C:\Windows\System32\PLLVxZX.exe
  2⤵
  PID:12760
- C:\Windows\System32\AkuhQTs.exe
  C:\Windows\System32\AkuhQTs.exe
  2⤵
  PID:12788
- C:\Windows\System32\yeuqYLm.exe
  C:\Windows\System32\yeuqYLm.exe
  2⤵
  PID:12804
- C:\Windows\System32\yhFVUFg.exe
  C:\Windows\System32\yhFVUFg.exe
  2⤵
  PID:12832
- C:\Windows\System32\eXWwCcv.exe
  C:\Windows\System32\eXWwCcv.exe
  2⤵
  PID:12852
- C:\Windows\System32\UzFRtGi.exe
  C:\Windows\System32\UzFRtGi.exe
  2⤵
  PID:12900
- C:\Windows\System32\PyeVhDn.exe
  C:\Windows\System32\PyeVhDn.exe
  2⤵
  PID:12920
- C:\Windows\System32\cTkSsMG.exe
  C:\Windows\System32\cTkSsMG.exe
  2⤵
  PID:12960
- C:\Windows\System32\VMgEiod.exe
  C:\Windows\System32\VMgEiod.exe
  2⤵
  PID:12980
- C:\Windows\System32\woPsROM.exe
  C:\Windows\System32\woPsROM.exe
  2⤵
  PID:13004
- C:\Windows\System32\CDkEret.exe
  C:\Windows\System32\CDkEret.exe
  2⤵
  PID:13028
- C:\Windows\System32\vexufgp.exe
  C:\Windows\System32\vexufgp.exe
  2⤵
  PID:13056
- C:\Windows\System32\kbZGEPq.exe
  C:\Windows\System32\kbZGEPq.exe
  2⤵
  PID:13088
- C:\Windows\System32\rXOJoBy.exe
  C:\Windows\System32\rXOJoBy.exe
  2⤵
  PID:13112
- C:\Windows\System32\qvukDUz.exe
  C:\Windows\System32\qvukDUz.exe
  2⤵
  PID:13152
- C:\Windows\System32\YsQgxIU.exe
  C:\Windows\System32\YsQgxIU.exe
  2⤵
  PID:13180
- C:\Windows\System32\JMbkbBI.exe
  C:\Windows\System32\JMbkbBI.exe
  2⤵
  PID:13200
- C:\Windows\System32\zAkHeat.exe
  C:\Windows\System32\zAkHeat.exe
  2⤵
  PID:13224
- C:\Windows\System32\lBFmtpP.exe
  C:\Windows\System32\lBFmtpP.exe
  2⤵
  PID:13264
- C:\Windows\System32\ffzhGjM.exe
  C:\Windows\System32\ffzhGjM.exe
  2⤵
  PID:13284
- C:\Windows\System32\NZMfZtf.exe
  C:\Windows\System32\NZMfZtf.exe
  2⤵
  PID:11300
- C:\Windows\System32\woUtclm.exe
  C:\Windows\System32\woUtclm.exe
  2⤵
  PID:12356
- C:\Windows\System32\FPiHQyc.exe
  C:\Windows\System32\FPiHQyc.exe
  2⤵
  PID:12408
- C:\Windows\System32\JvnlUAp.exe
  C:\Windows\System32\JvnlUAp.exe
  2⤵
  PID:12448
- C:\Windows\System32\nbbfqaj.exe
  C:\Windows\System32\nbbfqaj.exe
  2⤵
  PID:12496
- C:\Windows\System32\xGqWTLF.exe
  C:\Windows\System32\xGqWTLF.exe
  2⤵
  PID:12520
- C:\Windows\System32\yzcczab.exe
  C:\Windows\System32\yzcczab.exe
  2⤵
  PID:12668
- C:\Windows\System32\XGGzOxd.exe
  C:\Windows\System32\XGGzOxd.exe
  2⤵
  PID:12744
- C:\Windows\System32\kJmkNOc.exe
  C:\Windows\System32\kJmkNOc.exe
  2⤵
  PID:12800
- C:\Windows\System32\gKOYrkR.exe
  C:\Windows\System32\gKOYrkR.exe
  2⤵
  PID:12864
- C:\Windows\System32\MYYbHZS.exe
  C:\Windows\System32\MYYbHZS.exe
  2⤵
  PID:12860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\CLxbumd.exe

Filesize
1.2MB

MD5
0c55a2487858ba6a23cc22d263a5941f

SHA1
19b337721a6721ee350d9bcb243c2635a485360c

SHA256
a0d984c18de218b4544b12176e73d61b731173e3ef048d9cada202bfc9f08ecd

SHA512
ab6d8bd6e7caa70313c0a88aed191f9f5a0adabad92607b781b1e9a860d73e4a87b58a2ffbc23ccee5ec846bba43dafa2143656af9a0bc14b234a1378ea2b480

Download Submit
C:\Windows\System32\EvNmLYk.exe

Filesize
1.2MB

MD5
c9c70a6d455980734a397769e0c5340e

SHA1
b2ec027033c4be61bcd0b49bd6df808254783e9b

SHA256
7678e8d9a473f2b289a758f312c9ffd501d19614b63815e70801a2f3a85e462b

SHA512
5f33621b3613a92f60faf7722bbf7b93f7ccc85c4929f2150346393e64e2fc5f31cfaf10028dd578444c3f2b847e64abbac69d0bc8d98c152cf201843699ce51

Download Submit
C:\Windows\System32\FfGvBYu.exe

Filesize
1.2MB

MD5
28067ee81e30985c4da3c6ae3db40d7e

SHA1
cec2036238c44f4a6c15b4f10510139e2fdcfee6

SHA256
029bb0b35fabbcb85c20980282522171c897cd35b6a86bc8343e02e675e544e2

SHA512
8c8cdd43a84d1e70315d4008b9a6cc9e42506bda308e8ff58c2f6ddf66363f6df1d7b452687fc2592bcb3db991f476d5a9a86d224f0b90bfc962068378ef8017

Download Submit
C:\Windows\System32\HgrPCXZ.exe

Filesize
1.2MB

MD5
6a873c3dec5174ae3e5e8adf33278eae

SHA1
78d3d4b584d5bd25a3e7dd5aa79dc33abf0348a1

SHA256
c2bb2eeca4d11a34275a39f6a424bf59069a8fa31a0d10567b99d625c1f411aa

SHA512
50bc08b51c86ee30e3db4e6babab02c252ec9ba501379aea7e042c6ae2fc57b7635c3729e4e3dd7a2da0486ffa790355586a3c23c75bdcee270c72348528a178

Download Submit
C:\Windows\System32\HiKBswA.exe

Filesize
1.2MB

MD5
90708a219eded5e278e449b1eeb51d49

SHA1
b5831b66d9fa28df928273c269abd73ae37303d6

SHA256
555b3b8c10c88fc637d266d968089ca73eb8af2b7b9c23c9e0f0fdcdf3f28f16

SHA512
446964995ed6c6c436194922bd9e20409db340e3ca2f953cbfce958684398379e46ee4c893cf27c4139a096e036be79b7914f8ea26283f8d1021f45ca20d4f1a

Download Submit
C:\Windows\System32\KYizabx.exe

Filesize
1.2MB

MD5
cbfca8f0d9a52b54636e873a0172271e

SHA1
aaf0767dc378c4f02d342eb8bdeed455475dd0fe

SHA256
bffdf6999769c26a23d6e18006feb6c7d652eeab3e335099a291c38d2e3c7b78

SHA512
8ecb2646d6f557240e658fb12bbdaa4849fffb2c36344dddf8e046cc3023d31ecc5a6f8b7b0a1f3766ede0935c91679545682684fb06a293bfab25b41a09b7fe

Download Submit
C:\Windows\System32\KZjSlev.exe

Filesize
1.2MB

MD5
abd7d1b70028c9d8a17597085402bd6a

SHA1
4e3930f77854bcb61c79d8999f17e7393397084a

SHA256
020b7f5976101abc708048f0e5f9a41f81ac5247ad0bfc4e2b7a1e6100c08eeb

SHA512
bc731ab64774706d61c476d5b6d71a58e1343725d5e263dd67addb7f6453207773e2178e67b2eafb3ec0050e20b9931d5c13182178fcd355884905ea21bedbb7

Download Submit
C:\Windows\System32\KtAMIhz.exe

Filesize
1.2MB

MD5
5235242dc122d01f4c42ad813e8c7a70

SHA1
f60b743168d435a6bedb2aab33b0e91b383ca920

SHA256
e02e170d0ab664309f98e91498fcd89e2be89929c172188a20a57e216bead8be

SHA512
8c86c614664a1198a9c154319969e4aa77a962ce9b3f9c47d1fc93d8e722e6de177dbc81035245da4edbd8f7dc78306b3c347f372f7c3afc5c32db4977c35db5

Download Submit
C:\Windows\System32\LjPienz.exe

Filesize
1.2MB

MD5
16da57073a2483a8748129fef0b8b238

SHA1
c4906c5b5b9bd5d51534b716e0b4c878ea6868a8

SHA256
2adeb7c2d4d2b081c3cbd770992941424ad6d9c50ac15eb322348685cc550115

SHA512
ab6d0e477171425ab8daaa3dffaf7bdf34b7f961adc7ca8110faa7993730e16fddd1efc719b0c85257a2c0ebaf266a744523de44e6d1a3e6e777313f8e8965cc

Download Submit
C:\Windows\System32\MdWqElg.exe

Filesize
1.2MB

MD5
df13c3258d7728af69bf414bc6f8bb7e

SHA1
eab1da9a11acceb304e15740ee863d55664a9850

SHA256
387e0d65c24e58cab6ed718abaa27a0a3906900badcef9c0b4f776f02907f869

SHA512
e7f6c8635fa7568925db982311b044cc811178019b17c3c297712642ca40316ab47c792d9b0c529bc7a08e3bc8f138871d21fce7251c5f9480bd4d1b5dbb1028

Download Submit
C:\Windows\System32\NGxuODK.exe

Filesize
1.2MB

MD5
c4086377f53923a5415f43685f9b994f

SHA1
99129b5eff10f2c16fd71d3267ab77c55fb1e60a

SHA256
5fc4bf91f917d1c8a34b591e26cfe24224be6274d7e4e99640d3e8b452134228

SHA512
38408dc4abd4e5975bc0eaa5731fabcf4ec22a2128d31f67efb426fa0d3e8e1d525c1e4afd1a1803835688458e9b84fe99570c17f2b9fae945405d14612d8a47

Download Submit
C:\Windows\System32\QGDmpyJ.exe

Filesize
1.2MB

MD5
0952854ecdc2f8b03850edd6643a13ab

SHA1
868a1e34ace6690c7c4d1afa8baefa35856c7306

SHA256
d8165740d5f87f5d34458e87ff9d78ab29da457374b422ec779ee24c55db8497

SHA512
8da98c912b5b29d2a4282a3cfd283d65aed7968fdbc73acd818842da985925cc22b7200da522ebc1c83850a7304254bb874a0850d6d1173e49b5077aab040ed7

Download Submit
C:\Windows\System32\RGgQrch.exe

Filesize
1.2MB

MD5
0ce34f8961bf1c81df1f47ceec2b43cc

SHA1
ca8441c385b022ccb840ad7bcbb44fda0b2c4df8

SHA256
8e862f851b38d5499c06bf16732c08793fc092499710080d9fe16a24d901070f

SHA512
aaf081e62e572e7db92f46dbd5c9058508c144a604f9ea90574e769d290cd1b86cf0b77800ef33ec13f8491b6cd6ab228e128e743d437217aa1d22992425564d

Download Submit
C:\Windows\System32\TmtJkht.exe

Filesize
1.2MB

MD5
352005313ef90d1ec1c2fe3b29c1b8b1

SHA1
b58ab04e7f50b5c91635a1f8ad8a062061aaa2af

SHA256
61932dd0f694b5bf5b465fdeb07807b384513003800d6fd4fb9673dbc3d3bf48

SHA512
58f78d7fdcae7a4cdb3c36a87d644ed8a93bc64b5ae8dc11b3e040dd9db749824d747ee00376b86db9f8de0bbea9936676c3fd63ba9508f93f196dd1710e933d

Download Submit
C:\Windows\System32\UMVPSmT.exe

Filesize
1.2MB

MD5
c56939648217cf9335dfab400aed6c7f

SHA1
857e629fd7d6083c6fe8db3e845fe74306e892b4

SHA256
8025009eff1ce260ba66c6bd967d4dc9369d1884675fb269b88b2ed0ef6a007c

SHA512
693608554aea8b100aec36889b9e8a47adb1784d276137ba036e17ad5400d1434a06a09df599281ce6074f57d9ee53a943a7e4057215faf760310357796bd5c0

Download Submit
C:\Windows\System32\UsgMlYp.exe

Filesize
1.2MB

MD5
5d49bc9f3e1b9e7ea3ee5f4ea07221e2

SHA1
cfc59cb90ae89dfe9d33576e9679fe064534c7b3

SHA256
03b2e3202f52ae15fe97c25a8e5a0d230925bfc2a4eca8f684b9048402df72d9

SHA512
a76157c7df96c2474238de3b30be1754843de7c9472a624bd65839fec0b320eb6598892892db3b659a1a65eb2c60dfdeb98492eea52b6f45ffb3c1f65cc7563c

Download Submit
C:\Windows\System32\YktAuTo.exe

Filesize
1.2MB

MD5
937cc0d4712bad85e8f661215bf3a77b

SHA1
acc5f0afc28c86a3772b9c2519e3502c5df4aab2

SHA256
7bcde60137ec8dc9d1b96cd66aa905cd9657fc353a0cfe986ad40adf9ba95c68

SHA512
7204c4e638ed7e72ab08bef262eb493e3a3a01bea74c6badd42c1e878c24f3610be9deabdcf9e6f429f3f7814a932d9edaf8ca564e8f82d811c7b8d1b0282a55

Download Submit
C:\Windows\System32\eAKhpWD.exe

Filesize
1.2MB

MD5
bc910fe2c7cbcff3fc3db5c18dcfe041

SHA1
81ea9b58198705bdfe13f580524b9bd63b86e199

SHA256
aa8a4fa0a2e85125175b6ca8469a1956f122f2936425d82918d5b91418d106a0

SHA512
24c26ae2ccb5a68b1117fc3160fa14661602d1bcc00c5ca0d4d8b8427cae0e4158b7bfa8a97fa69c62360365e3478e2213fc3f4e2e1d0cc610bbfc93730a430f

Download Submit
C:\Windows\System32\eBPAtkY.exe

Filesize
1.2MB

MD5
74fdb50222cb080dff4e3c4c5c0803bb

SHA1
50dd64facb5ab6b391f2e7d37bc15fe1a8324430

SHA256
4fc8ce8d3ddc0d266db26ce7d133e946032cce4973a9b6a58e049365f42ad8b4

SHA512
d13284a3b7361524713545ccbb62e8b0de69046e1386f5ad61056b8fdcc7195e6c78d0816ea78a86719d6c9f1ffef2e4f95a011f1ba62597d644f1ca9f7cb26e

Download Submit
C:\Windows\System32\fFnWdij.exe

Filesize
1.2MB

MD5
6814fe8da89da27a06dd0c47b2886a73

SHA1
62da8af1f59202ef6718954af6456f42c9f060f6

SHA256
25eae7b7469d51be5849897a735406872448ff20c6e356eace8d07004d2c09da

SHA512
73ce6faad8be18023d4d11b4a76ab0d68388f51f9bbe03079a0b46ecc5f2e582ab29fb82f69612c7b8169bf9b27a4d5875cccb46c22d9f288cfc7c4b3212b71a

Download Submit
C:\Windows\System32\hGblJFI.exe

Filesize
1.2MB

MD5
09f8468287deb673dfec2cc232c35b96

SHA1
76e3b338dfceb95635d8579b837ff05b3227b39f

SHA256
b855f1ced8287ed9a68376a964a283fd3f5c470276e3709c681dabe7c141618c

SHA512
96fe4504c923d8686cc360ff2fca2854abed75a1eb4c63bb0038bd7beae0247f9306f310dd4d990756bb5af4d40033b9921b9f34d7d6c0e35028f9ca8f69f871

Download Submit
C:\Windows\System32\iNNVhaN.exe

Filesize
1.2MB

MD5
8920a68df97b149cbf73b952cfba5e80

SHA1
ede97f385b7b88e6e21afea39bd6a3bb31403b23

SHA256
fb1fe105dc0d19642b168cc43aeb10ace0cd9fb1b15c775c5babc10326e4b520

SHA512
6e7cd00c66fe119131a183dd6b3e1efc826f36261f65a9913077d6bd45f56dc6087810e8604f3c5038afe72e9c4b77eae3935cbf9ab0160565a24566980a1d71

Download Submit
C:\Windows\System32\jeXdOqB.exe

Filesize
1.2MB

MD5
3fe7a1a5b2a36fcd3f08576ee59ab5ef

SHA1
a846c0780698192da6ee056448f1134d36d44448

SHA256
fbb56774f7eb03725033817108efbcb236107704b303b679c58068679dfce82b

SHA512
a7ff4c04b47df703fde28cf103b7d6a53182e624757abf9d4352406638c4c82f300ce8196e8332edef29e116a5e324be94841d84cb01868f027a375876283b8d

Download Submit
C:\Windows\System32\juOTOIV.exe

Filesize
1.2MB

MD5
bf9d4d48650235b8139147a4c27f16ab

SHA1
fdee0ce9a876b294039dcd5f7697cf856f961437

SHA256
3da77f837fef1c26dad10beef40dd73be75f66e845861e0dddb3dde0af2239f2

SHA512
97ce40c72d1d580c8ce2e58e19f874db9d980cf5dfafd3ad71c436e509144518c1983367d56f7692543f6b3bee81002709068af00ab1d004ec3db6e3ec9ffd0f

Download Submit
C:\Windows\System32\mVsoXXt.exe

Filesize
1.2MB

MD5
acbbf5d56ac5d77fc7dfc9755c5da693

SHA1
8eccb1183c22ecb6bc12db551c71ba8de8996c04

SHA256
bbaad252b01f0c8cf50b863a76c79f7b19ba390848c7204f87492325518f56fe

SHA512
c9b4348f8b687e8887dfd4a81c16c5d4a4f3f64d7a83a1d2fac6b9020cb6644b56d3d16dfe889c6d0b70a6d9e43b68dfe4ade9f0caa0e1be79266925ec9b3d78

Download Submit
C:\Windows\System32\pteeYsF.exe

Filesize
1.2MB

MD5
5bd92100784d5961036d6b9665946ea4

SHA1
9304f5ea4cb9bf51c10a122e54685ecdff99b119

SHA256
adc67a4501a9b221575017dec5c2fe52d24e78da09ce5d41f7b1f89c4ea19171

SHA512
2d11ceed0ab14caccfcf291a4b869c756e86ea87f2901354757f75c28302f65369192f240e04288b38c480ad1479280ca1069df73db623848a3af6fb3d24b6b6

Download Submit
C:\Windows\System32\tsPZQTe.exe

Filesize
1.2MB

MD5
c72e1a6813cc91d9d295ed58605d5732

SHA1
1c507fc5bd19b6f346c65498f3ef30c0998f247a

SHA256
e1a09a3184a5437ee625794277a226c80a2fbd02dbe1d8833e11bdea50cd2ca8

SHA512
8fb707e4c0dd963507670313983496054228e619a7bc2ca622b40825ead6272051470a77defc89567473cf8c564f00e2c19cdceb9ad1325f7c107d61b4f8b690

Download Submit
C:\Windows\System32\wOmcaqw.exe

Filesize
1.2MB

MD5
863c21cba73d57886c83340a644b667c

SHA1
48bae03ee048a5cb7abeaf9d69794ac7e84f81d9

SHA256
8f390686d777cc96d9a77122b2a64e1dc7649ddc60ed161edab8c25f7dcbea5d

SHA512
5421301985a5e1b42f61c25da804548e417567ae87c9da2a8e8a641973b2fe93fe16a8ceac23f729e5f15d9939e14d7b3c86e67b134a67b87ad95171162e6c5b

Download Submit
C:\Windows\System32\zBzEsIF.exe

Filesize
1.2MB

MD5
42aaebfab421f3f197a33c94fce7182c

SHA1
ab61c0666b68b68d486944291402afca2f8b3f10

SHA256
f69c6c828cbe3e0c797aa8c7c2a9c259378cb21519a68ac197ecffab2b00e474

SHA512
ab034eed7028f9b2811b56080e5718e10fed43874f96078767a3856ad4910fb07e2510b0ddb40c6d353dd219691e891f0cee1769095becede520ae904fb115d4

Download Submit
C:\Windows\System32\zUgcQlu.exe

Filesize
1.2MB

MD5
cd9a5523805f264ba86d99d0ff201502

SHA1
5848ab0044dd5ba271d2960061e6b63e7d77bdd2

SHA256
2b8bf8f1507d01608df5262691cd8b743d10f6693b48fb7cd3099bd7c1f5ecf1

SHA512
5dcf25011dd8fbcd1cfcc3588f74b1e9e20bf8cd82385cbab447f9d27adc9a66063648b3f132871ad93979acedafbae10e4a25f376685583f8f6ebfb1c55310a

Download Submit
C:\Windows\System32\zehKBiY.exe

Filesize
1.2MB

MD5
2e004cc9a326021603d19aebda34dcd9

SHA1
575b5273c0e7a97f1d6caf2f4f119a385ca80fc0

SHA256
cd6a23cc7dccc37e981b5448a4374bbdf45e2954bf39791ae33d730f01da1ccd

SHA512
92cb203a1a9f84d991c1c16e68b9a610e9fe367fcf8d9ff3a8169a31dfc439e4036d34a0f2a360f29d9c952d3a782f337bff5db7f75fd5066d5f4c1710e5f939

Download Submit
C:\Windows\System32\zeizSJo.exe

Filesize
1.2MB

MD5
e02865dc3780e51a433eb2c2e3f5d7d8

SHA1
a33b1fd025b0ef1ea454c87d609d4a5019e61a31

SHA256
b79b96564625d6c4b62dd7c56dc7eb35584ac5b9a867b996e7f1a5f810ee296f

SHA512
0782dcf3ea6d6ac2259655bfaa51d390c922478298225b8b63d472ca3b06df619f66ef8662cf66ffe234d6ea14e014dba50d18341aca75d2ad8641c0db40d781

Download Submit
memory/464-346-0x00007FF6A2400000-0x00007FF6A27F1000-memory.dmp

Filesize
3.9MB

Download
memory/464-2087-0x00007FF6A2400000-0x00007FF6A27F1000-memory.dmp

Filesize
3.9MB

Download
memory/544-48-0x00007FF79B760000-0x00007FF79BB51000-memory.dmp

Filesize
3.9MB

Download
memory/544-2033-0x00007FF79B760000-0x00007FF79BB51000-memory.dmp

Filesize
3.9MB

Download
memory/544-1981-0x00007FF79B760000-0x00007FF79BB51000-memory.dmp

Filesize
3.9MB

Download
memory/1360-2085-0x00007FF6D8090000-0x00007FF6D8481000-memory.dmp

Filesize
3.9MB

Download
memory/1360-355-0x00007FF6D8090000-0x00007FF6D8481000-memory.dmp

Filesize
3.9MB

Download
memory/1368-369-0x00007FF748C80000-0x00007FF749071000-memory.dmp

Filesize
3.9MB

Download
memory/1368-2095-0x00007FF748C80000-0x00007FF749071000-memory.dmp

Filesize
3.9MB

Download
memory/1444-317-0x00007FF7F6750000-0x00007FF7F6B41000-memory.dmp

Filesize
3.9MB

Download
memory/1444-2076-0x00007FF7F6750000-0x00007FF7F6B41000-memory.dmp

Filesize
3.9MB

Download
memory/2156-338-0x00007FF6484D0000-0x00007FF6488C1000-memory.dmp

Filesize
3.9MB

Download
memory/2156-2081-0x00007FF6484D0000-0x00007FF6488C1000-memory.dmp

Filesize
3.9MB

Download
memory/2388-352-0x00007FF6D0740000-0x00007FF6D0B31000-memory.dmp

Filesize
3.9MB

Download
memory/2388-2089-0x00007FF6D0740000-0x00007FF6D0B31000-memory.dmp

Filesize
3.9MB

Download
memory/2400-2021-0x00007FF749AC0000-0x00007FF749EB1000-memory.dmp

Filesize
3.9MB

Download
memory/2400-1978-0x00007FF749AC0000-0x00007FF749EB1000-memory.dmp

Filesize
3.9MB

Download
memory/2400-15-0x00007FF749AC0000-0x00007FF749EB1000-memory.dmp

Filesize
3.9MB

Download
memory/2524-43-0x00007FF68DF70000-0x00007FF68E361000-memory.dmp

Filesize
3.9MB

Download
memory/2524-2027-0x00007FF68DF70000-0x00007FF68E361000-memory.dmp

Filesize
3.9MB

Download
memory/2524-1980-0x00007FF68DF70000-0x00007FF68E361000-memory.dmp

Filesize
3.9MB

Download
memory/2780-311-0x00007FF6F7960000-0x00007FF6F7D51000-memory.dmp

Filesize
3.9MB

Download
memory/2780-2063-0x00007FF6F7960000-0x00007FF6F7D51000-memory.dmp

Filesize
3.9MB

Download
memory/2892-375-0x00007FF792270000-0x00007FF792661000-memory.dmp

Filesize
3.9MB

Download
memory/2892-2097-0x00007FF792270000-0x00007FF792661000-memory.dmp

Filesize
3.9MB

Download
memory/2920-32-0x00007FF637310000-0x00007FF637701000-memory.dmp

Filesize
3.9MB

Download
memory/2920-2025-0x00007FF637310000-0x00007FF637701000-memory.dmp

Filesize
3.9MB

Download
memory/3396-2036-0x00007FF74B740000-0x00007FF74BB31000-memory.dmp

Filesize
3.9MB

Download
memory/3396-308-0x00007FF74B740000-0x00007FF74BB31000-memory.dmp

Filesize
3.9MB

Download
memory/3480-2023-0x00007FF761CD0000-0x00007FF7620C1000-memory.dmp

Filesize
3.9MB

Download
memory/3480-1979-0x00007FF761CD0000-0x00007FF7620C1000-memory.dmp

Filesize
3.9MB

Download
memory/3480-18-0x00007FF761CD0000-0x00007FF7620C1000-memory.dmp

Filesize
3.9MB

Download
memory/3536-2091-0x00007FF734110000-0x00007FF734501000-memory.dmp

Filesize
3.9MB

Download
memory/3536-356-0x00007FF734110000-0x00007FF734501000-memory.dmp

Filesize
3.9MB

Download
memory/3624-0-0x00007FF743560000-0x00007FF743951000-memory.dmp

Filesize
3.9MB

Download
memory/3624-1-0x0000014138360000-0x0000014138370000-memory.dmp

Filesize
64KB

Download
memory/3876-46-0x00007FF7241D0000-0x00007FF7245C1000-memory.dmp

Filesize
3.9MB

Download
memory/3876-2030-0x00007FF7241D0000-0x00007FF7245C1000-memory.dmp

Filesize
3.9MB

Download
memory/3884-2093-0x00007FF67BAC0000-0x00007FF67BEB1000-memory.dmp

Filesize
3.9MB

Download
memory/3884-367-0x00007FF67BAC0000-0x00007FF67BEB1000-memory.dmp

Filesize
3.9MB

Download
memory/4104-2019-0x00007FF7444B0000-0x00007FF7448A1000-memory.dmp

Filesize
3.9MB

Download
memory/4104-10-0x00007FF7444B0000-0x00007FF7448A1000-memory.dmp

Filesize
3.9MB

Download
memory/4252-2073-0x00007FF61F690000-0x00007FF61FA81000-memory.dmp

Filesize
3.9MB

Download
memory/4252-312-0x00007FF61F690000-0x00007FF61FA81000-memory.dmp

Filesize
3.9MB

Download
memory/4432-2083-0x00007FF733560000-0x00007FF733951000-memory.dmp

Filesize
3.9MB

Download
memory/4432-333-0x00007FF733560000-0x00007FF733951000-memory.dmp

Filesize
3.9MB

Download
memory/4452-298-0x00007FF69A0C0000-0x00007FF69A4B1000-memory.dmp

Filesize
3.9MB

Download
memory/4452-2037-0x00007FF69A0C0000-0x00007FF69A4B1000-memory.dmp

Filesize
3.9MB

Download
memory/4468-327-0x00007FF7190C0000-0x00007FF7194B1000-memory.dmp

Filesize
3.9MB

Download
memory/4468-2079-0x00007FF7190C0000-0x00007FF7194B1000-memory.dmp

Filesize
3.9MB

Download
memory/4728-47-0x00007FF739F70000-0x00007FF73A361000-memory.dmp

Filesize
3.9MB

Download
memory/4728-2031-0x00007FF739F70000-0x00007FF73A361000-memory.dmp

Filesize
3.9MB

Download
memory/5028-322-0x00007FF6105F0000-0x00007FF6109E1000-memory.dmp

Filesize
3.9MB

Download
memory/5028-2077-0x00007FF6105F0000-0x00007FF6109E1000-memory.dmp

Filesize
3.9MB

Download